ANS-C01 Network Implementation Practice Test 23 — 15 Questions

Question 1

A company wants to connect its on-premises data center to AWS using AWS Direct Connect. The company requires a dedicated 1 Gbps connection with low latency and high bandwidth for mission-critical workloads. Which type of Direct Connect interface should be used?

Accepted Answer

Dedicated Connection. Option B is correct because a dedicated connection provides a physical Ethernet link dedicated to the customer. A virtual interface is used on top of a dedicated connection. C and D are incorrect as they are not types of Direct Connect interfaces.

Answer

AWS Transit VIF

Answer

VPN Connection

Answer

Hosted Connection

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has three subnets: 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24. An EC2 instance in subnet 10.0.1.0/24 needs to send traffic to an on-premises server at 10.0.0.5/32 via a VPN connection. The VPC route table has a route to the VPN gateway for 10.0.0.0/8. What is the expected behavior?

Accepted Answer

Traffic to 10.0.0.5 stays within the VPC.. Option C is correct because the VPC has a more specific route (10.0.0.0/16) for local traffic, which takes precedence over the VPN route (10.0.0.0/8) due to longest prefix match. Traffic from the EC2 instance to 10.0.0.5 is within the VPC CIDR, so it stays local.

Answer

Traffic to 10.0.0.5 is sent to the internet gateway.

Answer

Traffic to 10.0.0.5 is routed through the VPN gateway.

Answer

Traffic to 10.0.0.5 is dropped because there is no matching route.

Question 3

A company is using AWS CloudFormation to deploy a VPC with two public subnets and two private subnets across two Availability Zones. The template includes an internet gateway and a NAT gateway in each public subnet. The company needs to ensure that instances in the private subnets can access the internet. Which route table configuration should be used?

Accepted Answer

Add a route 0.0.0.0/0 pointing to the NAT gateway in the same AZ in each private subnet route table.. Option D is correct because private subnets need a default route (0.0.0.0/0) pointing to a NAT gateway in the same AZ for high availability. A and B point to IGW which would not work for private subnets. C only points to one NAT gateway, not AZ-specific.

Answer

Add a route to the internet gateway in the private subnet route tables.

Answer

Add a route to the NAT gateway in the public subnet route tables.

Answer

Add a route 0.0.0.0/0 pointing to a single NAT gateway in both private subnet route tables.

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to establish a site-to-site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN tunnel is up, but traffic from the VPC to on-premises is not flowing. Which of the following is the most likely cause?

Accepted Answer

The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.. Option A is correct because the VPC route table must have a route pointing to the virtual private gateway for the on-premises CIDR. Without it, traffic is dropped. B, C, D are possible but less likely initial checks.

Answer

The security groups do not allow outbound traffic.

Answer

The NACLs are blocking outbound traffic.

Answer

The VPN connection is in the wrong AWS region.

Question 5

A company is designing a network for a highly available application across multiple AWS regions. The application requires low-latency communication between regions and uses IP addresses that cannot change. Which AWS service should be used to connect the VPCs in different regions?

Accepted Answer

VPC Peering. Option A is correct because VPC peering provides low-latency, private connectivity between VPCs in different regions. B is intra-region only. C is for on-premises. D is for internet-facing.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

Internet Gateway

Question 6

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize network security by inspecting all traffic between VPCs and between VPCs and on-premises. Which architecture should be used?

Accepted Answer

Attach all VPCs to a Transit Gateway and use route tables to send traffic through a firewall appliance in one VPC.. Option D is correct because Transit Gateway supports appliance mode to force traffic through a security appliance VPC. A and B do not provide centralized inspection. C is manual and not scalable.

Answer

Use VPN connections between all VPCs and on-premises.

Answer

Use VPC peering between all VPCs and configure security groups.

Answer

Use Network Load Balancer to distribute traffic across VPCs.

Question 7

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket to download files. The company wants to avoid using a NAT gateway and minimize latency. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the private subnet's route table.. Option C is correct because a VPC endpoint for S3 allows private access without NAT or IGW. A is not for S3. B adds latency. D is not for S3.

Answer

Place the instance in a public subnet and use a NAT gateway.

Answer

Use a VPC endpoint for EC2.

Answer

Use an internet gateway and a route to 0.0.0.0/0.

Question 8

A company is deploying a web application in a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The ALB must only accept traffic from the internet and forward it to the instances. Which subnet configuration is correct for the ALB and EC2 instances?

