AWS certification-style practice questions from VPC and Networking
Practice Questions – AWS VPC & Networking
Question 1
You launch an EC2 instance in a private subnet and it must download OS updates. The instance should not be publicly reachable. What must you configure?
A. Internet Gateway (IGW)
B. Elastic IP
C. NAT Gateway
D. VPC Peering
Answer: C. NAT Gateway
Explanation: A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic for updates while preventing inbound internet access.
Question 2
Your organization has 15 VPCs across multiple regions that need to communicate with each other and your data center. Which is the preferred solution?
A. Create VPC Peering for all pairs
B. Build IPSec VPNs between all VPCs
C. Use AWS Transit Gateway with Direct Connect
D. Use Internet-facing Elastic IPs
Answer: C. Use AWS Transit Gateway with Direct Connect
Explanation: Transit Gateway enables scalable hub-and-spoke architecture for inter-VPC and hybrid connectivity. Direct Connect enhances bandwidth and reduces latency.
Question 3
Which of the following is true about Security Groups and NACLs?
A. Security Groups are stateless; NACLs are stateful
B. Security Groups apply at the instance level; NACLs apply at the subnet level
C. Security Groups support allow/deny rules; NACLs support only allow rules
D. NACL rules apply only to outbound traffic
Answer: B. Security Groups apply at the instance level; NACLs at subnet level
Explanation: Security Groups are stateful and work per ENI/instance. NACLs are stateless, evaluated per subnet, with separate inbound/outbound rules.
Question 4
You stop and start an EC2 instance with a default public IPv4. What happens to the public IP?
A. It remains assigned permanently
B. It is released and a new one is assigned
C. It converts to an Elastic IP
D. It gets reassigned only if in a private subnet
Answer: B. It is released and a new one is assigned
Explanation: Ephemeral public IPv4 addresses are dynamic. A stop/start cycle allocates a new one unless an Elastic IP is used.
Question 5
Which is the most cost-efficient way to allow private subnets to access Amazon S3?
A. NAT Gateway with route to IGW
B. Create a VPC S3 Gateway Endpoint
C. Use public S3 URLs with Elastic IPs
D. Configure VPN to AWS S3
Answer: B. Create a VPC S3 Gateway Endpoint
Explanation: Gateway Endpoints for S3 allow private connectivity at no additional cost, avoiding NAT Gateway charges.
Question 6
A company deploys NAT Gateways in only one Availability Zone. During an AZ outage, instances in another AZ lose internet access. What’s the root cause?
A. Missing route propagation
B. NAT Gateway is AZ-specific
C. EC2 ENI misconfiguration
D. Default NACL blocking
Answer: B. NAT Gateway is AZ-specific
Explanation: NAT Gateways are AZ-local. Routes from other AZ subnets to a NAT Gateway in a failed AZ will break internet connectivity.
Question 7
Which CIDR ranges are valid subnets in a VPC with CIDR 10.0.0.0/16? (Select two)
A. 10.0.1.0/24
B. 192.168.1.0/24
C. 10.0.200.0/20
D. 172.31.0.0/16
Answer: A and C
Explanation: Subnets must lie inside the VPC’s CIDR block. Options A and C are valid. Options B and D fall outside.
Question 8
Which AWS feature records IP traffic metadata for analysis at the ENI, subnet, or VPC level?
A. GuardDuty
B. VPC Flow Logs
C. CloudTrail
D. AWS Config
Answer: B. VPC Flow Logs
Explanation: VPC Flow Logs capture metadata (source/destination, ports, ACCEPT/REJECT) for traffic monitoring.
Question 9
Which service allows multiple VPCs to privately connect within the same region or across regions using the AWS backbone network?
A. VPC Peering
B. AWS Transit Gateway
C. Direct Connect
D. Internet Gateway
Answer: A. VPC Peering
Explanation: VPC Peering establishes private connectivity between two VPCs using AWS backbone. It’s non-transitive.
Question 10
An EC2 instance is assigned both a primary private IP and a secondary private IP. What happens if you associate an Elastic IP with the secondary private IP?
A. The Elastic IP replaces the primary private IP
B. The Elastic IP is mapped only to the secondary IP
C. AWS does not allow associating EIP with secondary private IP
D. Both IPs map to the Elastic IP
Answer: B. The Elastic IP is mapped only to the secondary IP
Explanation: Elastic IPs can be bound to either primary or secondary IP addresses, and will map only to the assigned IP.
