ANS-C01 Network Implementation Practice Test 17 — 15 Questions

Question 1

A company runs a multi-account AWS environment and has centralized all inter-VPC traffic through an AWS Transit Gateway in the Network account. A new workload VPC is attached to the transit gateway with a single attachment, and the workload team needs to advertise a summary route of 10.20.0.0/16 into the transit gateway route table instead of the individual subnet routes. The VPC has subnets in three Availability Zones. Which action should the network engineer take to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a transit gateway route table entry for 10.20.0.0/16 with the VPC attachment as the target, then disable route propagation from the VPC attachment.. Disabling propagation stops the transit gateway from installing the VPC's more specific subnet routes, and a static 10.20.0.0/16 route targeting the attachment provides the single summarized path. Together they give the workload team one advertised prefix while still allowing traffic to reach every subnet behind that attachment.

Answer

Enable transit gateway route propagation on the VPC attachment and configure a prefix list on the attachment to aggregate the subnet routes.

Answer

Associate the VPC attachment with a new transit gateway route table that contains only the 10.20.0.0/16 static route and disable appliance mode.

Answer

Modify the VPC route table to remove the local route and add a static route for 10.20.0.0/16 pointing to the transit gateway.

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block of 100.64.0.0/16 to the VPC to support a new application that requires a large number of IP addresses. After adding the secondary CIDR, instances in the new CIDR range cannot communicate with instances in the original CIDR range. What is the most likely cause?

Accepted Answer

The security group attached to the instances does not allow traffic from the secondary CIDR block.. When you add a secondary CIDR block to a VPC, the local route in the route table is automatically updated to include the new range, allowing network-level communication between all subnets. However, security groups are stateful and must explicitly allow traffic. If the security group rules only allow traffic from the original CIDR (10.0.0.0/16) and not the new range (100.64.0.0/16), instances in the secondary CIDR will be unable to communicate with instances in the primary CIDR. The fix is to update the security group rules to include the secondary CIDR as an allowed source.

Answer

The VPC does not support communication between primary and secondary CIDR blocks by default.

Answer

The network ACL associated with the subnets in the secondary CIDR is blocking traffic from the original CIDR.

Answer

The route table associated with the subnets in the secondary CIDR does not have a route to the original CIDR block.

Question 3

A network engineer is configuring an AWS Site-to-Site VPN connection between an on-premises router and a virtual private gateway (VGW) attached to a VPC. The on-premises router uses BGP to advertise its routes. The engineer notices that the VPN tunnels are up, but traffic from the VPC to on-premises is not flowing. The VPC route table has a route for the on-premises CIDR pointing to the VGW. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the correct routes via BGP, or the VGW is not learning them.. For a VGW-based VPN, the VGW must learn on-premises routes via BGP and install them in the VPC route table. Even if the route table has a static route, dynamic BGP propagation is needed for the VGW to forward traffic. If the on-premises router fails to advertise the routes, or if BGP is misconfigured, traffic will not flow despite tunnels being up.

Answer

The VPC route table needs a route for the on-premises CIDR pointing to the VPN connection instead of the VGW.

Answer

The security group on the instances in the VPC does not allow outbound traffic to the on-premises CIDR.

Answer

The VPN tunnels are using IKEv2, which is not supported by the VGW.

Question 4

A media company runs a live video ingest tier in a VPC. Producers connect from the internet over TCP to a Network Load Balancer (NLB) whose targets are EC2 instances in an Auto Scaling group. The company must preserve the original client source IP for access-control logging and wants the lowest possible ingest latency. The NLB is currently configured with an IP-type target group. Which change should the network engineer make to meet these requirements?

Accepted Answer

Keep the IP-type target group and enable client IP preservation so the instance target sees the original producer address.. Client IP preservation on a Network Load Balancer is controlled by a target group attribute and is available for IP-type targets. Enabling it lets the backend observe the original producer address, which is what the access-control logging depends on. Because the NLB forwards at Layer 4 without terminating the TCP session, latency stays minimal, satisfying both requirements simultaneously.

Answer

Recreate the target group as an instance-type target group and disable client IP preservation on the NLB.

Answer

Attach an Elastic IP address to each EC2 target and configure the NLB to forward traffic directly to those addresses.

Answer

Migrate the ingest tier behind an Application Load Balancer with sticky sessions enabled to preserve the client address.

