ANS-C01 Network Implementation Practice Test 17 — 15 Questions

Question 1

A company is designing a highly available network architecture using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to ensure that if one connection fails, traffic automatically fails over to the other. Which TWO steps should they take? (Select TWO.)

Accepted Answer

Advertise the same prefix over both Direct Connect connections.. To achieve high availability with Direct Connect, you should configure BGP with the same prefix advertised over both connections and enable Bidirectional Forwarding Detection (BFD) for fast failure detection. Option A (same AS number) is not required; Option B (same prefix) is correct; Option D (BFD) is correct; Option C (single VIF) is not recommended; Option E (static routes) is not preferred.

Answer

Use a different BGP AS number for each Direct Connect connection.

Answer

Use static routes instead of BGP for the Direct Connect connections.

Answer

Configure a single virtual interface for both connections.

Question 2

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They need to route traffic to the closest healthy endpoint. Which AWS service should be used for global load balancing?

Accepted Answer

Use AWS Global Accelerator with an endpoint group in each region.. AWS Global Accelerator provides static IP addresses and routes traffic to the closest healthy endpoint, improving performance and availability. Option A is wrong because an ALB is regional. Option B is wrong because a Network Load Balancer is also regional. Option C is wrong because Route 53 with latency routing is a DNS-based approach, not as efficient as Global Accelerator for traffic optimization.

Answer

Use a single Application Load Balancer in one region with cross-region VPC peering.

Answer

Use Route 53 latency-based routing with health checks.

Answer

Use a Network Load Balancer in each region and Route 53 weighted routing.

Question 3

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a subnet that hosts a web application. They need to ensure that traffic from the on-premises network to the web application does not traverse the internet. Which TWO components are required? (Select TWO.)

Accepted Answer

Direct Connect Gateway associated with the Transit Gateway. To connect on-premises to a VPC via Transit Gateway without internet, you need a Direct Connect private VIF attached to a Direct Connect Gateway, and the Direct Connect Gateway must be associated with the Transit Gateway. Option A (VPN) would go over the internet; Option C (Internet Gateway) is internet; Option D (VPC Peering) is not for on-premises; Option E (CloudFront) is a CDN.

Answer

Internet Gateway attached to the VPC

Answer

Site-to-Site VPN connection to the Transit Gateway

Answer

CloudFront distribution in front of the web application

Question 4

A company has a VPC with multiple subnets across three Availability Zones. They are deploying an NFS file system using Amazon EFS. They need high availability and low latency from all subnets. Which EFS deployment option meets these requirements?

Accepted Answer

Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.. EFS One Zone storage class stores data in a single AZ, which does not provide high availability. EFS Standard with Multi-AZ is the correct choice for high availability across AZs. Option A is wrong because EFS One Zone is not highly available. Option C is wrong because EFS Standard with Multi-AZ using mount targets in each AZ provides both high availability and low latency. Option D is wrong because EFS Standard with Multi-AZ using a single mount target would create a single point of failure.

Answer

Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

Answer

Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

Answer

Use EFS One Zone storage class and create mount targets in each Availability Zone.

Question 5

A company has a VPC with a public subnet and a private subnet. They want to allow instances in the private subnet to download patches from the internet. Which THREE components are required? (Select THREE.)

Accepted Answer

Internet Gateway attached to the VPC. For private subnet internet access, you need a NAT Gateway (or NAT instance) in a public subnet, an Internet Gateway attached to the VPC, and a route in the private subnet's route table pointing to the NAT Gateway. Option D (Elastic IP) is needed for the NAT Gateway but is part of the NAT Gateway configuration. Option E (Direct Connect) is not required.

Answer

AWS Direct Connect connection

Answer

Elastic IP address assigned to the NAT Gateway

Question 6

A network engineer is troubleshooting connectivity from an EC2 instance in a private subnet to an S3 bucket. The VPC has a VPC endpoint for S3 configured. The instance can access the internet via a NAT Gateway. Which configuration is MOST likely causing the connection to S3 to fail?

