ANS-C01 Network Implementation Practice Test 17 — 15 Questions

Question 1

A company has a VPC with a CIDR of 10.0.0.0/16. They create a subnet 10.0.1.0/24 and launch an EC2 instance with a private IP 10.0.1.5. The instance needs to communicate with an on-premises server at 172.16.0.10 over a VPN connection. The VPN connection uses a Virtual Private Gateway. The VPC route table has a route 172.16.0.0/16 pointing to the VPG. The instance cannot reach the on-premises server. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises router is not advertising the 172.16.0.0/16 route to the Virtual Private Gateway.. The VPN connection requires the on-premises router to advertise the 172.16.0.0/16 route to the Virtual Private Gateway (VPG) via BGP (or static route configuration) for the VPG to forward traffic to the on-premises network. Without this route advertisement, the VPG will not have a path to 172.16.0.10, even though the VPC route table has a route pointing to the VPG. The instance's traffic reaches the VPG, but the VPG cannot forward it because it lacks the necessary routing information from the on-premises side.

Answer

The security group attached to the instance does not allow outbound traffic to 172.16.0.10.

Answer

The instance's route table does not have a route to the internet gateway.

Answer

The network ACL for the subnet denies outbound traffic to the on-premises IP range.

Question 2

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. The VPN uses two tunnels for high availability. The network engineer needs to ensure that if one tunnel goes down, traffic automatically fails over to the other tunnel. Which THREE steps should the engineer perform? (Choose THREE.)

Accepted Answer

Configure BGP on both VPN tunnels.. BGP is the correct choice for automatic failover because it enables dynamic route advertisement and withdrawal over the VPN tunnels. When a tunnel fails, BGP withdraws the corresponding routes, causing the VPC route table to automatically use the remaining tunnel's routes. This eliminates the need for manual intervention or static route manipulation.

Answer

Configure static routes pointing to the VPN connection.

Answer

Use a single customer gateway device with multiple BGP sessions.

Question 3

A company wants to use AWS Direct Connect to establish a dedicated network connection from their on-premises data center to AWS. They need to connect to a VPC in the us-east-1 region. Which of the following is a required step in the setup process?

Accepted Answer

Create a private virtual interface and attach it to a Virtual Private Gateway.. To establish a Direct Connect connection to a VPC, you must create a private virtual interface (VIF) and attach it to a Virtual Private Gateway (VGW) that is attached to the VPC. The private VIF carries traffic over the dedicated connection and uses BGP to exchange routes between the on-premises network and the VPC via the VGW. This is the core requirement for routing traffic from the Direct Connect link into a VPC.

Answer

Attach a Transit Gateway to the VPC.

Answer

Configure CloudFront to route traffic through the Direct Connect.

Answer

Create a site-to-site VPN connection as a backup.

Question 4

A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?

Accepted Answer

The NAT Gateway is deployed in a private subnet.. The NAT Gateway must be deployed in a public subnet with an Internet Gateway (IGW) attached to its route table to translate private IP addresses to the IGW's public IP. If the NAT Gateway is in a private subnet, it has no route to the internet, so traffic from the private EC2 instance reaches the NAT Gateway but cannot be forwarded to the internet. This is the most likely issue because the route table correctly points to the NAT Gateway, but the gateway itself lacks internet connectivity.

Answer

The security group does not allow inbound traffic from the internet.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The instance's DNS resolution is not configured correctly.

Question 5

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. They also have an EC2 instance in the private subnet that needs to access the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. The security group for the EC2 instance allows outbound HTTPS traffic. The network ACL for the private subnet allows inbound and outbound ephemeral ports. However, the EC2 instance cannot reach the internet. The network engineer checks the NAT Gateway and sees that it has an Elastic IP attached. The engineer also checks the route table for the public subnet and finds no route to the internet. What should the engineer do to fix the issue?

