ANS-C01 Practice Test 2 — 10 Questions

Question 1

A network engineer is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) connected via a VPC peering connection. Both VPCs have CIDR blocks: VPC-A = 10.0.0.0/16, VPC-B = 10.1.0.0/16. An EC2 instance in VPC-A (10.0.1.10) cannot ping an EC2 instance in VPC-B (10.1.1.10). Security groups and NACLs allow all traffic. The route tables are configured as follows: In VPC-A, a route to 10.1.0.0/16 via the peering connection. In VPC-B, a route to 10.0.0.0/16 via the peering connection. What is the most likely cause?

Accepted Answer

There is an intermediate VPC or on-premises network that routes traffic incorrectly due to the lack of transitive routing.. VPC peering connections do not support transitive routing. Even though the route tables in VPC-A and VPC-B correctly point to each other via the peering connection, if there is an intermediate VPC or on-premises network involved in the path, traffic cannot be forwarded through that intermediate point. The ping fails because the peering connection is a direct, one-to-one link and does not allow routing through a third network.

Answer

The VPCs have overlapping CIDR blocks.

Answer

Security groups are blocking ICMP traffic.

Answer

The route tables are missing routes to the peering connection.

Question 2

A company is migrating a legacy application to AWS. The application requires multicast communication between EC2 instances in the same VPC. Which THREE options can support this requirement? (Choose three.)

Accepted Answer

Use AWS Transit Gateway with a multicast domain.. AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows EC2 instances in different subnets and VPCs attached to the transit gateway to send and receive multicast traffic. This is a native AWS capability that does not require third-party appliances or workarounds, making it a valid option for the requirement.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain to the VPC.

Answer

Create a VPC peering connection and enable multicast across the peered VPCs.

Question 3

A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?

Accepted Answer

Use TLS or IPsec at the application layer between instances.. Option B is correct because VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.

Answer

Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.

Answer

Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.

Answer

Enable encryption on the VPC peering connection.

Question 4

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

Accepted Answer

The security group for the EC2 instance does not allow inbound HTTPS traffic.. Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed. Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.

Answer

The network ACL in the VPC is blocking outbound traffic.

Answer

The BGP session is in the 'Idle' state.

Answer

The route table associated with the virtual private gateway does not have a route to the on-premises network.

Question 5

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network engineer needs to ensure that traffic between VPC A and VPC B follows a specific path through a Network Virtual Appliance (NVA) in VPC C. Which TWO actions should the engineer take?

Accepted Answer

Add a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole.. Option B is correct because adding a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole forces traffic destined to VPC B to be dropped at the Transit Gateway, preventing direct routing. Option D is correct because adding a specific route for VPC B's CIDR in the Transit Gateway route table used by VPC A, pointing to the VPC C attachment, ensures traffic from VPC A to VPC B is forwarded through the NVA in VPC C, enforcing the desired inspection path.

Answer

Associate VPC A's and VPC B's route tables with a different Transit Gateway route table that has a default route pointing to the VPC C attachment.

Answer

Enable route propagation for VPC A and VPC B attachments in the same Transit Gateway route table.

Answer

Create a VPC peering connection between VPC A and VPC B.

Question 6

A multinational corporation is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. The network team is experiencing asymmetric routing for traffic between two VPCs that both have routes to the same on-premises network. Which feature should the team implement to resolve this issue?

Accepted Answer

Use AS_PATH prepending on the BGP advertisements from the on-premises router to influence route preference.. AS_PATH prepending allows the on-premises router to artificially lengthen the AS_PATH for specific BGP routes, making those routes less preferred. This influences route selection in the Transit Gateway and VPC route tables, ensuring that traffic from each VPC takes a consistent path and eliminating asymmetric routing.

Answer

Deploy a NAT Gateway in each VPC to force symmetric traffic.

Answer

Create a Transit Gateway peering attachment between the two VPCs.

Answer

Enable VPC Flow Logs to detect and alert on asymmetric flows.

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Verify that the transit gateway route table contains the CIDR blocks of both VPCs.. Option A is correct because the transit gateway route table must contain the CIDR blocks of both VPCs for traffic to be forwarded between them. Without these static routes, the transit gateway has no destination to route the traffic, causing it to be dropped. Verifying the route table entries ensures the necessary paths exist.

Answer

Check the Direct Connect virtual interface status.

Answer

Verify that the NAT Gateway in each VPC is properly configured.

Question 8

A company uses AWS Site-to-Site VPN to connect its on-premises network to AWS. The VPN connection is established, but traffic from on-premises to AWS is not working. The on-premises network team confirms that the on-premises firewall is allowing traffic to the VPC CIDR. What should the network engineer check in AWS to resolve the issue?

Accepted Answer

Check the VPC route tables to ensure routes to the on-premises network point to the virtual private gateway.. Option D is correct because even if the VPN tunnel is up and BGP is peering, traffic will not flow unless the VPC route tables have a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Without this route, the VPC has no path to forward return traffic back to the on-premises network, causing asymmetric routing or blackholing.

Answer

Verify that the VPN tunnel status is UP.

Answer

Review the customer gateway configuration for incorrect BGP settings.

Answer

Ensure the virtual private gateway is attached to the correct VPC.

Question 9

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. Network engineers report intermittent connectivity issues between VPC A and the on-premises network. The transit gateway route table shows the on-premises CIDR (10.0.0.0/8) propagated from the VPN attachment. VPC A has a subnet route pointing to the transit gateway for 10.0.0.0/8. Which step should the engineer take FIRST to diagnose the issue?

Accepted Answer

In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.. Option C is correct because the first diagnostic step for intermittent connectivity through a transit gateway is to verify the route table configuration. The engineer must confirm that the VPN attachment is correctly associated with the transit gateway route table and that the 10.0.0.0/8 route is propagated from the VPN attachment, as a missing or misassociated route would cause traffic to be dropped even if the VPN tunnel is up.

Answer

Verify that the VPN tunnel status shows as UP on both sides.

Answer

Enable VPC Flow Logs on VPC A to verify traffic reaching the transit gateway.

Answer

Check the security group rules on the EC2 instances in VPC A for outbound traffic.

Question 10

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

Accepted Answer

Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.. Option C is correct because it provides true high availability and fast failover by using two separate Direct Connect connections, each with multiple private VIFs, attached to the same transit gateway. BFD (Bidirectional Forwarding Detection) enables sub-second failure detection, and ECMP (Equal-Cost Multi-Path) routing across the VIFs allows active-active load balancing, minimizing packet loss during failover. This design eliminates single points of failure and meets the requirement for rapid convergence with minimal disruption.

Answer

Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.

Answer

Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.

Answer

Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.