Question 5

A network engineer is configuring a Transit Gateway in a hub-and-spoke topology. Spoke VPC A (10.1.0.0/16) and spoke VPC B (10.2.0.0/16) are both attached to the same Transit Gateway. Security policy requires that VPC A and VPC B cannot communicate with each other, but both must reach a shared services VPC (10.0.0.0/16). Which configuration on the Transit Gateway achieves this with the LEAST operational overhead?

Accepted Answer

Create a separate Transit Gateway route table for each spoke VPC, associate each spoke attachment with its own route table, and add only the shared services VPC CIDR as a propagated or static route in each spoke route table.. Isolating spokes at the Transit Gateway routing layer is accomplished by using separate route tables per attachment and only propagating shared routes. This keeps the shared services VPC reachable from both spokes while preventing any route that would allow VPC A to reach VPC B. It scales without per-subnet NACL maintenance.

Answer

Enable appliance mode on the shared services VPC attachment so that traffic from the spokes is forced through the shared services VPC before reaching other spokes.

Answer

Attach a network ACL to each spoke subnet that denies traffic sourced from the other spoke CIDR, and rely on the Transit Gateway default route table for forwarding.

Answer

Configure the Transit Gateway with a single route table, associate all attachments, and add a blackhole route for each spoke CIDR that points to the other spoke attachment.

Question 6

A company needs to give an application running on EC2 instances in a private subnet access to Amazon S3 without traversing the internet or a NAT gateway. The security team requires that traffic to S3 stay within the AWS network and that no additional public IP addresses be consumed. Which solution meets these requirements?

Accepted Answer

Create an interface VPC endpoint for Amazon S3 in the VPC and configure the instances to use it, then update the subnet route tables as needed for the endpoint's elastic network interfaces.. An interface VPC endpoint for Amazon S3 creates private elastic network interfaces in the chosen subnets and supports private DNS, so instances reach S3 using private addresses without a NAT gateway, internet gateway, or public IP. This keeps S3 traffic on the AWS network while allowing security group control of the endpoint interfaces.

Answer

Create a gateway VPC endpoint for Amazon S3 and add a route in the private subnet route table that targets the endpoint's prefix list.

Answer

Deploy an AWS Site-to-Site VPN connection to an AWS region endpoint for S3 and route S3 traffic through the tunnel.

Answer

Attach an Elastic IP address to each EC2 instance and create a route to an internet gateway so that S3 traffic egresses directly over the public internet.

Question 7

A media company runs a live video ingest tier in a VPC. Producers stream UDP video to a Network Load Balancer (NLB) at a fixed Elastic IP so that on-premises firewalls can be whitelisted. Because of a recent surge in traffic, the network team now needs the NLB to distribute each producer's UDP flow across multiple backend instances without the source IP being rewritten, and they must be able to inspect the original client source IP in the application logs. Which NLB configuration should the team use?

Accepted Answer

Configure the target group with the UDP protocol and enable client IP preservation so the backend instances receive the original producer source IP.. A Network Load Balancer supports UDP target groups, and client IP preservation can be enabled so that backend instances observe the original source address of the sender. For a live video ingest scenario where producer IPs must appear in application logs, the UDP target group with client IP preservation enabled is the correct combination.

Answer

Configure the target group with the UDP protocol and disable client IP preservation so the instances receive the load balancer node IP instead.

Answer

Configure the target group with the TCP_UDP protocol and attach an Application Load Balancer as the target so HTTP headers carry the source address.

Answer

Configure the target group with the TLS protocol and terminate the UDP streams on the NLB, then forward decrypted traffic to the instances.

Question 8

A company uses AWS Site-to-Site VPN over a virtual private gateway to connect an on-premises data center to a VPC. The VPN has two tunnels, each terminating in a different Availability Zone. The company wants to ensure that return traffic for a TCP flow always leaves through the same tunnel that the on-premises device used to send the flow, because the on-premises firewall performs stateful inspection. The on-premises router supports only one active tunnel at a time. Which configuration should the network engineer implement?

Accepted Answer

Advertise the on-premises prefixes over BGP with a lower Multi-Exit Discriminator on one tunnel and a higher one on the other, and use a single active tunnel on the customer gateway.. BGP attributes advertised from the customer gateway influence which VPN tunnel AWS selects for traffic toward on-premises. By setting a lower Multi-Exit Discriminator on the preferred tunnel, the on-premises side steers AWS return traffic onto that tunnel, and keeping only one tunnel active on the customer gateway matches the firewall's stateful requirement while the second tunnel remains available for failover.

Answer

Configure the customer gateway with a single BGP session and enable Equal-Cost Multipath across both tunnels.

