ANS-C01 Practice Test 5 — 10 Questions

Question 1

A company is migrating a legacy on-premises application to AWS. The application uses a large number of short-lived TCP connections and requires low latency. The network team is considering using either a Network Load Balancer (NLB) or a Gateway Load Balancer (GWLB). Which of the following is a key advantage of using NLB over GWLB for this use case?

Accepted Answer

NLB preserves the client source IP, while GWLB does not by default.. For an application using a large number of short-lived TCP connections requiring low latency, NLB is the optimal choice because it operates at Layer 4 and preserves the client source IP address by default, which is critical for applications that need to log or process the original client IP. GWLB, by design, uses GENEVE encapsulation (UDP port 6081) to tunnel traffic to backend appliances, which replaces the client source IP with the NLB's private IP unless explicit configuration (e.g., proxy protocol) is used. This makes NLB the better fit for preserving source IP without additional overhead.

Answer

NLB can forward traffic to third-party virtual appliances.

Answer

NLB can handle higher throughput than GWLB.

Answer

NLB supports TLS termination, while GWLB does not.

Question 2

A company is deploying a hybrid network architecture with an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The on-premises network uses BGP to advertise routes to the VPN connection. After the VPN is established, the on-premises network cannot reach EC2 instances in the VPC. The VPC route table has a route for the on-premises CIDR block pointing to the VPN gateway. What is the most likely cause of this issue?

Accepted Answer

The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.. When the on-premises network advertises a default route (0.0.0.0/0) via BGP over the VPN connection, the VPC propagates that route into its route tables (if route propagation is enabled). This default route can override the VPC's local route for the on-premises CIDR, causing traffic destined for the on-premises network to be sent back out the VPN gateway instead of being delivered locally, effectively breaking connectivity to EC2 instances.

Answer

The VPN connection is not using the correct pre-shared key.

Answer

The security group attached to the EC2 instances does not allow inbound traffic from the on-premises CIDR.

Answer

The VPC's network ACLs are blocking inbound traffic from the on-premises network.

Question 3

A company is designing a network for a three-tier web application in a single VPC. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The application servers need to make outbound calls to a third-party API. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Application Load Balancer, application servers in private subnets with a NAT gateway, and database servers in private subnets.. Option C is correct because it places web servers in public subnets with an Application Load Balancer for inbound internet traffic, while application and database servers reside in private subnets without direct internet access. A NAT gateway in a public subnet enables the application servers to initiate outbound connections to a third-party API, with return traffic automatically routed back, meeting the requirement for outbound-only internet access.

Answer

Web servers in public subnets, application and database servers in private subnets with an internet gateway for outbound traffic.

Answer

All servers in public subnets with security groups restricting access.

Answer

All servers in private subnets and a VPN connection to the internet.

Question 4

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

Accepted Answer

BGP session between the customer router and AWS is down.. A private VIF relies on a BGP session between the customer router and the AWS Direct Connect router to exchange routes and maintain the virtual interface state. When the BGP session goes down, the VIF state transitions to 'down' because no routing information is being exchanged, causing connectivity loss. This is the most direct and common cause of a VIF being in the 'down' state.

Answer

AWS Site-to-Site VPN is not established.

Answer

MACsec encryption is misconfigured on the customer router.

Answer

Jumbo frames are enabled on the VIF but not supported by the customer router.

Question 5

A network engineer is troubleshooting high latency on an AWS Transit Gateway that connects multiple VPCs and an on-premises network via AWS Site-to-Site VPN. The engineer wants to identify potential causes. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Review the CloudWatch metrics for the VPN tunnels for packet loss and latency.. Option B is correct because CloudWatch metrics for VPN tunnels provide direct visibility into packet loss and latency, which are key indicators of performance issues on the AWS Site-to-Site VPN component of the Transit Gateway. Option C is correct because Transit Gateway Flow Logs capture IP traffic information between attachments, allowing the engineer to analyze traffic patterns, identify drops, and pinpoint which VPC or VPN attachment is contributing to the high latency.

Answer

Review the NACL rules for each subnet in the VPCs.

Answer

Re-create the VPN connections to reset the tunnels.

Answer

Enable VPC Flow Logs on the VPCs attached to the transit gateway.

Question 6

A company has a VPC with public and private subnets. The security team wants to inspect all traffic between the private subnets and the internet using a centralized inspection VPC. The company uses AWS Network Firewall and wants to ensure that traffic cannot bypass the firewall. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Deploy the Network Firewall in a dedicated inspection VPC and use a VPC peering or transit gateway to route traffic from the workload VPC to the inspection VPC.. Option B is correct because deploying AWS Network Firewall in a dedicated inspection VPC and using a transit gateway (or VPC peering) allows centralized traffic inspection. This architecture ensures that all traffic between the workload VPC and the internet is routed through the inspection VPC, preventing bypass. The transit gateway enables transitive routing, while VPC peering can also be used with proper route table entries to force traffic through the firewall.

