ANS-C01 Network Implementation Practice Test 16 — 15 Questions

Question 1

A media company runs a VPC with an internet-facing Application Load Balancer (ALB) in front of web servers. Security requires that the web servers never receive traffic directly from the internet and that client source IP addresses are visible to the application for geolocation. The web servers run in private subnets and the ALB is in public subnets. Which TWO configurations must be implemented to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the web server security groups to allow inbound traffic only from the ALB security group.. The web servers must be protected from direct internet traffic, so their security groups should allow only the ALB security group as a source. This ensures that only the load balancer can initiate connections to the instances. To make client IPs available for geolocation, the ALB must pass that information; enabling proxy protocol v2 on the target group provides the original client IP in the protocol header. Together, these settings meet both the security and visibility requirements without exposing the instances.

Answer

Assign public IP addresses to the web servers and restrict inbound access using a network ACL.

Answer

Enable sticky sessions on the ALB target group to maintain client affinity.

Answer

Place the ALB in private subnets and attach an internet gateway to the VPC.

Question 2

A network engineer is designing a VPC peering connection between two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.0.1.0/24). The engineer creates the peering connection and accepts it. After adding routes in both VPCs' route tables pointing to the peering connection, the engineer notices that instances in VPC-A cannot communicate with instances in VPC-B. Security groups and network ACLs allow all traffic. What is the most likely cause?

Accepted Answer

The instances in VPC-A and VPC-B are in subnets that are not associated with the route tables that contain the peering routes.. Even when a VPC peering connection is active and routes are added, each subnet must be associated with a route table that contains the route to the peer VPC. If the instances reside in subnets associated with a different route table lacking the peering route, connectivity fails. This is a frequent configuration mistake in multi-route-table VPCs.

Answer

The route tables in both VPCs have not been updated with a route to the peering connection for the other VPC's CIDR.

Answer

The VPC peering connection does not support communication between VPCs with overlapping CIDR blocks.

Answer

The VPC peering connection must be created in the same Availability Zone as the instances to allow traffic.

Question 3

A network engineer is designing a hybrid network using AWS Direct Connect. The company requires that traffic from on-premises to AWS be encrypted end-to-end. The engineer plans to use a Direct Connect connection with a private VIF and a Site-to-Site VPN over the Direct Connect. Which configuration achieves encryption while maintaining the Direct Connect benefits?

Accepted Answer

Create a private VIF and establish a Site-to-Site VPN connection over the private VIF using the VGW as the target.. Establishing a Site-to-Site VPN over a private VIF combines the dedicated, private connectivity of Direct Connect with the encryption of IPsec VPN. The private VIF connects to a virtual private gateway, and the VPN tunnel is established over that private VIF, ensuring that all traffic between on-premises and AWS is encrypted. This approach is commonly used when compliance requires encryption for data in transit over Direct Connect.

Answer

Create a public VIF and run a VPN tunnel over it.

Answer

Enable MACsec on the Direct Connect connection.

Answer

Use a transit VIF with a VPN attachment on a Transit Gateway.

Question 4

A company is deploying a new VPC and wants to use AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team needs to ensure that traffic between VPC attachments is allowed and that route propagation works correctly. Which TWO statements are true about Transit Gateway route tables? (Choose two.)

Accepted Answer

A Transit Gateway route table can have multiple attachments associated with it, and each attachment can be associated with only one route table.. A Transit Gateway attachment can be associated with only one route table, but a route table can have many attachments. Route propagation from a VPC attachment automatically adds the VPC CIDR to the associated route table. These two facts are essential for designing segmented routing domains. The other statements misstate association limits, static route support, or IPv6 capabilities.

Answer

Route propagation must be manually enabled for each VPC attachment, and static routes cannot be added to a Transit Gateway route table.

Answer

A Transit Gateway route table can be associated with multiple attachments, and each attachment can be associated with multiple route tables.

Answer

Transit Gateway route tables only support IPv4 routes and cannot be used with IPv6 traffic.

