ANS-C01 Network Implementation Practice Test 10 — 15 Questions

Question 1

A company is using AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The VPC has a CIDR 10.0.0.0/16. The on-premises network uses 192.168.0.0/16. The company wants to enable communication between on-premises and the VPC, and also allow the VPC to access the internet via an internet gateway. Which TWO of the following configurations are necessary?

Accepted Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the internet gateway.. Option A is correct because the VPC route table must have a route for 192.168.0.0/16 pointing to the virtual private gateway (VGW) to route traffic to on-premises. Option D is correct because the VPC route table must have a route for 0.0.0.0/0 pointing to the internet gateway for outbound internet access. Option B is not necessary because the VGW is automatically attached. Option C is not necessary because the on-premises router must have routes to the VPC CIDR, not the internet gateway. Option E is not necessary because the VGW already handles routing.

Answer

A route in the on-premises router for the VPC CIDR (10.0.0.0/16) pointing to the AWS Direct Connect router.

Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway.

Answer

A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the internet gateway.

Question 2

A company is designing a VPC with multiple subnets. The company wants to use VPC Flow Logs to monitor network traffic. Which TWO of the following are valid destinations for VPC Flow Logs?

Accepted Answer

Amazon CloudWatch Logs. Option B and D are correct. VPC Flow Logs can be published to Amazon S3 or Amazon CloudWatch Logs. Option A is wrong because Kinesis Data Firehose is not a direct destination; it can be used via a subscription filter, but not directly. Option C is wrong because an SQS queue is not a supported destination. Option E is wrong because an RDS database is not a destination.

Answer

Amazon RDS

Answer

Amazon SQS

Answer

Amazon Kinesis Data Firehose

Question 3

A company is deploying a VPC with public and private subnets. The private subnets need outbound internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. Option C is correct because a NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Options A and B are for VPN and Direct Connect, which are private connections. Option D is for inbound traffic management.

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 4

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They want to route users to the nearest healthy ALB using latency-based routing. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs user traffic to the AWS region with the lowest network latency for the end user, based on latency measurements between the user and each region's resources. This matches the requirement to route users to the nearest healthy ALB, as Route 53 can evaluate health checks on the ALBs and only route to healthy endpoints.

Answer

Amazon CloudWatch

Answer

VPC Traffic Mirroring

Answer

AWS Global Accelerator

Question 5

A network engineer is troubleshooting connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS accounts and regions. The engineer can ping the private IP of an instance in the peered VPC from one side, but not from the other. What is the most likely cause?

Accepted Answer

Route tables in one VPC do not have a route to the peered VPC CIDR. Option D is correct because VPC peering connections must have matching route tables in both VPCs to allow bidirectional traffic. The ability to ping from one side but not the other indicates a missing route in one VPC's route table. Options A and B are irrelevant because the peering connection exists and works in one direction. Option C is for security groups, which would affect both directions equally.

Answer

The security group in the peered VPC is blocking ICMP traffic

Answer

The VPC CIDR blocks overlap

Answer

The VPC peering connection is in a 'pending-acceptance' state

Question 6

A company wants to deploy a web application on EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions (session affinity). What configuration is required on the ALB?

Accepted Answer

Enable stickiness on the target group and specify a cookie duration. Option B is correct because enabling stickiness on the ALB target group with a cookie duration ensures requests from the same client are sent to the same target. Option A is for client IP preservation. Option C is for health checks. Option D is for routing.

Answer

Use path-based routing

Answer

Configure health checks on the target group

Answer

Enable proxy protocol v2

Question 7

A company is migrating a legacy application that requires static IP addresses for its clients' firewall whitelisting. The application will be hosted on EC2 instances behind a Network Load Balancer (NLB) in a private subnet. Which approach should the company use to provide static IP addresses for outbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet with an Elastic IP. Option D is correct because a NAT Gateway in a public subnet with an Elastic IP provides static IPs for outbound traffic from private instances. Option A is for inbound traffic. Option B is for internet-facing NLB. Option C would not provide static IPs.

