Sign in Register
Home  /  Blog

AWS Advanced Networking Practice Questions: VPC, Transit Gateway and Direct Connect

Cloud certifications·10 min read·PractiseExam

This set of questions covers key domains of the AWS Advanced Networking Specialty exam, including hybrid networking, routing, security, and network automation. ---

Question 1

A multinational company is deploying a new application in AWS. They require a dedicated, private, and high-bandwidth connection from their on-premises data center to a single VPC in the us-east-1 region. The compliance team mandates that all traffic must traverse this private connection and cannot use the public internet. Which solution meets these requirements with the LEAST operational overhead? Another useful resource: AWS Advanced Networking Specialty Passing Score.

  1. A. Deploy a VPN Connection over the public internet using a VPN Gateway.
  2. B. Provision an AWS Direct Connect connection and a private virtual interface (VIF) associated with a Direct Connect Gateway.
  3. C. Provision an AWS Direct Connect connection and a transit virtual interface (VIF) associated with a Direct Connect Gateway.
  4. D. Create a VPC peering connection between the on-premises network and the VPC.

Answer: B

Explanation: A private VIF is the correct choice for connecting to a single VPC privately over a dedicated line, bypassing the internet. A transit VIF is used to connect to multiple VPCs via a Transit Gateway, which is overkill for a single VPC. VPN uses the public internet, and VPC peering cannot connect to on-premises networks.

Question 2

A solutions architect is designing a hub-and-spoke topology using AWS Transit Gateway. The security team requires that all traffic between workloads in the spoke VPCs must be inspected by a centralized security appliance (e.g., firewall) deployed in the hub VPC. Which configuration ensures this mandatory inspection?

  1. A. Create VPC peering connections between the spoke VPCs and the hub VPC, and disable route propagation.
  2. B. Configure the Transit Gateway route tables so that the route for the spoke VPCs points to the VPC attachment for the hub.
  3. C. Configure the Transit Gateway route tables so that the route for the spoke VPCs points to the Transit Gateway attachment for the security appliance.
  4. D. Enable multicast on the Transit Gateway and add the spokes and hub to the same multicast group.

Answer: C

Explanation: For centralized inspection, all traffic must be routed to the appliance's ENI. This is done by creating a Transit Gateway attachment for the appliance (e.g., a VPC attachment with the appliance) and pointing the route table entries for the spokes to that specific attachment. Peering does not work with Transit Gateway, and routing to the hub VPC attachment alone would only deliver traffic to the VPC, not necessarily force it through the appliance unless the appliance is the route target.

Question 3

A company has a VPC with a public subnet and a private subnet. An Amazon EC2 instance in the private subnet must access the internet for software updates. The instance has no public IP address. A NAT Gateway is deployed in the public subnet. Which of the following is a REQUIRED step to ensure the instance can reach the internet?

  1. A. Add a route in the private subnet's route table with destination 0.0.0.0/0 and target the NAT Gateway.
  2. B. Add a route in the public subnet's route table with destination 0.0.0.0/0 and target the Internet Gateway.
  3. C. Associate an Elastic IP address with the EC2 instance's primary network interface.
  4. D. Disable the source/destination check on the EC2 instance.

Answer: A

Explanation: The private subnet route table must have a default route pointing to the NAT Gateway for outbound traffic. The public subnet route table already needs a route to the IGW for the NAT Gateway to function, but that is not the step for the instance. The instance does not need a public IP, and source/destination checks are relevant for NAT instances, not NAT Gateways.

Question 4

An application running on Amazon ECS uses an Application Load Balancer (ALB) to distribute traffic to tasks in a private subnet. The security group for the ECS tasks must only allow traffic from the ALB. Which is the most secure way to define the source in the ECS task security group's inbound rule?

  1. A. Use the CIDR block of the VPC.
  2. B. Use the security group ID of the ALB.
  3. C. Use the private IP addresses of the ALB nodes.
  4. D. Use the prefix list ID for the AWS service that manages the ALB.

Answer: B For background on this area, read AWS Advanced Networking Specialty Difficulty: The Hardest AWS Cert?.

Explanation: Referencing the ALB's security group as the source is the most secure and dynamic method, as it automatically updates if the ALB scales. Using the VPC CIDR is too broad. Using the private IPs of ALB nodes is brittle because those IPs change as the ALB scales. Prefix lists are used for AWS services like S3, not for ALBs.

Question 5

A network engineer is setting up an AWS Client VPN endpoint for remote workers. They need to ensure that all traffic from the clients is routed through the VPN tunnel, including traffic destined for the internet, to enforce corporate web filtering policies. Which configuration is necessary?

  1. A. Configure the Client VPN endpoint to use mutual authentication.
  2. B. Add a route in the Client VPN endpoint's route table for 0.0.0.0/0 targeting the VPN endpoint.
  3. C. Add a route in the Client VPN endpoint's route table for 0.0.0.0/0 targeting a VPC subnet.
  4. D. Enable DNS resolution on the Client VPN endpoint.

Answer: C

Explanation: To force all client traffic through the tunnel, you need a default route (0.0.0.0/0) in the Client VPN endpoint's route table that points to a subnet in the VPC. This makes the VPN endpoint the next hop for all internet-bound traffic. Routing to the VPN endpoint itself is not a valid target. Mutual authentication is for security, not routing, and DNS resolution is a separate feature.

Question 6

A company is using Amazon Route 53 for DNS. They have a web application hosted on an Application Load Balancer (ALB) in the us-west-2 region and a static backup site hosted on an Amazon S3 website endpoint. They want to route traffic based on the geographic location of the user, directing users in North America to the ALB and users in Europe to the S3 website. Which Route 53 routing policy should they use?

