ANS-C01 Network Implementation Practice Test 25 — 15 Questions

Question 1

A network engineer is designing a hybrid network using AWS Direct Connect. The company requires high availability and wants to use a single AWS Direct Connect location with two connections from different customer routers. Which solution meets the high availability requirement?

Accepted Answer

Use two AWS Direct Connect connections from the same location, each connected to a different customer router, and configure BGP sessions over both connections. Option A is correct because using two connections (primary and backup) from different customer routers to the same Direct Connect location provides redundancy at the router level. Option B is wrong because a single connection is a single point of failure. Option C is wrong because multiple VLANs on one connection do not provide physical redundancy. Option D is wrong because BFD does not provide physical redundancy.

Answer

Use a single AWS Direct Connect connection with multiple VLANs

Answer

Use a single AWS Direct Connect connection with two BGP sessions

Answer

Use a single AWS Direct Connect connection with Bidirectional Forwarding Detection (BFD) enabled

Question 2

A company is deploying a multi-region application with an Application Load Balancer (ALB) in us-east-1 and a second ALB in eu-west-1. They want to route traffic to the nearest region using Amazon Route 53. They have set up a latency-based routing policy. Users in North America are being routed to eu-west-1 instead of us-east-1. What is the most likely cause?

Accepted Answer

Latency measurements between the user and us-east-1 are higher than expected due to transient network conditions. Option B is correct because latency-based routing uses measured latency, which can be inconsistent. If the latency measurement for us-east-1 is higher than expected (e.g., due to a temporary issue), Route 53 may route to eu-west-1. Option A is wrong because health checks affect routing only if they fail, but the question doesn't indicate failure. Option C is wrong because routing policy is already set to latency. Option D is wrong because weight is not used in latency routing.

Answer

The routing policy is incorrectly configured as geolocation instead of latency

Answer

The us-east-1 ALB is not associated with a Route 53 record set

Answer

The health checks for the us-east-1 ALB are failing

Question 3

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises the 10.0.0.0/8 prefix. One VPC has a route to the Transit Gateway for 0.0.0.0/0. Instances in that VPC can reach the internet via a NAT gateway but cannot reach on-premises resources. What is the most likely issue?

Accepted Answer

The VPC route table does not have a route to the on-premises CIDR via the Transit Gateway. Option D is correct because the more specific 10.0.0.0/8 route from on-premises should be preferred over the default route. If propagation is not enabled, the route is missing. Option A is wrong because the NAT gateway is for internet access, not on-premises. Option B is wrong because security groups can block traffic but the question implies connectivity issue due to routing. Option C is wrong because Direct Connect bandwidth does not affect routing.

Answer

The security group of the instances does not allow inbound traffic from on-premises

Answer

The Direct Connect virtual interface is not associated with the Transit Gateway

Answer

The on-premises router is not advertising the 10.0.0.0/8 prefix to AWS

Question 4

A company is setting up an AWS Client VPN endpoint for remote access. Users report they can connect to the VPN but cannot access resources in the VPC. The VPN endpoint is associated with a subnet that has a route table with a route to an internet gateway. The security group for the VPN endpoint allows all traffic. What could be the issue?

Accepted Answer

The route table associated with the VPN subnet does not have a route to the VPC CIDR. Option C is correct because the route table associated with the VPN subnet must have a route to the VPC CIDR via the VPN endpoint's network interface. Option A is wrong because authorization rules are for user access, not routing. Option B is wrong because client CIDR allocation is for VPN IPs. Option D is wrong because security group allows all traffic.

Answer

The authorization rules for the VPN endpoint do not include the VPC CIDR

Answer

The security group for the VPN endpoint does not allow outbound traffic

Answer

The client CIDR range overlaps with the VPC CIDR

Question 5

A company uses AWS Direct Connect with a public VIF to access Amazon S3. They notice that traffic to S3 is taking a suboptimal path (going through the internet) instead of the Direct Connect connection. The VPC has a route table with a route for S3 prefix list via the virtual private gateway. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the S3 prefix list via BGP over the public VIF. Option A is correct because Direct Connect public VIF routes are learned via BGP, and if the on-premises router does not advertise the S3 prefix, traffic may go over the internet. Option B is wrong because a private VIF is for VPC access, not public services. Option C is wrong because VPC endpoints are for private connectivity, but issue is with Direct Connect public VIF. Option D is wrong because the route table has a route for the prefix list.

