ANS-C01 Network Implementation Practice Test 19 — 15 Questions

Question 1

A company uses AWS Transit Gateway with multiple VPC attachments and a VPN attachment to an on-premises network. The on-premises network advertises the same prefix via two separate VPN connections for redundancy. The TGW route table shows both routes as active. Traffic from a VPC to on-premises is not load-balanced and prefers one connection. Which THREE actions would help achieve active-active load balancing? (Choose 3.)

Accepted Answer

Configure BGP AS_PATH prepending on the preferred VPN connection to make it less preferred. Using BGP AS_PATH prepending can influence path selection, equal-cost multi-path (ECMP) routing in TGW supports load balancing across equal routes, and adjusting BGP MED can influence inbound traffic. Weight is not supported in TGW; AS_PATH prepending on both sides equally would not differentiate; using VPN static routes would not support ECMP.

Answer

Set a higher BGP weight on the less preferred connection

Answer

Use static routes for both VPN connections instead of BGP

Question 2

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region using AWS native services? (Choose two.)

Accepted Answer

VPC peering. Options B and D are correct. VPC peering and Transit Gateway are both native AWS services that connect VPCs in the same region. Option A is wrong because Direct Connect is for on-premises to AWS, not VPC-to-VPC. Option C is wrong because software VPN is not a native AWS service; it's a third-party appliance. Option E is wrong because ClassicLink is for connecting EC2-Classic to VPC, not VPC-to-VPC.

Answer

Software VPN appliance

Answer

AWS Direct Connect

Answer

Amazon ClassicLink

Question 3

A network engineer is designing a Direct Connect solution with a public VIF and a private VIF. The private VIF will connect to a VPC via a Direct Connect Gateway. Which TWO of the following statements are correct regarding this setup? (Choose 2.)

Accepted Answer

The Direct Connect Gateway allows the private VIF to connect to multiple VPCs in different AWS Regions. A public VIF provides access to AWS public services (like S3) over Direct Connect, which is more consistent and lower latency than internet. A private VIF with Direct Connect Gateway allows connections to multiple VPCs in different regions. Option B is wrong because a private VIF does not access public endpoints (that's the public VIF). Option D is wrong because a private VIF requires a virtual interface and a router. Option E is wrong because a public VIF does not connect to VPCs.

Answer

The private VIF can be used without a virtual interface termination device on the customer side

Answer

The public VIF can be used to connect to a VPC via a Direct Connect Gateway

Answer

The private VIF can be used to access Amazon S3 over a private IP address

Question 4

A media company runs a latency-sensitive streaming application on Amazon EC2 instances in a VPC. The application sends UDP traffic to multiple on-premises destinations via an AWS Transit Gateway with a VPN attachment. Users report occasional freezing. Network monitoring shows no packet loss on the VPN tunnel, but the application logs show out-of-order packets and high jitter. The company uses a single VPN tunnel with BGP dynamic routing over the public internet. The on-premises router has a 50ms latency to the AWS endpoint. The application requires low jitter and in-order delivery. What should a network engineer do to resolve the issue?

Accepted Answer

Replace the VPN attachment with an AWS Direct Connect private VIF to provide a consistent path. UDP traffic over a single VPN tunnel over the internet can experience jitter and reordering due to variable network conditions. Using AWS Direct Connect provides a consistent, low-latency path that eliminates internet variability. Option A (multiple VPN tunnels) may not resolve jitter inherent to internet transit. Option B (TCP instead of UDP) changes application protocol, not a network solution. Option D (enable jumbo frames) does not address jitter.

Answer

Add a second VPN tunnel to the same Transit Gateway to load balance traffic

Answer

Enable jumbo frames on the VPN tunnel to reduce packet overhead

Answer

Change the application to use TCP instead of UDP

Question 5

Which THREE of the following are required to establish a highly available site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Two VPN tunnels (one primary, one secondary). Options B, D, and E are correct. A highly available VPN requires at least two tunnels (option B), a virtual private gateway attached to the VPC (option D), and a customer gateway resource representing the on-premises device (option E). Option A is wrong because a single VPN connection can have two tunnels and still be highly available. Option C is wrong because a Direct Connect connection is not required; VPN is standalone.

