Medium — ANS-C01 Practice Quiz

Question 1

A financial services company runs a public-facing web application behind an internet-facing Application Load Balancer (ALB) with an HTTPS listener using an ACM certificate. A compliance audit requires that all TLS connections enforce forward secrecy and disallow any TLS versions below 1.2. The security team must ensure that the ALB rejects clients that cannot negotiate a cipher supporting forward secrecy, while minimizing operational overhead. What is the MOST appropriate action?

Accepted Answer

Apply a predefined ELB security policy on the HTTPS listener (for example, ELBSecurityPolicy-FS-1-2-Res-2020-10) that enforces TLS 1.2+ and forward-secrecy ciphers.

Answer

Attach an AWS WAF web ACL to the ALB with a rule that inspects the TLS handshake and blocks weak ciphers.

Answer

Import a stronger ACM certificate that only supports ECDHE cipher suites so weak clients are automatically rejected.

Answer

Place a Network Load Balancer in front of the ALB and terminate TLS on the NLB using a custom OpenSSL cipher configuration.

Question 2

A financial services company exposes a partner-facing REST API behind an Application Load Balancer (ALB) with an HTTPS listener. Security policy now requires that only partner client applications presenting a certificate issued by the company's own private certificate authority may connect, and any connection presenting an untrusted or expired client certificate must be rejected at the ALB before reaching the backend targets. The team wants a managed solution that minimizes custom code on the targets. Which approach meets these requirements?

Accepted Answer

Configure mutual TLS (mTLS) on the ALB HTTPS listener in verify mode, using a trust store in Amazon S3 that contains the private CA's certificate bundle, and let the ALB validate and reject untrusted client certificates.

Answer

Enable mTLS on the ALB in passthrough mode and have each backend target application parse the X-Amzn-Mtls-Clientcert header to validate the certificate chain and expiry.

Answer

Place an AWS WAF web ACL on the ALB with a rule that inspects the TLS client certificate and blocks requests when the issuer does not match the private CA.

Answer

Terminate TLS on a Network Load Balancer with a certificate from AWS Private CA, then forward to the ALB, relying on the NLB to authenticate client certificates.

Question 3

A company runs three microservices behind a single Application Load Balancer using the domain shop.example.com. Requests to /api/orders must reach the orders service, /api/inventory must reach the inventory service, and all other paths must reach a default web frontend service. Each service runs in its own target group. The networking team must implement this routing with the fewest ALB resources while ensuring unmatched requests always land on the frontend. Which configuration meets these requirements?

Accepted Answer

On a single HTTPS listener, add path-based routing rules for /api/orders and /api/inventory pointing to their target groups, and set the listener's default action to forward to the frontend target group.

Answer

Create three separate ALBs, one per target group, and use Route 53 weighted records to distribute traffic among them.

Answer

Create one listener rule per target group using host-based conditions on shop.example.com, and rely on rule priority to break ties for unmatched paths.

Answer

Use a single listener with a fixed-response default action and add path-based rules for all three services including the frontend.

Question 4

A retail company runs a production web application behind an Application Load Balancer. The platform team wants to perform blue/green deployments by gradually shifting a percentage of live traffic from the current version (green) to a new version (blue) on the same listener, monitoring error rates before completing the cutover. Both versions are registered in separate target groups. What is the correct way to configure the ALB to shift a controlled percentage of traffic between the two versions?

Accepted Answer

Create a single listener rule with a forward action that references both target groups and assigns weights to each, adjusting the weights incrementally to shift traffic.

Answer

Create two separate listeners on different ports and use Route 53 weighted records to distribute traffic between the listener endpoints.

Answer

Register both versions' instances in a single target group and rely on the ALB round-robin algorithm to distribute traffic proportionally.

Answer

Configure a host-based routing rule that sends a fixed subset of hostnames to the blue target group and the remainder to green.

