ANS-C01 Network Implementation Practice Test 22 — 15 Questions

Question 1

A company is designing a multi-account AWS environment using AWS Transit Gateway. They want to centralize network management and ensure that VPCs in different accounts can communicate. Which THREE steps are required to achieve this? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Transit Gateway in the central networking account. The Transit Gateway must be created in a central networking account to serve as the hub for all VPC traffic. This centralizes routing and simplifies network management across the multi-account environment.

Answer

Create a separate Transit Gateway in each account and peer them together

Answer

Create a VPC peering connection between each VPC and the Transit Gateway

Question 2

A company is setting up a new VPC and needs to ensure that instances in the VPC can resolve DNS names within AWS (e.g., ec2-203-0-113-25.compute-1.amazonaws.com). Which TWO configurations are required? (Select TWO.)

Accepted Answer

Set the VPC's 'enableDnsSupport' attribute to true. Setting the VPC's 'enableDnsSupport' attribute to true (Option A) ensures that the VPC uses the Amazon-provided DNS server (the VPC DNS Resolver at the base VPC CIDR +2 address) to resolve DNS queries. This is required for instances to resolve public AWS DNS names like ec2-203-0-113-25.compute-1.amazonaws.com, as the VPC DNS Resolver handles both public and private DNS resolution within AWS.

Answer

Configure the Amazon Route 53 Resolver to forward queries to the VPC DNS

Answer

Create a public hosted zone in Amazon Route 53 and associate it with the VPC

Answer

Create a custom DHCP option set with the domain-name-servers option set to the VPC DNS IP

Question 3

A company is deploying a multi-VPC architecture with connectivity requirements. The network team needs to establish private connectivity between VPCs in the same AWS account and region, using services that can scale to 100 Gbps throughput. Which solution meets these requirements?

Accepted Answer

Create an AWS Transit Gateway and attach all VPCs to it. AWS Transit Gateway (TGW) acts as a regional hub-and-spoke router that can interconnect thousands of VPCs and on-premises networks, supporting burst throughput up to 100 Gbps per attachment. It simplifies multi-VPC connectivity by eliminating the need for full-mesh peering and provides centralized routing, making it the only option that meets both the scalability and private connectivity requirements.

Answer

Use AWS PrivateLink with Network Load Balancers to connect VPCs

Answer

Deploy AWS Client VPN and configure routes between VPCs

Answer

Configure VPC peering connections between each pair of VPCs

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team reports intermittent connectivity loss to resources in the VPC, but the Direct Connect tunnel status shows as UP. Which configuration is MOST likely causing the issue?

Accepted Answer

Traffic is being routed asymmetrically through the Direct Connect and a VPN backup. Asymmetric routing occurs when traffic from on-premises to the VPC uses Direct Connect, but return traffic from the VPC takes the VPN backup path. This can cause stateful firewalls (e.g., AWS Network Firewall, security groups, or on-premises firewalls) to drop packets because they expect traffic to arrive on the same interface. The Direct Connect tunnel status remains UP because the BGP session is still established, but connectivity is intermittent due to dropped return packets.

Answer

The BGP keepalive interval is set to 60 seconds

Answer

Jumbo frames are enabled on the Direct Connect interface but not on on-premises routers

Answer

A separate private VIF is required for each VPC in the account

Question 5

A company is implementing a hybrid network using AWS Site-to-Site VPN. The on-premises firewall requires that the VPN tunnels use IKEv2 with pre-shared keys and that the tunnels are always active. Which VPN configuration should be used?

Accepted Answer

Two VPN tunnels in active/active mode with BGP. IKEv2 with pre-shared keys and always-active tunnels require both tunnels to be in active/active mode, which is achieved by using BGP to advertise the same routes over both tunnels. BGP enables dynamic routing and ensures both tunnels are used simultaneously, meeting the requirement for continuous active connectivity.

Answer

Two VPN tunnels in active/passive mode

Answer

Two VPN tunnels with static routing

Answer

One VPN tunnel with static routing

Question 6

A company is designing a network for a multi-tier application that includes a web tier, application tier, and database tier. The web tier must be accessible from the internet, while the application and database tiers should have no direct internet access. All tiers are in the same VPC. Which configuration meets these requirements?

