ANS-C01 Practice Test 35 — 15 Questions

Question 1

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

Accepted Answer

Traffic goes through the NAT Gateway nat-67890.. Option C is correct because the subnet inherits the main route table (rtb-12345) which has a route to a NAT Gateway for 0.0.0.0/0. Option A is wrong because the local route is for VPC internal traffic. Option B is wrong because an Internet Gateway is not present. Option D is wrong because no explicit association exists.

Answer

Traffic is dropped because no explicit association is set.

Answer

Traffic goes through the Internet Gateway.

Answer

Traffic is dropped because no Internet Gateway is present.

Question 2

A company is deploying a VPC with public and private subnets across two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates without being directly reachable from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A (Internet Gateway) would allow inbound traffic, option C (VPC Peering) is for connecting VPCs, and option D (VPN Gateway) is for site-to-site VPN.

Answer

Virtual Private Gateway

Answer

VPC Peering Connection

Answer

Internet Gateway

Question 3

A company is deploying a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer (ALB), and the application tier runs on EC2 instances that connect to an RDS MySQL Multi-AZ DB instance. The application tier must be isolated from the internet and only accessible from the web tier. Which network implementation meets these requirements with the LEAST administrative overhead?

Accepted Answer

Place the web tier in a public subnet and the application tier in a private subnet, and configure security groups to allow inbound traffic to the application tier only from the web tier's security group.. Option C is correct because placing the web tier in a public subnet and the application tier in a private subnet with security groups allowing traffic only from the web tier is the standard design for multi-tier web applications with minimal overhead. Option A is wrong because using a network ACL alone would not isolate the application tier from the internet; a private subnet is needed. Option B is wrong because a NAT gateway is unnecessary for outbound access from the application tier (not required) and adds cost. Option D is wrong because using a different VPC and VPC peering adds complexity.

Answer

Create two VPCs: one for the web tier with a public subnet, and one for the application tier with a private subnet, and connect them using VPC peering.

Answer

Place the web tier in a public subnet and the application tier in a private subnet with a NAT gateway for outbound access, and use security groups to allow traffic from the web tier.

Answer

Place both tiers in the same public subnet, and use a network ACL to restrict traffic from the web tier to the application tier.

Question 4

A company is using AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The VPC has a CIDR 10.0.0.0/16. The on-premises network uses 192.168.0.0/16. The company wants to enable communication between on-premises and the VPC, and also allow the VPC to access the internet via an internet gateway. Which TWO of the following configurations are necessary?

Accepted Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the internet gateway.. Option A is correct because the VPC route table must have a route for 192.168.0.0/16 pointing to the virtual private gateway (VGW) to route traffic to on-premises. Option D is correct because the VPC route table must have a route for 0.0.0.0/0 pointing to the internet gateway for outbound internet access. Option B is not necessary because the VGW is automatically attached. Option C is not necessary because the on-premises router must have routes to the VPC CIDR, not the internet gateway. Option E is not necessary because the VGW already handles routing.

Answer

A route in the on-premises router for the VPC CIDR (10.0.0.0/16) pointing to the AWS Direct Connect router.

Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway.

Answer

A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the internet gateway.

Question 5

A company is experiencing intermittent connectivity issues between its on-premises network and AWS via a Direct Connect connection. The link is up, but packet loss is observed. Which test should the network engineer perform first to isolate the issue?

Accepted Answer

Run a traceroute with MTR. Option D is correct because MTR (my traceroute) provides detailed path analysis and packet loss at each hop. Option A is for basic connectivity. Option B is for DNS. Option C is for throughput, not loss.

Answer

Ping the virtual private gateway

Answer

Perform a DNS lookup

Answer

Run a speed test

Question 6

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC with public and private subnets. The ALB is in public subnets, and the web servers are in private subnets. Clients report intermittent connection errors. Investigation shows that the ALB is marking targets as unhealthy. What is the MOST likely cause?

Accepted Answer

The health check is configured to use the public IP address of the targets, but the targets are in private subnets without public IPs.. If the ALB health checks are configured to use the public IP of the targets, the private subnet instances will not respond because they do not have public IPs. Option A is wrong because security groups should allow traffic from the ALB. Option B is wrong because the ALB is in public subnets. Option D is wrong because security groups should be on the instance side.

Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB.

Answer

The security group for the web servers does not allow inbound traffic from the internet.

Answer

The ALB is deployed in private subnets and cannot reach the internet.

Question 7

A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?

Accepted Answer

Route propagation and route tables in the VPC and on-premises.. Option A is correct because the route tables on the on-premises router and in the VPC must have routes for the remote networks. Option B is incorrect because the VPN tunnel being up indicates Phase 1 and 2 are likely fine. Option C is incorrect because security groups are stateful and allow ICMP if outbound is allowed. Option D is incorrect because the VPN connection is active.

Answer

The VPN connection status in the AWS console.

Answer

Security group inbound rules for ICMP on the EC2 instance.

Answer

IKE version mismatch between the VPN endpoints.

