Unit 2: Networking and Connectivity in AWS - Practice Quiz

1 What is an Amazon Virtual Private Cloud (VPC)?

2 What does a subnet represent within an Amazon VPC?

3 Which component allows resources in a public subnet to communicate with the internet?

4 Which AWS component determines where network traffic from a subnet is directed?

5 At which level is a security group primarily applied in a VPC?

6 At which level does a network access control list (NACL) filter traffic?

7 Which statement correctly describes security groups?

8 Which type of rules can a network ACL contain?

9 Which feature provides private connectivity from a VPC to supported AWS services without using the public internet?

10 Which AWS service can be accessed through a gateway VPC endpoint?

11 Which AWS technology powers interface VPC endpoints?

12 What is the primary purpose of a VPC peering connection?

13 Which limitation applies to VPC peering connections?

14 What is a common purpose of AWS Transit Gateway?

15 What does AWS Site-to-Site VPN use to protect traffic between an on-premises network and a VPC?

16 What does AWS Direct Connect provide?

17 Which remote connectivity option commonly uses the public internet as its transport path?

18 Which feature records information about IP traffic flowing to and from network interfaces in a VPC?

19 Which AWS service can monitor network-related metrics and trigger alarms?

20 Which design choice supports high availability according to AWS Well-Architected principles?

21 A company has a VPC with CIDR block 10.0.0.0/24. It needs four equal-sized subnets: one public and one private subnet in each of two Availability Zones. Which subnet design uses the entire address range without overlap?

22 Instances in a private subnet need outbound IPv4 internet access but must not accept connections initiated from the internet. Which design meets this requirement?

23 A security group allows inbound TCP port 443 from a corporate CIDR block. No explicit outbound rule exists for the client's ephemeral port. Why can the HTTPS response still return if outbound traffic is otherwise allowed by the security group configuration?

24 A public web subnet uses a custom network ACL. Internet clients must connect to HTTPS on TCP port 443. Which pair of rules is required for basic request and response traffic?

25 Web servers and application servers have separate security groups. Application servers should accept TCP port 8080 only from instances associated with the web-tier security group. Which rule is most appropriate?

26 A network ACL currently allows TCP port 22 from 0.0.0.0/0 using rule 200. An administrator must block one suspicious address, 198.51.100.10, while retaining the general allow rule. What should be added?

27 EC2 instances in private subnets must access Amazon S3 without using a NAT gateway or public IP addresses. Which solution is the most appropriate?

28 An application uses an AWS service through an interface VPC endpoint. The team wants the service's standard regional hostname to resolve to the endpoint's private IP addresses inside the VPC. What should be enabled?

29 A VPC has an Amazon S3 gateway endpoint, but workloads should use the endpoint to access only the bucket reports-prod. Which endpoint-level control should be configured?

30 VPC A is peered with VPC B, and VPC B is peered with VPC C. VPC A must communicate directly with VPC C using VPC peering. What additional configuration is required?

31 A company connects production, development, and shared-services VPCs to AWS Transit Gateway. Development must reach shared services but must not reach production. Which design best enforces this segmentation?

32 Two VPCs with non-overlapping CIDR blocks have an active peering connection, but instances cannot communicate. The peering connection itself is healthy. Which configuration should be checked first?

33 A Site-to-Site VPN connection provides two VPN tunnels. The company wants high availability and dynamic route updates. How should the connection be configured?

34 A company has an existing Direct Connect connection that does not support MACsec. It requires encryption in transit while continuing to use the Direct Connect path. Which solution is suitable?

35 A business-critical workload requires resilient Direct Connect connectivity against a device failure and the loss of an entire Direct Connect location. Which architecture best meets the requirement?

36 Users report intermittent connection failures to an EC2 instance. VPC Flow Logs are delivered to CloudWatch Logs. Which analysis is most useful for identifying whether network controls rejected the traffic?

37 An architect wants to determine whether a proposed path from an EC2 instance to a database is blocked by routes, security groups, or network ACLs without sending test packets. Which AWS feature should be used?

38 A VPC has private subnets in three Availability Zones, but all of them route internet-bound traffic through one NAT gateway. Which change best improves reliability and reduces cross-AZ dependency?