Accepted Answer

Place web tier in public subnets with Internet Gateway, app and DB tiers in private subnets with a NAT Gateway for outbound traffic. It places the web tier in a public subnet with an Internet Gateway (IGW) for direct inbound internet traffic, while the application and database tiers reside in private subnets with no direct internet path. A NAT Gateway in a public subnet provides outbound-only internet access for the private tiers (e.g., for software updates) without allowing inbound connections, satisfying the requirement that only the web tier be internet-accessible.

Answer

Place all tiers in public subnets and use security group rules to restrict access to app and DB tiers

Answer

Place web tier in a public subnet and app and DB tiers in the same public subnet but with restrictive Network ACLs

Answer

Place all tiers in private subnets and attach an Internet Gateway to the private subnets for the web tier

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC has a public subnet 10.0.1.0/24 and a private subnet 10.0.2.0/24. An EC2 instance in the private subnet needs to download patches from the internet. Which configuration is required to provide outbound internet access to the private instance while preventing inbound internet traffic?

Accepted Answer

Deploy a NAT Gateway in the public subnet and add a default route in the private subnet route table pointing to the NAT Gateway. A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID. This design ensures the private instance's traffic is source-NATed to the NAT Gateway's Elastic IP, and the Internet Gateway only accepts responses to established outbound connections.

Answer

Attach an Internet Gateway to the private subnet and add a default route to the Internet Gateway in the private route table

Answer

Assign an Elastic IP to the private instance and update the security group to allow outbound traffic

Answer

Add an Internet Gateway to the VPC and create a route in the private subnet to 0.0.0.0/0 via the Internet Gateway

Question 8

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect and Site-to-Site VPN. The network team wants to ensure that traffic between VPCs does not traverse the on-premises network. Which Transit Gateway feature should be used?

Accepted Answer

Transit Gateway route tables with separate associations and propagations. Transit Gateway route tables with separate associations and propagations allow you to isolate traffic between VPCs and on-premises networks. By associating VPC attachments to one route table and on-premises attachments (Direct Connect, VPN) to another, you can prevent VPC-to-VPC traffic from being routed through the on-premises network. This ensures that inter-VPC traffic stays within AWS, meeting the requirement.

Answer

Transit Gateway Multicast

Answer

Transit Gateway Network Manager

Answer

Transit Gateway BGP over AWS Direct Connect

Question 9

A company has a Direct Connect connection with a private VIF to a Direct Connect gateway. The VIF is associated with a Direct Connect gateway that has a virtual private gateway (VGW) attachment to a VPC. The on-premises network is advertising a route to 10.0.0.0/16. However, the VPC cannot reach on-premises resources. The VPC has a route table with a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The on-premises router is not using BGP to advertise routes. The VPC route table already contains a static route to 10.0.0.0/16 pointing to the VGW, so route propagation is not required for this specific destination. However, for the VGW to forward traffic to on-premises, it must have learned the on-premises route via BGP from the Direct Connect gateway. If the on-premises router is not using BGP to advertise the 10.0.0.0/16 route, the Direct Connect gateway and therefore the VGW will not have a route to that prefix, causing traffic from the VPC to be dropped. Enabling route propagation on the VPC route table would not help because the route is already statically defined. Therefore, the most likely cause is that the on-premises router is not using BGP to advertise routes.

Answer

The VPC route table does not have route propagation enabled for the virtual private gateway

Answer

The security group on the VPC instances is blocking inbound traffic

Answer

The Direct Connect gateway does not support the prefix 10.0.0.0/16

Question 10

A company wants to securely connect two VPCs in different AWS regions using AWS infrastructure. Which service should be used?

Accepted Answer

VPC peering. VPC peering is the correct service because it allows direct, private connectivity between two VPCs in different AWS regions using AWS's internal network, without traversing the public internet. It uses the existing AWS infrastructure to route traffic between the VPCs via private IP addresses, and it supports inter-region peering as of 2017, making it the simplest and most cost-effective solution for this specific requirement.

