ANS-C01 Network Implementation Practice Test 21 — 15 Questions

Question 1

A financial services company is migrating its on-premises data center to AWS. The company has a three-tier application that consists of web servers, application servers, and a database. The application servers must communicate with the database using a private IP address. The database is hosted on an Amazon RDS for MySQL instance in a private subnet. The application servers are in a public subnet. The company has a security requirement that all traffic between the application servers and the database must be encrypted in transit. The network engineer has created a security group for the RDS instance that allows inbound traffic on port 3306 from the security group of the application servers. The engineer has also enabled encryption at rest for the RDS instance. During a security audit, it is discovered that traffic between the application servers and the database is not encrypted. The application team confirms that the application is configured to connect to the database using standard MySQL client library without any SSL/TLS options. The network engineer must ensure that all traffic between the application servers and the database is encrypted without modifying the application code. What should the network engineer do?

Accepted Answer

Deploy a Network Load Balancer (NLB) with a TLS listener in front of the RDS instance. Configure the NLB to terminate TLS from the application servers and forward traffic to the RDS instance using TLS.. Option B is correct because using a Network Load Balancer (NLB) with TLS termination between the application servers and the RDS instance allows offloading the SSL/TLS encryption from the application. The NLB can be configured with a TLS listener that terminates the client's TLS connection and then re-encrypts traffic to the RDS instance using TLS. This requires the RDS instance to have SSL/TLS enabled. Option A is incorrect because the application does not support TLS, so enabling SSL on RDS alone will not encrypt traffic if the client does not request it. Option C is incorrect because a VPN connection between subnets is unnecessarily complex and still requires the application to use TLS. Option D is incorrect because creating a new security group does not enforce encryption at the transport layer.

Answer

Create an AWS Site-to-Site VPN connection between the application servers' subnet and the database subnet to encrypt all traffic.

Answer

Enable the 'require_secure_transport' parameter in the RDS parameter group and set it to ON.

Answer

Modify the security group for the RDS instance to only allow traffic from the application servers' security group on port 3306 with the 'tls' protocol.

Question 2

Which TWO of the following are benefits of using AWS Global Accelerator? (Choose TWO.)

Accepted Answer

Static anycast IP addresses that serve as a fixed entry point. Option A (improved performance via edge locations) and Option C (static anycast IP addresses) are correct. Option B is wrong because it's not a DNS service. Option D is wrong because it does not replace CloudFront. Option E is wrong because it does not provide DDoS protection (AWS Shield does).

Answer

Built-in AWS WAF capabilities

Answer

Content caching similar to CloudFront

Answer

DNS-based load balancing

Question 3

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. They have two redundant 1 Gbps AWS Direct Connect connections. The company wants to use BGP to advertise the same prefix from both locations to AWS. How should they configure the BGP attributes to ensure active/passive failover with automatic failback?

Accepted Answer

Prepend the AS path on the secondary connection's BGP advertisements. Option B is correct because setting a shorter AS path prepend on the primary connection makes it preferred; if that path fails, the prepended path becomes active, and when the primary recovers, the shorter AS path is again preferred, providing automatic failback. Option A is wrong because local preference is applied inbound, not outbound. Option C is wrong because MED is not typically used across different AS. Option D is wrong because communities do not directly influence path selection for failover.

Answer

Set a higher MED value on the primary connection's BGP advertisements

Answer

Set a higher local preference on the secondary connection's BGP advertisements

Answer

Use BGP communities to tag routes and manipulate preference on AWS side

Question 4

A company has a VPC with public and private subnets in two Availability Zones. They have a NAT gateway in each AZ for outbound internet access. They recently added a third AZ and created a new private subnet. Instances in the new private subnet cannot reach the internet. The route table for the new subnet has a default route (0.0.0.0/0) pointing to a NAT gateway in the same AZ. What is the most likely cause?

Accepted Answer

The NAT gateway in the new AZ does not have an Elastic IP address attached. Option A is correct because the NAT gateway must have an Elastic IP (EIP) to provide internet connectivity. Without an EIP, the NAT gateway cannot translate private IPs for internet access. Option B is wrong because NAT gateways are not assigned to subnets; they are placed in public subnets. Option C is wrong because the route table is correctly configured. Option D is wrong because security group rules are for inbound/outbound traffic, but the NAT gateway itself does not have security groups.

Answer

The security group attached to the NAT gateway blocks outbound traffic

Answer

The route table in the new private subnet does not have a route to the NAT gateway

Answer

The NAT gateway is not in a public subnet in the new AZ

Question 5

A network engineer is troubleshooting connectivity between an EC2 instance in a VPC and an on-premises server connected via AWS Site-to-Site VPN. The ping from the EC2 instance to the on-premises server fails. The VPN tunnel status shows 'UP'. Which configuration should the engineer check first?

Accepted Answer

Check the route table associated with the EC2 instance's subnet for a route to the on-premises network. Option C is correct because the VPN is up, so the most likely issue is that the route table for the subnet containing the EC2 instance does not have a route to the on-premises network via the virtual private gateway. Option A is wrong because the tunnel is up. Option B is wrong because the VPN is up, so the pre-shared key is correct. Option D is wrong because the customer gateway device is on-premises, not in AWS.

Answer

Ensure the customer gateway device is configured with the correct public IP address

Answer

Check that the pre-shared key matches on both sides

Answer

Verify that the VPN tunnel is using the correct encryption algorithms

Question 6

A company is deploying a multi-region application and needs to route users to the nearest healthy endpoint. They are using Amazon Route 53 with latency-based routing and health checks. Users in Asia are sometimes routed to the US region even when the Asia endpoint is healthy. What is the most likely cause?

Accepted Answer

The health check for the Asia region endpoint is failing or misconfigured. Option B is correct because latency-based routing uses the latency between the user and the endpoint; if the health check is misconfigured, the Asia endpoint might be considered unhealthy, causing Route 53 to route to the next best region. Option A is wrong because geolocation routing is different from latency-based. Option C is wrong because TTL affects caching but not routing decisions. Option D is wrong because DNS resolution does not change routing behavior.

Answer

The Asia region endpoint's Route 53 geolocation routing policy is misconfigured

Answer

The TTL value for the DNS records is set too high

Answer

The DNS resolver used by users in Asia does not support latency-based routing

Question 7

A company has an AWS Transit Gateway with multiple VPC attachments. They want to centralize outbound internet traffic through a single VPC that has a NAT gateway and an internet gateway. All other VPCs should route internet-bound traffic through this central VPC. What configuration is required?

Accepted Answer

Attach a virtual private gateway to the central VPC and add a static route in the transit gateway route table pointing 0.0.0.0/0 to the virtual private gateway. Option D is correct because you need to attach a virtual private gateway to the central VPC and add a static route in the transit gateway route table pointing 0.0.0.0/0 to that VGW, then the other VPCs need a default route in their route tables pointing to the transit gateway attachment. Option A is wrong because TGW attachments do not have route tables; route tables are associated with TGW. Option B is wrong because that would send traffic directly to the internet gateway, not through the central VPC. Option C is wrong because that would route traffic to the NAT gateway directly in the central VPC, but the transit gateway cannot route to a NAT gateway directly; it needs a VGW or a prefix list.

Answer

Add a default route in the central VPC's subnet route tables pointing to the internet gateway

Answer

Create a route table in the central VPC and associate it with the transit gateway attachment

Answer

Add a route in the transit gateway route table pointing 0.0.0.0/0 to the NAT gateway in the central VPC

Question 8

A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?

Accepted Answer

The ID of the ALB's security group. Option B is correct because the ALB's security group ID can be used as the source in the instance security group, allowing traffic only from the ALB. Option A is wrong because the ALB's public IPs can change; using security group IDs is more reliable. Option C is wrong because the VPC CIDR is too broad. Option D is wrong because the subnet CIDR of the ALB is also too broad and not as secure.

Answer

The ALB's public IP address

Answer

The subnet CIDR block of the ALB's subnets

Answer

The VPC CIDR block

Question 9

A company has a Direct Connect connection with a private VIF to a VPC. They want to use BGP to advertise a specific /24 prefix from their on-premises network to AWS. After configuration, the prefix is not visible in the VPC route tables. The BGP session is established. What should the company check?

Accepted Answer

Verify that the prefix is included in the allowed prefixes list for the Direct Connect virtual interface. Option A is correct because the prefix must be allowed by the allowed prefixes list on the virtual private gateway; otherwise, it will not be propagated. Option B is wrong because the BGP session is established, so ASN is not an issue. Option C is wrong because route propagation is for VPN, not Direct Connect. Option D is wrong because the VPC route table can have custom routes, but the virtual private gateway will not accept prefixes not in the allowed list.

Answer

Ensure that route propagation is enabled on the VPC route table

Answer

Check that the BGP ASN on the customer gateway is unique and not conflicting

Answer

Add a static route in the VPC route table for the on-premises prefix

Question 10

A company is deploying a global application behind an Application Load Balancer (ALB) in AWS. They want to use AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. Which configuration is required to achieve this?

Accepted Answer

Create an accelerator with an endpoint group that includes the ALB as an endpoint. Option C is correct because Global Accelerator uses endpoint groups with health checks and routes traffic to the nearest healthy endpoint. Option A is wrong because Global Accelerator does not use Route 53 health checks; it has its own health checks. Option B is wrong because Global Accelerator does not use DNS-based routing like Route 53 latency records. Option D is wrong because Global Accelerator does not use CloudFront; it is a separate service.

Answer

Configure Route 53 health checks for the ALB and associate them with Global Accelerator

Answer

Configure a CloudFront distribution with the ALB as an origin and enable Global Accelerator

Answer

Create a Route 53 latency-based routing record set pointing to the ALB

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?

Accepted Answer

NAT gateway. Option A is correct because a NAT gateway allows outbound internet traffic from private subnets and blocks unsolicited inbound traffic. Option B is wrong because an internet gateway is for public subnets and allows inbound traffic. Option C is wrong because a VPC endpoint is for accessing AWS services privately, not the internet. Option D is wrong because a VPN connection is for hybrid connectivity, not internet access.

Answer

Site-to-Site VPN connection

Answer

VPC endpoint

Answer

Internet gateway

Question 12

A company has a VPC with multiple subnets. They want to use VPC Flow Logs to capture network traffic metadata for troubleshooting. Which TWO of the following are valid destinations for VPC Flow Logs? (Select TWO.)

Accepted Answer

Amazon CloudWatch Logs log group. Option A and Option D are correct. VPC Flow Logs can be published to Amazon S3 or Amazon CloudWatch Logs. Option B is wrong because Kinesis Data Firehose is not a direct destination; you can use CloudWatch Logs subscription filter to send to Firehose. Option C is wrong because SQS is not a supported destination. Option E is wrong because Lambda is not a direct destination; you can use CloudWatch Logs subscription filter to invoke Lambda.

Answer

Amazon Kinesis Data Firehose delivery stream

Answer

AWS Lambda function

Answer

Amazon Simple Queue Service (SQS) queue

Question 13

A company is designing a multi-account AWS environment using AWS Transit Gateway. They want to centralize network management and ensure that VPCs in different accounts can communicate. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Create a Transit Gateway in the central networking account. Options A, B, and D are correct. You need to share the Transit Gateway using Resource Access Manager (RAM), create a transit gateway route table, and associate the VPC attachments with the route table. Option C is wrong because VPC peering is not needed when using Transit Gateway. Option E is wrong because you do not need to create a separate Transit Gateway in each account; you share a central one.

Answer

Create a separate Transit Gateway in each account and peer them together

Answer

Create a VPC peering connection between each VPC and the Transit Gateway

Question 14

A company is setting up a new VPC and needs to ensure that instances in the VPC can resolve DNS names within AWS (e.g., ec2-203-0-113-25.compute-1.amazonaws.com). Which TWO configurations are required? (Select TWO.)

Accepted Answer

Set the VPC's 'enableDnsSupport' attribute to true. Options A and B are correct. To enable DNS resolution for private hosted zones and instance hostnames, both 'enableDnsHostnames' and 'enableDnsSupport' must be set to true. Option C is wrong because a public hosted zone is not required for private DNS resolution. Option D is wrong because the Amazon Route 53 Resolver is not needed; the VPC provides DNS resolution. Option E is wrong because a DHCP option set with domain-name-servers is not required; the default VPC DNS is provided.

Answer

Configure the Amazon Route 53 Resolver to forward queries to the VPC DNS

Answer

Create a public hosted zone in Amazon Route 53 and associate it with the VPC

Answer

Create a custom DHCP option set with the domain-name-servers option set to the VPC DNS IP

Question 15

A company is deploying a multi-VPC architecture with connectivity requirements. The network team needs to establish private connectivity between VPCs in the same AWS account and region, using services that can scale to 100 Gbps throughput. Which solution meets these requirements?

Accepted Answer

Create an AWS Transit Gateway and attach all VPCs to it. Option C is correct because Transit Gateway supports up to 100 Gbps per attachment and provides centralized connectivity between multiple VPCs. Option A is wrong because VPC peering does not scale to 100 Gbps and is a point-to-point connection. Option B is wrong because AWS PrivateLink is for accessing services across VPCs, not for general VPC-to-VPC connectivity. Option D is wrong because Client VPN is for remote access, not VPC-to-VPC.

Answer

Use AWS PrivateLink with Network Load Balancers to connect VPCs

Answer

Deploy AWS Client VPN and configure routes between VPCs

Answer

Configure VPC peering connections between each pair of VPCs