Answer

Enable tunnel preference on the VPN connection so that AWS advertises a lower BGP MED on the preferred tunnel, and disable the second tunnel.

Answer

Use static routes on the VPN connection and configure the on-premises router to prefer one tunnel by adjusting the tunnel's BGP local preference.

Question 9

A company has a Transit Gateway (TGW) with multiple VPC attachments and a Direct Connect gateway attachment. The on-premises network advertises a summary route of 10.0.0.0/8 to the TGW via BGP. The company also has a VPC with CIDR 10.1.0.0/16 attached to the TGW. A network engineer notices that traffic from on-premises to the VPC is being dropped. The TGW route table shows a propagated route for 10.0.0.0/8 pointing to the Direct Connect gateway attachment, and no specific route for 10.1.0.0/16. What should the engineer do to resolve the issue?

Accepted Answer

Add a static route in the TGW route table for 10.1.0.0/16 pointing to the VPC attachment.. Transit Gateway route tables use longest prefix match to select routes. A propagated summary route (10.0.0.0/8) from the Direct Connect gateway will be used for all traffic within that range unless a more specific route exists. Because the VPC CIDR (10.1.0.0/16) falls within the summary, traffic from on-premises to the VPC is sent back to on-premises, causing a loop or drop. Adding a static route for the VPC CIDR pointing to the VPC attachment creates a more specific route that takes precedence, ensuring correct delivery. This is a common design pattern when using summary routes in hybrid networks.

Answer

Configure the on-premises router to advertise a more specific route for the VPC CIDR.

Answer

Enable appliance mode on the VPC attachment to ensure symmetric routing.

Answer

Disable route propagation for the Direct Connect gateway attachment on the TGW route table.

Question 10

A financial services firm connects an on-premises data centre to AWS using a Transit Gateway. The on-premises router runs BGP and advertises a default route plus several specific prefixes toward the Transit Gateway attachment. The network team needs traffic from a VPC attached to the Transit Gateway to prefer a specific on-premises prefix over the default route, and they must avoid asymmetric routing. Which configuration achieves this?

Accepted Answer

Attach a route table to the VPC attachment that contains a static route for the specific prefix pointing to the Transit Gateway attachment, and associate that route table with the VPC attachment.. Transit Gateway route selection uses longest-prefix match, and static routes can be added to a Transit Gateway route table to override propagated routes. Placing a static route for the specific on-premises prefix in the route table associated with the VPC attachment ensures that prefix is chosen over the default route, while keeping the return path through the same attachment maintains symmetry.

Answer

Enable appliance mode on the VPC attachment so return traffic follows the same Availability Zone as the forward path.

Answer

Disable route propagation on the VPC attachment's route table and rely on the default route learned from the on-premises router.

Answer

Increase the BGP local preference on the on-premises router for the specific prefix and lower it for the default route.

Question 11

A company runs a latency-sensitive application on EC2 instances in a VPC. The instances must communicate with each other using IPv6 addresses, and the company wants to minimize operational overhead while ensuring that all inter-instance traffic stays within the VPC. The VPC and subnets are configured with IPv6 CIDR blocks. Which solution should a network engineer implement?

Accepted Answer

Enable IPv6 on the VPC and subnets, assign IPv6 addresses to the instances, and use security groups to control traffic.. The correct approach is to enable IPv6 on the VPC and subnets, assign IPv6 addresses to the instances, and use security groups to control traffic. This provides native IPv6 connectivity within the VPC without additional components. It meets the low operational overhead requirement because AWS handles the addressing and routing. Other options involve services that do not support IPv6 or are architecturally incorrect for intra-VPC communication.

Answer

Create a VPC peering connection between the subnets and enable IPv6 route propagation.

Answer

Deploy a NAT gateway with an associated IPv6 CIDR block and route all inter-instance traffic through it.

Answer

Assign Elastic IP addresses to the instances and configure security groups to allow IPv6 traffic.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block to the VPC to support additional workloads. The new CIDR block must not overlap with any existing subnets or routes. Which CIDR block can be added as a secondary CIDR to the VPC?

Accepted Answer

10.1.0.0/16. AWS allows adding secondary CIDR blocks to a VPC as long as they do not overlap with any existing CIDR blocks. The primary CIDR is 10.0.0.0/16, so a non-overlapping block like 10.1.0.0/16 is valid. The company's requirement to use the 10.0.0.0/8 range further confirms that 10.1.0.0/16 is the correct choice. Other options either overlap or fall outside the required range.

