ANS-C01 Practice Test 35 — 15 Questions

Question 1

A company is designing a network for a multi-account AWS environment using AWS Organizations. The company must centralize internet egress for all accounts. Which TWO solutions should the company use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Transit Gateway to route traffic from all VPCs to the egress VPC.. AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs. This allows traffic from multiple VPCs to be routed to a centralized egress VPC without requiring complex peering relationships or full mesh connectivity.

Answer

Use VPC Peering to connect all VPCs to the egress VPC.

Answer

Deploy a AWS Client VPN endpoint in each VPC.

Answer

Attach an Internet Gateway to each VPC and allow direct internet access.

Question 2

A company is designing a hybrid network where an Amazon VPC is connected to an on-premises data center via AWS Direct Connect and a VPN backup. They have a VPC with CIDR 10.0.0.0/16 and on-premises CIDR 192.168.0.0/16. They want to ensure that all traffic between the VPC and on-premises uses the Direct Connect connection when it is available, and automatically fails over to the VPN if Direct Connect fails. What should they do?

Accepted Answer

Create a virtual private gateway attached to the VPC. Establish a Direct Connect private virtual interface and a VPN connection to the virtual private gateway. Configure BGP on both connections and use a shorter AS path for the Direct Connect routes.. It uses a virtual private gateway (VGW) for both the Direct Connect private virtual interface and the VPN connection, and configures BGP on both. By advertising a shorter AS path (e.g., prepending fewer AS numbers) for the Direct Connect routes, the VPC and on-premises routers prefer the Direct Connect path when available. If Direct Connect fails, the BGP session drops, and the VPN routes (with a longer AS path) become active, providing automatic failover.

Answer

Create a virtual private gateway with a Direct Connect private virtual interface. Additionally, create a separate VPN connection directly to the VPC. Set longer AS path for the Direct Connect routes.

Answer

Create a virtual private gateway and establish both a Direct Connect private virtual interface and a VPN connection. Use BGP with equal AS path lengths to enable ECMP.

Answer

Create a virtual private gateway and attach a Direct Connect private virtual interface. For failover, add a static route in the VPC route table pointing to the VPN connection.

Question 3

A company has a VPC with public and private subnets in three Availability Zones. They have EC2 instances in private subnets that need to download patches from the internet. The company requires that all outbound traffic to the internet is logged and inspected. Which solution meets these requirements with the highest availability?

Accepted Answer

Create a centralized egress VPC with a NAT Gateway in each AZ. Peer the application VPCs to the egress VPC and route 0.0.0.0/0 traffic through a firewall appliance in the egress VPC.. It meets the requirements for logging and inspecting all outbound internet traffic by routing it through a centralized firewall appliance in an egress VPC, while also providing high availability through NAT Gateways deployed in each Availability Zone. This architecture ensures that traffic is inspected before reaching the internet, and the use of multiple NAT Gateways eliminates single points of failure, achieving the highest availability compared to single-instance or single-gateway solutions.

Answer

Launch a NAT instance in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to the NAT instance.

Answer

Place a single NAT Gateway in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to that NAT Gateway.

Answer

Attach an internet gateway to the VPC and add a route in the private subnet route tables to send 0.0.0.0/0 to the internet gateway.

Question 4

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

Accepted Answer

The transit gateway route table propagation is not configured.. The exhibit shows a transit gateway route table attached to the VPC, but no propagation is configured. Without explicit propagation, the VPC attachment's CIDR blocks are not automatically added to the transit gateway route table. The CloudFormation resource AWS::EC2::TransitGatewayRouteTablePropagation must be declared to enable route propagation from the VPC attachment into the transit gateway route table.

Answer

The VPC attachment is not in the 'available' state.

Answer

VPN ECMP support is enabled, preventing propagation.

Answer

DNS support is disabled on the transit gateway.

Question 5

Which THREE of the following are valid considerations when designing a multi-VPC architecture using AWS Transit Gateway? (Choose three.)

