ANS-C01 Network Implementation Practice Test 3 — 15 Questions

Question 1

A company is designing a multi-region architecture using AWS Direct Connect. Which TWO of the following are valid configurations for connecting to multiple regions? (Select TWO.)

Accepted Answer

Set up separate Direct Connect connections in each region. Each AWS Direct Connect connection is physically provisioned at a specific Direct Connect location and terminates in a single AWS region. To connect to multiple regions, you must establish separate Direct Connect connections in each target region. Option E is correct because a Direct Connect Gateway allows you to associate Virtual Private Clouds (VPCs) from different regions to a single private virtual interface (VIF), enabling inter-region connectivity over the Direct Connect connection.

Answer

Use a single Direct Connect connection to connect to all regions

Answer

Use a Transit Gateway to connect to multiple regions

Answer

Use a single private VIF associated with multiple regions

Question 2

A company is deploying a multi-tier web application in a VPC with public and private subnets. The web servers in the public subnets must be able to initiate outbound connections to the internet for software updates, but must not be directly accessible from the internet. Which configuration meets these requirements?

Accepted Answer

Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the public subnet's route table.. For instances in public subnets, outbound internet access is provided by attaching an Internet Gateway (IGW) to the VPC and adding a default route to the IGW in the public subnet's route table. To prevent direct inbound access, you use security groups or network ACLs to block incoming traffic. Option C correctly describes this configuration. Option D is for private subnets, where instances need a NAT Gateway for outbound access and must not have public IPs, which contradicts the stem stating the web servers are in public subnets. Options A and B are incorrect because NAT instances and ALBs are not used for providing outbound internet access from public subnets directly.

Answer

Deploy a NAT instance in a private subnet and add a default route to the NAT instance in the private subnet's route table.

Answer

Deploy an Application Load Balancer (ALB) in a public subnet and route outbound traffic through the ALB.

Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet's route table.

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to the VPC. Recently, the company deployed a new VPC with CIDR 10.0.0.0/16 in a different region and established a VPC peering connection between the two VPCs. Now, traffic from on-premises to the new VPC is being routed to the old VPC instead. How should the company resolve this issue?

Accepted Answer

Delete the VPC peering connection and use a VPN instead.. The issue is overlapping CIDR blocks (both VPCs use 10.0.0.0/16). VPC peering requires non-overlapping CIDRs. The Direct Connect route for 10.0.0.0/16 causes traffic destined to the new VPC to be sent to the old VPC. Deleting the peering and using a VPN to connect on-premises to the new VPC resolves this because VPNs can handle overlapping CIDRs with separate routing configurations. Option A is correct. Option B is not feasible because the new VPC is not directly connected to Direct Connect; the on-premises router cannot advertise a more specific prefix for the new VPC over the existing Direct Connect. Option C is incorrect because VPC peering does not propagate routes to Direct Connect virtual interfaces. Option D is incorrect because disabling route propagation and adding static routes in the VPC does not change the on-premises BGP routing.

Answer

Update the on-premises router to advertise a more specific prefix for the new VPC over Direct Connect, such as 10.0.1.0/24, and ensure the new VPC's route table has a route to the on-premises network.

Answer

Configure the VPC peering connection to propagate routes to the Direct Connect virtual interface.

Answer

Disable route propagation on the VPC route tables and add static routes.

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. The company also has a Site-to-Site VPN connection to the same VPC as a backup. During a failover test, traffic from on-premises to the VPC continues to use the Direct Connect even after it is intentionally failed. The BGP timers are set to default values. What is the most likely cause?

Accepted Answer

The BGP session with the Direct Connect router is still established because the physical link is up, but the link is not forwarding traffic.. The Direct Connect physical link is still up, so the BGP session remains established even though the link is not forwarding traffic. With default BGP timers (keepalive 60s, hold 180s), the session does not time out, so the VPC continues to receive the Direct Connect route and prefers it over the VPN backup. A failover requires either the BGP session to go down or the route to be withdrawn, neither of which occurs when only the data plane fails.