Question 11
Which AWS component allows a VPC to connect privately to services like S3, DynamoDB, and Secrets Manager?
A. NAT Gateway
B. Interface and Gateway VPC Endpoints
C. Internet Gateway
D. Elastic IP
Answer: B. Interface and Gateway VPC Endpoints
Explanation: Gateway Endpoints support S3/DynamoDB, Interface Endpoints support all other services.
Question 12
Why should you use non-overlapping CIDR blocks across your VPCs and on-premises networks?
A. To reduce NAT Gateway costs
B. To avoid route conflicts in hybrid or multi-VPC topologies
C. To enable S3 VPC Endpoint access
D. To support IPv6
Answer: B. To avoid route conflicts in hybrid/multi-VPC topologies
Explanation: Overlapping IPs cause ambiguous routes in VPN and Transit Gateway scenarios.
Question 13
What is the main difference between Internet Gateway (IGW) and Egress-Only Internet Gateway?
A. IGW works only with IPv6, Egress-Only works with IPv4
B. IGW allows inbound and outbound; Egress-Only allows outbound IPv6 only
C. IGW supports NAT, Egress-Only does not
D. Both are identical
Answer: B. IGW allows inbound and outbound; Egress-Only allows outbound IPv6 only
Explanation: IGW permits bidirectional traffic. Egress-Only IGW restricts inbound IPv6, supporting only outbound.
Question 14
Which AWS service helps extend your corporate data center private network into AWS VPC securely over the Internet?
A. Direct Connect
B. VPN over IPSec
C. VPC Endpoint
D. NAT Gateway
Answer: B. VPN over IPSec
Explanation: Site-to-Site VPN establishes an encrypted IPSec tunnel to a VPC over the internet.
Question 15
How many Elastic IPs (EIPs) are allocated by default per AWS region (before requesting a limit increase)?
A. 2
B. 5
C. 10
D. Unlimited
Answer: B. 5
Explanation: AWS enforces a default limit of 5 EIPs per region. You can request an increase.
Question 16
Which feature of AWS networking allows transitive connectivity between multiple VPCs and on-premises?
A. VPC Peering
B. Transit Gateway
C. VPN Gateway
D. Internet Gateway
Answer: B. Transit Gateway
Explanation: Transit Gateway supports transitive routing for VPCs and on-premises networks.
Question 17
You need to run workloads that require IPv6 global internet connectivity but without NAT. Which setup is correct?
A. Assign IPv6 addresses and connect via IGW
B. Deploy NAT Gateway with Elastic IPs
C. Use IPv6 over VPC Endpoints only
D. Use Egress-only IGW and Elastic IP
Answer: A. Assign IPv6 addresses and connect via IGW
Explanation: IPv6 addresses are global and routable without NAT. Only an IGW is needed for connectivity.
Question 18
Which AWS feature provides DNS resolution within a VPC, including custom domain names for instances?
A. Route 53 Resolver
B. VPC Endpoint DNS override
C. Cloud DNS proxy
D. BIND Service
Answer: A. Route 53 Resolver
Explanation: Route 53 Resolver provides private DNS resolution inside a VPC and supports hybrid DNS forwarding.
Question 19
A company has web servers in public subnets and databases in private subnets. Which security group relationship is best practice?
A. Allow internet access directly on DB security groups
B. ALB SG → DB SG only
C. ALB SG → App SG, App SG → DB SG
D. App SG open to 0.0.0.0/0
Answer: C. ALB SG → App SG, App SG → DB SG
Explanation: Best practice enforces layer-by-layer trust: Internet → ALB → App → DB.
Question 20
You want to ensure that an EC2 instance uses the same private IP address even if it is stopped and restarted. What must you do?
A. Assign an Elastic IP
B. Use an Elastic Network Interface (ENI) with the desired private IP
C. Convert the instance into an Auto Scaling group
D. Use DHCP to reassign IPs on restart
Answer: B. Use an Elastic Network Interface (ENI) with the desired private IP
Explanation: Primary private IPs persist by default, but to guarantee static assignment across different instances or for multiple IPs, attach an ENI.