ANS-C01 Network Implementation Practice Test 22 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team reports intermittent connectivity loss to resources in the VPC, but the Direct Connect tunnel status shows as UP. Which configuration is MOST likely causing the issue?

Accepted Answer

Traffic is being routed asymmetrically through the Direct Connect and a VPN backup. Option B is correct because asymmetric routing can cause connectivity drops if traffic returns via a different path and is dropped by security groups or ACLs. Option A is incorrect because BGP keepalives would not affect specific traffic. Option C is incorrect because jumbo frames may cause fragmentation but not intermittent loss. Option D is incorrect because a separate VIF is not required for each VPC.

Answer

The BGP keepalive interval is set to 60 seconds

Answer

Jumbo frames are enabled on the Direct Connect interface but not on on-premises routers

Answer

A separate private VIF is required for each VPC in the account

Question 2

A company is implementing a hybrid network using AWS Site-to-Site VPN. The on-premises firewall requires that the VPN tunnels use IKEv2 with pre-shared keys and that the tunnels are always active. Which VPN configuration should be used?

Accepted Answer

Two VPN tunnels in active/active mode with BGP. Option C is correct because two tunnels in active/active mode provide high availability and always-on connectivity. Option A is wrong because one tunnel is not redundant. Option B is wrong because active/passive means one tunnel is standby. Option D is wrong because dynamic routing with BGP is typically used, not static routes.

Answer

Two VPN tunnels in active/passive mode

Answer

Two VPN tunnels with static routing

Answer

One VPN tunnel with static routing

Question 3

A company is designing a network for a multi-tier application that includes a web tier, application tier, and database tier. The web tier must be accessible from the internet, while the application and database tiers should have no direct internet access. All tiers are in the same VPC. Which configuration meets these requirements?

Accepted Answer

Place web tier in public subnets with Internet Gateway, app and DB tiers in private subnets with a NAT Gateway for outbound traffic. Option A is correct because public subnets for web tier and private subnets for app and DB tiers with NAT Gateway for outbound access is a standard design. Option B is wrong because placing all tiers in public subnets exposes app and DB to internet. Option C is wrong because using Internet Gateway on private subnets defeats the purpose. Option D is wrong because Network ACLs alone do not prevent internet access if routes exist.

Answer

Place all tiers in public subnets and use security group rules to restrict access to app and DB tiers

Answer

Place web tier in a public subnet and app and DB tiers in the same public subnet but with restrictive Network ACLs

Answer

Place all tiers in private subnets and attach an Internet Gateway to the private subnets for the web tier

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC has a public subnet 10.0.1.0/24 and a private subnet 10.0.2.0/24. An EC2 instance in the private subnet needs to download patches from the internet. Which configuration is required to provide outbound internet access to the private instance while preventing inbound internet traffic?

Accepted Answer

Deploy a NAT Gateway in the public subnet and add a default route in the private subnet route table pointing to the NAT Gateway. Option C is correct because a NAT Gateway in the public subnet with a route in the private subnet route table pointing to the NAT Gateway provides outbound internet access. Option A is wrong because an Internet Gateway attached to the private subnet would allow inbound traffic. Option B is wrong because an EIP on the private instance directly exposes it. Option D is wrong because an Internet Gateway alone does not provide outbound access without a route to it.

Answer

Attach an Internet Gateway to the private subnet and add a default route to the Internet Gateway in the private route table

Answer

Assign an Elastic IP to the private instance and update the security group to allow outbound traffic

Answer

Add an Internet Gateway to the VPC and create a route in the private subnet to 0.0.0.0/0 via the Internet Gateway

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect and Site-to-Site VPN. The network team wants to ensure that traffic between VPCs does not traverse the on-premises network. Which Transit Gateway feature should be used?

Accepted Answer

Transit Gateway route tables with separate associations and propagations. Option B is correct because Transit Gateway route tables allow isolation of traffic between different attachments (e.g., VPCs vs. VPN). Option A is wrong because multicast is not relevant. Option C is wrong because flow logs monitor traffic, not control routing. Option D is wrong because BGP is used for dynamic routing, not for isolation.

Answer

Transit Gateway Multicast

Answer

Transit Gateway Network Manager

Answer

Transit Gateway BGP over AWS Direct Connect

Question 6

A company has a Direct Connect connection with a private VIF to a Direct Connect gateway. The VIF is associated with a Direct Connect gateway that has a virtual private gateway (VGW) attachment to a VPC. The on-premises network is advertising a route to 10.0.0.0/16. However, the VPC cannot reach on-premises resources. The VPC has a route table with a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The VPC route table does not have route propagation enabled for the virtual private gateway. Option D is correct because the VGW needs to propagate routes from the Direct Connect gateway to the VPC route table. Without propagation, the VPC does not know the on-premises routes. Option A is incorrect because BGP is typically used with Direct Connect. Option B is incorrect because the Direct Connect gateway can handle multiple prefixes. Option C is incorrect because security groups do not affect inbound routing decisions.

Answer

The on-premises router is not using BGP to advertise routes

Answer

The security group on the VPC instances is blocking inbound traffic

Answer

The Direct Connect gateway does not support the prefix 10.0.0.0/16

Question 7

A company wants to securely connect two VPCs in different AWS regions using AWS infrastructure. Which service should be used?

Accepted Answer

VPC peering. Option C is correct because VPC peering supports inter-region peering. Option A is wrong because Direct Connect is for on-premises connectivity, not inter-region. Option B is wrong because Transit Gateway currently does not support inter-region peering natively (requires VPC peering). Option D is wrong because Internet Gateway is for internet access.