Answer

The Direct Connect route is more specific than the VPN route.

Answer

The VPN BGP route has a longer AS path than the Direct Connect route.

Answer

The VPN route has a lower local preference than the Direct Connect route.

Question 5

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network advertises the prefix 10.0.0.0/8 to AWS. The VPC has a CIDR of 10.0.0.0/16. A network engineer wants to ensure that traffic from on-premises to a specific subnet 10.0.1.0/24 in the VPC is routed via a dedicated VPN connection instead of Direct Connect for testing purposes. Which TWO actions should the engineer take?

Accepted Answer

Prepend the AS path on the Direct Connect BGP advertisement.. The goal is to make the more specific subnet 10.0.1.0/24 prefer the VPN path over the Direct Connect path. Option A is correct because prepending the AS path on the Direct Connect BGP advertisement makes that route less preferred by BGP's best-path selection process, so the VPN-learned route can win for the affected prefix. Option E is correct because a lower MED value on the VPN route advertisement makes the VPN path more attractive than the Direct Connect path when comparing routes from the same neighboring AS, which is the standard way to influence inbound path preference. Option B is not correct because advertising 10.0.1.0/24 from the VPN into the VPC does not by itself override the existing Direct Connect route unless BGP attributes are also manipulated, and the question asks for actions that ensure the VPN is used. Option C is not correct because disabling route propagation on the VPN connection's route table would prevent the VPN routes from being installed, which is the opposite of what is needed. Option D is not correct because the no-export BGP community controls whether a route is advertised outside the local AS, not whether it is preferred over another route inside AWS.

Answer

Advertise the specific prefix 10.0.1.0/24 from the VPN connection to the VPC.

Answer

Disable route propagation on the VPN connection's route table.

Answer

Use a BGP community to tag the Direct Connect route as no-export.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect and a Site-to-Site VPN. The on-premises network advertises 10.0.0.0/8 over BGP. The company wants to ensure that traffic to the VPC's specific subnet 10.0.1.0/24 is routed via the VPN, while all other traffic to 10.0.0.0/8 uses Direct Connect. Which THREE actions should the network engineer take?

Accepted Answer

Set a higher BGP local preference on the VPN routes compared to Direct Connect routes for the same prefix.. Setting a higher BGP local preference on the VPN routes makes them more preferred over Direct Connect routes for the same prefix. Since the on-premises network advertises 10.0.0.0/8 over both connections, BGP local preference is the first tiebreaker; a higher value on the VPN side ensures that traffic to 10.0.1.0/24 uses the VPN as desired.

Answer

Disable route propagation on the VPN connection's route table.

Answer

Delete the VPN connection and rely solely on Direct Connect.

Question 7

A network engineer is troubleshooting connectivity issues between two VPCs connected via a Transit Gateway. The VPCs are in the same region and have proper route tables. Which TWO actions should the engineer perform to diagnose the problem?

Accepted Answer

Verify that the VPC route tables have routes pointing to the Transit Gateway attachment.. For traffic to flow from a VPC to a Transit Gateway, the VPC's route tables must include a route pointing to the Transit Gateway attachment (e.g., 10.0.0.0/16 -> tgw-xxx). Without this route, the VPC has no path to send traffic into the Transit Gateway, causing connectivity failure regardless of other configurations.

Answer

Check the security groups of the Transit Gateway.

Answer

Ping the Transit Gateway to verify its status.

Answer

Examine the network ACLs for the Transit Gateway.

Question 8

A company is deploying an application across multiple VPCs using AWS Transit Gateway. They need to ensure that only specific VPCs can communicate with each other. Which TWO methods can be used to isolate traffic?