Answer

The VPC does not have a VPC endpoint for S3

Answer

The public VIF is not associated with the correct Direct Connect gateway

Answer

The route table in the VPC does not have a route to the S3 prefix list via the virtual private gateway

Question 6

A company is implementing a network for a three-tier application in a VPC. They need to ensure that the web tier can communicate with the application tier, but the application tier cannot initiate connections to the web tier. Which configuration should be used?

Accepted Answer

Use security groups on the application tier instances to allow inbound from the web tier security group, and do not allow inbound from application tier in the web tier security group. Option B is correct because a stateful firewall like security groups can allow inbound from web to app while blocking inbound from app to web. Option A is wrong because network ACLs are stateless and require separate rules for inbound and outbound, making it more complex. Option C is wrong because a reverse proxy is unnecessary. Option D is wrong because a transit gateway is for inter-VPC routing, not for this requirement.

Answer

Use network ACLs on the application tier subnets to allow inbound from web tier and block outbound to web tier

Answer

Use a transit gateway with route tables to control traffic flow

Answer

Place a reverse proxy between the tiers

Question 7

A company has an AWS Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to use BGP attributes to prefer the Direct Connect path. On the customer router, they set a lower local preference for routes received via the VPN. However, traffic still uses the VPN. What could be the reason?

Accepted Answer

Local preference is not supported by AWS for BGP sessions; use AS path prepending instead. Option D is correct because AWS does not honor local preference set by the customer; AS path prepending is the standard method. Option A is wrong because MED is used to influence inbound traffic from AWS. Option B is wrong because BFD is for fast failure detection. Option C is wrong because weight is a Cisco-proprietary attribute not used in AWS.

Answer

The weight attribute is set higher on the VPN routes

Answer

Bidirectional Forwarding Detection (BFD) is not enabled on the Direct Connect connection

Answer

The BGP MED attribute is not set on the VPN routes

Question 8

A company is deploying a VPC with public and private subnets. They want to allow instances in a private subnet to access the internet for software updates while preventing inbound internet traffic. Which configuration should be used?

Accepted Answer

Attach an internet gateway to the VPC, and create a NAT gateway in a public subnet. Add a route in the private subnet route table to the NAT gateway for 0.0.0.0/0. Option A is correct because a NAT gateway in a public subnet allows outbound internet access from private subnets while blocking inbound traffic. Option B is wrong because an internet gateway allows inbound traffic. Option C is wrong because a VPC endpoint is for specific AWS services, not general internet. Option D is wrong because a transit gateway is for inter-VPC routing.

Answer

Create a VPC endpoint for internet access

Answer

Use a transit gateway with a NAT instance

Answer

Attach an internet gateway to the VPC and add a route in the private subnet to the internet gateway for 0.0.0.0/0

Question 9

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in multiple Availability Zones. Which TWO configurations are required to achieve high availability?

Accepted Answer

The ALB must be configured with subnets in at least two Availability Zones. Option A is correct because ALB must have subnets in at least two Availability Zones. Option B is correct because the ALB must be internet-facing to be accessible from the internet. Option C is wrong because cross-zone load balancing is enabled by default and not required for high availability. Option D is wrong because a single NAT gateway is a single point of failure. Option E is wrong because a single instance per AZ is sufficient.

Answer

At least three EC2 instances must be registered with the ALB

Answer

A NAT gateway must be deployed in each Availability Zone

Answer

Cross-zone load balancing must be enabled on the ALB

Question 10

A company is implementing a network segmentation strategy using AWS Transit Gateway. They have three VPCs: production, development, and shared services. They need to ensure that production and development VPCs can both access shared services, but cannot communicate with each other. Which THREE configurations are required?

