ANS-C01 Network Implementation Practice Test 27 — 15 Questions

Question 1

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to a partner's VPC with CIDR 10.0.0.0/16 using a VPC peering connection. What is the issue with this configuration?

Accepted Answer

Overlapping CIDR ranges are not supported for VPC peering. VPC peering requires that the CIDR blocks of the peered VPCs do not overlap. In this case, both VPCs use 10.0.0.0/16, which creates an identical address space. When routes are added to the route tables for the peering connection, the destination CIDR would be ambiguous, and the VPC cannot distinguish between local resources and those in the peered VPC, leading to routing conflicts. AWS explicitly rejects peering requests between VPCs with overlapping or identical CIDR ranges.

Answer

The company has reached the maximum number of VPC peering connections

Answer

VPC peering is only supported within the same region

Answer

VPC peering does not support transitive routing

Question 2

A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?

Accepted Answer

Verify that the VPC route table has a route to the on-premises network via the virtual private gateway. Even though the VPN tunnel is 'UP', traffic from the VPC to the on-premises network must be routed through the virtual private gateway (VGW). If the VPC route table does not contain a route for the on-premises CIDR (e.g., 192.168.1.0/24) pointing to the VGW, the instances have no path to reach the on-premises server, regardless of tunnel status.

Answer

Verify that the internet gateway is attached to the VPC

Answer

Verify that the security group for the instances allows outbound ICMP

Answer

Verify that the VPN tunnel is up on both ends

Question 3

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet. They want to provide internet access to instances in private subnets. The NAT gateway is configured with an Elastic IP. The private instances still cannot access the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT gateway. What is missing?

Accepted Answer

The route table for the public subnet where the NAT gateway resides does not have a default route to an internet gateway. The private instances can't access the internet because the NAT gateway itself is in a public subnet that lacks a route to an internet gateway. The route table for the public subnet where the NAT gateway resides must have a default route (0.0.0.0/0) pointing to an internet gateway for the NAT gateway to reach the internet. Without this, the NAT gateway cannot forward traffic from the private instances to the internet. Option A is not the best answer because network ACLs are stateless and by default allow outbound traffic, but they could be misconfigured; however, the most common missing piece is the public subnet's route table. Option B is incorrect because the private subnet route table already has the default route to the NAT gateway. Option C is incorrect because security groups are stateful and automatically allow outbound traffic if inbound is allowed, so they are not blocking.

Answer

The network ACL for the private subnet allows outbound traffic

Answer

The private subnet route table is missing a route to the NAT gateway

Answer

The security group for the instances allows outbound traffic

Question 4

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 attached to the transit gateway. They also have a Direct Connect virtual interface attached to the transit gateway. The on-premises network can reach some VPCs but not the VPC with CIDR 10.0.0.0/16. The transit gateway route table has a static route for the on-premises CIDR and a route propagation from the VPC attachment. What is the most likely issue?

Accepted Answer

The VPC CIDR overlaps with the on-premises CIDR. The most likely issue is that the VPC CIDR (10.0.0.0/16) overlaps with the on-premises CIDR. When CIDR blocks overlap, the transit gateway cannot distinguish between destinations in the VPC and on-premises, leading to routing conflicts. This explains why the on-premises network can reach other VPCs with non-overlapping CIDRs but not this VPC. The static route for the on-premises CIDR and the propagated route from the VPC attachment both exist in the transit gateway route table, but the overlap causes the transit gateway to forward traffic inconsistently or drop it. Options A, C, and D are incorrect: A) The transit gateway has no such attachment limit; C) The route table does have a route to the on-premises network via the static route; D) The VPC attachment is associated and propagating routes.

Answer

The transit gateway has reached the maximum number of attachments

Answer

The transit gateway route table does not have a route to the on-premises network

Answer

The VPC attachment is not associated with the transit gateway route table

Question 5

A company needs to establish a dedicated, low-latency, and consistent network connection from their on-premises data center to AWS. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, low-latency, and consistent private network connection from on-premises to AWS, bypassing the internet. Option A (Site-to-Site VPN) uses the public internet and is less consistent. Option B (VPN CloudHub) connects multiple on-premises sites to AWS but still relies on the internet. Option C (VPC peering) connects VPCs within AWS, not on-premises. Therefore, D is correct.

Answer

AWS Site-to-Site VPN

Answer

AWS VPN CloudHub

Answer

VPC peering

Question 6

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?

Accepted Answer

A route in the public subnet's route table to an internet gateway. A NAT gateway must be placed in a public subnet and requires an Elastic IP address (E) to enable outbound internet traffic with a source IP that can be routed back. Additionally, the public subnet where the NAT gateway resides must have a route in its route table that points to an internet gateway (C) for the NAT gateway to reach the internet. Security groups are not attached to NAT gateways (they use security groups for attached instances, but NAT gateways themselves are not security group–aware). Network ACLs control traffic at the subnet level but are not a requirement specific to NAT gateway functionality; they can be configured as needed. Deploying the NAT gateway in a private subnet (A) would prevent it from accessing the internet because private subnets do not have direct routes to an internet gateway. Therefore, only options C and E are required.

