ANS-C01 Network Implementation Practice Test 11 — 15 Questions

Question 1

A network engineer is designing a highly available VPN connectivity between an on-premises data center and AWS. The company has two AWS Direct Connect connections terminated on two different AWS Direct Connect locations for redundancy. The company wants to use AWS Site-to-Site VPN as a backup for Direct Connect. The VPN connections will terminate on a single Virtual Private Gateway (VGW) attached to a VPC. The on-premises network has two customer gateways (CGWs) each with a unique BGP ASN. Which TWO actions should the engineer take to ensure automatic failover and load balancing? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the VPN connections to use BGP dynamic routing.. Option A is correct because BGP dynamic routing is required for AWS Site-to-Site VPN to automatically withdraw and re-advertise routes when a tunnel or connection fails, enabling automatic failover without manual intervention. Option E is correct because creating two VPN connections, each from a different customer gateway (with its own unique BGP ASN) to the same virtual private gateway, provides redundant paths; combined with BGP, AWS can select the best path and fail over automatically, and multiple connections can also support load balancing across tunnels. Option B is not needed because BGP already handles route withdrawal and reconvergence natively, so a CloudWatch/Lambda-based route table modification would be an unnecessary custom mechanism. Option C is incorrect because AWS Site-to-Site VPN does not support ECMP over static routes on a virtual private gateway; ECMP requires BGP dynamic routing. Option D is incorrect because using a single customer gateway with two tunnels does not meet the requirement of two distinct customer gateways with unique BGP ASNs and provides less redundancy at the on-premises edge.

Answer

Set up a CloudWatch alarm to trigger an AWS Lambda function that changes route table entries upon VPN failure.

Answer

Configure the VPN connections to use static routes with equal cost multipath (ECMP).

Answer

Use a single customer gateway with two separate tunnels to the virtual private gateway.

Question 2

A financial services company is migrating its on-premises data center to AWS. The company has a three-tier application that consists of web servers, application servers, and a database. The application servers must communicate with the database using a private IP address. The database is hosted on an Amazon RDS for MySQL instance in a private subnet. The application servers are in a public subnet. The company has a security requirement that all traffic between the application servers and the database must be encrypted in transit. The network engineer has created a security group for the RDS instance that allows inbound traffic on port 3306 from the security group of the application servers. The engineer has also enabled encryption at rest for the RDS instance. During a security audit, it is discovered that traffic between the application servers and the database is not encrypted. The application team confirms that the application is configured to connect to the database using standard MySQL client library without any SSL/TLS options. The network engineer must ensure that all traffic between the application servers and the database is encrypted without modifying the application code. What should the network engineer do?

Accepted Answer

Enable the 'require_secure_transport' parameter in the RDS parameter group and set it to ON.. The 'require_secure_transport' parameter in the RDS parameter group, when set to ON, forces all connections to the MySQL instance to use SSL/TLS. This enforces encryption in transit at the database level without requiring any changes to the application code. Since the application uses a standard MySQL client library, it will automatically negotiate TLS if the server requires it, provided the client supports it (which modern MySQL clients do by default). This meets the requirement of encrypting all traffic between the application servers and the database without modifying the application.

Answer

Create an AWS Site-to-Site VPN connection between the application servers' subnet and the database subnet to encrypt all traffic.

Answer

Deploy a Network Load Balancer (NLB) with a TLS listener in front of the RDS instance. Configure the NLB to terminate TLS from the application servers and forward traffic to the RDS instance using TLS.

Answer

Modify the security group for the RDS instance to only allow traffic from the application servers' security group on port 3306 with the 'tls' protocol.

Question 3

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. They have two redundant 1 Gbps AWS Direct Connect connections. The company wants to use BGP to advertise the same prefix from both locations to AWS. How should they configure the BGP attributes to ensure active/passive failover with automatic failback?

Accepted Answer

Prepend the AS path on the secondary connection's BGP advertisements. AS path prepending on the secondary connection makes the BGP path longer, causing AWS to prefer the primary connection for inbound traffic. This achieves active/passive failover: if the primary fails, the shorter AS path on the secondary becomes preferred, and automatic failback occurs when the primary recovers and its shorter AS path is re-advertised.

