ANS-C01 Network Implementation Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. A company has an S3 bucket with the bucket policy shown. An EC2 instance in a VPC with CIDR 10.0.0.0/16 tries to retrieve an object from the bucket using the S3 console, but receives an 'Access Denied' error. The instance's security group allows all outbound traffic. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EC2 instance is accessing the S3 bucket through a NAT Gateway, so the source IP is the public IP of the NAT Gateway, which does not match the condition.. The bucket policy uses the `aws:SourceIp` condition to restrict access to requests originating from the specific IP range 10.0.0.0/16. However, when the EC2 instance accesses S3 through a NAT Gateway, the source IP seen by S3 is the public IP of the NAT Gateway, not the private IP of the instance. Since the NAT Gateway's public IP does not fall within the 10.0.0.0/16 range, the condition fails and S3 returns an 'Access Denied' error.

Answer

The bucket policy does not allow the s3:GetObject action.

Answer

The bucket policy does not specify a principal, so it defaults to deny.

Answer

The condition aws:SourceIp is too restrictive and blocks all traffic.

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. They also have a site-to-site VPN as a backup. The on-premises network advertises the same prefix via BGP over both connections. The company wants to prefer the Direct Connect path. What configuration achieves this?

Accepted Answer

Configure the Direct Connect BGP session with a higher local preference (e.g., 200) than the VPN BGP session.. Local preference is a BGP attribute used to influence outbound traffic from the local AS. By setting a higher local preference (e.g., 200) on the Direct Connect BGP session, the router will prefer that path over the VPN session (default local preference 100) for the same prefix. This ensures traffic from the VPC to on-premises uses Direct Connect as the primary path.

Answer

Set the Multi-Exit Discriminator (MED) on the VPN advertisement to a lower value.

Answer

Prepend the AS path on the Direct Connect advertisement to make it longer.

Answer

Configure the VPN BGP session with a higher local preference than the Direct Connect session.

Question 3

A security team wants to block traffic from a specific IP address (203.0.113.5) from reaching an EC2 instance. The instance is in a public subnet with a security group that allows all traffic from the internet. A network ACL is associated with the subnet. The team adds a DENY rule for the IP in the network ACL. However, traffic from that IP still reaches the instance. What is the most likely reason?

Accepted Answer

The network ACL has an ALLOW rule with a lower rule number that matches the IP, so the DENY rule is never evaluated.. Network ACLs are stateless and evaluated in order by rule number, from lowest to highest. If an ALLOW rule with a lower rule number (e.g., 100) matches the source IP 203.0.113.5 before the DENY rule (e.g., 200) is reached, the ALLOW rule will be applied and the traffic permitted. The DENY rule is never evaluated because the first matching rule determines the action.

Answer

The security group allows traffic from the IP, overriding the network ACL.

Answer

The network ACL is applied to the wrong subnet.

Answer

The internet gateway is ignoring the network ACL.

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). They have an internet-facing ALB in the public subnets and EC2 instances in the private subnets. The EC2 instances need to download updates from the internet. They deploy a NAT Gateway in each public subnet and add routes in the private subnet route tables pointing to the respective NAT Gateway in the same AZ. However, the EC2 instances in AZ2 cannot access the internet, while those in AZ1 can. What is the most likely cause?

Accepted Answer

The NAT Gateway in AZ2 does not have an Elastic IP address assigned.. The NAT Gateway in AZ2 does not have an Elastic IP address assigned. A NAT Gateway requires an Elastic IP to enable outbound internet traffic. Without it, the NAT Gateway cannot route traffic to the internet, causing the EC2 instances in AZ2 to fail to download updates. Option A is incorrect because security group rules are account-level and would affect both AZs equally. Option C is incorrect because the route table in AZ2 is configured to point to the NAT Gateway in the same AZ, not cross-AZ. Option D is incorrect because the route table for the private subnet in AZ2 does have a route to the NAT Gateway, but the NAT Gateway itself is missing the Elastic IP.

Answer

The security group of the EC2 instances in AZ2 is blocking outbound traffic.

Answer

The private subnet in AZ2 is routing traffic to the NAT Gateway in AZ1, which is in a different Availability Zone and incurs cross-AZ charges but should still work.

Answer

The route table for the private subnet in AZ2 is missing a route to the NAT Gateway.

Question 5

A company is setting up a VPC with both public and private subnets. The private subnets need outbound internet access for software updates. Which component is required to enable this?

Accepted Answer

A NAT gateway in a public subnet.. A NAT gateway in a public subnet is required to enable outbound internet access for private subnets. The NAT gateway resides in a public subnet with an Internet Gateway (IGW) route, and private subnet route tables direct default traffic (0.0.0.0/0) to the NAT gateway's elastic network interface. This allows instances in private subnets to initiate outbound connections (e.g., for software updates) while preventing unsolicited inbound traffic from the internet.