Answer

192.168.0.0/16

Answer

10.0.1.0/24

Answer

10.0.0.0/16

Question 13

A company runs a latency-sensitive trading application across two VPCs in the same AWS Region. The workload requires the lowest possible inter-VPC latency and jumbo frame support for large market-data bursts. A network engineer must choose the inter-VPC connectivity option that meets these requirements with minimal management overhead. Which solution should the engineer implement?

Accepted Answer

Deploy a VPC peering connection between the two VPCs and ensure both VPCs use instances with enhanced networking enabled.. VPC peering is the lowest-latency, highest-MTU option for connecting two VPCs in the same Region, because traffic stays on the AWS backbone with no intermediate routing device. Enhanced networking on the instances unlocks the packet-per-second and bandwidth needed for bursty market-data traffic, satisfying both the latency and jumbo frame requirements.

Answer

Attach both VPCs to a Transit Gateway and route traffic between them through a shared attachments subnet with a third-party firewall appliance.

Answer

Establish an AWS Site-to-Site VPN between the two VPCs using virtual private gateways on each side and BGP for dynamic routing.

Answer

Use AWS PrivateLink with an endpoint service in one VPC and an interface endpoint in the other VPC to expose the trading application.

Question 14

A financial services firm connects its on-premises data center to AWS using a Site-to-Site VPN over a virtual private gateway. The security team requires that all traffic from a specific on-premises subnet be inspected by a Gateway Load Balancer endpoint in a dedicated inspection VPC before reaching application VPCs. The application VPCs are connected to the inspection VPC through a Transit Gateway. Which combination of route table entries is required to force the traffic through the Gateway Load Balancer endpoint?

Accepted Answer

Add a route in the inspection VPC subnet route table pointing the on-premises CIDR to the Gateway Load Balancer endpoint, and add a route in the Transit Gateway route table pointing the application VPC CIDRs to the inspection VPC attachment.. Centralized inspection with a Gateway Load Balancer endpoint requires the Transit Gateway route table to steer application-bound traffic into the inspection VPC attachment, and the inspection VPC subnet route table to send the on-premises CIDR to the Gateway Load Balancer endpoint. Return traffic then follows the reverse path through the Transit Gateway.

Answer

Add a route in the application VPC subnet route tables pointing the on-premises CIDR to the Gateway Load Balancer endpoint, and add a route in the inspection VPC subnet route table pointing return traffic back to the Transit Gateway.

Answer

Add a route in the Transit Gateway route table pointing the on-premises CIDR to the Gateway Load Balancer endpoint attachment, and associate the application VPC attachments with that route table.

Answer

Add a route in the virtual private gateway route table pointing the on-premises CIDR to the Gateway Load Balancer endpoint, and propagate that route to the application VPCs through the Transit Gateway.

Question 15

A company runs a two-tier application across two VPCs: an application VPC (10.10.0.0/16) and a shared services VPC (10.20.0.0/16). Both VPCs are attached to the same AWS Transit Gateway, but each attachment uses a separate TGW route table. The application VPC's TGW route table contains a static route for 10.20.0.0/16 pointing to the shared services attachment, and the shared services VPC's TGW route table contains a static route for 10.10.0.0/16 pointing to the application attachment. Instances in both VPCs can reach each other, but the network team now needs to guarantee that traffic from the application VPC to the shared services VPC always traverses an AWS Network Firewall endpoint VPC (10.30.0.0/16) before reaching the destination. What change should the network engineer make?

Accepted Answer

Add a static route for 10.20.0.0/16 in the application VPC's TGW route table pointing to the Network Firewall attachment, then add a static route for 10.20.0.0/16 in the firewall VPC's TGW route table pointing to the shared services attachment.. The Transit Gateway route tables determine the next hop for traffic entering the TGW from each attachment. To force application-to-shared-services traffic through the Network Firewall VPC, the application VPC's TGW route table must point the shared services prefix at the firewall attachment, and the firewall VPC's TGW route table must forward that prefix to the shared services attachment. This creates the inspection chain without altering VPC subnet route tables.

Answer

Replace the static routes in both TGW route tables with propagated routes learned from the VPC attachments.

Answer

Create a new Transit Gateway route table, associate the application and shared services attachments with it, and add a blackhole route for 10.20.0.0/16.

Answer

Enable Transit Gateway appliance mode on the application VPC attachment and add a route for 10.20.0.0/16 in the application VPC subnet route tables pointing to the Network Firewall endpoint ENI.