ANS-C01 Network Implementation Practice Test 28 — 15 Questions

Question 1

A company is deploying a VPC with public and private subnets in two Availability Zones. The workloads in the private subnets need to access the internet for software updates. What is the MOST secure way to provide this internet access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a NAT gateway in a public subnet and update the private subnets' route table to point default traffic to the NAT gateway.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. This is the most secure and AWS-recommended method because it uses Source Network Address Translation (SNAT) to mask private IPs behind the NAT gateway's Elastic IP, and it requires only a route table update in the private subnets to direct default traffic (0.0.0.0/0) to the NAT gateway.

Answer

Set up a VPN connection to an on-premises network with internet access.

Answer

Use a transit gateway with a VPC attachment and route internet traffic through a centralized inspection VPC.

Answer

Attach an internet gateway to the VPC and route the private subnets' traffic to it.

Question 2

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances. Which AWS service can support multicast within a VPC?

Accepted Answer

Transit Gateway with multicast domain. AWS Transit Gateway supports multicast traffic through the creation of a multicast domain, which allows EC2 instances in different VPCs or subnets to send and receive multicast traffic. This is the only native AWS service that supports multicast within a VPC environment, making it the correct choice for migrating a legacy application that requires multicast.

Answer

VPC native multicast

Answer

Amazon CloudFront

Answer

Application Load Balancer

Question 3

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use a single Direct Connect connection to connect to multiple VPCs in different AWS accounts. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway (DX Gateway) is the correct service because it allows a single Direct Connect connection to be associated with multiple VPCs across different AWS accounts and regions. The DX Gateway acts as a regional or global transit hub, enabling private connectivity from on-premises to multiple VPCs without needing separate Direct Connect connections for each VPC. This is achieved by associating the DX Gateway with virtual private gateways (VGWs) in each target VPC, and then using AWS Resource Access Manager (RAM) to share the DX Gateway with other accounts.

Answer

Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 4

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table in the private subnet does not have a default route to the NAT gateway.. For an EC2 instance in a private subnet to reach the internet via a NAT gateway, the private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the target. Without this route, traffic destined for the internet has no path to the NAT gateway, so the instance can communicate within the VPC but cannot reach external hosts. Option D correctly identifies this missing route as the most likely cause.

Answer

The security group of the EC2 instance blocks outbound HTTPS traffic.

Answer

The NAT gateway does not have an Elastic IP address.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 5

A company is designing a hybrid network using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to configure a virtual interface (VIF) that provides connectivity to multiple VPCs in the same region. Which type of VIF should they use?

Accepted Answer

Transit virtual interface. A transit virtual interface (VIF) is the correct choice because it is specifically designed to connect a Direct Connect gateway to a single physical connection, enabling connectivity to multiple VPCs in the same or different AWS Regions. Unlike a private VIF, which only connects to a single VPC, a transit VIF works with a Direct Connect gateway and supports up to 3,000 VPC attachments per gateway, making it ideal for multi-VPC architectures.

Answer

Hosted virtual interface

Answer

Public virtual interface

Answer

Private virtual interface

Question 6

A company has several VPCs in the same AWS account and region. They want to centrally manage and monitor network traffic between these VPCs and also to on-premises networks. Which AWS service should they use?

Accepted Answer

Transit Gateway. AWS Transit Gateway (C) is the correct choice because it acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, simplifying network management and enabling centralized monitoring. It supports transitive routing between all attached networks, which is essential for the company's requirement to manage and monitor traffic across many VPCs and their on-premises environment.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

AWS VPN CloudHub

Question 7

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block and ensure that traffic from the internet to the IPv6-enabled resources is allowed. Which configuration is required?

Accepted Answer

Attach an internet gateway and update route tables for IPv6.. To enable IPv6 communication from the internet to resources in a VPC, you must associate an IPv6 CIDR block with the VPC, attach an internet gateway, and update the route tables to include a default route (::/0) pointing to the internet gateway for IPv6 traffic. Option B correctly describes this configuration, as the internet gateway handles both IPv4 and IPv6 traffic, and route tables must be explicitly updated for IPv6.

Answer

Attach a NAT gateway to the VPC and update route tables.

Answer

Create a Virtual Private Gateway and attach the VPC.

Answer

Create a Transit Gateway and attach the VPC.

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. Which additional configuration is needed?

Accepted Answer

Ensure the public subnet's route table has a route 0.0.0.0/0 pointing to an internet gateway.. The NAT gateway resides in the public subnet, but it still needs a route to the internet. The public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW) so that traffic from the NAT gateway can be forwarded to the internet. Without this route, the NAT gateway cannot send traffic beyond the VPC, even though the private subnet's route table correctly points to the NAT gateway.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach a security group to the NAT gateway allowing outbound traffic.

