ANS-C01 Network Implementation Practice Test 25 — 15 Questions

Question 1

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Two Direct Connect connections at two different AWS Direct Connect locations. Deploying two Direct Connect connections at two different AWS Direct Connect locations provides physical and logical redundancy. This ensures that if one location experiences an outage, the other location can continue to handle traffic, meeting the high availability requirement. AWS recommends this architecture for production workloads requiring resilient hybrid connectivity.

Answer

One Direct Connect connection and one AWS Site-to-Site VPN as backup

Answer

Two virtual interfaces (VIFs) on the same Direct Connect connection

Answer

Two Direct Connect connections at the same AWS Direct Connect location

Question 2

A company is troubleshooting high latency on an AWS Direct Connect connection. The network team notices that the latency increases during peak hours. The connection uses a single virtual interface (VIF) with a 1 Gbps capacity. What is the MOST likely cause of the latency?

Accepted Answer

The bandwidth limit of the virtual interface is being exceeded. The most likely cause of increased latency during peak hours is that the bandwidth limit of the virtual interface (VIF) is being exceeded. When traffic approaches or surpasses the 1 Gbps capacity, the router's egress queue begins to fill, causing packet buffering and queuing delay. This queuing delay directly manifests as higher round-trip time (RTT) and is a classic symptom of link saturation.

Answer

The VLAN ID is mismatched between the customer router and AWS

Answer

Jumbo frames are not enabled on the customer router

Answer

BGP keepalive timers are set too high

Question 3

A company needs to connect multiple VPCs to a common on-premises network through a single AWS Direct Connect connection. Which AWS service should be used to simplify this architecture?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks through a single Direct Connect connection. It simplifies the architecture by replacing complex mesh or star topologies with a single gateway that manages routing and attachments, reducing operational overhead and cost.

Answer

AWS VPN CloudHub

Answer

VPC peering

Answer

Virtual Private Gateway (VGW)

Question 4

A company is implementing a multi-region active-active application. They want to route users to the nearest healthy endpoint using DNS. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic based on the lowest network latency between the user and the endpoint, making it ideal for routing users to the nearest healthy endpoint in a multi-region active-active setup. It continuously monitors endpoint health via health checks and only routes to healthy endpoints, ensuring high availability and performance.

Answer

Elastic Load Balancer (ELB)

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 5

A company is setting up a new VPC with both IPv4 and IPv6 support. They need to ensure that instances in a private subnet can access the Internet for software updates. Which combination of resources is required?

Accepted Answer

NAT gateway and egress-only internet gateway. For IPv6 traffic, an egress-only internet gateway allows outbound-only internet access from private subnets, while a NAT gateway provides similar functionality for IPv4 traffic. Together, they enable instances in a private subnet to initiate outbound connections to the internet for software updates without allowing inbound connections from the internet.

Answer

VPC endpoint and internet gateway

Answer

NAT instance and internet gateway

Answer

Internet gateway and NAT gateway

Question 6

A company is deploying a web application across multiple Availability Zones in a single region. They want to distribute incoming traffic evenly across all healthy EC2 instances. Which AWS service should be used as the entry point?

Accepted Answer

Application Load Balancer (ALB). An Application Load Balancer (ALB) operates at Layer 7 and can distribute HTTP/HTTPS traffic across multiple targets in different Availability Zones. It supports health checks and round-robin routing to evenly distribute incoming requests across healthy EC2 instances, making it the correct entry point for a web application requiring even traffic distribution across AZs.

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53 with simple routing

Question 7

A network engineer is troubleshooting connectivity issues between an on-premises network and a VPC over a Direct Connect private VIF. The on-premises network can reach EC2 instances in the VPC, but cannot reach an RDS database in the same VPC. The VPC has a single subnet. What is the MOST likely cause?

Accepted Answer

The RDS database security group is not allowing inbound traffic from the on-premises CIDR. Since the on-premises network can reach EC2 instances but not the RDS database, the issue is likely at the security group level, not the network ACL or routing. Security groups are stateful and act as a virtual firewall for instances; by default, they deny all inbound traffic unless explicitly allowed. The RDS database's security group must have an inbound rule permitting traffic from the on-premises CIDR range, and its absence would block the connection while leaving EC2 access unaffected.

Answer

The VPC network ACL is blocking inbound traffic from on-premises

Answer

The direct connect virtual interface is configured for a different VLAN

Answer

The VPC route table does not have a route to the on-premises network

Question 8

A company needs to establish a dedicated, private, high-bandwidth connection between its on-premises data center and AWS. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center to AWS, bypassing the public internet. This is achieved through a physical cross-connect at an AWS Direct Connect location, delivering consistent latency and higher throughput compared to internet-based connections.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering

Question 9

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

Accepted Answer

The Application Load Balancer.. AWS WAF is a web application firewall that protects web resources from common exploits like SQL injection. It integrates directly with Application Load Balancers (ALBs) by allowing you to associate a web ACL with the ALB, which inspects HTTP/HTTPS traffic before it reaches the backend EC2 instances. This is the only supported integration point among the options for protecting application-layer traffic in this architecture.

Answer

Amazon Route 53 hosted zone.

Answer

The security group of the EC2 instances.

