ANS-C01 Network Implementation Practice Test 15 — 15 Questions

Question 1

A company is deploying a multi-tier web application across multiple Availability Zones in a VPC. The architecture includes public-facing Application Load Balancers, Amazon EC2 instances in private subnets, and an Amazon RDS for MySQL Multi-AZ DB instance. To meet compliance requirements, all traffic between the web tier and database tier must be encrypted and must not traverse the internet. Which TWO actions should the company take to implement this securely? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SSL/TLS encryption on the RDS DB instance and configure the web servers to connect using SSL.. Option C is correct because Amazon RDS for MySQL supports SSL/TLS connections, and enabling SSL/TLS on the DB instance while configuring the web servers to connect with SSL ensures the traffic between the web tier and database tier is encrypted in transit, satisfying the compliance requirement for encryption. Option E is correct because the RDS endpoint is a DNS name that resolves to a private IP address within the VPC when the DB instance is not publicly accessible, so using that endpoint keeps database traffic on the private AWS network and prevents it from traversing the internet. Option A is not appropriate because an AWS Site-to-Site VPN is used to connect on-premises networks to AWS, not to secure traffic between subnets within the same VPC. Option B is incorrect because there is no VPC endpoint for Amazon RDS; VPC endpoints are for services such as S3, DynamoDB, and other AWS services via PrivateLink, and RDS access is through its private DNS endpoint. Option D is incorrect because assigning an Elastic IP to an RDS DB instance is not supported and would make the database publicly reachable, violating the requirement that traffic must not traverse the internet.

Answer

Establish an AWS Site-to-Site VPN between the web tier subnets and the database subnet.

Answer

Create a VPC endpoint for Amazon RDS and route database traffic through it.

Answer

Assign an Elastic IP address to the RDS DB instance to ensure a stable IP for the web tier.

Question 2

A company is implementing a hybrid network architecture with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The company needs to ensure that traffic between VPCs is inspected by a centralized security appliance running on EC2 instances in a dedicated inspection VPC. To achieve this, traffic must be routed through the inspection VPC before reaching its destination. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create a blackhole route in the Transit Gateway route table for the VPC CIDR blocks that are destined for other VPCs.. Option B is correct because, to force inter-VPC traffic through the inspection VPC, the Transit Gateway route table must not directly resolve the destination VPC CIDRs to their own attachments; instead, a blackhole route (or more precisely, a route that directs traffic to the inspection VPC attachment) prevents the TGW from bypassing inspection and ensures traffic is sent to the inspection VPC. Option C is correct because the inspection VPC's subnet route tables must have a static route pointing all other VPC CIDRs (and on-premises CIDRs) back to the Transit Gateway, so that after the security appliance inspects the traffic, it is forwarded through the TGW to the final destination. Option A is incorrect because enabling route propagation for all VPC attachments would allow the TGW to learn and directly route to VPC CIDRs, bypassing the inspection VPC. Option D is incorrect because a VPC Gateway Endpoint is only for private access to S3 and DynamoDB, not for attracting or redirecting general inter-VPC traffic. Option E is incorrect because NAT gateways provide outbound internet access for private subnets and do not route traffic between VPCs or through a centralized inspection appliance.

Answer

Enable route propagation for all VPC attachments in the Transit Gateway route table.

Answer

Configure a VPC Gateway Endpoint for the inspection VPC to attract traffic.

Answer

Deploy a NAT gateway in each VPC to route traffic through the inspection VPC.

Question 3

A company is implementing a multicast application in AWS. The application requires that multicast traffic be forwarded between Amazon EC2 instances in different VPCs. The company has set up a multicast domain using AWS Transit Gateway Connect with multicast support. The multicast group is using the IP address 239.0.1.10. The network engineer has confirmed that the EC2 instances are registered as multicast members and that the Transit Gateway multicast domain is configured correctly. However, receivers in VPC B are not receiving multicast traffic from senders in VPC A. What is the MOST likely cause of this issue?

