ANS-C01 Network Implementation Practice Test 20 — 15 Questions

Question 1

A company runs a latency-sensitive trading application across two VPCs in the same AWS Region. Each VPC is attached to a different AWS Transit Gateway, and the two transit gateways are peered. Traffic between the VPCs must use the lowest-latency path, and the network team wants to avoid asymmetric routing. The team has already created the peering attachment and added routes in both transit gateway route tables. Which statement about Transit Gateway peering attachments is correct in this design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transit gateway peering attachments are non-transitive and require static routes or BGP-free route table entries on both sides.. Transit gateway peering is non-transitive, so each peered pair needs explicit static routes in both transit gateway route tables. The design must add routes for the remote VPC CIDRs on each side; there is no route propagation across the peering attachment. This gives deterministic, symmetric forwarding between the two VPCs while preventing unintended transit to other gateways.

Answer

Transit gateway peering attachments support transitive routing, so a third transit gateway can route through the peered pair.

Answer

Transit gateway peering attachments only support IPv6 traffic between the peered gateways.

Answer

Transit gateway peering attachments require the two transit gateways to be in different AWS Regions.

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block to the VPC to support additional workloads. The new CIDR block must not overlap with the existing block or any on-premises networks. The company plans to use the secondary CIDR for a new subnet in a different Availability Zone. Which CIDR block can be added as a secondary CIDR to the VPC?

Accepted Answer

172.16.0.0/16. A secondary CIDR block must not overlap with any existing VPC CIDR blocks. 172.16.0.0/16 is a private IPv4 range that does not overlap with 10.0.0.0/16, so it can be added. The other options either overlap with the existing CIDR or are duplicates.

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Answer

192.168.0.0/16

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16 and a subnet with a CIDR block of 10.0.1.0/24. The company needs to add a second CIDR block to the VPC to accommodate a new workload that requires a /20 subnet. The new CIDR block must not overlap with any existing VPC or on-premises routes. Which CIDR block can be associated with the VPC?

Accepted Answer

10.1.0.0/20. AWS allows multiple CIDR blocks per VPC, but each additional block must not overlap with any existing VPC CIDR or with routes propagated from on-premises. The existing VPC uses 10.0.0.0/16, so any block within that range is invalid. The block 10.1.0.0/20 is outside the existing range and provides enough addresses for a /20 subnet, making it the valid choice.

Answer

10.0.16.0/20

Answer

10.0.0.0/20

Answer

10.0.0.0/8

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16 and uses AWS Transit Gateway to connect to multiple on-premises networks via Site-to-Site VPNs. The company needs to ensure that traffic from on-premises can reach a specific subnet in the VPC, but only if the traffic originates from a specific on-premises CIDR block. The company wants to implement this restriction without modifying the on-premises routers. Which AWS feature should be used?

Accepted Answer

Network ACL on the subnet that allows traffic from the specific on-premises CIDR and denies all other traffic.. Network ACLs operate at the subnet level and can allow or deny traffic based on source IP CIDR. By configuring a network ACL on the target subnet to allow only the specific on-premises CIDR and deny all other traffic, the company can restrict access without changing on-premises routers. Other options either block too broadly or do not filter based on source.

Answer

VPC route table with a route to the Transit Gateway for the specific on-premises CIDR.

Answer

Transit Gateway route table with a route for the specific on-premises CIDR to the VPC attachment, and a blackhole route for all other prefixes.

Answer

Transit Gateway route tables with a blackhole route for the specific subnet.

Question 5

A company is deploying a new VPC and needs to connect it to an existing on-premises network using AWS Site-to-Site VPN. The company requires high availability and automatic failover between two VPN tunnels. Which two configurations should the network engineer implement to meet these requirements? (Choose two.)

Accepted Answer

Use BGP for dynamic routing between the customer gateway and the virtual private gateway.. To achieve high availability with AWS Site-to-Site VPN, the customer gateway should use BGP for dynamic routing and enable dead peer detection (DPD). BGP allows automatic failover by withdrawing routes when a tunnel fails, and DPD detects tunnel failures quickly. Together, these ensure that traffic is rerouted to the healthy tunnel without manual intervention.

Answer

Configure the customer gateway with two separate IP addresses, one for each VPN tunnel.

Answer

Configure a single VPN tunnel with a larger bandwidth allocation to handle all traffic.

Answer

Set up an AWS Direct Connect connection as a backup to the VPN tunnels.

Question 6

A network engineer needs to connect two VPCs in the same AWS Region using a peering connection. Both VPCs have non-overlapping CIDR blocks. After creating the peering connection, the engineer notices that instances in one VPC cannot reach instances in the other. What is the most likely cause?

Accepted Answer

The route tables in both VPCs do not have routes pointing to the peering connection.. VPC peering requires route table entries in both VPCs to direct traffic to the peering connection. Even with a peering connection in the active state, without these routes, packets have no path to the peer VPC. Security groups and network ACLs also need to allow the traffic, but the most immediate and common missing configuration is the route.

