ANS-C01 Network Implementation Practice Test 10 — 15 Questions

Question 1

Which TWO of the following are true about AWS VPC endpoints? (Choose two.)

Accepted Answer

Gateway Endpoints can be used to access Amazon S3 and DynamoDB.. Gateway VPC endpoints allow private connectivity to Amazon S3 and DynamoDB without traversing the internet, using route table entries rather than private IP addresses. This is the only AWS service pair supported by Gateway Endpoints, making them a cost-effective and simple solution for these two services.

Answer

Interface Endpoints are free of charge.

Answer

Gateway Endpoints use AWS PrivateLink.

Answer

Both Gateway and Interface Endpoints require a NAT gateway.

Question 2

A company is deploying a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer (ALB), and the application tier runs on EC2 instances that connect to an RDS MySQL Multi-AZ DB instance. The application tier must be isolated from the internet and only accessible from the web tier. Which network implementation meets these requirements with the LEAST administrative overhead?

Accepted Answer

Place the web tier in a public subnet and the application tier in a private subnet, and configure security groups to allow inbound traffic to the application tier only from the web tier's security group.. Placing the web tier in a public subnet and the application tier in a private subnet, then using a security group rule that references the web tier's security group as the source, provides a stateful, application-layer firewall that allows traffic only from the web tier to the application tier. This design isolates the application tier from the internet while requiring no additional infrastructure like NAT gateways or VPC peering, minimizing administrative overhead. The security group reference automatically scales with the web tier's instances, eliminating the need to manage IP addresses.

Answer

Create two VPCs: one for the web tier with a public subnet, and one for the application tier with a private subnet, and connect them using VPC peering.

Answer

Place the web tier in a public subnet and the application tier in a private subnet with a NAT gateway for outbound access, and use security groups to allow traffic from the web tier.

Answer

Place both tiers in the same public subnet, and use a network ACL to restrict traffic from the web tier to the application tier.

Question 3

A company is implementing a hybrid network architecture with AWS Direct Connect and a VPN backup. The company has two Direct Connect connections from different providers terminating at two AWS Direct Connect locations, each connecting to a separate AWS Transit Gateway in the same region. The VPCs are attached to both transit gateways. The company needs to ensure that traffic from on-premises to VPCs uses the primary Direct Connect connection when available and fails over to the secondary Direct Connect connection, then to the VPN. How should the company configure routing to achieve this?

Accepted Answer

Configure BGP AS_PATH prepending on the secondary Direct Connect and VPN connections to make them less preferred than the primary Direct Connect.. BGP AS_PATH prepending on the secondary Direct Connect and VPN connections artificially increases the AS path length, making those routes less preferred in the BGP best-path selection process. This ensures that the primary Direct Connect connection is chosen for traffic from on-premises to VPCs when available, with automatic failover to the secondary Direct Connect and then to the VPN as the least preferred path.

Answer

Disable route propagation from the VPN to the transit gateway route tables, and rely on the Direct Connect connections only.

Answer

Configure equal-cost multipath (ECMP) routing across all three connections to load balance traffic.

Answer

Use static routes in the transit gateway route tables with higher metric values for the secondary Direct Connect and VPN.

Question 4

A company is setting up AWS Client VPN to allow remote employees to access resources in a VPC. The VPC has a CIDR block of 10.0.0.0/16. The Client VPN endpoint is associated with a subnet 10.0.1.0/24. The company wants to assign client IP addresses from a different CIDR range than the VPC to avoid overlap. Which client CIDR range should the company specify?

Accepted Answer

172.16.0.0/12. The client CIDR range must not overlap with the VPC CIDR (10.0.0.0/16) or any on-premises networks. Both 172.16.0.0/12 (A) and 192.168.0.0/16 (D) are private RFC 1918 ranges that do not overlap, making them valid choices. Options B and C overlap with the VPC CIDR and are invalid. Note: This question accepts multiple correct answers (multi-select).

