ANS-C01 Network Implementation Practice Test 24 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. They want to use the same connection to access another VPC in a different region. What is the simplest way to achieve this?

Accepted Answer

Use a Direct Connect Gateway. Direct Connect Gateway allows a single private VIF to connect to multiple VPCs in different regions.

Answer

Create a new private VIF for the second VPC

Answer

Use a VPN over the internet to connect the VPCs

Answer

Set up VPC peering between the two VPCs

Question 2

A network engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint provides private connectivity to S3 and DynamoDB without requiring a NAT or IGW.

Answer

VPC Peering

Answer

Internet Gateway

Answer

NAT Gateway

Question 3

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?

Accepted Answer

Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it. Placing a firewall appliance in a dedicated VPC and routing traffic through it via Transit Gateway route tables allows inspection.

Answer

Use VPC security groups across VPCs

Answer

Use AWS Network Firewall directly in each VPC

Answer

Use network ACLs on each VPC subnet

Question 4

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They also have a VPN connection as a backup. How should they configure BGP to ensure that the VPN is only used when Direct Connect fails?

Accepted Answer

Use a higher local preference on the Direct Connect BGP session. Local preference is a BGP attribute used to influence outbound traffic from an AS. By setting a higher local preference on the Direct Connect BGP session, the router will prefer that path over the VPN session. When Direct Connect fails, the BGP session goes down, and the VPN route becomes the only available path, ensuring seamless failover.

Answer

Use a lower local preference on the Direct Connect BGP session

Answer

Use a lower AS path prepend on the VPN BGP session

Answer

Use a higher MED on the VPN BGP session

Question 5

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. What should be done to avoid overlapping CIDRs?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources. Overlapping CIDRs cause routing issues; the VPC CIDR must be changed to a non-overlapping range.

Answer

Configure a VPN with overlapping CIDRs, it will still work

Answer

Use NAT on the customer gateway to translate addresses

Answer

Use VPC peering to connect to on-premises

Question 6

A company has a VPC with an IPv6 CIDR and wants to provide internet access to instances in a private subnet using IPv6. Which AWS service should be used?

Accepted Answer

Egress-Only Internet Gateway. An egress-only internet gateway allows outbound IPv6 traffic from private subnets but blocks inbound traffic.

Answer

VPC Gateway Endpoint

Answer

Internet Gateway

Answer

NAT Gateway

Question 7

A network engineer is troubleshooting connectivity between two VPCs that are peered. The route tables are correct, and security groups allow traffic. However, ICMP ping fails. What is the most likely cause?

Accepted Answer

VPC peering does not support ICMP. VPC peering does not support ICMP; it only supports TCP and UDP traffic.

Answer

The route tables are not propagated

Answer

The VPCs are in different regions

Answer

The security groups are blocking ICMP

Question 8

A company wants to provide internet access to instances in a public subnet. Which component must be attached to the VPC and have a route to it in the subnet's route table?

Accepted Answer

Internet Gateway. Internet Gateway must be attached to the VPC and a default route pointing to it is needed for internet access.

Answer

Transit Gateway

Answer

Virtual Private Gateway

Answer

NAT Gateway

Question 9

Which TWO of the following are valid methods to connect an on-premises data center to an Amazon VPC over a private, dedicated network connection? (Choose two.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private connection. AWS VPN can also be used over the internet but is not dedicated; however, a VPN over Direct Connect is possible. The question asks for 'private, dedicated network connection', so Direct Connect is the primary method. VPN over internet is not dedicated. VPN over Direct Connect uses the dedicated connection.

Answer

VPC peering

Answer

AWS Site-to-Site VPN over the internet

Answer

AWS Client VPN

Question 10

Which THREE of the following are benefits of using AWS Transit Gateway over VPC peering for inter-VPC connectivity? (Choose three.)

Accepted Answer

Transitive routing between all attached VPCs. Transit Gateway simplifies connectivity by acting as a hub, supports transitive routing, and can connect multiple VPCs and on-premises networks via a single gateway.

Answer

Lower latency than VPC peering

Answer

No additional cost compared to VPC peering

Question 11

Which TWO of the following are valid configurations for an AWS Direct Connect virtual interface? (Choose two.)

Accepted Answer

Private virtual interface. A private virtual interface (B) allows you to connect your on-premises network directly to an Amazon VPC using private IP addresses, providing a secure, dedicated connection that bypasses the internet. A public virtual interface (E) enables access to all AWS public services (e.g., Amazon S3, DynamoDB) over the Direct Connect link using public IP addresses, without traversing the internet. Both are standard, supported virtual interface types for AWS Direct Connect.

Answer

VPN virtual interface

Answer

Hosted virtual interface

Answer

Transit virtual interface

Question 12

A network engineer created a VPC endpoint for the service shown in the exhibit. The endpoint is in the 'available' state, but instances in the VPC cannot resolve the private DNS name 'example.com'. What is the most likely cause?

Accepted Answer

The endpoint does not have 'Private DNS names enabled'. The private DNS name is only resolved via Route 53 private hosted zone if 'Private DNS names enabled' is set. The exhibit shows the service has a PrivateDnsName, but the endpoint must have 'Private DNS names enabled' for resolution to work.

Answer

The VPC does not have a Route 53 private hosted zone for example.com

Answer

The VPC does not have an internet gateway

Answer

The security group for the endpoint is blocking DNS traffic

Question 13

A company has an S3 bucket with the bucket policy shown. The VPC endpoint ID is correct. However, an EC2 instance in a private subnet in the same VPC cannot download objects from the bucket. What is a possible reason?

Accepted Answer

The EC2 instance is accessing S3 via a NAT Gateway instead of the VPC endpoint. The bucket policy allows access only via the specified VPC endpoint. If the EC2 instance is accessing S3 through a NAT Gateway or internet gateway, the source VPC endpoint will not be present, and access will be denied. The instance should use the VPC endpoint.

Answer

The EC2 instance does not have a route to the VPC endpoint

Answer

The bucket policy does not allow s3:ListBucket

Answer

The VPC endpoint security group is blocking traffic

Question 14

A network engineer created the CloudFormation stack shown. After creation, an EC2 instance launched in PublicSubnet does not have a public IP address. What is the most likely reason?

Accepted Answer

The VPC does not have an Internet Gateway attached. The subnet property 'MapPublicIpOnLaunch' is set to true, but the VPC does not have an Internet Gateway attached, and the subnet's route table does not have a route to an Internet Gateway. Without an Internet Gateway, public IP assignment might not work as expected, or the instance cannot reach the internet.

Answer

The subnet does not have an Internet Gateway attached

Answer

The subnet's route table does not have a route to a NAT Gateway

Answer

The instance type does not support public IP addresses

Question 15

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have route tables that include routes to each other's CIDR blocks via the peering connection. Instances in VPC A can ping instances in VPC B, but traffic to an Application Load Balancer (ALB) in VPC B fails. The ALB is in public subnets with internet-facing scheme. What is the most likely cause?

Accepted Answer

The ALB security group does not allow inbound traffic from VPC A. Option C is correct because an internet-facing ALB expects traffic to come from the internet via its public IP. Traffic from a peered VPC uses private IPs, which the ALB's security group may not allow unless explicitly permitted. Option A is wrong because route tables are configured correctly. Option B is wrong because the ALB can be reached from the internet. Option D is wrong because VPC peering does not affect the ALB's public accessibility.

Answer

The VPC peering connection does not support transitive routing for ALBs

Answer

The ALB is internet-facing and cannot be accessed from a peered VPC

Answer

The route tables in VPC B do not have a route back to VPC A