ANS-C01 Network Implementation Practice Test 12 — 15 Questions

Question 1

A company has a VPC with a transit gateway (TGW) connected to multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises a specific prefix 10.0.0.0/16. A VPC attachment in the same region also advertises the same prefix. The TGW route table has the on-premises route as static and the VPC route as propagated. Which route will be used for traffic destined to 10.0.0.5?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The static route to on-premises. When a transit gateway (TGW) receives both a static route and a propagated route for the same prefix, the static route takes precedence regardless of the propagation source. This is because static routes have a higher administrative distance (lower priority number) than dynamically learned routes. Therefore, traffic destined to 10.0.0.5 will be forwarded via the Direct Connect attachment to the on-premises network.

Answer

The propagated route from VPC

Answer

Both routes will be used with ECMP

Answer

The route with the shortest AS_PATH

Question 2

An application running on EC2 instances in a private subnet needs to send logs to Amazon CloudWatch Logs. Which step is essential to allow this communication without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for CloudWatch Logs and update the route table.. Amazon CloudWatch Logs supports both VPC Gateway Endpoints and VPC Interface Endpoints (PrivateLink). However, a Gateway Endpoint is more efficient as it does not require an Elastic Network Interface (ENI) and is accessed via route table entries, making it a simpler and more cost-effective solution for this scenario. Therefore, Option B is the appropriate choice.

Answer

Create a VPC Interface Endpoint for CloudWatch Logs and attach it to the subnet.

Answer

Assign a public IP to the EC2 instance and route directly to the internet.

Answer

Attach a NAT Gateway to the private subnet and route traffic to the internet.

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to establish connectivity to an on-premises network via AWS Site-to-Site VPN. The on-premises network uses a CIDR block of 192.168.0.0/16. The VPN connection will be redundant using two tunnels. Which THREE actions are required to enable this connectivity?

Accepted Answer

Create a Customer Gateway (CGW) in the same AWS region.. To establish an AWS Site-to-Site VPN, three actions are required: creating a Customer Gateway (CGW), creating a Virtual Private Gateway (VGW) and attaching it to the VPC, and adding a route in the VPC route tables pointing to the VGW for the on-premises CIDR. The correct answers are A, C, and E.

Answer

Create a Direct Connect virtual interface.

Answer

Configure a NAT Gateway in the VPC.

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise its prefixes. Recently, the on-premises router started advertising a more specific route (10.0.0.0/24) that overlaps with the VPC's CIDR (10.0.0.0/16). What is the impact on traffic destined to 10.0.0.5?

Accepted Answer

Return traffic from the instance to on-premises is routed through Direct Connect instead of staying within the VPC.. When an on-premises router advertises a more specific route (10.0.0.0/24) via BGP over a Direct Connect private VIF, the VPC propagates this route into its route tables. For traffic destined to 10.0.0.5, the VPC now has a more specific route (10.0.0.0/24) pointing to the virtual private gateway (VGW), overriding the local VPC route (10.0.0.0/16). This causes return traffic from the instance to on-premises to be routed through Direct Connect instead of staying within the VPC, as the VPC's route table prefers the longest prefix match.

Answer

The instance becomes unreachable from on-premises.

Answer

Traffic destined to the instance is blackholed.

Answer

Traffic is load-balanced between the VPC and Direct Connect.

Question 5

A company is deploying a global application and wants to use AWS Global Accelerator to improve performance. The application runs behind an Application Load Balancer (ALB) in us-east-1. Which THREE components are part of a Global Accelerator deployment?

Accepted Answer

Endpoint groups. Endpoint groups are a core component of AWS Global Accelerator that define the AWS Region and traffic routing for a listener. Each endpoint group contains one or more endpoints (such as an ALB, NLB, or EC2 instance) and allows you to control traffic distribution and health checking. In this scenario, the ALB in us-east-1 would be added to an endpoint group associated with that region.

Answer

Route 53 hosted zones

Answer

Lambda@Edge functions

Question 6

A company is deploying a multi-tier application across multiple VPCs connected via AWS Transit Gateway. The web tier must be able to initiate connections to the app tier, but the app tier must not be able to initiate connections to the web tier. How can this be achieved?

Accepted Answer

Deploy a centralized firewall appliance in a shared VPC and use Transit Gateway to route all inter-VPC traffic through it.. Routing all inter-VPC traffic through a centralized firewall appliance in a shared VPC via Transit Gateway allows you to enforce stateful inspection and access control policies. The firewall can be configured to permit only outbound connections from the web tier to the app tier while blocking any inbound connections initiated by the app tier, thus meeting the requirement without relying on VPC-native constructs that cannot enforce unidirectional stateful filtering across VPCs.

Answer

Configure network ACLs on the web tier subnets to allow outbound traffic and deny inbound from app tier.

Answer

Establish VPC peering between the web and app VPCs and restrict routes.

Answer

Use security groups across the VPCs by referencing each other's CIDR blocks.

Question 7

A network engineer needs to monitor network traffic in a VPC. Which TWO AWS services can capture and analyze VPC flow logs?

Accepted Answer

Amazon S3. Amazon S3 is a correct destination for VPC Flow Logs because you can publish flow log data directly to an S3 bucket, where it can be stored, queried with Amazon Athena, or processed by other analytics tools. Amazon CloudWatch Logs is also a correct destination, allowing you to publish flow logs to a log group for real-time monitoring, metric filters, and integration with CloudWatch alarms or third-party solutions via subscription filters.