Question 5

A company has a Transit Gateway (TGW) with multiple VPC attachments and a VPN attachment to an on-premises network. The on-premises network advertises a default route (0.0.0.0/0) to the TGW. A network engineer notices that traffic from a VPC attached to the TGW to another VPC attached to the same TGW is being routed to the on-premises network instead of directly between VPCs. What should the engineer do to ensure VPC-to-VPC traffic stays within AWS?

Accepted Answer

Create a static route in the TGW route table for each VPC CIDR pointing to the VPC attachment.. Transit Gateway route tables use longest prefix match. A propagated default route (0.0.0.0/0) from a VPN attachment will be used for all traffic unless more specific routes exist. To ensure VPC-to-VPC traffic uses the direct VPC attachments, you must add static routes for each VPC CIDR pointing to the respective VPC attachment. These /16 or /24 routes are more specific than the default route and will be preferred. This maintains hybrid connectivity while keeping intra-AWS traffic local.

Answer

Disable route propagation for the VPN attachment on the TGW route table.

Answer

Enable appliance mode on the VPN attachment to ensure symmetric routing.

Answer

Associate the VPC attachments with a separate TGW route table that has no default route.

Question 6

A company runs a critical web application in a VPC across three Availability Zones. The application instances are in private subnets behind an Application Load Balancer (ALB) in public subnets. The security team requires that all inbound traffic to the ALB be inspected by a third-party firewall appliance that supports transparent bridging and can inspect TLS metadata without decryption. The firewall must be able to see the original client IP addresses. Which solution meets these requirements?

Accepted Answer

Use Gateway Load Balancer (GWLB) to route traffic through the firewall appliance, and configure the ALB to use the GWLB endpoint as its target. Enable preserve client IP on the GWLB.. Gateway Load Balancer is purpose-built for inserting transparent network appliances into traffic flows. When the ALB forwards requests to a GWLB endpoint, the firewall appliance can inspect packets while the original client IP is preserved. This architecture supports transparent bridging and meets the security team's requirement without terminating TLS at the ALB.

Answer

Configure the ALB to use AWS WAF with a managed rule group and enable access logs to capture client IPs.

Answer

Deploy the firewall appliance behind an NLB, and configure the ALB to forward requests to the NLB. Enable proxy protocol on the NLB to preserve client IPs.

Answer

Attach the firewall appliance directly to the ALB as a target group member using its private IP address, and enable sticky sessions.

Question 7

A company runs a critical workload in a VPC that uses AWS Transit Gateway to connect to multiple on-premises networks via AWS Site-to-Site VPN and AWS Direct Connect. The network team needs to ensure that traffic between the on-premises networks and the VPC is highly available and that the Transit Gateway can fail over automatically. Which TWO configurations should the team implement? (Choose two.)

Accepted Answer

Create multiple AWS Site-to-Site VPN tunnels across different Availability Zones and enable Transit Gateway VPN attachment with equal-cost multi-path (ECMP) routing.. High availability for hybrid connectivity to a Transit Gateway requires redundant paths. Using multiple VPN tunnels across AZs with ECMP on the Transit Gateway VPN attachment, and/or multiple Direct Connect connections from different locations terminated on a Transit VIF, provides automatic failover and increased resilience. These configurations leverage BGP and ECMP for dynamic routing.

Answer

Configure a single AWS Direct Connect connection with a private virtual interface (VIF) and use BGP for dynamic routing.

Answer

Use a single Transit Gateway attachment for both VPN and Direct Connect, and rely on BGP to automatically fail over between them.

Answer

Enable Transit Gateway route table propagation and association for all attachments to allow dynamic routing updates.

Question 8

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team needs to ensure that traffic between specific VPCs is isolated while still allowing shared access to a central VPC. Which TWO features or configurations should be used to achieve this? (Choose two.)