Answer

The VPC internet gateway.

Question 10

A company is deploying an AWS Client VPN endpoint to provide remote access to its VPC resources. The company wants to allow clients to access resources in multiple subnets within the VPC. Which TWO configurations are necessary?

Accepted Answer

Associate the Client VPN endpoint with subnets in the VPC.. Associating the Client VPN endpoint with subnets in the VPC is required to establish the network connectivity between the VPN clients and the VPC. The Client VPN endpoint uses elastic network interfaces in the associated subnets to route traffic from clients into the VPC. Without this association, the endpoint cannot forward traffic to VPC resources.

Answer

Configure route tables in the VPC to direct traffic to the Client VPN endpoint.

Answer

Attach the VPC to a transit gateway.

Answer

Configure security groups on the target subnets.

Question 11

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets are used for NAT gateways and an Application Load Balancer (ALB). The private subnets host EC2 instances running a web application. What is the most cost-effective and highly available configuration for internet access from the private instances?

Accepted Answer

Deploy a NAT gateway in each public subnet and configure private route tables with a default route to the NAT gateway in the same AZ.. Deploying a NAT gateway in each public subnet (one per Availability Zone) ensures that private instances in each AZ can route outbound traffic through a NAT gateway in the same AZ, providing both high availability (no single point of failure) and cost efficiency (no cross-AZ data transfer charges). This configuration uses the default route (0.0.0.0/0) in the private route tables pointing to the NAT gateway in the same AZ, which avoids the per-GB data transfer costs that would occur if traffic crossed AZs to reach a single NAT gateway.

Answer

Create a single NAT gateway in one public subnet and route all private traffic to it.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnets.

Answer

Launch a NAT instance in each public subnet and configure the private route tables.

Question 12

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to inspect traffic between VPCs using a centralized network virtual appliance (NVA) in a security VPC. What is the most scalable and highly available design to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway, use separate route tables for inspection, and deploy NVAs behind a Gateway Load Balancer in the security VPC.. It uses Transit Gateway with separate route tables to isolate inspection traffic, and deploys NVAs behind a Gateway Load Balancer (GWLB) in the security VPC. GWLB provides automatic scaling and health checks across multiple NVAs, ensuring high availability and scalability for inter-VPC traffic inspection without introducing a single point of failure or manual routing complexity.

Answer

Place a single NVA in the Transit Gateway and route all inter-VPC traffic through it.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure the NVAs to route traffic.

Answer

Use Direct Connect to connect all VPCs to a central location and route through NVAs there.

Question 13

A company is designing a multi-region architecture with two AWS Regions. They need to connect VPCs in each region to an on-premises data center using AWS Direct Connect. They want to minimize latency and use the same BGP ASN on both sides. Which solution meets these requirements?

Accepted Answer

Use a Direct Connect gateway and create a private virtual interface from each region's Direct Connect connection to the Direct Connect gateway. Use the same BGP ASN on AWS side.. A Direct Connect gateway allows you to associate private virtual interfaces from multiple regions, enabling a single BGP ASN to be used on the AWS side across all connections. This minimizes latency by providing direct, private connectivity from each region to the on-premises data center without traversing the public internet. The ability to use the same BGP ASN on both sides is supported because the Direct Connect gateway presents itself as a single BGP speaker, avoiding ASN conflicts.

Answer

Establish two separate private virtual interfaces from each region to the on-premises router using different BGP ASNs.

Answer

Use AWS Site-to-Site VPN over the internet as a backup and the Direct Connect as primary.

Answer

Create a transit virtual interface from each region to a Transit Gateway in each region and peer the Transit Gateways.

Question 14

A company uses AWS Client VPN for remote access. Users report intermittent disconnections. The network engineer notices that the Client VPN endpoint is associated with a single subnet. What change should be made to improve reliability?

Accepted Answer

Associate the Client VPN endpoint with subnets in at least two Availability Zones.. Associating the Client VPN endpoint with subnets in at least two Availability Zones provides high availability for the VPN tunnel endpoints. If a single subnet (and its underlying AZ) fails or experiences network issues, the Client VPN endpoint can still route traffic through the other AZ's subnet, preventing the intermittent disconnections users are experiencing.

Answer

Split the client CIDR into smaller ranges for each Availability Zone.

Answer

Create multiple route tables for the same subnet.

Answer

Increase the subnet CIDR size to accommodate more clients.

Question 15

A company has a VPC with both IPv4 and IPv6 CIDRs. They need to allow outbound IPv6 traffic from private subnets to the internet. What should they use?

Accepted Answer

An egress-only internet gateway.. An egress-only internet gateway (EIGW) is a horizontally scaled, redundant VPC component that allows outbound IPv6 traffic from instances in a VPC to the internet, while preventing the internet from initiating an IPv6 connection to those instances. It is specifically designed for IPv6 traffic and must be used with a route table entry that directs all outbound IPv6 traffic (::/0) to the EIGW. Unlike an internet gateway, an EIGW does not support inbound IPv6 connections, making it the correct choice for private subnets that need outbound-only IPv6 internet access.

Answer

An internet gateway attached to the VPC.

Answer

A customer-managed prefix list.

Answer

A NAT gateway in a public subnet.