ANS-C01 Network Implementation Practice Test 15 — 15 Questions

Question 1

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application. Which THREE subnet CIDR blocks are valid within this VPC?

Accepted Answer

10.0.1.0/24. (10.0.1.0/24) is a valid subnet within the VPC CIDR 10.0.0.0/16 because its entire address range (10.0.1.0–10.0.1.255) falls within the VPC's address space. The /24 subnet mask is smaller than the VPC's /16, so it is a proper subset. AWS VPCs allow any RFC 1918 private IP range as long as the subnet CIDR is fully contained within the VPC CIDR.

Answer

10.1.0.0/24

Answer

10.0.0.0/8

Question 2

A network engineer is troubleshooting connectivity between two EC2 instances in the same VPC but different subnets. The instances can ping each other's private IP addresses, but traffic on TCP port 443 fails. What is the most likely cause?

Accepted Answer

Security group or network ACL rules blocking port 443.. Since the instances can ping each other, ICMP traffic is working, which rules out routing issues and confirms that the instances are reachable at Layer 3. TCP port 443 failing specifically indicates that a firewall rule is blocking the HTTPS traffic. Security groups are stateful and operate at the instance level, while network ACLs are stateless and operate at the subnet level; either can block port 443 while allowing ICMP, making this the most likely cause.

Answer

VPC Flow Logs misconfiguration.

Answer

Internet gateway not attached to the VPC.

Answer

Missing route in the route table.

Question 3

A company is setting up a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE configuration items should be checked?

Accepted Answer

Route tables in the VPC and on-premises router.. Route tables in both the VPC and the on-premises router must have entries directing traffic for the remote network (e.g., the on-premises CIDR in the VPC route table, and the VPC CIDR in the on-premises route table) toward the VPN gateway or the VPN tunnel interface. Without these routes, packets have no path to reach the other side, even if the tunnel itself is up. This is a fundamental requirement for any Site-to-Site VPN to forward traffic.

Answer

NAT gateway configuration in the VPC.

Answer

Internet gateway attachment to the VPC.

Question 4

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. They have multiple VPCs in a single AWS Region. Which design minimizes the number of Direct Connect virtual interfaces while providing connectivity to all VPCs?

Accepted Answer

Create one private VIF attached to a Direct Connect gateway and associate the gateway with all VPCs.. A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region. By attaching the Direct Connect gateway to all target VPCs, you eliminate the need for separate private VIFs per VPC, minimizing operational overhead and cost while maintaining private connectivity.

Answer

Set up a transit VPC with EC2-based routers.

Answer

Create a separate private VIF for each VPC.

Answer

Use a single public VIF and route through the internet.

Question 5

A network engineer is assigned an IAM policy to manage VPC resources. The engineer attempts to create a VPC with CIDR 10.0.0.0/16 and fails. What is the reason?

Accepted Answer

The Deny statement overrides the Allow statement for the specific CIDR.. The IAM policy includes an explicit Deny statement that denies the CreateVpc action when the CIDR block equals 10.0.0.0/16. Since explicit Deny statements override any Allow statements, the engineer's attempt to create a VPC with that specific CIDR fails regardless of any Allow permissions. This is a fundamental IAM evaluation logic rule: an explicit Deny always takes precedence over an Allow.

Answer

The resource ARN in the Deny statement does not match the VPC being created.

Answer

The condition in the Deny statement is not evaluated correctly.

Answer

The first statement allows only specific actions, not CreateVpc.

Question 6

An organization needs to securely connect its on-premises data center to multiple VPCs in different AWS Regions. The on-premises network uses BGP. Which AWS service should be used to simplify routing and provide a single point of attachment for the on-premises router?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. AWS Transit Gateway with inter-Region peering attachments is the correct choice because it provides a single point of attachment for the on-premises router, simplifying routing and connectivity to multiple VPCs across different AWS Regions. The Transit Gateway supports BGP over VPN connections or Direct Connect, allowing the on-premises network to peer with a single Transit Gateway, which then centrally manages inter-VPC and inter-Region traffic through peering attachments, eliminating the need for multiple separate connections.

Answer

Direct Connect gateway with a private VIF.

Answer

VPC Peering connections between each VPC and the on-premises network.

Answer

AWS Client VPN endpoint.

