ANS-C01 Network Implementation Practice Test 11 — 15 Questions

Question 1

A network engineer is troubleshooting connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS accounts and regions. The engineer can ping the private IP of an instance in the peered VPC from one side, but not from the other. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route tables in one VPC do not have a route to the peered VPC CIDR. The most likely cause is that the route tables in one VPC lack a route pointing to the peered VPC's CIDR block. For a VPC peering connection to function bidirectionally, each VPC must have a route in its route table that directs traffic destined for the other VPC's CIDR to the peering connection (pcx-*). Without this route, packets from the source VPC to the peered VPC will be dropped, even if the peering connection itself is active and the security groups allow traffic.

Answer

The security group in the peered VPC is blocking ICMP traffic

Answer

The VPC CIDR blocks overlap

Answer

The VPC peering connection is in a 'pending-acceptance' state

Question 2

A company wants to deploy a web application on EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions (session affinity). What configuration is required on the ALB?

Accepted Answer

Enable stickiness on the target group and specify a cookie duration. Sticky sessions (session affinity) are enabled at the target group level on an Application Load Balancer. By enabling stickiness and specifying a cookie duration, the ALB generates a session cookie (AWSALB) that binds a client's session to a specific target for the duration, ensuring subsequent requests from the same client are routed to the same EC2 instance.

Answer

Use path-based routing

Answer

Configure health checks on the target group

Answer

Enable proxy protocol v2

Question 3

A company is migrating a legacy application that requires static IP addresses for its clients' firewall whitelisting. The application will be hosted on EC2 instances behind a Network Load Balancer (NLB) in a private subnet. Which approach should the company use to provide static IP addresses for outbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet with an Elastic IP. A NAT Gateway in a public subnet with an Elastic IP provides a static source IP address for outbound traffic from private subnets. Since the EC2 instances are in a private subnet behind an NLB, they cannot directly reach the internet; the NAT Gateway translates their private IPs to the Elastic IP, which clients can whitelist. This ensures consistent outbound IPs without exposing the instances to inbound traffic.

Answer

Assign Elastic IPs to the EC2 instances

Answer

Use an internet-facing NLB with Elastic IPs

Answer

Use a VPC endpoint for the application

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

Accepted Answer

Use a Direct Connect Gateway and attach the VPCs. A Direct Connect Gateway (DX Gateway) is a managed service that allows you to associate a single private virtual interface (VIF) with up to 10 VPCs in the same AWS Region (or across Regions with inter-region peering). This enables the company to extend their existing Direct Connect connection to multiple VPCs without provisioning additional VIFs, simplifying management and reducing costs.

Answer

Provision additional private VIFs for each VPC

Answer

Use VPC peering between the VPCs

Answer

Use a Transit VPC with VPN connections

Question 5

A company wants to restrict outbound traffic from a VPC to only allow HTTPS traffic to a specific list of domains. Which AWS service can be used to achieve this?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is the correct choice because it provides stateful, managed firewall rules that can inspect and filter outbound traffic based on domain names (FQDN) for HTTPS (port 443) using TLS inspection or domain list rules. This allows you to create a rule group that permits outbound HTTPS traffic only to a specified list of domains, while blocking all other outbound traffic.

Answer

Security groups

Answer

Amazon Route 53

Answer

Application Load Balancer

Question 6

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be implemented?

Accepted Answer

Create a Gateway VPC Endpoint for S3. A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to access S3 without traversing the internet, using AWS's internal network. This minimizes data transfer costs because Gateway Endpoints are free and traffic stays within the AWS backbone, avoiding NAT Gateway or internet gateway charges.

Answer

Use an Interface VPC Endpoint for S3

Answer

Use AWS Direct Connect

Answer

Set up a NAT Gateway in the public subnet and route traffic through it

Question 7

A company is experiencing intermittent connectivity issues between its on-premises network and AWS via a Direct Connect connection. The link is up, but packet loss is observed. Which test should the network engineer perform first to isolate the issue?

