AWS Certified Solutions Architect VPC Networking and Security 3

Question 1

A team needs to privately access AWS services like S3 from their VPC without internet traffic leaving the AWS network. Which feature enables this?

Accepted Answer

VPC Endpoints

Answer

VPC Endpoints allow private connectivity to AWS services from within a VPC without requiring an internet gateway, NAT device, or VPN connection.

Question 2

A Network ACL rule has been configured to DENY traffic on port 443 with rule number 100, and another rule ALLOWs the same traffic with rule number 200. What is the result?

Accepted Answer

Traffic is denied because lower rule numbers are evaluated first

Answer

NACLs evaluate rules in order from lowest to highest rule number, so rule 100 (DENY) is processed before rule 200 (ALLOW), resulting in the traffic being denied.

Question 3

What type of VPC endpoint should be used to connect to AWS services that are powered by AWS PrivateLink?

Accepted Answer

Interface Endpoint

Answer

Interface Endpoints use AWS PrivateLink to create elastic network interfaces with private IPs in your VPC, enabling private connectivity to supported AWS services.

Question 4

A company uses VPC peering between two VPCs (A↔B and B↔C). Can VPC A communicate with VPC C through VPC B?

Accepted Answer

No, VPC peering does not support transitive peering

Answer

VPC peering does not support transitive routing — VPC A cannot route traffic to VPC C through VPC B; direct peering between A and C would be required.

Question 5

Which component must be added to a route table for a public subnet's EC2 instances to reach the internet?

Accepted Answer

A route to an Internet Gateway

Answer

A public subnet requires a route table entry pointing 0.0.0.0/0 to an Internet Gateway to allow EC2 instances to send and receive internet traffic.

AWS Practice Test

AWS Practice Test

AWS Certified Solutions Architect VPC Networking and Security 3