Question 5

A financial services company must ensure that no network ACL in any of its 40 member accounts allows unrestricted inbound SSH (TCP port 22 from 0.0.0.0/0). The security team wants automatic detection of violations across all accounts and regions, plus automatic remediation that removes the offending rule whenever one appears. The solution must produce an auditable record of compliance status for regulators. Which approach best meets these requirements?

Accepted Answer

Deploy an AWS Config organization managed rule (via delegated administrator) that checks NACL rules for unrestricted port 22 access, and attach an SSM Automation remediation action that removes the non-compliant entry.

Answer

Enable VPC Flow Logs in every account and use a scheduled Lambda function to parse the logs for SSH traffic from the internet, then invoke an API call to delete the NACL rule.

Answer

Create an AWS WAF web ACL with a rule blocking port 22 and associate it with each VPC to prevent inbound SSH from the internet.

Answer

Use Amazon GuardDuty across the organization to detect SSH brute-force findings and trigger an EventBridge rule that modifies the security groups to deny port 22.

Question 6

A network operations team manages all VPC security groups, route tables, and NACLs through a CloudFormation stack to enforce a consistent baseline. During an incident, an engineer manually added an inbound rule to a security group via the console to restore service quickly. Weeks later, the team wants to programmatically identify every resource in the stack whose live configuration no longer matches the template, without disrupting running resources. Which approach meets this requirement with the least operational effort?

Accepted Answer

Run CloudFormation drift detection on the stack and review the drift status for each resource to identify configuration differences.

Answer

Delete and recreate the stack so all resources are reprovisioned exactly as defined in the template.

Answer

Enable AWS Config with a custom rule that compares each resource against the raw CloudFormation template stored in S3.

Answer

Use VPC Flow Logs and CloudWatch Logs Insights to detect traffic that violates the intended security group baseline.

Question 7

A network operations team manages 40 AWS accounts under a single AWS Organizations structure. They need to deploy an identical set of interface VPC endpoints (for SSM, EC2 Messages, and CloudWatch Logs) into a standard VPC in every account, and ensure that any newly created account automatically receives the same endpoints without manual intervention. The solution must minimize ongoing operational effort. Which approach best meets these requirements?

Accepted Answer

Create a CloudFormation StackSet with service-managed permissions, deploy it to the entire organization, and enable automatic deployment to accounts added to the target OU.

Answer

Write a Lambda function triggered by CloudTrail account-creation events that runs the AWS CLI to create the endpoints in each new account.

Answer

Create a single CloudFormation stack in the management account with cross-account IAM roles and reference each member VPC using nested stacks.

Answer

Use AWS RAM to share the interface endpoints from a central networking account to all member accounts so each account reuses the same endpoints.

Question 8

A financial services company runs a latency-sensitive trading API on an Application Load Balancer in two AWS Regions (us-east-1 and eu-west-1). Global clients connect over TCP with long-lived, encrypted sessions and cannot tolerate connection resets during a regional failure. The API responses are fully dynamic and non-cacheable. The company wants clients to always use a single fixed set of static IP addresses and needs sub-minute automatic regional failover. Which edge design best meets these requirements?

Accepted Answer

Deploy AWS Global Accelerator with two endpoint groups (one per Region), each containing the regional ALB endpoint, and configure health checks for automatic failover.

Answer

Deploy Amazon CloudFront with an origin group referencing both regional ALBs and enable origin failover with a caching policy that disables caching.

Answer

Use Route 53 latency-based routing with health checks pointing at each regional ALB and publish the ALB DNS names to clients.

Answer

Deploy an NLB in each Region with Elastic IPs and use Route 53 failover routing to switch between the two static IP sets.

Question 9

A media company serves a static single-page application and its API from CloudFront. The origin is an S3 bucket in us-east-1 for static assets, and a Regional Application Load Balancer in us-east-1 for the API. Leadership requires that if the entire us-east-1 origin infrastructure becomes unavailable, viewers automatically continue to be served from a warm standby stack deployed in us-west-2 — without requiring any DNS TTL wait or client-side changes. Which CloudFront configuration meets this requirement with the least additional latency during normal operation?

Accepted Answer

Configure a CloudFront origin group for each origin, with the us-east-1 origin as primary and the us-west-2 origin as secondary, and define failover criteria on specific HTTP status codes.

Answer

Create a Route 53 failover routing policy with health checks in front of the origins and point CloudFront at the Route 53 record name as a single origin.

Answer

Use a Lambda@Edge origin-request function that checks origin health on every request and rewrites the origin domain to us-west-2 when us-east-1 fails.

Answer

Deploy AWS Global Accelerator in front of both Regional stacks and set the Global Accelerator endpoint as the CloudFront origin.

Question 10

A media company runs a web application behind an internal (private) Application Load Balancer inside a VPC. They want to serve this application globally through Amazon CloudFront for caching and TLS termination at the edge, but the security team mandates that the ALB must NOT be publicly accessible from the internet — traffic must only reach the ALB from CloudFront. Which design meets these requirements with the least operational overhead?

Accepted Answer

Use a CloudFront VPC origin that points directly to the internal ALB, so CloudFront reaches the private ALB over the AWS network without exposing it publicly.

Answer

Convert the ALB to internet-facing and restrict its security group to the published CloudFront IP ranges managed via an AWS-managed prefix list.

Answer

Place a public Network Load Balancer in front of the internal ALB and configure CloudFront to use the NLB as the origin, restricting the NLB with security groups.

Answer

Set up an AWS Site-to-Site VPN between the CloudFront edge locations and the VPC so the private ALB can be reached without a public endpoint.

Question 11

A media company hosts a static website with downloadable assets in an S3 bucket and serves it globally through CloudFront. Security requires that the S3 bucket be completely private and only accessible through the CloudFront distribution, and the solution must support SSE-KMS encrypted objects while following current AWS best practices. Which approach meets these requirements?

Accepted Answer

Configure Origin Access Control (OAC) on the CloudFront distribution and update the S3 bucket policy to grant access to the distribution's service principal, and grant CloudFront use of the KMS key.

Answer

Use a legacy Origin Access Identity (OAI) and restrict the bucket policy to the OAI's canonical user ID.

Answer

Enable S3 Block Public Access and make the CloudFront distribution use the S3 static website endpoint as a custom origin.

Answer

Attach a bucket policy that allows access only from CloudFront's published edge IP ranges referenced via the aws:SourceIp condition.

Question 12

A company runs a Site-to-Site VPN connection to AWS with two tunnels for redundancy. The network operations team wants to be automatically notified within a few minutes whenever either tunnel changes state, and they want to trigger a Lambda function that pages the on-call engineer. They must use native AWS metrics without deploying any agents. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch alarm on the VPN's TunnelState metric in the AWS/VPN namespace for each tunnel, set the threshold to detect the DOWN state (value below 1), and configure the alarm action to publish to an SNS topic that invokes the Lambda function.

Answer

Install the CloudWatch agent on the customer gateway device to push tunnel status to a custom metric, then alarm on that metric and trigger the Lambda function through an SNS subscription.

Answer

Enable VPC Flow Logs on the virtual private gateway attachment and use a CloudWatch Logs metric filter to detect the absence of traffic on a tunnel, then alarm and invoke Lambda.

Answer

Schedule a CloudWatch Events rule every 5 minutes to run a Lambda function that calls DescribeVpnConnections and evaluates the tunnel status field, paging the engineer if a tunnel is down.

Question 13

A global e-commerce company hosts its application on EC2 behind an Application Load Balancer in us-east-1, with CloudFront in front. Users in Southeast Asia have started reporting slow page loads and intermittent errors over the past two days, but internal synthetic canaries running from AWS regions show healthy latency. The network operations team needs to determine whether the degradation is caused by internet path issues (such as an ISP or transit provider problem) affecting specific city/ASN combinations, and quantify the impact on real users without deploying agents. Which AWS capability should the team use?

Accepted Answer

Enable Amazon CloudWatch Internet Monitor for the application's resources to correlate real client traffic with internet health measurements by geography and ASN.

