ANS-C01 Network Implementation — 30 Questions

Question 1

A company has a Direct Connect connection with a private VIF connected to a VPC. The company wants to add a second Direct Connect connection for redundancy. They plan to use BGP AS_PATH prepending to influence traffic steering so that the primary connection is preferred for inbound traffic. The on-premises router advertises the same prefix over both connections. The company configures BGP on the primary VIF with AS_PATH prepending (prepend two AS numbers). However, after configuration, inbound traffic still uses both paths equally. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AS_PATH prepending on the AWS side only affects outbound traffic, not inbound traffic.. AS_PATH prepending on the AWS side (the VIF) affects the AS_PATH attribute of routes that AWS advertises to the on-premises router. However, these routes are used by the on-premises router for outbound traffic from the on-premises network to AWS, not for inbound traffic from AWS to on-prem. Inbound traffic (from AWS to on-prem) is controlled by the BGP routes that AWS receives from the on-premises router, which are not affected by the prepending on the AWS side. Therefore, the prepending does not influence inbound traffic steering, and both paths are still used equally for inbound traffic.

Answer

The secondary VIF is not configured with BGP authentication.

Answer

The BGP hold time timer is set too low, causing the primary connection to flap.

Answer

The company did not set the MED attribute on the primary VIF.

Answer

The company configured the prepending on the virtual private gateway instead of the Direct Connect gateway.

Question 2

A company is migrating a legacy application to AWS. The application requires multicast communication between EC2 instances in the same VPC. Which THREE options can support this requirement? (Choose three.)

Accepted Answer

Use AWS Transit Gateway with a multicast domain.. AWS Transit Gateway supports multicast through dedicated multicast domains, allowing EC2 instances in attached subnets and VPCs to participate in multicast groups. This is a native AWS capability. Additionally, deploying a third-party virtual appliance that supports multicast routing in the VPC enables multicast traffic forwarding. However, AWS VPCs do not natively support multicast traffic, even within a single subnet, so option D is not valid. Direct Connect and VPC peering also do not support multicast due to AWS network restrictions.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain to the VPC.

Answer

Use a VPC with a single subnet and enable multicast on the subnet.

Answer

Create a VPC peering connection and enable multicast across the peered VPCs.

Question 3

A network engineer is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) connected via a VPC peering connection. Both VPCs have CIDR blocks: VPC-A = 10.0.0.0/16, VPC-B = 10.1.0.0/16. An EC2 instance in VPC-A (10.0.1.10) cannot ping an EC2 instance in VPC-B (10.1.1.10). Security groups and NACLs allow all traffic. The route tables are configured as follows: In VPC-A, a route to 10.1.0.0/16 via the peering connection. In VPC-B, a route to 10.0.0.0/16 via the peering connection. What is the most likely cause?

Accepted Answer

The route tables are missing routes to the peering connection.. The most likely cause is that the route tables containing the peering routes are not associated with the subnets where the EC2 instances are located. In AWS, each subnet must have an associated route table. If the main route table has the peering routes but the subnet's custom route table does not, the traffic will not be routed correctly. Since security groups and NACLs allow all traffic and the CIDRs are not overlapping, the only remaining possibility is a route table association issue.

Answer

The VPCs have overlapping CIDR blocks.

Answer

Security groups are blocking ICMP traffic.

Answer

There is an intermediate VPC or on-premises network that routes traffic incorrectly due to the lack of transitive routing.

Question 4

A company is deploying a multi-tier web application in a VPC with public and private subnets. The web servers in the public subnets must be able to initiate outbound connections to the internet for software updates, but must not be directly accessible from the internet. Which configuration meets these requirements?

Accepted Answer

Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the public subnet's route table.. For instances in public subnets, outbound internet access is provided by attaching an Internet Gateway (IGW) to the VPC and adding a default route to the IGW in the public subnet's route table. To prevent direct inbound access, you use security groups or network ACLs to block incoming traffic. Option C correctly describes this configuration. Option D is for private subnets, where instances need a NAT Gateway for outbound access and must not have public IPs, which contradicts the stem stating the web servers are in public subnets. Options A and B are incorrect because NAT instances and ALBs are not used for providing outbound internet access from public subnets directly.