Accepted Answer

Add a route in the public subnet route table to 0.0.0.0/0 via the internet gateway.. The NAT Gateway resides in the public subnet, and for the NAT Gateway to forward traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway. Without that route, the NAT Gateway cannot send traffic to the internet, even though the private subnet's route points to the NAT Gateway. Options A, C, and D are incorrect: A is unnecessary because a NAT Gateway in the private subnet would not have direct internet access; C would bypass the NAT Gateway and require a route to the internet gateway directly from the private subnet, which is not the standard design; D is wrong because adding another Elastic IP does not solve the missing route issue.

Answer

Deploy a second NAT Gateway in the private subnet.

Answer

Add a route in the private subnet route table to 0.0.0.0/0 via the internet gateway.

Answer

Attach a second Elastic IP to the NAT Gateway.

Question 6

A company has a VPC with multiple subnets that are peered with another VPC using a VPC Peering connection. They want to ensure that traffic between the two VPCs is encrypted. What should they do?

Accepted Answer

Use AWS Transit Gateway with a VPN attachment between the VPCs.. VPC Peering does not support encryption of traffic in transit. To encrypt traffic between VPCs, you can use AWS Transit Gateway with a VPN attachment, which establishes an IPsec VPN tunnel that encrypts all traffic between the VPCs. This solution meets the requirement for encrypted inter-VPC communication while still allowing connectivity across multiple subnets.

Answer

Configure network ACLs to enforce encryption.

Answer

Use AWS Direct Connect with a public VIF.

Answer

Enable encryption on the VPC Peering connection using a security group.

Question 7

A company has a VPC with CIDR 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have a Network Load Balancer (NLB) in the public subnet, and EC2 instances in the private subnet. The NLB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the NLB's private IP addresses on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR and outbound ephemeral ports to 0.0.0.0/0. However, clients connecting to the NLB experience intermittent timeouts. The network engineer checks the NLB logs and sees that connections are established but occasionally drop. The engineer also notices that the EC2 instances have a default route to a NAT Gateway in the public subnet. What is the most likely cause of the intermittent timeouts?

Accepted Answer

The EC2 instances have a default route to the NAT Gateway, causing asymmetric routing.. The NLB with client IP preservation sends traffic to targets with the client's source IP. The EC2 instances have a default route pointing to the NAT Gateway. When the instance responds to a client, the response is routed to the NAT Gateway (because the destination is the client's IP, which is outside the VPC). The NAT Gateway then sends the response to the internet, but the client expects the response from the NLB's IP address. This asymmetric routing causes the NLB to not see the response, leading to intermittent timeouts. Options A, B, and D are incorrect: disabling cross-zone load balancing does not cause timeouts, health checks are independent, and NLB does not have security groups.

Answer

Cross-zone load balancing is disabled on the NLB.

Answer

The NLB health checks are failing, causing targets to be removed.

Answer

The security group for the NLB is blocking inbound traffic.

Question 8

A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?

Accepted Answer

Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.. For instances in a public subnet to be reachable from the internet, the subnet's route table must include a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). The IGW itself is a horizontally scaled, redundant component that provides a target for internet-bound traffic, but without the route, traffic from the internet cannot reach the instances. This route enables bidirectional communication: the IGW performs NAT for instances with public IPs, translating their private IPs to the associated Elastic IP or public IP.

Answer

Launch a NAT Gateway in the public subnet.

Answer

Attach the VPC to an AWS Transit Gateway.

Answer

Establish a VPN connection to the Internet Gateway.

Question 9

A company has deployed a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which service should be used to provide this access without exposing the instances to inbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) to the gateway’s Elastic IP, enabling outbound-only access.

Answer

Attach an Internet Gateway to the VPC and add a default route to it from the private subnets.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Answer

Use a Direct Connect connection to route traffic through an on-premises internet gateway.

Question 10

A company is designing a highly available network architecture using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to ensure that if one connection fails, traffic automatically fails over to the other. Which TWO steps should they take? (Select TWO.)