Answer

Two separate VPN connections

Answer

An AWS Direct Connect connection

Question 6

A financial services company has a VPC with a public subnet and a private subnet. EC2 instances in the private subnet need to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, instances cannot reach the internet. The NAT gateway is in an 'available' state and has an Elastic IP attached. The security group for the NAT gateway allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a default route (0.0.0.0/0) pointing to an internet gateway. The most common cause is that the route table for the public subnet (where the NAT gateway resides) does not have a default route to an internet gateway. The NAT gateway needs a route to the internet gateway to forward traffic. Option B is wrong because NAT gateway does not require an IAM role. Option C is wrong because security group is correct. Option D is wrong because the NAT gateway is in 'available' state and has an EIP, so it is not provisioned incorrectly.

Answer

The security group for the NAT gateway is blocking inbound traffic from private instances

Answer

The NAT gateway is not provisioned with sufficient bandwidth

Answer

The NAT gateway does not have an IAM role to access the internet

Question 7

Which TWO of the following are true about AWS VPC security groups? (Choose two.)

Accepted Answer

They have an implicit deny all rule at the end.. Options A and C are correct. Security groups are stateful (option A) and support allow rules only (option C). Option B is wrong because security groups support allow rules only, not deny rules. Option D is wrong because security groups are applied to ENIs, not subnets. Option E is wrong because security groups are evaluated as a whole; all rules are considered before deciding.

Answer

Rules are evaluated in order, and the first matching rule is applied.

Answer

They support both allow and deny rules.

Answer

They can be associated with subnets.

Question 8

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect two separate branch offices using AWS Client VPN. Each branch office has a different subnet: Branch A uses 10.0.1.0/24 and Branch B uses 10.0.2.0/24. The Client VPN endpoint is configured with a CIDR range of 10.0.3.0/24. The route table for the VPC has the local route and routes to the Client VPN endpoint. Users from both branches can connect to the VPN but cannot communicate with each other. What is the most likely reason?

Accepted Answer

The branch subnets 10.0.1.0/24 and 10.0.2.0/24 are part of the VPC CIDR, so the VPC routes traffic locally instead of via the VPN. Branch subnets overlap with the VPC CIDR, causing routing conflicts. The VPC sees 10.0.1.0/24 and 10.0.2.0/24 as local, thus traffic destined to those addresses is routed locally within the VPC, not to the VPN. Options B and C are not relevant to inter-branch communication. Option D would not cause the issue because branch subnets are within the VPC CIDR.

Answer

The route tables in the branch subnets do not have routes to the Client VPN endpoint

Answer

The Client VPN endpoint is configured with a CIDR that overlaps with the branch subnets

Answer

The security group for the Client VPN endpoint does not allow inbound traffic from branch subnets

Question 9

A company is deploying a new application in a VPC with public and private subnets. The application needs to access an S3 bucket in the same AWS Region. Which configuration provides the MOST secure and cost-effective connectivity?

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and add a route to it.. Option B is correct because an S3 Gateway Endpoint provides private connectivity to S3 without traversing the internet or incurring NAT gateway costs. Option A is wrong because a NAT gateway adds cost and still uses internet. Option C is wrong because Direct Connect is overkill and costly. Option D is wrong because proxy servers add complexity and cost.

Answer

Configure a proxy server in the public subnet to forward requests to S3.

Answer

Set up an AWS Direct Connect connection to S3.

Answer

Create a NAT gateway in the public subnet and route traffic through it.

Question 10

A global e-commerce company uses AWS CloudFront to distribute content. They have an origin behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTPS traffic from CloudFront's IP ranges. Users in some regions report slow loading times. The company wants to reduce latency and improve performance. They are considering using Lambda@Edge and origin failover. However, they also notice that the ALB is receiving traffic directly from some IPs that are not CloudFront IPs, causing unnecessary load. What should a network engineer do to restrict access to the ALB to only CloudFront?

Accepted Answer

Update the ALB security group to allow inbound HTTPS only from the CloudFront managed prefix list. The best practice is to restrict ALB security group to CloudFront managed prefix list (com.amazonaws.global.cloudfront.origin-facing). This dynamically allows CloudFront IPs. Option A (custom header) is good but not sufficient alone because attackers can mimic headers. Option B (AWS WAF) can help but is not the primary method. Option D (restrict to specific regions) is not precise.

Answer

Use AWS WAF to block requests that do not come from CloudFront IPs

Answer

Configure the ALB to require a custom header (e.g., X-Origin-Verify) and validate it in the origin

Answer

Set up a VPC endpoint for CloudFront to route traffic privately

Question 11

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible over the internet, but the security team requires that all traffic be inspected by a third-party firewall appliance. What is the MOST scalable architecture?

