ANS-C01 Network Implementation Practice Test 10 — 15 Questions

Question 1

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible over the internet, but the security team requires that all traffic be inspected by a third-party firewall appliance. What is the MOST scalable architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Gateway Load Balancer with firewall appliances in each Availability Zone.. Gateway Load Load Balancer (GWLB) is designed to scale third-party virtual appliances (e.g., firewalls) horizontally across multiple Availability Zones. It uses the GENEVE protocol to encapsulate traffic, enabling transparent inspection while preserving the original packet headers. This architecture meets the security requirement for traffic inspection and provides high availability and elasticity, unlike a single appliance or a proxy-based solution.

Answer

Configure a Network Load Balancer with target groups pointing to firewall appliances.

Answer

Use an EC2 instance as a transparent proxy and set it as the next-hop in the route table.

Answer

Deploy a single firewall appliance in one Availability Zone and route all traffic through it.

Question 2

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to exchange routes with the VGW. The company wants to route traffic from the VPC to an on-premises subnet 192.168.1.0/24. The on-premises router advertises 192.168.1.0/24 over BGP. However, instances in the VPC cannot reach that subnet. The VPC route table has the local route and a route to the VGW for 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The 192.168.1.0/24 subnet overlaps with the VPC CIDR, causing the local route to take precedence. The most likely cause is that the on-premises subnet 192.168.1.0/24 overlaps with the VPC CIDR block, so the VPC's local route takes precedence over any propagated BGP route. AWS route tables always prefer the local route for destinations within the VPC CIDR, and BGP-propagated routes for overlapping prefixes are ignored. This is why instances cannot reach the on-premises subnet even though the router advertises it.

Answer

BGP route propagation is disabled on the VPC route table

Answer

The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the virtual private gateway

Answer

The Direct Connect virtual interface does not have the allowed prefixes configured

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway (VGW) attached. The on-premises network advertises a prefix 10.0.0.0/8 over BGP. The VPC has subnets with CIDR 10.0.1.0/24 and 10.0.2.0/24. The company wants to ensure that traffic to on-premises uses Direct Connect. However, traffic to an S3 bucket uses the internet. What route configuration is required?

Accepted Answer

Add specific routes for S3 public IP prefixes pointing to the internet gateway.. S3 public IP prefixes are not within the on-premises advertised prefix 10.0.0.0/8. Without explicit routes for S3, traffic to S3 would use the default route (if any) or be dropped. By adding specific routes for S3 public IP prefixes pointing to the internet gateway, S3 traffic is forced over the internet while all other traffic (including to on-premises) uses the Direct Connect private VIF via the propagated 10.0.0.0/8 route.

Answer

Change the VPC CIDR to avoid overlap with on-premises.

Answer

Add a static route for 0.0.0.0/0 pointing to the internet gateway.

Answer

Add a static route in the VPC route table for 0.0.0.0/0 pointing to the VGW.

Question 4

A large enterprise uses AWS Organizations with multiple accounts. The central networking account hosts a Transit Gateway with attachments from VPCs in various accounts. The enterprise uses AWS Resource Access Manager (RAM) to share the Transit Gateway with other accounts. A network engineer in a spoke account creates a VPC and attaches it to the shared Transit Gateway. The attachment shows 'available' state. However, traffic from the spoke VPC to other attached VPCs fails. The spoke VPC route table has a route to the Transit Gateway for 0.0.0.0/0. The Transit Gateway route table has routes for the spoke VPC CIDR and other VPC CIDRs. What is the most likely cause?

Accepted Answer

The Transit Gateway owner has not accepted the VPC attachment. The correct answer is D: the Transit Gateway owner has not accepted the VPC attachment. When a Transit Gateway is shared via AWS RAM, a VPC attachment created in a spoke account must be accepted by the Transit Gateway owner (the central networking account) before traffic can flow; until then the attachment can appear 'available' but will not pass traffic. Although the spoke route table has a 0.0.0.0/0 route to the Transit Gateway and the TGW route table shows the CIDRs, the unaccepted attachment prevents actual forwarding. Option A is wrong because IAM roles are not used for Transit Gateway attachment authorization. Option B is wrong because the spoke VPC already has a default route to the TGW. Option C is wrong because the TGW route table already contains the spoke and other VPC CIDRs.

