ANS-C01 Network Implementation Practice Test 30 — 15 Questions

Question 1

A company has a VPC with multiple subnets that are peered with another VPC using a VPC Peering connection. They want to ensure that traffic between the two VPCs is encrypted. What should they do?

Accepted Answer

Use AWS Transit Gateway with a VPN attachment between the VPCs.. VPC Peering does not support encryption of traffic in transit. To encrypt traffic between VPCs, you can use AWS Transit Gateway with a VPN attachment, which establishes an IPsec VPN tunnel that encrypts all traffic between the VPCs. This solution meets the requirement for encrypted inter-VPC communication while still allowing connectivity across multiple subnets.

Answer

Configure network ACLs to enforce encryption.

Answer

Use AWS Direct Connect with a public VIF.

Answer

Enable encryption on the VPC Peering connection using a security group.

Question 2

A company needs to provide internet access to a VPC that has both public and private subnets. They have already created an Internet Gateway and attached it to the VPC. What else must be configured for instances in the public subnet to be reachable from the internet?

Accepted Answer

Add a route to the public subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.. For instances in a public subnet to be reachable from the internet, the subnet's route table must include a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). The IGW itself is a horizontally scaled, redundant component that provides a target for internet-bound traffic, but without the route, traffic from the internet cannot reach the instances. This route enables bidirectional communication: the IGW performs NAT for instances with public IPs, translating their private IPs to the associated Elastic IP or public IP.

Answer

Launch a NAT Gateway in the public subnet.

Answer

Attach the VPC to an AWS Transit Gateway.

Answer

Establish a VPN connection to the Internet Gateway.

Question 3

A company has deployed a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which service should be used to provide this access without exposing the instances to inbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to it from the private subnets.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) to the gateway’s Elastic IP, enabling outbound-only access.

Answer

Attach an Internet Gateway to the VPC and add a default route to it from the private subnets.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Answer

Use a Direct Connect connection to route traffic through an on-premises internet gateway.

Question 4

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in each region. They need to route traffic to the closest healthy endpoint. Which AWS service should be used for global load balancing?

Accepted Answer

Use AWS Global Accelerator with an endpoint group in each region.. AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via Anycast IP addresses and endpoint groups in each region. It provides static IP addresses and intelligent traffic distribution based on latency, health, and geography, making it ideal for multi-region ALB architectures requiring global load balancing.

Answer

Use a single Application Load Balancer in one region with cross-region VPC peering.

Answer

Use Route 53 latency-based routing with health checks.

Answer

Use a Network Load Balancer in each region and Route 53 weighted routing.

Question 5

A company has a VPC with multiple subnets that are peered with another VPC using a VPC Peering connection. They want to ensure that traffic between the two VPCs is encrypted. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use EFS Standard storage class with Multi-AZ and create mount targets in each Availability Zone.. The EFS Standard storage class provides Multi-AZ durability and availability, and creating mount targets in each Availability Zone ensures that EC2 instances in any subnet can connect to EFS with low latency by using a mount target in the same AZ. This architecture avoids cross-AZ data transfer charges and minimizes latency, meeting both high availability and low latency requirements.

Answer

Use EFS One Zone storage class with a single mount target in the same Availability Zone as the application.

Answer

Use EFS Standard storage class with Multi-AZ and create a single mount target in one Availability Zone.

Answer

Use EFS One Zone storage class and create mount targets in each Availability Zone.

Question 6

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

Accepted Answer

The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.. A Gateway VPC Endpoint for S3 works by adding a route in the subnet's route table that points the S3 prefix list (com.amazonaws.region.s3) to the endpoint ID (vpce-xxx). Without this specific route, traffic destined for S3 from the subnet associated with rtb-11111111 will follow the default route (e.g., an Internet Gateway or NAT Gateway) instead of being routed through the endpoint. Since the endpoint is only associated with rtb-11111111 and rtb-22222222, but rtb-11111111 lacks the required prefix list route, traffic from that subnet cannot reach S3 via the endpoint.

Answer

The endpoint policy denies access to S3 from the instance's IAM role.

Answer

The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.

Answer

The VPC does not have DNS resolution enabled for the endpoint.

