ANS-C01 Network Implementation Practice Test 26 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. They also have a Site-to-Site VPN connection to the same VPC as a backup. The on-premises router is advertising the same prefixes over both connections. The company wants to ensure that traffic uses Direct Connect when available and fails over to VPN if Direct Connect goes down. Which configuration should be applied?

Accepted Answer

Prepend AS path on the BGP advertisements over the VPN connection to make the path less preferred.. To prefer Direct Connect over VPN, you should adjust the BGP attributes on the on-premises router. One common method is to prepend AS path on the VPN BGP advertisements to make the path longer, so the Direct Connect path is preferred. Option A is correct. Option B is incorrect because decreasing the MED on Direct Connect would make it more preferred, but the question asks for a method that can be applied on-premises. Option C is incorrect because local preference is usually set on the AWS side. Option D is incorrect because disabling BGP on the VPN would remove the backup.

Answer

Set a higher MED value on the Direct Connect BGP advertisements.

Answer

Disable BGP on the VPN connection to force traffic to Direct Connect.

Answer

Set a higher local preference on the VPN BGP advertisements.

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. They have set up a Transit Gateway and attached the VPC and the Direct Connect gateway. The on-premises network can reach some VPC resources but not others. The VPC has multiple subnets with different CIDR blocks. The on-premises router is advertising the same prefixes over BGP. What is the most likely cause of the partial connectivity?

Accepted Answer

The VPC route tables for the subnets that cannot be reached do not have a route to the Transit Gateway for the on-premises prefixes.. The most common cause of partial connectivity in this scenario is that the VPC route tables do not have routes pointing to the Transit Gateway for the on-premises prefixes. Even if the Transit Gateway has routes, the VPC subnets must send traffic to the Transit Gateway. Option A is correct. Option B is incorrect because if the Transit Gateway route table had incorrect propagation, it would affect all prefixes equally. Option C is incorrect because the on-premises router advertising the same prefixes would not cause partial connectivity. Option D is incorrect because the Direct Connect gateway association is fine if some traffic works.

Answer

The Direct Connect gateway association with the Transit Gateway is misconfigured.

Answer

The Transit Gateway route table does not have a static route or propagation for the on-premises prefixes.

Answer

The on-premises router is advertising different prefixes over BGP than expected.

Question 3

A company wants to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. Which of the following is required to establish the VPN connection?

Accepted Answer

Virtual private gateway attached to the VPC and a customer gateway representing the on-premises router. To establish a Site-to-Site VPN, you need a virtual private gateway (VGW) or transit gateway on the AWS side, and a customer gateway (CGW) representing the on-premises router. Option B is correct. Option A is incorrect because an internet gateway is used for public internet traffic, not VPN. Option C is incorrect because a Direct Connect gateway is for Direct Connect connections. Option D is incorrect because a VPC endpoint is for private access to AWS services.

Answer

Direct Connect gateway associated with the VPC

Answer

Internet gateway attached to the VPC

Answer

VPC endpoint for the VPN service

Question 4

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

Accepted Answer

Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.. For high availability, you should deploy a NAT gateway in each Availability Zone and route traffic from private subnets in each AZ to the NAT gateway in the same AZ. This avoids cross-AZ data transfer costs and ensures that an AZ failure does not affect other AZs. Option A is correct. Options B and C do not provide equal HA. Option D is incorrect because a NAT instance is less reliable than a managed NAT gateway.

Answer

Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

Answer

Use a single NAT instance in a public subnet with an auto scaling group and health checks.

Answer

Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.

Question 5

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team notices that traffic to a particular EC2 instance is taking a suboptimal path that goes through the internet instead of Direct Connect. The EC2 instance has both a private IP and a public IP. The on-premises router is advertising the VPC's CIDR block over BGP. What is the most likely cause?

Accepted Answer

The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address.. If the on-premises router uses the public IP to reach the instance, traffic will go over the internet, not Direct Connect. The issue is that the on-premises DNS or routing is resolving the public IP instead of the private IP for the instance. Option B is correct. Option A is incorrect because the private VIF is designed for private IP traffic. Option C is incorrect because security groups do not affect routing paths. Option D is incorrect because the BGP advertisement of the VPC CIDR is correct.

Answer

The private VIF is not configured to route the VPC CIDR.

Answer

The security group on the EC2 instance is blocking traffic from the on-premises IP range.

Answer

The on-premises router is not advertising the VPC CIDR to the Direct Connect router.

Question 6

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose 2)

Accepted Answer

AWS Direct Connect. AWS Site-to-Site VPN and AWS Direct Connect are the two primary services for hybrid connectivity. VPC peering is for VPC-to-VPC, not on-premises. VPC endpoints are for accessing AWS services privately. Internet gateway is for public internet access.

