AWS Certified Advanced Networking - Specialty

Question 1

A financial services company runs a public-facing web application behind an internet-facing Application Load Balancer (ALB) with an HTTPS listener using an ACM certificate. A compliance audit requires that all TLS connections enforce forward secrecy and disallow any TLS versions below 1.2. The security team must ensure that the ALB rejects clients that cannot negotiate a cipher supporting forward secrecy, while minimizing operational overhead. What is the MOST appropriate action?

Accepted Answer

Apply a predefined ELB security policy on the HTTPS listener (for example, ELBSecurityPolicy-FS-1-2-Res-2020-10) that enforces TLS 1.2+ and forward-secrecy ciphers.

Answer

Attach an AWS WAF web ACL to the ALB with a rule that inspects the TLS handshake and blocks weak ciphers.

Answer

Import a stronger ACM certificate that only supports ECDHE cipher suites so weak clients are automatically rejected.

Answer

Place a Network Load Balancer in front of the ALB and terminate TLS on the NLB using a custom OpenSSL cipher configuration.

Question 2

A financial services company exposes a partner-facing REST API behind an Application Load Balancer (ALB) with an HTTPS listener. Security policy now requires that only partner client applications presenting a certificate issued by the company's own private certificate authority may connect, and any connection presenting an untrusted or expired client certificate must be rejected at the ALB before reaching the backend targets. The team wants a managed solution that minimizes custom code on the targets. Which approach meets these requirements?

Accepted Answer

Configure mutual TLS (mTLS) on the ALB HTTPS listener in verify mode, using a trust store in Amazon S3 that contains the private CA's certificate bundle, and let the ALB validate and reject untrusted client certificates.

Answer

Enable mTLS on the ALB in passthrough mode and have each backend target application parse the X-Amzn-Mtls-Clientcert header to validate the certificate chain and expiry.

Answer

Place an AWS WAF web ACL on the ALB with a rule that inspects the TLS client certificate and blocks requests when the issuer does not match the private CA.

Answer

Terminate TLS on a Network Load Balancer with a certificate from AWS Private CA, then forward to the ALB, relying on the NLB to authenticate client certificates.

Question 3

A company runs a payment processing API behind a Network Load Balancer (NLB) with targets registered by instance ID across three Availability Zones. The security team requires that the backend EC2 instances see the original client source IP addresses in their application logs. Additionally, the operations team reports that traffic is being distributed unevenly — some AZs receive far more connections than others, causing hot spots. The NLB currently has cross-zone load balancing disabled. Which combination of actions will preserve original client IPs AND resolve the uneven traffic distribution?

Accepted Answer

Keep the targets registered by instance ID (which preserves client IP by default for NLB) and enable cross-zone load balancing on the NLB.

Answer

Re-register the targets by IP address and enable client IP preservation via a target group attribute, then leave cross-zone load balancing disabled.

Answer

Enable proxy protocol v2 on the target group and configure Route 53 weighted records pointing at each AZ's NLB node to balance traffic.

Answer

Place an Application Load Balancer in front of the NLB, enable the X-Forwarded-For header, and turn on cross-zone load balancing on the ALB.

Question 4

A company runs three microservices behind a single Application Load Balancer using the domain shop.example.com. Requests to /api/orders must reach the orders service, /api/inventory must reach the inventory service, and all other paths must reach a default web frontend service. Each service runs in its own target group. The networking team must implement this routing with the fewest ALB resources while ensuring unmatched requests always land on the frontend. Which configuration meets these requirements?

Accepted Answer

On a single HTTPS listener, add path-based routing rules for /api/orders and /api/inventory pointing to their target groups, and set the listener's default action to forward to the frontend target group.

Answer

Create three separate ALBs, one per target group, and use Route 53 weighted records to distribute traffic among them.

Answer

Create one listener rule per target group using host-based conditions on shop.example.com, and rely on rule priority to break ties for unmatched paths.

Answer

Use a single listener with a fixed-response default action and add path-based rules for all three services including the frontend.

Question 5

A retail company runs a production web application behind an Application Load Balancer. The platform team wants to perform blue/green deployments by gradually shifting a percentage of live traffic from the current version (green) to a new version (blue) on the same listener, monitoring error rates before completing the cutover. Both versions are registered in separate target groups. What is the correct way to configure the ALB to shift a controlled percentage of traffic between the two versions?

Accepted Answer

Create a single listener rule with a forward action that references both target groups and assigns weights to each, adjusting the weights incrementally to shift traffic.

Answer

Create two separate listeners on different ports and use Route 53 weighted records to distribute traffic between the listener endpoints.

Answer

Register both versions' instances in a single target group and rely on the ALB round-robin algorithm to distribute traffic proportionally.

Answer

Configure a host-based routing rule that sends a fixed subset of hostnames to the blue target group and the remainder to green.

Question 6

A financial services company must ensure that no network ACL in any of its 40 member accounts allows unrestricted inbound SSH (TCP port 22 from 0.0.0.0/0). The security team wants automatic detection of violations across all accounts and regions, plus automatic remediation that removes the offending rule whenever one appears. The solution must produce an auditable record of compliance status for regulators. Which approach best meets these requirements?

Accepted Answer

Deploy an AWS Config organization managed rule (via delegated administrator) that checks NACL rules for unrestricted port 22 access, and attach an SSM Automation remediation action that removes the non-compliant entry.

Answer

Enable VPC Flow Logs in every account and use a scheduled Lambda function to parse the logs for SSH traffic from the internet, then invoke an API call to delete the NACL rule.

Answer

Create an AWS WAF web ACL with a rule blocking port 22 and associate it with each VPC to prevent inbound SSH from the internet.

Answer

Use Amazon GuardDuty across the organization to detect SSH brute-force findings and trigger an EventBridge rule that modifies the security groups to deny port 22.

Question 7

A network operations team manages all VPC security groups, route tables, and NACLs through a CloudFormation stack to enforce a consistent baseline. During an incident, an engineer manually added an inbound rule to a security group via the console to restore service quickly. Weeks later, the team wants to programmatically identify every resource in the stack whose live configuration no longer matches the template, without disrupting running resources. Which approach meets this requirement with the least operational effort?

Accepted Answer

Run CloudFormation drift detection on the stack and review the drift status for each resource to identify configuration differences.

Answer

Delete and recreate the stack so all resources are reprovisioned exactly as defined in the template.

Answer

Enable AWS Config with a custom rule that compares each resource against the raw CloudFormation template stored in S3.

Answer

Use VPC Flow Logs and CloudWatch Logs Insights to detect traffic that violates the intended security group baseline.

Question 8

A network operations team manages 40 AWS accounts under a single AWS Organizations structure. They need to deploy an identical set of interface VPC endpoints (for SSM, EC2 Messages, and CloudWatch Logs) into a standard VPC in every account, and ensure that any newly created account automatically receives the same endpoints without manual intervention. The solution must minimize ongoing operational effort. Which approach best meets these requirements?

Accepted Answer

Create a CloudFormation StackSet with service-managed permissions, deploy it to the entire organization, and enable automatic deployment to accounts added to the target OU.

Answer

Write a Lambda function triggered by CloudTrail account-creation events that runs the AWS CLI to create the endpoints in each new account.

Answer

Create a single CloudFormation stack in the management account with cross-account IAM roles and reference each member VPC using nested stacks.

Answer

Use AWS RAM to share the interface endpoints from a central networking account to all member accounts so each account reuses the same endpoints.

Question 9

A financial services company runs a latency-sensitive trading API on an Application Load Balancer in two AWS Regions (us-east-1 and eu-west-1). Global clients connect over TCP with long-lived, encrypted sessions and cannot tolerate connection resets during a regional failure. The API responses are fully dynamic and non-cacheable. The company wants clients to always use a single fixed set of static IP addresses and needs sub-minute automatic regional failover. Which edge design best meets these requirements?

Accepted Answer

Deploy AWS Global Accelerator with two endpoint groups (one per Region), each containing the regional ALB endpoint, and configure health checks for automatic failover.

