Networking and Content Delivery
Free AWS Certified SysOps Administrator - Associate practice — 6 questions on Networking and Content Delivery, with explanations. No sign-up. Full 12-question mixed test →
A company has EC2 instances in a private subnet with no internet gateway or NAT gateway attached. A Gateway VPC Endpoint for Amazon S3 was created and associated with the VPC. Instances in one private subnet can reach S3 successfully, but instances in a second private subnet time out when accessing S3. Both subnets have identical security groups and default NACLs. What is the MOST likely cause?
A Gateway Endpoint only affects traffic from subnets whose route table has been explicitly associated with the endpoint. When you create the endpoint, you choose which route tables get the automatic pl-xxxxx route entry. If the second subnet uses a different route table that wasn't selected, no route to the endpoint exists and traffic has nowhere to go, causing timeouts.
A company uses AWS Transit Gateway to connect a Shared Services VPC, a Production VPC, and a Development VPC. Requirements: Production and Development VPCs must both reach Shared Services, but Production and Development must NOT be able to communicate with each other. Which Transit Gateway configuration meets this requirement with the LEAST operational overhead?
Transit Gateway supports multiple route tables per attachment. By associating Production and Development with separate route tables that only propagate routes from Shared Services (not from each other), traffic between Production and Development has no route and is dropped, while both can still reach Shared Services.
A company uses Amazon Route 53 geoproximity routing to direct traffic to resources in us-east-1 and eu-west-1. Users in France are currently routed to eu-west-1, but the company wants to shift a larger share of European traffic to us-east-1 without moving any resources or changing DNS record types. What should be done?
Geoproximity routing lets you set a bias value (-99 to 99) per resource. Increasing the bias for us-east-1 expands the geographic area from which traffic is routed to it, pulling in more traffic from nearby regions like Western Europe — without touching the actual resources or record types.
A company has an AWS Direct Connect private VIF as its primary connection to a VPC and a Site-to-Site VPN as a backup path, both using BGP. During normal operation, all traffic must use the Direct Connect path. If Direct Connect fails, traffic must automatically fail over to the VPN. Which configuration achieves this?
BGP path selection prefers routes with a shorter AS_PATH. By prepending extra AS numbers on the VPN's advertised routes, the VPN path appears 'longer' and less preferred, so traffic uses Direct Connect whenever it's available. If Direct Connect fails and its routes are withdrawn, the VPN becomes the only advertised path and traffic fails over automatically.
A company hosts static content in a private S3 bucket and serves it exclusively through Amazon CloudFront. The security team requires that all requests to the S3 origin come only from the specific CloudFront distribution, and that the bucket remain fully private with no public access. Which configuration meets this requirement using current AWS best practices?
Origin Access Control (OAC) is the current AWS-recommended method for securing S3 origins behind CloudFront. It uses SigV4 signing on every request and a bucket policy that grants access to the cloudfront.amazonaws.com service principal, scoped with an aws:SourceArn condition to the specific distribution — keeping the bucket fully private with no public access needed.
An EC2 instance in a subnet needs to make outbound HTTPS calls to an external API. The subnet's custom Network ACL has these rules: Outbound — allow TCP 443 to 0.0.0.0/0; Inbound — allow TCP 22 from the corporate CIDR only, deny all else. The instance's security group allows all outbound traffic and has no inbound rules. Outbound connection attempts succeed at the TCP level, but no response data is ever received. What change resolves this?
Network ACLs are stateless, so return traffic must be explicitly permitted. The external server responds from port 443 to the instance's ephemeral source port, so the NACL needs an inbound rule allowing traffic on the ephemeral range (commonly 1024-65535) from 0.0.0.0/0. Security groups are stateful and already allow the return traffic automatically since the outbound request was allowed.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
undefined $34.99 with code 89CE4ED79F19FA855B6D — valid through Sep 23.
Get my $34.99 deal →