ANS-C01 Network Implementation Practice Test 21 — 15 Questions

Question 1

A company has deployed a Network Load Balancer (NLB) in front of a fleet of EC2 instances. The NLB is configured with a TLS listener that uses a certificate from AWS Certificate Manager (ACM). Clients are reporting intermittent TLS handshake failures. The NLB's target group is configured with the TCP protocol on port 443. What is the most likely cause of the handshake failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The targets are failing health checks, causing the NLB to route traffic to unhealthy targets.. Intermittent TLS handshake failures with an NLB often stem from unhealthy targets. The NLB performs health checks on targets; if targets fail, they are removed, but during the interval, clients may experience failures. Ensuring targets pass health checks resolves the issue.

Answer

The target group is configured with the TCP protocol, but it should be TLS.

Answer

The NLB does not support TLS termination with ACM certificates.

Answer

The NLB's security group does not allow inbound traffic on port 443.

Question 2

A company is designing a VPC that must support a large number of concurrent connections to a third-party SaaS API over IPv4. The network team wants to use a NAT gateway and needs to understand which characteristics apply. (Choose two.)

Accepted Answer

A NAT gateway supports the allocation of up to one Elastic IP address, and the NAT gateway uses that address for outbound traffic.. A NAT gateway is zonal, created in one subnet and resilient within that Availability Zone, and it uses an Elastic IP address for source NAT on outbound traffic. It does not support security groups, cannot serve as a VPN target, and does not preserve the original instance source IP, so those characteristics are incorrect for this design.

Answer

A NAT gateway can be used as a target for an AWS Site-to-Site VPN connection to provide on-premises hosts with access to the internet.

Answer

A NAT gateway can be associated with a security group to restrict which private instances are allowed to use it for egress.

Answer

A NAT gateway preserves the original source IP address of the originating instance so that external services can identify the specific instance.

Question 3

A company is implementing a hub-and-spoke network topology using AWS Transit Gateway. They have multiple VPCs attached to the Transit Gateway and want to ensure that traffic between VPCs is inspected by a centralized security appliance in a dedicated inspection VPC. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Create a Transit Gateway route table for the inspection VPC and associate it with the inspection VPC attachment.. To route inter-VPC traffic through a centralized inspection VPC, you need a separate Transit Gateway route table associated with the inspection VPC attachment, and the spoke VPC attachments must be associated with a route table that has a default route pointing to the inspection VPC attachment. These two configurations ensure traffic is directed to the inspection VPC for security checks.

Answer

Enable appliance mode on the inspection VPC attachment.

Answer

Configure the spoke VPC route tables to point to the inspection VPC attachment as the next hop for inter-VPC traffic.

Answer

Disable route propagation on all Transit Gateway route tables.

Question 4

A network engineer manages a VPC where a Network Load Balancer (NLB) fronts a fleet of EC2 instances in two Availability Zones. The NLB's target group uses IP targets. Client source IP addresses must be preserved for the application's logging, and the application must receive the client's original IP. The engineer notices that instances see the NLB node IP instead of the client IP. Which configuration change resolves this?

Accepted Answer

Enable client IP preservation on the target group and verify the targets are EC2 instances in the same VPC as the NLB.. NLB client IP preservation is controlled by a target group attribute and works when targets are instances or IP addresses in supported configurations, such as targets in the same VPC as the NLB. Enabling the attribute and confirming the target placement ensures the application receives the original client source address, satisfying the logging requirement without application changes.

Answer

Move the EC2 instances into the same subnet as the NLB nodes and disable cross-zone load balancing.

Answer

Enable proxy protocol v2 on the target group and configure the application to parse the PROXY header.

Answer

Change the NLB scheme from internal to internet-facing so the client IP is passed through unchanged.

Question 5

A company is using AWS Transit Gateway to connect 40 VPCs and two on-premises data centers over Direct Connect. The network team wants to prevent any VPC from reaching the on-premises networks while still allowing all VPCs to communicate with each other. Which configuration should the team implement?