Accepted Answer

Run a traceroute with MTR. MTR (My TraceRoute) combines the functionality of traceroute and ping to provide per-hop latency and packet loss statistics. This allows the engineer to pinpoint whether the packet loss is occurring on the Direct Connect link itself, the customer gateway, or somewhere in the transit path, rather than just confirming end-to-end reachability.

Answer

Ping the virtual private gateway

Answer

Perform a DNS lookup

Answer

Run a speed test

Question 8

Which TWO of the following are valid methods to connect an on-premises data center to a VPC in AWS? (Choose 2.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a correct answer because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, enabling direct access to VPCs via private virtual interfaces (VIFs) or transit virtual interfaces for use with Transit Gateway.

Answer

VPC endpoint

Answer

Transit Gateway

Answer

VPC peering

Question 9

Which TWO of the following are true about using a Network Load Balancer (NLB) with AWS PrivateLink? (Choose 2.)

Accepted Answer

NLB can be assigned Elastic IPs. A Network Load Balancer (NLB) supports the assignment of Elastic IPs (EIPs) per Availability Zone, which provides a static, fixed IP address for the NLB. This is critical for AWS PrivateLink, as the service provider's VPC endpoint service uses the NLB's IP addresses to accept traffic from consumer VPCs, ensuring the endpoint remains reachable even if the underlying instances change.

Answer

NLB supports Server Name Indication (SNI)

Answer

NLB can perform TLS termination

Answer

NLB supports sticky sessions by default

Question 10

A company has a VPC with public and private subnets in two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an S3 bucket. What is the MOST cost-effective and secure way to provide this access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet route tables.. A VPC Gateway Endpoint for S3 provides private, secure connectivity to S3 without traversing the public internet, and it incurs no hourly or data processing charges, making it the most cost-effective and secure choice. Traffic stays within the AWS network, and the endpoint is attached to the private subnet route tables, allowing EC2 instances in those subnets to access S3 directly without needing a NAT Gateway or public IPs.

Answer

Deploy a NAT Gateway in each public subnet and route traffic from private subnets through it.

Answer

Use AWS Transit Gateway to route traffic to S3 via a centralized VPN.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to the EC2 instances.

Question 11

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached

Question 12

A company is setting up a Direct Connect connection to AWS. The on-premises router is configured with a BGP ASN of 64511. The AWS side uses a public ASN of 64512. Which configuration change is required for BGP peering to establish?

Accepted Answer

Change the customer ASN to a value in the 64512-65534 range.. The customer's BGP ASN 64511 is not within the private ASN range 64512-65534 required by AWS Direct Connect. Therefore, the customer must change their ASN to a value in that range to establish BGP peering.

Answer

Increase the eBGP multihop TTL to 2.

Answer

Configure the BGP peer with a public ASN on the customer side.

Answer

Enable BGP authentication with MD5 password.

Question 13

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

Accepted Answer

Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.. Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.

Answer

Use one Direct Connect connection as primary and the other as standby with static routes.

Answer

Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

Answer

Use a VPN connection over the internet as a backup for the Direct Connect links.

Question 14

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access but not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway is the correct choice because it enables instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address, providing one-way internet access without direct reachability.

Answer

Elastic IP Address (EIP)

Answer

Internet Gateway (IGW)

Answer

Virtual Private Gateway (VGW)

Question 15

A company has a multi-account AWS Organizations setup with hundreds of VPCs across multiple regions. The network team needs to centralize outbound internet traffic through a set of inspection VPCs for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Create a Transit Gateway with a central inspection VPC that has a NAT Gateway and route all VPCs to the inspection VPC for egress.. A Transit Gateway with a central inspection VPC centralizes egress traffic through a single NAT Gateway, eliminating the need for per-VPC NAT Gateways. This architecture scales horizontally by attaching hundreds of VPCs to the Transit Gateway and routing all 0.0.0.0/0 traffic to the inspection VPC, which is cost-effective as it reduces NAT Gateway hourly charges and data processing costs across multiple regions.

Answer

Use a Network Load Balancer in each VPC to distribute traffic to inspection appliances.

Answer

Deploy a NAT Gateway in each VPC and route traffic directly to the internet.

Answer

Set up VPC peering between all VPCs and route traffic through a single VPC with an Internet Gateway.