Accepted Answer

The route table for the private subnet is missing a route to the S3 VPC endpoint.. If a VPC endpoint for S3 is configured, traffic to S3 should use the endpoint and not go through the NAT Gateway. If the route table for the private subnet does not have a route to the S3 endpoint, traffic will go through the NAT Gateway, which may have security group restrictions or other issues. Option A is wrong because S3 endpoints do not use IAM roles for network connectivity. Option C is wrong because VPC endpoints do not require a public IP. Option D is wrong because S3 endpoints work across AZs.

Answer

The S3 VPC endpoint is in a different Availability Zone than the instance.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The EC2 instance does not have a public IP address.

Question 7

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

Accepted Answer

The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.. A Gateway endpoint automatically adds a prefix list route to the route table, but the route must point to the endpoint. If the route table already has a route to S3 via an Internet Gateway or NAT, the endpoint route may not be used. However, the most common issue is that the subnet's route table does not have the prefix list route for the S3 endpoint. The exhibit shows the endpoint is associated with the route table, but the route table itself must contain a route to the S3 prefix list (e.g., pl-12345) with the target as the endpoint. Option B (security group) is possible but less likely; Option C (DNS) is not required for Gateway endpoints; Option D (policy) is permissive.

Answer

The endpoint policy denies access to S3 from the instance's IAM role.

Answer

The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.

Answer

The VPC does not have DNS resolution enabled for the endpoint.

Question 8

A company wants to establish a dedicated, private connection between their on-premises data center and AWS. They require consistent, low-latency performance and support for multiple VLANs. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private connection with consistent performance and support for multiple VLANs via Virtual LANs (VLANs). Option A is wrong because a VPN connection uses the public internet. Option C is wrong because VPC peering is for connecting VPCs. Option D is wrong because Transit Gateway is a hub for multiple VPCs and on-premises, but the private connection itself is Direct Connect.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 9

Refer to the exhibit. A Lambda function is attached to a VPC using the network interface eni-1234567890abcdef0. The Lambda function needs to send traffic to an on-premises server via a Direct Connect connection. The traffic is failing. Which setting on the network interface is most likely causing the issue?

Accepted Answer

The SourceDestCheck flag is enabled, which prevents the Lambda function from sending traffic that it is not the source or destination of.. The SourceDestCheck flag is set to true (default). For Lambda functions that are not the source or destination of traffic (e.g., when acting as a NAT or forwarding traffic), this check must be disabled. In this scenario, if the Lambda function is forwarding traffic, the source/destination check would drop packets. Option A (multiple IPs) is not an issue; Option B (security group) could be but the exhibit doesn't show rules; Option C (subnet) is not the direct cause.

Answer

The network interface is in a subnet that does not have a route to the Direct Connect.

Answer

The network interface has two private IP addresses.

Answer

The security group attached to the network interface may be blocking outbound traffic.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (443) traffic. The route table for the private subnet has a default route pointing to a NAT Gateway in the public subnet. Which additional configuration is required to ensure the NAT Gateway can route the traffic?

Accepted Answer

Add a route in the public subnet route table to the Internet Gateway.. The NAT Gateway must be in a public subnet with an Internet Gateway route. The security group of the NAT Gateway does not control traffic; it's a managed service. The NAT Gateway's Elastic IP is automatically assigned. The route table of the public subnet must have a default route to the Internet Gateway. The private subnet route is already correct.

Answer

Configure the security group of the NAT Gateway to allow inbound traffic from the private subnet.

Answer

Add a route in the private subnet route table to the NAT Gateway's private IP.

Answer

Assign an Elastic IP address to the NAT Gateway.

Question 11

Refer to the exhibit. The bucket policy shown is applied to an S3 bucket. A VPC endpoint for S3 is created in a VPC with CIDR 10.0.0.0/16. An EC2 instance in the VPC tries to access an object in the bucket using the VPC endpoint. The request fails. What is the most likely reason?