Accepted Answer

Use a Gateway Load Balancer with firewall appliances in each Availability Zone.. Option C is correct because using Gateway Load Balancer with the firewall appliances in different AZs provides high availability and scalability. Option A is wrong because a single firewall is a SPOF. Option B is wrong because EC2 instances as next-hop in route table is not scalable. Option D is wrong because Network Load Balancer does not inspect traffic; it load balances.

Answer

Configure a Network Load Balancer with target groups pointing to firewall appliances.

Answer

Use an EC2 instance as a transparent proxy and set it as the next-hop in the route table.

Answer

Deploy a single firewall appliance in one Availability Zone and route all traffic through it.

Question 12

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to exchange routes with the VGW. The company wants to route traffic from the VPC to an on-premises subnet 192.168.1.0/24. The on-premises router advertises 192.168.1.0/24 over BGP. However, instances in the VPC cannot reach that subnet. The VPC route table has the local route and a route to the VGW for 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The 192.168.1.0/24 subnet overlaps with the VPC CIDR, causing the local route to take precedence. The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the VGW. The default route (0.0.0.0/0) goes to the VGW, but if the on-premises subnet is part of the VPC CIDR (e.g., if VPC CIDR is 192.168.0.0/16), then the local route takes precedence and traffic never goes to VGW. Since the subnet is 192.168.1.0/24, it could be within a VPC CIDR like 192.168.0.0/16. The local route would match and traffic stays in VPC. Option B is wrong because allowed prefixes are configured in Direct Connect Gateway, not VPC route table. Option C is wrong because if the subnet is within VPC CIDR, propagation doesn't help. Option D is wrong because the route is advertised.

Answer

BGP route propagation is disabled on the VPC route table

Answer

The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the virtual private gateway

Answer

The Direct Connect virtual interface does not have the allowed prefixes configured

Question 13

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway (VGW) attached. The on-premises network advertises a prefix 10.0.0.0/8 over BGP. The VPC has subnets with CIDR 10.0.1.0/24 and 10.0.2.0/24. The company wants to ensure that traffic to on-premises uses Direct Connect. However, traffic to an S3 bucket uses the internet. What route configuration is required?

Accepted Answer

Add specific routes for S3 public IP prefixes pointing to the internet gateway.. Option D is correct because adding a specific route for S3 prefixes to the internet gateway will override the more general route through the VGW for those destinations. Option A is wrong because S3 traffic would go through Direct Connect. Option B is wrong because VPC CIDR cannot be changed. Option C is wrong because more specific routes to IGW are needed.

Answer

Change the VPC CIDR to avoid overlap with on-premises.

Answer

Add a static route for 0.0.0.0/0 pointing to the internet gateway.

Answer

Add a static route in the VPC route table for 0.0.0.0/0 pointing to the VGW.

Question 14

A large enterprise uses AWS Organizations with multiple accounts. The central networking account hosts a Transit Gateway with attachments from VPCs in various accounts. The enterprise uses AWS Resource Access Manager (RAM) to share the Transit Gateway with other accounts. A network engineer in a spoke account creates a VPC and attaches it to the shared Transit Gateway. The attachment shows 'available' state. However, traffic from the spoke VPC to other attached VPCs fails. The spoke VPC route table has a route to the Transit Gateway for 0.0.0.0/0. The Transit Gateway route table has routes for the spoke VPC CIDR and other VPC CIDRs. What is the most likely cause?

Accepted Answer

The Transit Gateway owner has not accepted the VPC attachment. When a Transit Gateway is shared via RAM, the owner account must accept the attachment request. The attachment shows 'available' but not 'associated'? Actually, for shared TGW, the owner account needs to accept the attachment. The attachment state 'available' means it's ready but not yet associated with a TGW route table in the owner's account. The owner must associate it. Option B is wrong because the TGW route table has routes. Option C is wrong because the spoke route table has a route. Option D is wrong because no cross-account roles are needed for attachment.

Answer

The spoke account does not have an IAM role to access the Transit Gateway

Answer

The spoke VPC route table does not have routes to the other VPC CIDRs

Answer

The Transit Gateway route table does not propagate routes from the spoke VPC attachment

Question 15

A company has multiple VPCs that need to communicate with each other using private IP addresses. The VPCs are in the same AWS account and Region. Which AWS service provides the simplest and most scalable solution?

Accepted Answer

VPC peering connections. Option A is correct because VPC peering is simple, scalable, and allows direct connections between VPCs. Option B is wrong because VPN connections are complex and costly. Option C is wrong because Transit Gateway is more complex than needed for a few VPCs. Option D is wrong because ClassicLink is legacy and limited.

Answer

AWS Site-to-Site VPN

Answer

ClassicLink

Answer

AWS Transit Gateway