Accepted Answer

The security group for the sender EC2 instances does not allow outbound UDP traffic to the multicast group address.. The issue is that the sender EC2 instances' security group must allow outbound UDP traffic to the multicast group address 239.0.1.10. Even though the Transit Gateway multicast domain is correctly configured, security groups act as a virtual firewall at the instance level and can block multicast traffic if the appropriate outbound rule is not present. Option C is correct because without this rule, the traffic is blocked at the source. Option A is incorrect because multicast groups are not tied to specific subnets; they are associated with the transit gateway. Option B is incorrect because TTL is not a limiting factor in this scenario; AWS Transit Gateway multicast handles traffic within the domain regardless of TTL. Option D is incorrect because IGMP join messages are not required; multicast group members are statically registered in the Transit Gateway multicast domain.

Answer

The multicast group is not associated with the correct subnet in VPC A.

Answer

The multicast traffic has a TTL value of 1, which prevents it from leaving the source subnet.

Answer

The receiver instances are not sending IGMP join messages to the multicast group.

Question 4

A company is implementing an AWS Client VPN endpoint to provide remote access to its VPC resources. The company's on-premises network uses a split-tunneling configuration to route only corporate traffic through the VPN. The Client VPN endpoint is associated with a single subnet in the VPC. Users report that they can connect to the Client VPN but cannot reach resources in the VPC. The Client VPN endpoint's security group allows all traffic. What is the MOST likely cause of this issue?

Accepted Answer

The route table of the subnet where the Client VPN endpoint is attached does not have a route to the VPC CIDR.. The Client VPN endpoint is attached to a subnet. For clients to reach resources in the VPC, the subnet's route table must have a route to the VPC CIDR. Without this route, traffic from the VPN clients cannot reach the VPC resources, even though the VPN connection is established. Option A is incorrect because the security group for the Client VPN endpoint already allows all traffic, so inbound rules are not the issue. Option B is incorrect because authorization rules control access to specific target networks, but the fundamental routing issue prevents any traffic from reaching the VPC. Option D is incorrect because split-tunneling is about routing client traffic; the routing issue here is on the AWS side, not the client side.

Answer

The security group associated with the Client VPN endpoint does not allow inbound traffic from the client CIDR.

Answer

The authorization rules do not grant access to the target subnets.

Answer

The Client VPN endpoint is configured with full-tunneling instead of split-tunneling.

Question 5

A company is migrating its on-premises data center to AWS and wants to extend its Layer 2 network to AWS using AWS Outposts. The company has an existing VLAN with IP subnet 10.0.1.0/24 that hosts a legacy application requiring direct Layer 2 connectivity between on-premises servers and Outposts racks. The network engineer has installed an Outposts rack in the data center and connected it to the on-premises network via a local gateway (LGW) with a VLAN interface. The engineer has created a subnet in the Outposts VPC with CIDR 10.0.1.0/24 and launched EC2 instances. However, the on-premises servers cannot communicate with the Outposts instances. The LGW is configured correctly. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure the LGW VLAN interface with the correct VLAN ID that matches the on-premises VLAN.. For AWS Outposts, when connecting to an on-premises network via a local gateway (LGW), the LGW VLAN interface must be configured with the correct VLAN ID that matches the on-premises VLAN. If the VLAN ID is incorrect, traffic cannot be properly tagged and routed between the on-premises servers and the Outposts instances, even if the CIDR blocks match.

Answer

Create a VPC peering connection between the Outposts VPC and the on-premises network via the LGW.

Answer

Set up a Direct Connect private virtual interface from the on-premises router to the Outposts VPC.

Answer

Attach the Outposts VPC to a Transit Gateway and peer with on-premises network.

