ANS-C01 Network Implementation Practice Test 18 — 15 Questions

Question 1

A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?

Accepted Answer

The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.. Option B is correct because the VPN tunnel pre-shared keys (PSK) must match exactly between the customer gateway and the AWS VPN endpoint. Option A is wrong because security groups do not affect VPN tunnel establishment; they control traffic within the VPC. Option C is wrong because the virtual private gateway (VGW) is attached to the VPC, not the customer gateway. Option D is wrong because the VPN connection must be associated with the VGW, not a subnet.

Answer

The virtual private gateway is not attached to the customer gateway.

Answer

The VPN connection is not associated with a subnet.

Answer

The security group associated with the VPN endpoint is blocking the traffic.

Question 2

A company is deploying a web application that will be accessed over the internet. They want to use an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple Availability Zones. Which TWO configurations are required to make the ALB internet-facing? (Choose TWO.)

Accepted Answer

Associate the ALB with public subnets that have a route to an Internet Gateway.. An internet-facing ALB must be in public subnets (with a route to an Internet Gateway) and have a public DNS name. Option A is wrong because the ALB does not need its own public IP; it uses the public subnets. Option C is wrong because the ALB can be in public subnets only. Option D is wrong because security groups do not make it internet-facing.

Answer

Configure a security group that allows inbound traffic from 0.0.0.0/0.

Answer

Assign an Elastic IP address to the ALB.

Answer

Associate the ALB with private subnets only.

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to AWS. The VPC CIDR is 10.0.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection. However, traffic is going over the internet instead. What is the most likely cause?

Accepted Answer

The VPC CIDR overlaps with the on-premises prefix, and the local route in the VPC route table takes precedence.. Option D is correct because when the VPC CIDR and the on-premises prefix overlap, the VPC's local route takes precedence over any other route, including Direct Connect. Traffic destined for the on-premises network would be considered local to the VPC. Option A is wrong because longer prefix match does not apply to overlapping local routes. Option B is wrong because AWS always prefers more specific routes; the issue is the local route. Option C is wrong because BGP ASN prepending does not affect route preference over the local route.

Answer

The on-premises BGP ASN is prepended, causing the route to be less preferred.

Answer

The on-premises prefix is less specific than the VPC CIDR, so the VPC route takes precedence.

Answer

The BGP route is not being propagated into the VPC route table.

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public and a private subnet. They want to connect their on-premises network (192.168.0.0/16) to the VPC using a site-to-site VPN. Which THREE resources are needed to establish the VPN connection? (Choose THREE.)

Accepted Answer

Customer Gateway. A site-to-site VPN requires a Virtual Private Gateway (VPG) on the VPC side, a Customer Gateway (CGW) representing the on-premises router, and a VPN Connection between them. Option A is wrong because a Transit Gateway is not required for a simple VPN. Option D is wrong because a Direct Connect connection is separate. Option E is wrong because a VPC endpoint is for private access to AWS services.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 5

An organization is migrating to AWS and needs to connect multiple VPCs in different AWS regions using a hub-and-spoke topology. The hub VPC will host centralized services. Which solution is most cost-effective and provides high throughput?

Accepted Answer

Create VPC peering connections between the hub VPC and each spoke VPC.. Option C is correct because VPC peering provides high throughput and is cost-effective for hub-and-spoke topologies across regions, though it requires full mesh for transitive routing. However, the hub-and-spoke model does not support transitive routing via hub, but the question asks for connecting multiple VPCs; VPC peering is cost-effective. Option A is wrong because AWS Transit Gateway is managed but not the most cost-effective for few VPCs. Option B is wrong because Direct Connect is expensive and not needed for VPC-to-VPC. Option D is wrong because software VPN is less reliable and lower throughput.

Answer

Deploy a software VPN appliance in the hub VPC and connect each spoke VPC with VPN tunnels.

Answer

Establish Direct Connect connections from each VPC to a central on-premises location.

Answer

Set up AWS Transit Gateway with attachments to each VPC.

Question 6

A company has an AWS Direct Connect connection and wants to connect to multiple VPCs in the same region. Which TWO services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (Option B) acts as a central hub that interconnects VPCs and on-premises networks via a single Direct Connect connection, allowing you to connect to multiple VPCs in the same region without needing individual virtual interfaces. Direct Connect Gateway (Option D) enables you to associate multiple VPCs in the same or different regions with a single Direct Connect connection by using a single private virtual interface (VIF) and transit virtual interfaces (VIFs) to reach those VPCs through Transit Gateway or virtual private gateways.

