ANS-C01 Network Implementation Practice Test 12 — 15 Questions

Question 1

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to add IPv6 support for its public-facing web application. The application must be accessible via both IPv4 and IPv6. The VPC already has an Internet Gateway attached. What is the correct set of steps to enable IPv6?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and allocate IPv6 addresses to the subnets.. Option D is correct because to enable IPv6, you must associate an Amazon-provided IPv6 CIDR block with the VPC, update the route table to include a route for ::/0 to the Internet Gateway, and ensure the subnet has an IPv6 CIDR. Option A is wrong because you cannot assign a /64 block to a VPC. Option B is wrong because Egress-Only Internet Gateway is for outbound-only IPv6, not inbound. Option C is wrong because you cannot assign a custom IPv6 block without requesting it.

Answer

Assign a custom IPv6 CIDR block from your own range to the VPC and add a route to the Internet Gateway.

Answer

Associate an IPv6 CIDR block, create an Egress-Only Internet Gateway, and route ::/0 to it.

Answer

Associate a /64 IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and assign IPv6 addresses to instances.

Question 2

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Answer

Amazon RDS instance

Answer

NAT Gateway

Answer

Amazon S3

Question 3

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

Accepted Answer

Establish VPC peering connections in a full mesh and manage routes centrally.. Correct: A (Transit Gateway with central VPC) and D (VPC peering with full mesh) are valid hub-and-spoke methods. B is wrong because VPNs are not typically used for VPC-to-VPC. C is wrong because VPC endpoints are for connecting to AWS services, not VPCs. E is wrong because Direct Connect is for on-premises, not VPC-to-VPC.

Answer

Create a VPN connection between each VPC and a central VPN appliance.

Answer

Use Direct Connect to connect VPCs.

Answer

Use VPC Gateway Endpoints to connect VPCs.

Question 4

A company is using AWS Direct Connect with a public virtual interface to access Amazon S3. The on-premises network has a firewall that only allows traffic to specific IP prefixes. What is the best practice to ensure connectivity while maintaining security?

Accepted Answer

Use the S3 IP prefix list from AWS to create firewall rules.. Option C is correct because using the S3 public IP prefix list from AWS allows you to restrict traffic to known S3 IPs. Option A is wrong because S3 does not have a single IP. Option B is wrong because a private VIF is for VPC access, not S3. Option D is wrong because a VPN does not replace Direct Connect.

Answer

Allow all traffic to the AWS region's IP range.

Answer

Set up a Site-to-Site VPN tunnel over Direct Connect.

Answer

Use a private virtual interface and connect through a VPC endpoint.

Question 5

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Accepted Answer

Deploy firewall endpoints in at least two Availability Zones for high availability.. Correct: B (deploy in multiple AZs for HA) and D (use stateful rules for traffic inspection). A is wrong because it should be in a dedicated subnet. C is wrong because stateless rules are not the primary use case. E is wrong because Network Firewall supports both stateful and stateless.

Answer

Use only stateless rules to minimize processing overhead.

Answer

Use Network Firewall only for outbound traffic filtering.

Answer

Deploy the firewall in the same subnet as the workload for low latency.

Question 6

A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?

Accepted Answer

Use managed prefix lists in security group rules.. Option D is correct because using prefix lists allows referencing a CIDR collection in security group rules. Option A is wrong because NACLs are stateless and less granular. Option B is wrong because VPC endpoints are for AWS services. Option C is wrong because Network Firewall adds complexity.

Answer

Use VPC endpoints for inter-VPC communication.

Answer

Deploy AWS Network Firewall to centralize rules.

Answer

Replace security groups with network ACLs.

Question 7

Which THREE of the following are considerations when designing a Direct Connect implementation for high availability? (Choose three.)

Accepted Answer

Use BGP to advertise the same prefixes over both connections.. Correct: A (redundant connections), C (different locations), and D (BGP routing). B is wrong because single connection cannot provide HA. E is wrong because VPN is a separate backup, not a Direct Connect design consideration.

Answer

Use a single connection with high bandwidth.

Answer

Configure static routes to the on-premises network.

Question 8

A company is deploying a public-facing web application on EC2 instances behind an Application Load Balancer. The ALB is configured to terminate HTTPS using a certificate from AWS Certificate Manager. What additional step is required to ensure the ALB can validate the certificate?

Accepted Answer

Ensure the certificate is in the same AWS region as the ALB.. Option B is correct because ACM certificates must be in the same region as the ALB. Option A is wrong because DNS validation is not required for ALB. Option C is wrong because private CA is not needed. Option D is wrong because CloudFront is a different service.

Answer

Attach the certificate to an Amazon CloudFront distribution.

Answer

Create a DNS record to validate domain ownership.

Answer

Import the certificate into AWS Certificate Manager Private Certificate Authority.

Question 9

A company is deploying a VPC with public and private subnets in two Availability Zones. The workloads in the private subnets need to access the internet for software updates. What is the MOST secure way to provide this internet access?