Answer

Set a higher MED value on the primary connection's BGP advertisements

Answer

Set a higher local preference on the secondary connection's BGP advertisements

Answer

Use BGP communities to tag routes and manipulate preference on AWS side

Question 4

A company has a VPC with public and private subnets in two Availability Zones. They have a NAT gateway in each AZ for outbound internet access. They recently added a third AZ and created a new private subnet. Instances in the new private subnet cannot reach the internet. The route table for the new subnet has a default route (0.0.0.0/0) pointing to a NAT gateway in the same AZ. What is the most likely cause?

Accepted Answer

The NAT gateway in the new AZ does not have an Elastic IP address attached. A NAT gateway requires an Elastic IP (EIP) address to function for outbound internet traffic. Without an EIP attached, the NAT gateway cannot translate private source IPs to a public IP, so instances in the new private subnet cannot reach the internet even though the route table correctly points to the NAT gateway in the same AZ.

Answer

The security group attached to the NAT gateway blocks outbound traffic

Answer

The route table in the new private subnet does not have a route to the NAT gateway

Answer

The NAT gateway is not in a public subnet in the new AZ

Question 5

A company is deploying a multi-region application and needs to route users to the nearest healthy endpoint. They are using Amazon Route 53 with latency-based routing and health checks. Users in Asia are sometimes routed to the US region even when the Asia endpoint is healthy. What is the most likely cause?

Accepted Answer

The health check for the Asia region endpoint is failing or misconfigured. Latency-based routing selects the endpoint with the lowest latency for the user. If users in Asia are routed to the US even when the Asia endpoint is healthy, the most likely cause is that the health check for the Asia endpoint is failing or misconfigured. When a health check fails, Route 53 considers the endpoint unhealthy and excludes it from latency-based routing, causing traffic to be sent to the next-best region (e.g., US).

Answer

The Asia region endpoint's Route 53 geolocation routing policy is misconfigured

Answer

The TTL value for the DNS records is set too high

Answer

The DNS resolver used by users in Asia does not support latency-based routing

Question 6

A company has a Direct Connect connection with a private VIF to a VPC. They want to use BGP to advertise a specific /24 prefix from their on-premises network to AWS. After configuration, the prefix is not visible in the VPC route tables. The BGP session is established. What should the company check?

Accepted Answer

Verify that the prefix is included in the allowed prefixes list for the Direct Connect virtual interface. When a BGP session is established but the advertised prefix does not appear in VPC route tables, the most likely cause is that the prefix is not included in the allowed prefixes list configured on the Direct Connect virtual interface. AWS uses this list as a prefix filter; any prefix received via BGP that is not in the allowed list is silently ignored and not installed in the VPC route tables.

Answer

Ensure that route propagation is enabled on the VPC route table

Answer

Check that the BGP ASN on the customer gateway is unique and not conflicting

Answer

Add a static route in the VPC route table for the on-premises prefix

Question 7

A company has a VPC with multiple subnets. They want to use VPC Flow Logs to capture network traffic metadata for troubleshooting. Which TWO of the following are valid destinations for VPC Flow Logs? (Select TWO.)

Accepted Answer

Amazon CloudWatch Logs log group. VPC Flow Logs can be published to Amazon CloudWatch Logs log groups (option A), where each flow log record becomes a log event that you can query with CloudWatch Logs Insights and alarm on with metric filters, making it a valid destination for troubleshooting. VPC Flow Logs can also be delivered to an Amazon S3 bucket (option E), where records are stored as compressed objects in a hierarchy of bucket/prefix paths, which is the standard choice for long-term retention and Athena-based analysis. These are the only two supported flow log destinations in AWS. Option B (Kinesis Data Firehose) is not a direct destination — Firehose can only receive flow logs indirectly by subscribing to a CloudWatch Logs log group, not as a native flow log target. Option C (Lambda) and option D (SQS) are also not supported destinations; Lambda can be triggered by CloudWatch Logs subscriptions, and SQS is not integrated with VPC Flow Logs at all.

