AWS Certified Advanced Networking – Specialty — Practice Set 1

Question 1

A network engineer is designing the VPC architecture for a new AWS workload. The application requires 500 EC2 instances in a single Availability Zone with room to scale to 1,000 instances. The organization also needs 50 addresses reserved for internal load balancers and NAT infrastructure. The network must be a contiguous IPv4 CIDR block. Which VPC CIDR block MOST efficiently meets these requirements while minimizing wasted address space?

Accepted Answer

A /22 CIDR provides 1,024 addresses. AWS reserves 5 addresses per subnet, but at the VPC level this is sufficient for 1,000 instances plus 50 infrastructure addresses (1,050 total) with minimal waste of ~974 usable addresses. A /20 provides 4,096 addresses — functional but wastes over 3,000 addresses unnecessarily. A /16 with 65,536 addresses is massively over-provisioned for 1,000 instances and wastes address space that could be used for other VPCs in the organization. A /24 with 256 addresses cannot accommodate 500 instances even at the initial scale requirement.

Question 2

A network engineer is designing connectivity for a company with 40 Amazon VPCs spread across 4 AWS Regions. Each VPC needs full mesh connectivity with all other VPCs in the same Region and selective connectivity to VPCs in other Regions. The company expects to add 20 new VPCs over the next year. The architecture must minimize configuration complexity and operational overhead. Which connectivity architecture BEST meets these requirements?

Accepted Answer

AWS Transit Gateway in each Region acts as a hub for all VPC attachments, eliminating the O(n²) peering connection explosion of full mesh VPC peering — adding a new VPC requires only one Transit Gateway attachment. Inter-Region connectivity via Transit Gateway peering provides selective cross-Region paths. Full mesh VPC peering (option A) requires 40×39/2 = 780 peering connections for the current VPCs and is non-transitive, meaning routing updates are required for every new VPC pair. A transit VPC using EC2 appliances (option C) introduces operational overhead of managing EC2 instances, patching, and high-availability configurations. AWS Cloud WAN is a valid modern approach but is a higher-level abstraction that itself uses Transit Gateways; for direct architectural control, Transit Gateway peering is the more foundational and examination-expected answer.

Question 3

A network engineer is designing a hybrid connectivity architecture for a financial services company. The company requires a dedicated 10 Gbps connection from its on-premises data center to AWS with failover to a backup path. The primary path must provide deterministic latency under 5 ms to an AWS Direct Connect location 30 miles from the data center. The backup path must activate automatically in under 60 seconds if the primary fails. Which architecture MOST reliably meets all requirements?

Accepted Answer

Two dedicated Direct Connect connections from different locations provides both the 10 Gbps deterministic latency requirement and genuine path redundancy at the physical layer — BGP MED values control primary/backup preference and BGP reconvergence happens within seconds (well under 60 seconds). A single Direct Connect with CloudWatch/Lambda failover (option A) has no redundant path — if the physical connection fails, the Lambda has nowhere to fail over to. A LAG (option B) bonds connections from the same location into a single logical link; if the Direct Connect location itself fails, both LAG members fail simultaneously. A Direct Connect + Site-to-Site VPN backup (option C) is a common architecture but VPN over the internet cannot guarantee the 5 ms deterministic latency requirement for the backup path, and the 60-second failover SLA is borderline for BGP + IKE negotiation times.

Question 4

A network engineer is designing IP addressing for a large enterprise migrating to AWS. The company has existing on-premises networks using the 10.0.0.0/8 private address space and plans to connect 80 VPCs to the on-premises environment without NAT. The company needs to ensure no IP address overlaps across all VPCs and the on-premises network. The VPC address space will be allocated from 172.16.0.0/12. Each VPC needs at least 2,000 usable IP addresses. Which subnet size MOST efficiently allocates VPC CIDRs for 80 VPCs from 172.16.0.0/12?

Accepted Answer

A /21 provides 2,048 addresses, exceeding the 2,000 usable requirement (after AWS's 5-address reservation per subnet, actual usable is slightly less but workable with multiple subnets). The 172.16.0.0/12 space contains 1,048,576 addresses, which accommodates 512 /21 blocks — more than sufficient for 80 VPCs with room for growth. A /24 with 256 addresses cannot meet the 2,000-address requirement. A /16 with 65,536 addresses is 32x over-provisioned; 80 /16 blocks would exhaust only part of the /12 space but wastes addresses unnecessarily when the requirement is only 2,000. A /20 with 4,096 addresses also works and fits 256 VPCs, but /21 is the MOST efficient fit for the stated 2,000-address requirement.

