ANS-C01 Network Implementation Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway. The on-premises network can ping the VPC because the VPC route table has a route to 10.0.0.0/16 pointing to the virtual private gateway (VGW), so return traffic from the VPC is correctly forwarded. However, the VPC cannot ping the on-premises network because the on-premises router lacks a route back to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway (CGW). Without this return route, traffic from the VPC reaches the on-premises network, but the on-premises router drops the response packets as it does not know how to reach 172.16.0.0/16.

Answer

The VPN tunnels are not both in UP state

Answer

The VPN acceleration is disabled, causing high latency

Answer

The VPN connection is configured with static routes only and BGP is not used

Question 2

A company is deploying a multi-tier web application across three Availability Zones in a VPC. The web tier must be highly available and scale based on CPU utilization. The database tier uses an Amazon RDS Multi-AZ DB instance. The web tier must have the lowest possible latency to the internet. Which configuration should be used for the web tier subnets?

Accepted Answer

Place the web tier in public subnets with auto-assign public IP addresses enabled.. Placing the web tier in public subnets with auto-assign public IP addresses enabled ensures that each EC2 instance receives a public IPv4 address automatically, allowing direct internet access for low-latency communication. Public subnets have a route to an internet gateway, which provides the shortest path to the internet without additional hops. This configuration supports high availability across three Availability Zones and integrates with an Auto Scaling group based on CPU utilization.

Answer

Place the web tier in public subnets with auto-assign public IP addresses disabled.

Answer

Place the web tier in private subnets and use a VPC endpoint for internet access.

Answer

Place the web tier in private subnets and use a NAT gateway for internet access.

Question 3

A company wants to connect its on-premises data center to AWS using AWS Direct Connect. The company requires a dedicated 1 Gbps connection with low latency and high bandwidth for mission-critical workloads. Which type of Direct Connect interface should be used?

Accepted Answer

Dedicated Connection. A Dedicated Connection (Option D) is correct because it provides a physical, single-tenant Ethernet connection from the on-premises data center directly to AWS, offering dedicated 1 Gbps or 10 Gbps bandwidth with consistent low latency and high availability for mission-critical workloads. Unlike hosted connections, a dedicated connection is provisioned as a physical port at an AWS Direct Connect location, ensuring exclusive use and predictable performance without contention from other customers.

Answer

AWS Transit VIF

Answer

VPN Connection

Answer

Hosted Connection

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has three subnets: 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24. An EC2 instance in subnet 10.0.1.0/24 needs to send traffic to an on-premises server at 10.0.0.5/32 via a VPN connection. The VPC route table has a route to the VPN gateway for 10.0.0.0/8. What is the expected behavior?

Accepted Answer

Traffic to 10.0.0.5 stays within the VPC.. The VPC's CIDR is 10.0.0.0/16, and the destination 10.0.0.5/32 falls within this range. AWS VPCs use the most specific route that matches the destination IP, and the local route (10.0.0.0/16) is automatically added to all VPC route tables. Since 10.0.0.5/32 is a subset of 10.0.0.0/16, the local route takes precedence over the VPN route (10.0.0.0/8) because it is more specific (longer prefix length). Therefore, traffic destined to 10.0.0.5 stays within the VPC and is not sent to the VPN gateway.

Answer

Traffic to 10.0.0.5 is sent to the internet gateway.

Answer

Traffic to 10.0.0.5 is routed through the VPN gateway.

Answer

Traffic to 10.0.0.5 is dropped because there is no matching route.

Question 5

A company is using AWS CloudFormation to deploy a VPC with two public subnets and two private subnets across two Availability Zones. The template includes an internet gateway and a NAT gateway in each public subnet. The company needs to ensure that instances in the private subnets can access the internet. Which route table configuration should be used?

Accepted Answer

Add a route 0.0.0.0/0 pointing to the NAT gateway in the same AZ in each private subnet route table.. Private subnets require a default route (0.0.0.0/0) pointing to a NAT gateway in the same Availability Zone to ensure internet-bound traffic is source-NATed. This design maintains high availability by avoiding cross-AZ data transfer costs and single points of failure. The NAT gateway must be placed in a public subnet, and the private subnet route table must explicitly direct traffic to it.

