ANS-C01 Network Design Practice Test 4 — 15 Questions

Question 1

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for 172.16.0.0/16 pointing to the virtual private gateway.. The VPN status is 'available', which indicates that the VPN tunnels are established and the BGP sessions (if configured) are up. However, traffic still fails because the VPC route table lacks a route for the on-premises CIDR (172.16.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC does not know to send traffic destined for the on-premises network through the VPN connection, even though the tunnels themselves are operational.

Answer

The VPN tunnels are not in 'UP' state.

Answer

The tunnel inside CIDRs overlap with the VPC CIDR.

Answer

The BGP session is not established.

Question 2

A network engineer is creating an IAM policy for a DevOps team. The team needs to manage VPN connections. What is the effect of this policy?

Accepted Answer

Allows full management of VPN connections and associated resources.. The IAM policy grants the `ec2:*` action on VPN-related resources (`*vpn*`), which includes all VPN connection operations (create, modify, delete, describe) and associated resources like VPN gateways and customer gateways. This full wildcard on VPN resources enables complete lifecycle management, making option B correct.

Answer

Denies deletion of VPN connections.

Answer

Restricts access to only VPN connections.

Answer

Allows read-only access to VPN configurations.

Question 3

A network engineer is troubleshooting a Direct Connect private VIF. The VIF is in 'available' state but traffic is not flowing to the VPC. The VGW is attached to the VPC. What is the most likely cause?

Accepted Answer

The VPC route table lacks a route to the on-premises network pointing to the VGW.. When a Direct Connect private VIF is in the 'available' state, the physical and logical layer 2 connectivity is established, and BGP sessions are typically up. However, traffic still cannot flow to the VPC unless the VPC route table contains a route that directs traffic destined for the on-premises network to the Virtual Private Gateway (VGW). Without this route, the VPC has no path to send traffic over the Direct Connect connection, even though the VIF and BGP are operational.

Answer

The route filter prefix for the VPC CIDR is misconfigured.

Answer

BGP is not established between the on-premises router and the VGW.

Answer

The VIF state is not 'available'.

Question 4

A company wants to connect its on-premises data center to AWS using a dedicated, private network connection. Which AWS service should be used to establish a 1 Gbps dedicated connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service for establishing a dedicated, private network connection from an on-premises data center to AWS. It provides a 1 Gbps (or higher) physical Ethernet link that bypasses the public internet, delivering consistent network performance and reduced bandwidth costs for high-volume data transfer.

Answer

AWS Transit Gateway

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 5

A company has multiple VPCs across different AWS Regions and wants to enable communication between them using AWS's global network backbone. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Transit Gateway with inter-Region peering.. AWS Transit Gateway with inter-Region peering is correct because it allows you to connect multiple VPCs across different AWS Regions using AWS's global network backbone, providing a hub-and-spoke architecture that scales easily. This solution minimizes operational overhead by centralizing routing and eliminating the need to manage individual connections between each VPC, as Transit Gateway automatically handles route propagation and traffic distribution across peered transit gateways.

Answer

Set up AWS Direct Connect connections to each VPC.

Answer

Create VPC peering connections between each pair of VPCs.

Answer

Use AWS Site-to-Site VPN between VPCs.

Question 6

A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?

Accepted Answer

AWS Transit Gateway with centralized routing to the inspection VPC.. Option C is correct because AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.

Answer

VPC peering between all VPCs and the inspection VPC.

Answer

AWS Network Firewall deployed in each VPC.

Answer

AWS Direct Connect Gateway with virtual interfaces.

Question 7

A company needs to provide internet access to instances in a private subnet while preventing inbound connections from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It achieves this by translating the private source IP addresses of the instances to the NAT Gateway's Elastic IP address, and by default it does not allow inbound traffic unless an explicit inbound rule is added to the associated route table, which is not recommended for this use case.