Question 5

A network engineer is designing a multi-Region, multi-account AWS networking architecture for a global enterprise. The company requires centralized inspection of all inter-VPC traffic and all traffic egressing to the internet, using a third-party next-generation firewall. The architecture must scale to 200 VPCs across 3 Regions without reconfiguration of existing VPCs when new VPCs are added. Traffic must not bypass inspection under any circumstances. Which architecture MOST effectively meets all requirements?

Accepted Answer

AWS Gateway Load Balancer (GWLB) is specifically designed for centralized third-party network appliance inspection at scale: it transparently intercepts traffic using GENEVE encapsulation, distributes it across a scalable fleet of firewall appliances, and returns it to the original path. GWLB endpoints in each spoke VPC redirect traffic to the central inspection VPC without requiring changes to application VPC route tables when new VPCs are added to the Transit Gateway. AWS Network Firewall (option A) is an AWS-managed service, not a third-party firewall — the requirement specifically calls for third-party appliances. Deploying a firewall in each spoke VPC (option B) defeats the centralization requirement and requires per-VPC management of appliances. Per-VPC AWS Network Firewall policies (option D) again use an AWS-managed service, not third-party appliances, and do not use centralized inspection.

Question 6

A network engineer is designing BGP routing for a company with AWS Direct Connect and an on-premises network. The company has two AWS Direct Connect connections: a primary 10 Gbps connection through Direct Connect location A and a secondary 1 Gbps connection through Direct Connect location B. Traffic from on-premises to AWS must always prefer the primary 10 Gbps path. Traffic from AWS to on-premises must also prefer the primary path. The on-premises BGP router uses AS 65001 and the AWS side uses AS 7224. Which BGP configuration achieves BOTH directional path preferences?

Accepted Answer

For traffic from on-premises to AWS (inbound to AWS): AS path prepending on the secondary connection makes the secondary path appear longer, causing the on-premises BGP router to prefer the primary shorter-AS-path route. For traffic from AWS to on-premises (outbound from AWS): AWS Direct Connect supports BGP communities that influence the Local Preference on the AWS side — using community tags on the primary prefix advertisements raises the effective preference for that path. Option A correctly uses Local Preference for the AWS side, but AWS customers cannot directly set Local Preference on the AWS VGW; the mechanism is BGP communities. MED (option C) only influences path selection between two connections to the SAME AS peer — it does not reliably work across different Direct Connect locations with different POP routers. Advertising more-specific routes (option D) changes routing for specific prefixes rather than setting path preference and could cause unexpected routing for other prefixes.

Question 7

A network engineer is designing DNS architecture for a hybrid cloud environment. The company has an on-premises Active Directory DNS serving the domain corp.example.com. AWS workloads in multiple VPCs must be able to resolve both AWS Route 53 private hosted zones (aws.example.com) and on-premises hostnames (corp.example.com). On-premises clients must also be able to resolve the AWS private hosted zone names. The architecture must be fully redundant with no single point of failure. Which DNS architecture MOST effectively meets all requirements? (Choose TWO.)

Accepted Answer

Route 53 Resolver outbound endpoints (option B) enable AWS workloads to resolve on-premises corp.example.com names by forwarding queries to on-premises DNS servers — this is the AWS-recommended mechanism for hybrid DNS. Route 53 Resolver inbound endpoints (option E) placed in a centralized DNS VPC allow on-premises DNS servers to forward aws.example.com queries into AWS for resolution in private hosted zones; deploying across two Availability Zones eliminates single points of failure; sharing resolver rules via AWS Resource Access Manager extends the same DNS configuration to all VPCs without duplication. Option A describes inbound endpoints but at the individual VPC level, which creates management overhead at scale and is not as operationally efficient as centralized endpoints shared via RAM. Option C routes all DNS through on-premises servers, which creates an on-premises dependency for all AWS DNS and a single point of failure. Option D involves manual synchronization, which introduces risk of DNS record drift and operational complexity.

