ANS-C01 Network Implementation Practice Test 19 — 15 Questions

Question 1

A network engineer is deploying an AWS Site-to-Site VPN connection over a Direct Connect connection using a transit virtual interface (transit VIF). The customer gateway is configured with BGP. The engineer notices that the VPN tunnel is down, and the BGP session is not establishing. Which action should the engineer take to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that the BGP ASN on the customer gateway matches the ASN configured in the AWS transit gateway, and that the tunnel IP addresses are correctly configured.. When using a Site-to-Site VPN over a transit VIF, the BGP session must be established between the customer gateway and the transit gateway. Common causes of failure include incorrect ASN configuration or mismatched BGP peer IP addresses. Ensuring that the ASN on the customer gateway matches the transit gateway's ASN and that the tunnel IP addresses are correctly configured will allow the BGP session to come up and the VPN tunnel to establish.

Answer

Increase the MTU on the transit VIF to 9001 bytes to accommodate the VPN overhead, and restart the BGP process.

Answer

Verify that the customer gateway device supports asymmetric routing and enable dynamic routing on the transit VIF.

Answer

Configure a static route on the transit gateway to point to the VPN attachment, and disable BGP on the customer gateway.

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a second CIDR block to the VPC to accommodate growth. The new CIDR block must not overlap with any existing subnets or routes. After adding the new CIDR block, the network engineer creates a new subnet from it. However, instances in the new subnet cannot communicate with instances in the existing subnets. The route tables are correctly configured with local routes. What is the most likely reason for the communication failure?

Accepted Answer

The network ACL associated with the new subnet does not allow traffic from the existing subnets.. When adding a new subnet, it is automatically associated with the default network ACL, which allows all traffic. However, if a custom network ACL is used, it must have rules to allow traffic from the existing subnets' CIDR blocks. Since network ACLs are stateless, both inbound and outbound rules are required. This is the most likely reason for the communication failure.

Answer

The security group on the instances in the new subnet does not allow traffic from the existing subnets.

Answer

The new CIDR block overlaps with an existing subnet in another VPC that is peered.

Answer

The new CIDR block is not associated with the VPC's route tables.

Question 3

A company runs a web application in a VPC and wants to allow only specific IP ranges to reach an Application Load Balancer (ALB). The security team insists that the filtering happen at the network layer and that the allowed list be updated frequently without restarting the load balancer. Which approach should a network engineer implement?

Accepted Answer

Attach an AWS WAF web ACL to the ALB with an IP set match rule containing the allowed CIDR ranges.. AWS WAF integrated with an Application Load Balancer provides the ability to create IP set match rules that allow or block traffic based on source IP addresses. IP sets are independent resources that can be updated without modifying the load balancer, enabling frequent changes to the allow list. This meets the requirement for network-layer filtering with dynamic updates.

Answer

Configure a network ACL on the ALB subnet that allows only the approved CIDR ranges on ports 80 and 443.

Answer

Create a security group for the ALB that references the allowed CIDR ranges and attach it to the ALB.

Answer

Enable AWS Shield Advanced on the ALB and configure IP allow lists in the Shield console.

Question 4

A network engineer is deploying an AWS Network Load Balancer in front of a fleet of EC2 instances running a custom TCP application. The application servers must see the original client source IP address for logging and for an IP-based allow list. The security team also requires that the load balancer preserve the client source port. Which target group configuration should the engineer use?

Accepted Answer

Create the target group with the protocol set to TCP and the target type set to instance, and leave client IP preservation at its default enabled state.. A Network Load Balancer target group using the TCP protocol with instance targets preserves the client IP address and source port by default, which is exactly what the application logging and IP allow list require. Other target types or protocol choices either rewrite the source address or change the termination point, breaking the requirement.

Answer

Create the target group with the protocol set to TCP_UDP and the target type set to alb, and enable sticky sessions on the target group.

Answer

Create the target group with the protocol set to TLS and the target type set to instance, and enable proxy protocol v2 on the load balancer.

Answer

Create the target group with the protocol set to TCP and the target type set to ip, and disable client IP preservation so the NLB rewrites addresses consistently.

Question 5

A media company runs a live video transcoding workload on Amazon EC2 instances in a single VPC. The instances must receive multicast UDP streams from on-premises encoders at a rate of 4 Gbps. The company has an existing AWS Direct Connect connection with a transit virtual interface (transit VIF) attached to an AWS Transit Gateway. They need the multicast traffic to reach the VPC without traversing the public internet. What should the network engineer do to meet these requirements?

Accepted Answer

Enable multicast on the transit gateway and create a multicast domain, then associate the VPC attachment with the multicast domain.. Multicast over AWS Direct Connect requires the use of a transit gateway with multicast enabled. The transit VIF connects the on-premises network to the transit gateway, and a multicast domain allows the VPC attachment to receive multicast traffic. This is the only supported method to deliver multicast from on-premises to a VPC without public internet.

Answer

Create a Network Load Balancer in the VPC and configure UDP listeners to distribute the multicast traffic to the EC2 instances.

Answer

Configure a Site-to-Site VPN over the Direct Connect connection and enable multicast forwarding on the virtual private gateway.