Answer

Deploy a NAT instance in a private subnet and add a default route to the NAT instance in the private subnet's route table.

Answer

Deploy an Application Load Balancer (ALB) in a public subnet and route outbound traffic through the ALB.

Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet's route table.

Question 5

A company has a Direct Connect connection with a private VIF connected to a VPC. The company wants to add a second Direct Connect connection for redundancy. They plan to use BGP AS_PATH prepending to influence traffic steering so that the primary connection is preferred for inbound traffic. The on-premises router advertises the same prefix over both connections. The company configures BGP on the primary VIF with AS_PATH prepending (prepend two AS numbers). However, after configuration, inbound traffic still uses both paths equally. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delete the VPC peering connection and use a VPN instead.. The issue is overlapping CIDR blocks (both VPCs use 10.0.0.0/16). VPC peering requires non-overlapping CIDRs. The Direct Connect route for 10.0.0.0/16 causes traffic destined to the new VPC to be sent to the old VPC. Deleting the peering and using a VPN to connect on-premises to the new VPC resolves this because VPNs can handle overlapping CIDRs with separate routing configurations. Option A is correct. Option B is not feasible because the new VPC is not directly connected to Direct Connect; the on-premises router cannot advertise a more specific prefix for the new VPC over the existing Direct Connect. Option C is incorrect because VPC peering does not propagate routes to Direct Connect virtual interfaces. Option D is incorrect because disabling route propagation and adding static routes in the VPC does not change the on-premises BGP routing.

Answer

Update the on-premises router to advertise a more specific prefix for the new VPC over Direct Connect, such as 10.0.1.0/24, and ensure the new VPC's route table has a route to the on-premises network.

Answer

Configure the VPC peering connection to propagate routes to the Direct Connect virtual interface.

Answer

Disable route propagation on the VPC route tables and add static routes.

Question 6

A company has a Direct Connect connection with a private VIF connected to a VPC. The company wants to add a second Direct Connect connection for redundancy. They plan to use BGP AS_PATH prepending to influence traffic steering so that the primary connection is preferred for inbound traffic. The on-premises router advertises the same prefix over both connections. The company configures BGP on the primary VIF with AS_PATH prepending (prepend two AS numbers). However, after configuration, inbound traffic still uses both paths equally. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prepend the AS path on the Direct Connect BGP advertisement.. Prepending the AS path on the Direct Connect BGP advertisement makes the Direct Connect path less preferred on the on-premises router due to a longer AS path length, steering traffic to the VPN. Option E is correct because setting a lower MED value on the VPN route advertisement makes it more preferred over Direct Connect when all other BGP path selection criteria are equal. Option B is incorrect because it suggests advertising the specific prefix from the VPN to the VPC, whereas to influence traffic from on-premises, the VPC must advertise the specific prefix to on-premises via the VPN, not the other way around. Options C and D are incorrect: disabling route propagation on the VPN route table would prevent the VPC from learning routes via VPN, and using a BGP community as no-export on Direct Connect does not affect on-premises routing decisions.

Answer

Advertise the specific prefix 10.0.1.0/24 from the VPN connection to the VPC.

Answer

Disable route propagation on the VPN connection's route table.

Answer

Use a BGP community to tag the Direct Connect route as no-export.

Question 7

An EC2 instance with the attached IAM role is unable to download objects from an S3 bucket. The instance is in a VPC with CIDR 10.0.0.0/16. The S3 bucket policy allows access from the VPC. What is the most likely reason for the failure?

Accepted Answer

The IAM role does not have permission to list the bucket, which is required for the download operation.. The most likely reason is that the IAM role lacks the s3:ListBucket permission, which is often required by AWS CLI and SDK operations when downloading objects, even if the exact object key is known. For example, the `aws s3 cp` command performs a list operation to retrieve object metadata. Without s3:ListBucket, the download fails. Although s3:GetObject alone is technically sufficient for a direct API call, typical tools require both permissions. Option D correctly identifies this common oversight.