Answer

The spoke account does not have an IAM role to access the Transit Gateway

Answer

The spoke VPC route table does not have routes to the other VPC CIDRs

Answer

The Transit Gateway route table does not propagate routes from the spoke VPC attachment

Question 5

A company has multiple VPCs that need to communicate with each other using private IP addresses. The VPCs are in the same AWS account and Region. Which AWS service provides the simplest and most scalable solution?

Accepted Answer

VPC peering connections. VPC peering connections allow direct, private IP connectivity between VPCs using the AWS global network, with no single point of failure or bandwidth bottleneck. It is the simplest solution because it requires no additional hardware or software, and it scales horizontally by adding more peering connections as needed, though it does not support transitive routing.

Answer

AWS Site-to-Site VPN

Answer

ClassicLink

Answer

AWS Transit Gateway

Question 6

A company uses AWS PrivateLink to access a SaaS application hosted in another AWS account. The SaaS provider has created a VPC endpoint service in their account. The consumer has created a VPC endpoint in their VPC. The consumer's VPC has a route table with a local route and a route to a NAT gateway. The VPC endpoint is associated with a security group that allows inbound HTTPS from the consumer's VPC CIDR. The consumer's EC2 instances can resolve the DNS name of the endpoint but cannot connect to the SaaS service. What is the most likely cause?

Accepted Answer

The consumer's route table does not have a route to the VPC endpoint. For PrivateLink, the consumer's VPC endpoint is accessed via private IP addresses from the endpoint's elastic network interfaces (ENIs) in the consumer's VPC. The consumer's VPC route table must have a route to the endpoint's ENI to direct traffic correctly. The stem states that the security group allows inbound HTTPS from the consumer's VPC CIDR, so option C is not the cause. DNS resolution works because the endpoint's DNS name resolves to the private IPs of the ENIs, but without a matching route in the route table, traffic may be dropped or misrouted. Option D is the most likely cause.

Answer

The consumer's route table routes traffic to the endpoint via the NAT gateway

Answer

The VPC endpoint service is not available in the consumer's Availability Zone

Answer

The VPC endpoint security group does not allow inbound HTTPS from the consumer's EC2 instances

Question 7

A company has a VPC with public and private subnets across two Availability Zones. They have a Network Load Balancer (NLB) in the public subnets. The NLB has a target group of EC2 instances in the private subnets. The NLB is configured with TLS listeners and uses a certificate from AWS Certificate Manager (ACM). Clients connect to the NLB over the internet. Some clients report connection timeouts. The NLB access logs show that the connections are established but then hang. The target instances are healthy. The security groups for the instances allow inbound TCP/443 from the NLB's private IPs. What is the most likely cause?

Accepted Answer

The target group is configured with protocol TLS instead of TCP. The correct option is A: the target group is configured with protocol TLS instead of TCP. When an NLB has a TLS listener, it terminates TLS at the load balancer; the target group must then use TCP (or TLS if you want end-to-end encryption with re-encryption), but if the targets are only listening for plain TCP/443 and the target group is set to TLS, the NLB will attempt a TLS handshake with the backend, which fails and leaves connections hanging after they are established. The other options do not fit: cross-zone load balancing affects distribution, not hanging connections; an NLB does not have a security group blocking client traffic; and an idle timeout that is too low would close connections, not cause them to hang.

