ANS-C01 Network Implementation Practice Test 2 — 15 Questions

Question 1

Which THREE actions are required to enable an EC2 instance in a private subnet to download software updates from the internet? (Select THREE.)

Accepted Answer

Create a NAT Gateway in a public subnet. To enable an EC2 instance in a private subnet to download software updates from the internet, you need a NAT Gateway in a public subnet (Option C) which requires an Internet Gateway attached to the VPC (Option E) to route traffic to the internet. Additionally, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway (Option D). While a NAT Gateway does require an Elastic IP, this is automatically allocated and associated during creation, so it is not a separate action.

Answer

Allocate an Elastic IP and associate it with the NAT Gateway

Answer

Configure the security group to allow outbound traffic to 0.0.0.0/0

Question 2

A network engineer is troubleshooting connectivity between two VPCs that are peered. The route tables are correct, and security groups allow traffic. However, ICMP ping fails. What is the most likely cause?

Accepted Answer

The security groups are blocking ICMP. VPC peering does support ICMP traffic. The most common reason for ICMP ping failure despite correct route tables and security groups that allow traffic is that the security groups are not explicitly allowing ICMP. Security groups default to deny all inbound traffic, and a rule allowing all TCP traffic does not include ICMP. Therefore, the security groups must have an inbound ICMP rule for the ping to succeed.

Answer

The route tables are not propagated

Answer

VPC peering does not support ICMP

Answer

The VPCs are in different regions

Question 3

A company has multiple VPCs in the same AWS region that need to communicate with each other and with an on-premises data center. The company currently uses VPC peering connections between each VPC pair, which has become difficult to manage as the number of VPCs grows. The company wants to simplify the network architecture and implement a hub-and-spoke model using AWS Transit Gateway. The on-premises data center is connected to AWS via a Direct Connect connection with a private VIF. The company has already created a Transit Gateway and attached all VPCs to it. They have also created a Direct Connect gateway and associated it with the Transit Gateway. The on-premises router is advertising the on-premises CIDR (10.0.0.0/8) over BGP. However, after the migration, the VPCs cannot communicate with each other, and the on-premises network cannot reach the VPCs. The VPC route tables have been updated to route all traffic to the Transit Gateway. The Transit Gateway route table has propagation enabled for all VPC attachments and the Direct Connect gateway attachment. What is the most likely missing configuration?

Accepted Answer

The VPC route tables do not have routes for the other VPCs' CIDRs and the on-premises CIDR pointing to the Transit Gateway.. Despite propagation being enabled on the Transit Gateway route table, VPC route tables must have explicit routes for each destination CIDR (other VPCs and on-premises) pointing to the Transit Gateway. Without those routes, traffic will not be forwarded to the Transit Gateway for inter-VPC or on-premises communication. The problem statement confirms VPC route tables point all traffic to the Transit Gateway, but that usually means a default route (0.0.0.0/0) or a summary route, not specific routes for each remote CIDR. The most likely missing configuration is that the VPC route tables lack explicit routes for the other VPCs' CIDRs and the on-premises CIDR. Option C correctly identifies this. Options A, B, and D are incorrect because the Direct Connect gateway is associated, propagation is enabled, and the on-premises router is advertising the CIDR.

Answer

The Direct Connect gateway is not associated with the Transit Gateway.

Answer

The Transit Gateway route table does not have propagation enabled for the VPC attachments.

Answer

The on-premises router is not advertising the on-premises CIDR over BGP.

Question 4

A company is deploying a multi-tier web application across two AWS Regions. The application uses an Application Load Balancer (ALB) in each region, and traffic must be distributed to the closest healthy ALB using Route 53 latency-based routing. The application requires that clients maintain the same source IP address when the request is forwarded from the ALB to the backend targets. The backend targets are EC2 instances in private subnets. The company also needs to ensure that traffic between the ALB and targets stays within AWS. What should the company implement to meet these requirements?

Accepted Answer

Deploy a Network Load Balancer (NLB) in each region with targets in private subnets. Use Route 53 latency-based routing to the NLB.. Network Load Balancer (NLB) preserves the client source IP by default, meeting the requirement for source IP preservation. Targets must be placed in private subnets as per the given requirements, and traffic between the NLB and targets remains within the VPC, satisfying the condition that traffic stays within AWS. With an internet-facing NLB, Route 53 latency-based routing can be used to distribute traffic to the closest healthy NLB across regions. Options B, C, D, and E are incorrect: B incorrectly relies on an internal ALB with PrivateLink, which does not support Route 53 latency routing and does not preserve source IP; C and E use ALB, which does not preserve source IP; D uses Global Accelerator, which does not use Route 53 and does not preserve source IP when ALB is an endpoint.

Answer

Deploy an internal ALB in each region. Place targets in private subnets. Use VPC endpoints for the ALB (AWS PrivateLink) and Route 53 latency-based routing to the VPC endpoint.

