ANS-C01 Network Implementation Practice Test 3 — 15 Questions

Question 1

A company has set up a transit gateway with attachments to VPC-A and VPC-B. The transit gateway route table shows routes to both VPCs and a blackhole for 0.0.0.0/0. VPC-A's public subnet route table sends 10.1.0.0/16 traffic to the transit gateway. However, an EC2 instance in VPC-A's public subnet cannot reach an instance in VPC-B. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC-B's route table does not have a route to VPC-A's CIDR via the transit gateway.. For traffic to flow from VPC-A to VPC-B via a transit gateway, both VPCs must have routes in their route tables pointing to the transit gateway for the other VPC's CIDR. Since VPC-A's route table sends 10.1.0.0/16 (VPC-B's CIDR) to the transit gateway, but VPC-B's route table lacks a return route to VPC-A's CIDR via the transit gateway, the return traffic from VPC-B is dropped, causing connectivity failure.

Answer

VPC-A's route table does not have a route to the transit gateway.

Answer

The transit gateway route table does not have a route for 10.0.0.0/16.

Answer

The blackhole route in the transit gateway is blocking traffic between VPCs.

Question 2

A company is deploying a new VPC with both public and private subnets. The public subnet hosts an internet-facing Application Load Balancer (ALB), and the private subnet hosts EC2 instances running a web application. The EC2 instances need to download updates from the internet, but they must not be directly accessible from the internet. Which combination of steps should a network engineer implement to meet these requirements?

Accepted Answer

Create a NAT Gateway in a public subnet, and add a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing any unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) to the NAT Gateway in the private subnet's route table directs all outbound internet traffic through the NAT Gateway, which translates the private IPs to the NAT Gateway's Elastic IP. This meets the requirement of internet access for downloads without direct internet accessibility.

Answer

Launch a proxy server in the public subnet and configure the private instances to use it for outbound traffic.

Answer

Set up a VPN connection to an on-premises network and route all internet traffic through the VPN.

Answer

Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet's route table.

Question 3

A company has a Direct Connect connection with a private VIF connected to a VPC. The network engineer notices that traffic from on-premises to the VPC is being dropped intermittently. The on-premises router shows BGP session is up, but the VPC route table does not have the on-premises prefix. What is the most likely cause?

Accepted Answer

The on-premises router is advertising a route that is more specific than the allowed prefix list on the Direct Connect gateway.. The Direct Connect gateway (DXGW) uses allowed prefix lists to control which routes are accepted from the on-premises router via BGP. If the on-premises router advertises a prefix that is more specific (e.g., /28) than the allowed prefix list (e.g., /24), the DXGW will reject the route, causing the VPC route table to lack the on-premises prefix. The BGP session remains up because the session itself is not affected, but the specific route is not installed.

Answer

The MTU on the on-premises router is set too high.

Answer

The BGP session is flapping due to high latency.

Answer

The on-premises router is using AS_PATH prepending.

Question 4

A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?

Accepted Answer

Use TLS or IPsec at the application layer between instances.. VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.

Answer

Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.

Answer

Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.

Answer

Enable encryption on the VPC peering connection.

Question 5

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

Accepted Answer

The security group for the EC2 instance does not allow inbound HTTPS traffic.. Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed. Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.

Answer

The network ACL in the VPC is blocking outbound traffic.

Answer

The BGP session is in the 'Idle' state.

Answer

The route table associated with the virtual private gateway does not have a route to the on-premises network.

Question 6

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network engineer needs to ensure that traffic between VPC A and VPC B follows a specific path through a Network Virtual Appliance (NVA) in VPC C. Which TWO actions should the engineer take?

Accepted Answer

Add a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole.. Adding a static route in the Transit Gateway route table for VPC A's CIDR pointing to the VPC B attachment with a blackhole forces traffic destined to VPC B to be dropped at the Transit Gateway, preventing direct routing. Option D is correct because adding a specific route for VPC B's CIDR in the Transit Gateway route table used by VPC A, pointing to the VPC C attachment, ensures traffic from VPC A to VPC B is forwarded through the NVA in VPC C, enforcing the desired inspection path.

Answer

Associate VPC A's and VPC B's route tables with a different Transit Gateway route table that has a default route pointing to the VPC C attachment.

Answer

Enable route propagation for VPC A and VPC B attachments in the same Transit Gateway route table.

Answer

Create a VPC peering connection between VPC A and VPC B.

Question 7

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet instances need to access an S3 bucket in the same region. Which THREE steps should the network engineer take to ensure the most cost-effective and secure access without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 provides private, cost-effective access to S3 without traversing the internet or requiring a NAT Gateway. It uses AWS's internal network and route table entries to direct S3 traffic through the endpoint, avoiding data transfer costs and improving security.

Answer

Create a VPC Interface Endpoint for S3.

Answer

Create a NAT Gateway in the public subnet.

Question 8

A company has a large AWS environment with hundreds of VPCs connected via a Transit Gateway. The network team is implementing a new hub-and-spoke architecture where all traffic between VPCs must be inspected by a centralized firewall appliance in a shared services VPC. The firewall appliance is a third-party virtual appliance that supports VRF-like segmentation. The network engineer has configured the Transit Gateway with separate route tables for each VPC, and the shared services VPC is associated with all route tables. The firewall appliance is deployed in the shared services VPC with two ENIs: one in a 'trust' subnet and one in an 'untrust' subnet. The trust subnet is used for traffic coming from spoke VPCs, and the untrust subnet is used for traffic going to other spoke VPCs. The firewall appliance performs stateful inspection and returns traffic to the Transit Gateway via the correct ENI. However, after implementation, traffic between two spoke VPCs (VPC A and VPC B) is being dropped. The engineer verifies that the Transit Gateway route tables have static routes for each spoke VPC CIDR pointing to the shared services VPC attachment. The spoke VPCs have routes to each other's CIDR via the Transit Gateway. The firewall logs show that traffic from VPC A reaches the trust ENI, but the firewall is unable to send traffic to VPC B because it does not have a route to VPC B's CIDR. What is the most likely cause?

Accepted Answer

The route table for the untrust subnet does not have a route to VPC B's CIDR pointing to the Transit Gateway.. The firewall's untrust subnet route table must have a route pointing to the Transit Gateway for VPC B's CIDR. The firewall receives traffic from VPC A on its trust ENI, processes it, and then sends it out the untrust ENI. Without a route in the untrust subnet's route table directing traffic for VPC B's CIDR to the Transit Gateway, the firewall cannot forward the traffic back to the Transit Gateway for delivery to VPC B, causing the drop.

Answer

The shared services VPC attachment is not propagating routes to the Transit Gateway route tables.

Answer

The security group for the firewall's untrust ENI is blocking outbound traffic.

Answer

The Transit Gateway route table for VPC A does not have a route for VPC B's CIDR.

Question 9

A company is deploying a hybrid network architecture with an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The on-premises network uses BGP to advertise routes to the VPN connection. After the VPN is established, the on-premises network cannot reach EC2 instances in the VPC. The VPC route table has a route for the on-premises CIDR block pointing to the VPN gateway. What is the most likely cause of this issue?

Accepted Answer

The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.. When the on-premises network advertises a default route (0.0.0.0/0) via BGP over the VPN connection, the VPC propagates that route into its route tables (if route propagation is enabled). This default route can override the VPC's local route for the on-premises CIDR, causing traffic destined for the on-premises network to be sent back out the VPN gateway instead of being delivered locally, effectively breaking connectivity to EC2 instances.

Answer

The VPN connection is not using the correct pre-shared key.

Answer

The security group attached to the EC2 instances does not allow inbound traffic from the on-premises CIDR.

Answer

The VPC's network ACLs are blocking inbound traffic from the on-premises network.

Question 10

A network engineer is troubleshooting a connectivity issue between two VPCs (VPC-A and VPC-B) that are connected via a VPC peering connection. The engineer has verified that the route tables in both VPCs have the appropriate routes. However, instances in VPC-A cannot ping instances in VPC-B. Which TWO actions should the engineer take to resolve this issue? (Choose two.)

Accepted Answer

Verify that the network ACLs in VPC-B allow inbound ICMP traffic from VPC-A.. Network ACLs are stateless firewalls that control inbound and outbound traffic at the subnet level. Even if the route tables are correctly configured, a network ACL in VPC-B that denies inbound ICMP traffic from VPC-A's CIDR will block ping requests. Option D is correct because security groups are stateful and must explicitly allow inbound ICMP traffic from VPC-A's CIDR; without this rule, the instances in VPC-B will drop the ping requests.

Answer

Add a route in VPC-A's route table pointing to the VPC peering connection for the CIDR of VPC-B.

Answer

Enable DNS resolution for the VPC peering connection.

Answer

Configure a transit gateway to route traffic between the two VPCs.

Question 11

Order the steps to set up a Network Load Balancer with a TCP listener in front of an Auto Scaling group:

Accepted Answer

Create target group → Create load balancer → Register targets → Associate target group with listener → Configure health checks. First create the target group, then the load balancer, register targets, associate the target group with the listener, and configure health checks.

Answer

Create load balancer → Create target group → Register targets → Associate target group with listener → Configure health checks

Answer

Create target group → Create load balancer → Configure health checks → Register targets → Associate target group with listener

Answer

Create target group → Register targets → Create load balancer → Associate target group with listener → Configure health checks

Question 12

Order the steps to set up a redundant Direct Connect connection with two virtual interfaces in different AWS regions:

Accepted Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then configure BGP, then tune routing, then test failover.. First provision the connections, then create VIFs, configure BGP, tune routing, then test failover.

Answer

Create virtual interfaces (VIFs), then provision Direct Connect connections, then configure BGP, then tune routing, then test failover.

Answer

Provision Direct Connect connections, then configure BGP, then create virtual interfaces (VIFs), then tune routing, then test failover.

Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then test failover, then configure BGP, then tune routing.

Question 13

Match each AWS security feature to its description.

Accepted Answer

Security Groups: Acts as a virtual firewall for an EC2 instance at the instance level, controlling inbound and outbound traffic.. These are core security services for network protection. Security Groups are instance-level, NACLs are subnet-level, WAF protects web apps, and Shield provides DDoS protection.

Answer

Security Groups: Acts as a firewall at the subnet level.

Answer

Network ACLs: Acts as a virtual firewall for an EC2 instance.

Question 14

Match each AWS networking monitoring or troubleshooting tool to its primary purpose.

Accepted Answer

VPC Flow Logs: Captures information about IP traffic to and from network interfaces.. The correct matches are: VPC Flow Logs ↔ IP traffic capture, AWS CloudWatch Logs ↔ centralized log monitoring, AWS CloudTrail ↔ API activity recording. Common confusions include swapping VPC Flow Logs with CloudTrail, or CloudWatch Logs with VPC Reachability Analyzer.

Answer

VPC Flow Logs: Records API calls made in the AWS environment.

Answer

AWS CloudWatch Logs: Analyzes network paths between resources.

Question 15

A company is deploying a new web application on AWS. They need to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones. Which AWS service should they use?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and can terminate TLS, inspect HTTPS headers, and route traffic based on content. It is designed to distribute incoming HTTPS traffic across multiple EC2 instances in different Availability Zones, providing health checks and automatic scaling.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)