ANS-C01 Network Implementation Practice Test 22 — 15 Questions

Question 1

A company has a large AWS environment with hundreds of VPCs connected via a Transit Gateway. The network team is implementing a new hub-and-spoke architecture where all traffic between VPCs must be inspected by a centralized firewall appliance in a shared services VPC. The firewall appliance is a third-party virtual appliance that supports VRF-like segmentation. The network engineer has configured the Transit Gateway with separate route tables for each VPC, and the shared services VPC is associated with all route tables. The firewall appliance is deployed in the shared services VPC with two ENIs: one in a 'trust' subnet and one in an 'untrust' subnet. The trust subnet is used for traffic coming from spoke VPCs, and the untrust subnet is used for traffic going to other spoke VPCs. The firewall appliance performs stateful inspection and returns traffic to the Transit Gateway via the correct ENI. However, after implementation, traffic between two spoke VPCs (VPC A and VPC B) is being dropped. The engineer verifies that the Transit Gateway route tables have static routes for each spoke VPC CIDR pointing to the shared services VPC attachment. The spoke VPCs have routes to each other's CIDR via the Transit Gateway. The firewall logs show that traffic from VPC A reaches the trust ENI, but the firewall is unable to send traffic to VPC B because it does not have a route to VPC B's CIDR. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route table for the untrust subnet does not have a route to VPC B's CIDR pointing to the Transit Gateway.. The firewall's untrust subnet route table must have a route pointing to the Transit Gateway for VPC B's CIDR. The firewall receives traffic from VPC A on its trust ENI, processes it, and then sends it out the untrust ENI. Without a route in the untrust subnet's route table directing traffic for VPC B's CIDR to the Transit Gateway, the firewall cannot forward the traffic back to the Transit Gateway for delivery to VPC B, causing the drop.

Answer

The shared services VPC attachment is not propagating routes to the Transit Gateway route tables.

Answer

The security group for the firewall's untrust ENI is blocking outbound traffic.

Answer

The Transit Gateway route table for VPC A does not have a route for VPC B's CIDR.

Question 2

Order the steps to set up a Network Load Balancer with a TCP listener in front of an Auto Scaling group:

Accepted Answer

Create target group → Create load balancer → Register targets → Associate target group with listener → Configure health checks. First create the target group, then the load balancer, register targets, associate the target group with the listener, and configure health checks.

Answer

Create load balancer → Create target group → Register targets → Associate target group with listener → Configure health checks

Answer

Create target group → Create load balancer → Configure health checks → Register targets → Associate target group with listener

Answer

Create target group → Register targets → Create load balancer → Associate target group with listener → Configure health checks

Question 3

Order the steps to set up a redundant Direct Connect connection with two virtual interfaces in different AWS regions:

Accepted Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then configure BGP, then tune routing, then test failover.. First provision the connections, then create VIFs, configure BGP, tune routing, then test failover.

Answer

Create virtual interfaces (VIFs), then provision Direct Connect connections, then configure BGP, then tune routing, then test failover.

Answer

Provision Direct Connect connections, then configure BGP, then create virtual interfaces (VIFs), then tune routing, then test failover.

Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then test failover, then configure BGP, then tune routing.

Question 4

Match each AWS security feature to its description.

Accepted Answer

Security Groups: Acts as a virtual firewall for an EC2 instance at the instance level, controlling inbound and outbound traffic.. These are core security services for network protection. Security Groups are instance-level, NACLs are subnet-level, WAF protects web apps, and Shield provides DDoS protection.

Answer

Security Groups: Acts as a firewall at the subnet level.

Answer

Network ACLs: Acts as a virtual firewall for an EC2 instance.

Question 5

Match each AWS networking monitoring or troubleshooting tool to its primary purpose.

Accepted Answer

VPC Flow Logs: Captures information about IP traffic to and from network interfaces.. The correct matches are: VPC Flow Logs ↔ IP traffic capture, AWS CloudWatch Logs ↔ centralized log monitoring, AWS CloudTrail ↔ API activity recording. Common confusions include swapping VPC Flow Logs with CloudTrail, or CloudWatch Logs with VPC Reachability Analyzer.

Answer

VPC Flow Logs: Records API calls made in the AWS environment.

Answer

AWS CloudWatch Logs: Analyzes network paths between resources.

Question 6

A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.. The most likely cause is that the VPC route tables lack a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Even though the VPN tunnel is UP (indicating Phase 1 and Phase 2 IPsec SAs are established), traffic from on-premises cannot reach EC2 instances if the VPC does not know how to forward return traffic back through the VGW. Without this route, the VPC drops inbound packets or sends them to the internet gateway instead of the VPN tunnel.

Answer

The pre-shared keys are mismatched.

Answer

The VPN tunnel has been idle for too long and needs to be re-initiated.

Answer

The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.

