ANS-C01 Network Implementation Practice Test 3 — 15 Questions

Question 1

A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.. The correct answer is C because the tunnel being up indicates Layer 3 connectivity, but traffic may be blocked by VPC route tables or security group rules. Option A is incorrect because tunnel status is up. Option B is incorrect because a mismatch in pre-shared keys would prevent the tunnel from establishing. Option D is incorrect because the VPN gateway is the target, not a route table entry.

Answer

The pre-shared keys are mismatched.

Answer

The VPN tunnel has been idle for too long and needs to be re-initiated.

Answer

The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.

Question 2

A company runs a critical application on EC2 instances behind an Application Load Balancer. They need to ensure that if an instance fails health checks, it is automatically terminated and replaced. Which AWS service should they use?

Accepted Answer

Auto Scaling group. The correct answer is D because Auto Scaling groups can automatically replace unhealthy instances based on health checks from the load balancer. Option A (EC2) does not provide automatic replacement. Option B (CloudWatch) can monitor but not replace. Option C (Lambda) could be used with custom logic but is not the standard solution.

Answer

AWS Lambda

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch

Question 3

A company is designing a VPC with public and private subnets. They want EC2 instances in private subnets to be able to access the internet for software updates. Which AWS service should they use?

Accepted Answer

NAT Gateway. The correct answer is C because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A (Internet Gateway) is for public subnets. Option B (VPC Peering) is for connecting VPCs. Option D (Direct Connect) is a dedicated connection to on-premises.

Answer

AWS Direct Connect

Answer

Internet Gateway (IGW)

Answer

VPC Peering connection

Question 4

A company has multiple VPCs that need to communicate with each other. They want to use a hub-and-spoke model with centralized network management. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (D) is the correct choice because it acts as a central hub that interconnects multiple VPCs and on-premises networks using a hub-and-spoke topology. It simplifies network management by providing a single point of connectivity and supports transitive routing between all attached VPCs, which is exactly what the company needs for centralized network management.

Answer

AWS Direct Connect

Answer

VPN CloudHub

Answer

VPC Peering

Question 5

A company is deploying a latency-sensitive application across multiple AWS Regions. They want to use the AWS global network to route traffic to the nearest edge location for fast content delivery. Which service should they use?

Accepted Answer

AWS Global Accelerator. The correct answer is A because AWS Global Accelerator uses the AWS global network to direct traffic to the optimal endpoint, improving latency. Option B (CloudFront) is a CDN for caching static content. Option C (Route 53) is a DNS service. Option D (Direct Connect) is for dedicated connections.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Question 6

A company needs to connect its on-premises data center to AWS with a dedicated, private network connection that provides consistent performance. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent, low-latency performance and can reduce bandwidth costs for high-volume data transfer, making it the ideal choice for the stated requirement.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Site-to-Site VPN

Question 7

A company has a VPC with multiple subnets. They want to centrally control outbound traffic to the internet and log all traffic. Which AWS service should they use?

Accepted Answer

VPC Traffic Mirroring. The correct answer is D because VPC Traffic Mirroring allows you to capture and inspect network traffic for analysis. Option A (NAT Gateway) provides outbound internet access but does not log all traffic. Option B (VPC Flow Logs) captures IP traffic metadata but does not control traffic. Option C (Network ACL) controls traffic at the subnet level but does not log all traffic.

Answer

NAT Gateway

Answer

Network ACL

Answer

VPC Flow Logs

Question 8

A company is running a two-tier application with a web tier and a database tier. The web tier must be accessible from the internet, but the database tier should only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web tier in public subnet, database tier in private subnet with a security group allowing only web tier.. The correct answer is C because placing the web tier in a public subnet with an Internet Gateway and the database tier in a private subnet with a security group that allows traffic only from the web tier provides the required security. Option A (both in public) exposes the database. Option B (both in private) prevents internet access. Option D (database in public) is insecure.

Answer

Both tiers in public subnets with security groups restricting database access.

Answer

Both tiers in private subnets with a NAT Gateway for internet access.

Answer

Web tier in private subnet, database tier in public subnet with a security group.

Question 9

Which TWO of the following are valid options for implementing network segmentation in a VPC?

Accepted Answer

Security Groups. Security Groups (A) are stateful virtual firewalls that operate at the instance level (ENI), allowing you to control inbound and outbound traffic based on rules. They are a valid mechanism for network segmentation because you can assign different Security Groups to different instances or groups of instances to isolate traffic between tiers (e.g., web, app, database). Subnets (B) provide network segmentation at the VPC subnet level by dividing the VPC's IP address range into smaller segments, each associated with a specific Availability Zone and route table, enabling logical separation of resources.