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 5

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to download patches from the internet. The company wants to minimize costs while ensuring high availability. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in a public subnet in each Availability Zone and configure route tables for private subnets to use the NAT gateway in the same AZ.. Deploying a NAT gateway in each Availability Zone ensures high availability by eliminating a single point of failure, while the private subnets in each AZ use the local NAT gateway for outbound internet access. This design meets the requirement for high availability at minimal cost compared to other resilient architectures, as NAT gateways are fully managed and scale automatically.

Answer

Create a NAT gateway in one public subnet and use a second NAT gateway in a different AZ as a backup, but only route traffic to the primary.

Answer

Create a NAT gateway in one public subnet and configure route tables for private subnets to use it.

Answer

Launch a NAT instance in one public subnet and configure route tables for private subnets to use it.

Question 6

A company has an AWS Direct Connect connection with a private VIF to a VPC. The VPC has multiple subnets across two Availability Zones. The company wants to use the Direct Connect connection as the primary path for all traffic from on-premises to the VPC, and use a Site-to-Site VPN as a backup. The on-premises router is configured to advertise a default route via BGP over the Direct Connect, and the VPN also advertises a default route. Which configuration ensures that the Direct Connect path is preferred over the VPN?

Accepted Answer

Configure AS_PATH prepending on the VPN BGP advertisements from the on-premises router to make the VPN path longer.. AS_PATH prepending increases the AS path length for routes advertised over the VPN, making them less preferred compared to the Direct Connect routes when both paths advertise a default route. BGP selects the path with the shortest AS_PATH length when all other attributes are equal, so prepending on the VPN ensures Direct Connect is the primary path.

Answer

Disable route propagation from the VPN in the VPC route tables to ensure Direct Connect routes take precedence.

Answer

Set a higher local preference on the Direct Connect BGP session on the on-premises router.

Answer

Decrease the Multi-Exit Discriminator (MED) value on the Direct Connect BGP advertisements from AWS.

Question 7

A company is deploying a VPC with IPv6 support. The VPC has a CIDR block of 10.0.0.0/16 and an assigned IPv6 CIDR block of 2600:1f16:xxxx:xxxx::/56. The company wants EC2 instances in a public subnet to be able to communicate with the internet using IPv6. Which configuration is necessary?

Accepted Answer

Attach an egress-only internet gateway to the VPC and add a route for ::/0 to the egress-only internet gateway in the public subnet route table.. An egress-only internet gateway (EIGW) is the AWS-managed service designed to enable outbound-only IPv6 communication from a VPC to the internet. Since IPv6 addresses are globally unique and publicly routable, a NAT gateway (used for IPv4) is not needed; instead, the EIGW allows instances to initiate outbound traffic while preventing any unsolicited inbound connections. Adding a route for ::/0 to the EIGW in the public subnet route table directs all outbound IPv6 traffic through it.

Answer

Attach a NAT gateway to the VPC and add a route for ::/0 to the NAT gateway in the public subnet route table.

Answer

Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the internet gateway in the public subnet route table.

Answer

Set up a NAT64 translation service to convert IPv6 requests to IPv4.

Question 8

A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?

Accepted Answer

Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.. A Gateway Load Balancer (GWLB) allows you to deploy a fleet of third-party firewall appliances in a separate subnet and use a Gateway Load Balancer endpoint (GWLBe) to transparently intercept and steer inter-subnet traffic through the firewall. By configuring the route tables of the web and application subnets to send traffic to the GWLBe, the firewall inspects only the desired traffic without affecting other VPC traffic, as the GWLB operates at Layer 3 (Geneve encapsulation) and does not alter the source/destination IP addresses.

Answer

Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.

Answer

Place the firewall in a separate subnet and use network ACLs to force traffic through it.

Answer

Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.

Question 9

A company has multiple VPCs connected via AWS Transit Gateway. Each VPC has its own route table in the transit gateway. The company wants to restrict traffic between certain VPCs. For example, VPC A should be able to send traffic to VPC B but not to VPC C. VPC B should be able to send traffic to VPC C. Which configuration should the company use?