Question 8

A network engineer is designing a content delivery architecture for a global media company. The company hosts video streaming content in Amazon S3 in us-east-1. Users are globally distributed with 60% in Asia-Pacific and 40% in Europe. The company needs to minimize video start latency and buffer events while keeping data transfer costs as low as possible. Origin shield must protect the origin from request spikes. Which architecture BEST meets these requirements?

Accepted Answer

Amazon CloudFront with Origin Shield provides an additional caching layer between edge locations and the origin, dramatically reducing origin requests during traffic spikes and improving cache hit ratios for video segments. PriceClass_All ensures all global CloudFront edge locations serve users in Asia-Pacific and Europe with minimum latency. Multiple origins with S3 replication (option B) increases complexity and replication costs without the CDN caching benefit — each user request would still potentially hit S3 rather than a CloudFront cache. Lambda@Edge redirecting to S3 Transfer Acceleration (option C) uses Transfer Acceleration for uploads to S3, not for CloudFront viewer delivery — this is the wrong service for content delivery optimization. EC2 streaming servers (option D) require significant operational overhead for patching, scaling, and high availability, and still need to fetch content from S3 without caching optimization.

Question 9

A network engineer needs to implement VPC connectivity between a production VPC (10.1.0.0/16) and a database VPC (10.2.0.0/16) in the same AWS Region and same AWS account. The connection must be private (no traffic over the internet), have low latency, and EC2 instances in the production VPC must be able to initiate connections to database instances in the database VPC on port 5432. Which implementation MOST simply satisfies these requirements?

Accepted Answer

VPC peering is the simplest and most direct solution for two-VPC connectivity in the same Region: a single peering connection with route table entries in both VPCs enables low-latency private connectivity with no additional infrastructure. The CIDR ranges 10.1.0.0/16 and 10.2.0.0/16 do not overlap, so peering is technically feasible. Site-to-Site VPN between two VPCs is not supported — VPN connections are for hybrid on-premises-to-AWS connectivity. AWS Transit Gateway (option C) is architecturally correct but operationally heavier for a simple two-VPC scenario — it introduces a managed transit hub with associated costs and configuration not needed for just two VPCs. AWS PrivateLink (option D) works but requires deploying a Network Load Balancer as a service endpoint, adding cost and configuration complexity beyond what the simple two-VPC requirement needs.

Question 10

A network engineer is implementing internet egress for a multi-VPC architecture. Multiple application VPCs contain private EC2 instances that need outbound internet access for software updates. To reduce costs, the company wants to centralize NAT gateways in a single egress VPC rather than deploying NAT gateways in each application VPC. All traffic must be inspected by a third-party firewall in the egress VPC before reaching the internet. Which implementation correctly routes traffic through the centralized egress architecture?

Accepted Answer

The centralized egress pattern with Transit Gateway routes 0.0.0.0/0 from application VPCs through the Transit Gateway to the egress VPC attachment. In the egress VPC, traffic hits the firewall appliance subnet first (via route table), is inspected, then forwarded to the NAT gateway subnet, which routes outbound traffic through the internet gateway. This creates the inspection chain: app VPC → TGW → firewall → NAT GW → internet. Option A configures a blackhole for 0.0.0.0/0 in the application VPC TGW route table, which would drop all internet traffic rather than route it. VPC peering (option C) is non-transitive — traffic from an application VPC cannot reach the NAT gateway in the egress VPC through peering because routing through a peered VPC to another resource is not supported. Routing internet traffic back through on-premises (option D) introduces massive backhaul bandwidth costs and latency.

Question 11

A network engineer is implementing AWS Direct Connect for an enterprise customer. The customer has ordered a 10 Gbps hosted connection through an AWS Direct Connect partner and needs to connect 5 VPCs in the same AWS Region to the on-premises network. The customer wants to minimize the number of BGP sessions and virtual interfaces needed. Which implementation MOST efficiently connects all 5 VPCs through a single Direct Connect connection?

