ANS-C01 Network Implementation Practice Test 23 — 15 Questions

Question 1

A global company wants to connect multiple VPCs across different AWS Regions using a hub-and-spoke model. The hub VPC contains shared services such as Active Directory and DNS. Which AWS service provides the most scalable and maintainable solution for this architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. AWS Transit Gateway with inter-Region peering attachments is the most scalable and maintainable solution because it provides a central hub to connect multiple VPCs across different AWS Regions using a fully managed service. Inter-Region peering attachments allow transitive routing between all attached VPCs without requiring full mesh peering, and they support route propagation and centralized management of shared services like Active Directory and DNS. This architecture scales linearly as new VPCs or Regions are added, unlike VPC peering which requires individual non-transitive connections.

Answer

AWS VPN CloudHub to interconnect all VPCs.

Answer

AWS Direct Connect gateway with virtual interfaces to each VPC.

Answer

VPC peering between each spoke VPC and the hub VPC.

Question 2

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket in the same Region. Which solution provides the most secure and cost-effective connectivity?

Accepted Answer

Create a gateway endpoint for S3 in the VPC and add a route in the private subnet's route table pointing to the endpoint.. A gateway endpoint for S3 uses Amazon's private network to connect the VPC to S3 without traversing the internet, providing the most secure and cost-effective solution. It avoids NAT gateway hourly charges and data processing fees, and it does not require public IPs or internet access for the private subnet EC2 instance.

Answer

Create a NAT gateway in a public subnet and add a route in the private subnet's route table pointing to the NAT gateway.

Answer

Create an interface endpoint for S3 in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 3

A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?

Accepted Answer

Allow inbound traffic from the ALB's security group on the application port.. Referencing the ALB's security group as the source in the EC2 instances' inbound rule ensures that only traffic originating from the ALB is allowed. This leverages AWS security group referencing, which dynamically resolves to the private IP addresses of the ALB's elastic network interfaces (ENIs), providing a secure and scalable solution without exposing the instances to broader network ranges.

Answer

Allow inbound traffic from 0.0.0.0/0 on the application port.

Answer

Allow inbound traffic from the VPC CIDR on the application port.

Answer

Allow inbound traffic from the private subnet CIDR on the application port.

Question 4

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between a VPC and an on-premises network using IPsec. It is a fully managed, quick-to-deploy method that supports both static routes and BGP dynamic routing via the virtual private gateway.

Answer

VPC endpoints

Answer

AWS Transit Gateway

Answer

VPC peering

Question 5

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Accepted Answer

Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as EC2 instances, in different Availability Zones (AZs). By registering instances from multiple AZs with the ALB, you ensure that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ, thereby maintaining high availability. This aligns with the AWS Well-Architected Framework's recommendation to deploy workloads across multiple AZs and use a load balancer to handle failover.

Answer

Create a single public subnet that spans all Availability Zones.

Answer

Use a single NAT gateway in one Availability Zone to reduce cost.

Question 6

Which TWO of the following are required to establish a BGP session over a Direct Connect private virtual interface? (Choose TWO.)

Accepted Answer

A VLAN ID. A VLAN ID is required because a Direct Connect private virtual interface operates over a single 802.1Q VLAN trunk. The VLAN ID uniquely identifies the virtual interface on the Direct Connect connection, allowing multiple virtual interfaces to share the same physical link. Without a VLAN ID, the Layer 2 encapsulation cannot be established, and the BGP session cannot form.

Answer

A public IP address for the BGP peer

Answer

A Direct Connect gateway

Answer

A VPN connection to the VPC

Question 7

A company is deploying an application across multiple Availability Zones in a single AWS Region. The application requires that all traffic between EC2 instances in the same subnet be inspected by a network appliance. Which configuration should be used to meet this requirement?

Accepted Answer

Create a Gateway Load Balancer and configure the appliance as a target. A Gateway Load Balancer (GWLB) can inspect intra-subnet traffic between EC2 instances in the same subnet. Traffic between instances in the same subnet is Layer 2 and does not traverse route tables, so traditional routing methods cannot intercept it. GWLB uses Geneve encapsulation to transparently redirect traffic at the hypervisor level to the appliance targets without modifying the route table. The appliance must be configured to handle this encapsulation. Other options do not support inspection of same-subnet traffic.

Answer

Set up a VPC peering connection between the subnets

Answer

Use a Transit Gateway to route traffic through the appliance

Answer

Deploy AWS Network Firewall in the subnet

Question 8

A company has multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The appliance must be deployed in a single VPC and all inter-VPC traffic must be routed through it. Which architecture should be used?

Accepted Answer

Configure the Transit Gateway with a central inspection VPC that hosts the firewall appliance. A Transit Gateway supports centralised inspection by attaching a dedicated inspection VPC that hosts the third‑party firewall appliance. By adjusting the Transit Gateway route tables, all inter‑VPC traffic can be forced through the inspection VPC using static routes or a default route pointing to the firewall’s elastic network interface, enabling full traffic inspection without modifying individual VPC route tables.