Answer

Amazon Kinesis Data Firehose delivery stream

Answer

AWS Lambda function

Answer

Amazon Simple Queue Service (SQS) queue

Question 8

A company is setting up a new VPC and needs to ensure that instances in the VPC can resolve DNS names within AWS (e.g., ec2-203-0-113-25.compute-1.amazonaws.com). Which TWO configurations are required? (Select TWO.)

Accepted Answer

Set the VPC's 'enableDnsSupport' attribute to true. Option A is correct because the VPC's enableDnsSupport attribute must be true for the Amazon-provided DNS resolver (the .2 address of the VPC CIDR) to be available and to resolve AWS-internal names such as ec2-203-0-113-25.compute-1.amazonaws.com. Option B is correct because enableDnsHostnames must also be true so that instances launched in the VPC receive DNS hostnames and the VPC's DNS resolution returns the corresponding public/private DNS names for AWS resources. Option C is wrong because Route 53 Resolver forwarding rules are used to forward queries between on-premises and AWS, not to enable basic AWS-internal DNS resolution in a VPC. Option D is wrong because a public hosted zone is for hosting your own public DNS records, not for resolving AWS-provided instance DNS names. Option E is wrong because the default DHCP option set already points instances to the VPC DNS resolver (AmazonProvidedDNS), so a custom option set is not required to resolve AWS-internal names.

Answer

Configure the Amazon Route 53 Resolver to forward queries to the VPC DNS

Answer

Create a public hosted zone in Amazon Route 53 and associate it with the VPC

Answer

Create a custom DHCP option set with the domain-name-servers option set to the VPC DNS IP

Question 9

A company is deploying a multi-VPC architecture with connectivity requirements. The network team needs to establish private connectivity between VPCs in the same AWS account and region, using services that can scale to 100 Gbps throughput. Which solution meets these requirements?

Accepted Answer

Create an AWS Transit Gateway and attach all VPCs to it. AWS Transit Gateway (TGW) acts as a regional hub-and-spoke router that can interconnect thousands of VPCs and on-premises networks, supporting burst throughput up to 100 Gbps per attachment. It simplifies multi-VPC connectivity by eliminating the need for full-mesh peering and provides centralized routing, making it the only option that meets both the scalability and private connectivity requirements.

Answer

Use AWS PrivateLink with Network Load Balancers to connect VPCs

Answer

Deploy AWS Client VPN and configure routes between VPCs

Answer

Configure VPC peering connections between each pair of VPCs

Question 10

A company is implementing a hybrid network using AWS Site-to-Site VPN. The on-premises firewall requires that the VPN tunnels use IKEv2 with pre-shared keys and that the tunnels are always active. Which VPN configuration should be used?

Accepted Answer

Two VPN tunnels in active/active mode with BGP. IKEv2 with pre-shared keys and always-active tunnels require both tunnels to be in active/active mode, which is achieved by using BGP to advertise the same routes over both tunnels. BGP enables dynamic routing and ensures both tunnels are used simultaneously, meeting the requirement for continuous active connectivity.

Answer

Two VPN tunnels in active/passive mode

Answer

Two VPN tunnels with static routing

Answer

One VPN tunnel with static routing

Question 11

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC has a public subnet 10.0.1.0/24 and a private subnet 10.0.2.0/24. An EC2 instance in the private subnet needs to download patches from the internet. Which configuration is required to provide outbound internet access to the private instance while preventing inbound internet traffic?

Accepted Answer

Deploy a NAT Gateway in the public subnet and add a default route in the private subnet route table pointing to the NAT Gateway. A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID. This design ensures the private instance's traffic is source-NATed to the NAT Gateway's Elastic IP, and the Internet Gateway only accepts responses to established outbound connections.

