ANS-C01 Network Implementation Practice Test 29 — 15 Questions

Question 1

A company has a Direct Connect connection with a private virtual interface (VIF) attached to a Virtual Private Gateway (VGW) that is associated with a single VPC (10.0.0.0/16). The on-premises network uses BGP to exchange routes. The company has recently acquired another company and needs to connect to their VPC (172.16.0.0/16) in the same region. They want to use the existing Direct Connect connection to access both VPCs. The network engineer creates a Transit Gateway, attaches both VPCs, and creates a transit virtual interface (VIF) to the Transit Gateway. The engineer also deletes the private VIF. However, after the change, on-premises users cannot reach either VPC. What should the engineer do to restore connectivity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure BGP on the on-premises router to peer with the Transit Gateway over the transit VIF.. When you migrate from a private VIF to a transit VIF, the BGP peering session that previously existed between the on-premises router and the VGW is torn down. The transit VIF terminates on the Transit Gateway, so the on-premises router must establish a new BGP session with the Transit Gateway's BGP peer IP (from the transit VIF's /30 or /29 address range) using the customer-side IP as the neighbor. Without reconfiguring BGP on the on-premises router to peer with the TGW, no routes are exchanged and both VPCs become unreachable.

Answer

Attach the VPCs to the Transit Gateway with different route tables.

Answer

Create a new private VIF to each VPC.

Answer

Enable route propagation on the Transit Gateway route tables.

Question 2

A company is setting up a Direct Connect connection to AWS. They have a virtual private gateway (VGW) attached to their VPC. They need to establish a single logical connection over the Direct Connect link to access all subnets in the VPC. Which resource should they create on the Direct Connect virtual interface?

Accepted Answer

A private virtual interface (VIF) with a BGP session to the VGW.. A private virtual interface (VIF) is the correct resource because it allows you to connect your on-premises network directly to a VPC via a Direct Connect link. By associating the private VIF with a virtual private gateway (VGW) and establishing a BGP session, you create a single logical connection that provides Layer 3 access to all subnets in the VPC, as the VGW handles routing between the Direct Connect link and the VPC's route tables.

Answer

A hosted virtual interface (VIF) provided by an AWS Partner.

Answer

A public virtual interface (VIF) with a BGP session to the VGW.

Answer

A transit virtual interface (VIF) to the VGW.

Question 3

A company is designing a multi-account AWS environment using AWS Organizations. They need to centralize VPC flow logs and network traffic inspection across all accounts. Which architecture meets these requirements with minimal operational overhead?

Accepted Answer

Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.. It uses a central inspection VPC with AWS Network Firewall and Transit Gateway to route traffic from all VPCs through a single inspection point. This architecture centralizes both VPC flow logs and traffic inspection with minimal operational overhead, as Transit Gateway simplifies network connectivity and AWS Network Firewall provides managed, scalable inspection without per-account firewall management.

Answer

Use AWS Network Firewall in each VPC and aggregate logs centrally.

Answer

Enable VPC flow logs in each account and send them to a central S3 bucket. Use Network Access Analyzer for inspection.

Answer

Create VPC peering connections between all VPCs and deploy a third-party firewall in one VPC.

Question 4

A company is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) that are peered together. Both VPCs are in the same region. VPC-A has a CIDR of 10.0.0.0/16 and VPC-B has a CIDR of 10.0.0.0/16. The peering connection is established and the route tables are updated. However, EC2 instances in VPC-A cannot ping EC2 instances in VPC-B. What is the most likely cause?

Accepted Answer

The VPCs have overlapping CIDR blocks.. VPC peering requires non-overlapping CIDR blocks because the VPCs must have unique IP address spaces for routing to work correctly. Since both VPC-A and VPC-B use the same CIDR 10.0.0.0/16, the route tables cannot distinguish between the two VPCs, causing traffic to be misrouted or dropped. This is the most likely cause of the ping failure, as overlapping CIDRs prevent proper destination-based routing in the VPC peering connection.

Answer

The route tables do not have routes to the private IP addresses of the instances.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Answer

The VPCs are in different regions and peering does not work across regions.

