ANS-C01 Network Implementation Practice Test 25 — 15 Questions

Question 1

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have route tables that include routes to each other's CIDR blocks via the peering connection. Instances in VPC A can ping instances in VPC B, but traffic to an Application Load Balancer (ALB) in VPC B fails. The ALB is in public subnets with internet-facing scheme. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ALB security group does not allow inbound traffic from VPC A. The most likely cause is that the ALB's security group does not allow inbound traffic from VPC A. Even though the VPC peering connection is properly configured and ICMP traffic (ping) works, HTTP/HTTPS traffic to the ALB is controlled by security groups. The ALB's security group must explicitly permit inbound traffic from the CIDR block of VPC A (10.0.0.0/16) or from the security group of the instances in VPC A. Without this rule, the ALB will drop the traffic, even though the network path is functional.

Answer

The VPC peering connection does not support transitive routing for ALBs

Answer

The ALB is internet-facing and cannot be accessed from a peered VPC

Answer

The route tables in VPC B do not have a route back to VPC A

Question 2

A network engineer is designing a hybrid network using AWS Direct Connect. The company requires high availability and wants to use a single AWS Direct Connect location with two connections from different customer routers. Which solution meets the high availability requirement?

Accepted Answer

Use two AWS Direct Connect connections from the same location, each connected to a different customer router, and configure BGP sessions over both connections. It provides two physically separate AWS Direct Connect connections from the same location, each terminating on a different customer router. This architecture eliminates single points of failure at both the connection and router level. By configuring BGP sessions over both connections, the network can use BGP path selection and failover mechanisms (e.g., AS_PATH prepending or MED) to achieve high availability. This design meets the requirement for a single location while ensuring redundancy against a router or connection failure.

Answer

Use a single AWS Direct Connect connection with multiple VLANs

Answer

Use a single AWS Direct Connect connection with two BGP sessions

Answer

Use a single AWS Direct Connect connection with Bidirectional Forwarding Detection (BFD) enabled

Question 3

A company is deploying a multi-region application with an Application Load Balancer (ALB) in us-east-1 and a second ALB in eu-west-1. They want to route traffic to the nearest region using Amazon Route 53. They have set up a latency-based routing policy. Users in North America are being routed to eu-west-1 instead of us-east-1. What is the most likely cause?

Accepted Answer

Latency measurements between the user and us-east-1 are higher than expected due to transient network conditions. Latency-based routing in Route 53 selects the region with the lowest measured latency for the user. If transient network conditions cause higher-than-normal latency between the user and us-east-1, Route 53 may route traffic to eu-west-1 despite the geographic proximity. This is the most likely cause because the question states the routing policy is already set to latency, and transient conditions can skew measurements.

Answer

The routing policy is incorrectly configured as geolocation instead of latency

Answer

The us-east-1 ALB is not associated with a Route 53 record set

Answer

The health checks for the us-east-1 ALB are failing

Question 4

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises the 10.0.0.0/8 prefix. One VPC has a route to the Transit Gateway for 0.0.0.0/0. Instances in that VPC can reach the internet via a NAT gateway but cannot reach on-premises resources. What is the most likely issue?

Accepted Answer

The VPC route table does not have a route to the on-premises CIDR via the Transit Gateway. The VPC route table must have a specific route for the on-premises CIDR (10.0.0.0/8) pointing to the Transit Gateway. Without it, traffic destined for on-premises will use the 0.0.0.0/0 default route and go to the NAT gateway instead of the Transit Gateway. Option A is incorrect because the issue is routing, not security groups. Option B is incorrect because the Direct Connect virtual interface must be associated with the Transit Gateway for connectivity, but the question states it is connected, and the problem is likely missing specific routes. Option D is incorrect because the on-premises router is advertising the prefix, but the VPC route table lacks the specific route.

Answer

The security group of the instances does not allow inbound traffic from on-premises

Answer

The Direct Connect virtual interface is not associated with the Transit Gateway

Answer

The on-premises router is not advertising the 10.0.0.0/8 prefix to AWS

Question 5

A company is setting up an AWS Client VPN endpoint for remote access. Users report they can connect to the VPN but cannot access resources in the VPC. The VPN endpoint is associated with a subnet that has a route table with a route to an internet gateway. The security group for the VPN endpoint allows all traffic. What could be the issue?

Accepted Answer

The route table associated with the VPN subnet does not have a route to the VPC CIDR. The VPN endpoint is associated with a subnet, and that subnet's route table must include a route to the VPC CIDR to allow traffic from VPN clients to reach VPC resources. Without this route, packets from VPN clients are dropped because the subnet does not know how to forward them to the VPC. Option A is correct. Option B is incorrect because authorization rules control user access to specific destinations, but they do not affect routing; if the route is missing, traffic never reaches the VPC regardless of authorization. Option C is incorrect because the security group allows all traffic, so it is not blocking access. Option D is incorrect because while client CIDR overlap could cause issues, users can connect to the VPN, indicating no overlap; the primary issue is the missing route.