Accepted Answer

Advertise the same prefix over both Direct Connect connections.. Advertising the same prefix over both Direct Connect connections allows BGP to provide automatic failover. When one connection fails, BGP withdraws the route for that prefix, and traffic is redirected to the remaining connection. This leverages BGP's path selection and route propagation to achieve active/backup or active/active redundancy without manual intervention.

Answer

Use a different BGP AS number for each Direct Connect connection.

Answer

Use static routes instead of BGP for the Direct Connect connections.

Answer

Configure a single virtual interface for both connections.

Question 11

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They need to route traffic to the closest healthy endpoint. Which AWS service should be used for global load balancing?

Accepted Answer

Use AWS Global Accelerator with an endpoint group in each region.. AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via Anycast IP addresses and endpoint groups in each region. It provides static IP addresses and intelligent traffic distribution based on latency, health, and geography, making it ideal for multi-region ALB architectures requiring global load balancing.

Answer

Use a single Application Load Balancer in one region with cross-region VPC peering.

Answer

Use Route 53 latency-based routing with health checks.

Answer

Use a Network Load Balancer in each region and Route 53 weighted routing.

Question 12

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a subnet that hosts a web application. They need to ensure that traffic from the on-premises network to the web application does not traverse the internet. Which TWO components are required? (Select TWO.)

Accepted Answer

Direct Connect Gateway associated with the Transit Gateway. A Direct Connect Gateway associated with the Transit Gateway allows traffic from on-premises networks to reach VPCs attached to the Transit Gateway without traversing the internet. This association enables the Transit Gateway to route traffic between Direct Connect virtual interfaces and VPC attachments using private IP addresses, ensuring the path remains over the AWS private network.

Answer

Internet Gateway attached to the VPC

Answer

Site-to-Site VPN connection to the Transit Gateway

Answer

CloudFront distribution in front of the web application

Question 13

A company has a VPC with multiple subnets across three Availability Zones. They are deploying an NFS file system using Amazon EFS. They need high availability and low latency from all subnets. Which EFS deployment option meets these requirements?

Accepted Answer

Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.. The EFS Standard storage class provides Multi-AZ durability and availability, and creating mount targets in each Availability Zone ensures that EC2 instances in any subnet can connect to EFS with low latency by using a mount target in the same AZ. This architecture avoids cross-AZ data transfer charges and minimizes latency, meeting both high availability and low latency requirements.

Answer

Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

Answer

Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

Answer

Use EFS One Zone storage class and create mount targets in each Availability Zone.

Question 14

A company has a VPC with a public subnet and a private subnet. They want to allow instances in the private subnet to download patches from the internet. Which THREE components are required? (Select THREE.)

Accepted Answer

Internet Gateway attached to the VPC. An Internet Gateway (IGW) is required to provide a target in the VPC's route tables for internet-bound traffic. The NAT Gateway must be deployed in a public subnet and assigned an Elastic IP address so that it can route traffic through the IGW to the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling instances in the private subnet to initiate outbound connections to the internet for patch downloads while remaining inaccessible from the internet.

Answer

AWS Direct Connect connection

Answer

Elastic IP address assigned to the NAT Gateway

Question 15

A network engineer is troubleshooting connectivity from an EC2 instance in a private subnet to an S3 bucket. The VPC has a VPC endpoint for S3 configured. The instance can access the internet via a NAT Gateway. Which configuration is MOST likely causing the connection to S3 to fail?

Accepted Answer

The route table for the private subnet is missing a route to the S3 VPC endpoint.. For an EC2 instance in a private subnet to use a VPC endpoint for S3, the subnet's route table must include a route with the S3 endpoint's prefix list as the destination and the VPC endpoint ID as the target. Without this route, traffic destined for S3 will be sent to the NAT Gateway instead, which may fail if the instance lacks a public IP or if the NAT Gateway's route table or security groups block the traffic. Option B correctly identifies this missing route as the most likely cause.

Answer

The S3 VPC endpoint is in a different Availability Zone than the instance.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The EC2 instance does not have a public IP address.