ANS-C01 Network Implementation Practice Test 18 — 15 Questions

Question 1

A company is deploying a VPC endpoint for Amazon S3 to allow instances in a private subnet to access S3 without traversing the internet. A network engineer must configure the endpoint and associated networking components. Which TWO actions are required to enable instances in the private subnet to access S3 through the gateway endpoint? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a gateway VPC endpoint for S3 and associate it with the route table of the private subnet.. To use a gateway VPC endpoint for S3, you must create the endpoint and associate it with the route table of the subnet where the instances reside. This association injects a route for the S3 prefix list into the route table, enabling private connectivity. Additionally, you should attach an endpoint policy that grants the required access to S3; while the default policy allows full access, explicitly configuring a policy is necessary to restrict or permit specific actions in a secure deployment. An internet gateway, NAT gateway, or security group rule for the prefix list is not required for the endpoint to function.

Answer

Configure a security group rule on the instances to allow outbound traffic to the S3 prefix list.

Answer

Create a NAT gateway in a public subnet and update the private subnet's route table to direct S3 traffic to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a default route to the private subnet's route table.

Question 2

A solutions architect is deploying a Gateway Load Balancer (GWLB) to inspect traffic destined for a fleet of third-party firewall appliances running in a dedicated VPC. The architect creates a GWLB endpoint in the application VPC and needs to route traffic to it. Which route table entry will direct all inbound traffic from the internet to the GWLB endpoint?

Accepted Answer

A route in the application subnet route table with destination 0.0.0.0/0 and target the GWLB endpoint ID (vpce-xxxx).. A Gateway Load Balancer endpoint is a VPC endpoint that is used as a next hop in route tables. To transparently inspect traffic, the application subnet route table must point its default route at the GWLB endpoint ID so that packets are encapsulated in GENEVE and delivered to the appliance fleet. The internet gateway remains attached but is not the route target for inspected traffic.

Answer

A route in the application subnet route table with destination 0.0.0.0/0 and target the internet gateway (igw-xxxx).

Answer

A route in the appliance subnet route table with destination 0.0.0.0/0 and target the GWLB endpoint ID (vpce-xxxx).

Answer

A route in the application subnet route table with destination 0.0.0.0/0 and target the NAT gateway (nat-xxxx).

Question 3

A company is deploying a global application across multiple AWS Regions. The application requires a static anycast IP address that routes users to the nearest healthy endpoint. The company also wants to minimize latency and automatically fail over between Regions. Which TWO services or features should be used to meet these requirements? (Choose two.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides static anycast IP addresses that route to the nearest healthy endpoint. Its endpoint groups with health checks enable automatic failover between Regions. Together, they satisfy the requirements for static anycast IPs, latency minimization, and automatic failover. Other services like Route 53, Network Load Balancer, and CloudFront do not provide static anycast IPs for global applications.

Answer

Amazon CloudFront with origin failover

Answer

Network Load Balancer with cross-zone load balancing

Answer

Amazon Route 53 latency-based routing

Question 4

A network engineer is deploying an AWS Network Load Balancer (NLB) in front of a fleet of application servers running in three Availability Zones. The application must preserve the client source IP address for logging and must support long-lived TCP connections that occasionally exceed 350 seconds of idle time. The NLB has a target group of type instance. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enable TCP keepalive on the targets and configure the target group health check to use the TCP protocol.. Client IP preservation on the target group keeps the original client address visible to the application servers, which is required for source IP logging. Because NLB has no configurable idle timeout, long-lived TCP connections must be kept alive by the endpoints themselves, so enabling TCP keepalive on the targets and using a TCP health check satisfies the idle-connection requirement.

Answer

Increase the idle timeout on the NLB to a value greater than the longest expected idle period.

Answer

Attach an Elastic IP address to each target instance and register the Elastic IPs with the target group.