Question 7

A company has a VPC (10.0.0.0/16) with two subnets: public (10.0.1.0/24) and private (10.0.2.0/24). They have an Application Load Balancer (ALB) in the public subnet that distributes traffic to EC2 instances in the private subnet. The ALB is internet-facing and has a security group that allows inbound HTTP/S from 0.0.0.0/0. The EC2 instances have a security group that allows inbound HTTP from the ALB's security group. Users report that they can access the application, but the application is slow and sometimes times out. The network engineer checks CloudWatch metrics and sees that the ALB's target response time is high. The engineer suspects that the EC2 instances are overwhelmed. Which action should the engineer take to improve performance?

Accepted Answer

Add EC2 instances in another Availability Zone and register them with the ALB.. Adding EC2 instances in another Availability Zone increases capacity and distributes traffic across multiple AZs, reducing the load on each instance and improving performance and fault tolerance. Option A is incorrect because a NAT gateway is for outbound internet access, not for reducing latency between ALB and targets. Option B is incorrect because an NLB does not automatically distribute traffic across AZs as effectively for HTTP applications and does not offload processing. Option C is incorrect because simply increasing instance size (vertical scaling) may not provide the same benefits as horizontal scaling across AZs for handling variable loads.

Answer

Add a NAT gateway in the public subnet to reduce latency.

Answer

Replace the ALB with a Network Load Balancer to reduce overhead.

Answer

Increase the size of the EC2 instances in the private subnet.

Question 8

A company is deploying a latency-sensitive application across two AWS Regions using Application Load Balancers (ALBs) and AWS Global Accelerator. The application uses TCP port 8443. Which configuration ensures the lowest possible latency for global users?

Accepted Answer

Use AWS Global Accelerator with endpoints as the ALBs in each Region.. AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal ALB endpoint, minimizing internet hops and latency. For TCP port 8443, Global Accelerator preserves the client IP and provides connection termination at the edge, ensuring the lowest possible latency for global users by avoiding the public internet.

Answer

Use Amazon CloudFront with the ALBs as origins.

Answer

Use Amazon Route 53 latency-based routing with ALB endpoints in each Region.

Answer

Deploy a Network Load Balancer in each Region and use Route 53 geoproximity routing.

Question 9

A company has a Direct Connect connection with a private virtual interface (VIF) attached to a Virtual Private Gateway (VGW) that is associated with a single VPC (10.0.0.0/16). The on-premises network uses BGP to exchange routes. The company has recently acquired another company and needs to connect to their VPC (172.16.0.0/16) in the same region. They want to use the existing Direct Connect connection to access both VPCs. The network engineer creates a Transit Gateway, attaches both VPCs, and creates a transit virtual interface (VIF) to the Transit Gateway. The engineer also deletes the private VIF. However, after the change, on-premises users cannot reach either VPC. What should the engineer do to restore connectivity?

Accepted Answer

Configure BGP on the on-premises router to peer with the Transit Gateway over the transit VIF.. When the private VIF was replaced with a transit VIF to the Transit Gateway, the on-premises router lost its BGP peering with the VGW. To restore connectivity, the on-premises router must be configured to establish BGP peering with the Transit Gateway over the transit VIF. This allows route exchange between on-premises and both VPCs attached to the Transit Gateway. Option A is correct. Option B is incorrect because attaching VPCs with different route tables is not the issue; the VPCs are already attached. Option C is incorrect because creating separate private VIFs would be unnecessary and defeats the purpose of using a Transit Gateway. Option D is incorrect because route propagation is already enabled by default when VPCs are attached to a Transit Gateway; the missing piece is the BGP session from on-premises.

Answer

Attach the VPCs to the Transit Gateway with different route tables.

Answer

Create a new private VIF to each VPC.

Answer

Enable route propagation on the Transit Gateway route tables.

Question 10

A company is setting up AWS Direct Connect with a 1 Gbps dedicated connection. They want redundant connectivity with automatic failover. What is the most cost-effective way to achieve this?

Accepted Answer

Provision a second Direct Connect connection at a different location and configure BGP.. Achieving true redundancy with automatic failover for AWS Direct Connect requires physically diverse connections. A second Direct Connect connection at a different location, combined with BGP routing (e.g., using AS_PATH prepending or MED for traffic engineering), ensures that traffic automatically fails over if one connection goes down. While a VPN over the internet (option D) might seem cost-effective, it introduces variable latency, potential bandwidth constraints, and additional data transfer costs, making it less suitable for consistent performance and automatic failover in a dedicated connectivity context. Therefore, provisioning a second Direct Connect connection is the most cost-effective approach that meets the requirements.

Answer

Use a single connection with multiple VLANs.