Question 7

A company wants to establish a dedicated, private connection between their on-premises data center and AWS. They require consistent, low-latency performance and support for multiple VLANs. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet to deliver consistent, low-latency performance. It supports multiple VLANs via 802.1Q tagging over a single physical connection, enabling segmentation of traffic (e.g., for private VIFs, public VIFs, and transit VIFs). This meets the requirement for a private, high-performance link with VLAN support.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 8

A company has deployed a VPC with a public subnet and a private subnet in each of two Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access an external API over HTTPS. What is the MOST secure way to provide this access?

Accepted Answer

Deploy a NAT Gateway in each public subnet and add a default route in the private subnet route tables pointing to the NAT Gateway.. A NAT Gateway in each public subnet provides a managed, highly available path for EC2 instances in private subnets to initiate outbound HTTPS connections to the internet while preventing inbound connections from reaching them. Adding a default route (0.0.0.0/0) in the private subnet route tables pointing to the NAT Gateway ensures traffic destined for the external API is forwarded through the NAT Gateway, which performs source network address translation (SNAT) using its Elastic IP. This is the most secure method because it avoids exposing the EC2 instances directly to the internet and leverages AWS-managed infrastructure for scalability and fault tolerance.

Answer

Create a VPC endpoint for the external API service.

Answer

Assign public IP addresses to the EC2 instances and allow outbound traffic in the security group.

Answer

Set up a VPN connection to an on-premises network that has internet access.

Question 9

A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?

Accepted Answer

The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.. The most likely cause is a mismatch in the pre-shared key (PSK) between the customer gateway device and the VPN connection configuration in AWS. IPsec tunnel establishment requires both ends to authenticate using identical PSK values; if they differ, the Internet Key Exchange (IKE) phase 1 negotiation fails, leaving the tunnel status 'DOWN'. This is a common configuration error that directly prevents the VPN from coming up.

Answer

The virtual private gateway is not attached to the customer gateway.

Answer

The VPN connection is not associated with a subnet.

Answer

The security group associated with the VPN endpoint is blocking the traffic.

Question 10

A company is deploying a web application that will be accessed over the internet. They want to use an Application Load Balancer (ALB) to distribute traffic across EC2 instances in multiple Availability Zones. Which TWO configurations are required to make the ALB internet-facing? (Choose TWO.)

Accepted Answer

Associate the ALB with public subnets that have a route to an Internet Gateway.. Option E is correct because when you create an ALB you must explicitly set the Scheme to 'internet-facing' (as opposed to 'internal'); this makes the load balancer's nodes publicly resolvable and reachable from the internet. Option D is correct because an internet-facing ALB must be associated with public subnets, and those subnets require a route in their route table pointing to an Internet Gateway (0.0.0.0/0 → igw-xxxxxxxx) so that traffic can flow to and from the internet. Option A is not required: a security group allowing 0.0.0.0/0 is a common practice for the ALB's listener ports, but it is not a configuration requirement for making the ALB internet-facing, and the question asks for required configurations. Option B is incorrect because Elastic IP addresses are not assigned to ALBs; AWS automatically provides public IPs to internet-facing ALB nodes. Option C is incorrect because associating the ALB only with private subnets would make it internal, not internet-facing.

Answer

Configure a security group that allows inbound traffic from 0.0.0.0/0.

Answer

Assign an Elastic IP address to the ALB.

Answer

Associate the ALB with private subnets only.

Question 11

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public and a private subnet. They want to connect their on-premises network (192.168.0.0/16) to the VPC using a site-to-site VPN. Which THREE resources are needed to establish the VPN connection? (Choose THREE.)

Accepted Answer

Customer Gateway. To build an AWS Site-to-Site VPN, you must create a Customer Gateway (A), which represents the on-premises VPN device and holds its public IP address and BGP ASN so AWS knows the remote endpoint. You also need a Virtual Private Gateway (E), the AWS-side VPN concentrator that attaches to the VPC and terminates the tunnels. Finally, the VPN Connection (C) is the actual resource that binds the Customer Gateway to the Virtual Private Gateway and provisions the two IPsec tunnels. AWS Direct Connect (B) is a dedicated private circuit, not an IPsec VPN over the internet, so it is not required here. AWS Transit Gateway (D) is a hub for connecting many VPCs and on-premises networks and is optional, not a prerequisite for a single VPC site-to-site VPN.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 12

A company has a multi-tier application deployed in a VPC. The web tier consists of an internet-facing Application Load Balancer (ALB) in public subnets, and EC2 instances in private subnets. The application tier runs on EC2 instances in separate private subnets, and the database tier uses an Amazon RDS for MySQL instance in private subnets. The application tier needs to connect to the database on port 3306. The security group for the RDS instance (sg-database) has an inbound rule allowing TCP 3306 from the security group of the application tier (sg-app). The application tier instances can connect to the database, but the web tier instances cannot. The web tier instances should not have direct database access. What is the most likely reason for the web tier's inability to connect to the database?