Answer

Add a route to the internet gateway in the private subnet route tables.

Answer

Add a route to the NAT gateway in the public subnet route tables.

Answer

Add a route 0.0.0.0/0 pointing to a single NAT gateway in both private subnet route tables.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to establish a site-to-site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN tunnel is up, but traffic from the VPC to on-premises is not flowing. Which of the following is the most likely cause?

Accepted Answer

The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.. For traffic from a VPC to an on-premises network over a site-to-site VPN, the VPC route table must contain a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC has no path to forward packets destined for 192.168.0.0/16, even though the VPN tunnel is up. Security groups and NACLs are stateful or stateless filters, but they do not create routing paths.

Answer

The security groups do not allow outbound traffic.

Answer

The NACLs are blocking outbound traffic.

Answer

The VPN connection is in the wrong AWS region.

Question 7

A company is designing a network for a highly available application across multiple AWS regions. The application requires low-latency communication between regions and uses IP addresses that cannot change. Which AWS service should be used to connect the VPCs in different regions?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it establishes a direct, private network connection between two VPCs in different AWS regions using AWS's global backbone, enabling low-latency communication without requiring public internet traversal. It supports inter-region peering (since 2017) and allows the use of private IP addresses that remain unchanged, satisfying the requirement for fixed IPs.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

Internet Gateway

Question 8

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize network security by inspecting all traffic between VPCs and between VPCs and on-premises. Which architecture should be used?

Accepted Answer

Attach all VPCs to a Transit Gateway and use route tables to send traffic through a firewall appliance in one VPC.. AWS Transit Gateway supports centralized routing through a shared services VPC. By attaching all VPCs and VPN connections to the Transit Gateway and configuring route tables to point default or inter-VPC routes to a network firewall appliance (e.g., a third-party firewall or AWS Network Firewall) in a dedicated inspection VPC, all traffic between VPCs and between VPCs and on-premises can be forced through the firewall for inspection. This architecture leverages Transit Gateway route tables and blackhole routes to enforce traffic steering without requiring complex peering or VPN meshes.

Answer

Use VPN connections between all VPCs and on-premises.

Answer

Use VPC peering between all VPCs and configure security groups.

Answer

Use Network Load Balancer to distribute traffic across VPCs.

Question 9

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket to download files. The company wants to avoid using a NAT gateway and minimize latency. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the private subnet's route table.. A VPC endpoint for S3 allows the EC2 instance in the private subnet to access S3 directly over the AWS network, avoiding internet-bound traffic and eliminating the need for a NAT gateway. This minimizes latency because traffic stays within the AWS backbone and does not traverse the public internet. Attaching the endpoint to the private subnet's route table ensures that S3-bound traffic is routed through the endpoint.

Answer

Place the instance in a public subnet and use a NAT gateway.

Answer

Use a VPC endpoint for EC2.

Answer

Use an internet gateway and a route to 0.0.0.0/0.

Question 10

A company is deploying a web application in a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The ALB must only accept traffic from the internet and forward it to the instances. Which subnet configuration is correct for the ALB and EC2 instances?

Accepted Answer

ALB in public subnets, EC2 in private subnets.. An Application Load Balancer (ALB) must be deployed in public subnets to accept traffic directly from the internet, as it requires an internet gateway (IGW) route to receive inbound connections. The EC2 instances should reside in private subnets to enhance security, as they only need to respond to the ALB via the VPC's internal routing, not directly from the internet. This configuration ensures the ALB handles internet-facing traffic while the instances remain isolated from direct external access.

Answer

ALB in private subnets, EC2 in private subnets with a NAT gateway.

Answer

ALB in public subnets, EC2 in public subnets.

Answer

ALB in private subnets, EC2 in public subnets.

Question 11

A company is deploying a VPC with a CIDR block of 10.0.0.0/16. The VPC requires six subnets: three public and three private, each with a /24 CIDR. The company needs to ensure high availability across three Availability Zones. Which TWO of the following are valid subnet CIDR assignments that meet these requirements?

