ANS-C01 Network Implementation Practice Test 13 — 15 Questions

Question 1

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use a single Direct Connect connection to connect to multiple VPCs in different AWS accounts. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows a single Direct Connect connection to be associated with multiple VPCs across accounts and regions. Option A is wrong because a VPN connection is separate. Option B is wrong because a transit gateway is used for inter-VPC routing but not directly for Direct Connect. Option D is wrong because VPC peering does not extend Direct Connect.

Answer

Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 2

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table in the private subnet does not have a default route to the NAT gateway.. Option C is correct because the route table associated with the private subnet must have a default route (0.0.0.0/0) pointing to the NAT gateway. Option A is incorrect because the NAT gateway itself does not require a public IP for outbound traffic (though it needs one for inbound). Option B is incorrect because security group rules are stateful and allow outbound traffic. Option D is incorrect because the NACL must allow outbound traffic, but the route is the primary issue.

Answer

The security group of the EC2 instance blocks outbound HTTPS traffic.

Answer

The NAT gateway does not have an Elastic IP address.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 3

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the public subnet is configured as a NAT instance. The company wants to replace the NAT instance with a NAT gateway for better availability and maintenance. After creating a NAT gateway in the public subnet and updating the route table of the private subnet, traffic from the private subnet cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The NAT gateway does not have an Elastic IP address associated with it.. The NAT gateway must have an Elastic IP to work. Option A is wrong because the route table should point to the NAT gateway. Option B is wrong because the private subnet's route table destination for 0.0.0.0/0 should be the NAT gateway. Option D is wrong because security groups on the NAT gateway are not applicable (NAT gateway is managed).

Answer

The public subnet's route table still points to the NAT instance for internet traffic.

Answer

The security group attached to the NAT gateway is blocking outbound traffic.

Answer

The private subnet's route table has a route for 0.0.0.0/0 pointing to the NAT instance instead of the NAT gateway.

Question 4

A company is designing a hybrid network using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to configure a virtual interface (VIF) that provides connectivity to multiple VPCs in the same region. Which type of VIF should they use?

Accepted Answer

Transit virtual interface. Option D is correct because a transit virtual interface connects to a Transit Gateway, which can then be attached to multiple VPCs. Option A is incorrect because a private VIF connects to a single VPC. Option B is incorrect because a public VIF is for public services. Option C is incorrect because a hosted VIF is for partner connections.

Answer

Hosted virtual interface

Answer

Public virtual interface

Answer

Private virtual interface

Question 5

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

Accepted Answer

Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.. Placing RDS in a database subnet group across multiple AZs and using a cluster with Multi-AZ provides high availability and low latency by ensuring the database endpoint is always in the same AZ as the application instance when possible. Option A is wrong because a single AZ creates a single point of failure. Option B is wrong because a Network Load Balancer for RDS is not standard. Option D is wrong because a single RDS instance in one AZ is not highly available.

Answer

Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.

Answer

Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.

Answer

Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.

Question 6

A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?

Accepted Answer

Route propagation and route tables in the VPC and on-premises.. Option A is correct because the route tables on the on-premises router and in the VPC must have routes for the remote networks. Option B is incorrect because the VPN tunnel being up indicates Phase 1 and 2 are likely fine. Option C is incorrect because security groups are stateful and allow ICMP if outbound is allowed. Option D is incorrect because the VPN connection is active.

Answer

The VPN connection status in the AWS console.

Answer

Security group inbound rules for ICMP on the EC2 instance.

Answer

IKE version mismatch between the VPN endpoints.

Question 7

A company has several VPCs in the same AWS account and region. They want to centrally manage and monitor network traffic between these VPCs and also to on-premises networks. Which AWS service should they use?

Accepted Answer

Transit Gateway. A transit gateway acts as a central hub for routing traffic between VPCs and on-premises networks. Option B is wrong because VPC peering is point-to-point, not centralized. Option C is wrong because Direct Connect alone does not connect VPCs. Option D is wrong because VPN CloudHub is for multiple VPN connections, not VPCs.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

AWS VPN CloudHub

Question 8

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block and ensure that traffic from the internet to the IPv6-enabled resources is allowed. Which configuration is required?

Accepted Answer

Attach an internet gateway and update route tables for IPv6.. Option B is correct because an internet gateway must be attached to the VPC and must be IPv6-compatible (allows egress-only or full dual-stack). Option A is incorrect because a NAT gateway is for outbound IPv4. Option C is incorrect because a Transit Gateway is for inter-VPC connectivity. Option D is incorrect because a Virtual Private Gateway is for VPN/Direct Connect.

Answer

Attach a NAT gateway to the VPC and update route tables.

Answer

Create a Virtual Private Gateway and attach the VPC.

Answer

Create a Transit Gateway and attach the VPC.

Question 9

A company is setting up a new VPC with a CIDR block of 10.0.0.0/16. They need to create subnets for different tiers: public (web servers), private (application servers), and database (RDS). They want to maximize the number of available IP addresses while ensuring each subnet has at least 256 IP addresses. Which subnet design meets these requirements?

Accepted Answer

Create six /24 subnets (256 IPs each) across two Availability Zones (three per AZ).. Using /24 subnets (256 IPs each) across three tiers in two AZs requires 6 subnets, which fits within the /16. Option A uses /25 (128 IPs) which is too small. Option B uses /24 but only one AZ, not highly available. Option D uses /26 (64 IPs) which is too small.

Answer

Create three /25 subnets (128 IPs each) in one Availability Zone.

Answer

Create six /26 subnets (64 IPs each) across two Availability Zones.

Answer

Create three /24 subnets (256 IPs each) in one Availability Zone.

Question 10

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The Transit Gateway route table has a static route for 10.0.0.0/8 pointing to the VPN attachment. However, traffic from on-premises to the VPC is not working. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.. Option C is correct because the VPC's route table has a local route for 10.0.0.0/16, but a more specific route to the Transit Gateway is needed for return traffic. Option A is incorrect because the TGW route table is correct. Option B is incorrect because overlapping CIDRs cause issues, but the TGW can handle it with more specific routes. Option D is incorrect because the VPN attachment is used.

Answer

The VPN attachment is in the wrong TGW route table.

Answer

The VPC CIDR overlaps with the on-premises CIDR.

Answer

The Transit Gateway route table does not have a route for the VPC CIDR.

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. Which additional configuration is needed?

Accepted Answer

Ensure the public subnet's route table has a route 0.0.0.0/0 pointing to an internet gateway.. The NAT gateway is in the public subnet, so the public subnet's route table must have a route to an internet gateway for the NAT gateway to function. Option A is wrong because the private subnet already has the correct route. Option C is wrong because security groups on the NAT gateway do not exist. Option D is wrong because the instance might not have a public IP, but it uses the NAT gateway for outbound traffic, so a public IP is not required.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach a security group to the NAT gateway allowing outbound traffic.

Answer

Add a route to the NAT gateway in the private subnet's route table for destination 0.0.0.0/0.

Question 12

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which AWS service should be used to allow this access without traversing the internet?

Accepted Answer

VPC Gateway Endpoint for S3. Option C is correct because a VPC Gateway Endpoint for S3 allows private access. Option A is incorrect because a NAT gateway is for internet access. Option B is incorrect because an Internet Gateway is for internet access. Option D is incorrect because a Transit Gateway is for connecting networks.

Answer

Transit Gateway

Answer

NAT gateway

Answer

Internet gateway

Question 13

A company is designing a hybrid network using AWS Direct Connect. Which TWO of the following are required to establish a private virtual interface (VIF) to a single VPC?

Accepted Answer

A VLAN ID for the virtual interface.. A private VIF requires a VLAN ID and a BGP session. Option A is optional; Option C is for public VIF; Option E is for transit VIF.

Answer

A Direct Connect Gateway to connect to the VPC.

Answer

A public IP address for the AWS side of the BGP session.

Answer

A BGP session with the AWS Direct Connect endpoint using public IPs.

Question 14

A company has a Direct Connect connection with a private virtual interface to a VPC. They want to use the same Direct Connect connection to access another VPC in the same region. Which solution should they implement?

Accepted Answer

Use a Transit Gateway and a transit virtual interface.. Option B is correct because a Transit Gateway can be attached to both VPCs and a transit VIF can be used. Option A is incorrect because a private VIF is for a single VPC. Option C is incorrect because a VPN can be used but is not leveraging Direct Connect fully. Option D is incorrect because a second Direct Connect is unnecessary.

Answer

Create a second private virtual interface to the second VPC.

Answer

Set up a Site-to-Site VPN over the Direct Connect connection to the second VPC.

Answer

Order a second Direct Connect connection.

Question 15

A company has multiple VPCs that need to communicate with each other and with an on-premises network via AWS Transit Gateway. Which THREE of the following are valid attachment types for a transit gateway?

Accepted Answer

Direct Connect Gateway. Transit gateway supports attachments to VPCs, VPN connections, and Direct Connect gateways. Option D is incorrect because an internet gateway is attached to a VPC, not to a transit gateway. Option E is incorrect because a network load balancer is not directly attached to a transit gateway.

Answer

Internet Gateway

Answer

Network Load Balancer