Answer

A VPN connection to an on-premises network that has internet access.

Answer

A VPC peering connection to a VPC that has internet access.

Answer

An internet gateway attached to the VPC with a route in the private subnet's route table pointing to the internet gateway.

Question 6

A network engineer is troubleshooting connectivity between an on-premises data center and a VPC over an AWS Site-to-Site VPN. The tunnel status shows UP, but traffic from on-premises to the VPC is intermittently dropped. Which TWO of the following are likely causes? (Choose 2.)

Accepted Answer

Asymmetric routing across multiple tunnels. Asymmetric routing across multiple tunnels can cause intermittent drops because traffic from on-premises to the VPC may take one tunnel, while return traffic takes a different tunnel. If the stateful firewall (e.g., security groups, network ACLs, or on-premises firewall) sees packets from a different source IP or interface than expected, it may drop the return packets, leading to connectivity issues even though both tunnels are UP.

Answer

Dead Peer Detection (DPD) timeout configuration

Answer

BGP hold timer expiration

Answer

IPsec SA lifetime mismatch between peers

Question 7

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They have an on-premises application that needs to resolve private hosted zone names in Amazon Route 53. The on-premises DNS server forwards queries for the private domain to the VPC's DNS resolver. However, resolution fails. What is the most likely cause?

Accepted Answer

The private hosted zone is not associated with the VPC.. The most likely cause is that the private hosted zone is not associated with the VPC. For Route 53 private hosted zones, the zone must be explicitly associated with the VPC in which the DNS resolver operates. If the zone is not associated, the VPC's DNS resolver (Route 53 Resolver) will not respond to queries for that domain, even if queries are forwarded from on-premises. The on-premises DNS server forwards queries to the VPC's DNS resolver, but without zone association, the resolver has no knowledge of the private hosted zone. Options B and C are incorrect because DHCP option sets and security groups do not directly affect the VPC DNS resolver's ability to resolve private hosted zones. Option D is incorrect because an outbound endpoint is used to forward queries from the VPC to on-premises, not to accept inbound queries; the correct component would be an inbound endpoint, but the primary issue here is zone association.

Answer

The VPC's DHCP option set is not configured to use the Route 53 Resolver.

Answer

The security group for the VPC DNS resolver is blocking inbound UDP port 53 from the on-premises network.

Answer

A Route 53 Resolver outbound endpoint is not configured to forward queries from on-premises to the VPC.

Question 8

A company uses AWS Transit Gateway with multiple VPC attachments and a VPN attachment to an on-premises network. The on-premises network advertises the same prefix via two separate VPN connections for redundancy. The TGW route table shows both routes as active. Traffic from a VPC to on-premises is not load-balanced and prefers one connection. Which THREE actions would help achieve active-active load balancing? (Choose 3.)

Accepted Answer

Configure BGP AS_PATH prepending on the preferred VPN connection to make it less preferred. BGP AS_PATH prepending artificially increases the AS path length for routes advertised over the preferred VPN connection, making them less preferred by BGP's path selection algorithm. This causes the Transit Gateway to prefer the other VPN connection for those prefixes, enabling active-active load balancing when combined with ECMP.

Answer

Set a higher BGP weight on the less preferred connection

Answer

Use static routes for both VPN connections instead of BGP

Question 9

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region using AWS native services? (Choose two.)

Accepted Answer

VPC peering. VPC peering (B) is a valid AWS-native method to connect multiple VPCs in the same region, using the AWS backbone to route traffic between VPCs via private IPv4 or IPv6 addresses with no single point of failure or bandwidth bottleneck. AWS Transit Gateway (E) is also a native service that acts as a hub-and-spoke router, enabling transitive connectivity between thousands of VPCs and on-premises networks using a single gateway, supporting both same-region and inter-region peering attachments.

Answer

Software VPN appliance

Answer

AWS Direct Connect

Answer

Amazon ClassicLink

Question 10

A network engineer is designing a Direct Connect solution with a public VIF and a private VIF. The private VIF will connect to a VPC via a Direct Connect Gateway. Which TWO of the following statements are correct regarding this setup? (Choose 2.)

Accepted Answer

The Direct Connect Gateway allows the private VIF to connect to multiple VPCs in different AWS Regions. A Direct Connect Gateway enables a private VIF to connect to multiple VPCs, even across different AWS Regions, by acting as a transit hub. The gateway uses a single private VIF to route traffic to up to 10 VPCs (by default) in any region, provided the VPCs are associated via virtual private gateways and the appropriate route tables are configured.

