ANS-C01 Network Implementation Practice Test 14 — 15 Questions

Question 1

A company has multiple VPCs in the same AWS region that need to communicate with each other and with an on-premises data center. The company currently uses VPC peering connections between each VPC pair, which has become difficult to manage as the number of VPCs grows. The company wants to simplify the network architecture and implement a hub-and-spoke model using AWS Transit Gateway. The on-premises data center is connected to AWS via a Direct Connect connection with a private VIF. The company has already created a Transit Gateway and attached all VPCs to it. They have also created a Direct Connect gateway and associated it with the Transit Gateway. The on-premises router is advertising the on-premises CIDR (10.0.0.0/8) over BGP. However, after the migration, the VPCs cannot communicate with each other, and the on-premises network cannot reach the VPCs. The VPC route tables have been updated to route all traffic to the Transit Gateway. The Transit Gateway route table has propagation enabled for all VPC attachments and the Direct Connect gateway attachment. What is the most likely missing configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC route tables do not have routes for the other VPCs' CIDRs and the on-premises CIDR pointing to the Transit Gateway.. The correct answer is C: the VPC route tables do not have routes for the other VPCs' CIDRs and the on-premises CIDR pointing to the Transit Gateway. Even though the Transit Gateway route table has propagation enabled and the attachments exist, each VPC subnet route table must explicitly contain routes for the remote VPC CIDRs and the on-premises CIDR (10.0.0.0/8) with the Transit Gateway as the target; without these, traffic from the VPCs has no path to the Transit Gateway. Option A is wrong because the scenario states the Direct Connect gateway is already associated with the Transit Gateway. Option B is wrong because the scenario states propagation is already enabled for the VPC attachments. Option D is wrong because the scenario states the on-premises router is already advertising 10.0.0.0/8 over BGP.

Answer

The Direct Connect gateway is not associated with the Transit Gateway.

Answer

The Transit Gateway route table does not have propagation enabled for the VPC attachments.

Answer

The on-premises router is not advertising the on-premises CIDR over BGP.

Question 2

A company is implementing a hybrid network using AWS Direct Connect. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect gateway (DXGW) with a private virtual interface (VIF) to their on-premises router. They have established a BGP session between the on-premises router and the VGW. The on-premises network can reach EC2 instances in the VPC, but the VPC instances cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables lack a route for the on-premises CIDR pointing to the virtual private gateway. For instances in a VPC to reach on-premises resources over Direct Connect, the VPC route tables must have a route for the on-premises CIDR that points to the virtual private gateway (VGW). Without this route, traffic from the VPC to the on-premises network will not be forwarded to the VGW, even though the BGP session is established and the on-premises side can reach the VPC. Option A is incorrect because the VGW is attached to the VPC (otherwise on-premises could not reach EC2 instances). Option B is incorrect because a VPC endpoint for S3 does not cause routing conflicts for on-premises traffic. Option D is incorrect because the BGP session is established and the on-premises CIDR is being advertised (otherwise on-premises could not reach the VPC).

Answer

The virtual private gateway is not attached to the VPC

Answer

The VPC has a VPC endpoint for S3 that is causing a routing conflict

Answer

The BGP session is not advertising the on-premises CIDR to the VGW

Question 3

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is in public subnets, and the web servers are in private subnets. The ALB is configured with a target group pointing to the web servers. Users report intermittent 503 errors. The web servers are healthy according to the target group health checks. What is the most likely cause?

Accepted Answer

The ALB subnets do not have a route to an internet gateway. An internet-facing ALB requires its public subnets to have a route to an Internet Gateway (IGW) for the ALB nodes to communicate with clients and for the ALB to function properly. If the route table for the ALB subnets lacks a 0.0.0.0/0 route pointing to an IGW, the ALB cannot receive or return traffic, causing intermittent 503 errors even though backend targets are healthy. The health checks pass because they originate from the ALB to the targets within the VPC, not requiring internet connectivity.

Answer

The target group health check interval is too long

Answer

The ALB is configured as internal instead of internet-facing

Answer

Cross-zone load balancing is disabled

Question 4

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet. They want to provide internet access to instances in private subnets. The NAT gateway is configured with an Elastic IP. The private instances still cannot access the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT gateway. What is missing?

