ANS-C01 Network Implementation Practice Test 20 — 15 Questions

Question 1

A company uses AWS PrivateLink to access a SaaS application hosted in another AWS account. The SaaS provider has created a VPC endpoint service in their account. The consumer has created a VPC endpoint in their VPC. The consumer's VPC has a route table with a local route and a route to a NAT gateway. The VPC endpoint is associated with a security group that allows inbound HTTPS from the consumer's VPC CIDR. The consumer's EC2 instances can resolve the DNS name of the endpoint but cannot connect to the SaaS service. What is the most likely cause?

Accepted Answer

The VPC endpoint security group does not allow inbound HTTPS from the consumer's EC2 instances. For PrivateLink, the consumer's VPC endpoint should be associated with a security group that allows outbound traffic to the endpoint service. The security group for the endpoint controls inbound traffic to the endpoint from the consumer's instances. But the issue is that instances can resolve DNS but cannot connect. The most likely cause is that the endpoint's security group does not allow inbound HTTPS from the instances. Option B (NAT gateway) is irrelevant because PrivateLink uses private IPs. Option C (route table) is wrong because the endpoint uses local routing via the endpoint's network interfaces. Option D (availability) is wrong because DNS resolution works.

Answer

The consumer's route table routes traffic to the endpoint via the NAT gateway

Answer

The VPC endpoint service is not available in the consumer's Availability Zone

Answer

The consumer's route table does not have a route to the VPC endpoint

Question 2

A company is deploying a fleet of EC2 instances in private subnets. The instances need to download patches from the internet. The company wants to minimize cost and avoid managing NAT instances. The VPC has an internet gateway (IGW) attached. What should the company do?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables.. Option C is correct because a NAT Gateway in a public subnet provides outbound internet access for private instances, is managed, and cost-effective. Option A is wrong because private subnets cannot directly use IGW. Option B is wrong because NAT instances require management. Option D is wrong because VPC endpoints are for specific services, not general internet.

Answer

Attach the IGW to the private subnet route table.

Answer

Create a VPC endpoint for internet access.

Answer

Launch a NAT instance and configure routing.

Question 3

A company has a VPC with public and private subnets across two Availability Zones. They have a Network Load Balancer (NLB) in the public subnets. The NLB has a target group of EC2 instances in the private subnets. The NLB is configured with TLS listeners and uses a certificate from AWS Certificate Manager (ACM). Clients connect to the NLB over the internet. Some clients report connection timeouts. The NLB access logs show that the connections are established but then hang. The target instances are healthy. The security groups for the instances allow inbound TCP/443 from the NLB's private IPs. What is the most likely cause?

Accepted Answer

The target group is configured with protocol TLS instead of TCP. NLB with TLS termination requires that the target group uses TCP protocol (not TLS) because NLB terminates TLS and forwards plain TCP to targets. If the target group is configured with TLS protocol, the NLB will attempt to initiate a TLS handshake with the targets, which may fail if targets are not expecting TLS (or if certificates mismatch). This can cause connections to hang. Option B (cross-zone load balancing) would not cause hang. Option C (idle timeout) would cause disconnects, not hang. Option D (security group) is correct as described.

Answer

Cross-zone load balancing is disabled, causing uneven distribution

Answer

The security group for the NLB is blocking traffic from clients

Answer

The NLB idle timeout is set too low

Question 4

A company has a VPC with IPv4 and IPv6 CIDRs. They have a public subnet with an internet gateway and a private subnet with a NAT gateway. EC2 instances in the private subnet need to download updates from the internet. The instances have IPv6 addresses. The private subnet route table has a default route (::/0) pointing to an egress-only internet gateway. However, instances cannot reach IPv6 internet destinations. The egress-only internet gateway is attached to the VPC and in 'available' state. What is the most likely cause?

Accepted Answer

The instances do not have an IPv6 address assigned. Egress-only internet gateway is for outbound-only IPv6 traffic. It requires a route in the subnet route table. The route is present. However, egress-only internet gateway does not support IPv6 traffic that originates from the private subnet if the instances have public IPv6 addresses? Actually, egress-only internet gateway works for instances with IPv6 addresses. The issue might be that the instances have IPv6 addresses but the route table for the private subnet does not have a route to the egress-only internet gateway. But the question says it does. Another common issue: the egress-only internet gateway must be the target of the default IPv6 route. The most likely cause is that the route table for the public subnet (not private) does not have a route to the internet gateway for IPv6, but that's for public subnet. For private subnet, egress-only internet gateway is correct. But instances may need to have IPv6 addresses assigned. Option B (NAT gateway) is for IPv4 only. Option C (security group) is not likely. Option D (auto-assign IPv6) might be disabled.