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Answer

AWS CloudHub

Question 7

A company is using a Network Load Balancer (NLB) to distribute traffic to a fleet of EC2 instances. The NLB is configured with a target group that has health checks enabled. Some instances are marked as unhealthy even though they are running and responding to requests on the health check port. What is a likely cause?

Accepted Answer

The security group for the EC2 instances does not allow inbound traffic from the VPC CIDR on the health check port.. Option B is correct because the NLB health checks use the VPC subnet CIDR as the source IP, and if the security group does not allow traffic from that CIDR, health checks fail. Option A is wrong because health checks are sent from the NLB's private IPs within the subnet, not from the internet. Option C is wrong because NLB health checks do not use the internet gateway. Option D is wrong because route tables do not affect health check traffic; the NLB sends health checks from within the VPC.

Answer

The route table for the NLB subnet does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.

Answer

The health check is being blocked by a network ACL that allows inbound traffic only from the internet.

Question 8

Refer to the exhibit. A company has an S3 bucket with the bucket policy shown. An EC2 instance in a VPC with CIDR 10.0.0.0/16 tries to retrieve an object from the bucket using the S3 console, but receives an 'Access Denied' error. The instance's security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The EC2 instance is accessing the S3 bucket through a NAT Gateway, so the source IP is the public IP of the NAT Gateway, which does not match the condition.. The condition aws:SourceIp evaluates the IP address of the requester. For EC2 instances accessing S3 via a VPC endpoint, the source IP is the private IP, which matches 10.0.0.0/16. However, accessing S3 via the console uses the public IP of the NAT Gateway or internet gateway, which is not in the 10.0.0.0/16 range. Option B is wrong because the policy allows GetObject. Option C is wrong because the policy allows all principals. Option D is wrong because the bucket policy is not too restrictive; it just requires matching IP.

Answer

The bucket policy does not allow the s3:GetObject action.

Answer

The bucket policy does not specify a principal, so it defaults to deny.

Answer

The condition aws:SourceIp is too restrictive and blocks all traffic.

Question 9

A company has a Direct Connect connection with a private VIF to a VPC. They also have a site-to-site VPN as a backup. The on-premises network advertises the same prefix via BGP over both connections. The company wants to prefer the Direct Connect path. What configuration achieves this?

Accepted Answer

Configure the Direct Connect BGP session with a higher local preference (e.g., 200) than the VPN BGP session.. Option A is correct because AWS assigns a local preference of 100 by default to Direct Connect routes, while VPN routes have a lower local preference (e.g., 0 or lower). Option B is wrong because AS path prepending on the Direct Connect side would make it less preferred. Option C is wrong because the MED is not commonly used in this scenario; local preference is standard. Option D is wrong because the VPN should have higher AS path prepending to be less preferred.

Answer

Set the Multi-Exit Discriminator (MED) on the VPN advertisement to a lower value.

Answer

Prepend the AS path on the Direct Connect advertisement to make it longer.

Answer

Configure the VPN BGP session with a higher local preference than the Direct Connect session.

Question 10

A company has a multi-tier application deployed in a VPC. The web tier consists of an internet-facing Application Load Balancer (ALB) in public subnets, and EC2 instances in private subnets. The application tier runs on EC2 instances in separate private subnets, and the database tier uses an Amazon RDS for MySQL instance in private subnets. The application tier needs to connect to the database on port 3306. The security group for the RDS instance (sg-database) has an inbound rule allowing TCP 3306 from the security group of the application tier (sg-app). The application tier instances can connect to the database, but the web tier instances cannot. The web tier instances should not have direct database access. What is the most likely reason for the web tier's inability to connect to the database?

Accepted Answer

The security group of the RDS instance does not have an inbound rule allowing traffic from the web tier's security group.. The security group rule on sg-database allows traffic from sg-app. Since the web tier instances are in a different security group, they are not allowed. Option A is wrong because the rule is from sg-app, not from the web tier's security group. Option B is wrong because NACLs are stateless and if they were blocking, the application tier would also be affected. Option C is wrong because the database is in a private subnet and does not need a NAT Gateway. Option D is wrong because the route table is not relevant for security group rules.

Answer

The network ACL for the database subnet is blocking inbound traffic from the web tier subnets.

Answer

The RDS instance is in a public subnet and requires a NAT Gateway for communication.

Answer

The route table for the web tier subnets does not have a route to the database subnets.

Question 11

A security team wants to block traffic from a specific IP address (203.0.113.5) from reaching an EC2 instance. The instance is in a public subnet with a security group that allows all traffic from the internet. A network ACL is associated with the subnet. The team adds a DENY rule for the IP in the network ACL. However, traffic from that IP still reaches the instance. What is the most likely reason?

