ANS-C01 Network Implementation Practice Test 24 — 15 Questions

Question 1

A company is using CloudFormation to deploy a VPC. The private subnet route table has a route to a NAT gateway. However, instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet and has an attached Elastic IP. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The NAT gateway's security group is blocking traffic from the private subnet.. The NAT gateway has a security group that by default denies all inbound traffic. For instances in the private subnet to send traffic to the internet, the NAT gateway's security group must allow inbound traffic from the private subnet's CIDR (or from the private subnet's network ACLs) and allow outbound traffic to the internet. Option D is correct because this is the most likely issue: the security group is blocking traffic. Option A is incorrect because the public subnet route to the IGW is presumptively configured correctly for the NAT gateway to reach the internet. Option B is incorrect because the route to the NAT gateway is present in the private route table. Option C is incorrect because the NAT gateway does not need to be in the same subnet as the private instances; it must be in a public subnet.

Answer

The public subnet does not have a route to the internet gateway.

Answer

The private subnet route table does not have a route to the NAT gateway.

Answer

The NAT gateway is not in the same subnet as the private instances.

Question 2

A company is deploying a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for software updates but must not be reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing the internet from initiating connections back to those instances. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate private source IPs to the gateway's public IP, ensuring the private instances remain unreachable from external hosts.

Answer

VPC Peering

Answer

Virtual Private Gateway

Answer

Internet Gateway

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. They want to use the same connection to access another VPC in a different region. What is the simplest way to achieve this?

Accepted Answer

Use a Direct Connect Gateway. A Direct Connect Gateway (DX Gateway) allows you to associate a single private virtual interface (VIF) with multiple VPCs, even across different AWS regions. This is the simplest solution because it avoids creating additional VIFs or complex inter-VPC connectivity, and it supports transitive routing between the on-premises network and all associated VPCs via the same Direct Connect connection.

Answer

Create a new private VIF for the second VPC

Answer

Use a VPN over the internet to connect the VPCs

Answer

Set up VPC peering between the two VPCs

Question 4

A network engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint allows private subnet resources to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3-bound traffic to a highly available, horizontally scaled gateway endpoint, avoiding NAT or internet gateway costs and latency.

Answer

VPC Peering

Answer

Internet Gateway

Answer

NAT Gateway

Question 5

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?

Accepted Answer

Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it. The best approach is to create a dedicated firewall VPC that hosts the third-party firewall appliance and use Transit Gateway (TGW) route tables to steer inter-VPC traffic through that VPC. By attaching the firewall VPC to the TGW and configuring route tables with static routes pointing to the firewall VPC attachment, all traffic between other VPCs can be forced to traverse the firewall for inspection. This provides centralized, scalable traffic inspection without requiring changes to individual VPC routing or security group configurations.

Answer

Use VPC security groups across VPCs

Answer

Use AWS Network Firewall directly in each VPC

Answer

Use network ACLs on each VPC subnet

Question 6

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They also have a VPN connection as a backup. How should they configure BGP to ensure that the VPN is only used when Direct Connect fails?

Accepted Answer

Use a higher local preference on the Direct Connect BGP session. Local preference is a BGP attribute used to influence outbound traffic from an AS. By setting a higher local preference on the Direct Connect BGP session, the router will prefer that path over the VPN session. When Direct Connect fails, the BGP session goes down, and the VPN route becomes the only available path, ensuring seamless failover.

Answer

Use a lower local preference on the Direct Connect BGP session

Answer

Use a lower AS path prepend on the VPN BGP session

Answer

Use a higher MED on the VPN BGP session

Question 7

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. What should be done to avoid overlapping CIDRs?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources. AWS Site-to-Site VPN requires non-overlapping IP CIDRs between the VPC and the on-premises network for proper routing. The VPC uses 10.0.0.0/16, which falls entirely within the on-premises 10.0.0.0/8, causing a conflict that prevents the VPN from establishing routes correctly. Creating a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) and migrating resources resolves the overlap, enabling the VPN connection.

Answer

Configure a VPN with overlapping CIDRs, it will still work

Answer

Use NAT on the customer gateway to translate addresses

Answer

Use VPC peering to connect to on-premises

Question 8

A company has a VPC with an IPv6 CIDR and wants to provide internet access to instances in a private subnet using IPv6. Which AWS service should be used?

Accepted Answer

Egress-Only Internet Gateway. An Egress-Only Internet Gateway (EIGW) is the correct AWS service for providing outbound-only IPv6 internet access to instances in a private subnet. Unlike IPv4, IPv6 addresses are globally unique and publicly routable by default, so a NAT-like translation is unnecessary; the EIGW allows outbound traffic while preventing unsolicited inbound connections, aligning with the private subnet's security posture.