Accepted Answer

A transit VIF with a Direct Connect gateway and Transit Gateway is the most efficient architecture: one transit VIF and one BGP session handles all traffic, and the Transit Gateway provides connectivity to all 5 VPCs through their Transit Gateway attachments. This minimizes BGP sessions to a single session between the on-premises router and the Direct Connect gateway. Five private VIFs (option A) requires 5 BGP sessions and 5 VIFs — functional but the opposite of minimizing VIFs. Public VIF with public IPs (option C) routes traffic over the public internet addressing space even through Direct Connect, not through VPC private addressing — this is not the correct approach for private VPC connectivity. A single private VIF with a Direct Connect gateway associated to multiple VGWs (option D) is a valid approach but limits the number of VGWs that can be associated to 10, and is less scalable and requires VGW in each VPC rather than the Transit Gateway hub model.

Question 12

A network engineer is implementing IPv6 connectivity for an existing VPC that currently uses only IPv4. The VPC has public subnets with internet-facing EC2 instances and private subnets with backend services. The private subnet instances must be able to initiate outbound connections to the internet over IPv6 but must NOT accept inbound IPv6 connections from the internet. Public subnet instances need full bidirectional IPv6 internet connectivity. Which implementation correctly satisfies both subnet requirements?

Accepted Answer

AWS provides an egress-only internet gateway specifically for private subnets with IPv6: it allows outbound-initiated IPv6 traffic to the internet but is stateful — it drops any inbound connection attempts from the internet, providing exactly the required behavior for private subnets. Public subnets use the standard internet gateway for full bidirectional IPv6. Option A routes both public and private subnets through the internet gateway, which accepts inbound IPv6 connections — security groups would need to block all inbound IPv6, but this relies on application-layer policy rather than network architecture to provide the protection. NAT64 (option C) is for enabling IPv6 clients to reach IPv4 destinations, not for providing outbound-only IPv6 internet access from private instances that already have native IPv6 addresses. Relying on security groups alone (option D) is not best practice for private subnet internet isolation — the network-layer control (egress-only internet gateway) should enforce this.

Question 13

A network engineer is implementing a service endpoint for an internal microservice that must be accessible from 30 VPCs across multiple AWS accounts without making the service publicly accessible. The service is a REST API running behind a Network Load Balancer. New consumers must be able to subscribe without changes to the service provider's infrastructure. The service provider needs to control which AWS accounts can access the endpoint. Which implementation MOST effectively meets all requirements?

Accepted Answer

AWS PrivateLink endpoint services are purpose-built for this pattern: the service provider creates one endpoint service backed by the NLB and controls access via an allowed principals list (specific account IDs or IAM ARNs). Each consumer account creates an interface VPC endpoint without any changes to the provider's infrastructure. New consumers require only a new endpoint creation on their side and an approval from the provider. Transit Gateway (option B) provides connectivity but is less operationally clean for multi-account consumer scenarios and requires Transit Gateway attachments in every account, creating shared infrastructure. VPC peering to 30 VPCs (option C) requires 30 peering connections, route table entries in 31 VPCs, and CIDR-based security group rules — management complexity grows linearly with consumers. Amazon API Gateway private endpoints (option D) work for HTTP/HTTPS APIs but add API Gateway abstraction overhead; the requirement is direct NLB access, not HTTP API management.

Question 14

A network engineer is implementing an Amazon Route 53 routing policy for a global application with endpoints in us-east-1, eu-west-1, and ap-southeast-1. The primary objective is to route each user to the endpoint with the lowest network latency. However, if any regional endpoint becomes unhealthy, users should be automatically rerouted to the next-lowest-latency healthy endpoint. Which Route 53 configuration MOST effectively achieves this?

Accepted Answer

Route 53 latency-based routing records with associated health checks provide exactly the required behavior: Route 53 measures latency between the user's resolver and each AWS Region and routes to the lowest-latency healthy endpoint. When an endpoint fails its health check, Route 53 automatically removes it from consideration and routes to the next-lowest-latency healthy region. Weighted routing with equal weights distributes traffic evenly regardless of latency — users in Asia would get the same traffic distribution to us-east-1 as ap-southeast-1, not latency-optimized routing. Geolocation routing routes based on the geographic location of DNS resolvers, not actual network latency — a user in Eastern Europe might have lower latency to us-east-1 than eu-west-1 in specific scenarios. Failover routing supports only primary/secondary hierarchy, not the multi-Region lowest-latency selection required.

Question 15

A network engineer needs to troubleshoot intermittent connectivity failures between an EC2 instance in a private subnet and an Amazon RDS database in the same VPC. The engineer suspects the issue may be related to security group or network ACL rules blocking specific traffic. Which AWS tool provides the MOST direct visibility into accepted and rejected traffic flows at the network interface level?

