ANS-C01 Network Implementation Practice Test 26 — 15 Questions

Question 1

Which TWO of the following are requirements for establishing an AWS Direct Connect private virtual interface? (Choose two.)

Accepted Answer

A BGP session between the customer router and the AWS device.. A BGP session between the customer router and the AWS device is a fundamental requirement for establishing a private virtual interface. The private VIF uses BGP to exchange routing information (typically a /30 or /31 subnet) between the on-premises network and the VPC, enabling dynamic route advertisement and failover. Without this BGP session, the VIF cannot be activated or used for traffic.

Answer

Jumbo frames support (MTU 9001).

Answer

A public IP address for the VIF.

Answer

A public BGP ASN.

Question 2

Which TWO of the following are true about AWS VPC endpoints? (Choose two.)

Accepted Answer

Gateway Endpoints can be used to access Amazon S3 and DynamoDB.. Gateway VPC endpoints allow private connectivity to Amazon S3 and DynamoDB without traversing the internet, using route table entries rather than private IP addresses. This is the only AWS service pair supported by Gateway Endpoints, making them a cost-effective and simple solution for these two services.

Answer

Interface Endpoints are free of charge.

Answer

Gateway Endpoints use AWS PrivateLink.

Answer

Both Gateway and Interface Endpoints require a NAT gateway.

Question 3

A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?

Accepted Answer

Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.. A Gateway Load Balancer (GWLB) allows you to deploy a fleet of third-party firewall appliances in a separate subnet and use a Gateway Load Balancer endpoint (GWLBe) to transparently intercept and steer inter-subnet traffic through the firewall. By configuring the route tables of the web and application subnets to send traffic to the GWLBe, the firewall inspects only the desired traffic without affecting other VPC traffic, as the GWLB operates at Layer 3 (Geneve encapsulation) and does not alter the source/destination IP addresses.

Answer

Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.

Answer

Place the firewall in a separate subnet and use network ACLs to force traffic through it.

Answer

Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.

Question 4

A company has multiple VPCs connected via AWS Transit Gateway. Each VPC has its own route table in the transit gateway. The company wants to restrict traffic between certain VPCs. For example, VPC A should be able to send traffic to VPC B but not to VPC C. VPC B should be able to send traffic to VPC C. Which configuration should the company use?

Accepted Answer

Create separate transit gateway route tables for each VPC and add only the desired routes for other VPCs.. AWS Transit Gateway supports multiple route tables, and by creating a separate route table for each VPC attachment, you can control which VPCs can communicate by selectively adding routes to the desired destination VPC CIDRs. This allows VPC A to have a route only to VPC B, while VPC B's route table includes routes to both VPC A and VPC C, achieving the required traffic isolation without relying on stateful or stateless filtering at the attachment level.

Answer

Use network ACLs on the transit gateway attachments to filter traffic.

Answer

Use security groups on the VPC attachments to allow or deny traffic.

Answer

Create a single transit gateway route table and associate all VPC attachments with it.

Question 5

A company is setting up a Site-to-Site VPN connection to AWS. The customer gateway device is behind a NAT device that performs address translation. Which tunnel option must be enabled to ensure the VPN tunnel establishes correctly?

Accepted Answer

NAT Traversal (NAT-T). When a customer gateway device is behind a NAT device, the NAT device modifies the IP addresses and potentially the UDP ports in the IPsec packet headers. Standard IPsec (ESP) does not work through NAT because ESP is a Layer 4 protocol with no port numbers. NAT Traversal (NAT-T) solves this by encapsulating IPsec packets inside UDP (typically port 4500), allowing the NAT device to perform address translation without breaking the VPN tunnel.

Answer

Perfect Forward Secrecy (PFS)

Answer

Dead Peer Detection (DPD)

Answer

IKEv2

Question 6

A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?

Accepted Answer

An inbound rule in the database's security group that references the web server's security group.. Security group rules can reference other security groups as a source, allowing traffic from any instance associated with the referenced security group (the web server's security group) without needing to specify individual IP addresses. This is the recommended AWS best practice for inter-instance communication within a VPC, as it dynamically adapts to changes in the web server's IP or scaling events.

Answer

An inbound rule in the database's security group that allows traffic from the web server's private IP address.

Answer

An internet gateway attached to the VPC.

Answer

A NAT gateway in the public subnet.

Question 7

A company is using AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The VPC has a CIDR 10.0.0.0/16. The on-premises network uses 192.168.0.0/16. The company wants to enable communication between on-premises and the VPC, and also allow the VPC to access the internet via an internet gateway. Which TWO of the following configurations are necessary?