Answer

Deploy Amazon CloudFront with an origin group referencing both regional ALBs and enable origin failover with a caching policy that disables caching.

Answer

Use Route 53 latency-based routing with health checks pointing at each regional ALB and publish the ALB DNS names to clients.

Answer

Deploy an NLB in each Region with Elastic IPs and use Route 53 failover routing to switch between the two static IP sets.

Question 10

A media company serves a static single-page application and its API from CloudFront. The origin is an S3 bucket in us-east-1 for static assets, and a Regional Application Load Balancer in us-east-1 for the API. Leadership requires that if the entire us-east-1 origin infrastructure becomes unavailable, viewers automatically continue to be served from a warm standby stack deployed in us-west-2 — without requiring any DNS TTL wait or client-side changes. Which CloudFront configuration meets this requirement with the least additional latency during normal operation?

Accepted Answer

Configure a CloudFront origin group for each origin, with the us-east-1 origin as primary and the us-west-2 origin as secondary, and define failover criteria on specific HTTP status codes.

Answer

Create a Route 53 failover routing policy with health checks in front of the origins and point CloudFront at the Route 53 record name as a single origin.

Answer

Use a Lambda@Edge origin-request function that checks origin health on every request and rewrites the origin domain to us-west-2 when us-east-1 fails.

Answer

Deploy AWS Global Accelerator in front of both Regional stacks and set the Global Accelerator endpoint as the CloudFront origin.

Question 11

A media company runs a web application behind an internal (private) Application Load Balancer inside a VPC. They want to serve this application globally through Amazon CloudFront for caching and TLS termination at the edge, but the security team mandates that the ALB must NOT be publicly accessible from the internet — traffic must only reach the ALB from CloudFront. Which design meets these requirements with the least operational overhead?

Accepted Answer

Use a CloudFront VPC origin that points directly to the internal ALB, so CloudFront reaches the private ALB over the AWS network without exposing it publicly.

Answer

Convert the ALB to internet-facing and restrict its security group to the published CloudFront IP ranges managed via an AWS-managed prefix list.

Answer

Place a public Network Load Balancer in front of the internal ALB and configure CloudFront to use the NLB as the origin, restricting the NLB with security groups.

Answer

Set up an AWS Site-to-Site VPN between the CloudFront edge locations and the VPC so the private ALB can be reached without a public endpoint.

Question 12

A media company hosts a static website with downloadable assets in an S3 bucket and serves it globally through CloudFront. Security requires that the S3 bucket be completely private and only accessible through the CloudFront distribution, and the solution must support SSE-KMS encrypted objects while following current AWS best practices. Which approach meets these requirements?

Accepted Answer

Configure Origin Access Control (OAC) on the CloudFront distribution and update the S3 bucket policy to grant access to the distribution's service principal, and grant CloudFront use of the KMS key.

Answer

Use a legacy Origin Access Identity (OAI) and restrict the bucket policy to the OAI's canonical user ID.

Answer

Enable S3 Block Public Access and make the CloudFront distribution use the S3 static website endpoint as a custom origin.

Answer

Attach a bucket policy that allows access only from CloudFront's published edge IP ranges referenced via the aws:SourceIp condition.

Question 13

A network operations team runs a fleet of EC2 instances behind a custom TCP proxy on Nitro-based instance types. Applications intermittently report dropped connections during traffic spikes, but VPC Flow Logs show no REJECT entries and the instances' CPU and memory are healthy. The team suspects the instances are hitting Nitro network performance allowances (such as bandwidth or packet-per-second limits) that cause packets to be queued or dropped. Which approach provides the specific metrics needed to confirm this hypothesis?

Accepted Answer

Install the CloudWatch agent and collect the ethtool-based network performance metrics (bw_in_allowance_exceeded, bw_out_allowance_exceeded, pps_allowance_exceeded, conntrack_allowance_exceeded) exposed by the ENA driver

Answer

Enable VPC Flow Logs with the maximum aggregation interval and analyze the packets and bytes fields per flow in Athena

Answer

Enable Traffic Mirroring on the instances' ENIs and inspect the mirrored packets with a network analyzer appliance

Answer

Use Reachability Analyzer between the clients and the instances to verify there is no path-level packet drop

Question 14

A company runs a Site-to-Site VPN connection to AWS with two tunnels for redundancy. The network operations team wants to be automatically notified within a few minutes whenever either tunnel changes state, and they want to trigger a Lambda function that pages the on-call engineer. They must use native AWS metrics without deploying any agents. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch alarm on the VPN's TunnelState metric in the AWS/VPN namespace for each tunnel, set the threshold to detect the DOWN state (value below 1), and configure the alarm action to publish to an SNS topic that invokes the Lambda function.

Answer

Install the CloudWatch agent on the customer gateway device to push tunnel status to a custom metric, then alarm on that metric and trigger the Lambda function through an SNS subscription.

Answer

Enable VPC Flow Logs on the virtual private gateway attachment and use a CloudWatch Logs metric filter to detect the absence of traffic on a tunnel, then alarm and invoke Lambda.

Answer

Schedule a CloudWatch Events rule every 5 minutes to run a Lambda function that calls DescribeVpnConnections and evaluates the tunnel status field, paging the engineer if a tunnel is down.

Question 15

A global e-commerce company hosts its application on EC2 behind an Application Load Balancer in us-east-1, with CloudFront in front. Users in Southeast Asia have started reporting slow page loads and intermittent errors over the past two days, but internal synthetic canaries running from AWS regions show healthy latency. The network operations team needs to determine whether the degradation is caused by internet path issues (such as an ISP or transit provider problem) affecting specific city/ASN combinations, and quantify the impact on real users without deploying agents. Which AWS capability should the team use?

Accepted Answer

Enable Amazon CloudWatch Internet Monitor for the application's resources to correlate real client traffic with internet health measurements by geography and ASN.

Answer

Configure VPC Flow Logs with a custom format capturing TCP flags to analyze retransmissions from Southeast Asian source IPs.

Answer

Run Reachability Analyzer between the ALB and the CloudFront distribution to identify blocked network paths.

Answer

Deploy additional CloudWatch Synthetics canaries in more AWS regions to increase the sampling of latency measurements.

Question 16

A network operations team stores VPC Flow Logs in a CloudWatch Logs log group. During an unexpected NAT gateway data-processing cost spike, an engineer must quickly identify which private instances (source IP addresses) generated the most outbound bytes over the last 3 hours, without deploying additional infrastructure. What is the FASTEST approach to produce this ranked list?

Accepted Answer

Run a CloudWatch Logs Insights query against the flow log group that parses the bytes field, filters on the NAT gateway ENI, groups by source address with sum(bytes), and sorts descending

Answer

Export the log group to Amazon S3, create an AWS Glue crawler and an Athena table, then run a GROUP BY query on source address

Answer

Enable Traffic Mirroring on the NAT gateway ENI and analyze captured packets with a third-party tool to rank source hosts by volume

Answer

Create a CloudWatch metric filter that increments a custom metric per source IP and view the metric in a CloudWatch dashboard

Question 17

A network operations team runs a Transit Gateway connecting 12 VPCs across a region. Users in one VPC report intermittent slow transfers to a shared services VPC. The team suspects a specific TGW attachment is hitting a throughput ceiling but needs data to confirm before escalating. Without deploying any agents, which approach gives the team the fastest way to identify whether that attachment is saturating its bandwidth limit?

Accepted Answer

View the per-attachment BytesIn/BytesOut CloudWatch metrics that Transit Gateway publishes in the AWS/TransitGateway namespace and compare them against the 100 Gbps per-attachment limit

Answer

Enable VPC Flow Logs on every ENI in both VPCs and manually sum byte counts in Athena to estimate throughput per attachment

Answer

Install the CloudWatch agent on EC2 instances in both VPCs to collect NetworkPacketsIn/Out and correlate spikes with the slowdowns

Answer

Run Reachability Analyzer between instances in the two VPCs to confirm the path and measure the achievable bandwidth

Question 18

A company runs a critical application in a VPC that communicates with an on-premises database over an AWS Direct Connect connection. Users intermittently report slow response times, but the Direct Connect virtual interface metrics and BGP session appear healthy. The network team needs a managed AWS solution that continuously measures round-trip latency and packet loss between the VPC subnets and the on-premises database endpoint, with minimal agent installation and near-real-time CloudWatch metrics for alerting. Which approach best meets these requirements?