Accepted Answer

Associate each VPC attachment with a unique Transit Gateway route table and configure static routes only where needed.. Using Transit Gateway route tables with separate routing domains allows you to isolate traffic between VPCs. By associating each VPC attachment with a unique route table and controlling route propagation, you can ensure that only desired routes are shared. This enables isolation while still permitting access to a central VPC through specific static routes. The other options either bypass the Transit Gateway or are not relevant to unicast traffic isolation.

Answer

Use VPC peering between the VPCs that need to communicate.

Answer

Use AWS PrivateLink to connect the VPCs to the central VPC.

Answer

Enable Transit Gateway multicast for all VPC attachments.

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block of 100.64.0.0/16 to support a new application that requires a large number of IP addresses. After associating the new CIDR block, they create a new subnet with CIDR 100.64.1.0/24. However, instances launched in this subnet cannot reach the internet through the existing NAT Gateway in a public subnet. What is the most likely cause?

Accepted Answer

The route table associated with the new subnet does not have a route for 0.0.0.0/0 pointing to the NAT Gateway.. The most likely cause is that the new subnet is associated with the VPC's main route table, which lacks a default route to the NAT Gateway. When you add a secondary CIDR and create a subnet, you must explicitly associate it with a route table that has a 0.0.0.0/0 route pointing to the NAT Gateway. Without that route, instances cannot send traffic beyond the VPC. The NAT Gateway itself supports traffic from any private IP range, so the CIDR block is not the problem.

Answer

The NAT Gateway is in a subnet that does not have a route to the 100.64.0.0/16 CIDR block.

Answer

The NAT Gateway does not support traffic from the 100.64.0.0/16 CIDR range because it is reserved for carrier-grade NAT.

Answer

The new subnet must be explicitly associated with the same network ACL as the public subnet to allow outbound traffic.

Question 10

A company is using AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses dynamic BGP routing. The network engineer needs to ensure that the VPN tunnel remains operational even if the primary internet service provider (ISP) link fails. The company has two ISP links and wants to configure the VPN for high availability. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Use two customer gateways, each with a separate public IP address from a different ISP, and create two VPN connections.. To achieve high availability across two ISP links, you need to eliminate single points of failure. AWS provides two tunnels per VPN connection, but both tunnels may terminate on the same ISP if the customer gateway uses one public IP. By creating two customer gateways, each with a public IP from a different ISP, and establishing two VPN connections to the same virtual private gateway, you can direct each tunnel over a separate ISP. This ensures that if one ISP fails, the other VPN connection remains operational. This design is AWS best practice for redundant hybrid connectivity.

Answer

Enable AWS Global Accelerator for the VPN endpoints to provide failover between ISPs.

Answer

Create a transit gateway and attach the VPN connection to it, then enable ECMP on the transit gateway.

Answer

Configure the VPN connection to use a single tunnel with multiple BGP sessions over different ISPs.

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16 and a subnet in each of three Availability Zones. They need to assign a consistent set of private IP addresses to a fleet of EC2 instances that will host a database cluster. The IP addresses must remain the same even if instances are stopped and started, and the instances must be able to communicate with each other using these IP addresses. Which approach should be used?

Accepted Answer

Use secondary private IP addresses assigned to the instances, and configure the application to use those IPs.. Secondary private IP addresses are associated with an elastic network interface (ENI) and persist for the life of that ENI, even if the instance is stopped and started. This provides a stable private IP for database cluster communication. Primary private IPs can change on stop/start, so they are not suitable for this requirement.

Answer

Configure the instances to use the primary private IP address assigned by DHCP, and set the lease time to infinite.

Answer

Create a placement group and assign static IP addresses to the instances using the placement group's IP pool.

Answer

Assign Elastic IP addresses to each instance and configure the instances to use those addresses for communication.

Question 12

A company has an AWS Lambda function in a VPC that needs to access an Amazon RDS database in the same VPC. The Lambda function is configured with a security group that allows outbound traffic to the RDS security group on port 3306. The RDS security group allows inbound traffic from the Lambda security group on port 3306. However, the Lambda function times out when trying to connect. The VPC has no internet gateway, and the Lambda function does not require internet access. What is the most likely cause?