Answer

Deploy an Application Load Balancer (ALB) with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB.

Answer

Use AWS Global Accelerator with endpoints in each region. Attach the ALB as an endpoint and enable client IP preservation on the accelerator.

Answer

Deploy an ALB with internet-facing scheme in each region. Use Route 53 latency-based routing to the ALB. Place targets in public subnets to preserve source IP.

Question 5

A networking engineer is troubleshooting connectivity issues between two VPCs that are peered using a VPC peering connection. The VPCs are in different AWS accounts. The engineer has verified that the route tables are correct and the security groups allow traffic. However, ICMP ping fails from an instance in VPC A to an instance in VPC B. What is a likely cause?

Accepted Answer

There is a VPN connection attached to both VPCs that creates a transitive routing issue.. A VPN connection attached to both VPCs can introduce transitive routing, which is not supported by VPC peering. VPC peering does not allow transitive routing; traffic must flow directly between the peered VPCs. If both VPCs have a VPN connection to the same on-premises network or another network, the VPN can create a path that interferes with the direct peering path, causing ICMP pings to fail even when route tables and security groups are correctly configured.

Answer

The route tables in both VPCs do not have the route propagation enabled.

Answer

The VPC CIDR blocks overlap.

Answer

The security group in VPC A does not allow inbound ICMP from VPC B.

Answer

The network ACLs are not configured correctly for return traffic.

Question 6

A company has a centralized inspection VPC architecture where all traffic from spoke VPCs is routed through a Transit Gateway to a centralized VPC that hosts firewall appliances (NGFW). The company needs to inspect traffic between two instances in the same spoke VPC. What is the simplest way to achieve this?

Accepted Answer

Use AWS Transit Gateway with VPC attachments and configure route tables to force traffic between the two instances through the inspection VPC.. AWS Transit Gateway can route traffic between instances in the same spoke VPC by using VPC attachments and route tables to force the traffic through the centralized inspection VPC. This is achieved by configuring the spoke VPC's route table to send inter-instance traffic to the Transit Gateway, which then forwards it to the inspection VPC for firewall inspection before returning it to the destination instance. This approach avoids the need for additional appliances or complex routing within the spoke VPC itself.

Answer

Deploy a Gateway Load Balancer (GWLB) in the spoke VPC and route traffic to it.

Answer

Enable VPC peering and use route propagation to send traffic to the inspection VPC.

Answer

Create a VPC peering connection between the two instances' VPCs.

Question 7

A company is implementing a hybrid network with AWS Direct Connect and a VPN connection as backup. They have a Direct Connect gateway (DXGW) attached to a private VIF and a virtual private gateway (VGW) attached to a VPN connection. The VPC is attached to the VGW. They want to use the Direct Connect connection for all traffic when available. The on-premises router advertises the same prefix over both connections. However, traffic from on-premises to the VPC is using the VPN connection. BGP is configured correctly on both connections. What should the company do to prefer the Direct Connect path?

Accepted Answer

Configure a lower MED (Multi-Exit Discriminator) on the Direct Connect VIF.. The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to the local AS. By setting a lower MED on the Direct Connect VIF, the on-premises router will prefer the Direct Connect path over the VPN path when both advertise the same prefix, assuming all other BGP path selection criteria are equal. This directly addresses the requirement to prefer the Direct Connect connection for all traffic.

Answer

Set a higher weight on the Direct Connect BGP session.

Answer

Set a higher local preference on the Direct Connect VIF.

Answer

Change the BGP timers on the Direct Connect VIF to have a lower hold time.

Answer

Configure AS_PATH prepending on the VPN BGP session.

Question 8

A company is designing a network for a three-tier web application on AWS. The web tier must be accessible from the internet, and the application and database tiers must be in private subnets. The company wants to use a single AWS Region and ensure high availability. Which TWO configurations should be implemented? (Choose two.)

Accepted Answer

Place an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones.. An internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones (AZs) provides both internet access to the web tier and high availability. The ALB distributes incoming HTTP/HTTPS traffic to web instances in private subnets, and deploying across two AZs ensures fault tolerance if one AZ fails.

Answer

Use a stateful network ACL for the web tier subnets to simplify security rules.

Answer

Deploy a NAT Gateway in a single Availability Zone for outbound traffic from private subnets.

Answer

Create the VPC with a single Availability Zone to simplify management.

Question 9

A company is deploying a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in private subnets can access the internet for software updates while remaining unreachable from the internet. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route to the NAT Gateway in the private subnet route tables.. A NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP, allowing internet access while preventing any unsolicited inbound connections from the internet.

Answer

Attach an internet gateway to the private subnets and configure route tables.

Answer

Use a transit gateway to connect the VPC to the internet.

Answer

Establish a VPN connection to an on-premises network and route traffic through it.

Question 10

A company has deployed a web application across multiple AWS Regions using Application Load Balancers (ALBs) and EC2 instances. They want to use AWS Global Accelerator to improve performance and provide a fixed entry point. The Global Accelerator is configured with endpoints pointing to the ALBs. However, users are experiencing intermittent failures. What is the most likely cause?

Accepted Answer

Client IP address preservation is enabled on the Global Accelerator for cross-Region endpoints.. When client IP address preservation is enabled on Global Accelerator for cross-Region endpoints, the accelerator preserves the original client IP address in the packets sent to the Application Load Balancers. However, ALBs are layer-7 load balancers that require traffic to originate from the Global Accelerator's static IP addresses, not the client's IP, for proper routing and health check responses. This mismatch causes the ALBs to reject or mishandle traffic, leading to intermittent failures.

Answer

Global Accelerator does not support multiple endpoints in different Regions.

Answer

The ALBs are not configured with health checks.

Answer

The Global Accelerator is not configured for IPv6 traffic.

Question 11

A company is setting up a Direct Connect connection to connect its on-premises data center to AWS. The connection is established, and a private virtual interface (VIF) is configured. The on-premises router can ping the VIF's Amazon side IP address, but cannot ping an EC2 instance in the VPC. The VPC has a virtual private gateway attached, and the route tables are correctly configured. What should the company check next?

Accepted Answer

Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.. The on-premises router can ping the VIF's Amazon side IP, confirming that Layer 2 and Layer 3 connectivity over the Direct Connect link is working, and BGP is established. However, the inability to ping the EC2 instance indicates that return traffic from the VPC is not reaching the on-premises network. For return traffic to be routed correctly, the on-premises router must advertise the VPC CIDR (or a specific prefix) to the Direct Connect router via BGP; otherwise, the AWS side will not forward traffic destined for the on-premises network over the VIF.

Answer

Check that the NACLs on the EC2 instance's subnet allow inbound ICMP.

Answer

Confirm that the private VIF is associated with the correct virtual private gateway.

Answer

Ensure that BGP is established and receiving routes.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16 and has enabled VPC Flow Logs to capture all traffic. The logs show that an EC2 instance (10.0.1.10) is sending outbound traffic to an external IP (203.0.113.50) on port 443, but the traffic is being rejected. The instance's security group allows outbound HTTPS to 0.0.0.0/0, and the subnet's NACL allows outbound traffic on port 443. The VPC has an internet gateway attached, and the route table directs 0.0.0.0/0 to the internet gateway. What is the most likely cause of the rejection?

Accepted Answer

The NACL inbound rules are blocking the return traffic.. The outbound traffic from the EC2 instance is allowed by the security group and NACL outbound rules, but the return traffic (responses from 203.0.113.50:443 back to 10.0.1.10) must also be permitted by the subnet's NACL inbound rules. Since the NACL is stateless, it requires explicit inbound rules for ephemeral ports (typically 1024-65535) to allow the return traffic. If those inbound rules are missing, the return packets are dropped, causing the outbound traffic to appear as rejected in VPC Flow Logs.

Answer

The security group does not allow inbound HTTPS traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The route table does not have a route to the internet gateway.

Question 13

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect and a VPN connection as a backup. The on-premises network uses BGP to advertise routes to AWS. Which of the following are best practices for this setup? (Choose TWO.)

Accepted Answer

Use different BGP ASNs for the Direct Connect and VPN connections.. Using different BGP ASNs for the Direct Connect and VPN connections prevents BGP from treating the two connections as a single eBGP session, which would cause routing loops or suboptimal path selection. This separation allows AWS to distinguish between the two paths and apply independent routing policies. Option E is correct because configuring BGP attributes (such as AS path prepending or MED) on the Direct Connect path ensures it is preferred over the VPN backup, aligning with the design goal of using Direct Connect as the primary link.

Answer

Advertise the same routes over both connections with identical BGP attributes.

Answer

Use the VPN connection as the primary path and Direct Connect as the backup.

Answer

Use the same BGP ASN for both the Direct Connect and VPN connections.

Question 14

A company has a VPC with multiple subnets spanning three Availability Zones. They have deployed an Application Load Balancer (ALB) in the VPC and need to ensure high availability and scalability for a web application. Which of the following are design considerations for implementing the ALB in this environment? (Choose THREE.)

Accepted Answer

Enable the ALB in at least two Availability Zones to provide high availability.. AWS requires an Application Load Balancer to be enabled in at least two Availability Zones to achieve high availability. If one AZ fails, the ALB can continue routing traffic to healthy targets in the remaining AZs, ensuring fault tolerance and compliance with the ALB's regional service model.

Answer

Configure the ALB to use subnets that span multiple Availability Zones.

Answer

Use VPC peering to connect the ALB to subnets in other VPCs.

Question 15

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

Accepted Answer

The application layer is failing to establish a proper connection.. The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Answer

The security groups are blocking the traffic.

Answer

The route tables are incorrectly configured, causing packet loss.

Answer

The flow logs are misconfigured and not capturing all traffic.