Answer

The security group for the instances is blocking outbound IPv6 traffic

Answer

The NAT gateway does not support IPv6

Answer

The egress-only internet gateway is not attached to the VPC

Question 5

A company is setting up a new AWS account and wants to centrally manage VPC network traffic inspection across multiple accounts using a central VPC. The company uses AWS Organizations. Which architecture meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central inspection VPC that has firewall appliances.. Option B is correct because using a Transit Gateway with a central inspection VPC allows centralized traffic inspection across accounts. Option A is wrong because VPC peering does not centralize inspection. Option C is wrong because Network Load Balancer is not for inspection. Option D is wrong because VPC endpoints are for specific services.

Answer

Create VPC peering connections between each account's VPC and the central VPC.

Answer

Use VPC endpoints to route traffic to the central VPC.

Answer

Deploy a Network Load Balancer in each VPC and route traffic through it.

Question 6

A company has a VPC with a public subnet hosting a web server. They want to make the web server accessible over the internet. The web server has a public IP address. The public subnet route table has a default route (0.0.0.0/0) to an internet gateway. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. However, external users cannot access the web server. What is the most likely cause?

Accepted Answer

The internet gateway is not attached to the VPC. The internet gateway must be attached to the VPC. If it is not attached, traffic cannot flow. Option B (NACL) could be blocking but default NACL allows all traffic. Option C (web server not listening) is possible but less likely than IGW attachment. Option D (route table) is already correct.

Answer

The web server is not listening on port 80

Answer

The route table for the public subnet does not have a route to the internet gateway

Answer

The network ACL for the public subnet is blocking inbound HTTP traffic

Question 7

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add an additional non-overlapping CIDR to the VPC. What is a valid CIDR block they can add?

Accepted Answer

10.1.0.0/16. Option C is correct because 10.1.0.0/16 does not overlap with 10.0.0.0/16. Option A is wrong because 10.0.0.0/8 is a superset and overlaps. Option B is wrong because 10.0.0.0/16 is the same CIDR. Option D is wrong because 10.0.1.0/24 is within 10.0.0.0/16 and overlaps.

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 8

A company uses AWS Global Accelerator to improve performance for a web application hosted on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The Global Accelerator has an endpoint group in the us-east-1 Region with the ALB as an endpoint. Users in Asia report high latency. The company creates a new endpoint group in ap-southeast-1 and adds the same ALB (which is still in us-east-1). However, users in Asia still experience high latency. What should the network engineer do to reduce latency for Asian users?

Accepted Answer

Add an additional ALB in ap-southeast-1 and add it as an endpoint in the ap-southeast-1 endpoint group. Global Accelerator uses anycast IPs and routes traffic to the nearest endpoint group. But if the ALB is only in us-east-1, traffic from Asia will still go to us-east-1. To reduce latency, the company needs to deploy the application in ap-southeast-1 and add a local ALB as an endpoint. Options A and C do not address the physical distance. Option D is incorrect because Global Accelerator endpoints can be ALBs, but cross-Region ALB is not supported (endpoint group and endpoint must be in same Region).

Answer

Change the endpoint in ap-southeast-1 to use the same ALB but with a cross-Region VPC peering

Answer

Configure Global Accelerator to use weighted routing to direct more traffic to ap-southeast-1

Answer

Use Lambda@Edge to cache content at CloudFront edge locations in Asia

Question 9

A company is migrating an on-premises application to AWS. The application uses multicast for discovery. Which AWS service supports multicast traffic within a VPC?

Accepted Answer

AWS Transit Gateway. Option B is correct because AWS Transit Gateway supports multicast routing. Option A is wrong because VPC peering does not support multicast. Option C is wrong because Application Load Balancer is layer 7, not multicast. Option D is wrong because CloudFront is for content delivery, not multicast within VPC.

Answer

VPC peering

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 10

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to advertise routes. The company wants to ensure high availability by using two Direct Connect connections from different providers. Both connections terminate at the same Direct Connect location (same AWS device). The company configures two private VIFs, each with a separate BGP session, and attaches both to the same VGW. However, when one connection fails, traffic does not fail over. What is the most likely cause?

Accepted Answer

Both Direct Connect connections are on the same AWS device, creating a single point of failure. If both connections terminate at the same AWS Direct Connect location and same device, they share the same physical infrastructure. A failure at that location would affect both. True high availability requires connections at different locations. Also, BGP configuration may not have proper failover. The most likely cause is that both VIFs are on the same device, so a single point of failure exists. Option B (BGP ASN) is wrong because same ASN is allowed. Option C (allowed prefixes) would cause routes not to be accepted. Option D (MTU) would not cause complete failover failure.

