ANS-C01 Network Implementation Practice Test 16 — 15 Questions

Question 1

A company wants to securely connect multiple VPCs in the same region to a common on-premises network using a single Direct Connect connection. Which AWS service should they use to simplify the network architecture?

Accepted Answer

Direct Connect Gateway. Option B is correct. A Direct Connect gateway allows you to associate multiple VPCs (via virtual private gateways or transit gateways) to a single Direct Connect connection. Option A is wrong because a transit gateway alone does not include Direct Connect. Option C is wrong because a VPC peering connection is for VPC-to-VPC, not Direct Connect. Option D is wrong because a VPN gateway is for VPN, not Direct Connect.

Answer

Virtual Private Gateway

Answer

VPC Peering

Answer

Transit Gateway

Question 2

A company wants to securely connect their on-premises data center to AWS using a site-to-site VPN. They have multiple branch offices that also need to connect to AWS. Which AWS service should they use to simplify the management of multiple VPN connections?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a hub for connecting multiple VPCs and on-premises networks, simplifying the management of multiple VPN connections. Option A (Direct Connect) is a dedicated connection but not ideal for multiple branch offices. Option B (VPC Peering) is for VPC-to-VPC connections. Option D (VPN CloudHub) is a feature of Virtual Private Gateway but is less scalable than Transit Gateway.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPN CloudHub

Question 3

A company is designing a multi-tier application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must be isolated from all other tiers except the application tier. Which TWO network architectures meet these requirements? (Choose TWO.)

Accepted Answer

Use a public subnet for an Application Load Balancer and private subnets for web, app, and database tiers. Use security groups to restrict traffic between tiers.. Options B and D are correct. Option B uses public subnets for web, private subnets for app, and isolated subnets for database, with security groups controlling access. Option D uses a single private subnet with security groups and an ALB in a public subnet to expose the web tier. Option A is wrong because a single public subnet does not isolate tiers. Option C is wrong because placing all tiers in private subnets with a NAT gateway does not provide inbound access from the internet. Option E is wrong because a VPN connection is not needed.

Answer

Use a single public subnet for all tiers and control access with security groups.

Answer

Use private subnets for all tiers and a NAT gateway for internet access from the web tier. Use security groups to control traffic.

Answer

Use a VPN connection from the on-premises network to access all tiers.

Question 4

A company deployed an Application Load Balancer (ALB) in front of a fleet of EC2 instances. Users report intermittent timeouts. The ALB's target group health checks are failing for some instances. The instances are in private subnets with a single NAT Gateway. What is the most likely cause?

Accepted Answer

The security group on the EC2 instances does not allow inbound traffic from the ALB's security group.. Health checks from the ALB originate from the ALB's subnet and do not require a NAT Gateway. However, if the security group for the instances does not allow inbound traffic from the ALB's security group, health checks will fail. Option A (NAT Gateway) is unrelated; Option B (route table) would affect outbound traffic; Option C (instance type) is unlikely.

Answer

The route tables in the private subnets do not have a default route pointing to the NAT Gateway.

Answer

The EC2 instances are of an unsupported instance type for ALB target groups.

Answer

The NAT Gateway is in a single Availability Zone, causing traffic to fail during an AZ outage.

Question 5

A company is migrating a legacy application to AWS. The application uses multicast traffic between servers. The company needs to support multicast in the AWS VPC. Which TWO solutions can the network engineer recommend? (Choose TWO.)

Accepted Answer

Deploy a third-party virtual firewall or router that supports multicast inside the VPC.. Options A and D are correct. Option A uses a transit gateway with multicast support. Option D uses a third-party virtual appliance to handle multicast. Option B is wrong because VPC peering does not support multicast. Option C is wrong because Direct Connect does not provide multicast. Option E is wrong because VPC endpoints do not support multicast.

Answer

Use VPC endpoints for multicast support.