Answer

Internet gateway

Answer

VPC endpoint

Answer

VPC peering connection

Question 7

Which THREE considerations are important when implementing a multi-region Direct Connect architecture? (Choose 3)

Accepted Answer

Ensure Direct Connect connections are in at least two separate geographic locations.. To ensure high availability and disaster recovery, you should have Direct Connect connections in at least two separate locations, use diverse paths, and have a backup VPN connection. Using a single location creates a single point of failure. Using the same AWS device also creates a single point of failure. Direct Connect gateway can be used to associate multiple VPCs.

Answer

Use a single Direct Connect connection to reduce complexity.

Answer

Connect all Direct Connect connections to the same AWS Direct Connect device.

Question 8

Which TWO components are required when configuring a transit gateway to connect multiple VPCs and an on-premises network via Direct Connect? (Choose 2)

Accepted Answer

Transit Gateway association with the Direct Connect gateway. When using Transit Gateway with Direct Connect, you need a Direct Connect gateway, and the Transit Gateway must be associated with the Direct Connect gateway. A virtual private gateway (VGW) is not used with Transit Gateway; it is used with a VPC alone. A customer gateway is used for VPN, not Direct Connect. An internet gateway is for public internet traffic.

Answer

Internet gateway (IGW)

Answer

Virtual private gateway (VGW)

Answer

Customer gateway (CGW)

Question 9

Refer to the exhibit. A network engineer is creating an IAM policy for a junior engineer who needs to set up a VPC with public and private subnets and an internet gateway. The junior engineer reports that they cannot create a VPC peering connection. Based on the policy, what is the most likely reason?

Accepted Answer

The policy has an explicit Deny statement for ec2:CreateVpcPeeringConnection.. The policy explicitly denies the ec2:CreateVpcPeeringConnection action with an Effect of Deny. Even though there is an Allow for other actions, the Deny overrides any Allow for that specific action. Option C is correct. Options A and B are not relevant because the policy does not allow or deny those actions. Option D is incorrect because the policy does not require MFA.

Answer

The policy allows ec2:CreateVpc which implicitly denies peering.

Answer

The policy requires multi-factor authentication to create VPC peering connections.

Answer

The policy does not allow the ec2:CreateVpcPeeringConnection action.

Question 10

A company has a Direct Connect connection with a private VIF to a VPC in us-east-1. The VPC has two subnets: a public subnet and a private subnet. The public subnet has an internet gateway attached. The private subnet has a NAT gateway. The company's on-premises network uses the 10.0.0.0/8 IP range. The VPC CIDR is 10.1.0.0/16. The on-premises router is advertising 10.1.0.0/16 over BGP to the Direct Connect router. The company needs EC2 instances in the private subnet to initiate outbound connections to the internet for updates. The NAT gateway is in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the on-premises network team reports that they can ping the private IP of the NAT gateway (10.1.0.10) but not the private IP of an EC2 instance in the private subnet (10.1.1.50). The EC2 instance's security group allows ICMP from the on-premises IP range. The VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. The VPC is attached to a virtual private gateway. What is the most likely cause?

Accepted Answer

The private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway.. The on-premises network can ping the NAT gateway because the NAT gateway is in the public subnet, and the route table for the public subnet likely has a route to the virtual private gateway for the on-premises CIDR. However, the EC2 instance is in the private subnet, and the private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway. The VPC's main route table has such a route, but the private subnet is not using the main route table; it likely has a custom route table that only has the default route to the NAT gateway. Therefore, traffic from on-premises to the EC2 instance's private IP is not routed to the virtual private gateway. Option D is correct. Option A is incorrect because the security group allows ICMP. Option B is incorrect because the NAT gateway is reachable. Option C is incorrect because the virtual private gateway is attached.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The NAT gateway is not reachable from the on-premises network.

Answer

The security group on the EC2 instance is blocking ICMP from the on-premises IP range.

Question 11

A company has multiple VPCs in the same AWS region that need to communicate with each other and with an on-premises data center. The company currently uses VPC peering connections between each VPC pair, which has become difficult to manage as the number of VPCs grows. The company wants to simplify the network architecture and implement a hub-and-spoke model using AWS Transit Gateway. The on-premises data center is connected to AWS via a Direct Connect connection with a private VIF. The company has already created a Transit Gateway and attached all VPCs to it. They have also created a Direct Connect gateway and associated it with the Transit Gateway. The on-premises router is advertising the on-premises CIDR (10.0.0.0/8) over BGP. However, after the migration, the VPCs cannot communicate with each other, and the on-premises network cannot reach the VPCs. The VPC route tables have been updated to route all traffic to the Transit Gateway. The Transit Gateway route table has propagation enabled for all VPC attachments and the Direct Connect gateway attachment. What is the most likely missing configuration?