Answer

Configure the target group with the TCP protocol and enable the preserve_client_ip attribute, then adjust keepalive settings at the application layer.

Question 5

A retail company runs a three-tier application across multiple VPCs connected by a Transit Gateway. The network team wants to reduce data transfer costs and improve latency for traffic between two VPCs in the same AWS Region that frequently exchange large volumes of data. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Ensure both VPCs are in the same AWS Region and that their CIDR blocks do not overlap before creating the peering connection.. VPC peering between the two VPCs removes the Transit Gateway hop, eliminating its data processing charges and reducing latency. The peering connection requires non-overlapping CIDRs and route table entries in both VPCs pointing the peer CIDR at the peering connection.

Answer

Attach an internet gateway to both VPCs and route inter-VPC traffic through the public internet to bypass the Transit Gateway.

Answer

Create a Transit Gateway peering attachment between the two VPCs and disable route propagation on both attachments.

Answer

Enable Transit Gateway appliance mode on the attachment for the VPC that hosts the inspection appliances.

Question 6

A network engineer is designing a VPC that requires high availability and fault tolerance for a web application. The application will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The engineer must ensure that the ALB can route traffic to instances in multiple Availability Zones and that the instances can scale automatically. Which two configurations should the engineer implement? (Choose two.)

Accepted Answer

Create the ALB in at least two public subnets, each in a different Availability Zone.. To ensure high availability and fault tolerance for an ALB, the ALB must be created in at least two public subnets in different Availability Zones. Additionally, an Auto Scaling group should be attached to the ALB target group to automatically register and deregister instances as they scale. These two configurations provide the necessary redundancy and elasticity for the web application.

Answer

Enable cross-zone load balancing on the ALB to distribute traffic evenly across all registered instances.

Answer

Configure the ALB to use a Network Load Balancer (NLB) as a target to improve performance.

Answer

Set up a Route 53 alias record pointing to the ALB and enable health checks.

Question 7

A network engineer is configuring a VPC peering connection between two VPCs in different AWS accounts and different AWS Regions. The VPCs have non-overlapping CIDR blocks. After creating the peering connection and accepting it, the engineer updates the route tables in both VPCs. However, instances in one VPC cannot reach instances in the other VPC. The security groups allow all traffic. What is the most likely cause?

Accepted Answer

The instances are using a public IP address to communicate, which is not supported over VPC peering.. VPC peering connections only route traffic between private IP addresses. If instances attempt to communicate using public IP addresses, the traffic will not traverse the peering connection, even if route tables and security groups are correctly configured. Ensuring that applications use private IPs or DNS hostnames that resolve to private IPs is essential for inter-VPC communication.

Answer

The security group on the instances does not allow traffic from the peer VPC CIDR block.

Answer

The VPC peering connection is not in the active state.

Answer

The route tables in both VPCs do not have a route to the peer VPC CIDR block pointing to the peering connection.

Question 8

A company runs a multi-account AWS environment where each business unit has its own VPC. The central network team owns a shared services VPC and wants to allow all business unit VPCs to reach a self-hosted DNS resolver in the shared services VPC without changing each VPC's DHCP options. They attach all VPCs to a single AWS Transit Gateway and enable DNS support on the Transit Gateway. Which additional configuration is required for the business unit VPCs to resolve internal names through the shared resolver?

Accepted Answer

Create a Route 53 Resolver inbound endpoint in the shared services VPC and associate its IP addresses with the Transit Gateway.. Transit Gateway DNS support allows attached VPCs to use a resolver in another attached VPC, but it requires a Route 53 Resolver inbound endpoint to provide reachable target IP addresses for DNS queries. Inbound endpoints listen for queries from on-premises or other networks and answer them using Route 53 Resolver rules. Associating the endpoint's addresses with the Transit Gateway lets spoke VPCs forward queries through the Transit Gateway without DHCP changes.

Answer

Create a Route 53 Resolver outbound endpoint in each business unit VPC.