Accepted Answer

Deploy a NAT gateway in a public subnet and update the private subnets' route table to point default traffic to the NAT gateway.. Using a NAT gateway in a public subnet is the most secure approach because it allows outbound traffic while preventing inbound connections from the internet. Option A is wrong because an internet gateway attached to private subnets would expose them directly. Option C is wrong because a transit gateway is for connecting multiple VPCs, not providing internet access. Option D is wrong because a VPN connection is for private connectivity, not internet access.

Answer

Set up a VPN connection to an on-premises network with internet access.

Answer

Use a transit gateway with a VPC attachment and route internet traffic through a centralized inspection VPC.

Answer

Attach an internet gateway to the VPC and route the private subnets' traffic to it.

Question 10

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

Accepted Answer

The instances are in different Availability Zones.. The primary cause of higher latency between EC2 instances in different Availability Zones is the physical distance and the additional network hops required to traverse the AZ boundary. Even within the same VPC, traffic between AZs must pass through AWS's regional network infrastructure, which introduces a baseline latency of 1-2 milliseconds, whereas instances in the same AZ can communicate with sub-millisecond latency. The question explicitly states the instances are in different AZs, making this the most likely source of the latency issue.

Answer

The instances are using jumbo frames.

Answer

The instances are in a cluster placement group.

Answer

The instances have Enhanced Networking enabled.

Question 11

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC with public and private subnets. The ALB is in public subnets, and the web servers are in private subnets. Clients report intermittent connection errors. Investigation shows that the ALB is marking targets as unhealthy. What is the MOST likely cause?

Accepted Answer

The health check is configured to use the public IP address of the targets, but the targets are in private subnets without public IPs.. If the ALB health checks are configured to use the public IP of the targets, the private subnet instances will not respond because they do not have public IPs. Option A is wrong because security groups should allow traffic from the ALB. Option B is wrong because the ALB is in public subnets. Option D is wrong because security groups should be on the instance side.

Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB.

Answer

The security group for the web servers does not allow inbound traffic from the internet.

Answer

The ALB is deployed in private subnets and cannot reach the internet.

Question 12

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise routes to the VPC. The company wants to extend this connectivity to a second VPC in the same region without creating additional Direct Connect connections. Which solution should be used?

Accepted Answer

Use a transit gateway and attach both VPCs and the Direct Connect private VIF.. Option A is correct because a transit gateway can be attached to both VPCs and the Direct Connect VIF, enabling connectivity. Option B is wrong because VPC peering does not support Direct Connect. Option C is wrong because an additional VIF is not required. Option D is wrong because VPN is not needed.

Answer

Create a second Direct Connect private VIF for the second VPC.

Answer

Set up a Site-to-Site VPN from the on-premises network to the second VPC.

Answer

Create a VPC peering connection between the two VPCs.

Question 13

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances. Which AWS service can support multicast within a VPC?

Accepted Answer

Transit Gateway with multicast domain. AWS Transit Gateway supports multicast traffic through the creation of a multicast domain, which allows EC2 instances in different VPCs or subnets to send and receive multicast traffic. This is the only native AWS service that supports multicast within a VPC environment, making it the correct choice for migrating a legacy application that requires multicast.

Answer

VPC native multicast

Answer

Amazon CloudFront

Answer

Application Load Balancer

Question 14

A financial services company is designing a multi-region architecture for disaster recovery. They have a primary VPC in us-east-1 and a standby VPC in us-west-2. Each VPC has its own CIDR block (10.0.0.0/16 and 10.1.0.0/16). They want to use an inter-region VPC peering connection for replication traffic. Which of the following is a required step to establish this peering connection?

Accepted Answer

The owner of each VPC must accept the peering connection request.. For inter-region VPC peering, the owner of each VPC must accept the peering request. Option A is wrong because VPC peering does not use a VPN connection. Option B is wrong because the CIDR blocks are already non-overlapping. Option D is wrong because the peering connection is a single entity; you do not create two separate connections.

Answer

Ensure the VPC CIDR blocks do not overlap.

Answer

Create a VPN attachment between the two VPCs using AWS Site-to-Site VPN.

Answer

Create two separate peering connections, one for each direction of traffic.

Question 15

A company is deploying a web application across multiple Availability Zones in a VPC. The application tier consists of EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which solution meets this requirement?

Accepted Answer

Use an HTTPS listener on the ALB with a target group that uses HTTPS.. Option B is correct because using an HTTPS listener on the ALB with a target group that uses HTTPS ensures end-to-end encryption. Option A is incorrect because TCP listeners do not encrypt traffic. Option C is incorrect because internal ALBs still require HTTPS listeners for encryption. Option D is incorrect because security groups do not provide encryption.

Answer

Use an internal ALB with a TCP listener and a security group that allows only HTTPS.

Answer

Use an HTTP listener on the ALB and enable encryption on the security group.

Answer

Use a TCP listener on the ALB with a target group that uses TCP.