Question 5

Which TWO of the following are benefits of using an AWS Transit Gateway over VPC peering for connecting multiple VPCs? (Select TWO.)

Accepted Answer

Transitive routing between all attached VPCs.. Option D is correct because AWS Transit Gateway acts as a regional hub that supports transitive routing, meaning any attached VPC can reach any other attached VPC through the gateway without needing a full mesh of individual peering connections. Option E is correct because Transit Gateway centralises control of routing tables, route propagation, and attachments (including VPN and Direct Connect), so network policies are managed in one place rather than across many bilateral peering links. In contrast, VPC peering is non-transitive, so connecting many VPCs requires a mesh of peerings and per-peering route table entries, which is exactly the management overhead Transit Gateway removes. Option A is not correct because Transit Gateway data processing charges typically make it more expensive, not cheaper, than direct VPC peering for the same traffic. Option B is not correct because Transit Gateway does not provide an internet gateway; internet access still requires an IGW or NAT in the VPC. Option C is not correct because Transit Gateway does not automatically encrypt inter-VPC traffic; encryption requires VPN or application-level/TLS mechanisms.

Answer

Lower data transfer costs between VPCs.

Answer

Built-in internet gateway for all attached VPCs.

Answer

Automatic encryption of traffic between VPCs.

Question 6

A company has a VPC with multiple subnets. They want to monitor all network traffic entering and leaving the VPC for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for all network interfaces in a VPC, including subnets, enabling security analysis of all traffic entering and leaving the VPC. This is the correct service because it provides network-level visibility into traffic flows without requiring agents or changes to routing.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 7

Which THREE of the following are required to configure a site-to-site VPN connection between an on-premises network and an Amazon VPC? (Select THREE.)

Accepted Answer

A customer gateway resource representing the on-premises VPN device.. A customer gateway resource is required because it represents the on-premises VPN device in AWS, providing the necessary configuration information such as the device's public IP address and BGP ASN (if dynamic routing is used) to establish the site-to-site VPN connection. Without this resource, AWS has no reference to the remote endpoint for the IPsec tunnels.

Answer

A public virtual interface.

Answer

An AWS Direct Connect connection.

Question 8

A company is connecting their on-premises data center to AWS using a site-to-site VPN. The customer gateway device has a dynamic routing configuration with BGP. The VPN connection is established, but the VPC route table does not contain the on-premises network routes. What is the most likely cause?

Accepted Answer

Route propagation is not enabled on the VPC route table.. When using a site-to-site VPN with dynamic routing (BGP), the VPC route table must have route propagation enabled to automatically import the BGP-advertised routes from the virtual private gateway (VGW). Without route propagation, the VPC route table will not contain the on-premises network routes, even though the VPN tunnel and BGP session are established.

Answer

The customer gateway device is not configured with the correct BGP ASN.

Answer

The VPC route table has static routes pointing to the virtual private gateway.

Answer

The VPN connection is using static routing instead of dynamic routing.

Question 9

A company is deploying a VPC with public and private subnets across two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates without being directly reachable from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT). This satisfies the requirement of internet access without direct reachability.

Answer

Virtual Private Gateway

Answer

VPC Peering Connection

Answer

Internet Gateway

Question 10

A company wants to securely connect multiple VPCs in the same region to a common on-premises network using a single Direct Connect connection. Which AWS service should they use to simplify the network architecture?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows you to associate multiple VPCs (in the same or different AWS regions) with a single AWS Direct Connect connection, enabling connectivity to a common on-premises network. This simplifies the architecture by eliminating the need for multiple virtual interfaces or separate Direct Connect connections per VPC. The Direct Connect Gateway acts as a hub that routes traffic between the on-premises network and all associated VPCs via a single private virtual interface (VIF).