Answer

The security groups in both VPCs do not allow traffic from the other VPC's CIDR block.

Answer

The VPC peering connection requires a VPN attachment to route traffic.

Answer

The peering connection must be accepted in both VPCs before it becomes active.

Question 7

A company is deploying Amazon Route 53 Resolver endpoints in a VPC to provide hybrid DNS resolution. On-premises servers must resolve names hosted in a private hosted zone associated with the VPC, and EC2 instances in the VPC must resolve names hosted on the on-premises DNS servers. The network team has created an inbound endpoint and an outbound endpoint, each with two IP addresses in different Availability Zones. Which configuration is required to make both directions of resolution work?

Accepted Answer

Create a Route 53 Resolver rule of type FORWARD and associate it with the VPC, then point the on-premises DNS servers at the inbound endpoint IPs.. Hybrid DNS with Route 53 Resolver needs two complementary pieces: on-premises servers query the inbound endpoint IPs to resolve records in private hosted zones, and a FORWARD Resolver rule sends VPC queries for the on-premises domain to the outbound endpoint. Both endpoints should span at least two Availability Zones for availability.

Answer

Create a Route 53 Resolver rule of type SYSTEM and associate it with the VPC, then point the on-premises DNS servers at the outbound endpoint IPs.

Answer

Enable DNSSEC signing on the private hosted zone and share the zone with the on-premises DNS servers.

Answer

Create a Route 53 Resolver rule of type RECURSIVE and associate it with the VPC, then point the on-premises DNS servers at the inbound endpoint IPs.

Question 8

A company has a VPC with an internet-facing Network Load Balancer (NLB) that distributes traffic to targets in multiple Availability Zones. The NLB is configured with a TLS listener that uses an ACM certificate. A network engineer needs to ensure that the NLB preserves the source IP address of clients when forwarding traffic to the targets. Which configuration should the engineer implement?

Accepted Answer

Enable proxy protocol v2 on the target group.. For a TLS listener, the NLB terminates the TLS connection, so the client IP is not preserved by default. Enabling proxy protocol v2 on the target group allows the NLB to include the original client IP in the proxy protocol header, which the target application can parse. This is the correct way to preserve client IP with a TLS listener.

Answer

Configure the target group to use the source IP address as the client IP preservation setting.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Attach an Elastic IP address to each target instance.

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect this VPC to an on-premises network that uses the CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN. They have set up a virtual private gateway (VGW) and a customer gateway (CGW). The VPN tunnel is up, but traffic from on-premises to the VPC is not reaching instances. The on-premises router is advertising 10.0.0.0/8 over BGP. What is the most likely cause and solution?

Accepted Answer

The VPC CIDR overlaps with the on-premises CIDR. The company must change either the VPC CIDR or the on-premises CIDR to avoid overlap.. The VPC CIDR 10.0.0.0/16 falls within the on-premises CIDR 10.0.0.0/8. When on-premises hosts send traffic to VPC instances, the destination IP is within 10.0.0.0/8, but the VPC's local route for 10.0.0.0/16 is more specific and will be used for any traffic destined to that range within the VPC. However, from on-premises, the route to 10.0.0.0/8 may point to the VPN, but the VPC will not accept traffic for IPs within its CIDR from the VPN because it considers them local. This asymmetry causes connectivity failure. The only solution is to eliminate the overlap by re-IPing one side.

Answer

The VPC route table does not have a route for 10.0.0.0/8 pointing to the VGW. Add a route for 10.0.0.0/8 to the VGW.

Answer

The VGW does not support BGP. Enable BGP on the VGW by attaching a transit gateway instead.

Answer

The customer gateway is not configured with the correct BGP ASN. Update the CGW with the on-premises router's ASN.

Question 10

A company is deploying a VPC with a CIDR block of 10.0.0.0/16. They need to create subnets for a multi-tier application. The application requires that the web tier be publicly accessible, the application tier be private, and the database tier be isolated from the internet. The company wants to use AWS services to manage routing and security. Which TWO of the following configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Create a NAT gateway in a public subnet and add a route in the private subnet's route table to the NAT gateway.. To make the web tier publicly accessible, an internet gateway must be attached and a route added in the public subnet's route table. To allow the private application tier outbound internet access without inbound access, a NAT gateway in a public subnet with a route in the private subnet's route table is needed. These two configurations are essential for the multi-tier architecture. Other options are either not required or overly restrictive.

Answer

Create a virtual private gateway and attach it to the VPC, then add a route in the database subnet's route table to the virtual private gateway.

Answer

Create a security group for the database instances that allows inbound traffic only from the application tier's security group.

Answer

Create a network ACL for the database subnet that denies all inbound and outbound traffic.