Answer

The NAT gateway is deployed in a private subnet

Answer

A security group attached to the NAT gateway

Answer

A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Accepted Answer

The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway. Necessary because the VPC route tables must have a route for 172.16.0.0/12 pointing to the transit gateway to forward traffic to on-premises. Option B is necessary because the VPC must be attached to the transit gateway to allow communication. Option C is necessary because the transit gateway route table must include a static route for 172.16.0.0/12 pointing to the VPN attachment. Option D is not necessary because the on-premises router does not need to advertise the route over BGP; the static route in the transit gateway suffices. Option E is not necessary because the VPN tunnel can use static routing instead of dynamic BGP.

Answer

The on-premises router is advertising the 172.16.0.0/12 route over BGP

Answer

The VPN tunnel is configured with dynamic BGP routing

Question 8

Which TWO of the following are valid methods to provide outbound internet access to instances in a private subnet?

Accepted Answer

Deploy a NAT instance in a public subnet and configure routing. The correct answers are C and D. A NAT instance (C) or a NAT gateway (D) deployed in a public subnet with a default route pointing to them from the private subnet provides outbound internet access while keeping instances private. Option A is incorrect because VPC endpoints only provide private access to AWS services, not general internet. Option B is incorrect because an internet gateway is attached to the VPC, not directly to a subnet, and instances in private subnets cannot use it without a NAT device. Option E is incorrect because a VPN connection is for private connectivity to on-premises networks, not internet access.

Answer

Use a VPC endpoint for internet access

Answer

Attach an internet gateway directly to the private subnet

Answer

Use a VPN connection to the internet

Question 9

Refer to the exhibit. A company has two VPCs (vpc-aaaaaaaa and vpc-bbbbbbbb) that are peered. The CIDR blocks are both 10.0.0.0/16. The peering connection status is 'active'. Which of the following is true about this configuration?

Accepted Answer

The VPCs cannot communicate because of overlapping CIDR blocks. VPC peering does not support overlapping CIDR blocks. Even though the peering connection status is active, routes cannot be added to the route tables because the CIDR blocks are identical (both 10.0.0.0/16), preventing communication. Option B is incorrect because the peering connection can become active despite overlapping CIDRs; the issue arises at the routing layer. Option C is incorrect because the overlapping CIDRs prevent any communication between the VPCs. Option D is incorrect because DNS resolution is not automatically enabled; it requires additional configuration.

Answer

The VPC peering connection will not become active due to overlapping CIDRs

Answer

The VPCs can communicate using the peering connection without any issues

Answer

DNS resolution between the VPCs will be automatically enabled

Question 10

A company has a VPC with CIDR 10.0.0.0/16. They have two Availability Zones (us-east-1a and us-east-1b). In each AZ, there is a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). A NAT Gateway is deployed in the public subnet of us-east-1a. The private route tables for both private subnets have a default route pointing to the NAT Gateway. An application team has deployed EC2 instances in the private subnets. They report that instances in us-east-1b cannot access the internet, while instances in us-east-1a can. The NAT Gateway is healthy and has an Elastic IP attached. The route tables for the public subnets have a default route to the Internet Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway has reached the maximum number of concurrent connections. The most likely cause is that the NAT Gateway has reached its maximum number of concurrent connections. When connection limits are exceeded, new outbound connections from instances in any private subnet may fail, leading to internet access issues. This explains why instances in us-east-1a (which may have established connections earlier) can still access the internet, while instances in us-east-1b cannot. Option A is incorrect because the NAT Gateway is correctly placed in a public subnet. Option B is incorrect because the route table of the public subnet in us-east-1b does not affect traffic from private instances; they route directly to the NAT Gateway in us-east-1a. Option D is incorrect because cross-AZ data transfer charges are a cost concern and do not block network traffic. Therefore, the most plausible technical cause is option C.

Answer

The NAT Gateway is deployed in a private subnet

Answer

The route table for the public subnet in us-east-1b does not have a default route to the Internet Gateway

Answer

The NAT Gateway is in a different Availability Zone than the private subnet instances, causing cross-AZ data transfer charges

Question 11

A company has a Direct Connect connection with a single private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The VPC CIDR is 10.0.0.0/16. The on-premises CIDR is 172.16.0.0/12. The BGP session is established, and the on-premises router is advertising the 172.16.0.0/12 route to the VGW. The VGW is configured to propagate routes to the VPC route tables. However, instances in the VPC cannot reach on-premises resources. The VPC route table shows a propagated route for 172.16.0.0/12 with a target of the VGW. What is the most likely issue?