Accepted Answer

Configure Amazon CloudWatch Network Monitor with a monitor and probes that specify the VPC source subnets and the on-premises destination IP, publishing latency and packet-loss metrics to CloudWatch.

Answer

Enable VPC Flow Logs with a custom format capturing TCP flags and analyze the logs with Athena to calculate latency and retransmission rates.

Answer

Use Reachability Analyzer between the VPC ENI and the Direct Connect gateway attachment on a scheduled basis to detect the latency source.

Answer

Deploy Amazon CloudWatch Internet Monitor and add the on-premises database prefix as a monitored city-network to track packet loss.

Question 19

A financial services company exposes an internal REST API through an Application Load Balancer reachable only within their VPC. The network operations team wants proactive alerting when the API's HTTPS response latency exceeds a threshold or when the endpoint returns error codes, even during periods with no customer traffic. The monitoring must run from within the private network context and generate CloudWatch metrics and alarms. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Deploy a CloudWatch Synthetics canary configured to run inside the VPC subnets, using a heartbeat/API canary script that issues periodic HTTPS requests to the internal ALB and publishes latency and status-code metrics for CloudWatch alarms.

Answer

Enable VPC Flow Logs on the ALB subnet ENIs and create a metric filter that counts high-latency connections, then alarm on the resulting metric.

Answer

Configure the ALB access logs to write to S3 and use Athena scheduled queries to detect elevated latency and error rates, publishing results back to CloudWatch.

Answer

Create a Route 53 health check pointing at the internal ALB DNS name and alarm on the CloudWatch health-check status metric.

Question 20

A financial services company operates 40 AWS accounts under AWS Organizations, spread across three Regions. The security governance team must continuously evaluate whether any security group in any account permits unrestricted inbound SSH (0.0.0.0/0 on port 22), and they need a single consolidated view of all non-compliant resources across the entire organization without logging into each account. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Deploy AWS Config with the restricted-ssh managed rule in every account and Region using a CloudFormation StackSet, then create an organization-wide AWS Config aggregator in a delegated administrator account to view aggregated compliance results.

Answer

Enable VPC Flow Logs in every account, stream them to a centralized S3 bucket, and run scheduled Athena queries to detect SSH traffic sourced from 0.0.0.0/0.

Answer

Create a single AWS Config rule in the management account and rely on cross-account IAM roles so the rule evaluates security groups in all member accounts and Regions.

Answer

Use AWS Security Hub in one account with the CIS benchmark enabled and manually export findings from each member account into a spreadsheet weekly.

Question 21

A financial services company operates 40 AWS accounts under AWS Organizations. The security governance team must continuously detect and report on security groups that allow unrestricted inbound access (0.0.0.0/0) to ports other than 80 and 443 across all accounts and Regions, and produce a single compliance dashboard for auditors. Which approach best meets these governance requirements with the least operational overhead?

Accepted Answer

Deploy an AWS Config conformance pack containing the restricted-common-ports and vpc-sg-open-only-to-authorized-ports managed rules using an organization-level deployment via the delegated administrator account, aggregating results with a Config aggregator.

Answer

Enable VPC Flow Logs in every account, stream them to a centralized S3 bucket, and run scheduled Athena queries to identify traffic arriving on unauthorized ports from any source.

Answer

Write a Lambda function in each account triggered by EventBridge on a daily schedule that calls DescribeSecurityGroups and publishes non-compliant findings to a central SNS topic.

Answer

Configure AWS Network Firewall in a centralized inspection VPC with stateful rules that block inbound traffic to ports other than 80 and 443, and review the firewall logs for compliance reporting.

Question 22

A security team manages a centralized audit account and needs to continuously verify that no VPC across 40 member accounts (in an AWS Organization) has an internet gateway attached to subnets tagged 'PCI-Restricted'. The team wants a scalable, near-real-time governance solution that produces findings in the audit account without deploying custom Lambda in each member account. Which approach best meets this requirement?

Accepted Answer

Deploy an AWS Config organization custom rule (using a Config-managed Lambda in the delegated administrator account) that evaluates route table associations for PCI-Restricted subnets, and aggregate results in the audit account via an organization aggregator.

Answer

Enable VPC Flow Logs in every member account, stream them to a centralized S3 bucket, and run scheduled Athena queries to detect traffic to 0.0.0.0/0 through an internet gateway.

Answer

Create an IAM role in each member account trusted by the audit account and run a scheduled script that calls DescribeRouteTables in every account to check for igw- routes.

Answer

Use AWS Network Firewall in a centralized inspection VPC with a stateful rule that drops traffic from PCI-Restricted subnets destined to internet gateways, and review the alert logs.

Question 23

A company has a single 10 Gbps dedicated Direct Connect connection at an AWS Direct Connect location, terminating on one physical port. Traffic to AWS has grown, and the network team wants to increase available bandwidth to 20 Gbps while presenting the connection to their router as a single logical interface for simpler management. They also want the ability to add more connections later without reconfiguring VIFs. Which approach meets these requirements?

Accepted Answer

Create a Link Aggregation Group (LAG) using LACP, bundle two 10 Gbps dedicated connections at the same Direct Connect location, and migrate the existing VIFs onto the LAG.

Answer

Provision a second 10 Gbps dedicated connection and configure ECMP across the two connections by advertising the same prefixes over separate BGP sessions on each private VIF.

Answer

Request a hosted connection from a Direct Connect partner and rely on the partner's edge to aggregate bandwidth automatically.

Answer

Enable jumbo frames (9001 MTU) on the existing 10 Gbps connection to effectively double usable throughput.

Question 24

A company has a single production VPC that needs private connectivity to its on-premises data center over an existing 1 Gbps Direct Connect connection. The networking team wants the simplest configuration that provides private, low-latency access to resources in that one VPC and does not require any additional AWS routing constructs beyond what is strictly necessary. Which implementation should the team use?

Accepted Answer

Create a private virtual interface (VIF) on the Direct Connect connection and associate it with a virtual private gateway (VGW) attached to the VPC.

Answer

Create a transit virtual interface (VIF) on the Direct Connect connection and associate it with a Direct Connect gateway connected to a Transit Gateway that attaches the VPC.

Answer

Create a public virtual interface (VIF) on the Direct Connect connection and route VPC traffic to it using an internet gateway.

Answer

Create a hosted connection with a private VIF and associate it directly with the VPC route table without any gateway.

Question 25

A media company runs an on-premises rendering farm connected to AWS through a 10 Gbps Direct Connect connection. They currently upload large render outputs to an Amazon S3 bucket in us-east-1 over the public internet, but want the traffic to traverse the Direct Connect link instead to reduce cost and improve consistency. The workload must reach S3 and other AWS public service endpoints without going through a VPC. Which Direct Connect configuration meets this requirement?

Accepted Answer

Create a public virtual interface (VIF) on the Direct Connect connection and advertise the on-premises prefixes over BGP.

Answer

Create a private virtual interface (VIF) associated with a virtual private gateway attached to a VPC that has an S3 gateway endpoint.

Answer

Create a transit virtual interface (VIF) attached to a Transit Gateway and add a route to the S3 prefix list.

Answer

Create an interface VPC endpoint (PrivateLink) for S3 and route the private VIF traffic through it.

Question 26

A financial services company runs a critical hybrid workload that requires an SLA-backed connection between their on-premises data center and a single AWS Region. The design must survive the failure of any one AWS Direct Connect device, any one on-premises router, and an entire Direct Connect location, while maintaining active connectivity with no reliance on VPN failover. The company wants the AWS-recommended maximum resiliency posture. Which connectivity design meets these requirements?