Accepted Answer

Use a transit gateway route table for the VPC attachments that contains only VPC routes, and place the Direct Connect attachments in a separate route table that has no route back to the VPC route table.. Transit gateway route tables control reachability by determining which attachments can propagate and receive routes. Placing VPC attachments in a route table that contains only VPC CIDRs lets every VPC reach every other VPC, while isolating the Direct Connect attachments in a separate route table with no route into the VPC route table prevents any VPC from reaching on-premises networks.

Answer

Enable appliance mode on the transit gateway and attach a network firewall in a shared services VPC to inspect all traffic between the VPCs and the on-premises networks.

Answer

Apply a transit gateway prefix list to the Direct Connect attachments and reference it in the VPC route tables with a blackhole target for the on-premises CIDRs.

Answer

Create a separate transit gateway route table for the on-premises attachments and disassociate the VPC attachments from it, then remove the on-premises routes from the VPC route tables.

Question 6

A company has an AWS Site-to-Site VPN connection between its on-premises data center and a VPC. The VPN uses a virtual private gateway, and BGP is configured with two tunnels. The on-premises router advertises a default route to the VPC, and the VPC route table points to the virtual private gateway. Users report that some internet-bound traffic from the VPC is being sent to the on-premises data center instead of through the NAT gateway. Which change should the network engineer make to correct the routing?

Accepted Answer

Remove the default route from the VPC route table and add a more specific route for the on-premises CIDR pointing to the virtual private gateway.. The on-premises router is advertising a default route over BGP, which the virtual private gateway propagates into the VPC route table and which then captures internet-bound traffic. Removing that default route and using a specific route for the on-premises CIDR to the virtual private gateway confines VPN traffic to on-premises destinations and restores the intended internet path.

Answer

Add a static route in the VPC route table for 0.0.0.0/0 pointing to the internet gateway and rely on route priority to override the propagated route.

Answer

Change the virtual private gateway to a transit gateway and attach the VPN to the transit gateway so that the default route is no longer advertised.

Answer

Enable route propagation for the virtual private gateway on the subnet route table so that BGP-learned routes are preferred over static routes.

Question 7

A company has an AWS Site-to-Site VPN connection to a virtual private gateway (VGW) with two tunnels. The on-premises router uses BGP and advertises a default route to the VGW. The network engineer wants the VPC to prefer one tunnel for all traffic but automatically fail over to the second tunnel if the first becomes unavailable. Which configuration achieves this with the least operational effort?

Accepted Answer

Set a lower tunnel inside IP address metric on the primary tunnel and a higher metric on the standby tunnel in the VPN connection settings.. AWS Site-to-Site VPN tunnels each have a tunnel inside IP address metric that determines preference when both tunnels are up. Assigning a lower metric to the primary tunnel makes it the preferred egress path, and AWS automatically fails over to the higher-metric tunnel if the primary becomes unavailable. This uses native VPN settings and requires no on-premises routing changes.

Answer

Use a Direct Connect connection as the primary path and the VPN as a backup, and rely on BGP to fail over.

Answer

Configure BGP AS path prepending on the on-premises router for the standby tunnel so the primary tunnel is preferred.

Answer

Enable route propagation on the VGW route table and remove the static route for the standby tunnel.

Question 8

A network engineer is designing a VPC that will host a latency-sensitive application requiring high packet-per-second throughput. The application uses UDP and needs a load balancer that preserves the source IP and can handle millions of requests per second. The engineer must select the appropriate load balancer and configure it for this workload. (Choose two.)

Accepted Answer

Enable client IP preservation on the NLB target group so the application can see the original client source address.. The workload requires a layer 4 load balancer that supports UDP and high throughput, which the Network Load Balancer provides, and it requires source IP preservation, which is enabled as a target group attribute. Together these two choices satisfy the protocol, performance, and logging requirements for the latency-sensitive application.

Answer

Configure the NLB with a TCP listener and rely on the application to convert UDP packets to TCP.

Answer

Use an Application Load Balancer (ALB) with a UDP listener and enable source IP preservation.

Answer

Attach the NLB to a Gateway Load Balancer endpoint to gain UDP support and source IP preservation.