Answer

The IAM policy does not include an Allow for the s3:GetObject action.

Answer

The condition aws:SourceIp does not match the source IP of the request because the traffic is routed through a VPC Gateway Endpoint.

Answer

The S3 bucket policy has an explicit deny for the IAM role.

Question 8

A company has a VPC with multiple subnets. They want to monitor all network traffic entering and leaving the VPC for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for all network interfaces in a VPC, including subnets, enabling security analysis of all traffic entering and leaving the VPC. This is the correct service because it provides network-level visibility into traffic flows without requiring agents or changes to routing.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 9

A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An Application Load Balancer (ALB) is deployed in the public subnet, and EC2 instances are in the private subnet. The ALB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the ALB's security group on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24) and allows outbound ephemeral ports. However, the ALB health checks are failing with 503 errors. The network engineer checks the ALB logs and sees that TCP connections are established but HTTP requests are timing out. What is the most likely cause?

Accepted Answer

The ALB health check is configured to use HTTPS but the target only listens on HTTP.. The ALB health check is configured to use HTTPS, but the target only listens on HTTP. This mismatch causes the health check to fail because the target cannot respond to HTTPS requests, leading to a 503 error. The network ACL and security group configurations appear correct: inbound traffic from the public subnet CIDR is allowed, outbound ephemeral ports are allowed, and security groups are stateful. Option D is incorrect because network ACLs cannot reference security groups. Option A is unlikely because security groups are stateful. Option C would cause complete connectivity failure, not just health check issues.

Answer

The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.

Answer

The security group for the ALB does not allow outbound traffic to the targets.

Answer

The route table for the private subnet does not have a route to the ALB's subnet.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (443) traffic. The route table for the private subnet has a default route pointing to a NAT Gateway in the public subnet. Which additional configuration is required to ensure the NAT Gateway can route the traffic?

Accepted Answer

Assign an Elastic IP address to the NAT Gateway.. A NAT Gateway must have an Elastic IP address assigned to it to communicate with the internet. Without an Elastic IP, the NAT Gateway cannot send traffic to the internet or receive return traffic. The private subnet route table correctly points to the NAT Gateway, and the security group on the instance allows outbound HTTPS. The missing configuration is the Elastic IP address, which is required for the NAT Gateway to function.

Answer

Configure the security group of the NAT Gateway to allow inbound traffic from the private subnet.

Answer

Add a route in the private subnet route table to the NAT Gateway's private IP.

Answer

Add a route in the public subnet route table to the Internet Gateway.

Question 11

A company has a multi-tier application deployed in a VPC. The web tier consists of an internet-facing Application Load Balancer (ALB) in public subnets, and EC2 instances in private subnets. The application tier runs on EC2 instances in separate private subnets, and the database tier uses an Amazon RDS for MySQL instance in private subnets. The application tier needs to connect to the database on port 3306. The security group for the RDS instance (sg-database) has an inbound rule allowing TCP 3306 from the security group of the application tier (sg-app). The application tier instances can connect to the database, but the web tier instances cannot. The web tier instances should not have direct database access. What is the most likely reason for the web tier's inability to connect to the database?

Accepted Answer

The security group of the RDS instance does not have an inbound rule allowing traffic from the web tier's security group.. The security group for the RDS instance (sg-database) only allows inbound traffic on port 3306 from the application tier's security group (sg-app). The web tier instances are in a different security group, so traffic from the web tier is implicitly denied. Option A is incorrect because network ACLs are stateless; if they were blocking web tier traffic, they would also affect the application tier, which can connect successfully. Option C is incorrect because the RDS instance is in private subnets and does not need a NAT Gateway; NAT Gateways are for outbound internet access. Option D is incorrect because route tables do not affect security group logic; routing only determines network path, not whether traffic is permitted by security groups.

