ANS-C01 Network Implementation Practice Test 14 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet. The company has a NAT gateway in the public subnet. The NAT gateway has an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's Elastic IP is not allowed by the destination's firewall.. Option D is correct because the NAT gateway's Elastic IP must be allowed by the on-premises firewall or the destination must allow traffic from that IP. Option A is incorrect because a default route exists. Option B is incorrect because security groups are stateful and allow outbound. Option C is incorrect because NACLs are stateless but inbound rule for ephemeral ports is needed; however, the issue is more likely the NAT gateway's public IP not being allowed.

Answer

The security group of the EC2 instance blocks outbound traffic.

Answer

The route table in the public subnet does not have a default route to the internet gateway.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 2

A company is troubleshooting connectivity issues between two VPCs that are peered using an inter-region VPC peering connection. The VPCs have the following CIDR blocks: VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Which THREE of the following are possible reasons for the connectivity failure?

Accepted Answer

The route tables in each VPC do not have routes pointing to the peer VPC's CIDR.. For VPC peering, route tables must have routes to the peer VPC, security groups must allow traffic, and network ACLs must allow traffic. Option A is wrong because overlapping CIDRs are not the issue. Option D is wrong because the peering connection is in 'active' state by default after acceptance.

Answer

The VPC CIDR blocks overlap.

Answer

The VPC peering connection is in a 'pending-acceptance' state.

Question 3

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Register EC2 instances in multiple Availability Zones.. Option A is correct because the ALB must be internet-facing to receive traffic from users. Option D is correct because the EC2 instances should be in multiple AZs to survive an AZ failure. Option B is incorrect because an internal ALB is not accessible from the internet. Option C is incorrect because a single AZ is not highly available. Option E is incorrect because a Network Load Balancer is for TCP/UDP, not HTTP.

Answer

Use a Network Load Balancer instead of an ALB.

Answer

Place the EC2 instances in a single Availability Zone.

Answer

Configure the ALB as internal.

Question 4

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets host NAT gateways for outbound internet access from the private subnets. Which configuration ensures that EC2 instances in the private subnets can route traffic to the internet through the NAT gateways?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 targeting the NAT gateway.. Option B is correct because the private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT gateway to allow outbound internet traffic. Option A is wrong because internet gateway is for public subnets. Option C is wrong because VPC peering doesn't provide internet access. Option D is wrong because egress-only internet gateways are for IPv6.

Answer

Add a route in the public subnet route table pointing to the internet gateway.

Answer

Attach an egress-only internet gateway to the private subnets.

Answer

Create a VPC peering connection between the VPC and the NAT gateway.

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application. Which THREE subnet CIDR blocks are valid within this VPC?

Accepted Answer

10.0.1.0/24. Option A is correct because 10.0.1.0/24 is within 10.0.0.0/16. Option C is correct because 10.0.3.0/24 is within the range. Option D is correct because 10.0.5.0/24 is within the range. Option B is incorrect because 10.1.0.0/24 is outside the VPC CIDR. Option E is incorrect because 10.0.0.0/8 is larger and overlaps but is not a subnet.

Answer

10.1.0.0/24

Answer

10.0.0.0/8

Question 6

A network engineer is troubleshooting connectivity between two EC2 instances in the same VPC but different subnets. The instances can ping each other's private IP addresses, but traffic on TCP port 443 fails. What is the most likely cause?

Accepted Answer

Security group or network ACL rules blocking port 443.. Option C is correct because the security group or NACL is blocking port 443. Since ICMP works, the network layer is fine, but application layer port is blocked. Option A is wrong because route tables affect network layer, not port-specific. Option B is wrong because VPC flow logs are for monitoring, not blocking. Option D is wrong because internet gateway is not involved.

Answer

VPC Flow Logs misconfiguration.

Answer

Internet gateway not attached to the VPC.

Answer

Missing route in the route table.

Question 7

A company is setting up a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE configuration items should be checked?

Accepted Answer

Route tables in the VPC and on-premises router.. Option A is correct because route tables must have routes to the remote network. Option C is correct because security group rules must allow traffic. Option E is correct because network ACLs must allow traffic. Option B is incorrect because a NAT gateway is not required for VPN. Option D is incorrect because an internet gateway is not needed for VPN traffic.

Answer

NAT gateway configuration in the VPC.

Answer

Internet gateway attachment to the VPC.

Question 8

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. They have multiple VPCs in a single AWS Region. Which design minimizes the number of Direct Connect virtual interfaces while providing connectivity to all VPCs?

Accepted Answer

Create one private VIF attached to a Direct Connect gateway and associate the gateway with all VPCs.. Option B is correct because a Direct Connect gateway allows multiple VPCs to connect via a single virtual interface (VIF). Option A is wrong because each VIF is limited to one VPC. Option C is wrong because VPN is a backup, not primary. Option D is wrong because transit VPC adds complexity.

Answer

Set up a transit VPC with EC2-based routers.

Answer

Create a separate private VIF for each VPC.

Answer

Use a single public VIF and route through the internet.

Question 9

A network engineer is assigned an IAM policy to manage VPC resources. The engineer attempts to create a VPC with CIDR 10.0.0.0/16 and fails. What is the reason?

Accepted Answer

The Deny statement overrides the Allow statement for the specific CIDR.. Option C is correct because the second statement explicitly denies creating a VPC with CIDR 10.0.0.0/16. Option A is incorrect because the first statement allows VPC creation in general. Option B is incorrect because the resource ARN matches all VPCs. Option D is incorrect because the condition is on the CIDR, not region.

Answer

The resource ARN in the Deny statement does not match the VPC being created.

Answer

The condition in the Deny statement is not evaluated correctly.