Answer

Use VPC peering connections to allow multicast traffic between VPCs.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. They create a subnet 10.0.1.0/24 and launch an EC2 instance with a private IP 10.0.1.5. The instance needs to communicate with an on-premises server at 172.16.0.10 over a VPN connection. The VPN connection uses a Virtual Private Gateway. The VPC route table has a route 172.16.0.0/16 pointing to the VPG. The instance cannot reach the on-premises server. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the 172.16.0.0/16 route to the Virtual Private Gateway.. The VPN connection requires that the on-premises network advertise routes to the VPG via BGP. If the on-premises router is not advertising the 172.16.0.0/16 route, the VPG will not have a route to forward traffic. Option A (security group) would affect inbound, not outbound; Option C (NACL) would need to be checked but default NACL allows all; Option D (internet gateway) is not needed for VPN.

Answer

The security group attached to the instance does not allow outbound traffic to 172.16.0.10.

Answer

The instance's route table does not have a route to the internet gateway.

Answer

The network ACL for the subnet denies outbound traffic to the on-premises IP range.

Question 7

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. The VPN uses two tunnels for high availability. The network engineer needs to ensure that if one tunnel goes down, traffic automatically fails over to the other tunnel. Which THREE steps should the engineer perform? (Choose THREE.)

Accepted Answer

Configure BGP on both VPN tunnels.. Options A, B, and D are correct. Using BGP allows dynamic routing and failover. Two customer gateway devices provide physical redundancy. Enabling route propagation on the VPC route table ensures BGP routes are added. Option C is wrong because static routes do not provide automatic failover. Option E is wrong because a single customer gateway device is a single point of failure.

Answer

Configure static routes pointing to the VPN connection.

Answer

Use a single customer gateway device with multiple BGP sessions.

Question 8

A company wants to use AWS Direct Connect to establish a dedicated network connection from their on-premises data center to AWS. They need to connect to a VPC in the us-east-1 region. Which of the following is a required step in the setup process?

Accepted Answer

Create a private virtual interface and attach it to a Virtual Private Gateway.. To establish a Direct Connect connection to a VPC, you must create a private virtual interface (VIF) and attach it to a Virtual Private Gateway (VGW) that is attached to the VPC. The private VIF carries traffic over the dedicated connection and uses BGP to exchange routes between the on-premises network and the VPC via the VGW. This is the core requirement for routing traffic from the Direct Connect link into a VPC.

Answer

Attach a Transit Gateway to the VPC.

Answer

Configure CloudFront to route traffic through the Direct Connect.

Answer

Create a site-to-site VPN connection as a backup.

Question 9

A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An Application Load Balancer (ALB) is deployed in the public subnet, and EC2 instances are in the private subnet. The ALB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the ALB's security group on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24) and allows outbound ephemeral ports. However, the ALB health checks are failing with 503 errors. The network engineer checks the ALB logs and sees that TCP connections are established but HTTP requests are timing out. What is the most likely cause?

