ANS-C01 Network Implementation Practice Questions

Question 1

A company is deploying a multi-tier web application across two AWS Regions. The application uses an Application Load Balancer (ALB) in each region, and traffic must be distributed to the closest healthy ALB using Route 53 latency-based routing. The application requires that clients maintain the same source IP address when the request is forwarded from the ALB to the backend targets. The backend targets are EC2 instances in private subnets. The company also needs to ensure that traffic between the ALB and targets stays within AWS. What should the company implement to meet these requirements?

Accepted Answer

Deploy a Network Load Balancer (NLB) in each region with targets in private subnets. Use Route 53 latency-based routing to the NLB.. Network Load Balancer (NLB) preserves the client source IP by default, meeting the requirement for source IP preservation. Targets must be placed in private subnets as per the given requirements, and traffic between the NLB and targets remains within the VPC, satisfying the condition that traffic stays within AWS. With an internet-facing NLB, Route 53 latency-based routing can be used to distribute traffic to the closest healthy NLB across regions. Options B, C, D, and E are incorrect: B incorrectly relies on an internal ALB with PrivateLink, which does not support Route 53 latency routing and does not preserve source IP; C and E use ALB, which does not preserve source IP; D uses Global Accelerator, which does not use Route 53 and does not preserve source IP when ALB is an endpoint.

Answer

Deploy an internal ALB in each region. Place targets in private subnets. Use VPC endpoints for the ALB (AWS PrivateLink) and Route 53 latency-based routing to the VPC endpoint.

Answer

Deploy an Application Load Balancer (ALB) with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB.

Answer

Use AWS Global Accelerator with endpoints in each region. Attach the ALB as an endpoint and enable client IP preservation on the accelerator.

Answer

Deploy an ALB with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB. Place targets in public subnets to preserve source IP.

Question 2

A company has a Direct Connect connection with a private VIF connected to a VPC. The company wants to add a second Direct Connect connection for redundancy. They plan to use BGP AS_PATH prepending to influence traffic steering so that the primary connection is preferred for inbound traffic. The on-premises router advertises the same prefix over both connections. The company configures BGP on the primary VIF with AS_PATH prepending (prepend two AS numbers). However, after configuration, inbound traffic still uses both paths equally. What is the most likely cause?

Accepted Answer

AS_PATH prepending on the AWS side only affects outbound traffic, not inbound traffic.. The correct answer is B: AS_PATH prepending on the AWS side only affects outbound traffic, not inbound traffic. In this scenario, the company wants to influence inbound traffic (traffic from AWS to on-premises), but AS_PATH prepending must be applied on the on-premises router's BGP advertisements toward AWS, not on the AWS side (the virtual private gateway or Direct Connect gateway). AWS-side prepending would only influence how AWS routes traffic outbound toward on-premises, which is the opposite direction of what is needed. Options A, C, and D are unrelated to the equal-path selection issue: BGP authentication, hold timers, and MED (which AWS does not support for influencing inbound traffic in this manner) would not cause or fix equal-cost multipath. Option E is incorrect because prepending on the virtual private gateway is still AWS-side and affects outbound traffic, not inbound.

Answer

The secondary VIF is not configured with BGP authentication.

Answer

The BGP hold time timer is set too low, causing the primary connection to flap.

Answer

The company did not set the MED attribute on the primary VIF.

Answer

The company configured the prepending on the virtual private gateway instead of the Direct Connect gateway.

Question 3

A networking engineer is troubleshooting connectivity issues between two VPCs that are peered using a VPC peering connection. The VPCs are in different AWS accounts. The engineer has verified that the route tables are correct and the security groups allow traffic. However, ICMP ping fails from an instance in VPC A to an instance in VPC B. What is a likely cause?