Accepted Answer

Provision four dedicated connections across two separate Direct Connect locations, with two connections at each location terminating on separate on-premises routers and separate AWS devices.

Answer

Provision two dedicated connections at a single Direct Connect location, terminating on two different AWS devices, each connected to a separate on-premises router.

Answer

Provision one dedicated connection at a Direct Connect location and configure an AWS Site-to-Site VPN over the internet as the backup path using BGP.

Answer

Provision two dedicated connections at two separate Direct Connect locations, each terminating on a single shared on-premises router.

Question 27

A retail company has two Direct Connect locations, one in London and one in Frankfurt, each terminating a dedicated connection with a transit VIF attached to a separate Transit Gateway in eu-west-2 and eu-central-1. The company also has on-premises data centers connected at each Direct Connect location. The networking team wants traffic between the two on-premises data centers to flow directly across the AWS global backbone between the two Direct Connect locations, without traversing the customer's own WAN and without routing through a Transit Gateway. Which approach meets this requirement?

Accepted Answer

Enable SiteLink on the transit VIFs at both Direct Connect locations so the data centers can exchange routes over the AWS global network.

Answer

Create an inter-region Transit Gateway peering between the two Transit Gateways and advertise the on-premises prefixes across the peering.

Answer

Attach both transit VIFs to a single Direct Connect gateway and rely on the Direct Connect gateway to route between the two connections.

Answer

Provision a Site-to-Site VPN between the two customer gateways over public VIFs to bridge the two data centers.

Question 28

A company has a 10 Gbps Direct Connect connection at a single location. They need to provide private connectivity from their on-premises data center to five VPCs spread across three AWS accounts, all attached to a single Transit Gateway in one Region. They want to minimize the number of virtual interfaces they must provision and manage on the Direct Connect connection. Which approach meets these requirements?

Accepted Answer

Create a single transit VIF on the Direct Connect connection and associate it with a Direct Connect gateway that is associated with the Transit Gateway.

Answer

Create one private VIF per VPC and use VPC peering between the VPCs to share the connection.

Answer

Create a public VIF and route traffic to each VPC's public endpoints over the Direct Connect connection.

Answer

Create one private VIF per VPC and associate each with its own virtual private gateway attached to the respective VPC.

Question 29

A company operates 40 VPCs spread across three AWS accounts in the eu-west-1 Region. They connect to two on-premises data centers using Direct Connect. Requirements: (1) all VPCs must reach on-premises networks over Direct Connect, (2) each VPC's CIDR must be advertised to on-premises, and (3) the design must scale to 100+ VPCs while minimizing per-connection management overhead. They currently use one Direct Connect gateway associated directly with each VPC's virtual private gateway. As they grow, they hit the limit on the number of VGWs that can be associated with a single Direct Connect gateway. Which design change best meets the requirements at scale?

Accepted Answer

Deploy a single Transit Gateway shared across accounts via AWS RAM, attach all VPCs to it, and create a Direct Connect gateway association with that Transit Gateway.

Answer

Deploy a Transit Gateway in each account, associate each Transit Gateway with the Direct Connect gateway, and attach the VPCs to their local Transit Gateway.

Answer

Create additional Direct Connect gateways and distribute the VGW associations across them so no single gateway exceeds its VGW association limit.

Answer

Replace Direct Connect with multiple Site-to-Site VPN connections terminated on each VPC's virtual private gateway to avoid Direct Connect gateway limits.

Question 30

A company runs a fleet of EC2 instances in a private subnet of a dual-stack VPC. The instances have both IPv4 and IPv6 addresses. For IPv4, they already reach the internet through a NAT gateway for software updates. The security team now requires that these instances be able to initiate outbound IPv6 connections to the internet (for example, to fetch packages from IPv6-enabled repositories) but must NOT be reachable from the internet over IPv6. Which configuration meets this requirement?

Accepted Answer

Add an egress-only internet gateway to the VPC and add a route for ::/0 pointing to it in the private subnet's route table.

Answer

Route IPv6 traffic through the existing NAT gateway by adding a ::/0 route pointing to the NAT gateway.

Answer

Attach a standard internet gateway and add a ::/0 route to it, then use security groups to block inbound IPv6.

Answer

Assign the instances IPv6 addresses from a BYOIP pool and rely on the default VPC route table to provide outbound-only access.

Question 31

A financial services company runs an identical API stack in us-east-1 and eu-west-1, each fronted by a Network Load Balancer. They use AWS Global Accelerator with both NLBs registered as endpoints across two endpoint groups (one per Region). During a planned maintenance window for the eu-west-1 stack, the network team must gracefully remove that Region from receiving new traffic without deregistering endpoints or changing DNS, while allowing existing connections to complete. Which Global Accelerator configuration change accomplishes this MOST effectively?

Accepted Answer

Set the traffic dial for the eu-west-1 endpoint group to 0 percent so new flows are steered to the us-east-1 endpoint group.

Answer

Lower the endpoint weight of the eu-west-1 NLB to 0 within its endpoint group while leaving the traffic dial at 100 percent.

Answer

Remove the eu-west-1 static anycast IP address from the accelerator so clients only resolve the us-east-1 address.

Answer

Change the accelerator's routing to latency-based so all clients are directed to the closer us-east-1 endpoint group.

Question 32

A gaming company runs a multiplayer backend on EC2 instances behind Network Load Balancers deployed in three AWS Regions (us-east-1, eu-west-1, ap-southeast-1). The game uses custom UDP and TCP protocols on non-HTTP ports and requires the lowest possible latency for players worldwide, static entry-point IP addresses that can be embedded in the game client, and fast regional failover if a Region becomes unhealthy. Which edge design best meets these requirements?

Accepted Answer

Use AWS Global Accelerator with the three regional NLBs as endpoints, relying on its anycast static IP addresses and health-check-based traffic dial.

Answer

Place an Amazon CloudFront distribution in front of the NLBs and use latency-based Route 53 records to route players to the nearest Region.

Answer

Create latency-based Route 53 alias records pointing to each regional NLB and enable Route 53 health checks for failover.

Answer

Deploy an Application Load Balancer in each Region with CloudFront and Lambda@Edge to steer players to the closest healthy Region.

Question 33

A company operates a centralized security account containing a Gateway Load Balancer (GWLB) fronting a fleet of firewall appliances. Application teams in separate AWS accounts within the same AWS Organization must route their VPC egress traffic through this inspection fleet using Gateway Load Balancer endpoints (GWLBEs) deployed in each application VPC. The networking team wants application teams to be able to create GWLBEs in their own accounts that point to the centralized GWLB, while keeping the appliance fleet fully managed in the security account. What is the correct way to enable this cross-account architecture?

Accepted Answer

Create a VPC endpoint service backed by the GWLB in the security account, then share it with the application accounts by adding their account principals to the endpoint service allowed principals; application teams create GWLBEs referencing the service name.

Answer

Use AWS Resource Access Manager (RAM) to share the Gateway Load Balancer resource directly with the application accounts so they can attach GWLBEs to it.

Answer

Establish VPC peering between the security VPC and each application VPC, then add routes in the application route tables pointing at the peering connection to reach the GWLB.

Answer

Create a Transit Gateway attachment for the GWLB in the security account and share the Transit Gateway via RAM so application accounts can route traffic to the appliances.

Question 34

A company deploys a fleet of third-party firewall appliances behind a Gateway Load Balancer (GWLB) to inspect north-south traffic for a set of application VPCs. During testing, engineers observe that some TCP sessions inspected by the firewalls are being dropped intermittently, while others pass cleanly. Packet captures on the appliances show that return packets for the affected flows are arriving at a different appliance than the one that processed the initial forward packets. Which GWLB configuration change will resolve the dropped sessions?

Accepted Answer

Enable flow stickiness on the GWLB target group using an appropriate flow-hashing algorithm (5-tuple, 3-tuple, or 2-tuple) so both directions of a flow map to the same appliance.