Answer

The authorization rules for the VPN endpoint do not include the VPC CIDR

Answer

The security group for the VPN endpoint does not allow outbound traffic

Answer

The client CIDR range overlaps with the VPC CIDR

Question 6

A company uses AWS Direct Connect with a public VIF to access Amazon S3. They notice that traffic to S3 is taking a suboptimal path (going through the internet) instead of the Direct Connect connection. The VPC has a route table with a route for S3 prefix list via the virtual private gateway. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the S3 prefix list via BGP over the public VIF. For traffic to use the Direct Connect public VIF, the on-premises router must advertise the specific prefixes (e.g., S3 prefix list) via BGP over the public VIF. Without this advertisement, the on-premises router will not have a route pointing to the Direct Connect link for S3 traffic, causing it to fall back to the internet path. The VPC route table already has a route for the S3 prefix list via the virtual private gateway, so the issue lies in the BGP advertisement from the on-premises side.

Answer

The VPC does not have a VPC endpoint for S3

Answer

The public VIF is not associated with the correct Direct Connect gateway

Answer

The route table in the VPC does not have a route to the S3 prefix list via the virtual private gateway

Question 7

A company is implementing a network for a three-tier application in a VPC. They need to ensure that the web tier can communicate with the application tier, but the application tier cannot initiate connections to the web tier. Which configuration should be used?

Accepted Answer

Use security groups on the application tier instances to allow inbound from the web tier security group, and do not allow inbound from application tier in the web tier security group. Security groups are stateful and can be configured to allow inbound traffic from the web tier security group to the application tier instances, while the web tier security group only allows inbound from the application tier's security group on specific ports (if needed) and does not allow inbound from the application tier. This prevents the application tier from initiating connections to the web tier. Option A is wrong because network ACLs are stateless and would require explicit inbound and outbound rules to control the direction, but they do not track connection state and are more complex to configure for this requirement. Option B is wrong because a transit gateway is used for connecting multiple VPCs or on-premises networks, not for controlling traffic direction between tiers within the same VPC. Option C is wrong because a reverse proxy is used to forward requests from clients to servers, not to restrict initiation of connections.

Answer

Use network ACLs on the application tier subnets to allow inbound from web tier and block outbound to web tier

Answer

Use a transit gateway with route tables to control traffic flow

Answer

Place a reverse proxy between the tiers

Question 8

A company has an AWS Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to use BGP attributes to prefer the Direct Connect path. On the customer router, they set a lower local preference for routes received via the VPN. However, traffic still uses the VPN. What could be the reason?

Accepted Answer

Local preference is not supported by AWS for BGP sessions; use AS path prepending instead. AWS does not honor the local preference attribute set on the customer router for routes received via the VPN. In AWS, BGP local preference is not considered; instead, AS path prepending is the standard method to influence route selection on the customer side. Option B is incorrect because weight is a Cisco-proprietary attribute that is not used in AWS BGP sessions. Option C is incorrect because BFD is used for fast failure detection, not path selection. Option D is incorrect because MED is used to influence inbound traffic from AWS, not to prefer the Direct Connect path on the customer router.

Answer

The weight attribute is set higher on the VPN routes

Answer

Bidirectional Forwarding Detection (BFD) is not enabled on the Direct Connect connection

Answer

The BGP MED attribute is not set on the VPN routes

Question 9

A company is deploying a VPC with public and private subnets. They want to allow instances in a private subnet to access the internet for software updates while preventing inbound internet traffic. Which configuration should be used?

Accepted Answer

Attach an internet gateway to the VPC, and create a NAT gateway in a public subnet. Add a route in the private subnet route table to the NAT gateway for 0.0.0.0/0. A NAT gateway, deployed in a public subnet with an Internet Gateway (IGW) attached, allows instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while the IGW's one-way translation prevents unsolicited inbound traffic from reaching the private instances. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface.

Answer

Create a VPC endpoint for internet access

Answer

Use a transit gateway with a NAT instance

Answer

Attach an internet gateway to the VPC and add a route in the private subnet to the internet gateway for 0.0.0.0/0

Question 10

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in multiple Availability Zones. Which TWO configurations are required to achieve high availability?