Answer

Assign Elastic IPs to the EC2 instances

Answer

Use an internet-facing NLB with Elastic IPs

Answer

Use a VPC endpoint for the application

Question 8

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

Accepted Answer

Use a Direct Connect Gateway and attach the VPCs. Option B is correct because a Direct Connect Gateway allows a single private VIF to connect to multiple VPCs in the same region. Option A is for hybrid connectivity but not for multi-VPC. Option C is for inter-VPC routing. Option D is for additional VIFs.

Answer

Provision additional private VIFs for each VPC

Answer

Use VPC peering between the VPCs

Answer

Use a Transit VPC with VPN connections

Question 9

A company wants to restrict outbound traffic from a VPC to only allow HTTPS traffic to a specific list of domains. Which AWS service can be used to achieve this?

Accepted Answer

AWS Network Firewall. Option D is correct because Network Firewall can inspect and filter outbound traffic based on domain names. Option A is for inbound traffic distribution. Option B is for instance-level filtering. Option C is for domain registration.

Answer

Security groups

Answer

Amazon Route 53

Answer

Application Load Balancer

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be implemented?

Accepted Answer

Create a Gateway VPC Endpoint for S3. Option C is correct because a Gateway VPC Endpoint for S3 provides private connectivity to S3 without internet access, reducing costs. Option A would use internet. Option B is for other AWS services. Option D is for dedicated connectivity.

Answer

Use an Interface VPC Endpoint for S3

Answer

Use AWS Direct Connect

Answer

Set up a NAT Gateway in the public subnet and route traffic through it

Question 11

A company is experiencing intermittent connectivity issues between its on-premises network and AWS via a Direct Connect connection. The link is up, but packet loss is observed. Which test should the network engineer perform first to isolate the issue?

Accepted Answer

Run a traceroute with MTR. Option D is correct because MTR (my traceroute) provides detailed path analysis and packet loss at each hop. Option A is for basic connectivity. Option B is for DNS. Option C is for throughput, not loss.

Answer

Ping the virtual private gateway

Answer

Perform a DNS lookup

Answer

Run a speed test

Question 12

Which TWO of the following are valid methods to connect an on-premises data center to a VPC in AWS? (Choose 2.)

Accepted Answer

AWS Direct Connect. Options A and C are correct. AWS Site-to-Site VPN and AWS Direct Connect are the primary methods for hybrid connectivity. VPC peering (B) is for inter-VPC, not on-premises. VPC endpoints (D) are for AWS services. Transit Gateway (E) is a hub for multiple connections but not a direct connection method itself.

Answer

VPC endpoint

Answer

Transit Gateway

Answer

VPC peering

Question 13

Which TWO of the following are true about using a Network Load Balancer (NLB) with AWS PrivateLink? (Choose 2.)

Accepted Answer

NLB can be assigned Elastic IPs. Option D is correct because a Network Load Balancer (NLB) supports the assignment of Elastic IPs (EIPs) per Availability Zone, which provides a static, fixed IP address for the NLB. This is critical for AWS PrivateLink, as the service provider's VPC endpoint service uses the NLB's IP addresses to accept traffic from consumer VPCs, ensuring the endpoint remains reachable even if the underlying instances change.

Answer

NLB supports Server Name Indication (SNI)

Answer

NLB can perform TLS termination

Answer

NLB supports sticky sessions by default

Question 14

A company has a VPC with public and private subnets in two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an S3 bucket. What is the MOST cost-effective and secure way to provide this access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet route tables.. Option A is correct because a VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet, and it is free of charge (no data transfer costs). Option B is wrong because a NAT Gateway incurs hourly charges and data processing fees. Option C is wrong because a Transit Gateway is not needed for a single VPC. Option D is wrong because an Internet Gateway exposes traffic to the internet and would require public IPs or NAT, increasing cost and risk.

Answer

Deploy a NAT Gateway in each public subnet and route traffic from private subnets through it.

Answer

Use AWS Transit Gateway to route traffic to S3 via a centralized VPN.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to the EC2 instances.

Question 15

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached