ANS-C01 Network Implementation Practice Test 20 — 15 Questions

Question 1

A company is deploying a new application in a VPC with public and private subnets. The application needs to access an S3 bucket in the same AWS Region. Which configuration provides the MOST secure and cost-effective connectivity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and add a route to it.. An S3 Gateway Endpoint allows private subnet resources to access S3 over the AWS network without traversing the internet, eliminating the need for a NAT gateway or proxy. This provides the most secure connectivity (no public exposure) and is cost-effective because there are no hourly or data processing charges for the endpoint itself, only standard S3 data transfer costs.

Answer

Configure a proxy server in the public subnet to forward requests to S3.

Answer

Set up an AWS Direct Connect connection to S3.

Answer

Create a NAT gateway in the public subnet and route traffic through it.

Question 2

A global e-commerce company uses AWS CloudFront to distribute content. They have an origin behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTPS traffic from CloudFront's IP ranges. Users in some regions report slow loading times. The company wants to reduce latency and improve performance. They are considering using Lambda@Edge and origin failover. However, they also notice that the ALB is receiving traffic directly from some IPs that are not CloudFront IPs, causing unnecessary load. What should a network engineer do to restrict access to the ALB to only CloudFront?

Accepted Answer

Update the ALB security group to allow inbound HTTPS only from the CloudFront managed prefix list. The best practice is to restrict the ALB security group to the CloudFront managed prefix list (com.amazonaws.global.cloudfront.origin-facing). This dynamically allows only CloudFront IPs and automatically updates when CloudFront IPs change. Option C (custom header) is a good additional measure but not sufficient alone because attackers can mimic headers. Option B (AWS WAF) can help block non-CloudFront traffic but is not the primary method and adds complexity. Option D (VPC endpoint) is not applicable because CloudFront does not use VPC endpoints; it communicates over the internet. Therefore, Option A is correct.

Answer

Use AWS WAF to block requests that do not come from CloudFront IPs

Answer

Configure the ALB to require a custom header (e.g., X-Origin-Verify) and validate it in the origin

Answer

Set up a VPC endpoint for CloudFront to route traffic privately

Question 3

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible over the internet, but the security team requires that all traffic be inspected by a third-party firewall appliance. What is the MOST scalable architecture?

Accepted Answer

Use a Gateway Load Balancer with firewall appliances in each Availability Zone.. Gateway Load Load Balancer (GWLB) is designed to scale third-party virtual appliances (e.g., firewalls) horizontally across multiple Availability Zones. It uses the GENEVE protocol to encapsulate traffic, enabling transparent inspection while preserving the original packet headers. This architecture meets the security requirement for traffic inspection and provides high availability and elasticity, unlike a single appliance or a proxy-based solution.

Answer

Configure a Network Load Balancer with target groups pointing to firewall appliances.

Answer

Use an EC2 instance as a transparent proxy and set it as the next-hop in the route table.

Answer

Deploy a single firewall appliance in one Availability Zone and route all traffic through it.

Question 4

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to exchange routes with the VGW. The company wants to route traffic from the VPC to an on-premises subnet 192.168.1.0/24. The on-premises router advertises 192.168.1.0/24 over BGP. However, instances in the VPC cannot reach that subnet. The VPC route table has the local route and a route to the VGW for 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The 192.168.1.0/24 subnet overlaps with the VPC CIDR, causing the local route to take precedence. If the on-premises subnet 192.168.1.0/24 overlaps with the VPC CIDR (e.g., VPC CIDR 192.168.0.0/16), the VPC's local route takes precedence over any propagated BGP routes. Traffic destined for 192.168.1.0/24 stays within the VPC and never reaches the virtual private gateway, even though the on-premises router is advertising the route. Option A is incorrect because BGP route propagation is enabled by default for Direct Connect private VIFs, and even if disabled, a static route to the VGW would be needed. Option C is incorrect because if the subnet overlaps, a specific route to the VGW would be ignored due to the local route's higher priority. Option D is incorrect because allowed prefixes are configured on the Direct Connect gateway, not the VIF, and the route is being advertised successfully.

Answer

BGP route propagation is disabled on the VPC route table

Answer

The VPC route table does not have a specific route for 192.168.1.0/24 pointing to the virtual private gateway

Answer

The Direct Connect virtual interface does not have the allowed prefixes configured

Question 5

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway (VGW) attached. The on-premises network advertises a prefix 10.0.0.0/8 over BGP. The VPC has subnets with CIDR 10.0.1.0/24 and 10.0.2.0/24. The company wants to ensure that traffic to on-premises uses Direct Connect. However, traffic to an S3 bucket uses the internet. What route configuration is required?

Accepted Answer

Add specific routes for S3 public IP prefixes pointing to the internet gateway.. S3 public IP prefixes are not within the on-premises advertised prefix 10.0.0.0/8. Without explicit routes for S3, traffic to S3 would use the default route (if any) or be dropped. By adding specific routes for S3 public IP prefixes pointing to the internet gateway, S3 traffic is forced over the internet while all other traffic (including to on-premises) uses the Direct Connect private VIF via the propagated 10.0.0.0/8 route.

Answer

Change the VPC CIDR to avoid overlap with on-premises.

Answer

Add a static route for 0.0.0.0/0 pointing to the internet gateway.

Answer

Add a static route in the VPC route table for 0.0.0.0/0 pointing to the VGW.

Question 6

A company has multiple VPCs that need to communicate with each other using private IP addresses. The VPCs are in the same AWS account and Region. Which AWS service provides the simplest and most scalable solution?

Accepted Answer

VPC peering connections. VPC peering connections allow direct, private IP connectivity between VPCs using the AWS global network, with no single point of failure or bandwidth bottleneck. It is the simplest solution because it requires no additional hardware or software, and it scales horizontally by adding more peering connections as needed, though it does not support transitive routing.

Answer

AWS Site-to-Site VPN

Answer

ClassicLink

Answer

AWS Transit Gateway

Question 7

A company uses AWS PrivateLink to access a SaaS application hosted in another AWS account. The SaaS provider has created a VPC endpoint service in their account. The consumer has created a VPC endpoint in their VPC. The consumer's VPC has a route table with a local route and a route to a NAT gateway. The VPC endpoint is associated with a security group that allows inbound HTTPS from the consumer's VPC CIDR. The consumer's EC2 instances can resolve the DNS name of the endpoint but cannot connect to the SaaS service. What is the most likely cause?

Accepted Answer

The consumer's route table does not have a route to the VPC endpoint. For PrivateLink, the consumer's VPC endpoint is accessed via private IP addresses from the endpoint's elastic network interfaces (ENIs) in the consumer's VPC. The consumer's VPC route table must have a route to the endpoint's ENI to direct traffic correctly. The stem states that the security group allows inbound HTTPS from the consumer's VPC CIDR, so option C is not the cause. DNS resolution works because the endpoint's DNS name resolves to the private IPs of the ENIs, but without a matching route in the route table, traffic may be dropped or misrouted. Option D is the most likely cause.

Answer

The consumer's route table routes traffic to the endpoint via the NAT gateway

Answer

The VPC endpoint service is not available in the consumer's Availability Zone

Answer

The VPC endpoint security group does not allow inbound HTTPS from the consumer's EC2 instances

Question 8

A company is deploying a fleet of EC2 instances in private subnets. The instances need to download patches from the internet. The company wants to minimize cost and avoid managing NAT instances. The VPC has an internet gateway (IGW) attached. What should the company do?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing inbound connections from the internet. This solution is fully managed by AWS, eliminating the need to manage a NAT instance, and it is cost-effective compared to maintaining a dedicated instance. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID.

Answer

Attach the IGW to the private subnet route table.

Answer

Create a VPC endpoint for internet access.

Answer

Launch a NAT instance and configure routing.

Question 9

A company is setting up a new AWS account and wants to centrally manage VPC network traffic inspection across multiple accounts using a central VPC. The company uses AWS Organizations. Which architecture meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central inspection VPC that has firewall appliances.. AWS Transit Gateway acts as a hub-and-spoke router, enabling centralized network traffic inspection by routing inter-VPC and VPN traffic through a central inspection VPC that hosts firewall appliances (e.g., third-party NGFWs or AWS Network Firewall). This architecture scales across multiple accounts in AWS Organizations using resource sharing via AWS Resource Access Manager, and it supports granular route tables to force traffic through the inspection VPC without requiring peering mesh or single points of failure.

Answer

Create VPC peering connections between each account's VPC and the central VPC.

Answer

Use VPC endpoints to route traffic to the central VPC.

Answer

Deploy a Network Load Balancer in each VPC and route traffic through it.

Question 10

A company has a VPC with a public subnet hosting a web server. They want to make the web server accessible over the internet. The web server has a public IP address. The public subnet route table has a default route (0.0.0.0/0) to an internet gateway. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. However, external users cannot access the web server. What is the most likely cause?

Accepted Answer

The internet gateway is not attached to the VPC. The internet gateway must be attached to the VPC. If it is not attached, traffic cannot flow. Option B (NACL) could be blocking but default NACL allows all traffic. Option C (web server not listening) is possible but less likely than IGW attachment. Option D (route table) is already correct.

Answer

The web server is not listening on port 80

Answer

The route table for the public subnet does not have a route to the internet gateway

Answer

The network ACL for the public subnet is blocking inbound HTTP traffic

Question 11

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add an additional non-overlapping CIDR to the VPC. What is a valid CIDR block they can add?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it is a non-overlapping IPv4 CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must be from the private IP address ranges (RFC 1918) and must not overlap with any existing CIDR blocks in the VPC. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, as they are different /16 subnets within the 10.0.0.0/8 space.

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 12

A company uses AWS Global Accelerator to improve performance for a web application hosted on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The Global Accelerator has an endpoint group in the us-east-1 Region with the ALB as an endpoint. Users in Asia report high latency. The company creates a new endpoint group in ap-southeast-1 and adds the same ALB (which is still in us-east-1). However, users in Asia still experience high latency. What should the network engineer do to reduce latency for Asian users?

Accepted Answer

Add an additional ALB in ap-southeast-1 and add it as an endpoint in the ap-southeast-1 endpoint group. Global Accelerator routes traffic to the nearest endpoint group based on latency. However, if the endpoint (ALB) is only in us-east-1, traffic from Asia will still be forwarded to us-east-1 after reaching the ap-southeast-1 endpoint group because the endpoint itself is in us-east-1. To reduce latency, the company must deploy the application in ap-southeast-1 and add a local ALB as an endpoint in the ap-southeast-1 endpoint group. Option C correctly describes this. Option A is incorrect because the ALB cannot be in us-east-1 and serve as an endpoint for ap-southeast-1; endpoint group and endpoint must be in the same Region. Option B is incorrect because weighted routing does not change the physical location of the endpoint; the ALB is still distant. Option D uses CloudFront, which is a CDN, not a Global Accelerator solution, and does not reduce latency for the Global Accelerator use case.

Answer

Change the endpoint in ap-southeast-1 to use the same ALB but with a cross-Region VPC peering

Answer

Configure Global Accelerator to use weighted routing to direct more traffic to ap-southeast-1

Answer

Use Lambda@Edge to cache content at CloudFront edge locations in Asia

Question 13

A company is migrating an on-premises application to AWS. The application uses multicast for discovery. Which AWS service supports multicast traffic within a VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway supports multicast traffic within a VPC by acting as a multicast router. It allows you to create multicast domains and associate subnets, enabling multicast group communication (using IGMP) for applications like service discovery. This makes it the correct choice for migrating an on-premises application that relies on multicast.

Answer

VPC peering

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 14

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to advertise routes. The company wants to ensure high availability by using two Direct Connect connections from different providers. Both connections terminate at the same Direct Connect location (same AWS device). The company configures two private VIFs, each with a separate BGP session, and attaches both to the same VGW. However, when one connection fails, traffic does not fail over. What is the most likely cause?

Accepted Answer

Both Direct Connect connections are on the same AWS device, creating a single point of failure. If both connections terminate at the same AWS Direct Connect location and same device, they share the same physical infrastructure. A failure at that location would affect both. True high availability requires connections at different locations. Also, BGP configuration may not have proper failover. The most likely cause is that both VIFs are on the same device, so a single point of failure exists. Option B (BGP ASN) is wrong because same ASN is allowed. Option C (allowed prefixes) would cause routes not to be accepted. Option D (MTU) would not cause complete failover failure.

Answer

The same BGP ASN is used for both VIFs, causing route conflict

Answer

The MTU size is mismatched between the VIFs

Answer

The allowed prefixes for the VIFs do not include the on-premises subnets

Question 15

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network is advertising a default route (0.0.0.0/0) over BGP. The VPC has an internet gateway attached. When an EC2 instance in the VPC sends traffic to an internet destination, which path does it take by default?

Accepted Answer

Traffic goes to the on-premises network via Direct Connect.. When an on-premises network advertises a default route (0.0.0.0/0) over BGP via a Direct Connect private VIF, that route is propagated into the VPC route tables as a static route. By default, the most specific route (longest prefix match) is preferred, but since both the internet gateway and the BGP-advertised route are for 0.0.0.0/0, the BGP route takes precedence because it is learned via a more specific path (Direct Connect) and is considered a static route in the VPC route table, overriding the internet gateway's implicit route.

Answer

Traffic goes to the on-premises network only if there is a static route.

Answer

Traffic is dropped because there is no route.

Answer

Traffic goes to the internet via the internet gateway.