Question 6

A company has deployed a multi-account AWS environment using AWS Organizations. Each account has one or more VPCs that need to communicate with each other and with an on-premises data center via a central transit VPC. The company uses AWS Transit Gateway with a centralized network account that hosts the Transit Gateway. VPCs from other accounts are attached to the Transit Gateway via Resource Access Manager (RAM) shares. The network team notices that after attaching a new VPC from a member account, resources in that VPC cannot communicate with resources in other attached VPCs. The Transit Gateway route tables have appropriate routes, and the VPC route tables point to the Transit Gateway. What is the MOST likely cause of the issue?

Accepted Answer

The Transit Gateway attachment in the member account is in the 'pending acceptance' state and not yet accepted by the Transit Gateway owner.. When a VPC is attached to a Transit Gateway via RAM share, the attachment must be accepted by the Transit Gateway owner if the VPC is in a different account. If the attachment is in 'pending acceptance', no traffic can flow. Therefore, the most likely cause is that the attachment has not been accepted.

Answer

The Transit Gateway route table does not have the routes from the new VPC propagated.

Answer

The new VPC's CIDR overlaps with an existing attachment's CIDR.

Answer

The member account's VPC does not have a route to the Transit Gateway in its route tables.

Question 7

A company is implementing a network architecture for a critical application that requires ultra-low latency between two Amazon EC2 instances. The instances are launched in two different Availability Zones within the same AWS Region. The network engineer needs to ensure that traffic between the instances uses the lowest latency path possible. The instances are placed in a cluster placement group. The application uses TCP. The engineer has configured the security groups to allow all traffic between the instances. However, latency is higher than expected. What should the engineer do to reduce latency?

Accepted Answer

Enable Elastic Network Adapter (ENA) and enhanced networking on both instances.. Enhanced networking with ENA (Elastic Network Adapter) is required to achieve the highest packet-per-second (PPS) performance, lowest latency, and lowest jitter on supported EC2 instances. Without it, instances fall back to the paravirtualized network driver, which adds CPU overhead and increases latency. Since the instances are already in a cluster placement group (which provides low-latency, high-bandwidth connectivity within a single AZ), enabling ENA is the correct step to reduce latency further. Note: cluster placement groups only support instances within the same Availability Zone, so the scenario's mention of two AZs is inconsistent, but the question's core intent is to test enhanced networking.

Answer

Configure the instances to use their private IP addresses instead of public IPs for communication.

Answer

Move the instances to the same subnet within the same Availability Zone.

Answer

Set up a VPC peering connection between the subnets in the two Availability Zones.

Question 8

A company is setting up an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a virtual private gateway (VGW) attached, and the VPN connection uses two tunnels for redundancy. The on-premises customer gateway (CGW) is configured with the public IP address of the on-premises VPN device. The VPN tunnels are up and BGP sessions are established. However, the company cannot ping an EC2 instance in the VPC from an on-premises server. The security group for the EC2 instance allows ICMP from the on-premises network CIDR. What is the MOST likely cause of the issue?

Accepted Answer

The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.. Even with VPN tunnels up and BGP sessions established, traffic cannot flow from on-premises to the VPC unless the VPC subnet route tables contain a route for the on-premises CIDR pointing to the virtual private gateway. Without this route, return traffic from the EC2 instance has no path back to on-premises, so the ping fails. This is the most common omission when configuring Site-to-Site VPN.

Answer

The customer gateway is configured with an incorrect private IP address.

Answer

The VPN connection's security group is blocking ICMP traffic.

Answer

The BGP session is not advertising the on-premises routes to the VGW.

Question 9

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and uses a public subnet. The EC2 instances are in private subnets. The application needs to be accessible from the internet. The security group for the ALB allows inbound HTTP and HTTPS from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic from the ALB's security group. The route tables for the private subnets have a default route to a NAT gateway. Users report that they cannot access the application. The ALB target group shows the instances as unhealthy. What is the MOST likely cause?

Accepted Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port.. The most likely cause is that the EC2 instances' security group does not allow inbound traffic from the ALB's security group on the health check port. ALB health checks originate from the ALB nodes and use the instance's port and health check path. If the security group rule is missing or misconfigured (e.g., wrong port), the health checks fail, and the targets are marked unhealthy. Even though the rule may exist for application traffic, the health check port might differ.