Accepted Answer

Create a route table for the shared services VPC that allows routes to both production and development. Option A is correct because each VPC must be attached to the transit gateway. Option B is correct because route tables must be created to control routing. Option C is correct because the shared services VPC needs a route table that allows traffic from both production and development. Option D is wrong because VPC peering is not needed. Option E is wrong because a single route table would allow all-to-all communication.

Answer

Create a VPC peering connection between production and development

Answer

Use a single transit gateway route table for all attachments

Question 11

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. Which TWO components are required for the VPN connection?

Accepted Answer

Customer gateway. Option A is correct because a virtual private gateway is the AWS-side VPN concentrator. Option B is correct because a customer gateway represents the on-premises router. Option C is wrong because a Direct Connect connection is a separate service. Option D is wrong because a transit gateway is optional. Option E is wrong because a VPN connection is the VPN itself, not a component.

Answer

Transit gateway

Answer

VPN connection

Answer

Direct Connect connection

Question 12

A company is setting up a Direct Connect connection between its on-premises data center and AWS. The company wants to use a single virtual interface (VIF) to access multiple VPCs in the same AWS Region. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway allows you to associate a single virtual interface with multiple VPCs in the same region or across regions. Option A is incorrect because a VPC peering connection does not use Direct Connect. Option C is incorrect because a VPN connection is a different service. Option D is incorrect because a Transit VPC is an architectural pattern, not a service.

Answer

VPC peering connection

Answer

AWS VPN CloudHub

Answer

Transit VPC

Question 13

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses, but they cannot reach an internet-facing application hosted on an EC2 instance in a public subnet. The EC2 instance has a public IP and a security group allowing HTTP/HTTPS from 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The private VIF does not route traffic to public IP addresses; the on-premises traffic to the public IP must traverse the internet.. The issue is that the private VIF uses private IP addresses, and traffic from on-premises to the public IP of the EC2 instance will not go over the private VIF; it must go over the internet. Option A is correct because the private VIF only routes private IPs. Option B is incorrect because the security group allows all inbound HTTP/HTTPS. Option C is incorrect because the route table can have a default route to an internet gateway. Option D is incorrect because BGP is typically used for prefix exchange and would not block traffic to public IPs.

Answer

The route table in the public subnet does not have a default route to an internet gateway.

Answer

The security group is blocking traffic from the on-premises IP range.

Answer

The BGP session is not exchanging routes for the public IP range.

Question 14

A company is deploying a multi-region application using two AWS Regions. They want to use an AWS Transit Gateway to interconnect VPCs within each region, and they need to interconnect the Transit Gateways across regions. Which is the most scalable and reliable approach?

Accepted Answer

Use Transit Gateway peering attachments between the Transit Gateways in each region.. AWS Transit Gateway supports inter-region peering, which is the recommended method for connecting Transit Gateways across regions. Option A is correct. Option B is incorrect because VPC peering does not natively interconnect Transit Gateways. Option C is incorrect because Direct Connect can connect on-premises to multiple regions but is not designed primarily for interconnecting Transit Gateways. Option D is incorrect because VPN connections add complexity and lower throughput compared to Transit Gateway peering.

Answer

Create a VPC peering connection between VPCs in different regions and attach them to the Transit Gateways.

Answer

Use AWS Site-to-Site VPN connections between the Transit Gateways in each region.

Answer

Set up a Direct Connect gateway with virtual interfaces in each region and propagate routes.

Question 15

A company is deploying a VPC with both public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which AWS service should be placed in a public subnet to enable this?

Accepted Answer

NAT gateway. A NAT gateway (or NAT instance) in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is correct. Option B is incorrect because an internet gateway is in a VPC but does not allow private instances to initiate outbound traffic without a NAT. Option C is incorrect because a VPC endpoint is for private connectivity to AWS services, not internet access. Option D is incorrect because a Direct Connect virtual interface is for hybrid connectivity, not internet access.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Direct Connect virtual interface