Question 11

A company is deploying a new VPC and needs to connect it to an on-premises data center using AWS Direct Connect. They require high availability and encryption for traffic between the VPC and on-premises. Which TWO configurations should be used to meet these requirements? (Choose two.)

Accepted Answer

Configure a Site-to-Site VPN over the Direct Connect connection to encrypt traffic.. To achieve high availability, two Direct Connect connections from different locations are recommended. For encryption, a Site-to-Site VPN over the Direct Connect connection encrypts traffic end-to-end. Together, these meet both requirements. Other options either lack encryption (MACsec only encrypts part of the path) or do not provide the necessary redundancy and encryption combination.

Answer

Use AWS Transit Gateway with a Direct Connect gateway and enable equal-cost multipath (ECMP) across multiple VPN tunnels.

Answer

Enable MACsec on the Direct Connect connection to encrypt traffic at layer 2.

Answer

Create a private virtual interface (VIF) and associate it with a virtual private gateway (VGW) that has a static route to the on-premises network.

Question 12

A company runs an application on Amazon EC2 instances in a VPC. The application must access an Amazon S3 bucket without traversing the public internet. The company has configured an S3 gateway VPC endpoint in the VPC, and the route table for the subnet containing the instances includes a route for the S3 prefix list pointing to the endpoint. However, the instances are still unable to access the S3 bucket. The instances are in a private subnet with a NAT gateway for internet access. What is the most likely cause of the failure?

Accepted Answer

The S3 bucket policy does not allow access from the VPC endpoint.. When using an S3 gateway VPC endpoint, the S3 bucket policy must explicitly grant access to the endpoint or the VPC. Without that permission, S3 denies requests even though network routing is correct. The other options describe conditions that are either already satisfied or irrelevant to the failure.

Answer

The S3 gateway endpoint is not associated with the correct route table.

Answer

The route table for the private subnet does not have a route to the S3 prefix list.

Answer

The EC2 instances do not have public IP addresses.

Question 13

A company has a hybrid network with an AWS Direct Connect connection using a private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The on-premises network advertises 10.0.0.0/8 over BGP, and the VPC uses 10.1.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection and not the backup Site-to-Site VPN. Which configuration should the network engineer implement?

Accepted Answer

Advertise more specific routes from the VPC over Direct Connect and use AS path prepending on the VPN.. To ensure VPC to on-premises traffic uses Direct Connect, the VPC must advertise more specific routes over the Direct Connect VIF, making that path more attractive. Also, AS path prepending on the VPN BGP session increases the AS path length, making the VPN less preferred. Together, these ensure Direct Connect is primary.

Answer

Use a lower multi-exit discriminator (MED) on the VPN BGP session.

Answer

Use a higher local preference on the VPN BGP session.

Answer

Advertise more specific routes from on-premises over Direct Connect and use AS path prepending on the VPN.

Question 14

A company runs a latency-sensitive UDP service on EC2 instances in three Availability Zones behind a Network Load Balancer. During a load test, the operations team observes that a small number of clients experience intermittent packet loss while most clients are unaffected. The NLB target group is configured with the UDP protocol and instance targets. Which action is MOST likely to resolve the intermittent loss?

Accepted Answer

Confirm that each client's flow is hashed to a single healthy target and that the target's security group and health check port allow the NLB node traffic.. With UDP and instance targets, the Network Load Balancer hashes each client flow to a target per node, so a single unhealthy target or a security group that blocks NLB node traffic causes loss only for the clients hashed to that target. Verifying target health and the security group rules on the health check and service ports addresses the client-specific pattern.

Answer

Enable cross-zone load balancing on the NLB so that traffic is distributed evenly across all targets in all Availability Zones.

Answer

Increase the deregistration delay on the target group so that in-flight UDP packets are not dropped during target replacement.

Answer

Switch the target group protocol from UDP to TCP so that the load balancer can retransmit lost packets on behalf of the clients.

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a private subnet 10.0.1.0/24 with an EC2 instance that needs to access an Amazon S3 bucket. The VPC has an S3 gateway endpoint configured and associated with the private subnet's route table. However, the instance cannot access the S3 bucket. The instance's security group allows outbound HTTPS. The S3 bucket policy allows access from the VPC endpoint. What is the most likely cause?

Accepted Answer

The EC2 instance is in a subnet that does not have a route to the S3 gateway endpoint because the route table is not associated with the subnet.. For an S3 gateway endpoint to work, the route table associated with the subnet must have a route for the S3 prefix list pointing to the endpoint. If the subnet is associated with a different route table that lacks this route, the instance cannot reach S3 via the endpoint. The other options are either already addressed in the scenario or less likely.

Answer

The S3 gateway endpoint requires a route in the route table for the S3 prefix list, but the route is missing.

Answer

The S3 bucket policy does not allow access from the VPC endpoint because it lacks the aws:sourceVpce condition.

Answer

The EC2 instance's security group does not allow outbound traffic to the S3 prefix list.