AWS Certified Solutions Architect VPC Networking and Security 3 — Questions and Answers
Question 1: A team needs to privately access AWS services like S3 from their VPC without internet traffic leaving the AWS network. Which feature enables this?
- VPC Peering
- NAT Gateway
- VPC Endpoints (Correct answer)
- AWS PrivateLink
Correct answer: VPC Endpoints
VPC Endpoints allow private connectivity to AWS services from within a VPC without requiring an internet gateway, NAT device, or VPN connection.
Question 2: A Network ACL rule has been configured to DENY traffic on port 443 with rule number 100, and another rule ALLOWs the same traffic with rule number 200. What is the result?
- Traffic is allowed because ALLOW rules take precedence
- Traffic is denied because lower rule numbers are evaluated first (Correct answer)
- Both rules cancel out, so traffic is allowed by default
- Traffic is denied because DENY rules always override ALLOW
Correct answer: Traffic is denied because lower rule numbers are evaluated first
NACLs evaluate rules in order from lowest to highest rule number, so rule 100 (DENY) is processed before rule 200 (ALLOW), resulting in the traffic being denied.
Question 3: What type of VPC endpoint should be used to connect to AWS services that are powered by AWS PrivateLink?
- Gateway Endpoint
- Interface Endpoint (Correct answer)
- Route Table Endpoint
- Peering Endpoint
Correct answer: Interface Endpoint
Interface Endpoints use AWS PrivateLink to create elastic network interfaces with private IPs in your VPC, enabling private connectivity to supported AWS services.
Question 4: A company uses VPC peering between two VPCs (A↔B and B↔C). Can VPC A communicate with VPC C through VPC B?
- Yes, traffic routes automatically through peered VPCs
- No, VPC peering does not support transitive peering (Correct answer)
- Yes, but only if VPC B has a NAT Gateway
- Yes, but only if all VPCs are in the same region
Correct answer: No, VPC peering does not support transitive peering
VPC peering does not support transitive routing — VPC A cannot route traffic to VPC C through VPC B; direct peering between A and C would be required.
Question 5: Which component must be added to a route table for a public subnet's EC2 instances to reach the internet?
- A route to a NAT Gateway
- A route to an Internet Gateway (Correct answer)
- A route to a Virtual Private Gateway
- A route to an Egress-Only Internet Gateway
Correct answer: A route to an Internet Gateway
A public subnet requires a route table entry pointing 0.0.0.0/0 to an Internet Gateway to allow EC2 instances to send and receive internet traffic.
Question 6: An architect is designing a VPC and needs to ensure that a subnet in us-east-1a is isolated from another subnet in us-east-1b. Which resource enforces this boundary?
- Internet Gateway
- Security Group
- Network ACL (Correct answer)
- Route Table
Correct answer: Network ACL
Network ACLs control traffic at the subnet boundary and can be used to filter traffic between subnets in different availability zones within a VPC.
Question 7: What is a key difference between a Gateway VPC Endpoint and an Interface VPC Endpoint?
- Gateway endpoints cost more but support more services
- Gateway endpoints only support S3 and DynamoDB and are free; Interface endpoints support most other services and have an hourly cost (Correct answer)
- Interface endpoints are faster than Gateway endpoints
- Gateway endpoints require a NAT Gateway to function
Correct answer: Gateway endpoints only support S3 and DynamoDB and are free; Interface endpoints support most other services and have an hourly cost
Gateway endpoints are free and only support S3 and DynamoDB using route table entries, while Interface endpoints use ENIs and support many other AWS services at an hourly charge.
AWS Certified Solutions Architect VPC Networking and Security 3
A team needs to privately access AWS services like S3 from their VPC without internet traffic leaving the AWS network.
Which feature enables this?