ANS-C01 Network Implementation Practice Test 16 — 15 Questions

Question 1

A company is designing a multi-account AWS environment using AWS Organizations. They need to centralize VPC flow logs and network traffic inspection across all accounts. Which architecture meets these requirements with minimal operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.. It uses a central inspection VPC with AWS Network Firewall and Transit Gateway to route traffic from all VPCs through a single inspection point. This architecture centralizes both VPC flow logs and traffic inspection with minimal operational overhead, as Transit Gateway simplifies network connectivity and AWS Network Firewall provides managed, scalable inspection without per-account firewall management.

Answer

Use AWS Network Firewall in each VPC and aggregate logs centrally.

Answer

Enable VPC flow logs in each account and send them to a central S3 bucket. Use Network Access Analyzer for inspection.

Answer

Create VPC peering connections between all VPCs and deploy a third-party firewall in one VPC.

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should a network engineer implement?

Accepted Answer

Create a VPC gateway endpoint for S3 and add a route to the S3 prefix list via the endpoint.. A VPC gateway endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the S3 prefix list via the gateway endpoint, traffic destined for S3 is directed through the endpoint, which uses AWS's private backbone. This solution is cost-effective and does not require a NAT gateway or internet gateway.

Answer

Create a VPC interface endpoint for S3 and attach it to the private subnet.

Answer

Deploy an S3 VPN endpoint in the VPC.

Answer

Set up a NAT gateway in the public subnet and add a route to the S3 prefix list via the NAT gateway.

Question 3

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC over a private, dedicated connection? (Select TWO.)

Accepted Answer

AWS Direct Connect Gateway. AWS Direct Connect Gateway allows you to connect an on-premises network to multiple VPCs in different AWS regions over a single private, dedicated connection. AWS Direct Connect provides a dedicated private network link from your on-premises data center to AWS, bypassing the public internet for lower latency and increased security.

Answer

AWS Client VPN

Answer

VPC Peering

Answer

AWS VPN CloudHub

Question 4

A company is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) that are peered together. Both VPCs are in the same region. VPC-A has a CIDR of 10.0.0.0/16 and VPC-B has a CIDR of 10.0.0.0/16. The peering connection is established and the route tables are updated. However, EC2 instances in VPC-A cannot ping EC2 instances in VPC-B. What is the most likely cause?

Accepted Answer

The VPCs have overlapping CIDR blocks.. VPC peering requires non-overlapping CIDR blocks because the VPCs must have unique IP address spaces for routing to work correctly. Since both VPC-A and VPC-B use the same CIDR 10.0.0.0/16, the route tables cannot distinguish between the two VPCs, causing traffic to be misrouted or dropped. This is the most likely cause of the ping failure, as overlapping CIDRs prevent proper destination-based routing in the VPC peering connection.

Answer

The route tables do not have routes to the private IP addresses of the instances.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Answer

The VPCs are in different regions and peering does not work across regions.

Question 5

Which TWO of the following are benefits of using an AWS Transit Gateway over VPC peering for connecting multiple VPCs? (Select TWO.)

Accepted Answer

Transitive routing between all attached VPCs.. AWS Transit Gateway supports transitive routing, meaning that any VPC attached to the transit gateway can communicate with any other attached VPC through a single central hub. This eliminates the need to establish a full mesh of VPC peering connections, which would require n*(n-1)/2 individual peering links and manual route table entries for each pair. In contrast, VPC peering does not support transitive routing—if VPC A is peered with VPC B and VPC B is peered with VPC C, VPC A cannot route to VPC C through VPC B.

Answer

Lower data transfer costs between VPCs.

Answer

Built-in internet gateway for all attached VPCs.

Answer

Automatic encryption of traffic between VPCs.

Question 6

Which THREE of the following are required to configure a site-to-site VPN connection between an on-premises network and an Amazon VPC? (Select THREE.)

Accepted Answer

A customer gateway resource representing the on-premises VPN device.. A customer gateway resource is required because it represents the on-premises VPN device in AWS, providing the necessary configuration information such as the device's public IP address and BGP ASN (if dynamic routing is used) to establish the site-to-site VPN connection. Without this resource, AWS has no reference to the remote endpoint for the IPsec tunnels.

Answer

A public virtual interface.

Answer

An AWS Direct Connect connection.

Question 7

A company is connecting their on-premises data center to AWS using a site-to-site VPN. The customer gateway device has a dynamic routing configuration with BGP. The VPN connection is established, but the VPC route table does not contain the on-premises network routes. What is the most likely cause?

Accepted Answer

Route propagation is not enabled on the VPC route table.. When using a site-to-site VPN with dynamic routing (BGP), the VPC route table must have route propagation enabled to automatically import the BGP-advertised routes from the virtual private gateway (VGW). Without route propagation, the VPC route table will not contain the on-premises network routes, even though the VPN tunnel and BGP session are established.

Answer

The customer gateway device is not configured with the correct BGP ASN.

Answer

The VPC route table has static routes pointing to the virtual private gateway.

Answer

The VPN connection is using static routing instead of dynamic routing.

Question 8

A company is deploying a VPC with public and private subnets across two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates without being directly reachable from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT). This satisfies the requirement of internet access without direct reachability.