Answer

The first statement allows only specific actions, not CreateVpc.

Question 10

An organization needs to securely connect its on-premises data center to multiple VPCs in different AWS Regions. The on-premises network uses BGP. Which AWS service should be used to simplify routing and provide a single point of attachment for the on-premises router?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. Option C is correct because Transit Gateway provides a hub for multi-VPC and on-premises connectivity with BGP support. Option A is wrong because VPC peering is point-to-point, not hub. Option B is wrong because Direct Connect gateway doesn't connect multiple regions natively. Option D is wrong because Client VPN is for individual users.

Answer

Direct Connect gateway with a private VIF.

Answer

VPC Peering connections between each VPC and the on-premises network.

Answer

AWS Client VPN endpoint.

Question 11

A company has a VPC (10.0.0.0/16) with two subnets: public (10.0.1.0/24) and private (10.0.2.0/24). They have an Application Load Balancer (ALB) in the public subnet that distributes traffic to EC2 instances in the private subnet. The ALB is internet-facing and has a security group that allows inbound HTTP/S from 0.0.0.0/0. The EC2 instances have a security group that allows inbound HTTP from the ALB's security group. Users report that they can access the application, but the application is slow and sometimes times out. The network engineer checks CloudWatch metrics and sees that the ALB's target response time is high. The engineer suspects that the EC2 instances are overwhelmed. Which action should the engineer take to improve performance?

Accepted Answer

Add EC2 instances in another Availability Zone and register them with the ALB.. Option C is correct because using multiple Availability Zones increases capacity and fault tolerance. Option A is incorrect because increasing instance size may help but is not the best practice for high availability. Option B is incorrect because a NAT gateway is for outbound internet access. Option D is incorrect because an NLB does not offload processing from the instances.

Answer

Add a NAT gateway in the public subnet to reduce latency.

Answer

Replace the ALB with a Network Load Balancer to reduce overhead.

Answer

Increase the size of the EC2 instances in the private subnet.

Question 12

A company is deploying a latency-sensitive application across two AWS Regions using Application Load Balancers (ALBs) and AWS Global Accelerator. The application uses TCP port 8443. Which configuration ensures the lowest possible latency for global users?

Accepted Answer

Use AWS Global Accelerator with endpoints as the ALBs in each Region.. Option D is correct because Global Accelerator uses the AWS global network and anycast IPs, reducing latency. Option A is wrong because Route 53 with latency routing still uses public internet. Option B is wrong because CloudFront is for HTTP/HTTPS, not TCP. Option C is wrong because Network Load Balancer does not have multi-region capability.

Answer

Use Amazon CloudFront with the ALBs as origins.

Answer

Use Amazon Route 53 latency-based routing with ALB endpoints in each Region.

Answer

Deploy a Network Load Balancer in each Region and use Route 53 geoproximity routing.

Question 13

A company has a Direct Connect connection with a private virtual interface (VIF) attached to a Virtual Private Gateway (VGW) that is associated with a single VPC (10.0.0.0/16). The on-premises network uses BGP to exchange routes. The company has recently acquired another company and needs to connect to their VPC (172.16.0.0/16) in the same region. They want to use the existing Direct Connect connection to access both VPCs. The network engineer creates a Transit Gateway, attaches both VPCs, and creates a transit virtual interface (VIF) to the Transit Gateway. The engineer also deletes the private VIF. However, after the change, on-premises users cannot reach either VPC. What should the engineer do to restore connectivity?

Accepted Answer

Configure BGP on the on-premises router to peer with the Transit Gateway over the transit VIF.. Option D is correct because the on-premises router must be configured to establish BGP peering with the Transit Gateway over the transit VIF. Option A is incorrect because a new VPN connection is unnecessary. Option B is incorrect because the VPCs are already attached. Option C is incorrect because route propagation must be enabled in the TGW route tables.

Answer

Attach the VPCs to the Transit Gateway with different route tables.

Answer

Create a new private VIF to each VPC.

Answer

Enable route propagation on the Transit Gateway route tables.

Question 14

A company is setting up AWS Direct Connect with a 1 Gbps dedicated connection. They want redundant connectivity with automatic failover. What is the most cost-effective way to achieve this?

Accepted Answer

Provision a second Direct Connect connection at a different location and configure BGP.. Option B is correct because a second Direct Connect connection at a different location provides true redundancy. Option A is wrong because a single connection is a single point of failure. Option C is wrong because it adds cost without redundancy. Option D is wrong because VPN over the same connection doesn't help if the connection fails.

Answer

Use a single connection with multiple VLANs.

Answer

Use a single connection with a VPN over the same connection for redundancy.

Answer

Provision a single Direct Connect connection and use a VPN over the internet as backup.

Question 15

A company is deploying a web application across multiple Availability Zones in a VPC. The application needs to be highly available and scale based on traffic. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The company wants to ensure that if an Availability Zone fails, the ALB can still route traffic to healthy instances in other zones. What should the network engineer implement to meet this requirement?

Accepted Answer

Enable cross-zone load balancing on the ALB.. Option D is correct because enabling cross-zone load balancing on the ALB allows it to distribute traffic across all registered targets in all enabled Availability Zones. Option A is wrong because a Network Load Balancer does not support cross-zone load balancing by default. Option B is wrong because multiple ALBs per AZ would introduce complexity and is not the simplest solution. Option C is wrong because it does not address cross-zone load balancing.

Answer

Configure a Network Load Balancer instead of an ALB, and enable cross-zone load balancing.

Answer

Use an ALB with a target group that contains instances from only one Availability Zone, and use Route 53 health checks.

Answer

Deploy one ALB in each Availability Zone and use Route 53 latency-based routing.