ANS-C01 Network Implementation Practice Test 28 — 15 Questions

Question 1

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They want to add a second Direct Connect connection for redundancy. What is the MINIMUM number of virtual interfaces required to achieve active-active failover for the VPC?

Accepted Answer

Two private virtual interfaces (one on each connection). Option B is correct because with two Direct Connect connections, you can create a private VIF on each, and using BGP and AS_PATH prepending, you can achieve active-active load balancing and failover. Option A is wrong because a single VIF cannot provide redundancy. Option C is wrong because you need two VIFs for active-active. Option D is wrong because transit VIFs are for connecting to Direct Connect Gateway, not directly to a VPC.

Answer

Two transit virtual interfaces (one on each connection)

Answer

One private virtual interface and one transit virtual interface

Answer

One private virtual interface

Question 2

A network engineer is configuring an AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network advertises a prefix 10.0.0.0/8. One of the VPCs has a CIDR of 10.0.0.0/16. What will happen to traffic destined to 10.0.0.5 from another VPC attached to the Transit Gateway?

Accepted Answer

Traffic is routed to the VPC because of a more specific route. Option B is correct because Transit Gateway uses the most specific route (longest prefix match). The VPC's 10.0.0.0/16 is more specific than the on-premises 10.0.0.0/8, so traffic to 10.0.0.5 will be routed to the VPC. Option A is wrong because route propagation is not the issue; the more specific route is preferred. Option C is wrong because the route is not dropped; it uses the VPC route. Option D is wrong because the on-premises route is less specific, so it will not be used.

Answer

Traffic is dropped due to conflicting routes

Answer

Traffic is routed to the on-premises network because it is learned via Direct Connect

Answer

Traffic is load-balanced between the VPC and on-premises

Question 3

A company is deploying a global application with users in North America and Europe. They have set up an Application Load Balancer (ALB) in us-east-1 and another in eu-west-1. They want to route users to the nearest ALB using AWS Global Accelerator. What is the correct configuration to achieve this?

Accepted Answer

Create a Global Accelerator accelerator with endpoint groups in each region, each pointing to the respective ALB. Option A is correct because Global Accelerator uses Anycast IP addresses and health checks to route traffic to the nearest healthy endpoint (ALB). Option B is wrong because Route 53 latency-based routing does not use Anycast; it relies on DNS, which can be cached. Option C is wrong because CloudFront is a CDN, not a load balancer for dynamic content without caching. Option D is wrong because a Network Load Balancer (NLB) is not needed; Global Accelerator can directly target ALBs.

Answer

Use Amazon CloudFront with origins pointing to each ALB

Answer

Place each ALB behind a Network Load Balancer and use Global Accelerator

Answer

Create a Route 53 latency record set with aliases to each ALB

Question 4

A network engineer is troubleshooting an AWS Direct Connect connection that is experiencing high latency. The connection is a 1 Gbps dedicated connection. The engineer notices that the link utilization is at 90%. What is the MOST likely cause of the high latency?

Accepted Answer

High bandwidth utilization causing queuing. Option B is correct because high link utilization can cause queuing delays, which increase latency. Option A is wrong because jumbo frames generally reduce latency. Option C is wrong because BGP timers affect convergence, not latency. Option D is wrong because the virtual interface type does not directly cause high latency.

Answer

The virtual interface is configured as private instead of public

Answer

BGP keepalive timer misconfiguration

Answer

The use of jumbo frames

Question 5

A company has a VPC with public and private subnets. They have a web server in the public subnet that needs to make API calls to Amazon S3. The web server has a public IP. What is the MOST secure way to allow the web server to access S3 without traversing the internet?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the public subnet's route table to S3 via the endpoint. Option C is correct because a Gateway VPC Endpoint for S3 allows private access to S3 without internet traffic, and it is free and highly available. Option A is wrong because a NAT Gateway is used for outbound internet access, but it still uses the internet. Option B is wrong because an Interface VPC Endpoint for S3 is also private but more expensive than Gateway Endpoint. Option D is wrong because a proxy server adds complexity and is not the most secure or simple solution.