Answer

Increase the health check interval on the GWLB target group so appliances are not marked unhealthy during inspection spikes.

Answer

Enable cross-zone load balancing on the GWLB so traffic is distributed evenly across appliances in all Availability Zones.

Answer

Switch the GWLB listener from the GENEVE protocol to TCP so the load balancer can track connection state per session.

Question 35

A company runs a fleet of third-party firewall appliances that must inspect all north-south traffic entering and leaving several application VPCs. The security team wants to centralize these appliances in a dedicated inspection VPC, scale them horizontally, and preserve flow symmetry so that both directions of a connection hit the same appliance. Application teams must not manage the appliances directly. Which implementation meets these requirements?

Accepted Answer

Deploy a Gateway Load Balancer in the inspection VPC fronting the appliances, expose it via a GWLB endpoint (Gateway Load Balancer Endpoint) in each application VPC, and route traffic through the endpoint using route tables.

Answer

Deploy a Network Load Balancer in front of the appliances and update application VPC route tables to point the default route at the NLB's private IP addresses.

Answer

Place the appliances behind an Application Load Balancer in the inspection VPC and use VPC peering plus security groups to force application traffic through the ALB.

Answer

Attach the appliances to a Transit Gateway and rely on TGW appliance-mode disabled routing to distribute connections across the appliance ENIs.

Question 36

A financial services company must inspect all north-south traffic leaving its production VPC with a fleet of third-party stateful firewall appliances. Security requires that the appliances see the true 5-tuple of every flow and that traffic is transparently forwarded without the appliances needing to perform source NAT. The networking team wants a solution that scales horizontally, preserves flow symmetry, and integrates with Auto Scaling for the appliance fleet. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Deploy the appliances behind a Gateway Load Balancer, and route VPC egress traffic through Gateway Load Balancer endpoints; the GENEVE encapsulation preserves the original packet for transparent inspection.

Answer

Deploy the appliances behind a Network Load Balancer with TLS passthrough, and use NLB target groups to distribute flows across the appliance fleet.

Answer

Deploy the appliances behind an Application Load Balancer using IP target groups, relying on the X-Forwarded-For header to preserve the client source IP for the appliances.

Answer

Configure each appliance as a next hop in the VPC route table using individual static routes, and use a Lambda function to rewrite routes when Auto Scaling adds or removes an instance.

Question 37

A financial services company must inspect all outbound TLS traffic from a centralized inspection VPC using third-party firewall appliances behind a Gateway Load Balancer. A compliance mandate requires that the private keys used for TLS decryption never be exportable in plaintext and that all cryptographic operations be performed on FIPS 140-2 Level 3 validated hardware under the company's sole control. The security team wants to minimize custom key-handling code on the appliances. Which approach BEST satisfies these requirements?

Accepted Answer

Configure the firewall appliances to use keys stored in an AWS CloudHSM cluster, integrating via the PKCS#11 library so private key operations occur inside the FIPS 140-2 Level 3 HSMs

Answer

Store the TLS private keys as encrypted secrets in AWS Secrets Manager and have each appliance decrypt them at boot using an AWS KMS customer managed key

Answer

Use AWS Certificate Manager to issue the decryption certificates and attach them directly to the Gateway Load Balancer for inline TLS termination

Answer

Enable AWS Network Firewall TLS inspection with a KMS customer managed key and route the inspection VPC traffic through it instead of the appliances

Question 38

A company runs workloads across multiple VPCs connected to a Transit Gateway. On-premises servers connect via Direct Connect and must resolve private DNS records hosted in a Route 53 private hosted zone (example.internal). Additionally, EC2 instances in the VPCs must resolve internal DNS names hosted on the on-premises Active Directory DNS servers (corp.example.com). The solution must be highly available and require minimal ongoing operational management. Which approach should the network engineer implement?

Accepted Answer

Deploy Route 53 Resolver inbound endpoints in the VPC so on-premises servers can query the private hosted zone, and deploy Route 53 Resolver outbound endpoints with a forwarding rule for corp.example.com pointing to the on-premises DNS servers.

Answer

Deploy self-managed BIND DNS forwarders on EC2 instances in each VPC to conditionally forward queries in both directions between on-premises DNS and the private hosted zone.

Answer

Associate the private hosted zone with the on-premises network using a VPC association authorization, and configure DHCP option sets on the VPCs to point to the on-premises AD DNS servers.

Answer

Enable Route 53 Resolver DNS Firewall on the VPCs and create forwarding rules that route corp.example.com queries to on-premises and example.internal queries back to the VPC resolver.

Question 39

A company is designing a new AWS environment expected to grow to hundreds of VPCs across multiple accounts and Regions. The network team wants to avoid IP exhaustion and future re-addressing work. They plan to use dual-stack VPCs but want their internal east-west traffic and future workloads to primarily rely on IPv6 to eliminate address overlap concerns. When designing the IPv6 addressing scheme for the VPCs, which approach best meets these goals while allowing centralized, auditable allocation of address space?

Accepted Answer

Bring your own IPv6 (BYOIP) address ranges or use an IPAM pool with a provisioned IPv6 CIDR, then allocate contiguous, non-overlapping IPv6 blocks to each VPC from that centrally managed pool.

Answer

Let each VPC receive an Amazon-provided /56 IPv6 CIDR automatically at creation time, and manage overlap through Transit Gateway route tables.

Answer

Assign each VPC a unique IPv4 /16 and enable NAT64 so that IPv6 addressing is derived automatically and requires no central planning.

Answer

Use the same Amazon-provided /56 for all VPCs and rely on VPC peering to isolate the duplicate ranges.

Question 40

A company runs a workload across three private subnets in three Availability Zones (AZ-a, AZ-b, AZ-c) within a single VPC. Instances in all three subnets need outbound internet access for software updates. The networking team initially deployed one NAT gateway in AZ-a's public subnet and pointed the route tables of all three private subnets to it. During a recent AZ-a service event, instances in AZ-b and AZ-c also lost outbound connectivity. The team wants to eliminate this cross-AZ dependency while following AWS best practices. What should they implement?

Accepted Answer

Deploy a NAT gateway in a public subnet in each of the three AZs, and update each private subnet's route table to send 0.0.0.0/0 to the NAT gateway in its own AZ.

Answer

Deploy two additional NAT gateways in AZ-a and configure the private subnet route tables to load balance across all three NAT gateways in AZ-a.

Answer

Replace the NAT gateway with a NAT instance in AZ-a and enable source/destination check so all AZs continue to route through it.

Answer

Attach an egress-only internet gateway to the VPC and route all three private subnets' 0.0.0.0/0 traffic to it.

Question 41

A media company runs a fleet of EC2 instances in private subnets that push telemetry to a single third-party analytics endpoint (one destination IP and port) over HTTPS. Traffic flows through a NAT gateway. During peak events, application logs show connection failures and the CloudWatch metric ErrorPortAllocation for the NAT gateway spikes above zero, even though bandwidth utilization is well below the NAT gateway's throughput limit. What is the MOST effective way to resolve these connection failures?

Accepted Answer

Deploy multiple NAT gateways across different subnets and distribute the private instances so their traffic uses different NAT gateways, increasing the pool of available source ports to the same destination.

Answer

Increase the NAT gateway's bandwidth by requesting a service quota increase for maximum throughput per NAT gateway.

Answer

Replace the NAT gateway with a NAT instance running on a larger instance type to raise the connection limit.

Answer

Enable cross-zone load balancing on the NAT gateway so connections are balanced across Availability Zones.

Question 42

A financial services company runs a centralized inspection VPC using AWS Network Firewall to inspect all egress traffic from workload VPCs attached to a Transit Gateway. Auditors require that the security team be able to prove, on demand, exactly which domains each workload attempted to reach over the past 90 days, including connections that were ultimately blocked, without dropping any legitimate traffic during the initial rollout. The security team wants to introduce a new set of stateful rules but is concerned about accidentally blocking business-critical traffic before the rules are validated. Which approach best satisfies both the audit-evidence and safe-rollout requirements?