Accepted Answer

Create separate transit gateway route tables for each VPC and add only the desired routes for other VPCs.. AWS Transit Gateway supports multiple route tables, and by creating a separate route table for each VPC attachment, you can control which VPCs can communicate by selectively adding routes to the desired destination VPC CIDRs. This allows VPC A to have a route only to VPC B, while VPC B's route table includes routes to both VPC A and VPC C, achieving the required traffic isolation without relying on stateful or stateless filtering at the attachment level.

Answer

Use network ACLs on the transit gateway attachments to filter traffic.

Answer

Use security groups on the VPC attachments to allow or deny traffic.

Answer

Create a single transit gateway route table and associate all VPC attachments with it.

Question 10

A company is setting up a Site-to-Site VPN connection to AWS. The customer gateway device is behind a NAT device that performs address translation. Which tunnel option must be enabled to ensure the VPN tunnel establishes correctly?

Accepted Answer

NAT Traversal (NAT-T). When a customer gateway device is behind a NAT device, the NAT device modifies the IP addresses and potentially the UDP ports in the IPsec packet headers. Standard IPsec (ESP) does not work through NAT because ESP is a Layer 4 protocol with no port numbers. NAT Traversal (NAT-T) solves this by encapsulating IPsec packets inside UDP (typically port 4500), allowing the NAT device to perform address translation without breaking the VPN tunnel.

Answer

Perfect Forward Secrecy (PFS)

Answer

Dead Peer Detection (DPD)

Answer

IKEv2

Question 11

A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?

Accepted Answer

An inbound rule in the database's security group that references the web server's security group.. Security group rules can reference other security groups as a source, allowing traffic from any instance associated with the referenced security group (the web server's security group) without needing to specify individual IP addresses. This is the recommended AWS best practice for inter-instance communication within a VPC, as it dynamically adapts to changes in the web server's IP or scaling events.

Answer

An inbound rule in the database's security group that allows traffic from the web server's private IP address.

Answer

An internet gateway attached to the VPC.

Answer

A NAT gateway in the public subnet.

Question 12

A company is using AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The VPC has a CIDR 10.0.0.0/16. The on-premises network uses 192.168.0.0/16. The company wants to enable communication between on-premises and the VPC, and also allow the VPC to access the internet via an internet gateway. Which TWO of the following configurations are necessary?

Accepted Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the internet gateway.. An internet gateway (IGW) provides internet access for a VPC, and the VPC's main route table must include a default route (0.0.0.0/0) pointing to the IGW for outbound internet traffic. This allows instances in the VPC to reach the internet, which is a stated requirement. Without this route, traffic destined for the internet would have no path.

Answer

A route in the on-premises router for the VPC CIDR (10.0.0.0/16) pointing to the AWS Direct Connect router.

Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway.

Answer

A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the internet gateway.

Question 13

A company is designing a VPC with multiple subnets. The company wants to use VPC Flow Logs to monitor network traffic. Which TWO of the following are valid destinations for VPC Flow Logs?

Accepted Answer

Amazon CloudWatch Logs. VPC Flow Logs can publish flow log records directly to Amazon CloudWatch Logs, where you can view, search, and filter log data using the CloudWatch Logs console or API. This destination is enabled by default when you create a flow log via the AWS Management Console, making it the most common integration point for monitoring and alerting on network traffic patterns.

Answer

Amazon RDS

Answer

Amazon SQS

Answer

Amazon Kinesis Data Firehose

Question 14

A company is deploying a VPC with public and private subnets. The private subnets need outbound internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private source IP to the NAT Gateway's Elastic IP address, so responses return to the gateway, which then forwards them to the private instance. This meets the requirement of outbound-only internet access without direct internet reachability.

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 15

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They want to route users to the nearest healthy ALB using latency-based routing. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs user traffic to the AWS region with the lowest network latency for the end user, based on latency measurements between the user and each region's resources. This matches the requirement to route users to the nearest healthy ALB, as Route 53 can evaluate health checks on the ALBs and only route to healthy endpoints.

Answer

Amazon CloudWatch

Answer

VPC Traffic Mirroring

Answer

AWS Global Accelerator