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet. The company has a NAT gateway in the public subnet. The NAT gateway has an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's Elastic IP is not allowed by the destination's firewall.. Option D is correct because the NAT gateway's Elastic IP must be allowed by the on-premises firewall or the destination must allow traffic from that IP. Option A is incorrect because a default route exists. Option B is incorrect because security groups are stateful and allow outbound. Option C is incorrect because NACLs are stateless but inbound rule for ephemeral ports is needed; however, the issue is more likely the NAT gateway's public IP not being allowed.

Answer

The security group of the EC2 instance blocks outbound traffic.

Answer

The route table in the public subnet does not have a default route to the internet gateway.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 9

A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?

Accepted Answer

An inbound rule in the database's security group that references the web server's security group.. Option B is correct because a security group on the database must allow inbound traffic from the web server's security group. Option D is correct because the private subnet route table does not need a route to the internet gateway, but it must have a route to the NAT gateway or VPC peering if needed, but for database access, no route to internet is needed. However, the question asks for required components. Actually, to allow the web server to connect to the database, you need a security group rule on the database allowing the web server's security group, and you need the private subnet to have a route to the public subnet's CIDR via the local route (already present). So the correct options are B and C? Wait, let's analyze: A is not required because you can use security group IDs. B is required. C is required because the private subnet must have a route to the public subnet's CIDR (which is local and automatically added). D is not required because internet gateway is not needed for private subnet to communicate within VPC. E is not required because NAT gateway is for internet access. So the two correct are B and C. But C says "A route table associated with the private subnet that includes a route to the internet gateway" which is wrong. I need to correct the options. Let me rephrase:

Answer

An inbound rule in the database's security group that allows traffic from the web server's private IP address.

Answer

An internet gateway attached to the VPC.

Answer

A NAT gateway in the public subnet.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be implemented?

Accepted Answer

Create a Gateway VPC Endpoint for S3. Option C is correct because a Gateway VPC Endpoint for S3 provides private connectivity to S3 without internet access, reducing costs. Option A would use internet. Option B is for other AWS services. Option D is for dedicated connectivity.

Answer

Use an Interface VPC Endpoint for S3

Answer

Use AWS Direct Connect

Answer

Set up a NAT Gateway in the public subnet and route traffic through it

Question 11

A company has a VPC with a transit gateway (TGW) connected to multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises a specific prefix 10.0.0.0/16. A VPC attachment in the same region also advertises the same prefix. The TGW route table has the on-premises route as static and the VPC route as propagated. Which route will be used for traffic destined to 10.0.0.5?

Accepted Answer

The static route to on-premises. Option A is correct because static routes take precedence over propagated routes in a transit gateway route table. Option B is wrong because TGW does not use AS_PATH for static vs propagated. Option C is wrong because there is no longest prefix match difference. Option D is wrong because equal-cost multipath is not applied when static and propagated routes exist.

Answer

The propagated route from VPC

Answer

Both routes will be used with ECMP

Answer

The route with the shortest AS_PATH

Question 12

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

Accepted Answer

The transit gateway route table propagation is not configured.. Option B is correct because the route table association is enabled but propagation is not automatic; the CloudFormation resource does not create a route table propagation. Option A is wrong because the attachment is created. Option C is wrong because DNS support is not related. Option D is wrong because VPN ECMP is not relevant.

Answer

The VPC attachment is not in the 'available' state.

Answer

VPN ECMP support is enabled, preventing propagation.

Answer

DNS support is disabled on the transit gateway.

Question 13

A company has a Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to ensure that traffic always uses the Direct Connect connection when it is available, and only fails over to the VPN if Direct Connect goes down. How should they configure routing?

Accepted Answer

Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN.. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over VPN, BGP will prefer the more specific route. Option A (same prefix with lower AS path) is incorrect because AS path length is considered after prefix length. Option B (same prefix with different local preference) could work but the standard approach is prefix length. Option C (VPN with higher weight) is not a standard BGP attribute.

Answer

Use static routes pointing to the Direct Connect virtual interface with a lower metric than the VPN route.

Answer

Advertise the same prefix over both connections but with a lower AS path length over Direct Connect.

Answer

Advertise the same prefix over both connections but set a higher weight on the VPN BGP session.

Question 14

A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?

Accepted Answer

The NAT Gateway is deployed in a private subnet.. The NAT Gateway must be in a public subnet with an Internet Gateway attached. If the NAT Gateway is in a private subnet, it cannot access the internet. Option A (security group) allows outbound; Option B (NACL) default allows; Option D (DNS) is not the issue.

Answer

The security group does not allow inbound traffic from the internet.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The instance's DNS resolution is not configured correctly.

Question 15

A company has a VPC with a public subnet and a private subnet. They want to allow instances in the private subnet to download patches from the internet. Which THREE components are required? (Select THREE.)

Accepted Answer

Internet Gateway attached to the VPC. For private subnet internet access, you need a NAT Gateway (or NAT instance) in a public subnet, an Internet Gateway attached to the VPC, and a route in the private subnet's route table pointing to the NAT Gateway. Option D (Elastic IP) is needed for the NAT Gateway but is part of the NAT Gateway configuration. Option E (Direct Connect) is not required.

Answer

AWS Direct Connect connection

Answer

Elastic IP address assigned to the NAT Gateway

ANS-C01 Practice Test 35 — 15 Questions

Exhibit

ANS-C01 Practice Test 35 — 15 Questions

Exhibit