ANS-C01 Network Implementation Practice Test 14 — 15 Questions

Question 1

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.. A Multi-AZ cluster with one writer and two reader instances provides both high availability and low latency. The cluster endpoint automatically routes write traffic to the primary instance, while the reader endpoint distributes read traffic across the reader instances in different Availability Zones, reducing latency and improving resilience. This architecture ensures that if one Availability Zone fails, the database remains available without manual intervention, meeting the critical application's requirements.

Answer

Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.

Answer

Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.

Answer

Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.

Question 2

A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?

Accepted Answer

Route propagation and route tables in the VPC and on-premises.. The VPN tunnel being up indicates the IPsec/IKE negotiation succeeded, but reachability to the EC2 instance requires proper routing. The most common cause of ping failure when the tunnel is up is missing or incorrect route propagation from the VPN to the VPC route tables, or missing static routes on the on-premises side pointing to the VPN gateway. Without correct routes, traffic from the on-premises network cannot reach the VPC subnets, and return traffic from the EC2 instance cannot reach the on-premises network.

Answer

The VPN connection status in the AWS console.

Answer

Security group inbound rules for ICMP on the EC2 instance.

Answer

IKE version mismatch between the VPN endpoints.

Question 3

A company has several VPCs in the same AWS account and region. They want to centrally manage and monitor network traffic between these VPCs and also to on-premises networks. Which AWS service should they use?

Accepted Answer

Transit Gateway. AWS Transit Gateway (C) is the correct choice because it acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, simplifying network management and enabling centralized monitoring. It supports transitive routing between all attached networks, which is essential for the company's requirement to manage and monitor traffic across many VPCs and their on-premises environment.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

AWS VPN CloudHub

Question 4

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block and ensure that traffic from the internet to the IPv6-enabled resources is allowed. Which configuration is required?

Accepted Answer

Attach an internet gateway and update route tables for IPv6.. To enable IPv6 communication from the internet to resources in a VPC, you must associate an IPv6 CIDR block with the VPC, attach an internet gateway, and update the route tables to include a default route (::/0) pointing to the internet gateway for IPv6 traffic. Option B correctly describes this configuration, as the internet gateway handles both IPv4 and IPv6 traffic, and route tables must be explicitly updated for IPv6.

Answer

Attach a NAT gateway to the VPC and update route tables.

Answer

Create a Virtual Private Gateway and attach the VPC.

Answer

Create a Transit Gateway and attach the VPC.

Question 5

A company is setting up a new VPC with a CIDR block of 10.0.0.0/16. They need to create subnets for different tiers: public (web servers), private (application servers), and database (RDS). They want to maximize the number of available IP addresses while ensuring each subnet has at least 256 IP addresses. Which subnet design meets these requirements?

Accepted Answer

Create six /24 subnets (256 IPs each) across two Availability Zones (three per AZ).. It creates six /24 subnets (each with 256 IP addresses) across two Availability Zones, meeting the requirement of at least 256 IPs per subnet while maximizing total available IPs (1,536 IPs) and providing high availability by distributing subnets across multiple AZs. The /24 subnet mask provides exactly 256 IPs (254 usable) per subnet, which satisfies the minimum requirement without wasting address space.

Answer

Create three /25 subnets (128 IPs each) in one Availability Zone.

Answer

Create six /26 subnets (64 IPs each) across two Availability Zones.

Answer

Create three /24 subnets (256 IPs each) in one Availability Zone.

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The Transit Gateway route table has a static route for 10.0.0.0/8 pointing to the VPN attachment. However, traffic from on-premises to the VPC is not working. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.. For traffic from on-premises to reach the VPC, the VPC's route table must have a route pointing to the Transit Gateway (TGW) attachment as the target for the on-premises CIDR (10.0.0.0/8). Without this route, the VPC subnet will not forward return traffic to the TGW, causing a one-way communication failure. The TGW route table already has a static route for 10.0.0.0/8 pointing to the VPN attachment, so the issue is on the VPC side, not the TGW.

Answer

The VPN attachment is in the wrong TGW route table.

Answer

The VPC CIDR overlaps with the on-premises CIDR.

Answer

The Transit Gateway route table does not have a route for the VPC CIDR.

Question 7

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. Which additional configuration is needed?

Accepted Answer

Ensure the public subnet's route table has a route 0.0.0.0/0 pointing to an internet gateway.. The NAT gateway resides in the public subnet, but it still needs a route to the internet. The public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW) so that traffic from the NAT gateway can be forwarded to the internet. Without this route, the NAT gateway cannot send traffic beyond the VPC, even though the private subnet's route table correctly points to the NAT gateway.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach a security group to the NAT gateway allowing outbound traffic.

Answer

Add a route to the NAT gateway in the private subnet's route table for destination 0.0.0.0/0.