Answer

Place a forward proxy server in the public subnet and configure the web server to use it for S3

Answer

Create an Interface VPC Endpoint for S3 in the public subnet

Answer

Set up a NAT Gateway in the same subnet and route S3 traffic through it

Question 6

A company is building a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via Direct Connect. The on-premises network uses BGP to advertise routes to the Transit Gateway. One of the VPCs has an overlapping CIDR (10.0.0.0/16) with the on-premises network (10.0.0.0/8). The company wants to ensure that traffic from other VPCs to 10.0.0.0/16 goes to the VPC, not on-premises. What configuration is required?

Accepted Answer

No additional configuration is needed; the more specific route will be preferred automatically. Option C is correct because Transit Gateway uses longest prefix match. The VPC's /16 is more specific than the on-premises /8, so traffic to 10.0.0.0/16 will automatically go to the VPC. No additional configuration is needed. Option A is wrong because disabling route propagation would remove the on-premises routes entirely. Option B is wrong because a static route is not needed; longest prefix match already handles it. Option D is wrong because AS_PATH prepending is used to influence BGP path selection, but in this case, longest prefix match is sufficient.

Answer

Use AS_PATH prepending on the on-premises BGP advertisements to make them less preferred

Answer

Add a static route in the Transit Gateway route table for 10.0.0.0/16 pointing to the VPC attachment

Answer

Disable route propagation from the Direct Connect virtual interface to the Transit Gateway

Question 7

A company is designing a VPC with multiple subnets for a three-tier application. They need to ensure that the database tier (private subnet) can be accessed only by the application tier (private subnet) and that no other resources in the VPC can access the database. Which TWO security mechanisms should be used together to achieve this? (Choose TWO.)

Accepted Answer

Security groups. Option A (Network ACLs) and Option D (Security groups) are correct. Network ACLs provide stateless filtering at the subnet level, and security groups provide stateful filtering at the instance level. By configuring both, you can restrict access to the database subnet only from the application subnet. Option B is incorrect because VPC Flow Logs are for monitoring, not access control. Option C is incorrect because an IAM policy controls permissions for AWS API calls, not network traffic. Option E is incorrect because a route table controls routing, not filtering.

Answer

Route tables

Answer

VPC Flow Logs

Answer

IAM policies attached to the database instances

Question 8

A company is migrating its on-premises data center to AWS using Direct Connect and a VPN connection as backup. The company has multiple VPCs connected via a Transit Gateway. They want to ensure high availability for the Direct Connect connection. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure BGP with multiple virtual interfaces on the Direct Connect connections. Option A and Option D are correct. Option A: A second Direct Connect connection provides physical redundancy. Option D: Using BGP with multiple virtual interfaces allows active-active or active-passive failover. Option B is incorrect because a VPN connection is already in place as backup, but for Direct Connect high availability, you need redundant connections. Option C is incorrect because a single Direct Connect location is a single point of failure; you need two separate locations. Option E is incorrect because increasing bandwidth does not provide redundancy.

Answer

Replace the VPN backup with a second Direct Connect connection

Answer

Enable jumbo frames on the Direct Connect connection

Answer

Use a single Direct Connect connection but with higher bandwidth

Question 9

A company is setting up AWS Site-to-Site VPN for connectivity between its on-premises network and AWS VPC. They want to ensure the VPN tunnel is highly available. Which THREE components should be configured? (Choose THREE.)

Accepted Answer

BGP dynamic routing over the VPN tunnels. Options A, C, and D are correct. Option A: Two tunnels per VPN connection provide redundancy. Option C: A second customer gateway device ensures on-premises redundancy. Option D: BGP dynamic routing allows automatic failover. Option B is incorrect because a single VPN connection with one tunnel is not highly available. Option E is incorrect because static routes do not provide dynamic failover.