Accepted Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.3.0/24, 10.0.4.0/24, 10.0.5.0/24. It assigns six non-overlapping /24 subnets (10.0.0.0/24 through 10.0.5.0/24) within the 10.0.0.0/16 VPC, allowing three public and three private subnets to be distributed across three Availability Zones for high availability. Option C is also correct as it uses the same six /24 subnets but interleaves public and private ranges (e.g., public: 10.0.0.0/24, 10.0.2.0/24, 10.0.4.0/24; private: 10.0.1.0/24, 10.0.3.0/24, 10.0.5.0/24), which still provides non-overlapping /24 CIDRs and supports the required multi-AZ architecture.

Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

Answer

Public: 10.0.0.0/24, 10.0.0.0/25, 10.0.0.128/25; Private: 10.0.1.0/24, 10.0.1.0/25, 10.0.1.128/25

Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

Question 12

A company is configuring a site-to-site VPN connection between its on-premises network and AWS. The VPN tunnel is up, but traffic is not passing. The company has verified that routes are correct on both sides. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Check the security group rules for the EC2 instances in the VPC.. Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up and routes are correct, the security group rules must allow the desired traffic (e.g., from the on-premises network CIDR) to reach the EC2 instances. Without proper inbound rules, traffic will be dropped at the instance level, preventing communication.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Ensure that the on-premises firewall is configured to allow IPSec traffic.

Answer

Verify that the VPN tunnel is using the correct encryption algorithm.

Question 13

A company is designing a hybrid network using AWS Direct Connect. The company has a single 1 Gbps dedicated connection and wants to connect to multiple VPCs in the same region. Which THREE steps are necessary to achieve this connectivity?

Accepted Answer

Create a Direct Connect gateway.. A Direct Connect gateway acts as a central hub that allows a single private virtual interface to connect to multiple VPCs in the same or different AWS regions. Without a Direct Connect gateway, a private virtual interface can only connect to a single VPC. By using a Direct Connect gateway, you can associate it with multiple VPCs (either directly or via a transit gateway), enabling the desired multi-VPC connectivity over the single 1 Gbps dedicated connection.

Answer

Create a private virtual interface for each VPC.

Answer

Create a public virtual interface for each VPC.

Question 14

A network engineer is reviewing VPC Flow Logs for a VPC. The logs show that traffic from 10.0.1.5 to 10.0.2.10 on port 443 is being accepted and rejected intermittently. Both instances are in the same VPC. What is the most likely cause?

Accepted Answer

The network ACL is blocking traffic.. VPC Flow Logs show intermittent ACCEPT and REJECT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Since the traffic is within the same VPC, the route table is not involved (Option C is unlikely). Security groups are stateful, so even if the destination security group denies outbound traffic, return traffic for the established inbound connection is still allowed; thus Option A is incorrect. The intermittent behavior is characteristic of a stateless network ACL (NACL). A NACL is applied at the subnet level and evaluates inbound and outbound rules independently. If the NACL allows inbound traffic but blocks outbound response traffic (or vice versa), the flow will be partially accepted (initial packets) and then rejected when return packets hit the blocking rule. This matches the logs showing both ACCEPT and REJECT for the same flow. Therefore, the most likely cause is a misconfigured NACL (Option B).

Answer

The security group on the destination instance is configured to allow inbound HTTPS but deny outbound traffic.

Answer

The route table is misconfigured.

Answer

The source instance's security group is denying outbound traffic.

Question 15

A network engineer is troubleshooting connectivity issues. The route table shows a blackhole route for 10.0.0.0/8 pointing to a VPC endpoint (vpce-12345678). What is the most likely cause of the blackhole state?

Accepted Answer

The VPC endpoint (vpce-12345678) has been deleted.. A blackhole route in a VPC route table indicates that the target for the route (in this case, a VPC endpoint) is not in a valid state. When a VPC endpoint (vpce-12345678) is deleted, all routes pointing to it become blackhole routes because the target no longer exists. This causes traffic destined for 10.0.0.0/8 to be dropped silently.

Answer

The VPC CIDR 10.0.0.0/16 is overlapping with the endpoint route.

Answer

The route table does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.