Answer

Configure the shared services VPC as a DNS server in the DHCP options set of each business unit VPC.

Answer

Enable DNS hostnames and DNS resolution in each business unit VPC and create a VPC peering connection to the shared services VPC.

Question 9

A company needs to connect 20 VPCs across multiple AWS accounts to a shared services VPC using AWS Transit Gateway. The network team requires that all inter-VPC traffic be inspectable by a centralized firewall appliance in the shared services VPC. The firewall appliance must see traffic from all attached VPCs without modifying route tables in each VPC. Which solution meets these requirements?

Accepted Answer

Configure AWS Transit Gateway with a central route table that has a default route pointing to the shared services VPC attachment, and enable appliance mode on that attachment.. The correct solution uses a central Transit Gateway route table with a default route to the shared services VPC attachment, combined with appliance mode. Appliance mode ensures that return traffic follows the same path through the firewall appliance, preserving stateful inspection. This design centralizes inspection without requiring changes to each VPC's route tables, and it scales to many VPCs.

Answer

Use AWS Transit Gateway with a separate route table for each VPC attachment, and create static routes to the firewall appliance's ENI in the shared services VPC.

Answer

Attach all VPCs to a Transit Gateway and use AWS Resource Access Manager to share the Transit Gateway, then configure VPC peering between each VPC and the shared services VPC for inspection.

Answer

Create a Transit Gateway route table with a default route to the shared services VPC attachment, and associate all other VPC attachments with that route table.

Question 10

A network engineer is designing a VPC that must provide outbound-only internet access for instances in private subnets without assigning public IP addresses. The design must also support high availability across Availability Zones and avoid managing a single NAT instance. Which TWO components are required to meet these requirements? (Choose two.)

Accepted Answer

An internet gateway attached to the VPC, with the public subnet route table containing a default route to the internet gateway.. Private instances without public IPs need a NAT gateway for IPv4 egress, and the NAT gateway itself requires an internet gateway route in its public subnet. Deploying one NAT gateway per Availability Zone with matching private route tables delivers the required high availability without self-managed NAT instances.

Answer

A VPC endpoint for Amazon S3 with a route table entry in each private subnet pointing to the gateway endpoint.

Answer

An egress-only internet gateway attached to the VPC and referenced in the private subnet route tables.

Answer

A NAT instance launched with a public IP in each private subnet, with source/destination checking disabled.

Question 11

A network engineer is configuring an AWS Site-to-Site VPN over a Direct Connect connection (public VIF) to improve resiliency. The customer gateway device supports BGP. The engineer wants the VPN traffic to prefer the Direct Connect path and use the VPN only as a backup. Which BGP attribute should the engineer manipulate on the on-premises customer gateway to achieve this?

Accepted Answer

Prepend the autonomous system number multiple times on the routes advertised over the VPN tunnel to AWS.. AWS selects BGP paths using standard best-path criteria, and AS-path length is one of the attributes it evaluates when comparing routes learned over the public VIF and the VPN. Prepending the AS number on the VPN advertisements lengthens that path, causing AWS to prefer the Direct Connect path. The VPN remains available and is used only if the Direct Connect path is withdrawn.

Answer

Set a higher Multi-Exit Discriminator (MED) value on the routes advertised over the VPN tunnel than over the Direct Connect public VIF.

Answer

Set a lower local preference value on the routes received over the VPN tunnel than over the Direct Connect public VIF.

Answer

Set a higher weight value on the routes received over the VPN tunnel than over the Direct Connect public VIF.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16 and a subnet of 10.0.1.0/24. The company wants to connect this VPC to an on-premises network that uses 10.0.0.0/8. The network engineer plans to use AWS Site-to-Site VPN. Which statement describes the correct expectation for this design?

