ANS-C01 Network Implementation — 100 Questions

Question 1

A company is deploying a multi-tier web application across two AWS Regions. The application uses an Application Load Balancer (ALB) in each region, and traffic must be distributed to the closest healthy ALB using Route 53 latency-based routing. The application requires that clients maintain the same source IP address when the request is forwarded from the ALB to the backend targets. The backend targets are EC2 instances in private subnets. The company also needs to ensure that traffic between the ALB and targets stays within AWS. What should the company implement to meet these requirements?

Accepted Answer

Deploy an internal ALB in each region. Place targets in private subnets. Use VPC endpoints for the ALB (AWS PrivateLink) and Route 53 latency-based routing to the VPC endpoint.. Option B is correct because an internal ALB with targets in private subnets ensures traffic stays within AWS and preserves the client source IP by using VPC endpoints (AWS PrivateLink). Route 53 latency-based routing directs traffic to the closest healthy VPC endpoint, meeting the multi-region distribution requirement while maintaining source IP transparency for backend targets.

Answer

Deploy a Network Load Balancer (NLB) in each region with targets in public subnets. Use Route 53 latency-based routing to the NLB.

Answer

Deploy an Application Load Balancer (ALB) with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB.

Answer

Use AWS Global Accelerator with endpoints in each region. Attach the ALB as an endpoint and enable client IP preservation on the accelerator.

Answer

Deploy an ALB with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB. Place targets in public subnets to preserve source IP.

Question 2

A company has a Direct Connect connection with a private VIF connected to a VPC. The company wants to add a second Direct Connect connection for redundancy. They plan to use BGP AS_PATH prepending to influence traffic steering so that the primary connection is preferred for inbound traffic. The on-premises router advertises the same prefix over both connections. The company configures BGP on the primary VIF with AS_PATH prepending (prepend two AS numbers). However, after configuration, inbound traffic still uses both paths equally. What is the most likely cause?

Accepted Answer

AS_PATH prepending on the AWS side only affects outbound traffic, not inbound traffic.. B is correct because AS_PATH prepending on the AWS side (the VIF) affects the AS_PATH attribute of routes advertised by AWS to the on-premises router. For inbound traffic (traffic coming from on-premises into AWS), the on-premises router makes the routing decision based on the BGP attributes it receives from AWS. Prepending on the AWS side makes the path through the primary VIF look longer to the on-premises router, so the on-premises router should prefer the secondary VIF. However, if the on-premises router is not honoring the prepended AS_PATH (e.g., due to local preference or other policies), or if the prepending is not actually being applied to the correct direction, traffic may still be balanced. The key point is that AS_PATH prepending on the AWS side influences outbound traffic from AWS, not inbound traffic to AWS; inbound traffic steering is controlled by the on-premises router's BGP decision process.

Answer

The secondary VIF is not configured with BGP authentication.

Answer

The BGP hold time timer is set too low, causing the primary connection to flap.

Answer

The company did not set the MED attribute on the primary VIF.

Answer

The company configured the prepending on the virtual private gateway instead of the Direct Connect gateway.

Question 3

A networking engineer is troubleshooting connectivity issues between two VPCs that are peered using a VPC peering connection. The VPCs are in different AWS accounts. The engineer has verified that the route tables are correct and the security groups allow traffic. However, ICMP ping fails from an instance in VPC A to an instance in VPC B. What is a likely cause?

Accepted Answer

There is a VPN connection attached to both VPCs that creates a transitive routing issue.. Option C is correct because a VPN connection attached to both VPCs can introduce transitive routing, which is not supported by VPC peering. VPC peering does not allow transitive routing; traffic must flow directly between the peered VPCs. If both VPCs have a VPN connection to the same on-premises network or another network, the VPN can create a path that interferes with the direct peering path, causing ICMP pings to fail even when route tables and security groups are correctly configured.

Answer

The route tables in both VPCs do not have the route propagation enabled.

Answer

The VPC CIDR blocks overlap.

Answer

The security group in VPC A does not allow inbound ICMP from VPC B.

Answer

The network ACLs are not configured correctly for return traffic.

Question 4

A company has a centralized inspection VPC architecture where all traffic from spoke VPCs is routed through a Transit Gateway to a centralized VPC that hosts firewall appliances (NGFW). The company needs to inspect traffic between two instances in the same spoke VPC. What is the simplest way to achieve this?