Accepted Answer

The route table for the public subnet where the NAT gateway resides does not have a default route to an internet gateway. For a NAT gateway in a public subnet to provide internet access to private instances, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway. Without that route, the NAT gateway itself cannot reach the internet, so traffic from private instances is dropped even though the private route table correctly points to the NAT gateway.

Answer

The network ACL for the private subnet allows outbound traffic

Answer

The private subnet route table is missing a route to the NAT gateway

Answer

The security group for the instances allows outbound traffic

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 attached to the transit gateway. They also have a Direct Connect virtual interface attached to the transit gateway. The on-premises network can reach some VPCs but not the VPC with CIDR 10.0.0.0/16. The transit gateway route table has a static route for the on-premises CIDR and a route propagation from the VPC attachment. What is the most likely issue?

Accepted Answer

The VPC CIDR overlaps with the on-premises CIDR. The most likely issue is that the VPC CIDR (10.0.0.0/16) overlaps with the on-premises CIDR. AWS Transit Gateway does not support overlapping CIDRs between attached VPCs and on-premises networks — when overlap exists, the more specific or propagated route may be preferred, or the route may be dropped, causing the on-premises network to be unable to reach that VPC. Route propagation from the VPC attachment would still appear in the TGW route table, but traffic would be misrouted or blackholed due to the conflict.

Answer

The transit gateway has reached the maximum number of attachments

Answer

The transit gateway route table does not have a route to the on-premises network

Answer

The VPC attachment is not associated with the transit gateway route table

Question 6

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?

Accepted Answer

A route in the public subnet's route table to an internet gateway. Option C is correct because the public subnet hosting the NAT gateway must have a route table entry pointing to an Internet Gateway (0.0.0.0/0 → igw-xxxxxxxx), which enables the NAT gateway to forward traffic to the internet on behalf of private instances. Option E is correct because an AWS NAT gateway must be associated with a static public Elastic IP address at creation time, since it translates private source IPs to that EIP for outbound internet communication. Option A is incorrect because a NAT gateway must reside in a public subnet, not a private one, to have a route to the Internet Gateway. Option B is incorrect because NAT gateways do not support security groups; security groups apply to instances and other resources like ENIs, not to the NAT gateway itself. Option D is incorrect because NAT gateways do not use network ACLs directly, and inbound internet-initiated traffic is not required—NAT only permits outbound-initiated connections and their return traffic.

Answer

The NAT gateway is deployed in a private subnet

Answer

A security group attached to the NAT gateway

Answer

A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet

Question 7

A company has a VPC with CIDR 10.0.0.0/16. They have two Availability Zones (us-east-1a and us-east-1b). In each AZ, there is a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). A NAT Gateway is deployed in the public subnet of us-east-1a. The private route tables for both private subnets have a default route pointing to the NAT Gateway. An application team has deployed EC2 instances in the private subnets. They report that instances in us-east-1b cannot access the internet, while instances in us-east-1a can. The NAT Gateway is healthy and has an Elastic IP attached. The route tables for the public subnets have a default route to the Internet Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway has reached the maximum number of concurrent connections. The most likely cause is that the NAT Gateway has reached its maximum number of concurrent connections. When connection limits are exceeded, new outbound connections from instances in any private subnet may fail, leading to internet access issues. This explains why instances in us-east-1a (which may have established connections earlier) can still access the internet, while instances in us-east-1b cannot. Option A is incorrect because the NAT Gateway is correctly placed in a public subnet. Option B is incorrect because the route table of the public subnet in us-east-1b does not affect traffic from private instances; they route directly to the NAT Gateway in us-east-1a. Option D is incorrect because cross-AZ data transfer charges are a cost concern and do not block network traffic. Therefore, the most plausible technical cause is option C.

Answer

The NAT Gateway is deployed in a private subnet

Answer

The route table for the public subnet in us-east-1b does not have a default route to the Internet Gateway

Answer

The NAT Gateway is in a different Availability Zone than the private subnet instances, causing cross-AZ data transfer charges

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16. They have an Application Load Balancer (ALB) in public subnets and EC2 instances in private subnets. The ALB is configured to route traffic to the instances. Users can reach the ALB, but the ALB returns 502 Bad Gateway errors. The target group health checks are failing. The instances are running a web server on port 80. The security group for the instances allows inbound traffic from the ALB's security group on port 80. The network ACL for the private subnets allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24). What is the most likely cause of the health check failures?