Accepted Answer

The ALB health check is configured to use HTTPS but the target only listens on HTTP.. Option D is correct. The network ACL for the private subnet only allows inbound traffic from the public subnet CIDR (10.0.1.0/24). However, the ALB sends health checks from its private IP addresses, which are in the public subnet CIDR, so that should be fine. But the real issue is that the ALB also sends traffic to the targets using its own IP addresses, which are in the public subnet CIDR, so inbound is allowed. However, the outbound rule for the private subnet's network ACL must allow outbound traffic from the targets back to the ALB. The network ACL allows outbound ephemeral ports (1024-65535), but the ALB health check response uses the source port of the ALB (which is ephemeral) and the destination port on the target is 80. The response from the target goes back to the ALB's IP and port. The outbound rule in the network ACL should allow traffic to the ALB's subnet (10.0.1.0/24) on ephemeral ports. But the question says the network ACL allows outbound ephemeral ports without specifying destination. Actually, the outbound rule allows all ephemeral ports to anywhere? It says 'allows outbound ephemeral ports' - typically that means outbound to 0.0.0.0/0 on ephemeral ports. That should be fine. Wait, the issue might be that the network ACL is stateless and the outbound rule must allow the return traffic. The health check request comes from the ALB to the target on port 80. The target responds to the ALB's IP and source port. The outbound rule must allow traffic from the target to the ALB's IP on the ALB's source port (which is ephemeral). If the outbound rule allows all outbound ephemeral ports to 0.0.0.0/0, it should work. So why is it failing? Perhaps the ALB is using a different source IP? Actually, ALB health checks can originate from the ALB's private IP addresses. The network ACL for the private subnet has an inbound rule allowing port 80 from 10.0.1.0/24. That's correct. The outbound rule allows ephemeral ports to 0.0.0.0/0. That should allow the response. But maybe the outbound rule is too restrictive? Alternatively, the security group for the EC2 instances might not allow the response? But security groups are stateful, so if inbound is allowed, outbound is automatically allowed. So security group is fine. The most likely cause is that the network ACL inbound rule only allows from the public subnet CIDR, but the ALB might be using a different IP? No. Another possibility: the health check is sent from the ALB's nodes which are in the public subnet, but the public subnet CIDR is 10.0.1.0/24, so that's fine. Option D says 'The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.' That is incorrect because network ACLs cannot reference security groups. So the correct answer is actually that the network ACL inbound rule should allow from the ALB's security group? No. Let's re-evaluate. The most common issue is that the network ACL is stateless and the outbound rule must allow the response. But the question says the outbound rule allows ephemeral ports. That should be fine. Perhaps the health check is using HTTPS but only port 80 is allowed? The question says port 80. Option B says 'The ALB health check is configured to use HTTPS but the target only listens on HTTP.' That could cause a timeout. But the question says the TCP connection is established, so the port is open. However, if the health check expects a 200 OK and the target returns something else, it could cause a 503. Option A says 'The security group for the ALB does not allow outbound traffic to the targets.' But security groups are stateful, so if inbound is allowed, outbound is allowed. Option C says 'The route table for the private subnet does not have a route to the ALB's subnet.' That would cause no connectivity at all. Actually, the most likely cause is that the health check is using a different port or protocol. But given the options, Option D is the trick: network ACLs cannot reference security groups, so that statement is false, making it a distractor. The correct answer is not listed? Wait, the question is a PBQ with 4 options. Let's list them: A: The security group for the ALB does not allow outbound traffic to the targets. B: The ALB health check is configured to use HTTPS but the target only listens on HTTP. C: The route table for the private subnet does not have a route to the ALB's subnet. D: The network ACL for the private subnet does not allow inbound traffic from the ALB's security group. Option D is impossible because network ACLs don't support security groups. So D is wrong. Option A is unlikely because security groups are stateful. Option C would cause complete failure, not just health check. Option B is plausible: if health check expects HTTPS but target only has HTTP, the health check will get a timeout or non-200 response, causing 503. So the correct answer is B.

Answer

The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.

Answer

The security group for the ALB does not allow outbound traffic to the targets.

Answer

The route table for the private subnet does not have a route to the ALB's subnet.

Question 10

A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?

Accepted Answer

The NAT Gateway is deployed in a private subnet.. The NAT Gateway must be in a public subnet with an Internet Gateway attached. If the NAT Gateway is in a private subnet, it cannot access the internet. Option A (security group) allows outbound; Option B (NACL) default allows; Option D (DNS) is not the issue.

Answer

The security group does not allow inbound traffic from the internet.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The instance's DNS resolution is not configured correctly.

Question 11

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. They also have an EC2 instance in the private subnet that needs to access the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. The security group for the EC2 instance allows outbound HTTPS traffic. The network ACL for the private subnet allows inbound and outbound ephemeral ports. However, the EC2 instance cannot reach the internet. The network engineer checks the NAT Gateway and sees that it has an Elastic IP attached. The engineer also checks the route table for the public subnet and finds no route to the internet. What should the engineer do to fix the issue?