Accepted Answer

Use AWS Transit Gateway with VPC attachments and configure route tables to force traffic between the two instances through the inspection VPC.. Option B is correct because AWS Transit Gateway can route traffic between instances in the same spoke VPC by using VPC attachments and route tables to force the traffic through the centralized inspection VPC. This is achieved by configuring the spoke VPC's route table to send inter-instance traffic to the Transit Gateway, which then forwards it to the inspection VPC for firewall inspection before returning it to the destination instance. This approach avoids the need for additional appliances or complex routing within the spoke VPC itself.

Answer

Deploy a Gateway Load Balancer (GWLB) in the spoke VPC and route traffic to it.

Answer

Enable VPC peering and use route propagation to send traffic to the inspection VPC.

Answer

Create a VPC peering connection between the two instances' VPCs.

Question 5

A company is implementing a hybrid network with AWS Direct Connect and a VPN connection as backup. They have a Direct Connect gateway (DXGW) attached to a private VIF and a virtual private gateway (VGW) attached to a VPN connection. The VPC is attached to the VGW. They want to use the Direct Connect connection for all traffic when available. The on-premises router advertises the same prefix over both connections. However, traffic from on-premises to the VPC is using the VPN connection. BGP is configured correctly on both connections. What should the company do to prefer the Direct Connect path?

Accepted Answer

Configure a lower MED (Multi-Exit Discriminator) on the Direct Connect VIF.. Option E is correct because the Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to the local AS. By setting a lower MED on the Direct Connect VIF, the on-premises router will prefer the Direct Connect path over the VPN path when both advertise the same prefix, assuming all other BGP path selection criteria are equal. This directly addresses the requirement to prefer the Direct Connect connection for all traffic.

Answer

Set a higher weight on the Direct Connect BGP session.

Answer

Set a higher local preference on the Direct Connect VIF.

Answer

Change the BGP timers on the Direct Connect VIF to have a lower hold time.

Answer

Configure AS_PATH prepending on the VPN BGP session.

Question 6

A company is designing a network for a three-tier web application on AWS. The web tier must be accessible from the internet, and the application and database tiers must be in private subnets. The company wants to use a single AWS Region and ensure high availability. Which TWO configurations should be implemented? (Choose two.)

Accepted Answer

Place an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones.. Option A is correct because an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones (AZs) provides both internet access to the web tier and high availability. The ALB distributes incoming HTTP/HTTPS traffic to web instances in private subnets, and deploying across two AZs ensures fault tolerance if one AZ fails.

Answer

Use a stateful network ACL for the web tier subnets to simplify security rules.

Answer

Deploy a NAT Gateway in a single Availability Zone for outbound traffic from private subnets.

Answer

Create the VPC with a single Availability Zone to simplify management.

Question 7

A company is migrating a legacy application to AWS. The application requires multicast communication between EC2 instances in the same VPC. Which THREE options can support this requirement? (Choose three.)

Accepted Answer

Use AWS Transit Gateway with a multicast domain.. AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows EC2 instances in different subnets and VPCs attached to the transit gateway to send and receive multicast traffic. This is a native AWS capability that does not require third-party appliances or workarounds, making it a valid option for the requirement.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain to the VPC.

Answer

Create a VPC peering connection and enable multicast across the peered VPCs.

Question 8

A company is deploying a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in private subnets can access the internet for software updates while remaining unreachable from the internet. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route to the NAT Gateway in the private subnet route tables.. Option B is correct because a NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP, allowing internet access while preventing any unsolicited inbound connections from the internet.

Answer

Attach an internet gateway to the private subnets and configure route tables.

Answer

Use a transit gateway to connect the VPC to the internet.

Answer

Establish a VPN connection to an on-premises network and route traffic through it.

Question 9

A company has deployed a web application across multiple AWS Regions using Application Load Balancers (ALBs) and EC2 instances. They want to use AWS Global Accelerator to improve performance and provide a fixed entry point. The Global Accelerator is configured with endpoints pointing to the ALBs. However, users are experiencing intermittent failures. What is the most likely cause?

Accepted Answer

Client IP address preservation is enabled on the Global Accelerator for cross-Region endpoints.. When client IP address preservation is enabled on Global Accelerator for cross-Region endpoints, the accelerator preserves the original client IP address in the packets sent to the Application Load Balancers. However, ALBs are layer-7 load balancers that require traffic to originate from the Global Accelerator's static IP addresses, not the client's IP, for proper routing and health check responses. This mismatch causes the ALBs to reject or mishandle traffic, leading to intermittent failures.