Accepted Answer

The network ACL for the private subnets is stateless and is blocking the return traffic from the instances to the ALB. Network ACLs are stateless, meaning return traffic from the instances to the ALB is not automatically allowed even if inbound port 80 is permitted. The health check request reaches the instance, but the response from the instance back to the ALB is blocked by the NACL's outbound rules unless ephemeral ports (1024-65535) are explicitly allowed. This causes health checks to fail and the ALB to return 502 Bad Gateway.

Answer

The network ACL for the private subnets does not allow inbound traffic on port 80 from the ALB's subnet

Answer

The security group for the instances does not allow inbound traffic from the ALB

Answer

The target group is configured with the wrong port

Question 9

A network engineer is troubleshooting connectivity issues from an on-premises data center to an Amazon VPC via an AWS Site-to-Site VPN. The VPN tunnel is up, but ping from an on-premises host (10.0.0.5) to an EC2 instance (172.16.1.10) fails. The VPC CIDR is 172.16.0.0/16. The on-premises CIDR is 10.0.0.0/8. The customer gateway device has a route for 172.16.0.0/16 pointing to the VPN tunnel. The VPC route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. Security groups and NACLs allow ICMP. What is the MOST likely cause?

Accepted Answer

The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR. For a Site-to-Site VPN to pass traffic bidirectionally, BOTH the customer gateway side AND the VPC subnet route table must have routes pointing to the VPN endpoints. The question states the CGW has a route for 172.16.0.0/16, but the route table associated with the EC2 instance's subnet is not confirmed to have a route for 10.0.0.0/8. Even if the VPC's main route table has the route, the subnet may be associated with a custom route table that lacks it, causing the return traffic to be dropped.

Answer

The on-premises host does not have a route to the VPC CIDR

Answer

The customer gateway device is not configured with the correct pre-shared key

Answer

The virtual private gateway is not attached to the correct VPC

Question 10

A company is deploying a global application with users in North America and Europe. They have set up an Application Load Balancer (ALB) in us-east-1 and another in eu-west-1. They want to route users to the nearest ALB using AWS Global Accelerator. What is the correct configuration to achieve this?

Accepted Answer

Create a Global Accelerator accelerator with endpoint groups in each region, each pointing to the respective ALB. AWS Global Accelerator uses Anycast IPs to direct traffic to the nearest healthy endpoint group. By creating an accelerator with endpoint groups in us-east-1 and eu-west-1, each pointing to its respective ALB, Global Accelerator automatically routes users to the closest region based on latency and network conditions. This provides both performance optimization and high availability without additional intermediate load balancers.

Answer

Use Amazon CloudFront with origins pointing to each ALB

Answer

Place each ALB behind a Network Load Balancer and use Global Accelerator

Answer

Create a Route 53 latency record set with aliases to each ALB

Question 11

A company has a VPC with public and private subnets. They have a web server in the public subnet that needs to make API calls to Amazon S3. The web server has a public IP. What is the MOST secure way to allow the web server to access S3 without traversing the internet?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the public subnet's route table to S3 via the endpoint. A Gateway VPC Endpoint for S3 allows resources within a VPC to access S3 over the AWS private network without traversing the internet. By adding a route in the public subnet's route table pointing to the endpoint, the web server can reach S3 privately, even though it has a public IP. This is the most secure option because traffic stays within the AWS backbone and does not require an internet gateway, NAT, or proxy.

Answer

Place a forward proxy server in the public subnet and configure the web server to use it for S3

Answer

Create an Interface VPC Endpoint for S3 in the public subnet

Answer

Set up a NAT Gateway in the same subnet and route S3 traffic through it

Question 12

A company is building a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via Direct Connect. The on-premises network uses BGP to advertise routes to the Transit Gateway. One of the VPCs has an overlapping CIDR (10.0.0.0/16) with the on-premises network (10.0.0.0/8). The company wants to ensure that traffic from other VPCs to 10.0.0.0/16 goes to the VPC, not on-premises. What configuration is required?

