ANS-C01 Network Implementation Practice Test 24 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should the company implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet's route table.. A VPC Gateway Endpoint for S3 provides private, cost-free connectivity to S3 from within a VPC without traversing the internet. It uses prefix-based routing via the route table, ensuring traffic to S3 stays within the AWS network, minimizing data transfer costs and avoiding internet egress charges.

Answer

Create a VPC Interface Endpoint for S3 and attach it to the private subnet.

Answer

Configure an S3 bucket policy to allow access from the VPC and use an Internet Gateway.

Answer

Create a NAT Gateway in the public subnet and route traffic to the S3 bucket through it.

Question 2

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer notices that the BGP session is flapping intermittently. The connection is a 1 Gbps dedicated connection with a single private VIF. The router configuration uses default BGP timers. What is the most likely cause of the flapping?

Accepted Answer

The link experiences occasional packet loss causing BGP hold timer expiration.. B is correct because the BGP hold timer (default 90 seconds) expires when the link experiences intermittent packet loss, causing the BGP session to flap. This is a common issue on Direct Connect when the underlying physical link has transient errors or congestion, leading to missed keepalive messages and session resets.

Answer

The MTU size is set to 9001 (jumbo frames) on the Direct Connect interface.

Answer

The BGP authentication key is mismatched between the customer router and AWS.

Answer

The Multi-Exit Discriminator (MED) value is set too high on the customer router.

Question 3

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

Accepted Answer

Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.. Network Load Balancers (NLBs) preserve the source IP address of clients by default when using a TCP listener. No additional configuration is required to enable this behavior; the NLB forwards packets with the original source IP intact. Therefore, simply creating the NLB with a TCP listener and registering EC2 instances as targets is sufficient.

Answer

Enable Proxy Protocol v2 on the NLB target group.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Attach a security group to the NLB that allows inbound traffic from the client IP range.

Question 4

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company has two Direct Connect connections from different providers for redundancy. The company wants to use BGP to automatically fail over to the VPN if both Direct Connect connections fail. Which TWO configurations are required to achieve this?

Accepted Answer

Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.. Setting a higher local preference on Direct Connect routes makes them more preferred over VPN routes under normal conditions. Option E is correct because dynamic BGP routing on the VPN is required to allow automatic failover and route advertisement when Direct Connect fails, enabling BGP to withdraw routes and trigger failover.

Answer

Set a higher local preference on the VPN route to make it preferred over Direct Connect.

Answer

Configure the VPN connection with static routes instead of BGP.

Answer

Disable route propagation on the VPN connection's route table.

Question 5

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets contain NAT gateways for outbound internet access from the private subnets. The private subnets host web servers that need to make API calls to an external service over the internet. After implementation, the web servers cannot reach the internet. Which configuration is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.. A NAT gateway must be placed in a public subnet with a route to an internet gateway (IGW) to translate private IP addresses for outbound traffic. If the NAT gateway is in a private subnet, it cannot reach the IGW, so the private web servers' traffic destined for the internet (via the 0.0.0.0/0 route pointing to the NAT gateway) will fail, as the NAT gateway itself has no path to the internet.

Answer

The route table for the private subnets is not associated with the VPC's main route table.

Answer

The private subnets have a default route (0.0.0.0/0) pointing to an internet gateway instead of the NAT gateway.

Answer

The public subnets have a default route pointing to the NAT gateway instead of the internet gateway.

Question 6

A network engineer is setting up a Direct Connect connection from an on-premises data center to AWS. The connection uses a private VIF to connect to a VPC via a Direct Connect gateway. The on-premises network is advertising a BGP prefix 10.0.0.0/16, which overlaps with the VPC CIDR 10.0.0.0/16. What is the expected behavior?

Accepted Answer

The BGP session will be established, but the overlapping prefix will be ignored and not programmed into the VPC route tables.. When a BGP prefix advertised over a Direct Connect private VIF overlaps with the VPC CIDR, the BGP session establishes successfully, but AWS ignores the overlapping prefix and does not install it into the VPC route tables. This is because AWS always prefers the local VPC route over any propagated BGP route for the same prefix, preventing traffic destined for the VPC from being blackholed or misrouted to on-premises.

Answer

The VPC will automatically reassign a new CIDR to avoid the conflict.

Answer

The BGP session will fail to establish due to the prefix conflict.

Answer

The on-premises prefix will take precedence and override the VPC route.

Question 7

An organization uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to implement traffic inspection between VPCs using a third-party firewall appliance in a central VPC. The firewall must inspect traffic for all inter-VPC flows. Which architecture meets this requirement?

Accepted Answer

Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC's attachment, and enable appliance mode on the attachment.. Enabling appliance mode on a Transit Gateway attachment forces the Transit Gateway to preserve the source MAC address and use flow hash-based load balancing for traffic sent to the inspection VPC. This ensures that all inter-VPC traffic is routed through the third-party firewall appliance in the central VPC, allowing stateful inspection to work correctly. Without appliance mode, the Transit Gateway would perform MAC address rewriting, breaking the firewall's ability to track sessions.

Answer

Create VPC peering connections between all VPCs and route traffic through the central VPC.

Answer

Use a Network Load Balancer in the central VPC to distribute traffic to the firewall appliances.

Answer

Set up Direct Connect gateways and route all traffic through the on-premises network for inspection.

Question 8

A company has a VPC with an IPv6 CIDR block and wants to provide internet access to instances in a private subnet using an egress-only internet gateway. Which of the following must be configured correctly?