Answer

Amazon GuardDuty

Answer

VPC Traffic Mirroring

Answer

AWS Config

Question 8

A company needs to connect its on-premises data center to AWS using a site-to-site VPN. The on-premises firewall does not support IPsec. What alternative solution can the company use?

Accepted Answer

Use AWS Client VPN to establish a VPN connection from the on-premises network.. AWS Client VPN is a managed, OpenVPN-based service that allows on-premises clients to securely access AWS resources without requiring IPsec support on the on-premises firewall. Since the firewall does not support IPsec, Client VPN provides an alternative by using TLS-based VPN tunnels that only require standard TCP/UDP ports (typically 443) to be open, making it compatible with nearly any firewall.

Answer

Create a VPC peering connection between the on-premises router and the VPC.

Answer

Deploy an AWS Transit Gateway and attach the on-premises network via a VPC attachment.

Answer

Use AWS Direct Connect to establish a dedicated physical link.

Question 9

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

Accepted Answer

Traffic goes through the NAT Gateway nat-67890.. When a subnet is created in a VPC without an explicit route table association, it is implicitly associated with the VPC's main route table. The main route table in this scenario includes a default route (0.0.0.0/0) pointing to NAT Gateway nat-67890, so internet-bound traffic from this subnet is directed through the NAT Gateway. This allows instances in private subnets to initiate outbound internet connections while preventing inbound traffic from the internet.

Answer

Traffic is dropped because no explicit association is set.

Answer

Traffic goes through the Internet Gateway.

Answer

Traffic is dropped because no Internet Gateway is present.

Question 10

A company uses AWS Transit Gateway to connect multiple VPCs. The network team notices that traffic between two VPCs is taking a suboptimal path through a third VPC. What is the most likely cause?

Accepted Answer

Incorrect route table associations and propagations in the Transit Gateway.. Incorrect route table associations and propagations in the Transit Gateway cause traffic between two VPCs to take a suboptimal path through a third VPC. The Transit Gateway uses route tables to determine the next hop for traffic; if the route table for the source VPC does not have a direct route to the destination VPC but instead has a route pointing to the third VPC (e.g., via a VPN attachment or a transit VPC attachment), traffic will be forwarded through that third VPC. This is a common misconfiguration when route propagation is not properly set up or when static routes are incorrectly prioritized.

Answer

Security groups are blocking the direct path, forcing traffic through a third VPC.

Answer

BGP is not configured between the VPCs, so traffic defaults through a transit VPC.

Answer

ECMP routing is enabled, causing traffic to be load-balanced across multiple paths.

Question 11

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

Accepted Answer

The transit gateway route table propagation is not configured.. The exhibit shows a transit gateway route table attached to the VPC, but no propagation is configured. Without explicit propagation, the VPC attachment's CIDR blocks are not automatically added to the transit gateway route table. The CloudFormation resource AWS::EC2::TransitGatewayRouteTablePropagation must be declared to enable route propagation from the VPC attachment into the transit gateway route table.

Answer

The VPC attachment is not in the 'available' state.

Answer

VPN ECMP support is enabled, preventing propagation.

Answer

DNS support is disabled on the transit gateway.

Question 12

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to add IPv6 support for its public-facing web application. The application must be accessible via both IPv4 and IPv6. The VPC already has an Internet Gateway attached. What is the correct set of steps to enable IPv6?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and allocate IPv6 addresses to the subnets.. To enable IPv6 in a VPC, you must associate an Amazon-provided IPv6 CIDR block (a /56 block by default), add a route for the IPv6 default route (::/0) to the Internet Gateway, and allocate IPv6 addresses to the subnets. The Internet Gateway already supports IPv6 traffic natively, so no additional gateway is required for public-facing IPv6 access.

Answer

Assign a custom IPv6 CIDR block from your own range to the VPC and add a route to the Internet Gateway.

Answer

Associate an IPv6 CIDR block, create an Egress-Only Internet Gateway, and route ::/0 to it.

Answer

Associate a /64 IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and assign IPv6 addresses to instances.

Question 13

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Answer

Amazon RDS instance

Answer

NAT Gateway

Answer

Amazon S3

Question 14

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

Accepted Answer

Establish VPC peering connections in a full mesh and manage routes centrally.. VPC peering connections can be arranged in a full mesh, and by centrally managing route tables (e.g., using a centralized route management tool or a central VPC with route propagation), you can enforce a hub-and-spoke routing pattern. Option D is correct because AWS Transit Gateway inherently supports hub-and-spoke topologies by attaching multiple VPCs to a single gateway, which acts as the hub, and allows centralized control over routing and security policies.

Answer

Create a VPN connection between each VPC and a central VPN appliance.

Answer

Use Direct Connect to connect VPCs.

Answer

Use VPC Gateway Endpoints to connect VPCs.

Question 15

A company is using AWS Direct Connect with a public virtual interface to access Amazon S3. The on-premises network has a firewall that only allows traffic to specific IP prefixes. What is the best practice to ensure connectivity while maintaining security?

Accepted Answer

Use the S3 IP prefix list from AWS to create firewall rules.. AWS publishes managed prefix lists for each service, including Amazon S3, which contain the specific IP prefixes used by S3 in each region. By using these prefix lists in firewall rules, you can allow only the necessary S3 traffic while maintaining strict security, rather than permitting the entire region's IP range. This approach aligns with the principle of least privilege and ensures connectivity over the public VIF without exposing on-premises networks to unnecessary traffic.

Answer

Allow all traffic to the AWS region's IP range.

Answer

Set up a Site-to-Site VPN tunnel over Direct Connect.

Answer

Use a private virtual interface and connect through a VPC endpoint.