Answer

A single VPN connection with one tunnel

Answer

Static routing instead of BGP

Question 10

A company has a production VPC with CIDR 10.0.0.0/16. They have an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones. The ALB distributes traffic to a fleet of EC2 instances in private subnets. The EC2 instances need to access an Amazon S3 bucket to retrieve configuration files. The company wants to minimize data transfer costs and ensure that traffic to S3 does not traverse the internet. A network engineer created a Gateway VPC Endpoint for S3 in the VPC and added a route in the public subnet route tables pointing to the endpoint. However, the EC2 instances still cannot access the S3 bucket. The security groups for the EC2 instances allow outbound HTTPS to 0.0.0.0/0. The NACLs are default (allow all). The S3 bucket policy allows access from the VPC endpoint. What is the MOST likely reason the EC2 instances cannot access S3?

Accepted Answer

The route to the Gateway VPC Endpoint was added only to public subnets, not to private subnets. Option A is correct. The Gateway VPC Endpoint is only accessible from within the VPC, but the route to the endpoint must be added to the route tables of the subnets where the EC2 instances reside. The engineer added the route only to public subnet route tables, not to the private subnet route tables. Therefore, traffic from the EC2 instances destined to S3 uses the default route (0.0.0.0/0) which goes through the NAT Gateway or Internet Gateway, not through the endpoint. Option B is incorrect because the security group rule allows outbound HTTPS to all destinations. Option C is incorrect because the S3 bucket policy allows the VPC endpoint. Option D is incorrect because the endpoint is in the same region as the bucket.

Answer

The Gateway VPC Endpoint is in a different region than the S3 bucket

Answer

The security group for the EC2 instances does not allow outbound traffic to the S3 prefix list

Answer

The S3 bucket policy does not include a condition for the VPC endpoint

Question 11

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They have also set up a Site-to-Site VPN as a backup. The VPC has a virtual private gateway (VGW) attached. The on-premises network uses BGP over the Direct Connect and static routes for the VPN. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect when it is available; instead, it goes over the VPN. The VPC route table has a route for the on-premises CIDR (10.0.0.0/8) to the VGW. The VPN connection is configured with static routes. What is the MOST likely cause of this behavior?

Accepted Answer

The VPN static route has higher precedence than the BGP route from Direct Connect. Option D is correct. When using a VGW, AWS automatically propagates routes from the Direct Connect virtual interface and the VPN connection into the VPC route table. If both routes are propagated, the VPN route (static) may have a lower metric or be preferred due to BGP attributes? Actually, by default, AWS prefers the more specific route. But here both are to the same CIDR? The on-premises CIDR is 10.0.0.0/8. The Direct Connect virtual interface advertises this via BGP. The VPN static route also specifies this CIDR. AWS route tables use the longest prefix match, but if both routes have the same prefix length, the one with the lower BGP metric (if BGP) or the static route? Actually, static routes have higher precedence than propagated routes. So the static route from the VPN would be preferred over the BGP route from Direct Connect. That is the issue. The engineer should either remove the static route from the VPN or use BGP on the VPN to allow path selection. Option A is incorrect because both are to the VGW. Option B is incorrect because the VGW is attached. Option C is incorrect because the VPC route table does have a route.

Answer

The VPC route table does not have a route for the on-premises CIDR

Answer

The VGW is not attached to the VPC

Answer

The Direct Connect virtual interface is not associated with the VGW

Question 12

A small company has a single VPC with one public subnet and one private subnet. They have a web server in the public subnet and a database server in the private subnet. The web server needs to access the database server on port 3306 (MySQL). The network engineer has configured the security group for the database server to allow inbound TCP port 3306 from the security group of the web server. However, the web server cannot connect to the database server. The network ACL for the private subnet is the default (allows all inbound and outbound). The web server can ping the database server's private IP. What is the MOST likely cause of the connection failure?

