ANS-C01 Network Implementation Practice Test 12 — 15 Questions

Question 1

A company is deploying a multi-tier web application across three Availability Zones in a VPC. The web tier must be highly available and scale based on CPU utilization. The database tier uses an Amazon RDS Multi-AZ DB instance. The web tier must have the lowest possible latency to the internet. Which configuration should be used for the web tier subnets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the web tier in public subnets with auto-assign public IP addresses enabled.. Placing the web tier in public subnets with auto-assign public IP addresses enabled ensures that each EC2 instance receives a public IPv4 address automatically, allowing direct internet access for low-latency communication. Public subnets have a route to an internet gateway, which provides the shortest path to the internet without additional hops. This configuration supports high availability across three Availability Zones and integrates with an Auto Scaling group based on CPU utilization.

Answer

Place the web tier in public subnets with auto-assign public IP addresses disabled.

Answer

Place the web tier in private subnets and use a VPC endpoint for internet access.

Answer

Place the web tier in private subnets and use a NAT gateway for internet access.

Question 2

A company wants to connect its on-premises data center to AWS using AWS Direct Connect. The company requires a dedicated 1 Gbps connection with low latency and high bandwidth for mission-critical workloads. Which type of Direct Connect interface should be used?

Accepted Answer

Dedicated Connection. A Dedicated Connection (Option D) is correct because it provides a physical, single-tenant Ethernet connection from the on-premises data center directly to AWS, offering dedicated 1 Gbps or 10 Gbps bandwidth with consistent low latency and high availability for mission-critical workloads. Unlike hosted connections, a dedicated connection is provisioned as a physical port at an AWS Direct Connect location, ensuring exclusive use and predictable performance without contention from other customers.

Answer

AWS Transit VIF

Answer

VPN Connection

Answer

Hosted Connection

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has three subnets: 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24. An EC2 instance in subnet 10.0.1.0/24 needs to send traffic to an on-premises server at 10.0.0.5/32 via a VPN connection. The VPC route table has a route to the VPN gateway for 10.0.0.0/8. What is the expected behavior?

Accepted Answer

Traffic to 10.0.0.5 stays within the VPC.. The VPC's CIDR is 10.0.0.0/16, and the destination 10.0.0.5/32 falls within this range. AWS VPCs use the most specific route that matches the destination IP, and the local route (10.0.0.0/16) is automatically added to all VPC route tables. Since 10.0.0.5/32 is a subset of 10.0.0.0/16, the local route takes precedence over the VPN route (10.0.0.0/8) because it is more specific (longer prefix length). Therefore, traffic destined to 10.0.0.5 stays within the VPC and is not sent to the VPN gateway.

Answer

Traffic to 10.0.0.5 is sent to the internet gateway.

Answer

Traffic to 10.0.0.5 is routed through the VPN gateway.

Answer

Traffic to 10.0.0.5 is dropped because there is no matching route.

Question 4

A company is designing a network for a highly available application across multiple AWS regions. The application requires low-latency communication between regions and uses IP addresses that cannot change. Which AWS service should be used to connect the VPCs in different regions?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it establishes a direct, private network connection between two VPCs in different AWS regions using AWS's global backbone, enabling low-latency communication without requiring public internet traversal. It supports inter-region peering (since 2017) and allows the use of private IP addresses that remain unchanged, satisfying the requirement for fixed IPs.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

Internet Gateway

Question 5

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket to download files. The company wants to avoid using a NAT gateway and minimize latency. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the private subnet's route table.. A VPC endpoint for S3 allows the EC2 instance in the private subnet to access S3 directly over the AWS network, avoiding internet-bound traffic and eliminating the need for a NAT gateway. This minimizes latency because traffic stays within the AWS backbone and does not traverse the public internet. Attaching the endpoint to the private subnet's route table ensures that S3-bound traffic is routed through the endpoint.

Answer

Place the instance in a public subnet and use a NAT gateway.

Answer

Use a VPC endpoint for EC2.

Answer

Use an internet gateway and a route to 0.0.0.0/0.

Question 6

A company is deploying a VPC with a CIDR block of 10.0.0.0/16. The VPC requires six subnets: three public and three private, each with a /24 CIDR. The company needs to ensure high availability across three Availability Zones. Which TWO of the following are valid subnet CIDR assignments that meet these requirements?

Accepted Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.3.0/24, 10.0.4.0/24, 10.0.5.0/24. It assigns six distinct, non-overlapping /24 subnets within 10.0.0.0/16: public 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24 and private 10.0.3.0/24, 10.0.4.0/24, 10.0.5.0/24, which can each be placed in a separate Availability Zone for high availability. Option C is also correct because it uses six unique, non-overlapping /24 blocks within the VPC range — public 10.0.0.0/24, 10.0.2.0/24, 10.0.4.0/24 and private 10.0.1.0/24, 10.0.3.0/24, 10.0.5.0/24 — again allowing one subnet per AZ across three AZs. Options A and E are invalid because their private /25 subnets (10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25) overlap the public /24 subnets, and they are /25 rather than the required /24. Option D is invalid because its public subnets 10.0.0.0/24, 10.0.0.0/25, and 10.0.0.128/25 overlap each other, and its private subnets 10.0.1.0/24, 10.0.1.0/25, and 10.0.1.128/25 also overlap, violating the requirement for six distinct /24 subnets.

Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

Answer

Public: 10.0.0.0/24, 10.0.0.0/25, 10.0.0.128/25; Private: 10.0.1.0/24, 10.0.1.0/25, 10.0.1.128/25

Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

Question 7

A company is designing a hybrid network using AWS Direct Connect. The company has a single 1 Gbps dedicated connection and wants to connect to multiple VPCs in the same region. Which THREE steps are necessary to achieve this connectivity?

Accepted Answer

Create a Direct Connect gateway.. Option A is correct because a Direct Connect gateway is the global resource that allows a single Direct Connect connection to reach multiple VPCs, including VPCs in different regions, by acting as the aggregation point between the connection and the virtual interfaces. Option D is correct because the VPCs must be attached to an AWS Transit Gateway, which serves as the regional hub that the Direct Connect gateway connects to, enabling connectivity to multiple VPCs through a single association. Option E is correct because a transit virtual interface is the specific virtual interface type required to connect the Direct Connect connection to the transit gateway, and it must be associated with that transit gateway to carry traffic to the attached VPCs. Option B is incorrect because private virtual interfaces connect to a single VPC via a virtual private gateway, which does not scale to multiple VPCs in the way described and is not the transit-based design required here. Option C is incorrect because public virtual interfaces are used to access AWS public services such as S3 or DynamoDB over public IP addresses, not to reach private VPC resources.

Answer

Create a private virtual interface for each VPC.

Answer

Create a public virtual interface for each VPC.

Question 8

A company is using CloudFormation to deploy a VPC. The private subnet route table has a route to a NAT gateway. However, instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet and has an attached Elastic IP. What is the most likely issue?

Accepted Answer

The NAT gateway's security group is blocking traffic from the private subnet.. The NAT gateway has a security group that by default denies all inbound traffic. For instances in the private subnet to send traffic to the internet, the NAT gateway's security group must allow inbound traffic from the private subnet's CIDR (or from the private subnet's network ACLs) and allow outbound traffic to the internet. Option D is correct because this is the most likely issue: the security group is blocking traffic. Option A is incorrect because the public subnet route to the IGW is presumptively configured correctly for the NAT gateway to reach the internet. Option B is incorrect because the route to the NAT gateway is present in the private route table. Option C is incorrect because the NAT gateway does not need to be in the same subnet as the private instances; it must be in a public subnet.

Answer

The public subnet does not have a route to the internet gateway.

Answer

The private subnet route table does not have a route to the NAT gateway.

Answer

The NAT gateway is not in the same subnet as the private instances.

Question 9

A network engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint allows private subnet resources to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3-bound traffic to a highly available, horizontally scaled gateway endpoint, avoiding NAT or internet gateway costs and latency.

Answer

VPC Peering

Answer

Internet Gateway

Answer

NAT Gateway

Question 10

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They also have a VPN connection as a backup. How should they configure BGP to ensure that the VPN is only used when Direct Connect fails?

Accepted Answer

Use a higher local preference on the Direct Connect BGP session. Local preference is a BGP attribute used to influence outbound traffic from an AS. By setting a higher local preference on the Direct Connect BGP session, the router will prefer that path over the VPN session. When Direct Connect fails, the BGP session goes down, and the VPN route becomes the only available path, ensuring seamless failover.