Accepted Answer

The Lambda function's security group is not attached to the Lambda function's elastic network interface (ENI) correctly, or the ENI is in a subnet without a route to the RDS subnet.. Lambda functions in a VPC rely on Hyperplane ENIs placed in specified subnets. If the ENI's subnet does not have a route to the RDS subnet (though the local route usually suffices), or if the ENI is not properly associated with the security group, connectivity fails. Security group rules alone do not guarantee connectivity if the ENI is misconfigured or in an incorrect subnet.

Answer

The subnet's route table does not have a route to the RDS instance's subnet, but VPC internal routing is automatic.

Answer

The Lambda function's execution role lacks the necessary IAM permissions to describe the RDS instance.

Answer

The Lambda function is not associated with a VPC, so it cannot reach the RDS instance's private IP address.

Question 13

A company is deploying a new web application in a VPC. The application must be accessible from the internet over HTTPS, and the company wants to use its own domain name with an SSL/TLS certificate managed by AWS. The company also requires that the application be highly available across multiple Availability Zones. Which AWS service should be used to distribute incoming traffic?

Accepted Answer

Application Load Balancer. The Application Load Balancer is the correct choice because it provides layer 7 load balancing, supports HTTPS listeners with AWS Certificate Manager certificates, and can distribute traffic across multiple Availability Zones. It also offers advanced routing capabilities that are beneficial for web applications. The other load balancers either operate at lower layers, lack ACM integration, or are designed for different use cases such as appliances or legacy workloads.

Answer

Gateway Load Balancer

Answer

Classic Load Balancer

Answer

Network Load Balancer

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16 and a subnet in each of three Availability Zones. A network engineer needs to create a new subnet that will host a fleet of EC2 instances requiring IPv6 addresses for outbound internet access, but the instances must not be reachable from the internet. The VPC has an internet gateway attached and an egress-only internet gateway created. Which combination of subnet and route table configuration should the engineer use?

Accepted Answer

Create a dual-stack subnet with an associated route table that has a route ::/0 to the egress-only internet gateway, and assign IPv6 addresses to the instances.. An egress-only internet gateway provides outbound-only IPv6 connectivity by allowing IPv6 traffic from the subnet to the internet while blocking unsolicited inbound IPv6 connections. The route table for the subnet must include a ::/0 route pointing to that gateway. Because the VPC has an IPv4 CIDR block and no IPv6 CIDR is mentioned, the new subnet must be dual-stack rather than IPv6-only; IPv6-only subnets require the VPC to have an IPv6 CIDR block. Assigning IPv6 addresses to the instances completes the configuration.

Answer

Create an IPv6-only subnet with an associated route table that has a route ::/0 to the internet gateway, and assign IPv6 addresses to the instances.

Answer

Create an IPv6-only subnet with an associated route table that has a route ::/0 to the egress-only internet gateway, and assign IPv6 addresses to the instances.

Answer

Create a dual-stack subnet with an associated route table that has a route 0.0.0.0/0 to the internet gateway and a route ::/0 to the egress-only internet gateway, and assign IPv6 addresses to the instances.

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16 and a subnet with CIDR 10.0.1.0/24. They need to add a new subnet to the same VPC to host additional resources. The new subnet must be in a different Availability Zone and must not overlap with any existing subnets. Which CIDR block can be used for the new subnet?

Accepted Answer

10.0.2.0/24. The new subnet must be within the VPC CIDR and must not overlap with any existing subnet. The existing subnet is 10.0.1.0/24. A CIDR of 10.0.2.0/24 is within the VPC and does not overlap, and it can be created in a different Availability Zone. The other options either overlap or fall outside the VPC range.

Answer

10.0.1.0/25

Answer

10.0.0.0/24

Answer

10.0.1.128/25