Accepted Answer

The network ACL has an ALLOW rule with a lower rule number that matches the IP, so the DENY rule is never evaluated.. Option D is correct because network ACLs are stateless and require both inbound and outbound rules to allow return traffic. The DENY rule on inbound will block incoming traffic, but if the ACL also has an inbound ALLOW rule for the IP, the DENY rule might be evaluated after the ALLOW rule if the rule numbers are ordered incorrectly. However, the question states they added a DENY rule; if the ALLOW rule has a lower rule number, it will be evaluated first. Option A is wrong because security groups are stateful, but they do not override network ACLs. Option B is wrong because network ACLs apply to the subnet, not the instance. Option C is wrong because the internet gateway operates at layer 3 and does not filter by IP.

Answer

The security group allows traffic from the IP, overriding the network ACL.

Answer

The network ACL is applied to the wrong subnet.

Answer

The internet gateway is ignoring the network ACL.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). They have an internet-facing ALB in the public subnets and EC2 instances in the private subnets. The EC2 instances need to download updates from the internet. They deploy a NAT Gateway in each public subnet and add routes in the private subnet route tables pointing to the respective NAT Gateway in the same AZ. However, the EC2 instances in AZ2 cannot access the internet, while those in AZ1 can. What is the most likely cause?

Accepted Answer

The NAT Gateway in AZ2 does not have an Elastic IP address assigned.. The NAT Gateway in AZ2 may be in a different public subnet than the one the private subnet route points to, or the NAT Gateway may not have an associated Elastic IP. Option A is wrong because cross-AZ routing is possible but not the issue. Option B is wrong because the route is to the specific NAT Gateway in the same AZ. Option D is wrong because the issue is specific to one AZ, not a global issue.

Answer

The security group of the EC2 instances in AZ2 is blocking outbound traffic.

Answer

The private subnet in AZ2 is routing traffic to the NAT Gateway in AZ1, which is in a different Availability Zone and incurs cross-AZ charges but should still work.

Answer

The route table for the private subnet in AZ2 is missing a route to the NAT Gateway.

Question 13

A company is setting up a VPC with both public and private subnets. The private subnets need outbound internet access for software updates. Which component is required to enable this?

Accepted Answer

A NAT gateway in a public subnet.. Option A is correct because a NAT gateway in a public subnet provides outbound internet access to instances in private subnets. Option B is wrong because an internet gateway does not provide outbound access for private subnets without a NAT device. Option C is wrong because VPC peering is for connecting VPCs, not internet access. Option D is wrong because a VPN connection is for site-to-site connectivity, not internet access.

Answer

A VPN connection to an on-premises network that has internet access.

Answer

A VPC peering connection to a VPC that has internet access.

Answer

An internet gateway attached to the VPC with a route in the private subnet's route table pointing to the internet gateway.

Question 14

A network engineer is troubleshooting connectivity between an on-premises data center and a VPC over an AWS Site-to-Site VPN. The tunnel status shows UP, but traffic from on-premises to the VPC is intermittently dropped. Which TWO of the following are likely causes? (Choose 2.)

Accepted Answer

Asymmetric routing across multiple tunnels. Incorrect MTU settings can cause fragmentation issues leading to drops, and asymmetric routing can cause stateful firewalls to drop return traffic. Dead Peer Detection (DPD) timeout would cause the tunnel to go down, not intermittent drops; BGP hold timer expiration would cause BGP session reset; IPsec SA lifetime mismatch would cause periodic rekey issues but not typical intermittent drops.

Answer

Dead Peer Detection (DPD) timeout configuration

Answer

BGP hold timer expiration

Answer

IPsec SA lifetime mismatch between peers

Question 15

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They have an on-premises application that needs to resolve private hosted zone names in Amazon Route 53. The on-premises DNS server forwards queries for the private domain to the VPC's DNS resolver. However, resolution fails. What is the most likely cause?

Accepted Answer

A Route 53 Resolver outbound endpoint is not configured to forward queries from on-premises to the VPC.. Option D is correct because the Route 53 Resolver outbound endpoint is required to forward DNS queries from on-premises to the Route 53 private hosted zones. Without it, the VPC resolver does not accept queries from external sources. Option A is wrong because the private hosted zone is associated with the VPC. Option B is wrong because the VPC's DHCP option set typically uses the default VPC resolver (or custom), but the issue is inbound queries. Option C is wrong because security groups apply to instances, not to the VPC DNS resolver.

Answer

The private hosted zone is not associated with the VPC.

Answer

The VPC's DHCP option set is not configured to use the Route 53 Resolver.

Answer

The security group for the VPC DNS resolver is blocking inbound UDP port 53 from the on-premises network.