Question 9

A company is deploying a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in private subnets can access the internet for software updates while remaining unreachable from the internet. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route to the NAT Gateway in the private subnet route tables.. A NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP, allowing internet access while preventing any unsolicited inbound connections from the internet.

Answer

Attach an internet gateway to the private subnets and configure route tables.

Answer

Use a transit gateway to connect the VPC to the internet.

Answer

Establish a VPN connection to an on-premises network and route traffic through it.

Question 10

A company has a VPC with a CIDR of 10.0.0.0/16 and has enabled VPC Flow Logs to capture all traffic. The logs show that an EC2 instance (10.0.1.10) is sending outbound traffic to an external IP (203.0.113.50) on port 443, but the traffic is being rejected. The instance's security group allows outbound HTTPS to 0.0.0.0/0, and the subnet's NACL allows outbound traffic on port 443. The VPC has an internet gateway attached, and the route table directs 0.0.0.0/0 to the internet gateway. What is the most likely cause of the rejection?

Accepted Answer

The NACL inbound rules are blocking the return traffic.. The outbound traffic from the EC2 instance is allowed by the security group and NACL outbound rules, but the return traffic (responses from 203.0.113.50:443 back to 10.0.1.10) must also be permitted by the subnet's NACL inbound rules. Since the NACL is stateless, it requires explicit inbound rules for ephemeral ports (typically 1024-65535) to allow the return traffic. If those inbound rules are missing, the return packets are dropped, causing the outbound traffic to appear as rejected in VPC Flow Logs.

Answer

The security group does not allow inbound HTTPS traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The route table does not have a route to the internet gateway.

Question 11

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

Accepted Answer

The application layer is failing to establish a proper connection.. The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Answer

The security groups are blocking the traffic.

Answer

The route tables are incorrectly configured, causing packet loss.

Answer

The flow logs are misconfigured and not capturing all traffic.

Question 12

A company has set up a transit gateway with attachments to VPC-A and VPC-B. The transit gateway route table shows routes to both VPCs and a blackhole for 0.0.0.0/0. VPC-A's public subnet route table sends 10.1.0.0/16 traffic to the transit gateway. However, an EC2 instance in VPC-A's public subnet cannot reach an instance in VPC-B. What is the most likely cause?

Accepted Answer

VPC-B's route table does not have a route to VPC-A's CIDR via the transit gateway.. For traffic to flow from VPC-A to VPC-B via a transit gateway, both VPCs must have routes in their route tables pointing to the transit gateway for the other VPC's CIDR. Since VPC-A's route table sends 10.1.0.0/16 (VPC-B's CIDR) to the transit gateway, but VPC-B's route table lacks a return route to VPC-A's CIDR via the transit gateway, the return traffic from VPC-B is dropped, causing connectivity failure.

Answer

VPC-A's route table does not have a route to the transit gateway.

Answer

The transit gateway route table does not have a route for 10.0.0.0/16.

Answer

The blackhole route in the transit gateway is blocking traffic between VPCs.

Question 13

A company is deploying a new VPC with both public and private subnets. The public subnet hosts an internet-facing Application Load Balancer (ALB), and the private subnet hosts EC2 instances running a web application. The EC2 instances need to download updates from the internet, but they must not be directly accessible from the internet. Which combination of steps should a network engineer implement to meet these requirements?

Accepted Answer

Create a NAT Gateway in a public subnet, and add a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing any unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table directs all outbound internet traffic through the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP. This meets the requirement of internet access for downloads without direct internet accessibility.

Answer

Launch a proxy server in the public subnet and configure the private instances to use it for outbound traffic.

Answer

Set up a VPN connection to an on-premises network and route all internet traffic through the VPN.

Answer

Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet's route table.

Question 14

A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?

Accepted Answer

Use TLS or IPsec at the application layer between instances.. VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.

Answer

Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.

Answer

Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.

Answer

Enable encryption on the VPC peering connection.

Question 15

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

Accepted Answer

The security group for the EC2 instance does not allow inbound HTTPS traffic.. Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed. Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.

Answer

The network ACL in the VPC is blocking outbound traffic.

Answer

The BGP session is in the 'Idle' state.

Answer

The route table associated with the virtual private gateway does not have a route to the on-premises network.