Answer

AWS Direct Connect

Answer

Internet Gateway

Answer

AWS Transit Gateway

Question 11

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS VPN CloudHub. The on-premises network uses multiple customer gateways (CGWs) connected to a single virtual private gateway (VGW). The company wants to ensure that all traffic from the VPC to on-premises is routed through a specific CGW. Which configuration should be used?

Accepted Answer

Configure a static route in the VPC route table pointing to the VGW with a more specific prefix for the on-premises network. In an AWS VPN CloudHub setup, the VPC route table controls how traffic from the VPC is forwarded to the on-premises network via the virtual private gateway (VGW). By adding a static route with a more specific prefix (e.g., a /24 instead of a /16) for the on-premises network, you force the VPC to prefer that route over any dynamically learned routes from other CGWs, ensuring all traffic uses the designated CGW. This approach leverages the longest prefix match rule in the VPC route table, overriding BGP-learned routes without altering the BGP configuration.

Answer

Adjust the BGP local preference on the preferred CGW to a higher value

Answer

Remove the other CGWs from the VGW

Answer

Modify the VPN tunnel option to prefer the specific tunnel

Question 12

Which TWO scenarios are best suited for using AWS Transit Gateway over VPC peering? (Select TWO.)

Accepted Answer

Connecting hundreds of VPCs across multiple accounts. AWS Transit Gateway is designed to act as a central hub for connecting multiple VPCs and on-premises networks, simplifying management and reducing the number of connections. Option C is correct because Transit Gateway can scale to connect hundreds of VPCs across multiple accounts using a hub-and-spoke model, whereas VPC peering would require a full mesh of point-to-point connections, which becomes unmanageable and hits the hard limit of 125 peering connections per VPC. Option D is correct because Transit Gateway natively integrates with AWS Direct Connect via a Direct Connect Gateway, allowing a single Transit Gateway to route traffic from multiple VPCs to on-premises without needing individual VPN tunnels or complex routing configurations.

Answer

Connecting VPCs in different AWS accounts

Answer

Connecting a single VPC to an on-premises network

Answer

Connecting two VPCs in the same account and region

Question 13

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Accepted Answer

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection. AWS Direct Connect allows you to create multiple virtual interfaces (VIFs) — including private VIFs, public VIFs, and transit VIFs — over a single physical Direct Connect connection. This enables you to segment traffic to different AWS services (e.g., VPCs via private VIF, public AWS endpoints via public VIF) without needing separate physical cables, leveraging 802.1Q VLAN tagging to isolate each VIF.

Answer

Direct Connect traffic is encrypted by default

Answer

Direct Connect is a managed VPN service

Answer

Direct Connect can be provisioned in minutes without any physical infrastructure

Question 14

Refer to the exhibit. An EC2 instance in a VPC is assigned a public IP via an Elastic IP address. The instance is not reachable from the internet, although it has a security group allowing inbound HTTP traffic from 0.0.0.0/0. The VPC has an Internet Gateway attached to the route table of the subnet. What is the MOST likely cause?

Accepted Answer

The subnet route table does not have a default route (0.0.0.0/0) to the Internet Gateway. The most likely cause is that the subnet's route table lacks a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). Without this route, traffic destined for the internet from the instance has no path to the IGW, and return traffic from the internet cannot reach the instance. Even with a public Elastic IP and a permissive security group, the VPC's routing logic prevents internet-bound packets from being forwarded to the IGW.

Answer

The source/destination check is enabled and should be disabled

Answer

The security group is blocking inbound traffic

Answer

The Elastic IP is not correctly associated with the instance

Question 15

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

Accepted Answer

An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet. The EC2 instance in the public subnet cannot be reached from the internet because it lacks a publicly routable IP address. Even though the subnet has a default route to the Internet Gateway (IGW) and the security group allows inbound HTTP from 0.0.0.0/0, the instance must have either an Elastic IP address assigned directly or the subnet must have the 'Auto-assign public IPv4 address' attribute enabled. Without a public IP, the IGW cannot perform 1-to-1 NAT to translate the instance's private IP to a public IP, making it unreachable from the internet.

Answer

A VPN connection to the VPC

Answer

A NAT Gateway in the public subnet

Answer

A route table for the private subnet