Answer

Use AWS Global Accelerator to route the multicast traffic from the on-premises encoders to the VPC over the AWS global network.

Question 6

A company is deploying a global application that uses Amazon Route 53 for DNS. They want to implement a multi-region active-active architecture with latency-based routing. The application endpoints are in two AWS Regions: us-east-1 and eu-west-1. Each Region has an Application Load Balancer (ALB). The company also wants to ensure that if an ALB becomes unhealthy, traffic is routed to the other Region. Which TWO configurations should the network engineer implement to achieve this? (Choose two.)

Accepted Answer

Configure health checks for each ALB and associate them with the Route 53 records.. To achieve active-active multi-region with latency-based routing and failover, you need latency-based routing records for each ALB and health checks associated with those records. This ensures users are routed to the lowest-latency healthy Region, and if an ALB fails, Route 53 automatically fails over to the other Region.

Answer

Enable AWS Global Accelerator and create an accelerator with endpoints in both Regions.

Answer

Create a Route 53 alias record for each ALB with the evaluate target health setting enabled.

Answer

Use a geolocation routing policy to route users to the closest Region.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block of 100.64.0.0/16 to the VPC to support a new application that requires a large number of IP addresses. After adding the secondary CIDR, they create a new subnet with CIDR 100.64.1.0/24 and launch EC2 instances. However, the instances cannot communicate with an on-premises network over an AWS Site-to-Site VPN connection that uses a virtual private gateway (VGW). The on-premises network uses 10.0.0.0/8 and 192.168.0.0/16. What is the most likely cause of the connectivity issue?

Accepted Answer

The VGW does not support routing to the 100.64.0.0/10 address range.. AWS virtual private gateways do not support the 100.64.0.0/10 address range, which is reserved for carrier-grade NAT. Even though a VPC can have a secondary CIDR in that range, traffic over a Site-to-Site VPN that terminates on a VGW cannot route to or from that range. Therefore, the new subnet's instances cannot communicate with on-premises. Other options are not supported by the scenario details.

Answer

The secondary CIDR block 100.64.0.0/16 overlaps with the on-premises network.

Answer

The route table for the new subnet does not have a route to the VGW.

Answer

The on-premises firewall is blocking traffic from the 100.64.0.0/16 range.

Question 8

A company is designing a VPC that will host a latency-sensitive application. The application requires high throughput and needs to minimize network jitter. The company plans to use EC2 instances with enhanced networking. Which TWO features should the network engineer enable to meet these requirements? (Choose two.)

Accepted Answer

ENA Express. EFA and ENA Express are both designed to improve network performance for EC2 instances. EFA provides low-latency, high-throughput communication for HPC workloads, while ENA Express uses SRD to reduce tail latency and increase throughput for inter-instance traffic. Together, they address the latency-sensitive, high-throughput requirements.

Answer

AWS Global Accelerator

Answer

VPC peering

Answer

AWS Transit Gateway

Question 9

A company has an application running on Amazon EC2 instances in a private subnet. The application needs to access Amazon S3 without traversing the internet. The company wants to ensure that traffic to S3 stays within the AWS network and that the solution is highly available across multiple Availability Zones. Which solution should a network engineer implement?

Accepted Answer

Create a gateway VPC endpoint for S3, associate it with the route tables of the private subnets, and use the S3 public DNS names.. A gateway VPC endpoint for Amazon S3 is the appropriate solution because it enables private connectivity from a VPC to S3 without requiring an internet gateway or NAT device. It is associated with route tables, so instances in private subnets can reach S3 using the public DNS names, which resolve to private IP addresses. The endpoint is highly available and automatically scales, meeting the multi-AZ requirement.

Answer

Deploy a NAT gateway in a public subnet and route S3 traffic through it, then create a VPC endpoint policy to restrict access.

Answer

Create an interface VPC endpoint for S3 in each Availability Zone, and configure the application to use the endpoint's DNS names.

Answer

Set up an AWS Site-to-Site VPN connection to an on-premises proxy that forwards requests to S3, and route S3 traffic through the VPN.

Question 10

A company runs a latency-sensitive trading application on EC2 instances spread across three Availability Zones in a single VPC. The network team must ensure that traffic between instances in the same subnet never leaves the physical host when possible, and that inter-AZ traffic uses the lowest-latency path. The instances are already launched with enhanced networking enabled. Which action should the network engineer take to meet these goals?

Accepted Answer

Rely on the default VPC routing, since same-subnet traffic already uses the local route and inter-AZ traffic follows the AWS backbone automatically.. VPC local routing already keeps intra-VPC traffic on the AWS network, and same-subnet traffic between instances co-located on a host can be delivered locally. Inter-AZ traffic traverses the regional backbone with consistently low latency. Since enhanced networking is already enabled, no additional placement group or adapter configuration is required to satisfy both requirements.

Answer

Enable Elastic Fabric Adapter on the instances and use it for all intra-subnet traffic.

Answer

Place the instances in a cluster placement group so that same-subnet traffic can use the same-host path and inter-AZ placement is optimized.

Answer

Create a spread placement group and enable jumbo frames on the instances' ENIs.