Answer

The network ACL for the database subnet is blocking inbound traffic from the web tier subnets.

Answer

The RDS instance is in a public subnet and requires a NAT Gateway for communication.

Answer

The route table for the web tier subnets does not have a route to the database subnets.

Question 12

A large enterprise uses AWS Organizations with multiple accounts. The central networking account hosts a Transit Gateway with attachments from VPCs in various accounts. The enterprise uses AWS Resource Access Manager (RAM) to share the Transit Gateway with other accounts. A network engineer in a spoke account creates a VPC and attaches it to the shared Transit Gateway. The attachment shows 'available' state. However, traffic from the spoke VPC to other attached VPCs fails. The spoke VPC route table has a route to the Transit Gateway for 0.0.0.0/0. The Transit Gateway route table has routes for the spoke VPC CIDR and other VPC CIDRs. What is the most likely cause?

Accepted Answer

The Transit Gateway owner has not accepted the VPC attachment. When a Transit Gateway is shared via AWS Resource Access Manager (RAM), the owner account must accept the VPC attachment request from the spoke account. Even though the attachment state shows 'available', it might not be fully accepted and associated with the Transit Gateway route table. If the owner has not accepted, the attachment will not be associated with a route table, causing traffic failure. Option B is incorrect because the spoke VPC route table has a default route to the Transit Gateway, so traffic is directed there. Option C is incorrect because the Transit Gateway route table already contains routes for the VPC CIDRs; propagation is not needed for static routes. Option A is incorrect because IAM roles are not required for VPC attachment to a shared Transit Gateway. Therefore, the most likely cause is that the owner has not accepted the attachment, making option D correct.

Answer

The spoke account does not have an IAM role to access the Transit Gateway

Answer

The spoke VPC route table does not have routes to the other VPC CIDRs

Answer

The Transit Gateway route table does not propagate routes from the spoke VPC attachment

Question 13

A company has a VPC with public and private subnets across two Availability Zones. They have a Network Load Balancer (NLB) in the public subnets. The NLB has a target group of EC2 instances in the private subnets. The NLB is configured with TLS listeners and uses a certificate from AWS Certificate Manager (ACM). Clients connect to the NLB over the internet. Some clients report connection timeouts. The NLB access logs show that the connections are established but then hang. The target instances are healthy. The security groups for the instances allow inbound TCP/443 from the NLB's private IPs. What is the most likely cause?

Accepted Answer

The target group is configured with protocol TLS instead of TCP. The NLB terminates TLS at the listener and forwards traffic to targets using the target group's protocol. If the target group is configured with TLS protocol, the NLB attempts to establish a TLS session with the EC2 instances, which likely causes the handshake to fail or hang because the instances do not expect TLS or have a certificate mismatch. The correct configuration is to use TCP protocol on the target group. Option B is incorrect because cross-zone load balancing disabled would cause uneven distribution but not hanging connections. Option C is incorrect because NLB security groups do not control client traffic (NLBs do not have security groups for inbound traffic from clients); the instance security group already allows TCP/443 from NLB private IPs. Option D is incorrect because a low idle timeout would close idle connections, not cause them to hang.

Answer

Cross-zone load balancing is disabled, causing uneven distribution

Answer

The security group for the NLB is blocking traffic from clients

Answer

The NLB idle timeout is set too low

Question 14

A company has a VPC with IPv4 and IPv6 CIDRs. They have a public subnet with an internet gateway and a private subnet with a NAT gateway. EC2 instances in the private subnet need to download updates from the internet. The instances have IPv6 addresses. The private subnet route table has a default route (::/0) pointing to an egress-only internet gateway. However, instances cannot reach IPv6 internet destinations. The egress-only internet gateway is attached to the VPC and in 'available' state. What is the most likely cause?

