ANS-C01 Network Implementation Practice Test 26 — 15 Questions

Question 1

A company is deploying a VPC with both public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which AWS service should be placed in a public subnet to enable this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT gateway. A NAT gateway is correct because it enables EC2 instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. The NAT gateway must be placed in a public subnet with an associated Internet Gateway to translate private IP addresses to the public IP of the NAT gateway for outbound traffic.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Direct Connect virtual interface

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. They also have a Site-to-Site VPN connection to the same VPC as a backup. The on-premises router is advertising the same prefixes over both connections. The company wants to ensure that traffic uses Direct Connect when available and fails over to VPN if Direct Connect goes down. Which configuration should be applied?

Accepted Answer

Prepend AS path on the BGP advertisements over the VPN connection to make the path less preferred.. To prefer Direct Connect over VPN, adjust BGP attributes on the on-premises router. Prepend AS path on the VPN BGP advertisements to increase the AS path length, making the Direct Connect path shorter and thus preferred. This ensures failover to VPN if Direct Connect fails. Option A is incorrect because setting higher MED on Direct Connect would make it less preferred, not more. Option B is incorrect because disabling BGP on VPN removes the backup connection entirely. Option D is incorrect because setting higher local preference on VPN BGP advertisements would make VPN preferred, which is the opposite of the desired behavior. Local preference is typically set on the AWS side, not on-premises.

Answer

Set a higher MED value on the Direct Connect BGP advertisements.

Answer

Disable BGP on the VPN connection to force traffic to Direct Connect.

Answer

Set a higher local preference on the VPN BGP advertisements.

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. They have set up a Transit Gateway and attached the VPC and the Direct Connect gateway. The on-premises network can reach some VPC resources but not others. The VPC has multiple subnets with different CIDR blocks. The on-premises router is advertising the same prefixes over BGP. What is the most likely cause of the partial connectivity?

Accepted Answer

The VPC route tables for the subnets that cannot be reached do not have a route to the Transit Gateway for the on-premises prefixes.. The most common cause of partial connectivity in this scenario is that the VPC route tables do not have routes pointing to the Transit Gateway for the on-premises prefixes. Even if the Transit Gateway has routes, the VPC subnets must send traffic to the Transit Gateway. Option A is correct. Option B is incorrect because if the Transit Gateway route table had incorrect propagation, it would affect all prefixes equally. Option C is incorrect because the on-premises router advertising the same prefixes would not cause partial connectivity. Option D is incorrect because the Direct Connect gateway association is fine if some traffic works.

Answer

The Direct Connect gateway association with the Transit Gateway is misconfigured.

Answer

The Transit Gateway route table does not have a static route or propagation for the on-premises prefixes.

Answer

The on-premises router is advertising different prefixes over BGP than expected.

Question 4

A company wants to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. Which of the following is required to establish the VPN connection?

Accepted Answer

Virtual private gateway attached to the VPC and a customer gateway representing the on-premises router. To establish a Site-to-Site VPN, you need a virtual private gateway (VGW) or transit gateway on the AWS side, and a customer gateway (CGW) representing the on-premises router. Option C is correct. Option A is incorrect because a Direct Connect gateway is used for Direct Connect connections, not VPN. Option B is incorrect because an internet gateway is used for public internet traffic, not VPN. Option D is incorrect because a VPC endpoint is for private access to AWS services, not for establishing a VPN connection.

Answer

Direct Connect gateway associated with the VPC

Answer

Internet gateway attached to the VPC

Answer

VPC endpoint for the VPN service

Question 5

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

Accepted Answer

Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.. For high availability, you should deploy a NAT gateway in each Availability Zone and route traffic from private subnets in each AZ to the NAT gateway in the same AZ. This avoids cross-AZ data transfer costs and ensures that an AZ failure does not affect other AZs. Option A is correct. Options B and C do not provide equal HA. Option D is incorrect because deploying both NAT gateways in the same Availability Zone creates a single point of failure—if that AZ goes down, both gateways fail, so it is not highly available.

Answer

Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

Answer

Use a single NAT instance in a public subnet with an auto scaling group and health checks.

Answer

Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.

Question 6

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team notices that traffic to a particular EC2 instance is taking a suboptimal path that goes through the internet instead of Direct Connect. The EC2 instance has both a private IP and a public IP. The on-premises router is advertising the VPC's CIDR block over BGP. What is the most likely cause?

Accepted Answer

The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address.. The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address. When the on-premises router advertises the VPC CIDR over BGP, traffic destined for the VPC should use Direct Connect. However, if DNS returns the public IP, the on-premises hosts will send traffic to the internet (via the public IP) rather than through the private VIF, causing a suboptimal path. This is a common misconfiguration where DNS resolution does not account for private connectivity.

