A security team must explicitly block traffic from a specific range of malicious IP addresses at the subnet boundary of a VPC. Which VPC feature should they use?
Intermediate · Choose one
Explanation
Answer: D. Network ACLs operate at the subnet level and are the only VPC firewall construct that supports explicit deny rules. Rules are numbered and evaluated in order from the lowest number, so a low-numbered deny rule for the malicious CIDR range blocks that traffic before any later allow rule is considered.
A. Route tables control where traffic is sent, not whether it is permitted. Using routes as a security control is unreliable and does not filter inbound traffic at the subnet boundary.
B. IAM policies authorize API calls to AWS services. They do not filter network packets flowing to EC2 instances.
C. Security groups support allow rules only. There is no way to express a deny rule in a security group.
02
Amazon EC2 instances in a private subnet must download operating system patches from the internet, but nothing on the internet should be able to initiate a connection to them. Which VPC component should be used?
Intermediate · Choose one
Explanation
Answer: C. A NAT gateway placed in a public subnet performs network address translation for instances in private subnets. It allows those instances to initiate outbound connections to the internet, for example to fetch patches, while preventing any unsolicited inbound connections from reaching them.
A. Internet gateways are attached to the VPC, not to a subnet, and routing a private subnet directly to one would make those instances reachable from the internet if they had public addresses, which violates the requirement.
B. A virtual private gateway terminates a Site-to-Site VPN connection to an on-premises network. It does not provide internet access.
D. Assigning Elastic IP addresses would make the instances publicly addressable and therefore reachable from the internet, which is exactly what must be prevented.
03
A company runs identical copies of its web application in three AWS Regions. It wants Amazon Route 53 to send each user to the Regional endpoint that gives that user the fastest response. Which routing policy should be configured?
Intermediate · Choose one
Explanation
Answer: D. A latency routing policy is used when resources exist in multiple AWS Regions and you want traffic served from the Region that provides the lowest network latency for the requester. Route 53 uses measured latency data between users and Regions, so the choice reflects actual network performance rather than geography alone.
A. Weighted routing splits traffic across endpoints in proportions you define. It ignores latency entirely.
B. Simple routing returns a single record with no logic for choosing between multiple endpoints.
C. Geolocation routing sends users to endpoints based on the geographic location the DNS query originates from. The nearest geographic endpoint is not always the lowest-latency one.
04
A company maintains a primary application stack in one AWS Region and a standby stack in a second Region. It wants Amazon Route 53 to send all traffic to the primary while it is healthy and to switch to the standby automatically when a health check fails. Which routing policy should be used?
Intermediate · Choose one
Explanation
Answer: C. A failover routing policy implements an active-passive design. The primary record serves all traffic while its associated Route 53 health check passes, and Route 53 begins answering with the secondary record when the primary is judged unhealthy.
A. Multivalue answer routing returns up to eight healthy records at random. It spreads traffic across all healthy endpoints instead of preferring a designated primary.
B. IP-based routing maps user IP address ranges (CIDR blocks) to endpoints. It is used for network-based traffic engineering, not failover.
D. Geoproximity routing routes based on the geographic location of resources and users, with an optional bias to shift traffic. It is not an active-passive failover mechanism.
05
Which AWS service allows developers to create, publish, monitor, and secure REST, HTTP, and WebSocket APIs at any scale, acting as a managed front door to backend services such as AWS Lambda and Amazon EC2?
Intermediate · Choose one
Explanation
Answer: A. Amazon API Gateway is a fully managed service for creating, publishing, maintaining, monitoring, and securing APIs. It handles traffic management, authorization and access control, throttling, and API versioning, and it integrates natively with Lambda, EC2, and other AWS and HTTP backends.
B. AWS Amplify helps developers build and host frontend web and mobile applications and their backends. It is aimed at frontend delivery rather than at publishing, throttling, and securing APIs for arbitrary backends.
C. Elastic Load Balancing distributes network connections across targets. It does not provide API keys, usage plans, request throttling, or API lifecycle management.
D. CloudFront caches and delivers content at the edge. It can sit in front of an API but does not create or manage API definitions.