  1. A. Latency-based routing policy.
  2. B. Geolocation routing policy.
  3. C. Weighted routing policy.
  4. D. Failover routing policy.

Answer: B

Explanation: Geolocation routing policy allows you to route traffic based on the geographic location of the DNS query's source. Latency routing is based on network latency, not strict geography. Weighted routing distributes traffic based on weights, and failover routing is for active/passive failover, not geographic segmentation.

Question 7

A company has an AWS Direct Connect connection with a private virtual interface (VIF) to a VPC. They are experiencing asymmetric routing where traffic returns via a different path (e.g., over a VPN) than it entered. This is causing stateful firewall issues on-premises. Which Border Gateway Protocol (BGP) attribute configuration is the MOST effective way to force all traffic to use the Direct Connect path as the preferred path for both inbound and outbound traffic?

  1. A. Set a lower local preference on the on-premises router for routes learned over Direct Connect.
  2. B. Set a higher MED (Multi-Exit Discriminator) on the AWS side for routes advertised over Direct Connect.
  3. C. Advertise more specific routes (longer prefix) over Direct Connect than over the VPN.
  4. D. Use AS path prepending on the VPN BGP session to make the VPN path less desirable.

Answer: D

Explanation: To influence inbound traffic (from on-premises to AWS), you manipulate BGP attributes advertised to the on-premises router. AS path prepending makes the VPN path longer and less preferred, making Direct Connect the preferred path. Local preference is a Cisco-specific attribute used locally on the router. MED is used to influence inbound traffic but is a less reliable and less preferred method than AS path prepending. More specific routes (Option C) would also work, but AS path prepending is the more standard and direct method for making a path less desirable without altering routing tables. If this interests you, AWS Advanced Networking Specialty Difficulty: What Actually Makes People Fail goes into more detail.

Question 8

A DevOps engineer is automating the creation of network infrastructure using AWS CloudFormation. They need to create a VPC with a public subnet and a private subnet. The private subnet must be able to access the internet for patching. Which set of resources must be included in the CloudFormation template to achieve this?

  1. A. VPC, Internet Gateway, NAT Gateway, and a route table for the private subnet with a route to the NAT Gateway.
  2. B. VPC, Virtual Private Gateway, NAT Gateway, and a route table for the public subnet with a route to the NAT Gateway.
  3. C. VPC, Internet Gateway, NAT Instance, and a route table for the private subnet with a route to the Internet Gateway.
  4. D. VPC, Internet Gateway, NAT Gateway, and a route table for the public subnet with a route to the NAT Gateway.

Answer: A

Explanation: The required components are a VPC, an IGW for the public subnet, a NAT Gateway in the public subnet, and a route table for the private subnet pointing to the NAT Gateway. A Virtual Private Gateway is for VPN/Direct Connect. A NAT Instance is a valid but legacy option, and the private subnet route should point to the NAT Gateway, not the IGW.

Question 9

A security team is configuring VPC Flow Logs to monitor traffic to a critical database subnet. They need to capture and analyze the traffic to detect anomalies. They want to send the logs to a central logging solution for real-time analytics. Which destination should they use to meet the real-time analytics requirement?

  1. A. Amazon S3 bucket with lifecycle policies.
  2. B. Amazon CloudWatch Logs with a subscription filter to Amazon Kinesis Data Firehose.
  3. C. Amazon CloudWatch Logs with a subscription filter to Amazon Elasticsearch Service (OpenSearch).
  4. D. Amazon S3 bucket with AWS Glue ETL jobs.

Answer: C

Explanation: For real-time analytics, sending Flow Logs to CloudWatch Logs and then using a subscription filter to stream them directly to Amazon OpenSearch Service is the most direct and low-latency solution for querying and visualization. S3 is for batch/archival, and Kinesis Data Firehose adds a buffering layer that is not real-time. Glue ETL is also batch-oriented.

Question 10

An application running on EC2 instances in a private subnet needs to access an Amazon S3 bucket. The VPC has an S3 VPC endpoint. To maximize security and minimize data transfer costs, which of the following configurations is REQUIRED?

  1. A. Ensure the S3 bucket policy allows access only from the VPC endpoint.
  2. B. Add a route in the private subnet's route table for the S3 prefix list targeting the VPC endpoint.
  3. C. Configure the EC2 instances to use a proxy server for all traffic.
  4. D. Create a NAT Gateway in the public subnet for S3 traffic.

Answer: B

Explanation: A route in the subnet's route table pointing to the S3 prefix list (e.g., com.amazonaws.us-east-1.s3) with the target being the VPC endpoint is required for the endpoint to be used. The bucket policy restriction is a security best practice but not strictly required for connectivity. A proxy or NAT Gateway is not needed and would incur data transfer costs, defeating the purpose of the VPC endpoint.

This set of questions should help you gauge your readiness for the exam. Remember to review the official AWS documentation on networking services and best practices, and pay close attention to the specific use cases for Direct Connect, Transit Gateway, and Route 53 routing policies. Good luck with your preparation!

If you want a schedule that fits the time you have until the exam, use this free AWS Certified Advanced Networking - Specialty study plan.

Lock in your knowledge — AWS Certified Advanced Networking - Specialty exam questions reinforce what you have studied and expose what you have not.

When you want a quick check of which topics still need attention, use this free AWS Certified Advanced Networking - Specialty readiness check.

Amazon Web ServicesAWS Advanced Networking Specialtypractice-qCloud & AI
All postsSit a full-length mock