Accepted Answer

ALB in public subnets, EC2 in private subnets.. Option B is correct because ALBs must be in public subnets to receive internet traffic, and backend instances should be in private subnets for security. A puts both in public. C is reversed. D puts ALB in private.

Answer

ALB in private subnets, EC2 in private subnets with a NAT gateway.

Answer

ALB in public subnets, EC2 in public subnets.

Answer

ALB in private subnets, EC2 in public subnets.

Question 9

A company is deploying a VPC with a CIDR block of 10.0.0.0/16. The VPC requires six subnets: three public and three private, each with a /24 CIDR. The company needs to ensure high availability across three Availability Zones. Which TWO of the following are valid subnet CIDR assignments that meet these requirements?

Accepted Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.3.0/24, 10.0.4.0/24, 10.0.5.0/24. Options A and D are correct because they provide three non-overlapping /24 subnets per AZ across three AZs. B overlaps and C and E overlap within the same AZ.

Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

Answer

Public: 10.0.0.0/24, 10.0.0.0/25, 10.0.0.128/25; Private: 10.0.1.0/24, 10.0.1.0/25, 10.0.1.128/25

Answer

Public: 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24; Private: 10.0.0.0/25, 10.0.1.0/25, 10.0.2.0/25

Question 10

A company is configuring a site-to-site VPN connection between its on-premises network and AWS. The VPN tunnel is up, but traffic is not passing. The company has verified that routes are correct on both sides. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Check the security group rules for the EC2 instances in the VPC.. Options A and D are correct because checking security group and NACL rules is essential for traffic flow. B is irrelevant as tunnel is up. C is not applicable. E is already done.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Ensure that the on-premises firewall is configured to allow IPSec traffic.

Answer

Verify that the VPN tunnel is using the correct encryption algorithm.

Question 11

A company is designing a hybrid network using AWS Direct Connect. The company has a single 1 Gbps dedicated connection and wants to connect to multiple VPCs in the same region. Which THREE steps are necessary to achieve this connectivity?

Accepted Answer

Create a Direct Connect gateway.. Options A, C, and D are correct because a Direct Connect gateway allows multiple VPCs, and a transit VIF with a transit gateway is the recommended approach. B is not needed. E is incorrect because a private VIF can only connect to one VPC.

Answer

Create a private virtual interface for each VPC.

Answer

Create a public virtual interface for each VPC.

Question 12

A network engineer is reviewing VPC Flow Logs for a VPC. The logs show that traffic from 10.0.1.5 to 10.0.2.10 on port 443 is being accepted and rejected intermittently. Both instances are in the same VPC. What is the most likely cause?

Accepted Answer

The security group on the destination instance is configured to allow inbound HTTPS but deny outbound traffic.. Option C is correct because a security group that allows inbound HTTPS but denies outbound can cause intermittent rejects if the return traffic is blocked. NACLs are stateless and would block consistently. B and D are less likely.

Answer

The network ACL is blocking traffic.

Answer

The route table is misconfigured.

Answer

The source instance's security group is denying outbound traffic.

Question 13

A network engineer is troubleshooting connectivity issues. The route table shows a blackhole route for 10.0.0.0/8 pointing to a VPC endpoint (vpce-12345678). What is the most likely cause of the blackhole state?

Accepted Answer

The VPC endpoint (vpce-12345678) has been deleted.. Option B is correct because a blackhole route for a VPC endpoint typically indicates the endpoint has been deleted or is in a failed state. A is incorrect because the VPC CIDR is more specific. C is irrelevant. D is incorrect because blackhole doesn't indicate no route.

Answer

The VPC CIDR 10.0.0.0/16 is overlapping with the endpoint route.

Answer

The route table does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.

Question 14

A company is using CloudFormation to deploy a VPC. The private subnet route table has a route to a NAT gateway. However, instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet and has an attached Elastic IP. What is the most likely issue?

Accepted Answer

The NAT gateway's security group is blocking traffic from the private subnet.. Option A is correct because the NAT gateway's security group must allow inbound traffic from the private subnet and outbound to the internet. B is incorrect because the route is present. C is incorrect because public subnets don't need NAT. D is incorrect because the route points to NAT.

Answer

The public subnet does not have a route to the internet gateway.

Answer

The private subnet route table does not have a route to the NAT gateway.

Answer

The NAT gateway is not in the same subnet as the private instances.

Question 15

A company is deploying a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for software updates but must not be reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet.

Answer

VPC Peering

Answer

Virtual Private Gateway

Answer

Internet Gateway