Answer

Use a lower local preference on the Direct Connect BGP session

Answer

Use a lower AS path prepend on the VPN BGP session

Answer

Use a higher MED on the VPN BGP session

Question 11

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. What should be done to avoid overlapping CIDRs?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources. AWS Site-to-Site VPN requires non-overlapping IP CIDRs between the VPC and the on-premises network for proper routing. The VPC uses 10.0.0.0/16, which falls entirely within the on-premises 10.0.0.0/8, causing a conflict that prevents the VPN from establishing routes correctly. Creating a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) and migrating resources resolves the overlap, enabling the VPN connection.

Answer

Configure a VPN with overlapping CIDRs, it will still work

Answer

Use NAT on the customer gateway to translate addresses

Answer

Use VPC peering to connect to on-premises

Question 12

Which TWO of the following are valid methods to connect an on-premises data center to an Amazon VPC over a private, dedicated network connection? (Choose two.)

Accepted Answer

AWS Direct Connect. Option B (AWS Direct Connect) is correct because it establishes a dedicated, private physical network connection between an on-premises data center and AWS, bypassing the public internet entirely. Option C (AWS Direct Connect with a VPN (IPsec) over the private VIF) is also correct because it combines the dedicated Direct Connect link with an IPsec VPN tunnel over the private virtual interface, providing an encrypted private connection between on-premises and the VPC. Option A (VPC peering) is incorrect because it connects two VPCs to each other, not an on-premises data center to a VPC. Option D (AWS Site-to-Site VPN over the internet) is incorrect because it traverses the public internet rather than a private, dedicated connection. Option E (AWS Client VPN) is incorrect because it is a managed client-based VPN for individual remote users, not a dedicated data center-to-VPC link.

Answer

VPC peering

Answer

AWS Site-to-Site VPN over the internet

Answer

AWS Client VPN

Question 13

Which THREE of the following are valid configurations for an AWS Direct Connect virtual interface? (Choose three.)

Accepted Answer

Private virtual interface. Option B (Private virtual interface) is correct because a private VIF connects your on-premises network via Direct Connect to resources in a VPC using private IP addresses, typically through a virtual private gateway or Direct Connect gateway. Option D (Transit virtual interface) is correct because a transit VIF attaches to a Direct Connect gateway and provides access to multiple VPCs through a transit gateway, supporting larger BGP route limits. Option E (Public virtual interface) is correct because a public VIF lets you reach AWS public services (such as S3 and DynamoDB) and public IP space in any AWS region over the Direct Connect connection. Option A (VPN virtual interface) is not a valid Direct Connect VIF type—VPN connectivity is provided by AWS Site-to-Site VPN, not by a Direct Connect virtual interface. Option C (Hosted virtual interface) is not a VIF type itself; hosted virtual interfaces are private or public VIFs provisioned by an AWS Direct Connect Partner on your behalf, so 'hosted' describes the provisioning model rather than a distinct valid VIF configuration.

Answer

VPN virtual interface

Answer

Hosted virtual interface

Question 14

A company has an S3 bucket with the bucket policy shown. The VPC endpoint ID is correct. However, an EC2 instance in a private subnet in the same VPC cannot download objects from the bucket. What is a possible reason?

Accepted Answer

The EC2 instance is accessing S3 via a NAT Gateway instead of the VPC endpoint. The bucket policy likely includes a condition that restricts access to only requests originating from the VPC endpoint (e.g., `aws:sourceVpce`). If the EC2 instance in the private subnet routes traffic through a NAT Gateway instead of the VPC endpoint, the source IP will be the NAT Gateway's public IP, not the VPC endpoint's private IP, causing the condition to fail and the request to be denied. The instance can still reach S3 via the NAT Gateway, but the policy explicitly blocks non-endpoint traffic.

Answer

The EC2 instance does not have a route to the VPC endpoint

Answer

The bucket policy does not allow s3:ListBucket

Answer

The VPC endpoint security group is blocking traffic

Question 15

A network engineer created the CloudFormation stack shown. After creation, an EC2 instance launched in PublicSubnet does not have a public IP address. What is the most likely reason?

Accepted Answer

The VPC does not have an Internet Gateway attached. An EC2 instance in a public subnet requires an Internet Gateway (IGW) attached to the VPC to receive a public IP address. Without an IGW, the instance cannot be assigned a public IP or communicate with the internet, even if the subnet is configured to auto-assign public IPs. The CloudFormation stack likely omitted the IGW resource or its attachment to the VPC, leaving the VPC isolated.

Answer

The subnet does not have an Internet Gateway attached

Answer

The subnet's route table does not have a route to a NAT Gateway

Answer

The instance type does not support public IP addresses