Accepted Answer

The condition uses aws:SourceIp, which does not work with VPC endpoint traffic.. The condition in the bucket policy uses aws:SourceIp, but when traffic goes through a VPC endpoint, the source IP is the private IP of the instance, which is not evaluated by aws:SourceIp. Instead, aws:SourceVpce should be used. Option A (IAM role) is not shown; Option B (DNS) is unlikely; Option C (route table) is not the issue.

Answer

The bucket policy does not allow s3:ListBucket.

Answer

The EC2 instance does not have an IAM role that allows s3:GetObject.

Answer

The VPC endpoint does not have a route table associated with the instance's subnet.

Question 12

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application needs to store session state in an ElastiCache Redis cluster. The Redis cluster should not be accessible from the internet. Which network design should be used?

Accepted Answer

Place both the EC2 instances and the Redis cluster in private subnets with appropriate security groups.. The Redis cluster should be in a private subnet to prevent internet access. The ALB is typically in a public subnet or a private subnet with an internet-facing ALB. The EC2 instances should be in a private subnet and access Redis via the private subnet. Option A is wrong because a public subnet would expose Redis. Option B is wrong because placing Redis in a public subnet exposes it. Option C is wrong because a NAT Gateway is not needed for private subnet communication within the VPC.

Answer

Place the Redis cluster in a public subnet and restrict access via security group.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a private subnet, with a NAT Gateway for outbound traffic.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a public subnet.

Question 13

A company has deployed a VPC with a public subnet and a private subnet in each of two Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access an external API over HTTPS. What is the MOST secure way to provide this access?

Accepted Answer

Deploy a NAT Gateway in each public subnet and add a default route in the private subnet route tables pointing to the NAT Gateway.. A NAT Gateway in a public subnet allows outbound HTTPS traffic from private instances while preventing inbound traffic. Option A is wrong because a public IP on the instances exposes them. Option C is wrong because a VPN is for private connectivity, not internet. Option D is wrong because VPC endpoint is for specific AWS services, not external APIs.

Answer

Create a VPC endpoint for the external API service.

Answer

Assign public IP addresses to the EC2 instances and allow outbound traffic in the security group.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Question 14

A company is deploying a multi-tier web application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. Which design best meets these requirements?

Accepted Answer

Place the web tier in public subnets with an internet gateway, and the application and database tiers in private subnets. Use security groups to allow traffic from the web tier to the application tier, and from the application tier to the database tier.. Option A is correct because using public subnets for the web tier with an internet gateway and private subnets for the application and database tiers with security groups restricting traffic between tiers is the standard design. Option B is wrong because placing all tiers in public subnets exposes the application and database tiers to the internet. Option C is wrong because placement of tiers does not depend on CIDR blocks but on subnet types and route tables. Option D is wrong because using a single security group for all tiers cannot enforce tier-to-tier access restrictions.

Answer

Place all tiers in public subnets and use security groups to control traffic between tiers.

Answer

Place all tiers in the same subnet and use network ACLs to restrict traffic between tiers.

Answer

Place the web tier in a private subnet and use a NAT gateway for outbound internet access. Place the application and database tiers in public subnets.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). They launch a NAT Gateway in the public subnet and add a route in the private subnet route table: destination 0.0.0.0/0, target nat-gateway-id. An EC2 instance in the private subnet can ping an external server, but cannot connect to it via SSH. The security group allows outbound SSH (port 22), and the NACL allows outbound ephemeral ports. What is the likely cause?

Accepted Answer

The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.. The issue is likely that the external server's security group or firewall is blocking inbound SSH from the NAT Gateway's public IP. The NAT Gateway uses its Elastic IP for outbound traffic, and the external server must allow that IP. Option B is wrong because the NAT Gateway does not block SSH. Option C is wrong because the NACL is permissive. Option D is wrong because the route is correct.

Answer

The NACL on the private subnet is blocking outbound ephemeral ports.

Answer

The route table in the private subnet does not have a route to the NAT Gateway.

Answer

The NAT Gateway is not configured to allow SSH traffic.