Answer

Add a route to the NAT gateway in the private subnet's route table for destination 0.0.0.0/0.

Question 9

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which AWS service should be used to allow this access without traversing the internet?

Accepted Answer

VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 buckets without traversing the internet by using AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic through the endpoint, which is horizontally scaled and highly available. This avoids the need for a NAT gateway or internet gateway, keeping traffic within the AWS backbone.

Answer

Transit Gateway

Answer

NAT gateway

Answer

Internet gateway

Question 10

A company has multiple VPCs that need to communicate with each other and with an on-premises network via AWS Transit Gateway. Which THREE of the following are valid attachment types for a transit gateway?

Accepted Answer

Direct Connect Gateway. AWS Transit Gateway supports attachments to Direct Connect Gateways, enabling integration of Direct Connect virtual interfaces with the transit gateway for hybrid connectivity. This allows traffic from on-premises networks connected via Direct Connect to be routed through the transit gateway to multiple VPCs and other attachments.

Answer

Internet Gateway

Answer

Network Load Balancer

Question 11

A company is troubleshooting connectivity issues between two VPCs that are peered using an inter-region VPC peering connection. The VPCs have the following CIDR blocks: VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Which THREE of the following are possible reasons for the connectivity failure?

Accepted Answer

The route tables in each VPC do not have routes pointing to the peer VPC's CIDR.. For inter-region VPC peering to function, each VPC must have explicit routes in its route tables pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, traffic destined for the peer VPC will not be forwarded over the peering link, causing connectivity failure.

Answer

The VPC CIDR blocks overlap.

Answer

The VPC peering connection is in a 'pending-acceptance' state.

Question 12

A company is deploying a VPC with public and private subnets in two Availability Zones. The workloads in the private subnets need to access the internet for software updates. What is the MOST secure way to provide this internet access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 targeting the NAT gateway.. For EC2 instances in private subnets to reach the internet via a NAT gateway, the private subnet route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the next hop. The NAT gateway resides in a public subnet and translates the private IPs to its own Elastic IP, forwarding traffic to the internet gateway. Without this route, traffic from private instances has no path to the NAT gateway.

Answer

Add a route in the public subnet route table pointing to the internet gateway.

Answer

Attach an egress-only internet gateway to the private subnets.

Answer

Create a VPC peering connection between the VPC and the NAT gateway.

Question 13

A network engineer is troubleshooting connectivity between two EC2 instances in the same VPC but different subnets. The instances can ping each other's private IP addresses, but traffic on TCP port 443 fails. What is the most likely cause?

Accepted Answer

Security group or network ACL rules blocking port 443.. Since the instances can ping each other, ICMP traffic is working, which rules out routing issues and confirms that the instances are reachable at Layer 3. TCP port 443 failing specifically indicates that a firewall rule is blocking the HTTPS traffic. Security groups are stateful and operate at the instance level, while network ACLs are stateless and operate at the subnet level; either can block port 443 while allowing ICMP, making this the most likely cause.

Answer

VPC Flow Logs misconfiguration.

Answer

Internet gateway not attached to the VPC.

Answer

Missing route in the route table.

Question 14

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. They have multiple VPCs in a single AWS Region. Which design minimizes the number of Direct Connect virtual interfaces while providing connectivity to all VPCs?

Accepted Answer

Create one private VIF attached to a Direct Connect gateway and associate the gateway with all VPCs.. A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region. By attaching the Direct Connect gateway to all target VPCs, you eliminate the need for separate private VIFs per VPC, minimizing operational overhead and cost while maintaining private connectivity.

Answer

Set up a transit VPC with EC2-based routers.

Answer

Create a separate private VIF for each VPC.

Answer

Use a single public VIF and route through the internet.

Question 15

A company is deploying a latency-sensitive application across two AWS Regions using Application Load Balancers (ALBs) and AWS Global Accelerator. The application uses TCP port 8443. Which configuration ensures the lowest possible latency for global users?

Accepted Answer

Use AWS Global Accelerator with endpoints as the ALBs in each Region.. AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal ALB endpoint, minimizing internet hops and latency. For TCP port 8443, Global Accelerator preserves the client IP and provides connection termination at the edge, ensuring the lowest possible latency for global users by avoiding the public internet.

Answer

Use Amazon CloudFront with the ALBs as origins.

Answer

Use Amazon Route 53 latency-based routing with ALB endpoints in each Region.

Answer

Deploy a Network Load Balancer in each Region and use Route 53 geoproximity routing.