Accepted Answer

Amazon VPC Flow Logs capture metadata for all IP traffic flowing to and from network interfaces, including the source/destination IP, port, protocol, packet count, and crucially the ACCEPT/REJECT action. REJECT records directly indicate which traffic is being dropped by security group or network ACL rules, enabling precise diagnosis of connectivity failures. AWS CloudTrail logs API calls (configuration changes) but does not capture network traffic metadata — it would show when a security group was modified but not whether current traffic is being blocked. AWS X-Ray provides application-level distributed tracing but requires SDK instrumentation in the application code and does not capture network-layer accept/reject decisions. AWS Reachability Analyzer performs configuration-based path analysis (very useful for diagnosing misconfigurations) but does not capture actual traffic flow data for intermittent failures.

Question 16

A network engineer is monitoring a production environment with 500 EC2 instances across 10 VPCs. The operations team needs to be alerted within 5 minutes if any EC2 instance begins generating traffic to known malicious IP addresses or if any unusual port scanning activity is detected within VPCs. The solution must require no agents installed on EC2 instances. Which service BEST meets these requirements?

Accepted Answer

Amazon GuardDuty is a managed threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events without requiring any agents. It uses machine learning and AWS threat intelligence feeds to detect communication with known malicious IPs (GuardDuty finding type: UnauthorizedAccess:EC2/MaliciousIPCaller) and port scanning (Recon:EC2/PortProbeUnprotectedPort). EventBridge with SNS delivers findings within minutes of detection. VPC Flow Logs with CloudWatch Metrics filters (option A) could detect traffic to static known-bad IPs if maintained as a filter list, but requires custom development, continuous threat intelligence feed maintenance, and does not natively detect port scanning patterns. Systems Manager Agent (option C) requires agent installation, contradicting the no-agent requirement. AWS Security Hub (option D) aggregates findings from GuardDuty and other services but is not itself a detection engine for these specific network threat patterns.

Question 17

A network engineer needs to verify that a newly implemented Transit Gateway route table change does not create unintended network paths that allow a development VPC to reach a production database subnet. The change has not yet been deployed to production. Which approach is MOST effective for validating the intended connectivity isolation before deployment?

Accepted Answer

AWS Reachability Analyzer performs deterministic configuration-based analysis of network paths without sending actual traffic — it examines route tables, security groups, NACLs, Transit Gateway route tables, and other network configuration to determine whether a path exists between two endpoints. Running it before deployment by analyzing the current configuration reveals whether the planned change would create an unintended path. Importantly, it can be run against the current state AND after applying a proposed route table change in a staging environment. VPC Flow Logs (option A) only detect traffic after it has occurred — deploying the change and then monitoring means production was already exposed. AWS Network Manager provides topology visualization but requires manual path tracing without automated route verification. Deploying a test instance and running traceroute (option D) sends actual packets to production, violating the 'before deployment' requirement and potentially triggering security alerts.

Question 18

A network engineer is investigating a performance degradation issue on an AWS Direct Connect connection. Customers are reporting 40% higher than baseline latency for database queries that traverse the Direct Connect link from on-premises to AWS. The Direct Connect connection itself shows no errors or dropped packets in AWS CloudWatch Direct Connect metrics. Which diagnostic steps should the engineer take FIRST to identify the root cause? (Choose TWO.)

Accepted Answer

When Direct Connect shows no errors but latency has increased, the two most likely causes are bandwidth saturation (causing queuing delay) and routing changes (causing traffic to take a longer path). Checking CloudWatch bandwidth utilization metrics (option A) immediately identifies if the connection is at or near capacity — queuing delay increases sharply as utilization approaches 100%. Reviewing BGP route advertisements (option B) catches scenarios where a BGP route change caused traffic to be rerouted over a longer AS path or even through an internet VPN backup path with higher latency. Resetting the BGP session (option C) is a disruptive action that would briefly interrupt all traffic on the Direct Connect connection — never appropriate as a first diagnostic step. AWS X-Ray (option D) provides application-layer tracing but cannot diagnose network-layer latency increases at the Direct Connect infrastructure level. Checking TGW/VGW metrics (option E) is a reasonable secondary step but would show internal AWS-side packet handling; the problem is more likely at the Direct Connect link or BGP routing layer.