Answer

Global Accelerator does not support multiple endpoints in different Regions.

Answer

The ALBs are not configured with health checks.

Answer

The Global Accelerator is not configured for IPv6 traffic.

Question 10

A network engineer is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) connected via a VPC peering connection. Both VPCs have CIDR blocks: VPC-A = 10.0.0.0/16, VPC-B = 10.1.0.0/16. An EC2 instance in VPC-A (10.0.1.10) cannot ping an EC2 instance in VPC-B (10.1.1.10). Security groups and NACLs allow all traffic. The route tables are configured as follows: In VPC-A, a route to 10.1.0.0/16 via the peering connection. In VPC-B, a route to 10.0.0.0/16 via the peering connection. What is the most likely cause?

Accepted Answer

There is an intermediate VPC or on-premises network that routes traffic incorrectly due to the lack of transitive routing.. VPC peering connections do not support transitive routing. Even though the route tables in VPC-A and VPC-B correctly point to each other via the peering connection, if there is an intermediate VPC or on-premises network involved in the path, traffic cannot be forwarded through that intermediate point. The ping fails because the peering connection is a direct, one-to-one link and does not allow routing through a third network.

Answer

The VPCs have overlapping CIDR blocks.

Answer

Security groups are blocking ICMP traffic.

Answer

The route tables are missing routes to the peering connection.

Question 11

A company is setting up a Direct Connect connection to connect its on-premises data center to AWS. The connection is established, and a private virtual interface (VIF) is configured. The on-premises router can ping the VIF's Amazon side IP address, but cannot ping an EC2 instance in the VPC. The VPC has a virtual private gateway attached, and the route tables are correctly configured. What should the company check next?

Accepted Answer

Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.. The on-premises router can ping the VIF's Amazon side IP, confirming that Layer 2 and Layer 3 connectivity over the Direct Connect link is working, and BGP is established. However, the inability to ping the EC2 instance indicates that return traffic from the VPC is not reaching the on-premises network. For return traffic to be routed correctly, the on-premises router must advertise the VPC CIDR (or a specific prefix) to the Direct Connect router via BGP; otherwise, the AWS side will not forward traffic destined for the on-premises network over the VIF.

Answer

Check that the NACLs on the EC2 instance's subnet allow inbound ICMP.

Answer

Confirm that the private VIF is associated with the correct virtual private gateway.

Answer

Ensure that BGP is established and receiving routes.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16 and has enabled VPC Flow Logs to capture all traffic. The logs show that an EC2 instance (10.0.1.10) is sending outbound traffic to an external IP (203.0.113.50) on port 443, but the traffic is being rejected. The instance's security group allows outbound HTTPS to 0.0.0.0/0, and the subnet's NACL allows outbound traffic on port 443. The VPC has an internet gateway attached, and the route table directs 0.0.0.0/0 to the internet gateway. What is the most likely cause of the rejection?

Accepted Answer

The NACL inbound rules are blocking the return traffic.. The outbound traffic from the EC2 instance is allowed by the security group and NACL outbound rules, but the return traffic (responses from 203.0.113.50:443 back to 10.0.1.10) must also be permitted by the subnet's NACL inbound rules. Since the NACL is stateless, it requires explicit inbound rules for ephemeral ports (typically 1024-65535) to allow the return traffic. If those inbound rules are missing, the return packets are dropped, causing the outbound traffic to appear as rejected in VPC Flow Logs.

Answer

The security group does not allow inbound HTTPS traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The route table does not have a route to the internet gateway.

Question 13

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect and a VPN connection as a backup. The on-premises network uses BGP to advertise routes to AWS. Which of the following are best practices for this setup? (Choose TWO.)

Accepted Answer

Use different BGP ASNs for the Direct Connect and VPN connections.. Option B is correct because using different BGP ASNs for the Direct Connect and VPN connections prevents BGP from treating the two connections as a single eBGP session, which would cause routing loops or suboptimal path selection. This separation allows AWS to distinguish between the two paths and apply independent routing policies. Option E is correct because configuring BGP attributes (such as AS path prepending or MED) on the Direct Connect path ensures it is preferred over the VPN backup, aligning with the design goal of using Direct Connect as the primary link.

Answer

Advertise the same routes over both connections with identical BGP attributes.

Answer

Use the VPN connection as the primary path and Direct Connect as the backup.