Accepted Answer

Configure the new stateful rule group with rule actions set to 'alert' and enable both alert and flow logging to an S3 bucket with a 90-day lifecycle, then switch selected rules to 'drop' after validation.

Answer

Deploy the rules directly with 'drop' actions but enable flow logs only, relying on the flow logs to capture blocked connection metadata for the auditors.

Answer

Use a stateless rule group with a 'forward to stateful' default action and rely on Transit Gateway Flow Logs sent to CloudWatch Logs to record domain-level attempts.

Answer

Enable TLS inspection with a drop action on all rules and send only alert logs to Kinesis Data Firehose so the auditors can query blocked domains in real time.

Question 43

A financial services company operates a multi-account AWS Organization with a centralized inspection VPC that hosts AWS Network Firewall. The security governance team must guarantee that every stateful rule group deployed across all firewall policies in every member account enforces a mandatory drop rule for known malicious domains, and they must be automatically alerted whenever a firewall policy is created or modified in a way that removes this baseline protection. The team wants a scalable, organization-wide approach that centralizes rule management while continuously auditing compliance. Which combination BEST meets these requirements?

Accepted Answer

Use AWS Firewall Manager with a Network Firewall policy to centrally deploy and enforce the baseline stateful rule group across all accounts, and rely on Firewall Manager's non-compliance reporting plus AWS Config rules to detect and alert on drift.

Answer

Deploy the stateful rule group manually in each member account's firewall policy and use Amazon GuardDuty to detect when the malicious-domain drop rule is removed.

Answer

Create a CloudFormation StackSet that provisions identical Network Firewall policies in every account and enable termination protection to prevent any modification of the rule groups.

Answer

Share a single centralized Network Firewall rule group via AWS RAM to all accounts and use VPC Flow Logs to confirm that malicious-domain traffic is being dropped.

Question 44

A company runs a public-facing application behind an Application Load Balancer in a production account. During a recent volumetric DDoS event, on-call engineers struggled to respond and wanted AWS to proactively engage on their behalf. The security team also wants cost protection against DDoS-related scaling charges and the ability to have AWS experts apply mitigations to their ALB and Route 53 resources during future attacks. Which combination of actions BEST meets these requirements?

Accepted Answer

Subscribe to AWS Shield Advanced, associate the protected resources, and configure the Shield Response Team (SRT) with an IAM role and engagement so they can act during attacks; enable cost protection through Shield Advanced.

Answer

Rely on AWS Shield Standard, which is automatically enabled, and open a support case with the SRT when an attack occurs to receive cost credits and mitigation assistance.

Answer

Deploy AWS Network Firewall in front of the ALB with a stateful rule group that rate-limits inbound connections, and enable AWS Config to alert on rule changes.

Answer

Enable AWS WAF rate-based rules on the ALB and create an Amazon GuardDuty threat list so that GuardDuty automatically blocks attacking IPs at the edge.

Question 45

A company runs a public-facing web application in a VPC. Internet traffic enters through an Internet Gateway to an Application Load Balancer in public subnets, and the ALB forwards to application instances in private subnets. Security requires that ALL inbound traffic from the Internet be inspected by AWS Network Firewall before reaching the ALB. The team deploys a Network Firewall with firewall endpoints in dedicated firewall subnets. Which route table configuration correctly forces inbound Internet traffic through the firewall endpoint before reaching the public (ALB) subnets?

Accepted Answer

On the Internet Gateway ingress route table, add a route for the public subnet CIDRs pointing to the firewall VPC endpoint; on the public subnet route table, keep the default route (0.0.0.0/0) pointing to the Internet Gateway.

Answer

On the public subnet route table, add a 0.0.0.0/0 route pointing to the firewall VPC endpoint; leave the Internet Gateway with no edge association.

Answer

On the firewall subnet route table, add a route for the public subnet CIDRs pointing to the Internet Gateway; leave the public subnet route table default.

Answer

Attach a security group to the Internet Gateway that redirects all inbound traffic to the firewall endpoint before it reaches the ALB subnets.

Question 46

A financial services company hosts a public-facing web application behind an internet-facing Application Load Balancer in a public subnet. The security team requires that all inbound HTTPS traffic from the internet be deep-packet inspected by AWS Network Firewall for exploit signatures BEFORE it reaches the ALB, while preserving the original client source IP for the application's audit logs. The VPC uses an Internet Gateway. Which routing configuration correctly forces inbound internet traffic through the Network Firewall endpoint?

Accepted Answer

Add a route on the Internet Gateway route table (edge association) that sends traffic destined for the public subnet CIDR to the Network Firewall endpoint, and route return traffic from the firewall subnet back through the IGW.

Answer

Attach the Network Firewall endpoint as a target of the ALB and configure the listener to forward decrypted traffic to the firewall before the target group.

Answer

Modify the public subnet's NACL to redirect all inbound port 443 traffic to the Network Firewall endpoint ENI, then allow it onward to the ALB.

Answer

Place the Network Firewall endpoint in the same subnet as the ALB and add a security group rule referencing the firewall endpoint as the source for the ALB.

Question 47

A financial services company runs a centralized inspection VPC using AWS Network Firewall to enforce egress controls for all workload accounts. The compliance team requires that (1) all flow and alert logs from the firewall be retained immutably for 7 years, (2) logs be encrypted with a customer-managed key that the security team fully controls, and (3) the security team be able to prove during audits that logging was never disabled. Which combination of configurations BEST meets these requirements?

Accepted Answer

Configure Network Firewall logging to an S3 bucket with Object Lock in compliance mode, encrypt the bucket with an SSE-KMS customer-managed key, and use AWS Config with a managed rule to detect and alert when firewall logging configuration changes.

Answer

Configure Network Firewall logging to a CloudWatch Logs group with a 7-year retention setting, encrypt the log group with an AWS-managed key, and enable CloudTrail data events on the log group.

Answer

Configure Network Firewall logging to Kinesis Data Firehose delivering to S3 with versioning enabled, encrypt with SSE-S3, and rely on S3 lifecycle policies to prevent deletion for 7 years.

Answer

Configure Network Firewall logging to an S3 bucket with a bucket policy denying deletes, encrypt with an SSE-KMS customer-managed key, and enable GuardDuty to monitor for logging changes.

Question 48

A company routes all outbound internet traffic from a production VPC through AWS Network Firewall for stateful inspection. The VPC spans three Availability Zones with workloads in private subnets in each AZ. During a recent AZ impairment, all outbound traffic from the two healthy AZs also failed, causing a full application outage. The security team confirms the firewall policy and rules were correct. What is the MOST likely cause and the correct design to prevent recurrence?

Accepted Answer

A single firewall endpoint was deployed in one AZ and all private subnet route tables pointed to it; deploy a firewall endpoint subnet in each AZ and point each AZ's route table to its local endpoint

Answer

Network Firewall does not support multi-AZ deployments; replace it with a fleet of self-managed inspection appliances behind a Gateway Load Balancer

Answer

The stateful engine lost session state during the impairment; enable strict rule ordering and increase the flow timeout to preserve sessions across AZs

Answer

The firewall policy was attached to only one subnet's NACL; attach the same NACL to all subnets in every AZ

Question 49

A financial services company runs application servers in private subnets across three Availability Zones in a single VPC. Compliance requires that all outbound HTTPS traffic to the internet be restricted so that only a specific approved list of external SaaS domains (e.g., api.partner-a.com, api.partner-b.com) can be reached, and all other outbound connections must be dropped and logged. The team already uses a centralized egress design with a NAT gateway. Which solution meets the requirement with the least operational overhead?

Accepted Answer

Deploy AWS Network Firewall with a stateful rule group using domain list rules to allow the approved server-name-indication (SNI) values, set the default action to drop other traffic, enable alert logging, and route outbound traffic through the firewall endpoints before the NAT gateway.