Question 19

A network engineer is managing DNS for a company's AWS workloads. The company has migrated its public-facing applications to AWS and uses Amazon Route 53 for DNS. After a recent deployment, some users report intermittent DNS resolution failures for the application's domain name. The engineer finds that the TTL on the affected records was changed from 300 seconds to 30 seconds during the deployment. Amazon Route 53 health checks show all endpoints as healthy. Which is the MOST likely cause of the intermittent resolution failures?

Accepted Answer

When TTL is changed from 300 to 30 seconds, the change itself is subject to the old 300-second TTL — downstream resolvers that cached the DNS record right before the TTL change will continue serving stale records (potentially pointing to decommissioned IPs) for up to 300 seconds. During this transition window, some users get fresh 30-second TTL responses from Route 53 while others get stale 300-second cached responses from upstream resolvers, causing intermittent failures. Route 53 does not rate-limit DNS responses based on TTL value. Route 53 health check propagation is within seconds — if all endpoints show healthy in the console, they are healthy. DNSSEC failures cause consistent SERVFAIL responses, not intermittent failures dependent on which resolver the client uses.

Question 20

A network engineer needs to protect a public-facing web application on AWS from SQL injection attacks, cross-site scripting (XSS), and HTTP flood attacks (DDoS at Layer 7). The application runs behind an Application Load Balancer. Which combination of AWS services MOST effectively protects against all three threat categories?

Accepted Answer

AWS WAF Managed Rules Common Rule Set contains pre-built rules that detect and block SQL injection and XSS patterns in HTTP requests; WAF rate-based rules limit requests per IP per time window, mitigating HTTP flood attacks at Layer 7. AWS Shield Advanced provides enhanced DDoS protection including 24/7 DRT support and cost protection during DDoS events. AWS Shield Standard (option A) protects against network/transport layer DDoS but not Layer 7 HTTP floods or application-layer attacks like SQL injection and XSS. Amazon Inspector scans software for vulnerabilities (option C) — it is a vulnerability assessment tool, not a real-time traffic inspection service. VPC NACLs (option D) operate at the IP/port level and cannot inspect HTTP request bodies for SQL injection or XSS payloads.

Question 21

A network engineer is implementing network segmentation for a multi-tier application in a single VPC. The application has a web tier in public subnets, an application tier in private subnets, and a database tier in private subnets. The security team requires that the web tier can only communicate with the application tier on port 8080, the application tier can only communicate with the database tier on port 5432, and no direct communication is permitted between the web tier and database tier. Which control MOST effectively enforces this segmentation?

Accepted Answer

Security group chaining by referencing security group IDs (not CIDR ranges) is the most precise and maintainable approach: the application tier security group's inbound rule references the web tier security group ID for port 8080 — only instances in the web security group can initiate connections on that port. Similarly, the database tier only allows port 5432 from the application tier security group. No rule in the database security group allows the web tier security group, enforcing zero direct web-to-database communication. Network ACLs (option A) are stateless and operate on CIDR ranges — they cannot reference security groups and require explicit bidirectional rules for each connection, increasing complexity and risk of misconfiguration. Separate VPCs with peering (option C) adds architectural complexity for a segmentation requirement that security groups handle natively within a single VPC. AWS Network Firewall (option D) is appropriate for north-south or inter-VPC traffic inspection but is over-engineered for intra-VPC tier segmentation that security groups achieve without additional cost.

Question 22

A network engineer is designing network security controls for an environment that must comply with PCI DSS requirements. The environment includes cardholder data environment (CDE) VPCs and out-of-scope VPCs that must be network-isolated from each other. The company uses AWS Transit Gateway for inter-VPC connectivity. An internal audit found that a misconfigured Transit Gateway route table entry briefly allowed connectivity between an out-of-scope VPC and the CDE. Which control MOST effectively prevents recurrence of accidental cross-environment connectivity?