Accepted Answer

No additional configuration is needed; the more specific route will be preferred automatically. AWS Transit Gateway route tables follow the longest prefix match rule. The VPC advertises 10.0.0.0/16, which is a more specific route than the on-premises 10.0.0.0/8. Therefore, traffic destined for 10.0.0.0/16 will automatically be forwarded to the VPC attachment without any additional configuration.

Answer

Use AS_PATH prepending on the on-premises BGP advertisements to make them less preferred

Answer

Add a static route in the Transit Gateway route table for 10.0.0.0/16 pointing to the VPC attachment

Answer

Disable route propagation from the Direct Connect virtual interface to the Transit Gateway

Question 13

A company is designing a VPC with multiple subnets for a three-tier application. They need to ensure that the database tier (private subnet) can be accessed only by the application tier (private subnet) and that no other resources in the VPC can access the database. Which TWO security mechanisms should be used together to achieve this? (Choose TWO.)

Accepted Answer

Security groups. Security groups (C) are correct because they are stateful, instance-level virtual firewalls that can reference another security group as a source, so the database security group can allow inbound traffic only from the application tier's security group, effectively restricting access to that tier. Network ACLs (D) are correct because they are stateless, subnet-level controls that can filter traffic entering and leaving the database subnet, adding a subnet boundary that blocks other VPC resources from reaching the database tier. Used together, security groups enforce instance-level least privilege while NACLs enforce subnet-level traffic control, satisfying the requirement that only the application tier can access the database. Route tables (A) only direct traffic and do not provide allow/deny security filtering, so they cannot restrict which resources can access the database. VPC Flow Logs (B) are for monitoring and capturing IP traffic metadata, not for enforcing access control. IAM policies (E) govern AWS API permissions and do not control network-level access to database instances.

Answer

Route tables

Answer

VPC Flow Logs

Answer

IAM policies attached to the database instances

Question 14

A company is setting up AWS Site-to-Site VPN for connectivity between its on-premises network and AWS VPC. They want to ensure the VPN tunnel is highly available. Which THREE components should be configured? (Choose THREE.)

Accepted Answer

BGP dynamic routing over the VPN tunnels. Option B is correct because BGP dynamic routing over the VPN tunnels enables automatic failover and route propagation between the on-premises network and AWS, which is essential for high availability in a Site-to-Site VPN. Option D is correct because AWS Site-to-Site VPN automatically provisions two tunnels per VPN connection, and both tunnels should be configured and used to provide redundancy if one tunnel fails. Option E is correct because a second customer gateway device on-premises provides redundancy on the on-premises side, ensuring that if one customer gateway device fails, the VPN connection can still be established through the other device. Option A is incorrect because a single VPN connection with one tunnel does not provide redundancy; if that tunnel fails, connectivity is lost. Option C is incorrect because static routing does not support automatic failover or dynamic route updates, making it less suitable for a highly available VPN design compared to BGP.

Answer

A single VPN connection with one tunnel

Answer

Static routing instead of BGP

Question 15

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They have also set up a Site-to-Site VPN as a backup. The VPC has a virtual private gateway (VGW) attached. The on-premises network uses BGP over the Direct Connect and static routes for the VPN. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect when it is available; instead, it goes over the VPN. The VPC route table has a route for the on-premises CIDR (10.0.0.0/8) to the VGW. The VPN connection is configured with static routes. What is the MOST likely cause of this behavior?

Accepted Answer

The VPN static route has higher precedence than the BGP route from Direct Connect. When a VPC route table has a route for the on-premises CIDR (10.0.0.0/8) pointing to the VGW, AWS uses the longest prefix match to select the route. If both the Direct Connect BGP route and the VPN static route have the same prefix length, static routes are preferred over propagated BGP routes. Therefore, the VPN static route takes precedence, causing traffic to flow over the VPN even when Direct Connect is available. To fix this, the VPN should use BGP instead of static routes, or the static route should be removed so that the BGP route from Direct Connect is used.

Answer

The VPC route table does not have a route for the on-premises CIDR

Answer

The VGW is not attached to the VPC

Answer

The Direct Connect virtual interface is not associated with the VGW