Answer

Cross-zone load balancing is disabled, causing uneven distribution

Answer

The security group for the NLB is blocking traffic from clients

Answer

The NLB idle timeout is set too low

Question 8

A company has a VPC with IPv4 and IPv6 CIDRs. They have a public subnet with an internet gateway and a private subnet with a NAT gateway. EC2 instances in the private subnet need to download updates from the internet. The instances have IPv6 addresses. The private subnet route table has a default route (::/0) pointing to an egress-only internet gateway. However, instances cannot reach IPv6 internet destinations. The egress-only internet gateway is attached to the VPC and in 'available' state. What is the most likely cause?

Accepted Answer

The security group for the instances is blocking outbound IPv6 traffic. The egress-only internet gateway is correctly configured (attached to VPC and route rule ::/0 exists). The instances have IPv6 addresses as stated. The most likely remaining cause is that the security group attached to the instances has outbound rules blocking IPv6 traffic. By default, security groups allow all outbound traffic, but if a custom rule was applied, it could restrict IPv6 traffic. Option B is irrelevant because NAT gateway is for IPv4. Option C contradicts the stem. Option D contradicts the stem.

Answer

The NAT gateway does not support IPv6

Answer

The instances do not have an IPv6 address assigned

Answer

The egress-only internet gateway is not attached to the VPC

Question 9

A company is setting up a new AWS account and wants to centrally manage VPC network traffic inspection across multiple accounts using a central VPC. The company uses AWS Organizations. Which architecture meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central inspection VPC that has firewall appliances.. AWS Transit Gateway acts as a hub-and-spoke router, enabling centralized network traffic inspection by routing inter-VPC and VPN traffic through a central inspection VPC that hosts firewall appliances (e.g., third-party NGFWs or AWS Network Firewall). This architecture scales across multiple accounts in AWS Organizations using resource sharing via AWS Resource Access Manager, and it supports granular route tables to force traffic through the inspection VPC without requiring peering mesh or single points of failure.

Answer

Create VPC peering connections between each account's VPC and the central VPC.

Answer

Use VPC endpoints to route traffic to the central VPC.

Answer

Deploy a Network Load Balancer in each VPC and route traffic through it.

Question 10

A company has a VPC with a public subnet hosting a web server. They want to make the web server accessible over the internet. The web server has a public IP address. The public subnet route table has a default route (0.0.0.0/0) to an internet gateway. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. However, external users cannot access the web server. What is the most likely cause?

Accepted Answer

The internet gateway is not attached to the VPC. The internet gateway must be attached to the VPC. If it is not attached, traffic cannot flow. Option B (NACL) could be blocking but default NACL allows all traffic. Option C (web server not listening) is possible but less likely than IGW attachment. Option D (route table) is already correct.

Answer

The web server is not listening on port 80

Answer

The route table for the public subnet does not have a route to the internet gateway

Answer

The network ACL for the public subnet is blocking inbound HTTP traffic

Question 11

A company uses AWS Global Accelerator to improve performance for a web application hosted on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The Global Accelerator has an endpoint group in the us-east-1 Region with the ALB as an endpoint. Users in Asia report high latency. The company creates a new endpoint group in ap-southeast-1 and adds the same ALB (which is still in us-east-1). However, users in Asia still experience high latency. What should the network engineer do to reduce latency for Asian users?

Accepted Answer

Add an additional ALB in ap-southeast-1 and add it as an endpoint in the ap-southeast-1 endpoint group. Global Accelerator routes traffic to the nearest endpoint group based on latency. However, if the endpoint (ALB) is only in us-east-1, traffic from Asia will still be forwarded to us-east-1 after reaching the ap-southeast-1 endpoint group because the endpoint itself is in us-east-1. To reduce latency, the company must deploy the application in ap-southeast-1 and add a local ALB as an endpoint in the ap-southeast-1 endpoint group. Option C correctly describes this. Option A is incorrect because the ALB cannot be in us-east-1 and serve as an endpoint for ap-southeast-1; endpoint group and endpoint must be in the same Region. Option B is incorrect because weighted routing does not change the physical location of the endpoint; the ALB is still distant. Option D uses CloudFront, which is a CDN, not a Global Accelerator solution, and does not reduce latency for the Global Accelerator use case.