Answer

Configure VPC Flow Logs with a custom format capturing TCP flags to analyze retransmissions from Southeast Asian source IPs.

Answer

Run Reachability Analyzer between the ALB and the CloudFront distribution to identify blocked network paths.

Answer

Deploy additional CloudWatch Synthetics canaries in more AWS regions to increase the sampling of latency measurements.

Question 14

A network operations team stores VPC Flow Logs in a CloudWatch Logs log group. During an unexpected NAT gateway data-processing cost spike, an engineer must quickly identify which private instances (source IP addresses) generated the most outbound bytes over the last 3 hours, without deploying additional infrastructure. What is the FASTEST approach to produce this ranked list?

Accepted Answer

Run a CloudWatch Logs Insights query against the flow log group that parses the bytes field, filters on the NAT gateway ENI, groups by source address with sum(bytes), and sorts descending

Answer

Export the log group to Amazon S3, create an AWS Glue crawler and an Athena table, then run a GROUP BY query on source address

Answer

Enable Traffic Mirroring on the NAT gateway ENI and analyze captured packets with a third-party tool to rank source hosts by volume

Answer

Create a CloudWatch metric filter that increments a custom metric per source IP and view the metric in a CloudWatch dashboard

Question 15

A network operations team runs a Transit Gateway connecting 12 VPCs across a region. Users in one VPC report intermittent slow transfers to a shared services VPC. The team suspects a specific TGW attachment is hitting a throughput ceiling but needs data to confirm before escalating. Without deploying any agents, which approach gives the team the fastest way to identify whether that attachment is saturating its bandwidth limit?

Accepted Answer

View the per-attachment BytesIn/BytesOut CloudWatch metrics that Transit Gateway publishes in the AWS/TransitGateway namespace and compare them against the 100 Gbps per-attachment limit

Answer

Enable VPC Flow Logs on every ENI in both VPCs and manually sum byte counts in Athena to estimate throughput per attachment

Answer

Install the CloudWatch agent on EC2 instances in both VPCs to collect NetworkPacketsIn/Out and correlate spikes with the slowdowns

Answer

Run Reachability Analyzer between instances in the two VPCs to confirm the path and measure the achievable bandwidth

Question 16

A company runs a critical application in a VPC that communicates with an on-premises database over an AWS Direct Connect connection. Users intermittently report slow response times, but the Direct Connect virtual interface metrics and BGP session appear healthy. The network team needs a managed AWS solution that continuously measures round-trip latency and packet loss between the VPC subnets and the on-premises database endpoint, with minimal agent installation and near-real-time CloudWatch metrics for alerting. Which approach best meets these requirements?

Accepted Answer

Configure Amazon CloudWatch Network Monitor with a monitor and probes that specify the VPC source subnets and the on-premises destination IP, publishing latency and packet-loss metrics to CloudWatch.

Answer

Enable VPC Flow Logs with a custom format capturing TCP flags and analyze the logs with Athena to calculate latency and retransmission rates.

Answer

Use Reachability Analyzer between the VPC ENI and the Direct Connect gateway attachment on a scheduled basis to detect the latency source.

Answer

Deploy Amazon CloudWatch Internet Monitor and add the on-premises database prefix as a monitored city-network to track packet loss.

Question 17

A financial services company exposes an internal REST API through an Application Load Balancer reachable only within their VPC. The network operations team wants proactive alerting when the API's HTTPS response latency exceeds a threshold or when the endpoint returns error codes, even during periods with no customer traffic. The monitoring must run from within the private network context and generate CloudWatch metrics and alarms. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Deploy a CloudWatch Synthetics canary configured to run inside the VPC subnets, using a heartbeat/API canary script that issues periodic HTTPS requests to the internal ALB and publishes latency and status-code metrics for CloudWatch alarms.

Answer

Enable VPC Flow Logs on the ALB subnet ENIs and create a metric filter that counts high-latency connections, then alarm on the resulting metric.