Answer

The private VIF is not configured to route the VPC CIDR.

Answer

The security group on the EC2 instance is blocking traffic from the on-premises IP range.

Answer

The on-premises router is not advertising the VPC CIDR to the Direct Connect router.

Question 7

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose 2)

Accepted Answer

AWS Direct Connect. AWS Site-to-Site VPN and AWS Direct Connect are the two primary services for hybrid connectivity. VPC peering is for VPC-to-VPC, not on-premises. VPC endpoints are for accessing AWS services privately. Internet gateway is for public internet access.

Answer

Internet gateway

Answer

VPC endpoint

Answer

VPC peering connection

Question 8

Which THREE considerations are important when implementing a multi-region Direct Connect architecture? (Choose 3)

Accepted Answer

Ensure Direct Connect connections are in at least two separate geographic locations.. Implementing Direct Connect connections in at least two separate geographic locations ensures physical diversity and resilience against regional outages. This aligns with AWS best practices for high availability, as a single location failure (e.g., due to natural disaster or fiber cut) would not impact all connections, maintaining connectivity to your VPCs.

Answer

Use a single Direct Connect connection to reduce complexity.

Answer

Connect all Direct Connect connections to the same AWS Direct Connect device.

Question 9

Which TWO components are required when configuring a transit gateway to connect multiple VPCs and an on-premises network via Direct Connect? (Choose 2)

Accepted Answer

Transit Gateway association with the Direct Connect gateway. When using Transit Gateway with Direct Connect, you need a Direct Connect gateway, and the Transit Gateway must be associated with the Direct Connect gateway. A virtual private gateway (VGW) is not used with Transit Gateway; it is used with a VPC alone. A customer gateway is used for VPN, not Direct Connect. An internet gateway is for public internet traffic.

Answer

Internet gateway (IGW)

Answer

Virtual private gateway (VGW)

Answer

Customer gateway (CGW)

Question 10

Refer to the exhibit. A network engineer is creating an IAM policy for a junior engineer who needs to set up a VPC with public and private subnets and an internet gateway. The junior engineer reports that they cannot create a VPC peering connection. Based on the policy, what is the most likely reason?

Accepted Answer

The policy has an explicit Deny statement for ec2:CreateVpcPeeringConnection.. The policy includes an explicit Deny statement for the ec2:CreateVpcPeeringConnection action. In IAM, an explicit Deny overrides any Allow, so even though the policy allows other VPC-related actions, the Deny prevents the junior engineer from creating VPC peering connections. Therefore, the most likely reason is that the policy has an explicit Deny for that action, which corresponds to option A. Option B is incorrect because the policy does allow ec2:CreateVpc and does not implicitly deny peering; an explicit Deny is required. Option C is irrelevant because the policy does not mention MFA. Option D is incorrect because the policy does not allow the action, but the explicit Deny is the stronger reason and is listed as option A.

Answer

The policy allows ec2:CreateVpc which implicitly denies peering.

Answer

The policy requires multi-factor authentication to create VPC peering connections.

Answer

The policy does not allow the ec2:CreateVpcPeeringConnection action.

Question 11

A company has a Direct Connect connection with a private VIF to a VPC in us-east-1. The VPC has two subnets: a public subnet and a private subnet. The public subnet has an internet gateway attached. The private subnet has a NAT gateway. The company's on-premises network uses the 10.0.0.0/8 IP range. The VPC CIDR is 10.1.0.0/16. The on-premises router is advertising 10.1.0.0/16 over BGP to the Direct Connect router. The company needs EC2 instances in the private subnet to initiate outbound connections to the internet for updates. The NAT gateway is in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the on-premises network team reports that they can ping the private IP of the NAT gateway (10.1.0.10) but not the private IP of an EC2 instance in the private subnet (10.1.1.50). The EC2 instance's security group allows ICMP from the on-premises IP range. The VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. The VPC is attached to a virtual private gateway. What is the most likely cause?

Accepted Answer

The private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway.. The on-premises network can ping the NAT gateway because the NAT gateway is in the public subnet, and the route table for the public subnet likely has a route to the virtual private gateway for the on-premises CIDR. However, the EC2 instance is in the private subnet, and the private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway. The VPC's main route table has such a route, but the private subnet is not using the main route table; it likely has a custom route table that only has the default route to the NAT gateway. Therefore, traffic from on-premises to the EC2 instance's private IP is not routed to the virtual private gateway. Option D is correct. Option A is incorrect because the security group allows ICMP. Option B is incorrect because the NAT gateway is reachable. Option C is incorrect because the virtual private gateway is attached.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The NAT gateway is not reachable from the on-premises network.