06
Which statement about Amazon VPC subnets is TRUE?
Intermediate · Choose one
Explanation
Answer: C. A VPC is a Regional construct that spans all Availability Zones in its Region, but each subnet is created inside exactly one Availability Zone. This is why highly available designs create at least one subnet in each of two or more Availability Zones and distribute resources across them.
A. A VPC can contain many subnets, and they may be public or private depending on their route table configuration.
B. Subnets never span Availability Zones. Spanning zones is achieved by creating multiple subnets, one per zone.
D. VPCs and subnets are Regional. A subnet cannot exist in two Regions; cross-Region designs use separate VPCs connected by peering or Transit Gateway.
07
Which TWO statements correctly compare AWS Direct Connect with AWS Site-to-Site VPN? (Choose TWO.)
Hard · Select 2 answers
Explanation
Answer: C and E. AWS Direct Connect establishes a dedicated physical link between the customer's network and AWS that bypasses the public internet, so throughput and latency are consistent and predictable. AWS Site-to-Site VPN, by contrast, builds an IPsec tunnel over the customer's existing internet connection, so it can be configured quickly with no circuit to order and no long lead time.
A. This is reversed. A VPN traverses the public internet, so its bandwidth and latency vary with internet conditions, whereas Direct Connect provides the dedicated path.
B. A standard Direct Connect connection is private but is not encrypted by default. Encryption requires running a VPN over Direct Connect or using MACsec on supported connections.
D. Direct Connect involves port-hour charges and cross-connect fees, so for small or intermittent data volumes a VPN is usually cheaper. Direct Connect tends to win on cost only at sustained high data transfer volumes.
08
Amazon EC2 instances in a private subnet need to read and write objects in an Amazon S3 bucket. The security team requires that this traffic never traverse the public internet, and they do not want to run a NAT gateway for it. What should be implemented?
Hard · Choose one
Explanation
Answer: B. A VPC gateway endpoint for Amazon S3 adds a route in the subnet's route table that sends S3-destined traffic across the AWS private network. No internet gateway, NAT device, or public IP address is required, and the traffic never leaves the AWS network.
A. A bucket policy controls authorization once a request arrives. It does not create a network path, so instances with no route to S3 still could not reach the bucket.
C. A Site-to-Site VPN connects a VPC to an on-premises network. It does not provide private access to Amazon S3 from within the VPC.
D. An internet gateway by definition routes traffic to and from the public internet, which the security team has explicitly ruled out.
09
A company has one VPC in the eu-west-1 Region and another in ap-southeast-1. Application servers in each VPC must communicate using private IP addresses without sending traffic over the public internet. Which option meets this requirement with the least configuration?
Hard · Choose one
Explanation
Answer: D. VPC peering creates a networking connection between two VPCs so that resources can communicate using private IP addresses as if they were on the same network. Inter-Region peering is supported, and the traffic travels over the AWS global backbone rather than the public internet, and it is encrypted by AWS.
A. Internet gateways route traffic over the public internet, which the requirement rules out, and the servers would need public IP addresses.
B. CloudFront is a content delivery network for delivering content to end users. It is not a VPC-to-VPC connectivity mechanism.
C. NAT gateways provide outbound internet access for private subnets. They do not create private connectivity between two VPCs.
10
A team is releasing a new version of its web application and wants to send 10 percent of user traffic to the new version and 90 percent to the current version, adjusting the split over time. Which Amazon Route 53 routing policy supports this?
Hard · Choose one
Explanation
Answer: B. A weighted routing policy lets you associate multiple records with the same name and assign each a relative weight. Route 53 returns each record in proportion to its weight, so a 10 and 90 split sends roughly one in ten requests to the new version. Adjusting the weights shifts traffic gradually, which is the standard DNS-level canary or blue/green technique.
A. Multivalue answer routing returns up to eight healthy records selected at random. It provides rough distribution but no configurable percentage split.
C. Failover routing is binary and health-check driven. It sends all traffic to the primary or all to the secondary, with no proportional split.
D. Latency routing chooses the Region with the best measured latency for each user. The proportion of traffic each version receives cannot be controlled.