Answer

The same BGP ASN is used for both VIFs, causing route conflict

Answer

The MTU size is mismatched between the VIFs

Answer

The allowed prefixes for the VIFs do not include the on-premises subnets

Question 11

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network is advertising a default route (0.0.0.0/0) over BGP. The VPC has an internet gateway attached. When an EC2 instance in the VPC sends traffic to an internet destination, which path does it take by default?

Accepted Answer

Traffic goes to the on-premises network via Direct Connect.. Option A is correct because the VPC route table will have the more specific local VPC routes and the propagated route from Direct Connect. The most specific route for 0.0.0.0/0 will be the one from Direct Connect (propagated), so traffic goes to on-premises. Option B is wrong because the IGW route is not present. Option C is wrong because the instance sends traffic based on route table. Option D is wrong because traffic goes to on-premises.

Answer

Traffic goes to the on-premises network only if there is a static route.

Answer

Traffic is dropped because there is no route.

Answer

Traffic goes to the internet via the internet gateway.

Question 12

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group across three Availability Zones, and an Amazon RDS for MySQL database. The ALB has a target group that routes traffic to the EC2 instances on TCP port 8080. The security group for the EC2 instances allows inbound traffic from the ALB's security group on port 8080. Users report intermittent connectivity issues to the application. A network engineer reviews the VPC Flow Logs and notices that traffic from the ALB to the EC2 instances is being recorded as 'REJECT' for some requests. What is the most likely cause of this issue?

Accepted Answer

The network ACL associated with the EC2 instances' subnet does not have an outbound rule to allow traffic from the EC2 instances to the ALB on ephemeral ports.. Option A is correct because the network ACL is stateless and must allow both inbound and outbound traffic for ephemeral ports. If the outbound rule is missing, SYN-ACK packets from the EC2 instance to the ALB will be dropped, causing the ALB to see a timeout or reject. Option B is incorrect because target group health checks use the same security group rules; if health checks succeed, connectivity should work. Option C is incorrect because the ALB itself does not have a security group that affects traffic to targets; it uses the target group's security group. Option D is incorrect because network ACLs are stateless and require explicit rules for return traffic; the security group stateful behavior does not override ACL rules.

Answer

The ALB's security group is blocking inbound traffic from the EC2 instances on the response path.

Answer

The ALB's target group health check is misconfigured, causing the ALB to mark instances as unhealthy and stop sending traffic.

Answer

The security group on the EC2 instances is stateful and automatically allows return traffic; the issue cannot be security group related.

Question 13

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS Region? (Choose TWO.)

Accepted Answer

VPC peering. Option A (VPC Peering) and Option C (Transit Gateway) are correct. VPC Peering allows direct connectivity, and Transit Gateway supports transitive routing. Option B (VPN) is for on-premises. Option D (Direct Connect) is for on-premises. Option E (Internet Gateway) is for internet access, not VPC to VPC.

Answer

Internet gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Question 14

A network engineer is designing a highly available VPN connectivity between an on-premises data center and AWS. The company has two AWS Direct Connect connections terminated on two different AWS Direct Connect locations for redundancy. The company wants to use AWS Site-to-Site VPN as a backup for Direct Connect. The VPN connections will terminate on a single Virtual Private Gateway (VGW) attached to a VPC. The on-premises network has two customer gateways (CGWs) each with a unique BGP ASN. Which TWO actions should the engineer take to ensure automatic failover and load balancing? (Choose two.)

Accepted Answer

Configure the VPN connections to use BGP dynamic routing.. Option A is correct because using BGP dynamic routing on both VPN tunnels allows automatic failover and load balancing. Option C is correct because creating a VPN connection from each CGW to the same VGW provides two separate tunnels. Option B is incorrect because static routes do not provide automatic failover. Option D is incorrect because a single CGW creates a single point of failure. Option E is incorrect because the VPN is backup; using BGP on both tunnels handles failover without cloudwatch alarms.

Answer

Set up a CloudWatch alarm to trigger an AWS Lambda function that changes route table entries upon VPN failure.

Answer

Configure the VPN connections to use static routes with equal cost multipath (ECMP).

Answer

Use a single customer gateway with two separate tunnels to the virtual private gateway.

Question 15

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose THREE.)

Accepted Answer

Virtual Private Gateway. Option B (Customer Gateway), Option C (Virtual Private Gateway), and Option D (VPN Connection) are required. Option A (Direct Connect) is a different service. Option E (Transit Gateway) is optional, not required.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway