ANS-C01 Network Implementation Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.. A Gateway VPC Endpoint for S3 works by adding a route in the subnet's route table that points the S3 prefix list (com.amazonaws.region.s3) to the endpoint ID (vpce-xxx). Without this specific route, traffic destined for S3 from the subnet associated with rtb-11111111 will follow the default route (e.g., an Internet Gateway or NAT Gateway) instead of being routed through the endpoint. Since the endpoint is only associated with rtb-11111111 and rtb-22222222, but rtb-11111111 lacks the required prefix list route, traffic from that subnet cannot reach S3 via the endpoint.

Answer

The endpoint policy denies access to S3 from the instance's IAM role.

Answer

The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.

Answer

The VPC does not have DNS resolution enabled for the endpoint.

Question 2

A company wants to establish a dedicated, private connection between their on-premises data center and AWS. They require consistent, low-latency performance and support for multiple VLANs. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet to deliver consistent, low-latency performance. It supports multiple VLANs via 802.1Q tagging over a single physical connection, enabling segmentation of traffic (e.g., for private VIFs, public VIFs, and transit VIFs). This meets the requirement for a private, high-performance link with VLAN support.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 3

Refer to the exhibit. A Lambda function is attached to a VPC using the network interface eni-1234567890abcdef0. The Lambda function needs to send traffic to an on-premises server via a Direct Connect connection. The traffic is failing. Which setting on the network interface is most likely causing the issue?

Accepted Answer

The SourceDestCheck flag is enabled, which prevents the Lambda function from sending traffic that it is not the source or destination of.. Lambda functions attached to a VPC use elastic network interfaces (ENIs) with the Source/Destination Check flag enabled by default. This flag causes the ENI to drop any traffic where the ENI's IP address is not the source or destination of the packet. Since the Lambda function is sending traffic to an on-premises server via Direct Connect, the ENI is acting as an intermediate hop, and the flag must be disabled for the traffic to pass.

Answer

The network interface is in a subnet that does not have a route to the Direct Connect.

Answer

The network interface has two private IP addresses.

Answer

The security group attached to the network interface may be blocking outbound traffic.

Question 4

Refer to the exhibit. The bucket policy shown is applied to an S3 bucket. A VPC endpoint for S3 is created in a VPC with CIDR 10.0.0.0/16. An EC2 instance in the VPC tries to access an object in the bucket using the VPC endpoint. The request fails. What is the most likely reason?

Accepted Answer

The condition uses aws:SourceIp, which does not work with VPC endpoint traffic.. The bucket policy uses the `aws:SourceIp` condition key, which is not supported for traffic originating from a VPC endpoint. When requests are made through a VPC endpoint, the source IP address is replaced by the endpoint's private IP, making `aws:SourceIp` ineffective. To restrict access based on the VPC endpoint, you must use the `aws:SourceVpce` or `aws:SourceVpc` condition keys instead.

Answer

The bucket policy does not allow s3:ListBucket.

Answer

The EC2 instance does not have an IAM role that allows s3:GetObject.

Answer

The VPC endpoint does not have a route table associated with the instance's subnet.

Question 5

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application needs to store session state in an ElastiCache Redis cluster. The Redis cluster should not be accessible from the internet. Which network design should be used?

Accepted Answer

Place both the EC2 instances and the Redis cluster in private subnets with appropriate security groups.. Placing both the EC2 instances and the ElastiCache Redis cluster in private subnets ensures that the Redis cluster is not accessible from the internet, meeting the security requirement. The EC2 instances can communicate with the Redis cluster within the same VPC using private IP addresses, and security groups can be used to restrict traffic to only the necessary ports (e.g., TCP 6379 for Redis) from the EC2 instances' security group. This design avoids exposing the Redis cluster to any public network, aligning with best practices for internal caching layers.

Answer

Place the Redis cluster in a public subnet and restrict access via security group.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a private subnet, with a NAT Gateway for outbound traffic.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a public subnet.

Question 6

A company has deployed a VPC with a public subnet and a private subnet in each of two Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access an external API over HTTPS. What is the MOST secure way to provide this access?