Answer

The ALB is deployed in a private subnet instead of a public subnet.

Answer

The ALB does not have an associated internet gateway route.

Answer

The NAT gateway is not correctly routing traffic from the instances to the internet.

Question 10

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises data center to a VPC. The VPC has a virtual private gateway (VGW) attached. The company has recently added a second VPC and wants to use the same Direct Connect connection to access both VPCs. The network engineer proposes using a Direct Connect gateway (DXGW) with two private VIFs, one for each VPC. However, the engineer wants to minimize complexity and cost. Which configuration should the engineer use to allow both VPCs to use the same Direct Connect connection?

Accepted Answer

Create a Direct Connect gateway and associate it with the private VIF. Then associate both VPCs' virtual private gateways with the Direct Connect gateway.. A Direct Connect gateway (DXGW) allows a single private VIF to connect to multiple VPCs across different regions and accounts by associating multiple virtual private gateways (VGWs) with the DXGW. This minimizes complexity and cost because only one private VIF is needed, and the DXGW handles the routing between on-premises and all associated VPCs.

Answer

Create a private VIF for each VPC on the same Direct Connect connection.

Answer

Create a public virtual interface on the Direct Connect connection and attach both VPCs to it.

Answer

Create a single private VIF and attach both VPCs directly to it.

Question 11

A company is deploying a new VPC with public and private subnets. The company wants to ensure that EC2 instances in the private subnet can access the internet for software updates. The instances do not need to be accessible from the internet. The network engineer has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, instances in the private subnet cannot reach the internet. The NAT gateway is in the 'available' state. What is the MOST likely cause?

Accepted Answer

The NAT gateway does not have an Elastic IP address associated.. An Elastic IP must be associated with the NAT gateway for it to work. Option A is incorrect because the NAT gateway is already in a public subnet. Option C is incorrect because the route is present. Option D is incorrect because security groups do not block outbound traffic to internet by default.

Answer

The NAT gateway is not in a public subnet.

Answer

The private subnet's route table does not have a default route to the NAT gateway.

Answer

The security group of the EC2 instances blocks outbound traffic.

Question 12

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC has two subnets: subnet A (172.16.1.0/24) and subnet B (172.16.2.0/24). The company launches an EC2 instance in subnet A with a private IP of 172.16.1.10 and a public IP. The instance's security group allows inbound SSH from 0.0.0.0/0. The subnet A's route table has a route to an internet gateway (IGW) for 0.0.0.0/0. The network engineer can SSH into the instance from the internet. The company then attaches a second network interface (eth1) to the instance with an IP from subnet B (172.16.2.20). The engineer wants to use this interface for additional management traffic. After attaching, the engineer can no longer SSH into the instance via the original public IP. What is the MOST likely cause?

Accepted Answer

The operating system's routing table now uses eth1 as the default gateway, causing asymmetric routing.. When a second ENI (eth1) is attached to an EC2 instance, the operating system may reconfigure its default route to use the new interface, especially if both interfaces have default routes. This causes outbound traffic to leave via eth1 while inbound SSH responses try to return via eth0, creating asymmetric routing that breaks the SSH session. The instance's public IP is associated with eth0, so return traffic must go through eth0.

Answer

The route table for subnet B does not have a route to the IGW.

Answer

The security group for eth1 blocks inbound SSH.

Answer

The internet gateway is not attached to subnet B.