Answer

Use the same BGP ASN for both the Direct Connect and VPN connections.

Question 14

A company has a VPC with multiple subnets spanning three Availability Zones. They have deployed an Application Load Balancer (ALB) in the VPC and need to ensure high availability and scalability for a web application. Which of the following are design considerations for implementing the ALB in this environment? (Choose THREE.)

Accepted Answer

Enable the ALB in at least two Availability Zones to provide high availability.. Option A is correct because AWS requires an Application Load Balancer to be enabled in at least two Availability Zones to achieve high availability. If one AZ fails, the ALB can continue routing traffic to healthy targets in the remaining AZs, ensuring fault tolerance and compliance with the ALB's regional service model.

Answer

Configure the ALB to use subnets that span multiple Availability Zones.

Answer

Use VPC peering to connect the ALB to subnets in other VPCs.

Question 15

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

Accepted Answer

The application layer is failing to establish a proper connection.. The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Answer

The security groups are blocking the traffic.

Answer

The route tables are incorrectly configured, causing packet loss.

Answer

The flow logs are misconfigured and not capturing all traffic.

Question 16

A company has set up a transit gateway with attachments to VPC-A and VPC-B. The transit gateway route table shows routes to both VPCs and a blackhole for 0.0.0.0/0. VPC-A's public subnet route table sends 10.1.0.0/16 traffic to the transit gateway. However, an EC2 instance in VPC-A's public subnet cannot reach an instance in VPC-B. What is the most likely cause?

Accepted Answer

VPC-B's route table does not have a route to VPC-A's CIDR via the transit gateway.. Option A is correct because for traffic to flow from VPC-A to VPC-B via a transit gateway, both VPCs must have routes in their route tables pointing to the transit gateway for the other VPC's CIDR. Since VPC-A's route table sends 10.1.0.0/16 (VPC-B's CIDR) to the transit gateway, but VPC-B's route table lacks a return route to VPC-A's CIDR via the transit gateway, the return traffic from VPC-B is dropped, causing connectivity failure.

Answer

VPC-A's route table does not have a route to the transit gateway.

Answer

The transit gateway route table does not have a route for 10.0.0.0/16.

Answer

The blackhole route in the transit gateway is blocking traffic between VPCs.

Question 17

A company is deploying a new VPC with both public and private subnets. The public subnet hosts an internet-facing Application Load Balancer (ALB), and the private subnet hosts EC2 instances running a web application. The EC2 instances need to download updates from the internet, but they must not be directly accessible from the internet. Which combination of steps should a network engineer implement to meet these requirements?

Accepted Answer

Create a NAT Gateway in a public subnet, and add a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing any unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table directs all outbound internet traffic through the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP. This meets the requirement of internet access for downloads without direct internet accessibility.

Answer

Launch a proxy server in the public subnet and configure the private instances to use it for outbound traffic.

Answer

Set up a VPN connection to an on-premises network and route all internet traffic through the VPN.

Answer

Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet's route table.

Question 18

A company has a Direct Connect connection with a private VIF connected to a VPC. The network engineer notices that traffic from on-premises to the VPC is being dropped intermittently. The on-premises router shows BGP session is up, but the VPC route table does not have the on-premises prefix. What is the most likely cause?

Accepted Answer

The on-premises router is advertising a route that is more specific than the allowed prefix list on the Direct Connect gateway.. Option C is correct because the Direct Connect gateway (DXGW) uses allowed prefix lists to control which routes are accepted from the on-premises router via BGP. If the on-premises router advertises a prefix that is more specific (e.g., /28) than the allowed prefix list (e.g., /24), the DXGW will reject the route, causing the VPC route table to lack the on-premises prefix. The BGP session remains up because the session itself is not affected, but the specific route is not installed.

Answer

The MTU on the on-premises router is set too high.

Answer

The BGP session is flapping due to high latency.

Answer

The on-premises router is using AS_PATH prepending.

Question 19

A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?

Accepted Answer

Use TLS or IPsec at the application layer between instances.. Option B is correct because VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.

Answer

Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.

Answer

Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.

Answer

Enable encryption on the VPC peering connection.

Question 20

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

Accepted Answer

The security group for the EC2 instance does not allow inbound HTTPS traffic.. Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed. Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.

Answer

The network ACL in the VPC is blocking outbound traffic.

Answer

The BGP session is in the 'Idle' state.

Answer

The route table associated with the virtual private gateway does not have a route to the on-premises network.