Accepted Answer

Add a route in the public subnet route table to 0.0.0.0/0 via the internet gateway.. Option C is correct. The public subnet needs a route to an internet gateway for the NAT Gateway to forward traffic to the internet. Option A is wrong because the private subnet route is already correct. Option B is wrong because a second NAT Gateway is not needed. Option D is wrong because the NAT Gateway already has an EIP.

Answer

Deploy a second NAT Gateway in the private subnet.

Answer

Add a route in the private subnet route table to 0.0.0.0/0 via the internet gateway.

Answer

Attach a second Elastic IP to the NAT Gateway.

Question 12

A company has a VPC with multiple subnets that are peered with another VPC using a VPC Peering connection. They want to ensure that traffic between the two VPCs is encrypted. What should they do?

Accepted Answer

Use AWS Transit Gateway with a VPN attachment between the VPCs.. VPC Peering does not support encryption of traffic. To add encryption, you can deploy a VPN connection between the VPCs, or use an overlay solution. Option A (Transit Gateway with VPN) is a valid approach. Option B (Internet Gateway) would expose traffic to the internet. Option C (NACL) does not encrypt. Option D (Direct Connect) does not encrypt by default.

Answer

Configure network ACLs to enforce encryption.

Answer

Use AWS Direct Connect with a public VIF.

Answer

Enable encryption on the VPC Peering connection using a security group.

Question 13

A company has a VPC with CIDR 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have a Network Load Balancer (NLB) in the public subnet, and EC2 instances in the private subnet. The NLB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the NLB's private IP addresses on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR and outbound ephemeral ports to 0.0.0.0/0. However, clients connecting to the NLB experience intermittent timeouts. The network engineer checks the NLB logs and sees that connections are established but occasionally drop. The engineer also notices that the EC2 instances have a default route to a NAT Gateway in the public subnet. What is the most likely cause of the intermittent timeouts?

Accepted Answer

The EC2 instances have a default route to the NAT Gateway, causing asymmetric routing.. Option A is correct. When the NLB uses client IP preservation (default), the target instance receives traffic with the client's source IP. The target then sends the response back to the client IP. But the target's default route points to the NAT Gateway, so the response goes to the NAT Gateway instead of directly back to the NLB. The NAT Gateway then sends the response to the internet, but the client expects the response from the NLB's IP, causing asymmetry and potential drops. Option B is wrong because health checks are independent. Option C is wrong because disabling cross-zone load balancing does not cause timeouts. Option D is wrong because the NLB does not have security groups.

Answer

Cross-zone load balancing is disabled on the NLB.

Answer

The NLB health checks are failing, causing targets to be removed.

Answer

The security group for the NLB is blocking inbound traffic.

Question 14

A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?

Accepted Answer

Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.. For internet access, the public subnet's route table must have a default route to the Internet Gateway. Additionally, the instances must have public IP addresses (auto-assign public IP or Elastic IP) and security groups/NACLs allowing inbound traffic. Option B (NAT Gateway) is for private subnets; Option C (VPN) is not needed; Option D (Transit Gateway) is not required.

Answer

Launch a NAT Gateway in the public subnet.

Answer

Attach the VPC to an AWS Transit Gateway.

Answer

Establish a VPN connection to the Internet Gateway.

Question 15

A company has deployed a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which service should be used to provide this access without exposing the instances to inbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.. A NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet but prevents inbound traffic from the internet. Option A is wrong because an Internet Gateway alone would expose instances to inbound traffic. Option C is wrong because a VPN connection is for private connectivity. Option D is wrong because a Direct Connect connection is for dedicated private connectivity.

Answer

Attach an Internet Gateway to the VPC and add a default route to it from the private subnets.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Answer

Use a Direct Connect connection to route traffic through an on-premises internet gateway.