Answer

Change the endpoint in ap-southeast-1 to use the same ALB but with a cross-Region VPC peering

Answer

Configure Global Accelerator to use weighted routing to direct more traffic to ap-southeast-1

Answer

Use Lambda@Edge to cache content at CloudFront edge locations in Asia

Question 12

A company is migrating an on-premises application to AWS. The application uses multicast for discovery. Which AWS service supports multicast traffic within a VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway supports multicast traffic within a VPC by acting as a multicast router. It allows you to create multicast domains and associate subnets, enabling multicast group communication (using IGMP) for applications like service discovery. This makes it the correct choice for migrating an on-premises application that relies on multicast.

Answer

VPC peering

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 13

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to advertise routes. The company wants to ensure high availability by using two Direct Connect connections from different providers. Both connections terminate at the same Direct Connect location (same AWS device). The company configures two private VIFs, each with a separate BGP session, and attaches both to the same VGW. However, when one connection fails, traffic does not fail over. What is the most likely cause?

Accepted Answer

Both Direct Connect connections are on the same AWS device, creating a single point of failure. The most likely cause is that both Direct Connect connections terminate at the same AWS device at the same Direct Connect location, creating a single point of failure. If that device fails, both connections go down, and traffic cannot fail over. For high availability, the connections should terminate at different devices or locations.

Answer

The same BGP ASN is used for both VIFs, causing route conflict

Answer

The MTU size is mismatched between the VIFs

Answer

The allowed prefixes for the VIFs do not include the on-premises subnets

Question 14

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network is advertising a default route (0.0.0.0/0) over BGP. The VPC has an internet gateway attached. When an EC2 instance in the VPC sends traffic to an internet destination, which path does it take by default?

Accepted Answer

Traffic goes to the on-premises network via Direct Connect.. When an on-premises network advertises a default route (0.0.0.0/0) over BGP via a Direct Connect private VIF, that route is propagated into the VPC route tables as a static route. By default, the most specific route (longest prefix match) is preferred, but since both the internet gateway and the BGP-advertised route are for 0.0.0.0/0, the BGP route takes precedence because it is learned via a more specific path (Direct Connect) and is considered a static route in the VPC route table, overriding the internet gateway's implicit route.

Answer

Traffic goes to the on-premises network only if there is a static route.

Answer

Traffic is dropped because there is no route.

Answer

Traffic goes to the internet via the internet gateway.

Question 15

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group across three Availability Zones, and an Amazon RDS for MySQL database. The ALB has a target group that routes traffic to the EC2 instances on TCP port 8080. The security group for the EC2 instances allows inbound traffic from the ALB's security group on port 8080. Users report intermittent connectivity issues to the application. A network engineer reviews the VPC Flow Logs and notices that traffic from the ALB to the EC2 instances is being recorded as 'REJECT' for some requests. What is the most likely cause of this issue?

Accepted Answer

The network ACL associated with the EC2 instances' subnet does not have an outbound rule to allow traffic from the EC2 instances to the ALB on ephemeral ports.. The network ACL (NACL) is stateless and must have explicit outbound rules to allow return traffic from the EC2 instances back to the ALB on ephemeral ports. Since the ALB initiates connections to the EC2 instances on TCP port 8080, the return traffic from the EC2 instances uses ephemeral ports (typically 1024-65535) destined for the ALB's source port. Without an outbound rule in the subnet's NACL allowing this traffic, the NACL will reject the response packets, causing intermittent REJECT entries in VPC Flow Logs.

Answer

The ALB's security group is blocking inbound traffic from the EC2 instances on the response path.

Answer

The ALB's target group health check is misconfigured, causing the ALB to mark instances as unhealthy and stop sending traffic.

Answer

The security group on the EC2 instances is stateful and automatically allows return traffic; the issue cannot be security group related.