Accepted Answer

You can route internet-bound traffic from multiple VPCs through a single shared VPC with a NAT gateway.. AWS Transit Gateway allows you to centralize internet-bound traffic by routing it from multiple VPCs through a single shared VPC that contains a NAT gateway. This design reduces costs and simplifies management by avoiding the need for a separate NAT gateway in each VPC, as the Transit Gateway can propagate routes to direct traffic to the shared VPC's NAT gateway for egress to the internet.

Answer

Transit Gateway does not support multicast traffic.

Answer

VPCs attached to the same Transit Gateway can have overlapping CIDR blocks.

Question 6

A company's VPC includes a public subnet with a NAT gateway and a private subnet with EC2 instances. The EC2 instances in the private subnet need to access the internet for software updates. The NAT gateway's Elastic IP is associated correctly, and the route tables are configured. However, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table for the private subnet is missing a default route pointing to the NAT gateway.. The most common issue is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from the private subnet cannot be directed to the NAT gateway, and thus cannot reach the internet.

Answer

The NAT gateway is in the private subnet.

Answer

The network ACL for the private subnet is blocking outbound traffic.

Answer

The security group for the EC2 instances does not allow outbound traffic.

Question 7

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network engineer is troubleshooting connectivity issues and notices that the BGP session between the on-premises router and the AWS Direct Connect virtual interface is down. The engineer has verified the physical connectivity and the VLAN configuration. What should the engineer check next?

Accepted Answer

Confirm that the BGP ASN configured on the on-premises router matches the one provided by AWS.. Correct answer is C. BGP session establishment requires matching BGP ASN on both sides; if they don't match, the session fails. Option A is incorrect because the virtual interface type (private or public) does not prevent BGP from coming up; it affects routing scope. Option B is incorrect because the route size advertised does not affect the BGP session itself; AWS accepts routes of any size within limits. Option D is incorrect because the VPC CIDR is used for routing, but not for BGP session establishment; the session can be up even if no routes are propagated.

Answer

Ensure the virtual interface type is set to 'public'.

Answer

Verify that the on-premises router is advertising a CIDR block smaller than /24.

Answer

Check the VPC CIDR range in the route table.

Question 8

A network engineer is troubleshooting intermittent connectivity issues between two VPCs that are peered. The VPC peering connection is in the 'active' state. ICMP ping from an instance in VPC A to an instance in VPC B fails intermittently. What is the most likely cause?

Accepted Answer

The route tables in one or both VPCs lack routes to the peer VPC's CIDR via the peering connection.. Since the VPC peering connection is active, the issue is likely that the route tables in one or both VPCs are not correctly configured to route traffic to the peered VPC's CIDR via the peering connection. Without proper routes, traffic is dropped.

Answer

The network ACLs are blocking ICMP traffic.

Answer

The security groups on the instances do not allow inbound ICMP.

Answer

The VPC peering connection is not in the 'active' state.

Question 9

A company is designing a multi-account AWS environment using AWS Transit Gateway. They want to centralize network management and ensure that VPCs in different accounts can communicate. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Create a Transit Gateway in the central networking account. The Transit Gateway must be created in a central networking account to serve as the hub for all VPC traffic. This centralizes routing and simplifies network management across the multi-account environment.

Answer

Create a separate Transit Gateway in each account and peer them together

Answer

Create a VPC peering connection between each VPC and the Transit Gateway

Question 10

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect and a VPN connection as a backup. The on-premises network uses BGP to advertise routes to AWS. Which of the following are best practices for this setup? (Choose TWO.)

Accepted Answer

Use different BGP ASNs for the Direct Connect and VPN connections.. Using different BGP ASNs for the Direct Connect and VPN connections prevents BGP from treating the two connections as a single eBGP session, which would cause routing loops or suboptimal path selection. This separation allows AWS to distinguish between the two paths and apply independent routing policies. Option E is correct because configuring BGP attributes (such as AS path prepending or MED) on the Direct Connect path ensures it is preferred over the VPN backup, aligning with the design goal of using Direct Connect as the primary link.

Answer

Advertise the same routes over both connections with identical BGP attributes.

Answer

Use the VPN connection as the primary path and Direct Connect as the backup.

Answer

Use the same BGP ASN for both the Direct Connect and VPN connections.

Question 11

A company is designing a VPC with public and private subnets. The private subnets need to access Amazon S3 and Amazon DynamoDB. The company wants to minimize data transfer costs and avoid using a NAT gateway. What is the MOST cost-effective solution?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB in the private subnets and update route tables. VPC endpoints for S3 and DynamoDB allow private connectivity without incurring data transfer costs or NAT gateway fees. Option A is wrong because an HTTP proxy adds complexity and cost. Option B is wrong because a NAT instance still incurs instance costs and management overhead. Option D is wrong because a NAT gateway incurs hourly and data processing charges.

Answer

Set up an HTTP proxy in the private subnets and configure the applications to use it

Answer

Use a NAT instance instead of a NAT gateway

Answer

Create a NAT gateway in a public subnet and route private subnet traffic to it

Question 12

A company is migrating a legacy application to AWS. The application uses multicast traffic between servers. The company needs to support multicast in the AWS VPC. Which TWO solutions can the network engineer recommend? (Choose TWO.)

Accepted Answer

Deploy a third-party virtual firewall or router that supports multicast inside the VPC.. A third-party virtual firewall or router appliance (e.g., from vendors like Palo Alto Networks or Cisco) can be deployed in the VPC and configured to forward multicast traffic using protocols such as IGMP and PIM. This allows the legacy application to continue using multicast within the VPC without native AWS multicast support. Option D is correct because AWS Transit Gateway now supports multicast domains, enabling you to create a multicast group and associate subnets, allowing multicast traffic to flow between attached VPCs and VPN connections.

Answer

Use VPC endpoints for multicast support.

Answer

Use VPC peering connections to allow multicast traffic between VPCs.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain.

Question 13

A company is deploying a web application across multiple Availability Zones in a VPC. The application needs to be highly available and scale based on traffic. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The company wants to ensure that if an Availability Zone fails, the ALB can still route traffic to healthy instances in other zones. What should the network engineer implement to meet this requirement?

Accepted Answer

Enable cross-zone load balancing on the ALB.. Enabling cross-zone load balancing on an Application Load Balancer (ALB) allows it to distribute incoming traffic evenly across all registered targets in all enabled Availability Zones. If an entire Availability Zone fails, the ALB automatically routes traffic only to healthy instances in the remaining zones, ensuring high availability without requiring manual intervention or additional components.

Answer

Configure a Network Load Balancer instead of an ALB, and enable cross-zone load balancing.

Answer

Use an ALB with a target group that contains instances from only one Availability Zone, and use Route 53 health checks.

Answer

Deploy one ALB in each Availability Zone and use Route 53 latency-based routing.

Question 14

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to access an S3 bucket. Which configuration provides the most secure and efficient access without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and associate it with the private subnet route table.. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 directly over the AWS network without traversing the internet, using a route table entry that targets the endpoint's prefix list. This provides the most secure and efficient access by keeping traffic within the AWS backbone, avoiding NAT Gateway costs and internet exposure.

Answer

Establish a VPN connection to on-premises and route to S3 from there.

Answer

Use a NAT Gateway in the public subnet to route traffic to S3.

Answer

Configure a proxy server in the public subnet.

Question 15

A company has a VPC with multiple subnets across three Availability Zones. They are deploying an NFS file system using Amazon EFS. They need high availability and low latency from all subnets. Which EFS deployment option meets these requirements?

Accepted Answer

Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.. The EFS Standard storage class provides Multi-AZ durability and availability, and creating mount targets in each Availability Zone ensures that EC2 instances in any subnet can connect to EFS with low latency by using a mount target in the same AZ. This architecture avoids cross-AZ data transfer charges and minimizes latency, meeting both high availability and low latency requirements.

Answer

Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

Answer

Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

Answer

Use EFS One Zone storage class and create mount targets in each Availability Zone.