___________________________________________________________________
AWS Cloud Practitioner VPC &
Networking Practice Test 2026–2027 |
Amazon VPC Questions, Answers &
Detailed Rationales
1. What is the primary purpose of an Amazon VPC?
A. To provide managed database storage
B. To create an isolated virtual network for AWS resources
C. To automatically encrypt all AWS data
D. To manage IAM users
Answer: To create an isolated virtual network for AWS resources
Rationale: A VPC provides a logically isolated virtual network in AWS where you
can launch and control resources such as EC2 instances.
2. Which component of a VPC determines the range of private IP addresses
available to resources?
A. Route table
B. Security group
C. CIDR block
D. Internet gateway
,Answer: CIDR block
Rationale: A VPC is assigned an IPv4 CIDR block that defines its overall private IP
address range.
3. Which AWS networking component enables communication between a VPC
and the public internet?
A. NAT gateway
B. Internet gateway
C. Network ACL
D. VPC endpoint
Answer: Internet gateway
Rationale: An internet gateway provides a target in a VPC route table for
internet-bound traffic and enables communication between resources with
appropriate public addressing and the internet.
4. Which VPC component is used to divide a VPC into smaller IP address
ranges?
A. Subnet
B. Internet gateway
C. Transit gateway
D. NAT gateway
Answer: Subnet
Rationale: Subnets partition a VPC's CIDR range into smaller networks and are
associated with specific Availability Zones.
5. Which statement about an AWS subnet is correct?
A. A subnet can span multiple Availability Zones
B. A subnet exists within a single Availability Zone
C. A subnet must always have public IP addresses
D. A subnet automatically provides internet access
,Answer: A subnet exists within a single Availability Zone
Rationale: Each subnet is associated with one Availability Zone, although a VPC
can contain subnets across multiple Availability Zones.
6. What makes a subnet public?
A. It has a security group
B. It contains an internet gateway
C. Its route table has a route to an internet gateway
D. It uses private IP addresses
Answer: Its route table has a route to an internet gateway
Rationale: A subnet is generally considered public when its associated route
table contains a route to an internet gateway. Resources also need appropriate
public addressing to communicate directly with the internet.
7. Which component controls inbound and outbound traffic at the instance
level for supported AWS resources?
A. Security group
B. Route table
C. Internet gateway
D. DHCP option set
Answer: Security group
Rationale: Security groups act as virtual firewalls associated with network
interfaces and control allowed inbound and outbound traffic.
8. Which security group behavior is correct?
A. It uses explicit deny rules
B. It is stateless
C. It is stateful
D. It applies only to subnet-level traffic
, Answer: It is stateful
Rationale: Security groups are stateful, so return traffic for an allowed
connection is automatically permitted regardless of the outbound or inbound
rule for that response.
9. Which VPC component provides stateless subnet-level traffic filtering?
A. Security group
B. Network ACL
C. NAT gateway
D. Route table
Answer: Network ACL
Rationale: Network Access Control Lists operate at the subnet level and are
stateless, requiring both inbound and outbound rules for traffic flows.
10.An application in a private subnet needs to access the public internet for
software updates. Which service is commonly used?
A. Internet gateway directly
B. NAT gateway
C. VPC peering only
D. Network ACL
Answer: NAT gateway
Rationale: A NAT gateway allows resources in private subnets to initiate
outbound connections to the internet without allowing unsolicited inbound
internet connections.
11.Where should a NAT gateway normally be deployed for highly available
outbound internet connectivity?
A. In a private subnet
B. In a public subnet
AWS Cloud Practitioner VPC &
Networking Practice Test 2026–2027 |
Amazon VPC Questions, Answers &
Detailed Rationales
1. What is the primary purpose of an Amazon VPC?
A. To provide managed database storage
B. To create an isolated virtual network for AWS resources
C. To automatically encrypt all AWS data
D. To manage IAM users
Answer: To create an isolated virtual network for AWS resources
Rationale: A VPC provides a logically isolated virtual network in AWS where you
can launch and control resources such as EC2 instances.
2. Which component of a VPC determines the range of private IP addresses
available to resources?
A. Route table
B. Security group
C. CIDR block
D. Internet gateway
,Answer: CIDR block
Rationale: A VPC is assigned an IPv4 CIDR block that defines its overall private IP
address range.
3. Which AWS networking component enables communication between a VPC
and the public internet?
A. NAT gateway
B. Internet gateway
C. Network ACL
D. VPC endpoint
Answer: Internet gateway
Rationale: An internet gateway provides a target in a VPC route table for
internet-bound traffic and enables communication between resources with
appropriate public addressing and the internet.
4. Which VPC component is used to divide a VPC into smaller IP address
ranges?
A. Subnet
B. Internet gateway
C. Transit gateway
D. NAT gateway
Answer: Subnet
Rationale: Subnets partition a VPC's CIDR range into smaller networks and are
associated with specific Availability Zones.
5. Which statement about an AWS subnet is correct?
A. A subnet can span multiple Availability Zones
B. A subnet exists within a single Availability Zone
C. A subnet must always have public IP addresses
D. A subnet automatically provides internet access
,Answer: A subnet exists within a single Availability Zone
Rationale: Each subnet is associated with one Availability Zone, although a VPC
can contain subnets across multiple Availability Zones.
6. What makes a subnet public?
A. It has a security group
B. It contains an internet gateway
C. Its route table has a route to an internet gateway
D. It uses private IP addresses
Answer: Its route table has a route to an internet gateway
Rationale: A subnet is generally considered public when its associated route
table contains a route to an internet gateway. Resources also need appropriate
public addressing to communicate directly with the internet.
7. Which component controls inbound and outbound traffic at the instance
level for supported AWS resources?
A. Security group
B. Route table
C. Internet gateway
D. DHCP option set
Answer: Security group
Rationale: Security groups act as virtual firewalls associated with network
interfaces and control allowed inbound and outbound traffic.
8. Which security group behavior is correct?
A. It uses explicit deny rules
B. It is stateless
C. It is stateful
D. It applies only to subnet-level traffic
, Answer: It is stateful
Rationale: Security groups are stateful, so return traffic for an allowed
connection is automatically permitted regardless of the outbound or inbound
rule for that response.
9. Which VPC component provides stateless subnet-level traffic filtering?
A. Security group
B. Network ACL
C. NAT gateway
D. Route table
Answer: Network ACL
Rationale: Network Access Control Lists operate at the subnet level and are
stateless, requiring both inbound and outbound rules for traffic flows.
10.An application in a private subnet needs to access the public internet for
software updates. Which service is commonly used?
A. Internet gateway directly
B. NAT gateway
C. VPC peering only
D. Network ACL
Answer: NAT gateway
Rationale: A NAT gateway allows resources in private subnets to initiate
outbound connections to the internet without allowing unsolicited inbound
internet connections.
11.Where should a NAT gateway normally be deployed for highly available
outbound internet connectivity?
A. In a private subnet
B. In a public subnet