Accepted Answer

The ALB must be configured with subnets in at least two Availability Zones. The ALB must be configured with subnets in at least two Availability Zones to remain available if one AZ fails. Option B is correct because an internet-facing ALB is required to accept traffic from the internet; an internal ALB would not be accessible. Option C is incorrect because high availability does not require three instances; two instances (one per AZ) can provide high availability. Option D is incorrect because NAT gateways are not required for ALB high availability; they are used for outbound internet access from private subnets. Option E is incorrect because cross-zone load balancing is enabled by default, but it is not a requirement for high availability; high availability is achieved by having instances in multiple AZs.

Answer

At least three EC2 instances must be registered with the ALB

Answer

A NAT gateway must be deployed in each Availability Zone

Answer

Cross-zone load balancing must be enabled on the ALB

Question 11

A company is implementing a network segmentation strategy using AWS Transit Gateway. They have three VPCs: production, development, and shared services. They need to ensure that production and development VPCs can both access shared services, but cannot communicate with each other. Which THREE configurations are required?

Accepted Answer

Create a route table for the shared services VPC that allows routes to both production and development. The shared services VPC needs a transit gateway route table with routes to both the production and development VPC attachments so that return traffic from shared services can reach those VPCs. Without these routes, the transit gateway would drop return packets, breaking bidirectional communication.

Answer

Create a VPC peering connection between production and development

Answer

Use a single transit gateway route table for all attachments

Question 12

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. Which TWO components are required for the VPN connection?

Accepted Answer

Customer gateway. A customer gateway is required as the on-premises side endpoint for the site-to-site VPN, representing the physical or software VPN device on the customer network. A virtual private gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic from the VPC to the on-premises network. Together, they form the two mandatory endpoints for establishing IPsec VPN tunnels over the internet.

Answer

Transit gateway

Answer

VPN connection

Answer

Direct Connect connection

Question 13

A company is setting up a Direct Connect connection between its on-premises data center and AWS. The company wants to use a single virtual interface (VIF) to access multiple VPCs in the same AWS Region. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway allows you to associate multiple Virtual Private Clouds (VPCs) in the same AWS Region with a single Direct Connect virtual interface (VIF). This is achieved by creating a Direct Connect gateway and attaching it to the VIF, then associating the desired VPCs with the gateway via virtual private gateways (VGWs) or transit gateways. This enables centralized, private connectivity from on-premises to multiple VPCs without needing separate VIFs per VPC.

Answer

VPC peering connection

Answer

AWS VPN CloudHub

Answer

Transit VPC

Question 14

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses, but they cannot reach an internet-facing application hosted on an EC2 instance in a public subnet. The EC2 instance has a public IP and a security group allowing HTTP/HTTPS from 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The private VIF does not route traffic to public IP addresses; the on-premises traffic to the public IP must traverse the internet.. The issue is that the private VIF (private virtual interface) is designed to route traffic only between private IP addresses, not public IP addresses. Even though the EC2 instance has a public IP and the security group allows HTTP/HTTPS from anywhere, traffic from on-premises destined for the public IP of the EC2 instance will not traverse the Direct Connect private VIF because the private VIF does not route public IP traffic. Instead, that traffic would need to go over the internet. Therefore, the most likely cause is that the private VIF does not route traffic to public IP addresses, as stated in option D. Option A is incorrect because the route table in the public subnet can have a default route to an internet gateway; that is not the issue. Option B is incorrect because the security group allows all inbound HTTP/HTTPS. Option C is incorrect because BGP exchanges routes for prefixes advertised over the VIF, but even if routes were exchanged, the private VIF would not route public IP traffic.

Answer

The route table in the public subnet does not have a default route to an internet gateway.

Answer

The security group is blocking traffic from the on-premises IP range.

Answer

The BGP session is not exchanging routes for the public IP range.

Question 15

A company is deploying a multi-region application using two AWS Regions. They want to use an AWS Transit Gateway to interconnect VPCs within each region, and they need to interconnect the Transit Gateways across regions. Which is the most scalable and reliable approach?

Accepted Answer

Use Transit Gateway peering attachments between the Transit Gateways in each region.. AWS Transit Gateway supports inter-region peering, which is the recommended method for connecting Transit Gateways across regions. Option A is correct. Option B is incorrect because VPC peering does not natively interconnect Transit Gateways. Option C is incorrect because using AWS Site-to-Site VPN connections adds complexity, reduces bandwidth, and is less reliable compared to Transit Gateway peering. Option D is incorrect because a Direct Connect gateway is designed for connecting on-premises networks to AWS, not for interconnecting Transit Gateways across regions.

Answer

Create a VPC peering connection between VPCs in different regions and attach them to the Transit Gateways.

Answer

Use AWS Site-to-Site VPN connections between the Transit Gateways in each region.

Answer

Set up a Direct Connect gateway with virtual interfaces in each region and propagate routes.