Accepted Answer

Deploy a NAT Gateway in each public subnet and add a default route in the private subnet route tables pointing to the NAT Gateway.. A NAT Gateway in each public subnet provides a managed, highly available path for EC2 instances in private subnets to initiate outbound HTTPS connections to the internet while preventing inbound connections from reaching them. Adding a default route (0.0.0.0/0) in the private subnet route tables pointing to the NAT Gateway ensures traffic destined for the external API is forwarded through the NAT Gateway, which performs source network address translation (SNAT) using its Elastic IP. This is the most secure method because it avoids exposing the EC2 instances directly to the internet and leverages AWS-managed infrastructure for scalability and fault tolerance.

Answer

Create a VPC endpoint for the external API service.

Answer

Assign public IP addresses to the EC2 instances and allow outbound traffic in the security group.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Question 7

A company is deploying a multi-tier web application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. Which design best meets these requirements?

Accepted Answer

Place the web tier in public subnets with an internet gateway, and the application and database tiers in private subnets. Use security groups to allow traffic from the web tier to the application tier, and from the application tier to the database tier.. It places the web tier in a public subnet with an Internet Gateway (IGW) for direct internet access, while the application and database tiers reside in private subnets with no direct internet path. Security groups act as stateful virtual firewalls at the instance level, allowing you to specify inbound rules that permit traffic only from the web tier security group to the application tier, and from the application tier security group to the database tier. This layered approach enforces the principle of least privilege and meets the access requirements without exposing the internal tiers to the internet.

Answer

Place all tiers in public subnets and use security groups to control traffic between tiers.

Answer

Place all tiers in the same subnet and use network ACLs to restrict traffic between tiers.

Answer

Place the web tier in a private subnet and use a NAT gateway for outbound internet access. Place the application and database tiers in public subnets.

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). They launch a NAT Gateway in the public subnet and add a route in the private subnet route table: destination 0.0.0.0/0, target nat-gateway-id. An EC2 instance in the private subnet can ping an external server, but cannot connect to it via SSH. The security group allows outbound SSH (port 22), and the NACL allows outbound ephemeral ports. What is the likely cause?

Accepted Answer

The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.. The NAT Gateway translates the private instance's source IP to its own Elastic IP address for outbound traffic. SSH connections require bidirectional communication: the external server must send SYN-ACK packets back to the source IP. If the external server's firewall blocks traffic from the NAT Gateway's Elastic IP, the TCP handshake fails, preventing SSH while ICMP (ping) may still work because ICMP echo requests and replies are stateless and often allowed by default.

Answer

The NACL on the private subnet is blocking outbound ephemeral ports.

Answer

The route table in the private subnet does not have a route to the NAT Gateway.

Answer

The NAT Gateway is not configured to allow SSH traffic.

Question 9

A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?

Accepted Answer

The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.. The most likely cause is a mismatch in the pre-shared key (PSK) between the customer gateway device and the VPN connection configuration in AWS. IPsec tunnel establishment requires both ends to authenticate using identical PSK values; if they differ, the Internet Key Exchange (IKE) phase 1 negotiation fails, leaving the tunnel status 'DOWN'. This is a common configuration error that directly prevents the VPN from coming up.

Answer

The virtual private gateway is not attached to the customer gateway.

Answer

The VPN connection is not associated with a subnet.

Answer

The security group associated with the VPN endpoint is blocking the traffic.

Question 10

A company is deploying a web application that will be accessed over the internet. They want to use an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple Availability Zones. Which TWO configurations are required to make the ALB internet-facing? (Choose TWO.)

Accepted Answer

Associate the ALB with public subnets that have a route to an Internet Gateway.. An internet-facing ALB must be associated with public subnets that have a route to an Internet Gateway (IGW). This ensures the ALB's nodes receive public IP addresses and can accept traffic from the internet. Option E is correct because the scheme must be explicitly set to 'internet-facing' during creation; this determines whether the ALB gets public IP addresses and is reachable from the internet.

Answer

Configure a security group that allows inbound traffic from 0.0.0.0/0.

Answer

Assign an Elastic IP address to the ALB.

Answer

Associate the ALB with private subnets only.