Answer

Configure the ALB access logs to write to S3 and use Athena scheduled queries to detect elevated latency and error rates, publishing results back to CloudWatch.

Answer

Create a Route 53 health check pointing at the internal ALB DNS name and alarm on the CloudWatch health-check status metric.

Question 18

A financial services company operates 40 AWS accounts under AWS Organizations, spread across three Regions. The security governance team must continuously evaluate whether any security group in any account permits unrestricted inbound SSH (0.0.0.0/0 on port 22), and they need a single consolidated view of all non-compliant resources across the entire organization without logging into each account. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Deploy AWS Config with the restricted-ssh managed rule in every account and Region using a CloudFormation StackSet, then create an organization-wide AWS Config aggregator in a delegated administrator account to view aggregated compliance results.

Answer

Enable VPC Flow Logs in every account, stream them to a centralized S3 bucket, and run scheduled Athena queries to detect SSH traffic sourced from 0.0.0.0/0.

Answer

Create a single AWS Config rule in the management account and rely on cross-account IAM roles so the rule evaluates security groups in all member accounts and Regions.

Answer

Use AWS Security Hub in one account with the CIS benchmark enabled and manually export findings from each member account into a spreadsheet weekly.

Question 19

A financial services company operates 40 AWS accounts under AWS Organizations. The security governance team must continuously detect and report on security groups that allow unrestricted inbound access (0.0.0.0/0) to ports other than 80 and 443 across all accounts and Regions, and produce a single compliance dashboard for auditors. Which approach best meets these governance requirements with the least operational overhead?

Accepted Answer

Deploy an AWS Config conformance pack containing the restricted-common-ports and vpc-sg-open-only-to-authorized-ports managed rules using an organization-level deployment via the delegated administrator account, aggregating results with a Config aggregator.

Answer

Enable VPC Flow Logs in every account, stream them to a centralized S3 bucket, and run scheduled Athena queries to identify traffic arriving on unauthorized ports from any source.

Answer

Write a Lambda function in each account triggered by EventBridge on a daily schedule that calls DescribeSecurityGroups and publishes non-compliant findings to a central SNS topic.

Answer

Configure AWS Network Firewall in a centralized inspection VPC with stateful rules that block inbound traffic to ports other than 80 and 443, and review the firewall logs for compliance reporting.

Question 20

A security team manages a centralized audit account and needs to continuously verify that no VPC across 40 member accounts (in an AWS Organization) has an internet gateway attached to subnets tagged 'PCI-Restricted'. The team wants a scalable, near-real-time governance solution that produces findings in the audit account without deploying custom Lambda in each member account. Which approach best meets this requirement?

Accepted Answer

Deploy an AWS Config organization custom rule (using a Config-managed Lambda in the delegated administrator account) that evaluates route table associations for PCI-Restricted subnets, and aggregate results in the audit account via an organization aggregator.

Answer

Enable VPC Flow Logs in every member account, stream them to a centralized S3 bucket, and run scheduled Athena queries to detect traffic to 0.0.0.0/0 through an internet gateway.

Answer

Create an IAM role in each member account trusted by the audit account and run a scheduled script that calls DescribeRouteTables in every account to check for igw- routes.

Answer

Use AWS Network Firewall in a centralized inspection VPC with a stateful rule that drops traffic from PCI-Restricted subnets destined to internet gateways, and review the alert logs.

Question 21

A company has a single 10 Gbps dedicated Direct Connect connection at an AWS Direct Connect location, terminating on one physical port. Traffic to AWS has grown, and the network team wants to increase available bandwidth to 20 Gbps while presenting the connection to their router as a single logical interface for simpler management. They also want the ability to add more connections later without reconfiguring VIFs. Which approach meets these requirements?

Accepted Answer

Create a Link Aggregation Group (LAG) using LACP, bundle two 10 Gbps dedicated connections at the same Direct Connect location, and migrate the existing VIFs onto the LAG.

