ANS-C01 Network Implementation Practice Test 27 — 15 Questions

Question 1

Which TWO of the following are valid methods to connect an on-premises data center to a VPC in AWS? (Choose 2.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a correct answer because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, enabling direct access to VPCs via private virtual interfaces (VIFs) or transit virtual interfaces for use with Transit Gateway.

Answer

VPC endpoint

Answer

Transit Gateway

Answer

VPC peering

Question 2

A company has a VPC with public and private subnets in two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an S3 bucket. What is the MOST cost-effective and secure way to provide this access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet route tables.. A VPC Gateway Endpoint for S3 provides private, secure connectivity to S3 without traversing the public internet, and it incurs no hourly or data processing charges, making it the most cost-effective and secure choice. Traffic stays within the AWS network, and the endpoint is attached to the private subnet route tables, allowing EC2 instances in those subnets to access S3 directly without needing a NAT Gateway or public IPs.

Answer

Deploy a NAT Gateway in each public subnet and route traffic from private subnets through it.

Answer

Use AWS Transit Gateway to route traffic to S3 via a centralized VPN.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to the EC2 instances.

Question 3

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached

Question 4

A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?

Accepted Answer

Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.. Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.

Answer

Use one Direct Connect connection as primary and the other as standby with static routes.

Answer

Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.

Answer

Use a VPN connection over the internet as a backup for the Direct Connect links.

Question 5

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access but not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway is the correct choice because it enables instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address, providing one-way internet access without direct reachability.

Answer

Elastic IP Address (EIP)

Answer

Internet Gateway (IGW)

Answer

Virtual Private Gateway (VGW)

Question 6

A company has a VPC with a transit gateway (TGW) connected to multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises a specific prefix 10.0.0.0/16. A VPC attachment in the same region also advertises the same prefix. The TGW route table has the on-premises route as static and the VPC route as propagated. Which route will be used for traffic destined to 10.0.0.5?

Accepted Answer

The static route to on-premises. When a transit gateway (TGW) receives both a static route and a propagated route for the same prefix, the static route takes precedence regardless of the propagation source. This is because static routes have a higher administrative distance (lower priority number) than dynamically learned routes. Therefore, traffic destined to 10.0.0.5 will be forwarded via the Direct Connect attachment to the on-premises network.

Answer

The propagated route from VPC

Answer

Both routes will be used with ECMP

Answer

The route with the shortest AS_PATH

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to establish connectivity to an on-premises network via AWS Site-to-Site VPN. The on-premises network uses a CIDR block of 192.168.0.0/16. The VPN connection will be redundant using two tunnels. Which THREE actions are required to enable this connectivity?

Accepted Answer

Create a Customer Gateway (CGW) in the same AWS region.. Option A is correct because a Site-to-Site VPN requires a Customer Gateway (CGW) resource in AWS that represents the on-premises VPN device's public IP address and BGP ASN, which is necessary to terminate the VPN tunnels on the customer side. Option C is correct because a Virtual Private Gateway (VGW) must be created and attached to the VPC to serve as the AWS-side VPN endpoint that the two redundant tunnels connect to. Option E is correct because the VPC route tables must have a route for the on-premises CIDR 192.168.0.0/16 targeting the VGW so that traffic destined for the on-premises network is forwarded through the VPN connection. Option B is incorrect because a Direct Connect virtual interface is used for AWS Direct Connect dedicated connections, not for a Site-to-Site VPN. Option D is incorrect because a NAT Gateway provides outbound internet access for private subnets and plays no role in establishing VPN connectivity to an on-premises network.

Answer

Create a Direct Connect virtual interface.

Answer

Configure a NAT Gateway in the VPC.

Question 8

A company is deploying a global application and wants to use AWS Global Accelerator to improve performance. The application runs behind an Application Load Balancer (ALB) in us-east-1. Which THREE components are part of a Global Accelerator deployment?

Accepted Answer

Endpoint groups. Endpoint groups are a core component of AWS Global Accelerator that define the AWS Region and traffic routing for a listener. Each endpoint group contains one or more endpoints (such as an ALB, NLB, or EC2 instance) and allows you to control traffic distribution and health checking. In this scenario, the ALB in us-east-1 would be added to an endpoint group associated with that region.

Answer

Route 53 hosted zones

Answer

Lambda@Edge functions

Question 9

A company uses AWS Transit Gateway to connect multiple VPCs. The network team notices that traffic between two VPCs is taking a suboptimal path through a third VPC. What is the most likely cause?

Accepted Answer

Incorrect route table associations and propagations in the Transit Gateway.. Incorrect route table associations and propagations in the Transit Gateway cause traffic between two VPCs to take a suboptimal path through a third VPC. The Transit Gateway uses route tables to determine the next hop for traffic; if the route table for the source VPC does not have a direct route to the destination VPC but instead has a route pointing to the third VPC (e.g., via a VPN attachment or a transit VPC attachment), traffic will be forwarded through that third VPC. This is a common misconfiguration when route propagation is not properly set up or when static routes are incorrectly prioritized.