Question 7

A company runs a critical application on EC2 instances behind an Application Load Balancer. They need to ensure that if an instance fails health checks, it is automatically terminated and replaced. Which AWS service should they use?

Accepted Answer

Auto Scaling group. An Auto Scaling group (Option C) is the correct service because it automatically replaces unhealthy EC2 instances by integrating with the Application Load Balancer's health checks. When an instance fails the configured health check (e.g., HTTP 5xx or TCP timeout), the Auto Scaling group marks it as unhealthy, terminates it, and launches a new instance to maintain the desired capacity. This lifecycle management is a core feature of Auto Scaling groups, not available in the other options.

Answer

AWS Lambda

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch

Question 8

A company is designing a VPC with public and private subnets. They want EC2 instances in private subnets to be able to access the internet for software updates. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway enables EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT), allowing them to reach public endpoints.

Answer

AWS Direct Connect

Answer

Internet Gateway (IGW)

Answer

VPC Peering connection

Question 9

A company has multiple VPCs that need to communicate with each other. They want to use a hub-and-spoke model with centralized network management. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (D) is the correct choice because it acts as a central hub that interconnects multiple VPCs and on-premises networks using a hub-and-spoke topology. It simplifies network management by providing a single point of connectivity and supports transitive routing between all attached VPCs, which is exactly what the company needs for centralized network management.

Answer

AWS Direct Connect

Answer

VPN CloudHub

Answer

VPC Peering

Question 10

A company is deploying a latency-sensitive application across multiple AWS Regions. They want to use the AWS global network to route traffic to the nearest edge location for fast content delivery. Which service should they use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to direct traffic to the nearest edge location via Anycast IP addresses, then routes it over the AWS backbone to the optimal regional endpoint. This minimizes latency and jitter for latency-sensitive applications by avoiding the public internet and providing static IP addresses for traffic management.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Question 11

A company needs to connect its on-premises data center to AWS with a dedicated, private network connection that provides consistent performance. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent, low-latency performance and can reduce bandwidth costs for high-volume data transfer, making it the ideal choice for the stated requirement.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Site-to-Site VPN

Question 12

A company is running a two-tier application with a web tier and a database tier. The web tier must be accessible from the internet, but the database tier should only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web tier in public subnet, database tier in private subnet with a security group allowing only web tier.. The correct architecture places the web tier in a public subnet with an internet gateway for inbound traffic, and the database tier in a private subnet with a security group that only allows inbound traffic from the web tier's security group. This ensures the database is not directly reachable from the internet, adhering to the principle of least privilege and defense in depth. The security group acts as a stateful virtual firewall, allowing you to reference the web tier's security group as the source, which automatically adapts to any changes in the web tier's IP addresses.

Answer

Both tiers in public subnets with security groups restricting database access.

Answer

Both tiers in private subnets with a NAT Gateway for internet access.

Answer

Web tier in private subnet, database tier in public subnet with a security group.

Question 13

Which TWO of the following are valid options for implementing network segmentation in a VPC?

Accepted Answer

Security Groups. Security Groups (A) are correct because they act as stateful virtual firewalls at the instance/ENI level, allowing you to control inbound and outbound traffic by protocol, port, and source/destination, which is a core mechanism for enforcing segmentation within a VPC. Subnets (B) are correct because they divide a VPC's CIDR block into distinct IP ranges (e.g., public vs. private subnets) that isolate resources at the network layer and are the foundational building block for VPC segmentation. Route Tables (C) are not a segmentation mechanism themselves; they only direct traffic between subnets, gateways, and peering connections, so they don't enforce isolation. NAT Gateway (D) merely provides outbound internet access for private subnets and does not segment traffic. Internet Gateway (E) only enables inbound/outbound connectivity to the internet for public subnets and likewise does not create segmentation.

Answer

Route Tables

Answer

NAT Gateway

Answer

Internet Gateway

Question 14

Which TWO of the following are characteristics of an AWS Network Load Balancer (NLB)?

Accepted Answer

Preserves the source IP address of the client. Network Load Balancers operate at Layer 4 and preserve the client source IP address by default. When a client sends a request, the NLB forwards the packet with the original source IP intact, unlike Application Load Balancers which replace it with their own IP. This is critical for applications that require client IP logging or security filtering.

Answer

Supports SSL offloading

Answer

Supports routing based on HTTP headers

Answer

Operates at Layer 7 of the OSI model

Question 15

A company is deploying a new application in a VPC with public and private subnets. The application servers in the private subnets need to access the internet to download patches. Which configuration meets this requirement without allowing inbound internet traffic?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway from the private subnets' route tables.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet (e.g., for patch downloads) while preventing unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface. This is the standard AWS pattern for outbound-only internet access from private subnets.

Answer

Attach an internet gateway to the private subnets and configure route tables accordingly.

Answer

Establish a site-to-site VPN connection to an on-premises internet gateway.

Answer

Configure a VPC endpoint for the internet in the private subnets.