Accepted Answer

The VPC route tables do not have routes for the other VPCs' CIDRs and the on-premises CIDR pointing to the Transit Gateway.. Even though the Transit Gateway route table has propagation enabled, the VPCs might not have routes that point to the Transit Gateway for the other VPCs' CIDRs and the on-premises CIDR. The VPC route tables need explicit routes for the other VPCs' CIDRs (e.g., 10.2.0.0/16) pointing to the Transit Gateway. Alternatively, the Transit Gateway route table might not have routes for the on-premises CIDR because the Direct Connect gateway propagation might not be working if the on-premises prefixes are not being advertised correctly. The most common issue is that the VPC route tables do not have routes for the other VPCs' CIDRs. Option A is correct. Option B is incorrect because the Transit Gateway route table has propagation enabled. Option C is incorrect because the Direct Connect gateway association is in place. Option D is incorrect because the on-premises router is advertising the CIDR.

Answer

The Direct Connect gateway is not associated with the Transit Gateway.

Answer

The Transit Gateway route table does not have propagation enabled for the VPC attachments.

Answer

The on-premises router is not advertising the on-premises CIDR over BGP.

Question 12

A company has a VPC with public and private subnets across two Availability Zones. The private subnets require outbound internet access for updates, but must not be directly reachable from the internet. The company has a NAT gateway in each public subnet. Security team reports that instances in private subnets cannot reach the internet. Which configuration should be verified first?

Accepted Answer

Verify that the route table for the public subnets has a default route pointing to an internet gateway, and the private subnets' route table has a default route pointing to the NAT gateway. Option C is correct because NAT gateway requires a route to an internet gateway in the route table of the public subnet where it resides, and the private subnet route table must have a default route pointing to the NAT gateway. Option A is wrong because NACLs are stateless and default NACLs allow all traffic; they are not the most likely cause. Option B is wrong because security groups are stateful and outbound traffic is allowed by default. Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.

Answer

Verify that the VPC has a VPC endpoint for S3 configured

Answer

Verify that the network ACLs for the private subnets allow outbound traffic to 0.0.0.0/0

Answer

Verify that the security groups attached to the instances allow outbound HTTPS traffic

Question 13

A company is implementing a hybrid network using AWS Direct Connect. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect gateway (DXGW) with a private virtual interface (VIF) to their on-premises router. They have established a BGP session between the on-premises router and the VGW. The on-premises network can reach EC2 instances in the VPC, but the VPC instances cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables lack a route for the on-premises CIDR pointing to the virtual private gateway. Option B is correct because the VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway. Option A is wrong because the VGW is already attached. Option C is wrong because BGP is established. Option D is wrong because VPC endpoints are not relevant.

Answer

The virtual private gateway is not attached to the VPC

Answer

The VPC has a VPC endpoint for S3 that is causing a routing conflict

Answer

The BGP session is not advertising the on-premises CIDR to the VGW

Question 14

A company is designing a multi-tier application with web servers in public subnets and database servers in private subnets. The database servers should only be accessible from the web servers. Which AWS feature should be used to enforce this?

Accepted Answer

Security groups that reference the web server security group as a source. Option C is correct because security groups act as a virtual firewall for instances, and you can allow inbound traffic from a specific security group (the web servers' security group). Option A is wrong because NACLs are stateless and applied at subnet level, not instance-level. Option B is wrong because network ACLs are not as granular as security groups for this use case. Option D is wrong because VPC endpoints are for accessing AWS services privately.

Answer

VPC endpoints to restrict access to the database servers

Answer

Network ACLs with allow rules for the web server subnet CIDR

Answer

Network ACLs with deny rules for all traffic except from the web server subnet

Question 15

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is in public subnets, and the web servers are in private subnets. The ALB is configured with a target group pointing to the web servers. Users report intermittent 503 errors. The web servers are healthy according to the target group health checks. What is the most likely cause?

Accepted Answer

The ALB subnets do not have a route to an internet gateway. Option D is correct because internet-facing ALBs require a route to an internet gateway in their subnet route table to respond to clients. Option A is wrong because the ALB is internet-facing, not internal. Option B is wrong if the web servers are healthy. Option C is wrong because cross-zone load balancing is enabled by default and not likely intermittent.

Answer

The target group health check interval is too long

Answer

The ALB is configured as internal instead of internet-facing

Answer

Cross-zone load balancing is disabled