Answer

Virtual Private Gateway

Answer

VPC Peering Connection

Answer

Internet Gateway

Question 9

A company has deployed a Network Load Balancer (NLB) in a VPC. The NLB is configured with a target group that points to EC2 instances in the same VPC. The network engineer notices that traffic from clients is not being forwarded to the targets. The NLB's security groups and network ACLs allow all traffic. What is the most likely cause?

Accepted Answer

The EC2 instances are missing a route back to the NLB's subnet.. When an NLB forwards traffic to targets, the targets must send response traffic back to the clients. If the EC2 instances lack a route to the NLB's subnet (or the client's IP via the NLB), the return traffic will be dropped, causing the connection to fail. Since the NLB operates at layer 4 and preserves the client IP, the targets need a route back to the client, often via the NLB's private IP or the VPC's default gateway, depending on the architecture.

Answer

The security group attached to the NLB is blocking traffic.

Answer

The NLB health checks are failing, causing targets to be marked unhealthy.

Answer

Cross-zone load balancing is disabled on the NLB.

Question 10

A company has a Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to ensure that traffic always uses the Direct Connect connection when it is available, and only fails over to the VPN if Direct Connect goes down. How should they configure routing?

Accepted Answer

Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN.. BGP selects the most specific prefix (longest prefix match) first, regardless of other attributes. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over VPN, traffic will always prefer the Direct Connect path when it is available. If Direct Connect fails, the more specific prefix is withdrawn, and traffic automatically falls back to the VPN using the less specific prefix.

Answer

Use static routes pointing to the Direct Connect virtual interface with a lower metric than the VPN route.

Answer

Advertise the same prefix over both connections but with a lower AS path length over Direct Connect.

Answer

Advertise the same prefix over both connections but set a higher weight on the VPN BGP session.

Question 11

A company wants to securely connect multiple VPCs in the same region to a common on-premises network using a single Direct Connect connection. Which AWS service should they use to simplify the network architecture?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows you to associate multiple VPCs (in the same or different AWS regions) with a single AWS Direct Connect connection, enabling connectivity to a common on-premises network. This simplifies the architecture by eliminating the need for multiple virtual interfaces or separate Direct Connect connections per VPC. The Direct Connect Gateway acts as a hub that routes traffic between the on-premises network and all associated VPCs via a single private virtual interface (VIF).

Answer

Virtual Private Gateway

Answer

VPC Peering

Answer

Transit Gateway

Question 12

A company wants to securely connect their on-premises data center to AWS using a site-to-site VPN. They have multiple branch offices that also need to connect to AWS. Which AWS service should they use to simplify the management of multiple VPN connections?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (C) acts as a central hub that interconnects VPCs and on-premises networks, allowing you to manage multiple site-to-site VPN connections and branch office attachments through a single gateway. This simplifies routing and reduces operational overhead compared to managing individual VPN connections between each branch and each VPC.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPN CloudHub

Question 13

A company is designing a multi-tier application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must be isolated from all other tiers except the application tier. Which TWO network architectures meet these requirements? (Choose TWO.)

Accepted Answer

Use a public subnet for an Application Load Balancer and private subnets for web, app, and database tiers. Use security groups to restrict traffic between tiers.. It places the Application Load Balancer in a public subnet to receive internet traffic, while the web, app, and database tiers reside in private subnets. Security groups are used to restrict traffic flows: the ALB security group allows inbound HTTP/HTTPS from the internet, the web tier security group allows inbound only from the ALB, the app tier security group allows inbound only from the web tier, and the database tier security group allows inbound only from the app tier. This ensures the application tier is only accessible from the web tier, and the database tier is isolated except from the application tier.

Answer

Use a single public subnet for all tiers and control access with security groups.

Answer

Use private subnets for all tiers and a NAT gateway for internet access from the web tier. Use security groups to control traffic.

Answer

Use a VPN connection from the on-premises network to access all tiers.

Question 14

A company deployed an Application Load Balancer (ALB) in front of a fleet of EC2 instances. Users report intermittent timeouts. The ALB's target group health checks are failing for some instances. The instances are in private subnets with a single NAT Gateway. What is the most likely cause?

Accepted Answer

The security group on the EC2 instances does not allow inbound traffic from the ALB's security group.. The most likely cause is that the security group on the EC2 instances does not allow inbound traffic from the ALB's security group. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health checks will fail, causing intermittent timeouts as the ALB stops routing traffic to unhealthy targets.

Answer

The route tables in the private subnets do not have a default route pointing to the NAT Gateway.

Answer

The EC2 instances are of an unsupported instance type for ALB target groups.

Answer

The NAT Gateway is in a single Availability Zone, causing traffic to fail during an AZ outage.

Question 15

A company is migrating a legacy application to AWS. The application uses multicast traffic between servers. The company needs to support multicast in the AWS VPC. Which TWO solutions can the network engineer recommend? (Choose TWO.)

Accepted Answer

Deploy a third-party virtual firewall or router that supports multicast inside the VPC.. A third-party virtual firewall or router appliance (e.g., from vendors like Palo Alto Networks or Cisco) can be deployed in the VPC and configured to forward multicast traffic using protocols such as IGMP and PIM. This allows the legacy application to continue using multicast within the VPC without native AWS multicast support. Option D is correct because AWS Transit Gateway now supports multicast domains, enabling you to create a multicast group and associate subnets, allowing multicast traffic to flow between attached VPCs and VPN connections.

Answer

Use VPC endpoints for multicast support.

Answer

Use VPC peering connections to allow multicast traffic between VPCs.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain.