ANS-C01 Network Implementation Practice Test 2 — 15 Questions

Question 1

A company is deploying a hybrid network architecture with an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The on-premises network uses BGP to advertise routes to the VPN connection. After the VPN is established, the on-premises network cannot reach EC2 instances in the VPC. The VPC route table has a route for the on-premises CIDR block pointing to the VPN gateway. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.. When the on-premises network advertises a default route (0.0.0.0/0) via BGP over the VPN connection, the VPC propagates that route into its route tables (if route propagation is enabled). This default route can override the VPC's local route for the on-premises CIDR, causing traffic destined for the on-premises network to be sent back out the VPN gateway instead of being delivered locally, effectively breaking connectivity to EC2 instances.

Answer

The VPN connection is not using the correct pre-shared key.

Answer

The security group attached to the EC2 instances does not allow inbound traffic from the on-premises CIDR.

Answer

The VPC's network ACLs are blocking inbound traffic from the on-premises network.

Question 2

A network engineer is troubleshooting a connectivity issue between two VPCs (VPC-A and VPC-B) that are connected via a VPC peering connection. The engineer has verified that the route tables in both VPCs have the appropriate routes. However, instances in VPC-A cannot ping instances in VPC-B. Which TWO actions should the engineer take to resolve this issue? (Choose two.)

Accepted Answer

Verify that the network ACLs in VPC-B allow inbound ICMP traffic from VPC-A.. Network ACLs are stateless firewalls that control inbound and outbound traffic at the subnet level. Even if the route tables are correctly configured, a network ACL in VPC-B that denies inbound ICMP traffic from VPC-A's CIDR will block ping requests. Option D is correct because security groups are stateful and must explicitly allow inbound ICMP traffic from VPC-A's CIDR; without this rule, the instances in VPC-B will drop the ping requests.

Answer

Add a route in VPC-A's route table pointing to the VPC peering connection for the CIDR of VPC-B.

Answer

Enable DNS resolution for the VPC peering connection.

Answer

Configure a transit gateway to route traffic between the two VPCs.

Question 3

A company is deploying a new web application on AWS. They need to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones. Which AWS service should they use?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and can terminate TLS, inspect HTTPS headers, and route traffic based on content. It is designed to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones, providing health checks and automatic scaling.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Question 4

A company has a VPC with multiple subnets. They want to centrally control outbound traffic to the internet and log all traffic. Which AWS service should they use?

Accepted Answer

NAT Gateway. NAT Gateway provides centralized outbound internet access for instances in private subnets. While it does not natively log traffic, you can enable VPC Flow Logs on the VPC to capture metadata of all traffic, including that traversing the NAT Gateway. This combination meets both the control and logging requirements. Other options either fail to control traffic (VPC Traffic Mirroring only copies, VPC Flow Logs only logs) or provide control at a different level (Network ACL is stateless and subnet-level).

Answer

Network ACL

Answer

VPC Flow Logs

Answer

VPC Traffic Mirroring

Question 5

Which THREE of the following are valid methods to connect a VPC to an on-premises network?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a valid method to connect a VPC to an on-premises network because it provides a dedicated, private, high-bandwidth physical connection from your on-premises data center to AWS, bypassing the public internet. This connection uses industry-standard 802.1Q VLANs to create virtual interfaces (VIFs) that directly access VPCs or AWS services, offering consistent network performance and reduced latency compared to internet-based connections.

Answer

VPC Peering

Answer

VPC Endpoint

Question 6

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise a route for 10.0.0.0/8. The VPC CIDR is 10.1.0.0/16. The company wants to ensure that all traffic from the VPC to on-premises uses the Direct Connect connection, but if the Direct Connect fails, traffic should fail over to a VPN connection. Which configuration achieves this?

Accepted Answer

Configure a BGP local preference of 200 on the Direct Connect VIF and 100 on the VPN connection, and use the same ASN for both.. B is correct because BGP local preference is an administrative weight used to prefer one path over another within the same AS. By setting a higher local preference (200) on the Direct Connect VIF and a lower value (100) on the VPN, the on-premises router will prefer the Direct Connect path for outbound traffic. If the Direct Connect fails, the BGP session drops, and the VPN route with the lower local preference becomes active, providing failover. Using the same ASN for both connections ensures the routes are compared as equal under BGP best-path selection.

Answer

Create a static route in the VPC route table pointing to the VPN with a metric of 100, and let BGP propagate the Direct Connect route.

Answer

Set the MED attribute on the Direct Connect VIF to 100 and on the VPN to 200.

Answer

Configure AS path prepend on the Direct Connect side to advertise a longer AS path.

Question 7

A company wants to enable DNS resolution for hybrid network using Route 53 Resolver. The on-premises DNS servers are reachable via Direct Connect. The company wants to forward queries for a custom domain (example.corp) from VPC to on-premises. Which resource should be created in the VPC?

Accepted Answer

Route 53 Resolver outbound endpoint and associate a resolver rule.. To forward DNS queries from a VPC to on-premises DNS servers, you need a Route 53 Resolver outbound endpoint, which initiates outbound DNS traffic from the VPC. You then associate a resolver rule that specifies the domain (example.corp) and the target on-premises DNS server IPs, enabling conditional forwarding via Direct Connect.

Answer

A VPC endpoint for Route 53 Resolver service.

Answer

Route 53 Resolver rule that forwards example.corp to on-premises DNS servers.

Answer

Route 53 Resolver inbound endpoint.

Question 8

A company has multiple AWS accounts and wants to centrally manage network security using AWS Network Firewall. The firewall must inspect traffic between VPCs in the same Region. Which deployment model achieves this with minimal latency?

Accepted Answer

Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.. AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs route traffic through a central inspection VPC. By attaching AWS Network Firewall as a VPC attachment to the transit gateway, traffic between VPCs is routed through the firewall for inspection with minimal latency because the firewall is deployed inline within the transit gateway route table, avoiding the overhead of multiple peering connections or third-party appliances.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC peering between VPCs.

Answer

Deploy AWS Network Firewall in a shared services VPC and use VPC peering to connect all VPCs.

Answer

Use a centralized inspection VPC with a Gateway Load Balancer and third-party appliances.

Question 9

A company has a Direct Connect connection with a public virtual interface (VIF) to access AWS public services. They want to ensure that all traffic to Amazon S3 from on-premises uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Use the public virtual interface and configure a route filter to only accept routes for the S3 service.. A public virtual interface (VIF) provides direct connectivity to AWS public services, including Amazon S3, over the Direct Connect link. By default, the public VIF advertises a default route or specific AWS public prefixes; you must configure a route filter to accept only the S3 service prefixes (e.g., from the S3 service-specific prefix list) to ensure all S3 traffic uses the Direct Connect connection instead of the internet. This prevents any other public traffic from using the link and enforces the desired routing behavior.

Answer

Establish a VPN connection over the Direct Connect private VIF and route S3 traffic through the VPN.

Answer

Create a private virtual interface and attach it to the VPC.

Answer

Create a Direct Connect gateway and associate the public VIF with it.

Question 10

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. The company wants to ensure that traffic to on-premises from VPC does not overlap with VPC's own CIDR. Which action should be taken?

Accepted Answer

Create a more specific route in the VPC route table for the on-premises network that is within the 10.0.0.0/8 range but not overlapping with the VPC's subnets.. Creating a more specific route (e.g., 10.0.0.0/8 with a longer prefix than the VPC's /16) in the VPC route table allows traffic destined for the on-premises network to be directed through the VPN, while the VPC's own /16 CIDR remains local. AWS uses the most specific route that matches the destination IP, so a route with a longer prefix (e.g., /8) will not override the local /16 route for VPC-internal traffic, preventing overlap.

Answer

Change the VPC CIDR to a non-overlapping range such as 172.16.0.0/16.

Answer

Use a NAT gateway to translate the VPC's IP addresses to a different IP range when communicating with on-premises.

Answer

Use AWS Transit Gateway with a network overlay to encapsulate traffic.

Question 11

A company has a Direct Connect connection with multiple Virtual Interfaces (VIFs) to an on-premises network. The VIFs are associated with a Direct Connect Gateway that is attached to multiple VPCs. The company is experiencing asymmetric routing and wants to ensure that traffic from on-premises to the VPCs always uses the same VIF. Which configuration should be implemented?

Accepted Answer

Configure BGP communities on the VIFs to influence route preference. BGP communities allow you to tag routes on the Direct Connect VIFs with specific community values (e.g., 7224:7100 for the primary VIF, 7224:7200 for the secondary VIF). AWS Direct Connect uses these community tags to influence route preference, ensuring that traffic from on-premises to the VPCs consistently uses the designated primary VIF. This mechanism provides granular control over path selection without modifying AS_PATH or local preference, directly addressing asymmetric routing.

Answer

Use AS_PATH prepending on the VIFs to make one path more preferred

Answer

Enable Jumbo Frames on the Direct Connect connection

Answer

Set the Local Preference attribute on the AWS side

Question 12

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses static routes. Recently, the on-premises network administrator added a new subnet (10.0.3.0/24) and needs to ensure that traffic to this subnet is routed through the VPN tunnel. What must be done in the AWS VPC to enable this connectivity?

Accepted Answer

Add a static route for 10.0.3.0/24 in the VPN connection's route table. For a Site-to-Site VPN connection using static routes, the on-premises network administrator must add a new static route in the VPC route table for the new subnet (10.0.3.0/24), pointing to the virtual private gateway. Option D accomplishes this by adding a static route in the VPN connection's route table. Route propagation (Option B) is only available when the VPN uses BGP dynamic routing, not static routes. Options A and C are incorrect because the customer gateway configuration does not affect VPC routing, and creating a new VPN connection is unnecessary.

Answer

Update the customer gateway configuration

Answer

Enable route propagation on the VPN connection

Answer

Create a new VPN connection for the new subnet

Question 13

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to ensure that traffic can only go out to the internet and not be initiated from the internet. Which configuration should be used?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route table. A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, which translates the private source IP to the gateway’s Elastic IP for return traffic. This meets the requirement of outbound-only internet access without exposing private instances to inbound initiation.

Answer

Attach an Internet Gateway to the private subnets

Answer

Set up a VPN connection to an on-premises network

Answer

Create a VPC endpoint for S3

Question 14

A company needs to connect its on-premises network to a VPC using AWS Direct Connect. The company wants to use a single Direct Connect connection to connect to multiple VPCs in the same region. Which configuration should be used?

Accepted Answer

Create a Direct Connect Gateway and associate it with multiple VPCs. A Direct Connect Gateway allows a single Direct Connect connection (via a private virtual interface) to be associated with multiple VPCs in the same region (or across regions). The Direct Connect Gateway acts as a hub, enabling transitive routing between the on-premises network and all associated VPCs without needing separate private VIFs per VPC.

Answer

Create a private VIF for each VPC

Answer

Use a VPN connection to extend the Direct Connect to other VPCs

Answer

Use a Transit Gateway to connect the Direct Connect to multiple VPCs

Question 15

Which THREE of the following are features of AWS Transit Gateway? (Select THREE.)

Accepted Answer

Multicast support. AWS Transit Gateway supports multicast, allowing you to create multicast domains and propagate multicast traffic between subnets and VPCs attached to the transit gateway, which is why option A is correct. It also provides transitive routing between multiple VPCs, so any VPC attached to the transit gateway can route to any other attached VPC through a single hub, making option C correct. Option D is correct because the transit gateway acts as a centralized hub for routing and management, letting you attach VPCs, VPNs, and Direct Connect gateways and manage routing from one place. Option B is not a feature of Transit Gateway, since NAT is handled by separate services such as NAT Gateway or NAT instances, not by the transit gateway itself. Option E is not correct because Transit Gateway does not provide edge-to-edge routing for VPN connections; VPN attachments route through the transit gateway hub, and edge-to-edge routing between VPN attachments is not supported.

Answer

Built-in NAT capabilities

Answer

Edge-to-edge routing for VPN connections