Accepted Answer

The security group of the RDS instance does not have an inbound rule allowing traffic from the web tier's security group.. The correct answer is B: the RDS security group (sg-database) only allows inbound TCP 3306 from sg-app, so traffic from the web tier's security group is denied by default, which is exactly why the application tier can connect but the web tier cannot. Security groups are stateful allow-lists, so any source not explicitly permitted is implicitly blocked. Option A is unlikely because network ACLs are stateless and would typically also affect the application tier unless specifically configured, and the scenario points to a security group scoping issue. Option C is wrong because RDS instances in private subnets do not need a NAT Gateway for inbound client connections, and NAT is for outbound traffic from private subnets. Option D is wrong because subnets within the same VPC communicate via the local route, and routing is not the limiting factor here.

Answer

The network ACL for the database subnet is blocking inbound traffic from the web tier subnets.

Answer

The RDS instance is in a public subnet and requires a NAT Gateway for communication.

Answer

The route table for the web tier subnets does not have a route to the database subnets.

Question 13

A security team wants to block traffic from a specific IP address (203.0.113.5) from reaching an EC2 instance. The instance is in a public subnet with a security group that allows all traffic from the internet. A network ACL is associated with the subnet. The team adds a DENY rule for the IP in the network ACL. However, traffic from that IP still reaches the instance. What is the most likely reason?

Accepted Answer

The network ACL has an ALLOW rule with a lower rule number that matches the IP, so the DENY rule is never evaluated.. Network ACLs are stateless and evaluated in order by rule number, from lowest to highest. If an ALLOW rule with a lower rule number (e.g., 100) matches the source IP 203.0.113.5 before the DENY rule (e.g., 200) is reached, the ALLOW rule will be applied and the traffic permitted. The DENY rule is never evaluated because the first matching rule determines the action.

Answer

The security group allows traffic from the IP, overriding the network ACL.

Answer

The network ACL is applied to the wrong subnet.

Answer

The internet gateway is ignoring the network ACL.

Question 14

A company is setting up a VPC with both public and private subnets. The private subnets need outbound internet access for software updates. Which component is required to enable this?

Accepted Answer

A NAT gateway in a public subnet.. A NAT gateway in a public subnet is required to enable outbound internet access for private subnets. The NAT gateway resides in a public subnet with an Internet Gateway (IGW) route, and private subnet route tables direct default traffic (0.0.0.0/0) to the NAT gateway's elastic network interface. This allows instances in private subnets to initiate outbound connections (e.g., for software updates) while preventing unsolicited inbound traffic from the internet.

Answer

A VPN connection to an on-premises network that has internet access.

Answer

A VPC peering connection to a VPC that has internet access.

Answer

An internet gateway attached to the VPC with a route in the private subnet's route table pointing to the internet gateway.

Question 15

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region using AWS native services? (Choose two.)

Accepted Answer

VPC peering. VPC peering (B) is correct because it is an AWS-native networking feature that directly connects two VPCs in the same region (or across regions) using private IPv4/IPv6 addresses, with no gateway, VPN, or single point of failure, and it supports intra-region VPC-to-VPC connectivity. AWS Transit Gateway (E) is also correct because it is a regional AWS-native hub-and-spoke transit hub that attaches multiple VPCs (and VPN/Direct Connect) in the same region, allowing transitive routing between all attached VPCs without full-mesh peering. A Software VPN appliance (A) is not an AWS-native service — it is a customer-managed EC2 instance running third-party VPN software, so it does not qualify. AWS Direct Connect (C) is a dedicated private network link between on-premises and AWS, not a method for connecting VPCs to each other within a region. Amazon ClassicLink (D) was a legacy feature for linking EC2-Classic instances to a VPC, not for connecting multiple VPCs, and it has been retired.

Answer

Software VPN appliance

Answer

AWS Direct Connect

Answer

Amazon ClassicLink