Answer

Provision a second 10 Gbps dedicated connection and configure ECMP across the two connections by advertising the same prefixes over separate BGP sessions on each private VIF.

Answer

Request a hosted connection from a Direct Connect partner and rely on the partner's edge to aggregate bandwidth automatically.

Answer

Enable jumbo frames (9001 MTU) on the existing 10 Gbps connection to effectively double usable throughput.

Question 22

A company has a single production VPC that needs private connectivity to its on-premises data center over an existing 1 Gbps Direct Connect connection. The networking team wants the simplest configuration that provides private, low-latency access to resources in that one VPC and does not require any additional AWS routing constructs beyond what is strictly necessary. Which implementation should the team use?

Accepted Answer

Create a private virtual interface (VIF) on the Direct Connect connection and associate it with a virtual private gateway (VGW) attached to the VPC.

Answer

Create a transit virtual interface (VIF) on the Direct Connect connection and associate it with a Direct Connect gateway connected to a Transit Gateway that attaches the VPC.

Answer

Create a public virtual interface (VIF) on the Direct Connect connection and route VPC traffic to it using an internet gateway.

Answer

Create a hosted connection with a private VIF and associate it directly with the VPC route table without any gateway.

Question 23

A media company runs an on-premises rendering farm connected to AWS through a 10 Gbps Direct Connect connection. They currently upload large render outputs to an Amazon S3 bucket in us-east-1 over the public internet, but want the traffic to traverse the Direct Connect link instead to reduce cost and improve consistency. The workload must reach S3 and other AWS public service endpoints without going through a VPC. Which Direct Connect configuration meets this requirement?

Accepted Answer

Create a public virtual interface (VIF) on the Direct Connect connection and advertise the on-premises prefixes over BGP.

Answer

Create a private virtual interface (VIF) associated with a virtual private gateway attached to a VPC that has an S3 gateway endpoint.

Answer

Create a transit virtual interface (VIF) attached to a Transit Gateway and add a route to the S3 prefix list.

Answer

Create an interface VPC endpoint (PrivateLink) for S3 and route the private VIF traffic through it.

Question 24

A company has a 10 Gbps Direct Connect connection at a single location. They need to provide private connectivity from their on-premises data center to five VPCs spread across three AWS accounts, all attached to a single Transit Gateway in one Region. They want to minimize the number of virtual interfaces they must provision and manage on the Direct Connect connection. Which approach meets these requirements?

Accepted Answer

Create a single transit VIF on the Direct Connect connection and associate it with a Direct Connect gateway that is associated with the Transit Gateway.

Answer

Create one private VIF per VPC and use VPC peering between the VPCs to share the connection.

Answer

Create a public VIF and route traffic to each VPC's public endpoints over the Direct Connect connection.

Answer

Create one private VIF per VPC and associate each with its own virtual private gateway attached to the respective VPC.

Question 25

A company operates 40 VPCs spread across three AWS accounts in the eu-west-1 Region. They connect to two on-premises data centers using Direct Connect. Requirements: (1) all VPCs must reach on-premises networks over Direct Connect, (2) each VPC's CIDR must be advertised to on-premises, and (3) the design must scale to 100+ VPCs while minimizing per-connection management overhead. They currently use one Direct Connect gateway associated directly with each VPC's virtual private gateway. As they grow, they hit the limit on the number of VGWs that can be associated with a single Direct Connect gateway. Which design change best meets the requirements at scale?

Accepted Answer

Deploy a single Transit Gateway shared across accounts via AWS RAM, attach all VPCs to it, and create a Direct Connect gateway association with that Transit Gateway.

Answer

Deploy a Transit Gateway in each account, associate each Transit Gateway with the Direct Connect gateway, and attach the VPCs to their local Transit Gateway.

Answer

Create additional Direct Connect gateways and distribute the VGW associations across them so no single gateway exceeds its VGW association limit.

Answer

Replace Direct Connect with multiple Site-to-Site VPN connections terminated on each VPC's virtual private gateway to avoid Direct Connect gateway limits.