Question 11

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to AWS. The VPC CIDR is 10.0.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection. However, traffic is going over the internet instead. What is the most likely cause?

Accepted Answer

The VPC CIDR overlaps with the on-premises prefix, and the local route in the VPC route table takes precedence.. When a VPC CIDR (10.0.0.0/16) exactly matches a prefix advertised via Direct Connect (10.0.0.0/16), the VPC's local route (which is implicitly created for the VPC CIDR) takes precedence over any propagated BGP route. This is because AWS route tables prioritize the most specific matching route, and when prefixes are identical, the local route is preferred over static or propagated routes. As a result, traffic destined for 10.0.0.0/16 stays within the VPC instead of being sent over the Direct Connect connection.

Answer

The on-premises BGP ASN is prepended, causing the route to be less preferred.

Answer

The on-premises prefix is less specific than the VPC CIDR, so the VPC route takes precedence.

Answer

The BGP route is not being propagated into the VPC route table.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public and a private subnet. They want to connect their on-premises network (192.168.0.0/16) to the VPC using a site-to-site VPN. Which THREE resources are needed to establish the VPN connection? (Choose THREE.)

Accepted Answer

Customer Gateway. A Customer Gateway (option A) is required because it represents the on-premises VPN device in AWS, providing the public IP address and routing information needed to establish the IPsec tunnel. A VPN Connection (option C) is the logical resource that ties together the Customer Gateway and the Virtual Private Gateway, defining the tunnel settings, pre-shared keys, and routing options. A Virtual Private Gateway (option E) is the AWS-side endpoint attached to the VPC that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 13

An organization is migrating to AWS and needs to connect multiple VPCs in different AWS regions using a hub-and-spoke topology. The hub VPC will host centralized services. Which solution is most cost-effective and provides high throughput?

Accepted Answer

Create VPC peering connections between the hub VPC and each spoke VPC.. VPC peering connections provide high-throughput, low-latency connectivity between VPCs using the AWS global network, with no bandwidth limits and no single point of failure. For a hub-and-spoke topology with a limited number of VPCs, VPC peering is the most cost-effective solution as it incurs no hourly or per-GB data transfer charges beyond standard inter-region data transfer costs, unlike Transit Gateway which has hourly attachment fees. This makes it ideal for organizations migrating to AWS that need simple, direct connectivity without the complexity or cost of additional appliances or transit infrastructure.

Answer

Deploy a software VPN appliance in the hub VPC and connect each spoke VPC with VPN tunnels.

Answer

Establish Direct Connect connections from each VPC to a central on-premises location.

Answer

Set up AWS Transit Gateway with attachments to each VPC.

Question 14

A company has an AWS Direct Connect connection and wants to connect to multiple VPCs in the same region. Which TWO services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (Option B) acts as a central hub that interconnects VPCs and on-premises networks via a single Direct Connect connection, allowing you to connect to multiple VPCs in the same region without needing individual virtual interfaces. Direct Connect Gateway (Option D) enables you to associate multiple VPCs in the same or different regions with a single Direct Connect connection by using a single private virtual interface (VIF) and transit virtual interfaces (VIFs) to reach those VPCs through Transit Gateway or virtual private gateways.

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Answer

AWS CloudHub

Question 15

A company is using a Network Load Balancer (NLB) to distribute traffic to a fleet of EC2 instances. The NLB is configured with a target group that has health checks enabled. Some instances are marked as unhealthy even though they are running and responding to requests on the health check port. What is a likely cause?

Accepted Answer

The security group for the EC2 instances does not allow inbound traffic from the VPC CIDR on the health check port.. When a Network Load Balancer performs health checks, it sends requests from its private IP addresses within the NLB subnet to the target instances. The security group on the EC2 instances must explicitly allow inbound traffic from the VPC CIDR (or the NLB subnet CIDR) on the health check port. If the security group only allows traffic from the internet or a different source, the health check packets are dropped, causing the instances to be marked unhealthy even though they are running and responding to other traffic.

Answer

The route table for the NLB subnet does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.

Answer

The health check is being blocked by a network ACL that allows inbound traffic only from the internet.