Accepted Answer

Use Transit Gateway Network Manager to create a network segmentation design.. Transit Gateway Network Manager provides a centralized view and allows you to create network segmentation designs by grouping resources and defining routing policies, which helps isolate traffic between specific VPCs. Option B is correct because by creating separate Transit Gateway route tables for different groups of VPCs and associating VPC attachments accordingly, you control which VPCs can route traffic to each other, effectively isolating traffic between groups.

Answer

Configure network ACLs on the VPC subnets to allow or deny traffic.

Answer

Use security groups on the Transit Gateway attachments.

Answer

Implement VPC endpoints for inter-VPC communication.

Question 9

An engineer is reviewing VPC Flow Logs for connectivity issues between two EC2 instances (10.0.1.5 and 10.0.2.10) on TCP port 443. The first log entry shows ACCEPT, the second shows REJECT. What is the most likely cause of the REJECT?

Accepted Answer

The network ACL is blocking the traffic due to an incorrect inbound rule.. The first log entry shows ACCEPT for the outbound SYN packet, indicating the initial connection attempt succeeded. The second REJECT indicates that the return SYN-ACK packet from 10.0.2.10 to 10.0.1.5 was dropped. Since security groups are stateful and automatically allow return traffic for established connections, they cannot cause this REJECT. Network ACLs are stateless, so they require explicit inbound rules for return traffic. If the inbound rule on the NACL for the subnet of 10.0.2.10 does not allow the return traffic (e.g., using an ephemeral port range), it will be REJECTED. Therefore, option B is correct.

Answer

The destination instance has an incorrect network interface configuration.

Answer

The route table for the subnet does not have a route to the destination.

Answer

A security group rule is blocking the return traffic.

Question 10

An EC2 instance with the attached IAM role is unable to download objects from an S3 bucket. The instance is in a VPC with CIDR 10.0.0.0/16. The S3 bucket policy allows access from the VPC. What is the most likely reason for the failure?

Accepted Answer

The IAM role does not have permission to list the bucket, which is required for the download operation.. The most likely reason is that the IAM role lacks the s3:ListBucket permission, which is often required by AWS CLI and SDK operations when downloading objects, even if the exact object key is known. For example, the `aws s3 cp` command performs a list operation to retrieve object metadata. Without s3:ListBucket, the download fails. Although s3:GetObject alone is technically sufficient for a direct API call, typical tools require both permissions. Option D correctly identifies this common oversight.

Answer

The IAM policy does not include an Allow for the s3:GetObject action.

Answer

The condition aws:SourceIp does not match the source IP of the request because the traffic is routed through a VPC Gateway Endpoint.

Answer

The S3 bucket policy has an explicit deny for the IAM role.

Question 11

A company has a Direct Connect connection with a private VIF to a VPC. They notice that the BGP session is flapping every few minutes. The network team confirms that the customer router and AWS router are configured correctly. What is the MOST likely cause of the BGP flapping?

Accepted Answer

MTU mismatch between the customer router and the AWS Direct Connect endpoint. B is correct because an MTU mismatch between the customer router and the AWS Direct Connect endpoint can cause BGP session flapping. When the MTU is mismatched, larger BGP keepalive or update packets may be fragmented or dropped, leading to hold timer expirations and session resets. This occurs even if both routers are configured correctly for BGP, as the issue lies at the Layer 2/3 boundary rather than the BGP configuration itself.

Answer

The BGP community string is not set correctly

Answer

Incorrect BGP ASN configuration on the virtual interface

Answer

Bidirectional Forwarding Detection (BFD) is not enabled

Question 12

A company is designing a highly available network in AWS. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to use BGP as the routing protocol. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Advertise the same on-premises prefixes over both connections with different AS_PATH prepend values. Option B is correct because advertising the same on-premises prefixes over both Direct Connect connections while using different AS_PATH prepend values allows BGP to prefer one path under normal conditions and fail over to the other if the primary path is lost, which is essential for high availability. Option E is correct because each Direct Connect connection requires its own BGP session (typically one per virtual interface) to exchange routes independently, so that failure of one connection does not affect the other. Option A is incorrect because identical BGP community values do not provide redundancy or path preference; communities are used for route tagging and policy, not for high availability. Option C is incorrect because jumbo frames affect MTU and performance, not routing redundancy or failover. Option D is incorrect because multiple virtual interfaces on a single Direct Connect connection do not protect against the failure of that connection or its provider/location, so they do not satisfy the requirement for high availability across two connections.