Answer

Configure security groups on the application servers referencing the resolved IP addresses of the approved domains and attach a deny-all outbound rule for everything else.

Answer

Create network ACLs on the private subnets that allow outbound TCP 443 only to the CIDR ranges published by the SaaS providers and deny all other egress.

Answer

Attach AWS WAF with a custom rule group to the NAT gateway that inspects the Host header of outbound HTTPS requests and blocks any domain not on the allow list.

Question 50

A financial services company routes all outbound internet traffic from its VPCs through a centralized inspection VPC that uses AWS Network Firewall. Compliance requires that the firewall block access to any HTTPS destination outside an approved list of fully qualified domain names (FQDNs). Currently the firewall's stateful rules match on the TLS Server Name Indication (SNI), but security auditors report that some clients bypass the controls by sending a benign SNI while connecting to a disallowed domain. Which change most directly closes this gap while keeping the approved-domain allow-list model?

Accepted Answer

Enable TLS inspection configuration on the Network Firewall so it decrypts the session and enforces rules against the actual certificate and HTTP Host header rather than the SNI alone

Answer

Replace the stateful domain rules with stateless rules that filter on destination IP address ranges resolved from the approved FQDNs

Answer

Add a Route 53 Resolver DNS Firewall rule group that blocks all domains not on the approved list and attach it to the inspection VPC

Answer

Configure the firewall to drop any packet where the TLS SNI extension is absent and rely on strict SNI matching for the rest

Question 51

A financial services company runs a centralized inspection VPC with AWS Network Firewall for all outbound internet traffic from workloads across multiple accounts via a Transit Gateway. The security team must ensure that all data leaving the environment toward on-premises data centers over the Site-to-Site VPN is encrypted in transit, and that any workload attempting to establish an unencrypted (plaintext) connection to an external partner API endpoint is blocked. Traffic to the partner endpoint uses HTTPS on port 443, but the team suspects some legacy applications fall back to HTTP on port 80. Which approach BEST enforces encryption-in-transit requirements for the outbound partner traffic while minimizing operational overhead?

Accepted Answer

Configure a Network Firewall stateful rule group that drops any TCP traffic destined to the partner endpoint on port 80, and rely on the Site-to-Site VPN's IPsec encryption for the on-premises path.

Answer

Enable TLS inspection on the VPN tunnel and configure a stateless rule to reject all traffic on port 80 across the inspection VPC.

Answer

Attach a security group to the Transit Gateway attachment that denies outbound port 80 and require IPsec transport mode on all partner connections.

Answer

Deploy AWS WAF on the Network Firewall endpoint to block HTTP requests and enable MACsec on the Site-to-Site VPN for encryption in transit.

Question 52

A financial services company runs a centralized inspection VPC using AWS Network Firewall to filter east-west traffic between multiple spoke VPCs attached to a Transit Gateway. The security team must prove to auditors that no spoke-to-spoke traffic can bypass the firewall and reach another spoke directly. During a compliance review, an auditor asks how to programmatically and continuously verify that the Transit Gateway route tables associated with spoke attachments always route inter-spoke traffic through the inspection VPC attachment. Which approach best satisfies this continuous governance requirement?

Accepted Answer

Use an AWS Config custom rule (or conformance pack) that evaluates Transit Gateway route table associations and propagations, flagging any spoke route table whose inter-spoke routes do not point to the inspection VPC attachment.

Answer

Enable VPC Flow Logs on every spoke VPC and manually review the logs weekly to confirm no direct spoke-to-spoke flows appear.

Answer

Configure Reachability Analyzer to run once during the audit to confirm the current path between two spoke VPCs traverses the inspection VPC.

Answer

Attach a restrictive network ACL to the inspection VPC subnets to block any traffic not originating from the Transit Gateway.

Question 53

A financial services company runs a multi-tier application in a single VPC. The security team requires that all outbound traffic from application subnets be inspected against a continuously updated list of known malicious IP addresses and that stateful connection tracking be applied so that return traffic is automatically allowed without opening broad ephemeral port ranges. They also need centralized, human-readable logging of allowed and denied flows for compliance audits. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Deploy AWS Network Firewall with a stateful rule group referencing a managed threat-intelligence domain/IP feed, route subnet egress through firewall endpoints, and enable alert and flow logging.

Answer

Attach a network ACL to the application subnets with deny rules for the malicious IP list and rely on the NACL's connection tracking for return traffic.

Answer

Configure security groups on the application instances with outbound deny rules for each malicious IP and enable VPC Flow Logs for auditing.

Answer

Deploy a fleet of self-managed proxy EC2 instances behind a Gateway Load Balancer and maintain the malicious IP list manually in iptables.

Question 54

A company hosts a public-facing e-commerce application behind an Application Load Balancer (ALB) in a VPC. Security auditors require protection against SQL injection and cross-site scripting (XSS) attacks targeting the application's HTTP request payloads, and they also require the ability to block requests from specific countries and enforce rate limits on abusive clients. The security team wants a managed, purpose-built service that inspects Layer 7 HTTP/HTTPS content. Which AWS service should be deployed to meet these requirements with the least operational overhead?

Accepted Answer

AWS WAF with managed rule groups associated to the ALB

Answer

AWS Network Firewall with a stateful rule group inspecting traffic before the ALB

Answer

Network ACLs on the ALB subnets combined with security group rules

Answer

A Gateway Load Balancer with a third-party IDS/IPS appliance fleet

Question 55

A global enterprise operates a Transit Gateway spanning three AWS Regions with dozens of VPC and VPN attachments managed under a single AWS Cloud WAN / Network Manager global network. The operations team wants a proactive alert whenever a Site-to-Site VPN tunnel associated with any attachment changes state (up/down) or when BGP routing convergence issues occur, without writing custom polling scripts against each individual VPN connection. Which approach best meets this requirement?

Accepted Answer

Enable Network Manager, which publishes topology and routing change events (including VPN tunnel state and BGP status) to Amazon CloudWatch Events/EventBridge, and create EventBridge rules that trigger SNS notifications on the relevant events.

Answer

Configure VPC Flow Logs on every attachment's subnets and build a CloudWatch Logs metric filter that detects when tunnel packet counts drop to zero.

Answer

Run Reachability Analyzer on a scheduled basis for each attachment pair and alarm when a path analysis returns 'not reachable'.

Answer

Enable Transit Gateway Flow Logs and create a CloudWatch alarm on the TunnelState dimension exported automatically by the flow log records.

Question 56

A company operates a global network built on multiple Transit Gateways across three AWS Regions, several Site-to-Site VPN connections, and two Direct Connect gateways spanning many accounts. The network operations team currently logs into each account and Region separately to check attachment states and route propagation, which delays incident response. They want a single, centralized visualization of the entire cross-Region topology and the ability to be alerted when a TGW attachment or route-table state changes, without deploying custom polling scripts. Which solution best meets these requirements?

Accepted Answer

Create an AWS Network Manager global network, register the Transit Gateways, and use its topology view together with CloudWatch Events/EventBridge notifications for state changes.

Answer

Enable VPC Flow Logs on every attachment ENI and build a QuickSight dashboard that joins the logs across accounts to infer topology.

Answer

Schedule Reachability Analyzer path analyses between all attachment pairs in each Region and aggregate the results into an S3 bucket.

Answer

Deploy a Lambda function in each account that calls the EC2 DescribeTransitGatewayAttachments API on a cron schedule and writes results to a shared DynamoDB table.

Question 57

A network engineer manages a large multi-Region global network built on multiple Transit Gateways registered in AWS Cloud WAN's predecessor tooling via AWS Network Manager. After a routing change, an application team reports that traffic from a VPC attached to the us-east-1 Transit Gateway cannot reach a VPC attached to the eu-west-1 Transit Gateway, even though a peering attachment exists. The engineer needs to determine, without generating live traffic, whether the Transit Gateway route tables on both ends have the correct routes and where the path breaks. Which AWS Network Manager capability should the engineer use?