Question 8

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which AWS service should be used to allow this access without traversing the internet?

Accepted Answer

VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 buckets without traversing the internet by using AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic through the endpoint, which is horizontally scaled and highly available. This avoids the need for a NAT gateway or internet gateway, keeping traffic within the AWS backbone.

Answer

Transit Gateway

Answer

NAT gateway

Answer

Internet gateway

Question 9

A company is designing a hybrid network using AWS Direct Connect. Which TWO of the following are required to establish a private virtual interface (VIF) to a single VPC?

Accepted Answer

A VLAN ID for the virtual interface.. A VLAN ID is required to create a private virtual interface (VIF) because it uniquely identifies the 802.1Q VLAN tag used to segregate traffic on the Direct Connect link. Without a VLAN ID, the physical connection cannot logically separate the private VIF from other virtual interfaces (e.g., public or transit VIFs) on the same circuit.

Answer

A Direct Connect Gateway to connect to the VPC.

Answer

A public IP address for the AWS side of the BGP session.

Answer

A BGP session with the AWS Direct Connect endpoint using public IPs.

Question 10

A company has a Direct Connect connection with a private virtual interface to a VPC. They want to use the same Direct Connect connection to access another VPC in the same region. Which solution should they implement?

Accepted Answer

Use a Transit Gateway and a transit virtual interface.. A Transit Gateway (TGW) allows you to attach multiple VPCs and a Direct Connect Gateway (DXGW) via a transit virtual interface (VIF). This enables a single Direct Connect connection to route traffic to multiple VPCs in the same region without additional physical connections or private VIFs. The TGW acts as a central hub, simplifying network architecture and reducing operational overhead.

Answer

Create a second private virtual interface to the second VPC.

Answer

Set up a Site-to-Site VPN over the Direct Connect connection to the second VPC.

Answer

Order a second Direct Connect connection.

Question 11

A company has multiple VPCs that need to communicate with each other and with an on-premises network via AWS Transit Gateway. Which THREE of the following are valid attachment types for a transit gateway?

Accepted Answer

Direct Connect Gateway. AWS Transit Gateway supports attachments to Direct Connect Gateways, enabling integration of Direct Connect virtual interfaces with the transit gateway for hybrid connectivity. This allows traffic from on-premises networks connected via Direct Connect to be routed through the transit gateway to multiple VPCs and other attachments.

Answer

Internet Gateway

Answer

Network Load Balancer

Question 12

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet. The company has a NAT gateway in the public subnet. The NAT gateway has an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's Elastic IP is not allowed by the destination's firewall.. The NAT gateway's Elastic IP is a public IP address that the destination server sees as the source of the outbound traffic. If the destination's firewall (e.g., a security appliance or an internet-based service) explicitly blocks traffic from that Elastic IP, the EC2 instance will be unable to reach the internet, even though the VPC routing and NAT configuration are correct. This is a common scenario when the destination uses IP-based allowlists or blacklists.

Answer

The security group of the EC2 instance blocks outbound traffic.

Answer

The route table in the public subnet does not have a default route to the internet gateway.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 13

A company is troubleshooting connectivity issues between two VPCs that are peered using an inter-region VPC peering connection. The VPCs have the following CIDR blocks: VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Which THREE of the following are possible reasons for the connectivity failure?

Accepted Answer

The route tables in each VPC do not have routes pointing to the peer VPC's CIDR.. For inter-region VPC peering to function, each VPC must have explicit routes in its route tables pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, traffic destined for the peer VPC will not be forwarded over the peering link, causing connectivity failure.

Answer

The VPC CIDR blocks overlap.

Answer

The VPC peering connection is in a 'pending-acceptance' state.

Question 14

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Register EC2 instances in multiple Availability Zones.. Registering EC2 instances in multiple Availability Zones ensures that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ. This is a fundamental requirement for high availability because the ALB distributes incoming traffic across targets in different AZs, and if all instances are in a single AZ, that AZ becomes a single point of failure.

Answer

Use a Network Load Balancer instead of an ALB.

Answer

Place the EC2 instances in a single Availability Zone.

Answer

Configure the ALB as internal.

Question 15

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets host NAT gateways for outbound internet access from the private subnets. Which configuration ensures that EC2 instances in the private subnets can route traffic to the internet through the NAT gateways?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 targeting the NAT gateway.. For EC2 instances in private subnets to reach the internet via a NAT gateway, the private subnet route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the next hop. The NAT gateway resides in a public subnet and translates the private IPs to its own Elastic IP, forwarding traffic to the internet gateway. Without this route, traffic from private instances has no path to the NAT gateway.

Answer

Add a route in the public subnet route table pointing to the internet gateway.

Answer

Attach an egress-only internet gateway to the private subnets.

Answer

Create a VPC peering connection between the VPC and the NAT gateway.