Answer

Use the same BGP community values for both connections

Answer

Enable jumbo frames on both connections

Answer

Configure multiple virtual interfaces on a single Direct Connect connection

Question 13

A company is deploying a new VPC with public and private subnets. The VPC will host web servers in the public subnet and database servers in the private subnet. The web servers need to access the internet for updates, and the database servers need to receive traffic only from the web servers. Which THREE components are essential for this architecture?

Accepted Answer

Network ACL for subnets. Option B (Network ACL for subnets) is correct because NACLs provide stateless, subnet-level filtering that is a standard part of a VPC design with separate public and private subnets, allowing control of inbound and outbound traffic at the subnet boundary. Option C (Internet gateway) is correct because an IGW is required to give the public subnet's web servers internet connectivity, and it is the target for the public route table's 0.0.0.0/0 route. Option E (Security groups for web and database servers) is correct because security groups are stateful, instance-level firewalls that enforce the requirement that database servers receive traffic only from the web servers (by referencing the web server security group as the source) while allowing web servers appropriate access. Option A is not essential here because a NAT gateway is only needed for private-subnet instances to initiate outbound internet traffic, and the scenario specifies the database servers only need to receive traffic from the web servers, not reach the internet. Option D is not essential because a VPC endpoint for S3 is only required for private access to S3 without internet, which is not part of the stated requirements.

Answer

NAT gateway in the public subnet

Answer

VPC endpoint for S3

Question 14

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The network team wants to isolate traffic between VPCs while allowing all VPCs to reach the on-premises network. Which TWO configurations should be implemented?

Accepted Answer

Use a Direct Connect gateway to propagate routes to all VPCs. Option B is correct because a Direct Connect gateway is the AWS construct that allows a single Direct Connect connection to reach multiple VPCs through a Transit Gateway, propagating the on-premises routes so every VPC can reach the on-premises network. Option C is correct because Transit Gateway route tables control which attachments can route to each other; by creating a separate route table per VPC and associating each VPC attachment with its own table, you can prevent VPC-to-VPC traffic while still allowing each VPC to route to the on-premises attachment (for example, by propagating the Direct Connect/VPN attachment routes into each table). Option A is incorrect because a Direct Connect virtual interface is not attached to a VPN attachment on the Transit Gateway; VPN attachments are for IPsec VPN connections, not Direct Connect. Option D is incorrect because a single shared Transit Gateway route table would allow all VPCs to route to each other, defeating the isolation requirement. Option E is incorrect because VPC peering connections would directly interconnect the VPCs, which is the opposite of isolating their traffic.

Answer

Attach the Direct Connect virtual interface to a VPN attachment on the Transit Gateway

Answer

Use a single Transit Gateway route table for all attachments

Answer

Create VPC peering connections between each VPC

Question 15

A company needs to connect its on-premises data center to AWS using AWS Direct Connect. The company has two redundant connections and wants to use BGP as the routing protocol. Which BGP attribute should be manipulated to influence outbound traffic from AWS to the on-premises network?

Accepted Answer

Prepend AS_PATH on routes advertised to AWS.. To influence outbound traffic from AWS to the on-premises network, you must make the on-premises routes less attractive to AWS. Prepend AS_PATH on routes advertised to AWS increases the AS path length, making those routes less preferred by AWS's BGP best-path selection, thus steering traffic away from that Direct Connect virtual interface.

Answer

Set the Local Preference attribute on routes received from AWS.

Answer

Set the MED attribute on routes advertised to AWS.

Answer

Apply a BGP community tag to routes received from AWS.