Accepted Answer

For PCI DSS compliance, the strongest control is architectural isolation: separate Transit Gateways for CDE and out-of-scope environments with an SCP (Service Control Policy) at the AWS Organizations level that prevents any principal from creating a peering attachment between them. This eliminates the root cause of accidental misconfiguration — there is no route table entry that could accidentally enable connectivity because the two networks are not connected at any layer. Config + Lambda remediation (option A) provides detective and corrective controls but has a time gap between misconfiguration and remediation during which connectivity exists — this is a compensating control, not a preventive one suitable for PCI DSS. Resource Access Manager sharing restrictions (option C) control which VPCs can be attached but do not prevent an administrator from manually creating a peering between the two Transit Gateways. AWS Network Firewall (option D) is a detective/preventive control at the traffic layer but the underlying routing misconfiguration persists — for PCI DSS the architectural separation is the required control.

Question 23

A network engineer is implementing VPC endpoints to eliminate internet exposure for AWS service traffic. The company's EC2 instances in private subnets need to access Amazon S3 and Amazon DynamoDB. The security team requires that S3 access is restricted to specific company-owned S3 buckets only and that traffic never traverses the internet or uses public IPs. Which VPC endpoint types and access controls MOST effectively meet these requirements?

Accepted Answer

Amazon S3 and Amazon DynamoDB both support gateway VPC endpoints, which route traffic through the AWS private network at no additional cost (unlike interface endpoints which have hourly charges). Gateway endpoints update VPC route tables to direct S3/DynamoDB traffic through the endpoint automatically, ensuring traffic never traverses the internet. The endpoint policy on the S3 gateway endpoint restricts which buckets can be accessed through the endpoint, enforcing the bucket restriction requirement. Interface endpoints for DynamoDB (option C) are valid but cost more than gateway endpoints unnecessarily. Gateway endpoints for both services with endpoint policies (option B) is the correct, cost-optimal approach. NAT gateway (option D) routes traffic to public S3/DynamoDB endpoints over the internet, which violates the no-internet-exposure requirement.

Question 24

A network engineer is designing network security governance for a company with 200 AWS accounts managed through AWS Organizations. The security team requires that all VPCs in all accounts have AWS Network Firewall policies applied consistently, with no ability for individual account administrators to disable or modify the firewall policies. New VPCs created in any account must automatically have the required firewall policy applied. Which governance approach MOST effectively meets these requirements at scale?

Accepted Answer

AWS Firewall Manager is purpose-built for centralized network security policy governance across AWS Organizations: it allows a delegated security account to define Network Firewall policies that automatically propagate to all in-scope accounts and VPCs, including newly created VPCs through automatic remediation. Individual account administrators cannot modify Firewall Manager-managed policies. The security team manages one policy definition that enforces consistently across 200 accounts. Lambda + EventBridge (option B) requires deploying and maintaining Lambda functions in 200 accounts — significant operational overhead and no central management of the policy definition. AWS Config auto-remediation (option C) has a detection-to-remediation lag and requires Config rules deployed in all accounts; it detects non-compliance after VPC creation, not immediately on creation. Service Catalog templates (option D) relies on administrator compliance — administrators could still create VPCs without deploying the template, and the requirement states they must not be able to disable the policy.

Question 25

A network engineer is implementing security controls for an AWS Transit Gateway that connects 50 VPCs in a financial services environment. The company's compliance team requires that all inter-VPC traffic flows be logged with full metadata for 7 years, that traffic between specific VPC pairs be encrypted in transit, and that traffic analysis be available for forensic investigation within 1 hour of a security incident. Which combination of controls MOST comprehensively satisfies all three compliance requirements?

Accepted Answer

VPC Flow Logs with S3 Object Lock in compliance mode (not governance mode) provides tamper-proof 7-year log retention that satisfies financial services compliance requirements — compliance mode prevents even privileged users from deleting records before expiry. TLS in application communications handles encryption in transit between VPCs. Amazon Athena's serverless SQL querying against S3 Flow Logs enables forensic analysis within minutes, satisfying the 1-hour requirement. Transit Gateway Flow Logs (option B) is valid but MACsec encryption is only available for AWS Direct Connect dedicated connections, not for inter-VPC traffic through Transit Gateway — this does not satisfy encryption for inter-VPC paths. CloudTrail logs API calls (option C), not traffic flows, and AWS Certificate Manager manages certificates but does not by itself encrypt inter-VPC traffic. GuardDuty (option D) provides threat detection, not traffic flow logging for compliance — KMS encrypts data at rest, not data in transit between VPCs.

ANS-C01 — AWS Certified Advanced Networking – Specialty