Answer

Security groups are blocking the direct path, forcing traffic through a third VPC.

Answer

BGP is not configured between the VPCs, so traffic defaults through a transit VPC.

Answer

ECMP routing is enabled, causing traffic to be load-balanced across multiple paths.

Question 10

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

Accepted Answer

The transit gateway route table propagation is not configured.. The exhibit shows a transit gateway route table attached to the VPC, but no propagation is configured. Without explicit propagation, the VPC attachment's CIDR blocks are not automatically added to the transit gateway route table. The CloudFormation resource AWS::EC2::TransitGatewayRouteTablePropagation must be declared to enable route propagation from the VPC attachment into the transit gateway route table.

Answer

The VPC attachment is not in the 'available' state.

Answer

VPN ECMP support is enabled, preventing propagation.

Answer

DNS support is disabled on the transit gateway.

Question 11

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Accepted Answer

Application Load Balancer. An Application Load Balancer (ALB) terminates HTTPS (port 443) connections and forwards traffic to targets. Flow logs showing ACCEPT for traffic to port 443 on an ALB's internal IP (10.0.2.10) are expected because the ALB listens on that port for incoming client connections. The ALB operates at Layer 7 and is the only listed service that natively accepts HTTPS traffic on port 443 within a VPC.

Answer

Amazon RDS instance

Answer

NAT Gateway

Answer

Amazon S3

Question 12

Which TWO of the following are best practices for securing a VPC with AWS Network Firewall? (Choose two.)

Accepted Answer

Deploy firewall endpoints in at least two Availability Zones for high availability.. Option A is correct because AWS Network Firewall firewall endpoints are Availability Zone–scoped, so deploying endpoints in at least two AZs ensures high availability and prevents a single-AZ failure from taking down inspection. Option C is correct because stateful rule groups allow deep packet inspection and application-layer (Layer 7) filtering using Suricata-compatible rules, which is essential for detecting and blocking sophisticated threats. Option B is incorrect because stateless rules alone cannot perform application-layer inspection and are not a best practice for comprehensive security. Option D is incorrect because Network Firewall can inspect both inbound and outbound traffic, not just outbound. Option E is incorrect because the firewall should be deployed in a dedicated subnet (typically a firewall subnet) rather than the same subnet as workloads, to maintain proper traffic segmentation and routing.

Answer

Use only stateless rules to minimize processing overhead.

Answer

Use Network Firewall only for outbound traffic filtering.

Answer

Deploy the firewall in the same subnet as the workload for low latency.

Question 13

A company has multiple VPCs connected via a transit gateway. Each VPC has a security group that allows traffic from the other VPCs' CIDR blocks. The security group rules are getting complex. How can the company simplify security group management while maintaining the same level of security?

Accepted Answer

Use managed prefix lists in security group rules.. Managed prefix lists let you group CIDR blocks into a single named list and reference that list in security group rules, so instead of maintaining dozens of individual CIDR entries across many security groups, you update the prefix list once and all referencing rules update automatically. This simplifies management while maintaining the same security posture because the rules still enforce the same CIDR-based access.

Answer

Use VPC endpoints for inter-VPC communication.

Answer

Deploy AWS Network Firewall to centralize rules.

Answer

Replace security groups with network ACLs.

Question 14

Which THREE of the following are considerations when designing a Direct Connect implementation for high availability? (Choose three.)

Accepted Answer

Use BGP to advertise the same prefixes over both connections.. Using BGP to advertise the same prefixes over both Direct Connect connections enables active-active or active-passive load balancing and automatic failover. BGP’s route selection and AS_PATH prepending allow you to control traffic flow, ensuring that if one connection fails, the other continues to advertise the same prefixes, maintaining connectivity without manual intervention.

Answer

Use a single connection with high bandwidth.

Answer

Configure static routes to the on-premises network.

Question 15

A company is deploying a public-facing web application on EC2 instances behind an Application Load Balancer. The ALB is configured to terminate HTTPS using a certificate from AWS Certificate Manager. What additional step is required to ensure the ALB can validate the certificate?

Accepted Answer

Ensure the certificate is in the same AWS region as the ALB.. For an Application Load Balancer to terminate HTTPS using a certificate from AWS Certificate Manager (ACM), the certificate must be in the same AWS region as the ALB. ACM certificates are region-specific resources; the ALB can only reference certificates that are stored in the same region where the ALB is deployed. This is a fundamental constraint of ACM integration with regional services like ALB.

Answer

Attach the certificate to an Amazon CloudFront distribution.

Answer

Create a DNS record to validate domain ownership.

Answer

Import the certificate into AWS Certificate Manager Private Certificate Authority.