Accepted Answer

Use Network Manager Route Analysis to compute the forward and return paths across the registered Transit Gateways and identify the route table hop where the path is missing a route

Answer

Enable Transit Gateway Flow Logs on both attachments and inspect the records for REJECT actions to locate the break

Answer

Run VPC Reachability Analyzer between the two VPC ENIs to trace the end-to-end path across Regions

Answer

Use the Network Manager global topology view and manually compare the two Transit Gateway route tables for missing entries

Question 58

A company runs a public HTTPS web application behind an Application Load Balancer (ALB) that they want to protect with AWS WAF. They also have a requirement from their security team: the backend EC2 instances must see the original client source IP addresses in the application logs for fraud analysis, without deploying any additional software on the instances. The ALB terminates TLS. Which approach meets both the WAF protection and original client IP requirements with the least operational overhead?

Accepted Answer

Associate the AWS WAF web ACL with the ALB and configure the application to read the X-Forwarded-For HTTP header for the original client IP.

Answer

Replace the ALB with a Network Load Balancer, enable client IP preservation on the target group, and attach the WAF web ACL to the NLB.

Answer

Keep the ALB, enable Proxy Protocol v2 on the target group, and associate the WAF web ACL with the ALB so the instances receive the TCP source IP.

Answer

Place a Gateway Load Balancer in front of the ALB, associate the WAF web ACL with the GWLB, and forward traffic transparently to preserve the source IP.

Question 59

A financial services company is deploying a payment processing API for external partners. Requirements: partners must whitelist a small set of static IP addresses in their firewalls; TLS termination must occur on the backend EC2 instances (not on the load balancer) because a hardware security module (HSM) integration is required; and the solution must support millions of concurrent connections with ultra-low latency. Which load balancing implementation meets all requirements?

Accepted Answer

Deploy a Network Load Balancer with a TCP listener on port 443, assign Elastic IPs per subnet, and forward traffic to an instance target group where TLS is terminated on the backend.

Answer

Deploy an Application Load Balancer with an HTTPS listener and import certificates into AWS Certificate Manager for TLS termination at the ALB.

Answer

Deploy a Network Load Balancer with a TLS listener so the NLB decrypts traffic before forwarding to the backend instances.

Answer

Deploy a Gateway Load Balancer with GENEVE encapsulation and forward decrypted traffic to backend appliances for TLS processing.

Question 60

A financial services company runs a high-throughput trading API behind a Network Load Balancer (NLB). Currently, the NLB uses a TCP listener on port 443 and passes encrypted traffic through to the EC2 backends, which perform TLS termination. The security team wants to centralize certificate management using AWS Certificate Manager (ACM) and reduce CPU load on the backend instances, while keeping the NLB (not an ALB) as the entry point to preserve ultra-low latency and static IP addresses. Which implementation meets these requirements?

Accepted Answer

Change the NLB listener to a TLS listener on port 443, attach an ACM certificate to the listener, and configure the target group to forward decrypted traffic to the backends over TCP.

Answer

Keep the TCP passthrough listener and install the ACM certificate directly on each EC2 instance using the ACM export feature.

Answer

Replace the NLB with an Application Load Balancer using an HTTPS listener and an ACM certificate, then place the ALB behind a Global Accelerator for static IPs.

Answer

Add a TLS listener to the NLB but configure the target group protocol as TLS so traffic is re-encrypted to the backends, offloading nothing from the instances.

Question 61

A company runs a fleet of custom UDP-based real-time telemetry servers behind a Network Load Balancer (NLB) in a single VPC. Operations reports that unhealthy backend instances continue to receive UDP traffic, causing packet loss for clients. The team confirms the target group protocol is set to UDP and instances are registered correctly. What is the MOST likely cause and appropriate fix?

Accepted Answer

UDP target groups cannot use UDP for health checks, so a separate TCP or HTTP health check port must be configured on the targets to detect and drain unhealthy instances.

Answer

NLB does not support UDP; migrate the listener and target group to an Application Load Balancer with a UDP listener.

Answer

Cross-zone load balancing must be disabled so the NLB only routes to healthy targets in the same Availability Zone.

Answer

Connection draining (deregistration delay) must be set to 0 seconds so unhealthy targets are removed immediately.

Question 62

A financial services company runs a payment processing service behind a Network Load Balancer in an eu-west-1 VPC and exposes it via an AWS PrivateLink endpoint service. A newly acquired subsidiary operates all of its workloads in us-east-1 and must consume this service privately, without traversing the public internet and without requiring the two organizations to coordinate on overlapping RFC 1918 address spaces. The networking team wants the simplest design that keeps traffic on the AWS backbone. Which approach should they implement?

Accepted Answer

Enable cross-Region access on the PrivateLink endpoint service, then create an interface VPC endpoint in the us-east-1 consumer VPC that points to the eu-west-1 endpoint service.

Answer

Establish an inter-Region VPC peering connection between the us-east-1 and eu-west-1 VPCs and add routes to the NLB's private IP addresses in each route table.

Answer

Attach both VPCs to a Transit Gateway in each Region, peer the Transit Gateways across Regions, and route consumer traffic directly to the NLB subnets in eu-west-1.

Answer

Create a Direct Connect gateway associating the two Regions and advertise the NLB subnet prefixes so the subsidiary can reach the service privately.

Question 63

A financial services company runs a shared analytics service in a provider VPC. Dozens of consumer accounts, several with CIDR ranges that overlap with the provider VPC and with each other, must reach this single TCP-based service on port 8443. The provider must not manage routing for consumer networks, and consumers must not gain access to any other resources in the provider VPC. Traffic must stay on the AWS private network. Which connectivity design best meets these requirements?

Accepted Answer

Create an AWS PrivateLink endpoint service backed by a Network Load Balancer in the provider VPC, and have each consumer create an interface VPC endpoint to the service.

Answer

Attach all provider and consumer VPCs to a Transit Gateway and use route table segmentation to expose only the analytics subnet.

Answer

Establish VPC peering connections between the provider VPC and each consumer VPC, adding specific routes only for the analytics service subnet.

Answer

Deploy a Direct Connect gateway with a transit VIF so consumers reach the analytics service over a private connection.

Question 64

A financial services company exposes an internal payment API to hundreds of partner VPCs using AWS PrivateLink. The endpoint service is backed by a Network Load Balancer. Partners report intermittent connection failures that correlate with times when the company performs maintenance in one Availability Zone. The company's VPC spans three AZs (us-east-1a, 1b, 1c), but the NLB and endpoint service are configured with subnets only in us-east-1a and us-east-1b. Partner interface endpoints are created in all three AZs. What is the most likely cause of the failures and the correct remediation?

Accepted Answer

Consumer interface endpoints in us-east-1c have no corresponding provider AZ, so traffic to that endpoint ENI has no path; enable the endpoint service in us-east-1c by adding an NLB subnet there and enabling cross-zone load balancing is optional but recommended.

Answer

PrivateLink requires VPC peering between provider and consumer to route across AZs; add peering connections and update route tables to reach the NLB during maintenance.

Answer

The NLB must terminate TLS for PrivateLink to preserve availability; install an ACM certificate on the NLB and switch the listener to TLS so failover works across AZs.

Answer

Interface endpoints do not support multiple AZs, so partners must consolidate all endpoints into a single AZ that matches the provider; delete the us-east-1c endpoints.

Exam domain	Exam weight	Practice
Network Design	30%	Practice this topic
Network Implementation	26%	Practice this topic
Network Management and Operation	20%	Practice this topic
Network Security, Compliance, and Governance	24%	Practice this topic

AWS Certified Advanced Networking - Specialty (ANS-C01) practice exam & study guide

Start studying ANS-C01

All ANS-C01 study resources

ANS-C01 exam domains

Sample ANS-C01 questions

Key ANS-C01 terms

ANS-C01 frequently asked questions

Network Design (30%)

Network Implementation (26%)

Network Management and Operation (20%)

Network Security, Compliance, and Governance (24%)