Answer

AWS Direct Connect

Answer

Internet Gateway

Answer

AWS Transit Gateway

Question 8

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS VPN CloudHub. The on-premises network uses multiple customer gateways (CGWs) connected to a single virtual private gateway (VGW). The company wants to ensure that all traffic from the VPC to on-premises is routed through a specific CGW. Which configuration should be used?

Accepted Answer

Configure a static route in the VPC route table pointing to the VGW with a more specific prefix for the on-premises network. Option A is correct because using a more specific prefix in the static route forces traffic through that CGW. Option B is wrong because BGP metrics influence path selection but are not deterministic. Option C is wrong because VPN tunnel options affect encryption, not routing. Option D is wrong because multiple CGWs per VGW is possible with CloudHub.

Answer

Adjust the BGP local preference on the preferred CGW to a higher value

Answer

Remove the other CGWs from the VGW

Answer

Modify the VPN tunnel option to prefer the specific tunnel

Question 9

Which TWO scenarios are best suited for using AWS Transit Gateway over VPC peering? (Select TWO.)

Accepted Answer

Connecting hundreds of VPCs across multiple accounts. Options B and D are correct. Transit Gateway is ideal for many VPCs and for connecting VPCs with Direct Connect. Option A is wrong because one-to-one is simpler with peering. Option C is wrong because VPC peering can also be used for cross-account. Option E is wrong because a single VPC does not need Transit Gateway.

Answer

Connecting VPCs in different AWS accounts

Answer

Connecting a single VPC to an on-premises network

Answer

Connecting two VPCs in the same account and region

Question 10

Which THREE actions are required to enable an EC2 instance in a private subnet to download software updates from the internet? (Select THREE.)

Accepted Answer

Allocate an Elastic IP and associate it with the NAT Gateway. Options B, C, and D are correct. A NAT Gateway in a public subnet, a route to it, and an EIP for the NAT Gateway. Option A is wrong because an Internet Gateway alone does not provide outbound access for private subnets. Option E is wrong because security groups allow outbound by default.

Answer

Configure the security group to allow outbound traffic to 0.0.0.0/0

Answer

Attach an Internet Gateway to the VPC

Question 11

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Accepted Answer

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection. Options A and C are correct. Direct Connect provides consistent network performance and supports multiple virtual interfaces. Option B is wrong because it is not encrypted by default. Option D is wrong because it is not a VPN. Option E is wrong because it requires a dedicated connection.

Answer

Direct Connect traffic is encrypted by default

Answer

Direct Connect is a managed VPN service

Answer

Direct Connect can be provisioned in minutes without any physical infrastructure

Question 12

Refer to the exhibit. An EC2 instance in a VPC is assigned a public IP via an Elastic IP address. The instance is not reachable from the internet, although it has a security group allowing inbound HTTP traffic from 0.0.0.0/0. The VPC has an Internet Gateway attached to the route table of the subnet. What is the MOST likely cause?

Accepted Answer

The subnet route table does not have a default route (0.0.0.0/0) to the Internet Gateway. Option D is correct because SourceDestCheck must be disabled for NAT instances, but for a regular EC2 instance that is not a NAT, it should be enabled. However, the exhibit shows SourceDestCheck: true, which is correct. The issue is likely that the subnet's route table does not have a route to the Internet Gateway. Option A is wrong because the EIP is allocated. Option B is wrong because the security group allows inbound HTTP. Option C is wrong because SourceDestCheck being true is correct for regular instances.

Answer

The source/destination check is enabled and should be disabled

Answer

The security group is blocking inbound traffic

Answer

The Elastic IP is not correctly associated with the instance

Question 13

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

Accepted Answer

An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet. Option C is correct because the template does not define a route table or route for the private subnet. However, the instance is in the public subnet, so the issue is that the public subnet might not have the route table associated. But looking at the template, it has PublicSubnetRouteTableAssociation. The missing piece is that the instance likely needs an Elastic IP or auto-assign public IP. Option A is not needed for public subnets with IGW. Option B is not needed for public subnets. Option D is not needed because the instance is in a public subnet.

Answer

A VPN connection to the VPC

Answer

A NAT Gateway in the public subnet

Answer

A route table for the private subnet

Question 14

Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway. Option B is correct because the VPN connection has a static route for 10.0.0.0/16, but the remote network CIDR is 0.0.0.0/0, which may cause routing issues. However, the main issue is that the VPC has a route to 10.0.0.0/16, but the on-premises network may not have a route back to the VPC's CIDR (172.16.0.0/16). Option A is incorrect because the tunnels are up. Option C is incorrect because static routes are configured. Option D is incorrect because acceleration is optional.

Answer

The VPN tunnels are not both in UP state

Answer

The VPN acceleration is disabled, causing high latency

Answer

The VPN connection is configured with static routes only and BGP is not used

Question 15

A company is deploying a multi-tier web application across three Availability Zones in a VPC. The web tier must be highly available and scale based on CPU utilization. The database tier uses an Amazon RDS Multi-AZ DB instance. The web tier must have the lowest possible latency to the internet. Which configuration should be used for the web tier subnets?

Accepted Answer

Place the web tier in public subnets with auto-assign public IP addresses enabled.. Option A is correct because assigning public IP addresses to web instances in public subnets allows direct internet access with minimal latency. B would introduce NAT latency. C and D are incorrect for a public-facing web tier.

Answer

Place the web tier in public subnets with auto-assign public IP addresses disabled.

Answer

Place the web tier in private subnets and use a VPC endpoint for internet access.

Answer

Place the web tier in private subnets and use a NAT gateway for internet access.