Answer

Attach an Internet Gateway to the private subnet and add a default route to the Internet Gateway in the private route table

Answer

Assign an Elastic IP to the private instance and update the security group to allow outbound traffic

Answer

Add an Internet Gateway to the VPC and create a route in the private subnet to 0.0.0.0/0 via the Internet Gateway

Question 12

A company has a Direct Connect connection with a private VIF to a Direct Connect gateway. The VIF is associated with a Direct Connect gateway that has a virtual private gateway (VGW) attachment to a VPC. The on-premises network is advertising a route to 10.0.0.0/16. However, the VPC cannot reach on-premises resources. The VPC has a route table with a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The on-premises router is not using BGP to advertise routes. The VPC route table already contains a static route to 10.0.0.0/16 pointing to the VGW, so route propagation is not required for this specific destination. However, for the VGW to forward traffic to on-premises, it must have learned the on-premises route via BGP from the Direct Connect gateway. If the on-premises router is not using BGP to advertise the 10.0.0.0/16 route, the Direct Connect gateway and therefore the VGW will not have a route to that prefix, causing traffic from the VPC to be dropped. Enabling route propagation on the VPC route table would not help because the route is already statically defined. Therefore, the most likely cause is that the on-premises router is not using BGP to advertise routes.

Answer

The VPC route table does not have route propagation enabled for the virtual private gateway

Answer

The security group on the VPC instances is blocking inbound traffic

Answer

The Direct Connect gateway does not support the prefix 10.0.0.0/16

Question 13

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS VPN CloudHub. The on-premises network uses multiple customer gateways (CGWs) connected to a single virtual private gateway (VGW). The company wants to ensure that all traffic from the VPC to on-premises is routed through a specific CGW. Which configuration should be used?

Accepted Answer

Configure a static route in the VPC route table pointing to the VGW with a more specific prefix for the on-premises network. In an AWS VPN CloudHub setup, the VPC route table controls how traffic from the VPC is forwarded to the on-premises network via the virtual private gateway (VGW). By adding a static route with a more specific prefix (e.g., a /24 instead of a /16) for the on-premises network, you force the VPC to prefer that route over any dynamically learned routes from other CGWs, ensuring all traffic uses the designated CGW. This approach leverages the longest prefix match rule in the VPC route table, overriding BGP-learned routes without altering the BGP configuration.

Answer

Adjust the BGP local preference on the preferred CGW to a higher value

Answer

Remove the other CGWs from the VGW

Answer

Modify the VPN tunnel option to prefer the specific tunnel

Question 14

Which THREE actions are required to enable an EC2 instance in a private subnet to download software updates from the internet? (Select THREE.)

Accepted Answer

Create a NAT Gateway in a public subnet. Option C is correct because a NAT Gateway must be created in a public subnet (with a route to an Internet Gateway) so it can forward the private instance's traffic to the internet. Option D is correct because the private subnet's route table must have a route with destination 0.0.0.0/0 targeting the NAT Gateway, otherwise the instance's outbound packets have no path to the internet. Option E is correct because the VPC needs an Internet Gateway attached so the public subnet (and thus the NAT Gateway) can reach the internet. Option A is not required because NAT Gateways use an automatically assigned public IP via an Elastic IP that AWS manages at creation; you do not separately allocate and associate an EIP as a distinct required action. Option B is not required because security groups are stateful and allow all outbound traffic by default, so no explicit outbound rule to 0.0.0.0/0 is needed to enable the updates.

Answer

Allocate an Elastic IP and associate it with the NAT Gateway

Answer

Configure the security group to allow outbound traffic to 0.0.0.0/0

Question 15

Refer to the exhibit. An EC2 instance in a VPC is assigned a public IP via an Elastic IP address. The instance is not reachable from the internet, although it has a security group allowing inbound HTTP traffic from 0.0.0.0/0. The VPC has an Internet Gateway attached to the route table of the subnet. What is the MOST likely cause?

Accepted Answer

The subnet route table does not have a default route (0.0.0.0/0) to the Internet Gateway. The most likely cause is that the subnet's route table lacks a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). Without this route, traffic destined for the internet from the instance has no path to the IGW, and return traffic from the internet cannot reach the instance. Even with a public Elastic IP and a permissive security group, the VPC's routing logic prevents internet-bound packets from being forwarded to the IGW.

Answer

The source/destination check is enabled and should be disabled

Answer

The security group is blocking inbound traffic

Answer

The Elastic IP is not correctly associated with the instance