Answer

Internet Gateway

Answer

AWS Direct Connect

Answer

VPC Endpoint

Question 8

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The application team wants to allow internet traffic to an IPv6-enabled web server. Which resource must be configured?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is required to allow inbound and outbound IPv6 traffic between a VPC and the internet. Unlike IPv4, IPv6 addresses in AWS are globally unique by default, so no NAT is needed; the IGW directly routes traffic for both IPv4 and IPv6 when attached to the VPC and associated with the route table.

Answer

NAT64

Answer

Egress-Only Internet Gateway

Answer

NAT Gateway

Question 9

A company is designing a hybrid network with AWS Direct Connect. They have multiple VPCs in the same Region and want to use a single Direct Connect connection to access all VPCs. Which AWS resource should be used?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows you to associate up to 10 Virtual Private Gateways (VGWs) or Transit Gateways in the same or different AWS accounts, enabling a single Direct Connect connection to reach multiple VPCs in the same Region. This is the correct resource because it acts as a hub that terminates the Direct Connect virtual interfaces (VIFs) and propagates routes to the associated VPCs via their VGWs or Transit Gateways.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

Virtual Private Gateway

Question 10

A company needs to resolve DNS names within a VPC using a custom domain. Which AWS service should be used?

Accepted Answer

Amazon Route 53 Resolver. Amazon Route 53 Resolver provides recursive DNS resolution for VPCs and supports custom domain names via inbound and outbound endpoints. It integrates with on-premises DNS through conditional forwarding, enabling resolution of custom private domains within the VPC without exposing them to the internet.

Answer

Elastic Load Balancing

Answer

Amazon CloudFront

Answer

AWS WAF

Question 11

A company wants to monitor network traffic between two VPCs that are peered. Which AWS feature can capture IP traffic information for analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between peered VPCs. They log metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions, which can be published to CloudWatch Logs or Amazon S3 for analysis. This makes them the correct choice for monitoring network traffic between two peered VPCs.

Answer

AWS X-Ray

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet goes through a centralized firewall. Which design should be used?

Accepted Answer

Route all internet traffic through a centralized inspection VPC using Transit Gateway.. Option A is correct because it uses a Transit Gateway to route all outbound internet traffic from the VPC to a centralized inspection VPC, where a firewall (e.g., AWS Network Firewall or a third-party appliance) inspects and forwards traffic to an Internet Gateway. This design meets the security requirement by enforcing a single egress point, ensuring all traffic is inspected before reaching the internet.

Answer

Attach an Internet Gateway to each VPC.

Answer

Use AWS Site-to-Site VPN to a third-party firewall.

Answer

Use VPC Endpoints for all services.

Question 13

Which TWO options are valid methods to connect multiple VPCs together in a hub-and-spoke topology? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (A) is a valid method because it establishes a direct, one-to-one network connection between two VPCs using the AWS global backbone, enabling private IPv4 or IPv6 communication without gateways or VPNs. AWS Transit Gateway (E) is valid because it acts as a central hub that connects multiple VPCs and on-premises networks through a single, scalable gateway, simplifying the hub-and-spoke topology management.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

AWS Site-to-Site VPN

Question 14

Which THREE are benefits of using AWS Transit Gateway over VPC peering in a multi-VPC environment? (Select THREE.)

Accepted Answer

Centralized management of network policies. AWS Transit Gateway provides a centralized hub for managing network policies across multiple VPCs, allowing you to apply consistent routing, security, and access controls from a single point. This eliminates the need to manage individual VPC peering connections and their route tables, reducing operational overhead and the risk of misconfiguration.

Answer

Higher bandwidth per connection

Answer

Simpler configuration for a few VPCs

Answer

Lower cost compared to VPC peering

Question 15

Which TWO AWS services can be used to provide inbound internet connectivity to resources in a VPC? (Select TWO.)

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that provides a target in VPC route tables for internet-routable traffic and performs network address translation (NAT) for instances with public IPs. It enables inbound internet connectivity by allowing traffic from the internet to reach resources in the VPC, provided the resources have public IPs and the route table directs 0.0.0.0/0 traffic to the IGW.

Answer

VPC Endpoint

Answer

Amazon CloudFront

Answer

NAT Gateway