Answer

Configure an AWS WAF web ACL and associate it with the internet gateway.

Answer

Enable VPC Flow Logs on the private subnets to monitor traffic.

Answer

Create an internet gateway in the workload VPC and attach it to the private subnets.

Question 7

A company is designing a hybrid network using AWS Transit Gateway. The company has three VPCs (VPC-A, VPC-B, VPC-C) all attached to the same Transit Gateway. The on-premises network connects to the Transit Gateway via a Direct Connect gateway. The company needs to ensure that VPC-C can communicate with the on-premises network but not with VPC-A or VPC-B. Which TWO actions should the network engineer take?

Accepted Answer

Associate the VPC-C route table with the Direct Connect gateway attachment.. Option B is correct because associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with the on-premises network via the Transit Gateway, enabling communication. Option D is correct because creating a separate Transit Gateway route table for VPC-C and not propagating VPC-A and VPC-B routes ensures that VPC-C has no routes to those VPCs, effectively isolating it from them at the network layer.

Answer

Use security groups on VPC-C to deny traffic from VPC-A and VPC-B.

Answer

Establish VPC peering connections between VPC-C and VPC-A, and VPC-C and VPC-B.

Answer

Apply a network ACL on VPC-C subnets to block traffic from VPC-A and VPC-B.

Question 8

A company has a VPC with an internet gateway and a NAT Gateway. The private subnet route table has a default route to the NAT Gateway. The company wants to enable instances in the private subnet to access an S3 bucket in the same region without traversing the internet. Which TWO actions should the company take?

Accepted Answer

Add a route to the S3 prefix list via the gateway endpoint in the private subnet route table.. Option B is correct because adding a route to the S3 prefix list via the gateway endpoint directs traffic destined for S3 through the VPC endpoint, keeping it within the AWS network. Option C is correct because a gateway VPC endpoint for S3 provides a private, scalable connection to S3 without requiring internet access or a NAT Gateway. Together, these actions allow private subnet instances to access S3 privately and efficiently.

Answer

Remove the default route to the NAT Gateway from the private subnet route table.

Answer

Add a route to the S3 prefix list via the NAT Gateway in the private subnet route table.

Answer

Create an interface VPC endpoint for S3.

Question 9

A company is designing a multi-region architecture with VPCs in us-east-1 and eu-west-1. The company needs low-latency connectivity between the VPCs and wants to avoid traffic over the public internet. The VPCs have overlapping CIDR blocks (10.0.0.0/16). Which solution should the network engineer recommend?

Accepted Answer

Set up an AWS Transit Gateway in each region and connect them via a VPN attachment.. Option A is correct because AWS Transit Gateway supports inter-region peering attachments that use the AWS global network backbone, providing low-latency, private connectivity between VPCs in different regions. Even when VPCs have overlapping CIDR blocks, Transit Gateway can handle this through route table isolation and network segmentation (e.g., using separate route tables for each VPC attachment), which VPC peering cannot do. VPN attachments between Transit Gateways in each region establish encrypted tunnels over the AWS backbone, avoiding the public internet.

Answer

Use a Direct Connect connection between the regions.

Answer

Use VPC peering between the two VPCs.

Answer

Place all resources in a single VPC with multiple Availability Zones.

Question 10

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs in the same AWS Region. The company wants to use AWS Transit Gateway to simplify connectivity between these VPCs and their on-premises network. Which steps are required to integrate the existing Direct Connect connection with Transit Gateway?

Accepted Answer

Create a Direct Connect gateway, associate the existing VIFs, and attach the Direct Connect gateway to the Transit Gateway.. Option D is correct because AWS Direct Connect private VIFs cannot be attached directly to a Transit Gateway. Instead, you must create a Direct Connect Gateway, associate the existing private VIFs with it, and then attach the Direct Connect Gateway to the Transit Gateway. This architecture allows the Transit Gateway to route traffic between the on-premises network (via the Direct Connect connection) and the attached VPCs, while also enabling inter-VPC routing through the Transit Gateway.

Answer

Set up a VPN connection over the Direct Connect link and attach the VPN to the Transit Gateway.

Answer

Attach the existing private VIFs directly to the Transit Gateway.

Answer

Create a new private VIF on the Direct Connect connection and attach it to the Transit Gateway.