Answer

VPC Gateway Endpoint

Answer

Internet Gateway

Answer

NAT Gateway

Question 9

A company wants to provide internet access to instances in a public subnet. Which component must be attached to the VPC and have a route to it in the subnet's route table?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For instances in a public subnet to have outbound internet access and be reachable from the internet, the IGW must be attached to the VPC, and the subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW as the target.

Answer

Transit Gateway

Answer

Virtual Private Gateway

Answer

NAT Gateway

Question 10

Which TWO of the following are valid methods to connect an on-premises data center to an Amazon VPC over a private, dedicated network connection? (Choose two.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private connection. AWS VPN can also be used over the internet but is not dedicated; however, a VPN over Direct Connect is possible. The question asks for 'private, dedicated network connection', so Direct Connect is the primary method. VPN over internet is not dedicated. VPN over Direct Connect uses the dedicated connection.

Answer

VPC peering

Answer

AWS Site-to-Site VPN over the internet

Answer

AWS Client VPN

Question 11

Which THREE of the following are benefits of using AWS Transit Gateway over VPC peering for inter-VPC connectivity? (Choose three.)

Accepted Answer

Transitive routing between all attached VPCs. AWS Transit Gateway enables transitive routing, meaning that traffic can flow between any attached VPCs without needing a full mesh of VPC peering connections. With VPC peering, each pair of VPCs requires a separate peering connection, and transitive routing is not supported — traffic cannot hop from one peered VPC to another. Transit Gateway acts as a hub-and-spoke router, simplifying connectivity and scaling to hundreds of VPCs.

Answer

Lower latency than VPC peering

Answer

No additional cost compared to VPC peering

Question 12

Which THREE of the following are valid configurations for an AWS Direct Connect virtual interface? (Choose three.)

Accepted Answer

Private virtual interface. AWS Direct Connect supports three types of virtual interfaces: private, public, and transit. A private virtual interface (B) connects your on-premises network to an Amazon VPC using private IP addresses. A public virtual interface (E) provides access to AWS public services (e.g., S3, DynamoDB) over the Direct Connect link. A transit virtual interface (D) enables connectivity from a Direct Connect gateway to one or more transit gateways, allowing access to multiple VPCs and VPN connections. All three are valid configurations.

Answer

VPN virtual interface

Answer

Hosted virtual interface

Question 13

A network engineer created a VPC endpoint for the service shown in the exhibit. The endpoint is in the 'available' state, but instances in the VPC cannot resolve the private DNS name 'example.com'. What is the most likely cause?

Accepted Answer

The endpoint does not have 'Private DNS names enabled'. The private DNS name is only resolved via Route 53 private hosted zone if 'Private DNS names enabled' is set. The exhibit shows the service has a PrivateDnsName, but the endpoint must have 'Private DNS names enabled' for resolution to work.

Answer

The VPC does not have a Route 53 private hosted zone for example.com

Answer

The VPC does not have an internet gateway

Answer

The security group for the endpoint is blocking DNS traffic

Question 14

A company has an S3 bucket with the bucket policy shown. The VPC endpoint ID is correct. However, an EC2 instance in a private subnet in the same VPC cannot download objects from the bucket. What is a possible reason?

Accepted Answer

The EC2 instance is accessing S3 via a NAT Gateway instead of the VPC endpoint. The bucket policy likely includes a condition that restricts access to only requests originating from the VPC endpoint (e.g., `aws:sourceVpce`). If the EC2 instance in the private subnet routes traffic through a NAT Gateway instead of the VPC endpoint, the source IP will be the NAT Gateway's public IP, not the VPC endpoint's private IP, causing the condition to fail and the request to be denied. The instance can still reach S3 via the NAT Gateway, but the policy explicitly blocks non-endpoint traffic.

Answer

The EC2 instance does not have a route to the VPC endpoint

Answer

The bucket policy does not allow s3:ListBucket

Answer

The VPC endpoint security group is blocking traffic

Question 15

A network engineer created the CloudFormation stack shown. After creation, an EC2 instance launched in PublicSubnet does not have a public IP address. What is the most likely reason?

Accepted Answer

The VPC does not have an Internet Gateway attached. An EC2 instance in a public subnet requires an Internet Gateway (IGW) attached to the VPC to receive a public IP address. Without an IGW, the instance cannot be assigned a public IP or communicate with the internet, even if the subnet is configured to auto-assign public IPs. The CloudFormation stack likely omitted the IGW resource or its attachment to the VPC, leaving the VPC isolated.

Answer

The subnet does not have an Internet Gateway attached

Answer

The subnet's route table does not have a route to a NAT Gateway

Answer

The instance type does not support public IP addresses