Answer

Route Tables

Answer

NAT Gateway

Answer

Internet Gateway

Question 10

Which THREE of the following are valid methods to connect a VPC to an on-premises network?

Accepted Answer

AWS Direct Connect. The correct answers are A, C, and E. VPN, Direct Connect, and Transit Gateway are valid connection methods. Option B (VPC Peering) connects VPCs, not on-premises. Option D (VPC Endpoint) connects to AWS services.

Answer

VPC Peering

Answer

VPC Endpoint

Question 11

Which TWO of the following are characteristics of an AWS Network Load Balancer (NLB)?

Accepted Answer

Preserves the source IP address of the client. The correct answers are B and D. NLB operates at Layer 4, handles millions of requests per second, and preserves source IP. Option A (Layer 7) is for ALB. Option C (HTTP header) is Layer 7. Option E (SSL offloading) is Layer 7.

Answer

Supports SSL offloading

Answer

Supports routing based on HTTP headers

Answer

Operates at Layer 7 of the OSI model

Question 12

A company is deploying a new application in a VPC with public and private subnets. The application servers in the private subnets need to access the internet to download patches. Which configuration meets this requirement without allowing inbound internet traffic?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway from the private subnets' route tables.. Option B is correct because a NAT gateway in a public subnet provides outbound internet access for instances in private subnets while blocking unsolicited inbound connections. Option A is wrong because an internet gateway attached to the private subnet would allow inbound traffic. Option C is wrong because a VPC endpoint is for private connectivity to AWS services, not general internet. Option D is wrong because a VPN connection is for private connectivity to a remote network, not internet access.

Answer

Attach an internet gateway to the private subnets and configure route tables accordingly.

Answer

Establish a site-to-site VPN connection to an on-premises internet gateway.

Answer

Configure a VPC endpoint for the internet in the private subnets.

Question 13

A global company wants to connect multiple VPCs across different AWS Regions using a hub-and-spoke model. The hub VPC contains shared services such as Active Directory and DNS. Which AWS service provides the most scalable and maintainable solution for this architecture?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. Option D is correct because AWS Transit Gateway is designed for hub-and-spoke connectivity across many VPCs and Regions, providing scalability and centralized management. Option A is wrong because VPC peering is point-to-point and does not scale well for many VPCs. Option B is wrong because VPN CloudHub is for VPN-based connectivity, not VPC-to-VPC. Option C is wrong because Direct Connect gateway is for connecting Direct Connect to multiple VPCs, not for VPC-to-VPC peering.

Answer

AWS VPN CloudHub to interconnect all VPCs.

Answer

AWS Direct Connect gateway with virtual interfaces to each VPC.

Answer

VPC peering between each spoke VPC and the hub VPC.

Question 14

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise a route for 10.0.0.0/8. The VPC CIDR is 10.1.0.0/16. The company wants to ensure that all traffic from the VPC to on-premises uses the Direct Connect connection, but if the Direct Connect fails, traffic should fail over to a VPN connection. Which configuration achieves this?

Accepted Answer

Configure a BGP local preference of 200 on the Direct Connect VIF and 100 on the VPN connection, and use the same ASN for both.. Option A is correct because a lower BGP local preference on the VPN side makes the Direct Connect route more preferred. Option B is wrong because a higher AS path prepend on the Direct Connect side would make it less preferred. Option C is wrong because a static route with a high metric would be less preferred, not a backup. Option D is wrong because setting a lower MED on the Direct Connect side would make it more preferred, but the question asks for failover order; the VPN should be backup, so VPN MED should be higher.

Answer

Create a static route in the VPC route table pointing to the VPN with a metric of 100, and let BGP propagate the Direct Connect route.

Answer

Set the MED attribute on the Direct Connect VIF to 100 and on the VPN to 200.

Answer

Configure AS path prepend on the Direct Connect side to advertise a longer AS path.

Question 15

A company wants to enable DNS resolution for hybrid network using Route 53 Resolver. The on-premises DNS servers are reachable via Direct Connect. The company wants to forward queries for a custom domain (example.corp) from VPC to on-premises. Which resource should be created in the VPC?

Accepted Answer

Route 53 Resolver outbound endpoint and associate a resolver rule.. Option C is correct because a Route 53 Resolver outbound endpoint forwards DNS queries from VPC to on-premises DNS servers. Option A is wrong because an inbound endpoint allows on-premises to query VPC DNS. Option B is wrong because a resolver rule is used to specify which domains to forward, but it must be associated with an endpoint. Option D is wrong because a VPC endpoint for Route 53 Resolver is not a service; you create endpoints for the resolver service.

Answer

A VPC endpoint for Route 53 Resolver service.

Answer

Route 53 Resolver rule that forwards example.corp to on-premises DNS servers.

Answer

Route 53 Resolver inbound endpoint.