Accepted Answer

The security group for the instances is blocking outbound IPv6 traffic. The egress-only internet gateway is correctly configured (attached to VPC and route rule ::/0 exists). The instances have IPv6 addresses as stated. The most likely remaining cause is that the security group attached to the instances has outbound rules blocking IPv6 traffic. By default, security groups allow all outbound traffic, but if a custom rule was applied, it could restrict IPv6 traffic. Option B is irrelevant because NAT gateway is for IPv4. Option C contradicts the stem. Option D contradicts the stem.

Answer

The NAT gateway does not support IPv6

Answer

The instances do not have an IPv6 address assigned

Answer

The egress-only internet gateway is not attached to the VPC

Question 15

A company has an AWS Transit Gateway with multiple VPC attachments. They want to centralize outbound internet traffic through a single VPC that has a NAT gateway and an internet gateway. All other VPCs should route internet-bound traffic through this central VPC. What configuration is required?

Accepted Answer

Add a route in the transit gateway route table pointing 0.0.0.0/0 to the NAT gateway in the central VPC. To centralize outbound internet traffic through a single VPC using AWS Transit Gateway, you must add a route in the transit gateway route table pointing 0.0.0.0/0 to the central VPC's attachment. Although the option states 'to the NAT gateway', the intended meaning is that traffic is routed to the central VPC where the NAT gateway resides. The central VPC's subnet route tables direct traffic to the NAT gateway, which then uses the internet gateway for egress. This ensures all internet-bound traffic from other VPCs is sent to the central VPC for centralized egress. Option A is incorrect because a virtual private gateway is used for VPN or Direct Connect connections, not for centralizing internet traffic through a VPC. Options B and C do not achieve the required centralized routing.

Answer

Attach a virtual private gateway to the central VPC and add a static route in the transit gateway route table pointing 0.0.0.0/0 to the virtual private gateway

Answer

Add a default route in the central VPC's subnet route tables pointing to the internet gateway

Answer

Create a route table in the central VPC and associate it with the transit gateway attachment

Question 16

Which THREE actions are required to enable an EC2 instance in a private subnet to download software updates from the internet? (Select THREE.)

Accepted Answer

Create a NAT Gateway in a public subnet. To enable an EC2 instance in a private subnet to download software updates from the internet, you need a NAT Gateway in a public subnet (Option C) which requires an Internet Gateway attached to the VPC (Option E) to route traffic to the internet. Additionally, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway (Option D). While a NAT Gateway does require an Elastic IP, this is automatically allocated and associated during creation, so it is not a separate action.

Answer

Allocate an Elastic IP and associate it with the NAT Gateway

Answer

Configure the security group to allow outbound traffic to 0.0.0.0/0

Question 17

A network engineer is troubleshooting connectivity between two VPCs that are peered. The route tables are correct, and security groups allow traffic. However, ICMP ping fails. What is the most likely cause?

Accepted Answer

The security groups are blocking ICMP. VPC peering does support ICMP traffic. The most common reason for ICMP ping failure despite correct route tables and security groups that allow traffic is that the security groups are not explicitly allowing ICMP. Security groups default to deny all inbound traffic, and a rule allowing all TCP traffic does not include ICMP. Therefore, the security groups must have an inbound ICMP rule for the ping to succeed.

Answer

The route tables are not propagated

Answer

VPC peering does not support ICMP

Answer

The VPCs are in different regions

Question 18

A company has multiple VPCs in the same AWS region that need to communicate with each other and with an on-premises data center. The company currently uses VPC peering connections between each VPC pair, which has become difficult to manage as the number of VPCs grows. The company wants to simplify the network architecture and implement a hub-and-spoke model using AWS Transit Gateway. The on-premises data center is connected to AWS via a Direct Connect connection with a private VIF. The company has already created a Transit Gateway and attached all VPCs to it. They have also created a Direct Connect gateway and associated it with the Transit Gateway. The on-premises router is advertising the on-premises CIDR (10.0.0.0/8) over BGP. However, after the migration, the VPCs cannot communicate with each other, and the on-premises network cannot reach the VPCs. The VPC route tables have been updated to route all traffic to the Transit Gateway. The Transit Gateway route table has propagation enabled for all VPC attachments and the Direct Connect gateway attachment. What is the most likely missing configuration?

Accepted Answer

The VPC route tables do not have routes for the other VPCs' CIDRs and the on-premises CIDR pointing to the Transit Gateway.. Despite propagation being enabled on the Transit Gateway route table, VPC route tables must have explicit routes for each destination CIDR (other VPCs and on-premises) pointing to the Transit Gateway. Without those routes, traffic will not be forwarded to the Transit Gateway for inter-VPC or on-premises communication. The problem statement confirms VPC route tables point all traffic to the Transit Gateway, but that usually means a default route (0.0.0.0/0) or a summary route, not specific routes for each remote CIDR. The most likely missing configuration is that the VPC route tables lack explicit routes for the other VPCs' CIDRs and the on-premises CIDR. Option C correctly identifies this. Options A, B, and D are incorrect because the Direct Connect gateway is associated, propagation is enabled, and the on-premises router is advertising the CIDR.

Answer

The Direct Connect gateway is not associated with the Transit Gateway.

Answer

The Transit Gateway route table does not have propagation enabled for the VPC attachments.

Answer

The on-premises router is not advertising the on-premises CIDR over BGP.

Question 19

A company is deploying a multi-tier web application across two AWS Regions. The application uses an Application Load Balancer (ALB) in each region, and traffic must be distributed to the closest healthy ALB using Route 53 latency-based routing. The application requires that clients maintain the same source IP address when the request is forwarded from the ALB to the backend targets. The backend targets are EC2 instances in private subnets. The company also needs to ensure that traffic between the ALB and targets stays within AWS. What should the company implement to meet these requirements?

Accepted Answer

Deploy a Network Load Balancer (NLB) in each region with targets in private subnets. Use Route 53 latency-based routing to the NLB.. Network Load Balancer (NLB) preserves the client source IP by default, meeting the requirement for source IP preservation. Targets must be placed in private subnets as per the given requirements, and traffic between the NLB and targets remains within the VPC, satisfying the condition that traffic stays within AWS. With an internet-facing NLB, Route 53 latency-based routing can be used to distribute traffic to the closest healthy NLB across regions. Options B, C, D, and E are incorrect: B incorrectly relies on an internal ALB with PrivateLink, which does not support Route 53 latency routing and does not preserve source IP; C and E use ALB, which does not preserve source IP; D uses Global Accelerator, which does not use Route 53 and does not preserve source IP when ALB is an endpoint.

Answer

Deploy an internal ALB in each region. Place targets in private subnets. Use VPC endpoints for the ALB (AWS PrivateLink) and Route 53 latency-based routing to the VPC endpoint.

Answer

Deploy an Application Load Balancer (ALB) with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB.

Answer

Use AWS Global Accelerator with endpoints in each region. Attach the ALB as an endpoint and enable client IP preservation on the accelerator.

Answer

Deploy an ALB with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB. Place targets in public subnets to preserve source IP.

Question 20

A networking engineer is troubleshooting connectivity issues between two VPCs that are peered using a VPC peering connection. The VPCs are in different AWS accounts. The engineer has verified that the route tables are correct and the security groups allow traffic. However, ICMP ping fails from an instance in VPC A to an instance in VPC B. What is a likely cause?

Accepted Answer

There is a VPN connection attached to both VPCs that creates a transitive routing issue.. A VPN connection attached to both VPCs can introduce transitive routing, which is not supported by VPC peering. VPC peering does not allow transitive routing; traffic must flow directly between the peered VPCs. If both VPCs have a VPN connection to the same on-premises network or another network, the VPN can create a path that interferes with the direct peering path, causing ICMP pings to fail even when route tables and security groups are correctly configured.

Answer

The route tables in both VPCs do not have the route propagation enabled.

Answer

The VPC CIDR blocks overlap.

Answer

The security group in VPC A does not allow inbound ICMP from VPC B.

Answer

The network ACLs are not configured correctly for return traffic.