Answer

Create a Network Load Balancer in each VPC and point to the firewall

Answer

Deploy AWS Network Firewall in each VPC

Answer

Use VPC peering connections between all VPCs and route traffic through the inspection VPC

Question 9

A company is migrating a legacy application to AWS. The application requires multicast communication between instances. The company needs to implement a multicast solution within a VPC. Which AWS service or feature should be used to support multicast?

Accepted Answer

Create a Transit Gateway multicast domain. AWS Transit Gateway supports multicast through the creation of a Transit Gateway multicast domain. This feature allows you to send multicast traffic from a source to multiple receivers within a VPC, which is required for legacy applications that rely on multicast communication. Transit Gateway multicast domains work with IGMP (Internet Group Management Protocol) to manage group memberships and route multicast traffic efficiently.

Answer

Configure multicast in the VPC's route tables

Answer

Use AWS Global Accelerator for multicast distribution

Answer

Set up VPC peering to enable multicast between subnets

Question 10

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

Accepted Answer

Associate AWS WAF with the ALB and make the ALB internet-facing. AWS WAF can be directly associated with an Application Load Balancer (ALB) to inspect HTTP/HTTPS traffic before it reaches the ALB. Making the ALB internet-facing allows it to receive traffic directly from the internet while WAF provides the required traffic inspection. This combination meets both the accessibility and security requirements without additional components.

Answer

Use a Network Load Balancer with AWS WAF attached

Answer

Place the ALB behind a Security Group that inspects traffic

Answer

Use Amazon CloudFront in front of the ALB with AWS WAF

Question 11

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a subnet that hosts an EC2 instance with a sensitive database. The company wants to add an extra layer of encryption for traffic between the on-premises network and the EC2 instance. Which solution should be used?

Accepted Answer

Set up an IPsec VPN tunnel over the Direct Connect private VIF. An IPsec VPN tunnel over a Direct Connect private VIF adds an extra layer of encryption to traffic between on-premises and the EC2 instance. Direct Connect private VIFs provide a private, isolated connection but do not encrypt data by default; IPsec encrypts the IP payload at Layer 3, ensuring confidentiality over the physical link. This meets the requirement for an additional encryption layer without altering the application or network stack on the EC2 instance.

Answer

Enable TLS on the EC2 instance

Answer

Use an SSL certificate on the on-premises router

Answer

Use AWS Key Management Service (KMS) to encrypt the traffic

Question 12

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC? (Select TWO.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This is a valid method for connecting an on-premises network to a VPC, as it establishes a direct physical link that can be associated with a virtual interface to a VPC.

Answer

VPC peering connection

Answer

VPC endpoint

Answer

Internet Gateway

Question 13

A company wants to provide internet access to instances in a private subnet while ensuring that traffic is logged and inspected. The solution must be highly available within a single AWS Region. Which approach should the company use?

Accepted Answer

Deploy a NAT Gateway in each Availability Zone and configure the private subnet route tables to point to the NAT Gateway in the same AZ. Use Gateway Load Balancer endpoint for traffic inspection.. It combines NAT Gateways (one per AZ) for highly available outbound internet access from private subnets with a Gateway Load Balancer endpoint for traffic inspection. NAT Gateways are managed, scale automatically, and are AZ-resilient when deployed in each AZ, while the Gateway Load Balancer endpoint allows traffic to be routed through third-party inspection appliances without disrupting the NAT path. This meets the requirements for high availability within a single Region and ensures all egress traffic is logged and inspected.

Answer

Launch a NAT instance in a public subnet and configure it as the default route for the private subnet.

Answer

Create a VPC endpoint for the internet and attach it to the private subnet.

Answer

Attach an Internet Gateway to the VPC and add a default route to it in the private subnet's route table.

Question 14

A company has deployed an application across multiple AWS Regions using Application Load Balancers (ALBs). The company wants to route traffic to the nearest healthy endpoint using latency-based routing. Which AWS service should be used to distribute traffic across the ALBs?

Accepted Answer

Amazon Route 53 with latency routing policy.. Amazon Route 53 with a latency routing policy is the correct choice because it directs traffic to the ALB endpoint that provides the lowest latency for the end user, based on measured round-trip times between the user and each AWS Region. This aligns with the requirement to route traffic to the nearest healthy endpoint using latency-based routing, as Route 53 evaluates health checks on the ALBs and only considers healthy endpoints when determining the lowest latency.

Answer

Amazon CloudFront with multiple origins.

Answer

AWS Network Load Balancer with cross-zone load balancing.

Answer

AWS Global Accelerator.

Question 15

A company needs to securely connect multiple VPCs across different AWS Regions using AWS backbone network infrastructure without traversing the public internet. The solution must be managed centrally and support transitive routing between VPCs. Which service should the company use?

Accepted Answer

AWS Transit Gateway with inter-region peering.. AWS Transit Gateway with inter-region peering allows you to connect VPCs across different AWS Regions using the AWS global backbone, avoiding the public internet. It provides a central hub for managing connectivity and supports transitive routing between all attached VPCs, which is not possible with VPC peering alone. This makes it the correct choice for a centrally managed, transitive, cross-region solution.

Answer

VPC peering connections in a full mesh.

Answer

AWS PrivateLink and VPC Endpoints.

Answer

AWS ClassicLink.