Accepted Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the internet gateway.. An internet gateway (IGW) provides internet access for a VPC, and the VPC's main route table must include a default route (0.0.0.0/0) pointing to the IGW for outbound internet traffic. This allows instances in the VPC to reach the internet, which is a stated requirement. Without this route, traffic destined for the internet would have no path.

Answer

A route in the on-premises router for the VPC CIDR (10.0.0.0/16) pointing to the AWS Direct Connect router.

Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway.

Answer

A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the internet gateway.

Question 8

A company is deploying a VPC with public and private subnets. The private subnets need outbound internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private source IP to the NAT Gateway's Elastic IP address, so responses return to the gateway, which then forwards them to the private instance. This meets the requirement of outbound-only internet access without direct internet reachability.

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 9

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They want to route users to the nearest healthy ALB using latency-based routing. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs user traffic to the AWS region with the lowest network latency for the end user, based on latency measurements between the user and each region's resources. This matches the requirement to route users to the nearest healthy ALB, as Route 53 can evaluate health checks on the ALBs and only route to healthy endpoints.

Answer

Amazon CloudWatch

Answer

VPC Traffic Mirroring

Answer

AWS Global Accelerator

Question 10

A network engineer is troubleshooting connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS accounts and regions. The engineer can ping the private IP of an instance in the peered VPC from one side, but not from the other. What is the most likely cause?

Accepted Answer

Route tables in one VPC do not have a route to the peered VPC CIDR. The most likely cause is that the route tables in one VPC lack a route pointing to the peered VPC's CIDR block. For a VPC peering connection to function bidirectionally, each VPC must have a route in its route table that directs traffic destined for the other VPC's CIDR to the peering connection (pcx-*). Without this route, packets from the source VPC to the peered VPC will be dropped, even if the peering connection itself is active and the security groups allow traffic.

Answer

The security group in the peered VPC is blocking ICMP traffic

Answer

The VPC CIDR blocks overlap

Answer

The VPC peering connection is in a 'pending-acceptance' state

Question 11

A company wants to deploy a web application on EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions (session affinity). What configuration is required on the ALB?

Accepted Answer

Enable stickiness on the target group and specify a cookie duration. Sticky sessions (session affinity) are enabled at the target group level on an Application Load Balancer. By enabling stickiness and specifying a cookie duration, the ALB generates a session cookie (AWSALB) that binds a client's session to a specific target for the duration, ensuring subsequent requests from the same client are routed to the same EC2 instance.

Answer

Use path-based routing

Answer

Configure health checks on the target group

Answer

Enable proxy protocol v2

Question 12

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend this connectivity to multiple VPCs in the same region without creating additional VIFs. Which solution should they implement?

Accepted Answer

Use a Direct Connect Gateway and attach the VPCs. A Direct Connect Gateway (DX Gateway) is a managed service that allows you to associate a single private virtual interface (VIF) with up to 10 VPCs in the same AWS Region (or across Regions with inter-region peering). This enables the company to extend their existing Direct Connect connection to multiple VPCs without provisioning additional VIFs, simplifying management and reducing costs.

Answer

Provision additional private VIFs for each VPC

Answer

Use VPC peering between the VPCs

Answer

Use a Transit VPC with VPN connections

Question 13

A company wants to restrict outbound traffic from a VPC to only allow HTTPS traffic to a specific list of domains. Which AWS service can be used to achieve this?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is the correct choice because it provides stateful, managed firewall rules that can inspect and filter outbound traffic based on domain names (FQDN) for HTTPS (port 443) using TLS inspection or domain list rules. This allows you to create a rule group that permits outbound HTTPS traffic only to a specified list of domains, while blocking all other outbound traffic.

Answer

Security groups

Answer

Amazon Route 53

Answer

Application Load Balancer

Question 14

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be implemented?

Accepted Answer

Create a Gateway VPC Endpoint for S3. A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to access S3 without traversing the internet, using AWS's internal network. This minimizes data transfer costs because Gateway Endpoints are free and traffic stays within the AWS backbone, avoiding NAT Gateway or internet gateway charges.

Answer

Use an Interface VPC Endpoint for S3

Answer

Use AWS Direct Connect

Answer

Set up a NAT Gateway in the public subnet and route traffic through it

Question 15

A company is experiencing intermittent connectivity issues between its on-premises network and AWS via a Direct Connect connection. The link is up, but packet loss is observed. Which test should the network engineer perform first to isolate the issue?

Accepted Answer

Run a traceroute with MTR. MTR (My TraceRoute) combines the functionality of traceroute and ping to provide per-hop latency and packet loss statistics. This allows the engineer to pinpoint whether the packet loss is occurring on the Direct Connect link itself, the customer gateway, or somewhere in the transit path, rather than just confirming end-to-end reachability.

Answer

Ping the virtual private gateway

Answer

Perform a DNS lookup

Answer

Run a speed test