ANS-C01 Network Implementation Practice Test 11 — 15 Questions

Question 1

A company is setting up a Direct Connect connection to AWS. The on-premises router is configured with a BGP ASN of 65000. The AWS side uses a public ASN of 64512. Which configuration change is required for BGP peering to establish?

Accepted Answer

Change the customer ASN to a value in the 64512-65534 range.. Option D is correct because Direct Connect requires private ASNs (64512-65534) for the customer side; 65000 is private. Option A is wrong because public ASNs are not required. Option B is wrong because MD5 is optional. Option C is wrong because eBGP multihop is not needed for directly connected routers.

Answer

Increase the eBGP multihop TTL to 2.

Answer

Configure the BGP peer with a public ASN on the customer side.

Answer

Enable BGP authentication with MD5 password.

Question 2

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

Accepted Answer

Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.. Option C is correct because using a Transit Gateway with two Direct Connect gateways (one for each connection) and dynamic BGP routing enables automatic failover via BGP path selection. Option A is wrong because both connections to the same VGW do not provide true redundancy if the VGW fails. Option B is wrong because static routes require manual intervention. Option D is wrong because a VPN over the internet defeats the purpose of Direct Connect.

Answer

Use one Direct Connect connection as primary and the other as standby with static routes.

Answer

Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

Answer

Use a VPN connection over the internet as a backup for the Direct Connect links.

Question 3

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access but not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. Option C is correct because a NAT Gateway enables outbound internet access for private subnets while preventing inbound traffic. Option A is wrong because an Internet Gateway provides bidirectional access. Option B is wrong because a VPN connection is for hybrid connectivity. Option D is wrong because an EIP is used with NAT Gateway or Internet Gateway, not alone.

Answer

Elastic IP Address (EIP)

Answer

Internet Gateway (IGW)

Answer

Virtual Private Gateway (VGW)

Question 4

A company has a multi-account AWS Organizations setup with hundreds of VPCs across multiple regions. The network team needs to centralize outbound internet traffic through a set of inspection VPCs for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Create a Transit Gateway with a central inspection VPC that has a NAT Gateway and route all VPCs to the inspection VPC for egress.. Option B is correct because AWS Transit Gateway with central VPC attachment allows routing all egress traffic through inspection VPCs, and using a single NAT Gateway per AZ in the inspection VPC is scalable and cost-effective. Option A is wrong because each VPC with its own NAT Gateway is not centralized. Option C is wrong because Network Load Balancer is not designed for internet egress. Option D is wrong because VPC peering does not scale to hundreds of VPCs and lacks transitive routing.

Answer

Use a Network Load Balancer in each VPC to distribute traffic to inspection appliances.

Answer

Deploy a NAT Gateway in each VPC and route traffic directly to the internet.

Answer

Set up VPC peering between all VPCs and route traffic through a single VPC with an Internet Gateway.

Question 5

A company has a VPC with a transit gateway (TGW) connected to multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises a specific prefix 10.0.0.0/16. A VPC attachment in the same region also advertises the same prefix. The TGW route table has the on-premises route as static and the VPC route as propagated. Which route will be used for traffic destined to 10.0.0.5?

Accepted Answer

The static route to on-premises. Option A is correct because static routes take precedence over propagated routes in a transit gateway route table. Option B is wrong because TGW does not use AS_PATH for static vs propagated. Option C is wrong because there is no longest prefix match difference. Option D is wrong because equal-cost multipath is not applied when static and propagated routes exist.

Answer

The propagated route from VPC

Answer

Both routes will be used with ECMP

Answer

The route with the shortest AS_PATH

Question 6

An application running on EC2 instances in a private subnet needs to send logs to Amazon CloudWatch Logs. Which step is essential to allow this communication without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for CloudWatch Logs and update the route table.. Option A is correct because a VPC Gateway Endpoint for CloudWatch Logs provides private connectivity. Option B is wrong because a NAT Gateway is needed only for internet traffic. Option C is wrong because a VPC Interface Endpoint is not the only way; Gateway Endpoints are simpler for CloudWatch Logs. Option D is wrong because an Internet Gateway is not needed.

Answer

Create a VPC Interface Endpoint for CloudWatch Logs and attach it to the subnet.

Answer

Assign a public IP to the EC2 instance and route directly to the internet.

Answer

Attach a NAT Gateway to the private subnet and route traffic to the internet.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to establish connectivity to an on-premises network via AWS Site-to-Site VPN. The on-premises network uses a CIDR block of 192.168.0.0/16. The VPN connection will be redundant using two tunnels. Which TWO actions are required to enable this connectivity?

Accepted Answer

Create a Virtual Private Gateway (VGW) and attach it to the VPC.. Option A and Option D are correct. Option A is correct because a Virtual Private Gateway must be attached to the VPC. Option D is correct because route tables must have routes for the on-premises CIDR pointing to the VPN gateway. Option B is wrong because Customer Gateway is the on-premises device, not an AWS resource. Option C is wrong because Direct Connect is a different service. Option E is wrong because NAT Gateway is for outbound internet.

Answer

Create a Customer Gateway (CGW) in the same AWS region.

Answer

Create a Direct Connect virtual interface.

Answer

Configure a NAT Gateway in the VPC.

Question 8

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise its prefixes. Recently, the on-premises router started advertising a more specific route (10.0.0.0/24) that overlaps with the VPC's CIDR (10.0.0.0/16). What is the impact on traffic destined to 10.0.0.5?

Accepted Answer

Return traffic from the instance to on-premises is routed through Direct Connect instead of staying within the VPC.. Option C is correct because when a Direct Connect virtual interface advertises a more specific route that overlaps with the VPC CIDR, AWS prefers the more specific route from Direct Connect, causing traffic from the VPC to the on-premises network to be routed via Direct Connect instead of locally. Option A is wrong because the instance remains reachable from on-premises. Option B is wrong because BGP does not cause route flapping in this scenario. Option D is wrong because the traffic is not blackholed; it goes to on-premises.

Answer

The instance becomes unreachable from on-premises.

Answer

Traffic destined to the instance is blackholed.

Answer

Traffic is load-balanced between the VPC and Direct Connect.

Question 9

A company is deploying a global application and wants to use AWS Global Accelerator to improve performance. The application runs behind an Application Load Balancer (ALB) in us-east-1. Which THREE components are part of a Global Accelerator deployment?

Accepted Answer

Endpoint groups. Option A, Option C, and Option D are correct. Option A is correct because Global Accelerator uses anycast IP addresses. Option C is correct because it uses edge locations. Option D is correct because endpoint groups are a core component. Option B is wrong because Lambda@Edge is for CloudFront. Option E is wrong because Route 53 is DNS, not part of Global Accelerator.

Answer

Route 53 hosted zones

Answer

Lambda@Edge functions

Question 10

A company is deploying a multi-tier application across multiple VPCs connected via AWS Transit Gateway. The web tier must be able to initiate connections to the app tier, but the app tier must not be able to initiate connections to the web tier. How can this be achieved?

Accepted Answer

Deploy a centralized firewall appliance in a shared VPC and use Transit Gateway to route all inter-VPC traffic through it.. Option D is correct because a stateful network firewall appliance in a central VPC can enforce unidirectional traffic rules. Transit Gateway route tables can direct traffic to the firewall VPC for inspection, and the firewall rules allow only web-to-app traffic. Option A is wrong because NACLs are stateless and cannot track connection state. Option B is wrong because VPC peering does not provide transitive routing. Option C is wrong because security groups are stateful but cannot be applied across VPCs.

Answer

Configure network ACLs on the web tier subnets to allow outbound traffic and deny inbound from app tier.

Answer

Establish VPC peering between the web and app VPCs and restrict routes.

Answer

Use security groups across the VPCs by referencing each other's CIDR blocks.

Question 11

A network engineer needs to monitor network traffic in a VPC. Which TWO AWS services can capture and analyze VPC flow logs?

Accepted Answer

Amazon S3. Amazon S3 is a correct destination for VPC Flow Logs because you can publish flow log data directly to an S3 bucket, where it can be stored, queried with Amazon Athena, or processed by other analytics tools. Amazon CloudWatch Logs is also a correct destination, allowing you to publish flow logs to a log group for real-time monitoring, metric filters, and integration with CloudWatch alarms or third-party solutions via subscription filters.

Answer

Amazon GuardDuty

Answer

VPC Traffic Mirroring

Answer

AWS Config

Question 12

A company needs to connect its on-premises data center to AWS using a site-to-site VPN. The on-premises firewall does not support IPsec. What alternative solution can the company use?

Accepted Answer

Use AWS Client VPN to establish a VPN connection from the on-premises network.. Option B is correct because AWS Client VPN allows individual clients or the entire network to connect using OpenVPN-based software, which can be installed on the firewall if it supports OpenVPN. Option A is wrong because Direct Connect is a physical connection. Option C is wrong because Transit Gateway is a network transit hub, not a VPN endpoint. Option D is wrong because VPC peering is for VPC-to-VPC connectivity.

Answer

Create a VPC peering connection between the on-premises router and the VPC.

Answer

Deploy an AWS Transit Gateway and attach the on-premises network via a VPC attachment.

Answer

Use AWS Direct Connect to establish a dedicated physical link.

Question 13

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

Accepted Answer

Traffic goes through the NAT Gateway nat-67890.. Option C is correct because the subnet inherits the main route table (rtb-12345) which has a route to a NAT Gateway for 0.0.0.0/0. Option A is wrong because the local route is for VPC internal traffic. Option B is wrong because an Internet Gateway is not present. Option D is wrong because no explicit association exists.

Answer

Traffic is dropped because no explicit association is set.

Answer

Traffic goes through the Internet Gateway.

Answer

Traffic is dropped because no Internet Gateway is present.

Question 14

A company uses AWS Transit Gateway to connect multiple VPCs. The network team notices that traffic between two VPCs is taking a suboptimal path through a third VPC. What is the most likely cause?

Accepted Answer

Incorrect route table associations and propagations in the Transit Gateway.. Option A is correct because Transit Gateway route tables control the path of inter-VPC traffic. If routes are not correctly configured, traffic may be forwarded to an unintended attachment. Option B is wrong because ECMP is for load balancing, not path selection. Option C is wrong because security groups do not affect routing. Option D is wrong because BGP is not used between VPCs in Transit Gateway.

Answer

Security groups are blocking the direct path, forcing traffic through a third VPC.

Answer

BGP is not configured between the VPCs, so traffic defaults through a transit VPC.

Answer

ECMP routing is enabled, causing traffic to be load-balanced across multiple paths.

Question 15

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

Accepted Answer

The transit gateway route table propagation is not configured.. Option B is correct because the route table association is enabled but propagation is not automatic; the CloudFormation resource does not create a route table propagation. Option A is wrong because the attachment is created. Option C is wrong because DNS support is not related. Option D is wrong because VPN ECMP is not relevant.

Answer

The VPC attachment is not in the 'available' state.

Answer

VPN ECMP support is enabled, preventing propagation.

Answer

DNS support is disabled on the transit gateway.