Accepted Answer

There is a VPN connection attached to both VPCs that creates a transitive routing issue.. A VPN connection attached to both VPCs can introduce transitive routing, which is not supported by VPC peering. VPC peering does not allow transitive routing; traffic must flow directly between the peered VPCs. If both VPCs have a VPN connection to the same on-premises network or another network, the VPN can create a path that interferes with the direct peering path, causing ICMP pings to fail even when route tables and security groups are correctly configured.

Answer

The route tables in both VPCs do not have the route propagation enabled.

Answer

The VPC CIDR blocks overlap.

Answer

The security group in VPC A does not allow inbound ICMP from VPC B.

Answer

The network ACLs are not configured correctly for return traffic.

Question 4

A company has a centralized inspection VPC architecture where all traffic from spoke VPCs is routed through a Transit Gateway to a centralized VPC that hosts firewall appliances (NGFW). The company needs to inspect traffic between two instances in the same spoke VPC. What is the simplest way to achieve this?

Accepted Answer

Use AWS Transit Gateway with VPC attachments and configure route tables to force traffic between the two instances through the inspection VPC.. AWS Transit Gateway can route traffic between instances in the same spoke VPC by using VPC attachments and route tables to force the traffic through the centralized inspection VPC. This is achieved by configuring the spoke VPC's route table to send inter-instance traffic to the Transit Gateway, which then forwards it to the inspection VPC for firewall inspection before returning it to the destination instance. This approach avoids the need for additional appliances or complex routing within the spoke VPC itself.

Answer

Deploy a Gateway Load Balancer (GWLB) in the spoke VPC and route traffic to it.

Answer

Enable VPC peering and use route propagation to send traffic to the inspection VPC.

Answer

Create a VPC peering connection between the two instances' VPCs.

Question 5

A company is implementing a hybrid network with AWS Direct Connect and a VPN connection as backup. They have a Direct Connect gateway (DXGW) attached to a private VIF and a virtual private gateway (VGW) attached to a VPN connection. The VPC is attached to the VGW. They want to use the Direct Connect connection for all traffic when available. The on-premises router advertises the same prefix over both connections. However, traffic from on-premises to the VPC is using the VPN connection. BGP is configured correctly on both connections. What should the company do to prefer the Direct Connect path?

Accepted Answer

Configure a lower MED (Multi-Exit Discriminator) on the Direct Connect VIF.. The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to the local AS. By setting a lower MED on the Direct Connect VIF, the on-premises router will prefer the Direct Connect path over the VPN path when both advertise the same prefix, assuming all other BGP path selection criteria are equal. This directly addresses the requirement to prefer the Direct Connect connection for all traffic.

Answer

Set a higher weight on the Direct Connect BGP session.

Answer

Set a higher local preference on the Direct Connect VIF.

Answer

Change the BGP timers on the Direct Connect VIF to have a lower hold time.

Answer

Configure AS_PATH prepending on the VPN BGP session.

Question 6

A company is designing a network for a three-tier web application on AWS. The web tier must be accessible from the internet, and the application and database tiers must be in private subnets. The company wants to use a single AWS Region and ensure high availability. Which TWO configurations should be implemented? (Choose two.)

Accepted Answer

Place an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones.. An internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones (AZs) provides both internet access to the web tier and high availability. The ALB distributes incoming HTTP/HTTPS traffic to web instances in private subnets, and deploying across two AZs ensures fault tolerance if one AZ fails.

Answer

Use a stateful network ACL for the web tier subnets to simplify security rules.

Answer

Deploy a NAT Gateway in a single Availability Zone for outbound traffic from private subnets.

Answer

Create the VPC with a single Availability Zone to simplify management.

Question 7

A company is migrating a legacy application to AWS. The application requires multicast communication between EC2 instances in the same VPC. Which THREE options can support this requirement? (Choose three.)

Accepted Answer

Use AWS Transit Gateway with a multicast domain.. AWS Transit Gateway supports multicast through dedicated multicast domains, allowing EC2 instances in attached subnets and VPCs to participate in multicast groups. This is a native AWS capability. Additionally, deploying a third-party virtual appliance that supports multicast routing in the VPC enables multicast traffic forwarding. However, AWS VPCs do not natively support multicast traffic, even within a single subnet, so option D is not valid. Direct Connect and VPC peering also do not support multicast due to AWS network restrictions.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain to the VPC.

Answer

Use a VPC with a single subnet and enable multicast on the subnet.

Answer

Create a VPC peering connection and enable multicast across the peered VPCs.

Question 8

A company has deployed a web application across multiple AWS Regions using Application Load Balancers (ALBs) and EC2 instances. They want to use AWS Global Accelerator to improve performance and provide a fixed entry point. The Global Accelerator is configured with endpoints pointing to the ALBs. However, users are experiencing intermittent failures. What is the most likely cause?

Accepted Answer

Client IP address preservation is enabled on the Global Accelerator for cross-Region endpoints.. When client IP address preservation is enabled on Global Accelerator for cross-Region endpoints, the accelerator preserves the original client IP address in the packets sent to the Application Load Balancers. However, ALBs are layer-7 load balancers that require traffic to originate from the Global Accelerator's static IP addresses, not the client's IP, for proper routing and health check responses. This mismatch causes the ALBs to reject or mishandle traffic, leading to intermittent failures.

Answer

Global Accelerator does not support multiple endpoints in different Regions.

Answer

The ALBs are not configured with health checks.

Answer

The Global Accelerator is not configured for IPv6 traffic.

Question 9

A network engineer is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) connected via a VPC peering connection. Both VPCs have CIDR blocks: VPC-A = 10.0.0.0/16, VPC-B = 10.1.0.0/16. An EC2 instance in VPC-A (10.0.1.10) cannot ping an EC2 instance in VPC-B (10.1.1.10). Security groups and NACLs allow all traffic. The route tables are configured as follows: In VPC-A, a route to 10.1.0.0/16 via the peering connection. In VPC-B, a route to 10.0.0.0/16 via the peering connection. What is the most likely cause?

Accepted Answer

The route tables are missing routes to the peering connection.. The most likely cause is that the route tables containing the peering routes are not associated with the subnets where the EC2 instances are located. In AWS, each subnet must have an associated route table. If the main route table has the peering routes but the subnet's custom route table does not, the traffic will not be routed correctly. Since security groups and NACLs allow all traffic and the CIDRs are not overlapping, the only remaining possibility is a route table association issue.

Answer

The VPCs have overlapping CIDR blocks.

Answer

Security groups are blocking ICMP traffic.

Answer

There is an intermediate VPC or on-premises network that routes traffic incorrectly due to the lack of transitive routing.

Question 10

A company is setting up a Direct Connect connection to connect its on-premises data center to AWS. The connection is established, and a private virtual interface (VIF) is configured. The on-premises router can ping the VIF's Amazon side IP address, but cannot ping an EC2 instance in the VPC. The VPC has a virtual private gateway attached, and the route tables are correctly configured. What should the company check next?

Accepted Answer

Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.. The on-premises router can ping the VIF's Amazon side IP, confirming that Layer 2 and Layer 3 connectivity over the Direct Connect link is working, and BGP is established. However, the inability to ping the EC2 instance indicates that return traffic from the VPC is not reaching the on-premises network. For return traffic to be routed correctly, the on-premises router must advertise the VPC CIDR (or a specific prefix) to the Direct Connect router via BGP; otherwise, the AWS side will not forward traffic destined for the on-premises network over the VIF.

Answer

Check that the NACLs on the EC2 instance's subnet allow inbound ICMP.

Answer

Confirm that the private VIF is associated with the correct virtual private gateway.

Answer

Ensure that BGP is established and receiving routes.

Network Implementation

ANS-C01 Network Implementation — Key Topics

Where candidates lose marks on Network Implementation