Question 13

A company is deploying a multi-tier web application across multiple Availability Zones in a VPC. The architecture includes public-facing Application Load Balancers, Amazon EC2 instances in private subnets, and an Amazon RDS for MySQL Multi-AZ DB instance. To meet compliance requirements, all traffic between the web tier and database tier must be encrypted and must not traverse the internet. Which TWO actions should the company take to implement this securely? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install a certificate on each EC2 instance and configure the target group to use HTTPS.. Option B is correct because to encrypt traffic between the ALB and the EC2 instances, the target group must use the HTTPS protocol, and each EC2 instance must present a valid TLS certificate (installed on the instance or via a load balancer) so the ALB can establish a TLS session to the targets. Option D is correct because the requirement explicitly states the application must support HTTP health checks from the ALB; however, since the target group protocol is HTTPS, the health check protocol must also be set to HTTPS to match the encrypted target communication and succeed—configuring the health check as HTTPS ensures the ALB can perform health checks over the same TLS channel. Option A is incorrect because an HTTP listener would not encrypt traffic from the client to the ALB, and stickiness is unrelated to encryption. Option C is incorrect because setting the target group protocol to HTTP would leave the ALB-to-instance traffic unencrypted, violating the requirement. Option E is incorrect because allowing inbound HTTP from the ALB would not encrypt traffic and is unnecessary when the target group uses HTTPS; the security group should allow HTTPS (port 443) from the ALB instead.

Answer

Configure the ALB listener to use HTTP and enable stickiness.

Answer

Configure the ALB listener to use HTTPS and set the target group protocol to HTTP.

Answer

Configure the security group for EC2 instances to allow inbound HTTP traffic from the ALB.

Question 14

A global e-commerce company operates a production environment on AWS with a VPC (10.0.0.0/16) containing public and private subnets in three Availability Zones. The application runs on EC2 instances in private subnets behind an Application Load Balancer (ALB) in public subnets. The company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers via Site-to-Site VPN. Recently, the operations team noticed intermittent connectivity issues: users in the Asia-Pacific region experience slow page load times and occasional timeouts, while users in other regions have no issues. The network team suspects packet loss or high latency on the VPN connection to the on-premises data center in Singapore, which hosts a critical database. The AWS Direct Connect connection is not yet available. The team ran a traceroute from an EC2 instance in the production VPC to the database server (IP 203.0.113.50) and observed high latency and packet loss on the fifth hop (a transit gateway attachment). The VPN tunnel status shows 'UP' on both ends. CloudWatch metrics for the VPN tunnel show no errors but high 'TunnelData' bytes. What should the network engineer do FIRST to resolve the issue?

Accepted Answer

Enable jumbo frames on the transit gateway and the EC2 instances in the private subnets.. Enabling jumbo frames on the transit gateway and EC2 instances allows larger MTU, reducing packet fragmentation and the associated packet loss and latency. The high 'TunnelData' bytes and packet loss on the attachment suggest MTU mismatch. Option B is incorrect because adding a second VPN tunnel with ECMP increases bandwidth but does not fix MTU issues. Option C is incorrect because Direct Connect is not available yet and the problem is not routing. Option D is incorrect because stronger encryption does not affect MTU.

Answer

Increase the VPN tunnel bandwidth by creating a second VPN tunnel and enabling ECMP.

Answer

Modify the BGP attributes on the transit gateway to prefer the Direct Connect path once it becomes available.

Answer

Rebuild the VPN connection using a different customer gateway device with stronger encryption.

Question 15

A network engineer is deploying a VPC with a CIDR block of 10.0.0.0/16. The company requires that instances in a private subnet (10.0.1.0/24) can access an Amazon S3 bucket without traversing the public internet. The engineer creates an interface VPC endpoint for S3 in the private subnet. However, instances still cannot reach S3. What is the most likely cause?

Accepted Answer

The route table associated with the private subnet does not have a route to the prefix list for S3.. When you create an interface VPC endpoint for S3, you must add a route to the AWS-managed prefix list for S3 in the route table associated with the subnet where the endpoint ENIs are created. The route target is the endpoint's ENI. Without this route, instances in that subnet will not send traffic to the endpoint, and the connection fails. Security groups and bucket policies are also important, but the missing route is the most common cause of immediate failure after endpoint creation.

Answer

The VPC does not have an internet gateway attached, so S3 cannot be reached.

Answer

The security group on the endpoint does not allow outbound traffic to the S3 prefix list.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.