Answer

The private VIF can be used without a virtual interface termination device on the customer side

Answer

The public VIF can be used to connect to a VPC via a Direct Connect Gateway

Answer

The private VIF can be used to access Amazon S3 over a private IP address

Question 11

A media company runs a latency-sensitive streaming application on Amazon EC2 instances in a VPC. The application sends UDP traffic to multiple on-premises destinations via an AWS Transit Gateway with a VPN attachment. Users report occasional freezing. Network monitoring shows no packet loss on the VPN tunnel, but the application logs show out-of-order packets and high jitter. The company uses a single VPN tunnel with BGP dynamic routing over the public internet. The on-premises router has a 50ms latency to the AWS endpoint. The application requires low jitter and in-order delivery. What should a network engineer do to resolve the issue?

Accepted Answer

Replace the VPN attachment with an AWS Direct Connect private VIF to provide a consistent path. UDP traffic over a single VPN tunnel over the internet can experience jitter and reordering due to variable network conditions. Using AWS Direct Connect provides a consistent, low-latency path that eliminates internet variability. Option A (multiple VPN tunnels) may not resolve jitter inherent to internet transit. Option B (TCP instead of UDP) changes application protocol, not a network solution. Option D (enable jumbo frames) does not address jitter.

Answer

Add a second VPN tunnel to the same Transit Gateway to load balance traffic

Answer

Enable jumbo frames on the VPN tunnel to reduce packet overhead

Answer

Change the application to use TCP instead of UDP

Question 12

Which THREE of the following are required to establish a highly available site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Two VPN tunnels (one primary, one secondary). AWS Site-to-Site VPN requires two tunnels per VPN connection to provide high availability. Each tunnel uses separate endpoints and paths; if one tunnel fails, traffic automatically fails over to the other. This design ensures continuous connectivity even during maintenance or failures.

Answer

Two separate VPN connections

Answer

An AWS Direct Connect connection

Question 13

A financial services company has a VPC with a public subnet and a private subnet. EC2 instances in the private subnet need to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, instances cannot reach the internet. The NAT gateway is in an 'available' state and has an Elastic IP attached. The security group for the NAT gateway allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a default route (0.0.0.0/0) pointing to an internet gateway. The most likely cause is that the route table for the public subnet (where the NAT gateway resides) does not have a default route (0.0.0.0/0) pointing to an internet gateway. The NAT gateway needs this route to forward traffic from private instances to the internet. Option A is incorrect because security groups for NAT gateways do not block inbound traffic from private instances; they only control traffic to the NAT gateway itself. Option B is incorrect because bandwidth provisioning is not related to connectivity; the NAT gateway can handle traffic up to its bandwidth limit. Option C is incorrect because NAT gateways do not require IAM roles to access the internet; they use Elastic IPs.

Answer

The security group for the NAT gateway is blocking inbound traffic from private instances

Answer

The NAT gateway is not provisioned with sufficient bandwidth

Answer

The NAT gateway does not have an IAM role to access the internet

Question 14

Which TWO of the following are true about AWS VPC security groups? (Choose two.)

Accepted Answer

They have an implicit deny all rule at the end.. Security groups in AWS VPC are stateful, meaning that if you allow inbound traffic, the corresponding outbound return traffic is automatically permitted, regardless of outbound rules. They also have an implicit deny all rule at the end, so any traffic not explicitly allowed by a rule is denied. This makes options B and C correct.

Answer

Rules are evaluated in order, and the first matching rule is applied.

Answer

They support both allow and deny rules.

Answer

They can be associated with subnets.

Question 15

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect two separate branch offices using AWS Client VPN. Each branch office has a different subnet: Branch A uses 10.0.1.0/24 and Branch B uses 10.0.2.0/24. The Client VPN endpoint is configured with a CIDR range of 10.0.3.0/24. The route table for the VPC has the local route and routes to the Client VPN endpoint. Users from both branches can connect to the VPN but cannot communicate with each other. What is the most likely reason?

Accepted Answer

The branch subnets 10.0.1.0/24 and 10.0.2.0/24 are part of the VPC CIDR, so the VPC routes traffic locally instead of via the VPN. Branch subnets overlap with the VPC CIDR, causing routing conflicts. The VPC sees 10.0.1.0/24 and 10.0.2.0/24 as local, thus traffic destined to those addresses is routed locally within the VPC, not to the VPN. Options B and C are not relevant to inter-branch communication. Option D would not cause the issue because branch subnets are within the VPC CIDR.

Answer

The route tables in the branch subnets do not have routes to the Client VPN endpoint

Answer

The Client VPN endpoint is configured with a CIDR that overlaps with the branch subnets

Answer

The security group for the Client VPN endpoint does not allow inbound traffic from branch subnets