Accepted Answer

The MySQL service on the database server is not running or not listening on port 3306. Option C is correct. The security group for the database server allows inbound from the web server's security group, which is correct. However, security groups are stateful, so the return traffic is automatically allowed. The issue is likely that the database server is not listening on port 3306 or the MySQL service is not running. Since ping works, the network layer is fine. Option A is incorrect because NACLs are default allow. Option B is incorrect because the security group rule is correct. Option D is incorrect because the web server is in the same VPC, so it can reach the private IP.

Answer

The web server cannot reach the private IP of the database server because it is in a different subnet

Answer

The network ACL for the private subnet is blocking inbound traffic on port 3306

Answer

The security group for the database server is not allowing inbound traffic from the web server's security group

Question 13

A company is deploying a multi-tier web application across multiple Availability Zones in a VPC. The architecture includes public-facing Application Load Balancers, Amazon EC2 instances in private subnets, and an Amazon RDS for MySQL Multi-AZ DB instance. To meet compliance requirements, all traffic between the web tier and database tier must be encrypted and must not traverse the internet. Which TWO actions should the company take to implement this securely? (Choose two.)

Accepted Answer

Enable SSL/TLS encryption on the RDS DB instance and configure the web servers to connect using SSL.. Option A is correct because enabling encryption in transit with SSL/TLS between web tier and RDS MySQL encrypts the traffic. Option C is correct because using an RDS endpoint within the same VPC ensures traffic does not traverse the internet. Option B is incorrect because RDS instances do not have Elastic IPs in private subnets. Option D is incorrect because an RDS endpoint already provides a private IP within the VPC; a VPC endpoint is for services like S3. Option E is incorrect because a VPN connection is not needed for traffic within the same VPC.

Answer

Establish an AWS Site-to-Site VPN between the web tier subnets and the database subnet.

Answer

Create a VPC endpoint for Amazon RDS and route database traffic through it.

Answer

Assign an Elastic IP address to the RDS DB instance to ensure a stable IP for the web tier.

Question 14

A company is implementing a hybrid network architecture with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The company needs to ensure that traffic between VPCs is inspected by a centralized security appliance running on EC2 instances in a dedicated inspection VPC. To achieve this, traffic must be routed through the inspection VPC before reaching its destination. Which TWO configurations are required? (Choose two.)

Accepted Answer

Create a blackhole route in the Transit Gateway route table for the VPC CIDR blocks that are destined for other VPCs.. Option A is correct because blackhole routes in the Transit Gateway route table prevent direct VPC-to-VPC communication. Option C is correct because the inspection VPC must advertise specific routes to attract traffic. Option B is incorrect because enabling route propagation does not force traffic through inspection VPC. Option D is incorrect because NAT gateway is for outbound internet traffic. Option E is incorrect because VPC endpoints are not used for inter-VPC traffic inspection.

Answer

Enable route propagation for all VPC attachments in the Transit Gateway route table.

Answer

Configure a VPC Gateway Endpoint for the inspection VPC to attract traffic.

Answer

Deploy a NAT gateway in each VPC to route traffic through the inspection VPC.

Question 15

A company is using AWS Direct Connect to connect its on-premises network to a VPC via a private virtual interface (VIF) attached to a virtual private gateway (VGW). The company wants to add redundant connectivity using a second Direct Connect connection from a different provider. The network team proposes using a Direct Connect gateway (DXGW) with two private VIFs from different connections, each attached to the DXGW. The DXGW will be associated with the VGW. Which THREE steps are required to complete this configuration? (Choose three.)

Accepted Answer

Associate both private virtual interfaces with the same Direct Connect gateway.. Option A is correct because both VIFs must be associated with the same DXGW. Option B is correct because the DXGW must be associated with the VGW. Option D is correct because the on-premises router must advertise the same BGP prefixes over both VIFs to enable active-active or failover. Option C is incorrect because VGWs are regional, not per-AZ. Option E is incorrect because the VPC route tables must have routes pointing to the VGW, not to the DXGW directly.

Answer

Add routes to the VPC subnets' route tables pointing to the Direct Connect gateway.

Answer

Create a separate virtual private gateway for each Direct Connect connection.