Answer

The security group on the EC2 instance is blocking ICMP from the on-premises IP range.

Question 12

A company has a VPC with public and private subnets across two Availability Zones. The private subnets require outbound internet access for updates, but must not be directly reachable from the internet. The company has a NAT gateway in each public subnet. Security team reports that instances in private subnets cannot reach the internet. Which configuration should be verified first?

Accepted Answer

Verify that the route table for the public subnets has a default route pointing to an internet gateway, and the private subnets' route table has a default route pointing to the NAT gateway. For instances in private subnets to reach the internet via a NAT gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway, and the NAT gateway must be placed in a public subnet whose route table has a default route pointing to an internet gateway. If either route is missing, outbound internet access will fail. Option B is incorrect because VPC endpoints are for accessing specific AWS services (e.g., S3), not general internet access. Option C is incorrect because NACLs are stateless and by default allow all outbound traffic; although custom NACLs could block traffic, routing misconfiguration is a more common first issue. Option D is incorrect because security groups are stateful and outbound traffic is allowed by default; blocking outbound HTTPS would be an intentional change, not the first thing to verify.

Answer

Verify that the VPC has a VPC endpoint for S3 configured

Answer

Verify that the network ACLs for the private subnets allow outbound traffic to 0.0.0.0/0

Answer

Verify that the security groups attached to the instances allow outbound HTTPS traffic

Question 13

A company is implementing a hybrid network using AWS Direct Connect. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect gateway (DXGW) with a private virtual interface (VIF) to their on-premises router. They have established a BGP session between the on-premises router and the VGW. The on-premises network can reach EC2 instances in the VPC, but the VPC instances cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables lack a route for the on-premises CIDR pointing to the virtual private gateway. For instances in a VPC to reach on-premises resources over Direct Connect, the VPC route tables must have a route for the on-premises CIDR that points to the virtual private gateway (VGW). Without this route, traffic from the VPC to the on-premises network will not be forwarded to the VGW, even though the BGP session is established and the on-premises side can reach the VPC. Option A is incorrect because the VGW is attached to the VPC (otherwise on-premises could not reach EC2 instances). Option B is incorrect because a VPC endpoint for S3 does not cause routing conflicts for on-premises traffic. Option D is incorrect because the BGP session is established and the on-premises CIDR is being advertised (otherwise on-premises could not reach the VPC).

Answer

The virtual private gateway is not attached to the VPC

Answer

The VPC has a VPC endpoint for S3 that is causing a routing conflict

Answer

The BGP session is not advertising the on-premises CIDR to the VGW

Question 14

A company is designing a multi-tier application with web servers in public subnets and database servers in private subnets. The database servers should only be accessible from the web servers. Which AWS feature should be used to enforce this?

Accepted Answer

Security groups that reference the web server security group as a source. Security groups are stateful and act as a virtual firewall for individual instances. By referencing the web server security group as a source in the database security group's inbound rules, you allow traffic only from instances in that security group. This provides granular control at the instance level. Option B is incorrect because VPC endpoints are used to privately connect to AWS services, not to restrict database access. Options C and D are incorrect because network ACLs are stateless and applied at the subnet level, not at the instance level, and they require explicit allow rules for return traffic. Using a NACL with allow rules for the web server subnet CIDR would still allow any instance in that subnet, not just the web servers, and would require managing ephemeral ports.

Answer

VPC endpoints to restrict access to the database servers

Answer

Network ACLs with allow rules for the web server subnet CIDR

Answer

Network ACLs with deny rules for all traffic except from the web server subnet

Question 15

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is in public subnets, and the web servers are in private subnets. The ALB is configured with a target group pointing to the web servers. Users report intermittent 503 errors. The web servers are healthy according to the target group health checks. What is the most likely cause?

Accepted Answer

The ALB subnets do not have a route to an internet gateway. An internet-facing ALB must be deployed in public subnets that have a route to an internet gateway. Since the web servers are healthy but users get intermittent 503 errors, the issue is likely that the ALB's subnets lack a route to an internet gateway, preventing the ALB from sending responses to clients. Option B is wrong because a long health check interval would not cause 503 errors if the targets are healthy. Option C is wrong because the ALB is described as being in public subnets and should be internet-facing; if it were internal, it would not receive internet traffic. Option D is wrong because cross-zone load balancing being disabled affects traffic distribution but does not cause intermittent 503 errors when targets are healthy.

Answer

The target group health check interval is too long

Answer

The ALB is configured as internal instead of internet-facing

Answer

Cross-zone load balancing is disabled