Answer

Use a single connection with a VPN over the same connection for redundancy.

Answer

Provision a single Direct Connect connection and use a VPN over the internet as backup.

Question 11

A company is deploying a web application across multiple Availability Zones in a VPC. The application needs to be highly available and scale based on traffic. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The company wants to ensure that if an Availability Zone fails, the ALB can still route traffic to healthy instances in other zones. What should the network engineer implement to meet this requirement?

Accepted Answer

Enable cross-zone load balancing on the ALB.. Enabling cross-zone load balancing on an Application Load Balancer (ALB) allows it to distribute incoming traffic evenly across all registered targets in all enabled Availability Zones. If an entire Availability Zone fails, the ALB automatically routes traffic only to healthy instances in the remaining zones, ensuring high availability without requiring manual intervention or additional components.

Answer

Configure a Network Load Balancer instead of an ALB, and enable cross-zone load balancing.

Answer

Use an ALB with a target group that contains instances from only one Availability Zone, and use Route 53 health checks.

Answer

Deploy one ALB in each Availability Zone and use Route 53 latency-based routing.

Question 12

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC. Which action should they take?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. Amazon VPC supports IPv6 through an Amazon-provided IPv6 CIDR block that is automatically allocated from Amazon's pool of global unicast addresses. You cannot bring your own IPv6 CIDR or manually assign one; the only supported method is to associate an Amazon-provided /56 IPv6 CIDR block with the VPC. This enables dual-stack networking, allowing resources to communicate over both IPv4 and IPv6.

Answer

Request an IPv6 CIDR block from your regional internet registry and associate it with the VPC.

Answer

Enable IPv6 on the subnets directly without associating a VPC CIDR.

Answer

Manually assign a /56 IPv6 CIDR block to the VPC.

Question 13

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet to download software updates. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the EC2 instance cannot access the internet. The network engineer verifies that the NAT gateway has an Elastic IP, the security group for the EC2 instance allows outbound HTTPS traffic, and the network ACL for the private subnet allows inbound and outbound ephemeral ports. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a route to an internet gateway.. The NAT gateway resides in the public subnet, which must have a route table with a default route (0.0.0.0/0) pointing to an internet gateway (IGW) for the NAT gateway to forward traffic to the internet. Without this route, the NAT gateway cannot reach the IGW, so traffic from the private subnet EC2 instance fails even though the private subnet route is correctly configured. The security group and network ACL settings are irrelevant if the NAT gateway itself lacks internet connectivity.

Answer

The security group attached to the NAT gateway does not allow outbound traffic.

Answer

The route table for the private subnet does not have a route to the NAT gateway.

Answer

The NAT gateway does not support UDP traffic.

Question 14

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via VPN. The on-premises network advertises a route for 10.0.0.0/8. One VPC has a CIDR of 10.0.1.0/24. How does Transit Gateway handle the overlapping route?

Accepted Answer

The Transit Gateway uses the longest prefix match; the VPC route 10.0.1.0/24 is more specific.. AWS Transit Gateway uses the longest prefix match (LPM) rule to select the most specific route when multiple routes overlap. In this case, the on-premises network advertises 10.0.0.0/8 via BGP, while the VPC has a directly attached CIDR of 10.0.1.0/24. Since /24 is more specific than /8, traffic destined for 10.0.1.0/24 is routed to the VPC, not the on-premises network.

Answer

The Transit Gateway prefers the on-premises route because it is learned via BGP.

Answer

The Transit Gateway drops traffic to 10.0.1.0/24 due to conflict.

Answer

The Transit Gateway summarises the on-premises route to 10.0.0.0/16.

Question 15

A company is setting up a Direct Connect connection to AWS. They have a virtual private gateway (VGW) attached to their VPC. They need to establish a single logical connection over the Direct Connect link to access all subnets in the VPC. Which resource should they create on the Direct Connect virtual interface?

Accepted Answer

A private virtual interface (VIF) with a BGP session to the VGW.. A private virtual interface (VIF) is the correct resource because it allows you to connect your on-premises network directly to a VPC via a Direct Connect link. By associating the private VIF with a virtual private gateway (VGW) and establishing a BGP session, you create a single logical connection that provides Layer 3 access to all subnets in the VPC, as the VGW handles routing between the Direct Connect link and the VPC's route tables.

Answer

A hosted virtual interface (VIF) provided by an AWS Partner.

Answer

A public virtual interface (VIF) with a BGP session to the VGW.

Answer

A transit virtual interface (VIF) to the VGW.