Accepted Answer

Add a default route (::/0) in the private subnet's route table pointing to the egress-only internet gateway.. An egress-only internet gateway (EIG) is a horizontally scaled, redundant VPC component that allows outbound-only IPv6 traffic from instances in a private subnet to the internet, while preventing unsolicited inbound connections. To use it, you must add a default route (::/0) in the private subnet's route table pointing to the EIG, which directs all outbound IPv6 traffic through the gateway. This configuration ensures that instances can initiate outbound IPv6 connections (e.g., to download updates) but cannot be reached from the internet.

Answer

Configure NAT64 on the VPC to translate IPv6 to IPv4.

Answer

Enable route propagation for the egress-only internet gateway in the route table.

Answer

Assign an IPv6 address to the egress-only internet gateway.

Question 9

A company is implementing a multi-region architecture with VPCs in us-east-1 and eu-west-1. They want to connect these VPCs using a Transit Gateway and ensure that traffic between regions can be inspected by a firewall in us-east-1. Which configuration is required?

Accepted Answer

Create a Transit Gateway in each region, peer them, and configure route tables to send inter-region traffic through the inspection VPC in us-east-1.. It uses Transit Gateway inter-region peering to connect the two regions, and by attaching an inspection VPC (with a firewall) in us-east-1 to the Transit Gateway, you can route all inter-region traffic through that VPC for inspection. The Transit Gateway route tables in each region are configured to send traffic destined for the other region to the inspection VPC attachment, ensuring traffic is inspected before being forwarded.

Answer

Establish a VPN connection between the two VPCs and route traffic through the firewall.

Answer

Create a VPC peering connection between the two VPCs and update route tables.

Answer

Use a Direct Connect gateway to connect the two VPCs directly.

Question 10

A developer wants to allow an EC2 instance in a VPC to access an Amazon S3 bucket without traversing the public internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows EC2 instances to access S3 buckets privately using AWS’s internal network, without traversing the public internet. Gateway endpoints are specifically designed for services like S3 and DynamoDB, using route table entries to direct traffic to the service via the AWS backbone, with no data transfer costs for traffic within the same region.

Answer

AWS PrivateLink with an interface VPC endpoint.

Answer

NAT gateway in the public subnet.

Answer

AWS Direct Connect with a public VIF.

Question 11

A company has a VPN connection between an on-premises network and AWS using two tunnels for redundancy. The BGP sessions are established, but traffic is only flowing through one tunnel. The engineer wants to ensure both tunnels are actively used. What should be configured?

Accepted Answer

Advertise the same BGP prefixes over both tunnels from the on-premises router.. When both tunnels advertise the same BGP prefixes, the AWS VPN endpoint will see equal-cost paths and load-balance traffic across both tunnels using ECMP (Equal-Cost Multi-Path) routing. This ensures active-active utilization of both tunnels, which is the standard design for AWS VPN redundancy.

Answer

Enable load balancing on the VPN connection in the AWS console.

Answer

Configure static routes for the second tunnel.

Answer

Assign different BGP ASNs to each tunnel.

Question 12

An organization is using AWS Direct Connect with a private VIF to connect to a VPC. They want to extend connectivity to multiple VPCs in the same region without creating multiple private VIFs. Which solution should they implement?

Accepted Answer

Create a Direct Connect gateway and associate it with a Transit Gateway that is attached to the VPCs.. A Direct Connect gateway allows you to associate a single private VIF with multiple VPCs in the same region by connecting to a Transit Gateway. The Transit Gateway then acts as a hub, enabling transitive routing between all attached VPCs without needing separate VIFs. This solution scales efficiently and avoids the complexity of managing multiple private VIFs.

Answer

Create VPC peering connections from the VPC with the Direct Connect VIF to the other VPCs.

Answer

Provision separate private VIFs for each VPC.

Answer

Use a Transit VIF to connect directly to a Transit Gateway.

Question 13

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?

Accepted Answer

Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.. A NAT gateway in the public subnet provides outbound internet access for instances in the private subnet while preventing inbound connections from the internet. By adding a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT gateway, traffic from the EC2 instance destined for the internet is forwarded to the NAT gateway, which then uses its Elastic IP to communicate with the internet. This allows the instance to download patches without requiring a public IP or direct internet gateway access.

Answer

Launch a NAT instance in the private subnet and configure source/destination check.

Answer

Create a VPC endpoint for the patch service.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.

Question 14

An organization is designing a hybrid network using AWS Direct Connect with a private VIF. They want to ensure high availability and failover. Which THREE components should be part of the design?

Accepted Answer

Two separate Direct Connect connections from different providers or locations.. Using two separate Direct Connect connections from different providers or locations ensures physical diversity, eliminating single points of failure. This design meets the high availability requirement by providing redundant paths for traffic, even if one connection or provider experiences an outage.

Answer

A NAT gateway in each Availability Zone.

Answer

A single Direct Connect connection with multiple VLANs.

Question 15

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?

Accepted Answer

The authorization rules allow access to the VPC's CIDR.. Authorization rules in AWS Client VPN define which networks (CIDRs) users are allowed to access. If the rule does not include the VPC's CIDR, traffic to resources in the VPC will be dropped even though the VPN tunnel is established. This is a common misconfiguration that prevents resource reachability.

Answer

The Client VPN endpoint has a public IP address.

Answer

The client certificate is issued by a valid CA.