A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a subnet with a database instance that should only be accessible from the on-premises network on port 1433. The security group for the database instance currently allows all traffic from the VPC CIDR. What should be configured to restrict access to only the on-premises network?

Create a new security group that allows all traffic from the on-premises CIDR and attach it to the database instance.

Remove the security group and use a network ACL to control all traffic to the database.

Modify the network ACL on the subnet to deny traffic on port 1433 from all sources except the on-premises CIDR.

Modify the security group to allow inbound traffic on port 1433 from the on-premises CIDR range only.

Why is it important to avoid overlapping CIDR ranges between on-premises networks and AWS VPCs?

To prevent routing conflicts and ensure proper traffic flow

To improve the security of the network

To enable automatic route propagation

What is the difference between security groups and network ACLs?

Security groups support allow and deny rules, while network ACLs only support allow rules

Security groups are stateless, while network ACLs are stateful

Security groups are stateful, while network ACLs are stateless

Security groups operate at the subnet level, while network ACLs operate at the instance level

AWSCertified Advanced Networking - Specialty

Domain 1Objective 5

Task 1.5: Design a Routing Strategy and Connectivity Architecture Between On-Premises Networks and the AWS Cloud ANS-C01 Practice Questions (Page 1)

Part of the Content Domain 1: Network Design domain, which accounts for 30% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~21–35 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

15concepts

30%of the exam

Questions 1–5

1foundation · easy
Which Direct Connect virtual interface type is required to access resources inside a VPC?
Select an answer first
2application · medium
A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a subnet with a database instance that should only be accessible from the on-premises network on port 1433. The security group for the database instance currently allows all traffic from the VPC CIDR. What should be configured to restrict access to only the on-premises network?
Select an answer first
3foundation · easy
Why is it important to avoid overlapping CIDR ranges between on-premises networks and AWS VPCs?
Select an answer first
4foundation · easy
What is the difference between security groups and network ACLs?
Select an answer first
5foundation · easy
What type of VPN is AWS Client VPN?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 1.5: Design a Routing Strategy and Connectivity Architecture Between On-Premises Networks and the AWS Cloud ANS-C01 Practice Questions (Page 1)

Questions 1–5

Which Direct Connect virtual interface type is required to access resources inside a VPC?

Why is it important to avoid overlapping CIDR ranges between on-premises networks and AWS VPCs?

What is the difference between security groups and network ACLs?

What type of VPN is AWS Client VPN?

Keep studying — Content Domain 1: Network Design