Accepted Answer

The VPN connection will fail to establish because the VPC CIDR overlaps with the on-premises CIDR, and overlapping routes cannot both be advertised.. Site-to-Site VPN does not perform address translation, so overlapping CIDRs between the VPC and on-premises network create ambiguous routing. Because 10.0.0.0/16 falls inside 10.0.0.0/8, the on-premises network considers VPC addresses local, and AWS cannot install a conflicting route, so the design requires re-addressing or a translation layer.

Answer

The VPN connection will work as long as the on-premises router uses a more specific route for the VPC CIDR than for the on-premises network.

Answer

The VPN connection will work because the VPC subnet CIDR 10.0.1.0/24 is more specific than 10.0.0.0/8 and therefore does not overlap.

Answer

The VPN connection will work because AWS performs NAT on the VPC CIDR before sending traffic over the VPN.

Question 13

A company runs a stateful inspection appliance on an EC2 instance in a VPC. The appliance sits between an internet-facing Network Load Balancer and a fleet of web servers. The appliance must see the original client source IP addresses so that its logging and access-control rules work. Which configuration should the network engineer apply to the Network Load Balancer target group?

Accepted Answer

Enable client IP preservation on the target group.. Client IP preservation is the Network Load Balancer feature that maintains the original client source address when forwarding to targets, which is exactly what the inspection appliance needs for accurate logging and source-based rules. It works with instance and IP targets and avoids requiring the appliance to parse an added header.

Answer

Configure the target group to use TLS listeners with end-to-end encryption.

Answer

Enable proxy protocol v2 on the target group.

Answer

Attach an Elastic IP address to each appliance instance and enable source/destination check.

Question 14

A company operates a hub-and-spoke topology with an AWS Transit Gateway in the primary Region and a second Transit Gateway in a peered Region. Each Transit Gateway has multiple VPC attachments and a Site-to-Site VPN attachment for its local data center. The network team needs to enable traffic between the two Regions' VPCs and ensure that a single on-premises data center can reach VPCs in both Regions through the Transit Gateway peering. Which TWO configuration steps are required to meet these requirements? (Choose two.)

Accepted Answer

Create a Transit Gateway peering attachment between the two Transit Gateways and accept the peering request in the peer Region.. Cross-Region Transit Gateway connectivity requires a peering attachment that is accepted in the peer Region, plus a shared Transit Gateway route table where the VPN attachment and peering attachment are associated and a static route points to the peering attachment for the remote CIDRs. Dynamic propagation does not apply to peering attachments, so static routes are mandatory. Together these steps let on-premises traffic transit both Regions.

Answer

Create a Direct Connect gateway and associate both Transit Gateways with it to allow cross-Region routing.

Answer

Enable Transit Gateway route propagation for the peering attachment so BGP-learned routes from the VPN are automatically advertised across the peering link.

Answer

Configure a VPC peering connection between the VPCs in each Region and use that as the transit path instead of the Transit Gateway peering.

Question 15

A company runs a latency-sensitive trading application on EC2 instances distributed across three Availability Zones in a VPC. The application uses a Network Load Balancer (NLB) with a TCP listener on port 443. The company wants to ensure that if an entire Availability Zone fails, client connections are automatically routed to healthy targets in the remaining zones without manual intervention. The NLB is internet-facing and has one subnet in each of the three Availability Zones. What should the network engineer do to meet these requirements?

Accepted Answer

Enable cross-zone load balancing on the NLB.. Cross-zone load balancing allows the NLB to route traffic to targets in any enabled Availability Zone, regardless of the zone where the load balancer node receives the connection. This ensures that if one Availability Zone fails, the remaining NLB nodes can still forward traffic to healthy targets in other zones, providing high availability without manual intervention. Other options do not address the cross-zone traffic distribution requirement.

Answer

Create a Route 53 latency-based routing policy that points to the NLB's DNS name.

Answer

Configure a target group with a health check that has a shorter interval and higher threshold.

Answer

Attach an Elastic IP address to each NLB node in every Availability Zone.