ANS-C01 Network Implementation Practice Test 13 — 15 Questions

Question 1

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Accepted Answer

Deploy firewall endpoints in at least two Availability Zones for high availability.. Deploying AWS Network Firewall endpoints in at least two Availability Zones ensures high availability and fault tolerance. If one AZ or firewall endpoint fails, traffic can be routed through the other, preventing a single point of failure. This aligns with AWS best practices for resilient network architectures.

Answer

Use only stateless rules to minimize processing overhead.

Answer

Use Network Firewall only for outbound traffic filtering.

Answer

Deploy the firewall in the same subnet as the workload for low latency.

Question 2

A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?

Accepted Answer

Use managed prefix lists in security group rules.. Use managed prefix lists. Prefix lists allow you to group CIDR blocks and reference them in security group rules, simplifying management. Option B is wrong because VPC endpoints are for accessing AWS services privately, not for inter-VPC communication. Option C is wrong because AWS Network Firewall adds another layer of complexity and cost; prefix lists achieve simplification more directly. Option D is wrong because network ACLs are stateless and less granular than security groups, and they cannot use prefix lists for rule simplification.

Answer

Use VPC endpoints for inter-VPC communication.

Answer

Deploy AWS Network Firewall to centralize rules.

Answer

Replace security groups with network ACLs.

Question 3

Which THREE of the following are considerations when designing a Direct Connect implementation for high availability? (Choose three.)

Accepted Answer

Use BGP to advertise the same prefixes over both connections.. Using BGP to advertise the same prefixes over both Direct Connect connections enables active-active or active-passive load balancing and automatic failover. BGP’s route selection and AS_PATH prepending allow you to control traffic flow, ensuring that if one connection fails, the other continues to advertise the same prefixes, maintaining connectivity without manual intervention.

Answer

Use a single connection with high bandwidth.

Answer

Configure static routes to the on-premises network.

Question 4

A company is deploying a public-facing web application on EC2 instances behind an Application Load Balancer. The ALB is configured to terminate HTTPS using a certificate from AWS Certificate Manager. What additional step is required to ensure the ALB can validate the certificate?

Accepted Answer

Ensure the certificate is in the same AWS region as the ALB.. For an Application Load Balancer to terminate HTTPS using a certificate from AWS Certificate Manager (ACM), the certificate must be in the same AWS region as the ALB. ACM certificates are region-specific resources; the ALB can only reference certificates that are stored in the same region where the ALB is deployed. This is a fundamental constraint of ACM integration with regional services like ALB.

Answer

Attach the certificate to an Amazon CloudFront distribution.

Answer

Create a DNS record to validate domain ownership.

Answer

Import the certificate into AWS Certificate Manager Private Certificate Authority.

Question 5

A company is deploying a VPC with public and private subnets in two Availability Zones. The workloads in the private subnets need to access the internet for software updates. What is the MOST secure way to provide this internet access?

Accepted Answer

Deploy a NAT gateway in a public subnet and update the private subnets' route table to point default traffic to the NAT gateway.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. This is the most secure and AWS-recommended method because it uses Source Network Address Translation (SNAT) to mask private IPs behind the NAT gateway's Elastic IP, and it requires only a route table update in the private subnets to direct default traffic (0.0.0.0/0) to the NAT gateway.

Answer

Set up a VPN connection to an on-premises network with internet access.

Answer

Use a transit gateway with a VPC attachment and route internet traffic through a centralized inspection VPC.

Answer

Attach an internet gateway to the VPC and route the private subnets' traffic to it.

Question 6

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

Accepted Answer

The instances are in different Availability Zones.. The primary cause of higher latency between EC2 instances in different Availability Zones is the physical distance and the additional network hops required to traverse the AZ boundary. Even within the same VPC, traffic between AZs must pass through AWS's regional network infrastructure, which introduces a baseline latency of 1-2 milliseconds, whereas instances in the same AZ can communicate with sub-millisecond latency. The question explicitly states the instances are in different AZs, making this the most likely source of the latency issue.

Answer

The instances are using jumbo frames.

Answer

The instances are in a cluster placement group.

Answer

The instances have Enhanced Networking enabled.

Question 7

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC with public and private subnets. The ALB is in public subnets, and the web servers are in private subnets. Clients report intermittent connection errors. Investigation shows that the ALB is marking targets as unhealthy. What is the MOST likely cause?

Accepted Answer

The health check is configured to use the public IP address of the targets, but the targets are in private subnets without public IPs.. When health checks are configured to use the public IP address of targets, the ALB attempts to reach the targets via the internet. Since the web servers are in private subnets without public IPs, the health check traffic cannot be routed to them, causing the ALB to mark them as unhealthy. Health checks must target private IP addresses within the VPC for instances in private subnets.

Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB.

Answer

The security group for the web servers does not allow inbound traffic from the internet.

Answer

The ALB is deployed in private subnets and cannot reach the internet.

Question 8

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise routes to the VPC. The company wants to extend this connectivity to a second VPC in the same region without creating additional Direct Connect connections. Which solution should be used?

Accepted Answer

Use a transit gateway and attach both VPCs and the Direct Connect private VIF.. A transit gateway allows you to centrally connect multiple VPCs and on-premises networks via a single Direct Connect private virtual interface. By attaching both VPCs and the Direct Connect private VIF to the transit gateway, the on-premises network can reach both VPCs without needing additional Direct Connect connections. This solution scales efficiently and supports transitive routing between all attached networks.

Answer

Create a second Direct Connect private VIF for the second VPC.

Answer

Set up a Site-to-Site VPN from the on-premises network to the second VPC.

Answer

Create a VPC peering connection between the two VPCs.

Question 9

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances. Which AWS service can support multicast within a VPC?

Accepted Answer

Transit Gateway with multicast domain. AWS Transit Gateway supports multicast traffic through the creation of a multicast domain, which allows EC2 instances in different VPCs or subnets to send and receive multicast traffic. This is the only native AWS service that supports multicast within a VPC environment, making it the correct choice for migrating a legacy application that requires multicast.

Answer

VPC native multicast

Answer

Amazon CloudFront

Answer

Application Load Balancer

Question 10

A financial services company is designing a multi-region architecture for disaster recovery. They have a primary VPC in us-east-1 and a standby VPC in us-west-2. Each VPC has its own CIDR block (10.0.0.0/16 and 10.1.0.0/16). They want to use an inter-region VPC peering connection for replication traffic. Which of the following is a required step to establish this peering connection?

Accepted Answer

The owner of each VPC must accept the peering connection request.. Inter-region VPC peering connections require both VPC owners to accept the peering request. In AWS, a VPC peering connection is a one-to-one relationship between two VPCs, and the request must be accepted by the owner of the accepter VPC (in this case, the standby VPC in us-west-2) after the requester VPC (us-east-1) initiates it. This acceptance is a mandatory step for the peering connection to become active, regardless of whether the VPCs are in the same or different regions.

Answer

Ensure the VPC CIDR blocks do not overlap.

Answer

Create a VPN attachment between the two VPCs using AWS Site-to-Site VPN.

Answer

Create two separate peering connections, one for each direction of traffic.

Question 11

A company is deploying a web application across multiple Availability Zones in a VPC. The application tier consists of EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which solution meets this requirement?

Accepted Answer

Use an HTTPS listener on the ALB with a target group that uses HTTPS.. To encrypt traffic between the Application Load Balancer (ALB) and the EC2 instances, the ALB must use an HTTPS listener and the target group must be configured with the HTTPS protocol. This ensures that the ALB terminates the client’s HTTPS connection and then re-encrypts traffic to the backend instances using TLS, meeting the security team’s requirement for end-to-end encryption.

Answer

Use an internal ALB with a TCP listener and a security group that allows only HTTPS.

Answer

Use an HTTP listener on the ALB and enable encryption on the security group.

Answer

Use a TCP listener on the ALB with a target group that uses TCP.

Question 12

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use a single Direct Connect connection to connect to multiple VPCs in different AWS accounts. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway (DX Gateway) is the correct service because it allows a single Direct Connect connection to be associated with multiple VPCs across different AWS accounts and regions. The DX Gateway acts as a regional or global transit hub, enabling private connectivity from on-premises to multiple VPCs without needing separate Direct Connect connections for each VPC. This is achieved by associating the DX Gateway with virtual private gateways (VGWs) in each target VPC, and then using AWS Resource Access Manager (RAM) to share the DX Gateway with other accounts.

Answer

Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 13

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table in the private subnet does not have a default route to the NAT gateway.. For an EC2 instance in a private subnet to reach the internet via a NAT gateway, the private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the target. Without this route, traffic destined for the internet has no path to the NAT gateway, so the instance can communicate within the VPC but cannot reach external hosts. Option D correctly identifies this missing route as the most likely cause.

Answer

The security group of the EC2 instance blocks outbound HTTPS traffic.

Answer

The NAT gateway does not have an Elastic IP address.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 14

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the public subnet is configured as a NAT instance. The company wants to replace the NAT instance with a NAT gateway for better availability and maintenance. After creating a NAT gateway in the public subnet and updating the route table of the private subnet, traffic from the private subnet cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The NAT gateway does not have an Elastic IP address associated with it.. A NAT gateway requires an Elastic IP address to function as a gateway for outbound internet traffic. Without an Elastic IP, the NAT gateway cannot perform source network address translation (SNAT), so instances in the private subnet cannot reach the internet. This is the most likely cause given that the route table update was already performed.

Answer

The public subnet's route table still points to the NAT instance for internet traffic.

Answer

The security group attached to the NAT gateway is blocking outbound traffic.

Answer

The private subnet's route table has a route for 0.0.0.0/0 pointing to the NAT instance instead of the NAT gateway.

Question 15

A company is designing a hybrid network using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to configure a virtual interface (VIF) that provides connectivity to multiple VPCs in the same region. Which type of VIF should they use?

Accepted Answer

Transit virtual interface. A transit virtual interface (VIF) is the correct choice because it is specifically designed to connect a Direct Connect gateway to a single physical connection, enabling connectivity to multiple VPCs in the same or different AWS Regions. Unlike a private VIF, which only connects to a single VPC, a transit VIF works with a Direct Connect gateway and supports up to 3,000 VPC attachments per gateway, making it ideal for multi-VPC architectures.

Answer

Hosted virtual interface

Answer

Public virtual interface

Answer

Private virtual interface