Answer

Virtual Private Gateway

Answer

VPC Peering

Answer

Transit Gateway

Question 11

A company wants to securely connect their on-premises data center to AWS using a site-to-site VPN. They have multiple branch offices that also need to connect to AWS. Which AWS service should they use to simplify the management of multiple VPN connections?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (C) acts as a central hub that interconnects VPCs and on-premises networks, allowing you to manage multiple site-to-site VPN connections and branch office attachments through a single gateway. This simplifies routing and reduces operational overhead compared to managing individual VPN connections between each branch and each VPC.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPN CloudHub

Question 12

A company is designing a multi-tier application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must be isolated from all other tiers except the application tier. Which TWO network architectures meet these requirements? (Choose TWO.)

Accepted Answer

Use a public subnet for an Application Load Balancer and private subnets for web, app, and database tiers. Use security groups to restrict traffic between tiers.. It places the Application Load Balancer in a public subnet to receive internet traffic, while the web, app, and database tiers reside in private subnets. Security groups are used to restrict traffic flows: the ALB security group allows inbound HTTP/HTTPS from the internet, the web tier security group allows inbound only from the ALB, the app tier security group allows inbound only from the web tier, and the database tier security group allows inbound only from the app tier. This ensures the application tier is only accessible from the web tier, and the database tier is isolated except from the application tier.

Answer

Use a single public subnet for all tiers and control access with security groups.

Answer

Use private subnets for all tiers and a NAT gateway for internet access from the web tier. Use security groups to control traffic.

Answer

Use a VPN connection from the on-premises network to access all tiers.

Question 13

A company wants to use AWS Direct Connect to establish a dedicated network connection from their on-premises data center to AWS. They need to connect to a VPC in the us-east-1 region. Which of the following is a required step in the setup process?

Accepted Answer

Create a private virtual interface and attach it to a Virtual Private Gateway.. To establish a Direct Connect connection to a VPC, you must create a private virtual interface (VIF) and attach it to a Virtual Private Gateway (VGW) that is attached to the VPC. The private VIF carries traffic over the dedicated connection and uses BGP to exchange routes between the on-premises network and the VPC via the VGW. This is the core requirement for routing traffic from the Direct Connect link into a VPC.

Answer

Attach a Transit Gateway to the VPC.

Answer

Configure CloudFront to route traffic through the Direct Connect.

Answer

Create a site-to-site VPN connection as a backup.

Question 14

A company has a VPC with two subnets: a public subnet with a NAT Gateway and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a security group that allows all outbound traffic. The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely issue?

Accepted Answer

The NAT Gateway is deployed in a private subnet.. The NAT Gateway must be deployed in a public subnet with an Internet Gateway (IGW) attached to its route table to translate private IP addresses to the IGW's public IP. If the NAT Gateway is in a private subnet, it has no route to the internet, so traffic from the private EC2 instance reaches the NAT Gateway but cannot be forwarded to the internet. This is the most likely issue because the route table correctly points to the NAT Gateway, but the gateway itself lacks internet connectivity.

Answer

The security group does not allow inbound traffic from the internet.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The instance's DNS resolution is not configured correctly.

Question 15

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. They also have an EC2 instance in the private subnet that needs to access the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. The security group for the EC2 instance allows outbound HTTPS traffic. The network ACL for the private subnet allows inbound and outbound ephemeral ports. However, the EC2 instance cannot reach the internet. The network engineer checks the NAT Gateway and sees that it has an Elastic IP attached. The engineer also checks the route table for the public subnet and finds no route to the internet. What should the engineer do to fix the issue?

Accepted Answer

Add a route in the public subnet route table to 0.0.0.0/0 via the internet gateway.. The NAT Gateway resides in the public subnet, and for the NAT Gateway to forward traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway. Without that route, the NAT Gateway cannot send traffic to the internet, even though the private subnet's route points to the NAT Gateway. Options A, C, and D are incorrect: A is unnecessary because a NAT Gateway in the private subnet would not have direct internet access; C would bypass the NAT Gateway and require a route to the internet gateway directly from the private subnet, which is not the standard design; D is wrong because adding another Elastic IP does not solve the missing route issue.

Answer

Deploy a second NAT Gateway in the private subnet.

Answer

Add a route in the private subnet route table to 0.0.0.0/0 via the internet gateway.

Answer

Attach a second Elastic IP to the NAT Gateway.