39 IPv6-enabled instances in a private subnet must initiate outbound internet connections, but unsolicited inbound internet connections must be blocked. Which routing design should be used?

40 A VPC's original IPv4 CIDR block has insufficient free space for new subnets. The workloads cannot immediately be migrated to another VPC. What is the most direct solution?

41 An application requires 30 private IPv4 addresses for EC2 instances in each of three Availability Zones. Each subnet must also accommodate the five addresses that AWS reserves. What is the smallest subnet prefix that satisfies the requirement in each Availability Zone?

42 A dual-stack workload in a private subnet must initiate outbound IPv6 connections to the internet, but unsolicited inbound IPv6 connections must not reach it. IPv4 traffic already uses a NAT gateway. Which design meets the IPv6 requirement?

43 Private application subnets span three Availability Zones and require resilient outbound IPv4 internet access. The current design sends all 0.0.0.0/0 traffic to one NAT gateway in one Availability Zone. Which redesign best improves fault isolation and avoids cross-AZ NAT data paths?

44 A client at 10.0.1.10 connects to an HTTPS server at 10.0.2.20. The server security group allows inbound TCP 443 from the client security group. Both subnets use restrictive custom NACLs. Which NACL configuration is necessary for the connection?

45 A subnet NACL contains rule 100 allowing TCP 443 from 0.0.0.0/0, rule 110 denying TCP 443 from 198.51.100.0/24, and the default deny rule. What happens to an HTTPS packet from 198.51.100.25?

46 An administrator removes an inbound security group rule while several established TCP sessions are active. No NACL or route changes occur. Which behavior should be expected?

47 A security team must immediately block one known malicious IPv4 address from every resource in a subnet. Existing security groups contain broad allow rules. Which control can express the required explicit deny without rewriting every security group?

48 Instances in private subnets must access Amazon S3 without NAT gateways. The architecture must avoid hourly endpoint charges, and access must be restricted to a designated bucket using endpoint policy controls. Which solution is appropriate?

49 An on-premises application connected through AWS Direct Connect must privately access Amazon S3 through a VPC endpoint. The application cannot use public S3 IP addresses. Which endpoint design supports this access pattern?

50 A VPC has private DNS enabled for an AWS interface endpoint. EC2 instances resolve the service's standard regional hostname to the endpoint's private IP addresses. On-premises clients connected by VPN still use public DNS answers. What should be added to provide consistent private resolution?

51 VPC A is peered with VPC B, and VPC B is peered with VPC C. The CIDR blocks do not overlap. Instances in VPC A must communicate privately with instances in VPC C. Which change is required?

52 A company uses one transit gateway for production, development, and shared-services VPCs. Production and development must both reach shared services, but they must not reach each other. Which design enforces this at the transit gateway?

53 Traffic between spoke VPCs is inspected by a stateful firewall appliance fleet behind a Gateway Load Balancer in an inspection VPC. Intermittent failures occur because forward and return flows reach appliances in different Availability Zones. Which transit gateway feature addresses this issue?

54 Two VPCs both use the IPv4 CIDR block 10.20.0.0/16 and must exchange traffic without renumbering either VPC. Which statement about directly connecting them is correct?

55 A company needs consistent private connectivity from its data center to AWS, but all application traffic must be encrypted in transit at the IP layer. A Direct Connect connection is available. Which architecture best meets both requirements?

56 A Site-to-Site VPN uses dynamic routing and includes two IPsec tunnels. The customer gateway currently establishes BGP only on the preferred tunnel. What configuration best aligns with AWS high-availability guidance?

57 A company has VPCs in several AWS Regions and wants one set of Direct Connect connections to reach them through private virtual interfaces. Which design provides the intended multi-Region association?

58 Security analysts need the full contents of selected packets from an EC2 instance to investigate an application-layer protocol anomaly. Which AWS networking capability provides the required data?

59 An engineer must determine whether security groups, NACLs, routes, and gateway configuration permit connectivity between two ENIs. Sending test packets is prohibited. Which service is most appropriate?

60 VPC Flow Logs show REJECT records for traffic targeting TCP 443 on an instance. The instance security group allows the source, but the subnet NACL denies the packet. Can the flow-log record alone identify the NACL as the rejecting control?