Accepted Answer

The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface. The on-premises router must also have a route back to the VPC CIDR via the Direct Connect interface for traffic to flow bidirectionally. Option A is wrong because security groups are stateful, so outbound traffic is automatically allowed. Option B is wrong because the VPC route table does contain the propagated route for 172.16.0.0/12. Option D is wrong because the BGP session is established and the VGW does not need to advertise the VPC CIDR for outbound traffic; the problem is the lack of a return route on the on-premises router.

Answer

The security groups for the VPC instances do not allow outbound traffic to the on-premises network

Answer

The VPC route table does not have a route for the on-premises CIDR

Answer

The BGP session is not advertising the VPC CIDR to the on-premises router

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They have an Application Load Balancer (ALB) in public subnets and EC2 instances in private subnets. The ALB is configured to route traffic to the instances. Users can reach the ALB, but the ALB returns 502 Bad Gateway errors. The target group health checks are failing. The instances are running a web server on port 80. The security group for the instances allows inbound traffic from the ALB's security group on port 80. The network ACL for the private subnets allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24). What is the most likely cause of the health check failures?

Accepted Answer

The network ACL for the private subnets is stateless and is blocking the return traffic from the instances to the ALB. The most likely cause is that the network ACL for the private subnets is stateless. While the inbound rule allows traffic on port 80 from the public subnet CIDR (which includes the ALB's IPs), the outbound rule does not allow the return traffic from the instances to the ALB. This return traffic uses ephemeral ports and must be explicitly allowed in the outbound rules of the private subnet NACL. Without this, the ALB cannot receive responses from the instances, causing health checks to fail and resulting in 502 errors. Option A is incorrect because the inbound NACL rule does allow traffic from the ALB's subnet. Option B is incorrect because the security group allows inbound traffic from the ALB's security group. Option D is incorrect because the target group port is correctly set to 80.

Answer

The network ACL for the private subnets does not allow inbound traffic on port 80 from the ALB's subnet

Answer

The security group for the instances does not allow inbound traffic from the ALB

Answer

The target group is configured with the wrong port

Question 13

A company is deploying a multi-tier application on AWS and needs to ensure that traffic between the web tier and the application tier does not traverse the internet. Both tiers are deployed in the same VPC but in different subnets. What is the MOST secure way to meet this requirement?

Accepted Answer

Use route tables and security groups to allow traffic within the VPC. The most secure way to ensure that traffic between the web tier and the application tier does not traverse the internet is to use route tables and security groups to allow traffic within the VPC. Both tiers are in the same VPC but in different subnets, so traffic stays within the VPC by default if routing is configured correctly. Route tables direct traffic between subnets, and security groups act as virtual firewalls to control inbound and outbound traffic. Option D is correct. Option A is wrong because an Internet Gateway is used for internet access, not for routing within a VPC. Option B is wrong because VPC Peering connects different VPCs, not subnets within the same VPC. Option C is wrong because a NAT Gateway is for outbound internet access from private subnets, not for inter-subnet communication.

Answer

Use an Internet Gateway to route traffic between subnets

Answer

Use VPC Peering between the subnets

Answer

Use a NAT Gateway in each subnet for inter-subnet communication

Question 14

A network engineer is troubleshooting connectivity issues from an on-premises data center to an Amazon VPC via an AWS Site-to-Site VPN. The VPN tunnel is up, but ping from an on-premises host (10.0.0.5) to an EC2 instance (172.16.1.10) fails. The VPC CIDR is 172.16.0.0/16. The on-premises CIDR is 10.0.0.0/8. The customer gateway device has a route for 172.16.0.0/16 pointing to the VPN tunnel. The VPC route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. Security groups and NACLs allow ICMP. What is the MOST likely cause?

Accepted Answer

The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR. The most likely cause is that the subnet route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR (10.0.0.0/8). Although the VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway, the EC2 instance's subnet may be using a custom route table that lacks this route. Without it, the EC2 instance's return ICMP traffic to 10.0.0.5 is sent via the local route (which only covers the VPC CIDR 172.16.0.0/16) and does not reach the VPN tunnel, causing the ping to fail.

Answer

The on-premises host does not have a route to the VPC CIDR

Answer

The customer gateway device is not configured with the correct pre-shared key

Answer

The virtual private gateway is not attached to the correct VPC

Question 15

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The ALB is internet-facing and uses TLS termination. The application requires that client IP addresses be preserved in the backend logs. The backend instances are in private subnets behind the ALB. Which configuration will ensure client IP addresses are preserved without additional overhead?

Accepted Answer

Configure the ALB to pass the X-Forwarded-For header and ensure backend logs parse it. The ALB automatically adds the X-Forwarded-For header to HTTP requests, containing the original client IP address. Since the backend instances are in private subnets and receive traffic from the ALB's private IPs, parsing this header in the backend logs is the standard, zero-overhead method to preserve client IPs for HTTP/HTTPS traffic with TLS termination.

Answer

Attach a VPC Endpoint to the ALB to capture client IP

Answer

Enable Proxy Protocol v2 on the target group

Answer

Replace the ALB with a Network Load Balancer (NLB)