Question 11

A company is deploying a new VPC and needs to capture IP traffic metadata for all elastic network interfaces in the VPC. The security team wants to analyze the logs in Amazon CloudWatch Logs and also archive them to Amazon S3 for long-term retention. The company wants the simplest configuration that meets both needs. What should the network engineer do?

Accepted Answer

Create two VPC Flow Logs: one with a destination of CloudWatch Logs and one with a destination of Amazon S3.. VPC Flow Logs support CloudWatch Logs and Amazon S3 as destinations, and you can create multiple flow logs for the same resource. To both analyze in CloudWatch Logs and archive to S3, the simplest approach is to create one flow log with a CloudWatch Logs destination and another with an S3 destination. This avoids custom pipelines and provides native delivery to both services.

Answer

Create a VPC Flow Log with a destination of CloudWatch Logs, and configure a subscription filter to deliver the logs to Amazon S3.

Answer

Create a single VPC Flow Log with a destination of Amazon S3, and use Amazon Athena to query the logs.

Answer

Enable VPC Flow Logs on each subnet with a destination of CloudWatch Logs, and enable S3 server access logging on the VPC.

Question 12

A company has a VPC with a single subnet that hosts a web application. The application must be accessible from the internet over HTTPS. The company wants to use an Application Load Balancer (ALB) to distribute traffic to the application instances. The ALB must be highly available across multiple Availability Zones. Which configuration should the network engineer use?

Accepted Answer

Create an ALB with subnets in at least two Availability Zones and enable cross-zone load balancing.. To achieve high availability, an Application Load Balancer must be associated with subnets in at least two Availability Zones. Enabling cross-zone load balancing ensures that traffic is distributed evenly across all targets regardless of their AZ. This configuration also supports HTTPS listeners and internet-facing access.

Answer

Create an ALB in a single Availability Zone and associate it with the subnet.

Answer

Create an ALB with a single subnet and use Route 53 latency-based routing to distribute traffic.

Answer

Create an ALB with subnets in two Availability Zones but disable cross-zone load balancing to reduce latency.

Question 13

A network engineer needs to connect a VPC to an on-premises network using AWS Site-to-Site VPN. The on-premises router uses a public IP address and supports BGP. The engineer wants the VPN to automatically fail over between two tunnels if one tunnel goes down. Which configuration should the engineer use?

Accepted Answer

Create a Site-to-Site VPN connection with a virtual private gateway, enable dynamic routing with BGP, and configure both tunnels with unique BGP ASNs on the customer gateway.. A Site-to-Site VPN connection with a virtual private gateway supports BGP dynamic routing, and each of the two tunnels can run its own BGP session with a unique ASN on the customer gateway. BGP detects tunnel failures and withdraws routes, enabling automatic failover. This design provides the required resilience without manual reconfiguration.

Answer

Create a Site-to-Site VPN connection with a transit gateway and use static routing with identical prefixes on both tunnels.

Answer

Create two separate Site-to-Site VPN connections, each with a single tunnel, and use equal-cost multipath routing on the customer gateway.

Answer

Create a Site-to-Site VPN connection with a virtual private gateway and use static routing with a single tunnel to simplify configuration.

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to add a secondary CIDR block of 100.64.0.0/16 because the original range is exhausted. The network engineer must ensure that instances in the new secondary CIDR can reach the internet through an existing NAT gateway in the original CIDR. What should the engineer do?

Accepted Answer

Associate the secondary CIDR block with the VPC, create a subnet from it, and add a route in the new subnet's route table pointing 0.0.0.0/0 to the existing NAT gateway.. Associating the secondary CIDR block and creating a subnet from it, then routing that subnet's default route to the existing NAT gateway, gives instances in the new range outbound internet access. The NAT gateway translates traffic from any subnet in the VPC, so no relocation is required.

Answer

Associate the secondary CIDR block with the VPC and add the new range to the existing NAT gateway's Elastic IP address allocation.

Answer

Create a new VPC with the secondary CIDR block and peer it with the original VPC, then route internet traffic through the new VPC's NAT gateway.

Answer

Associate the secondary CIDR block with the VPC and move the NAT gateway into the new CIDR by recreating it in a subnet from that range.

Question 15

A company is designing a VPC with a CIDR block of 10.0.0.0/16. They plan to create subnets in three Availability Zones and need to reserve IP addresses for AWS services. Which TWO statements about IP address usage in a VPC are correct? (Choose two.)

Accepted Answer

AWS reserves the first four IP addresses and the last IP address in each subnet CIDR block.. AWS reserves five IP addresses in each subnet: the first four and the last. A VPC can have multiple CIDR blocks, including IPv4 and IPv6, allowing for address space expansion. These two facts are essential for designing subnets with sufficient usable addresses and for planning future growth without recreating the VPC.

Answer

The first IP address of a subnet is reserved for the VPC router, and the second is reserved for DNS.

Answer

The primary CIDR block of a VPC cannot be modified after creation, but you can add secondary CIDR blocks.

Answer

Each subnet must have a CIDR block that is a subset of the VPC CIDR block, and subnet CIDR blocks can overlap if they are in different Availability Zones.