ANS-C01 Network Implementation Practice Test 31 — 15 Questions

Question 1

A network engineer is designing a Direct Connect solution with a public VIF and a private VIF. The private VIF will connect to a VPC via a Direct Connect Gateway. Which TWO of the following statements are correct regarding this setup? (Choose 2.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Direct Connect Gateway allows the private VIF to connect to multiple VPCs in different AWS Regions. Option D is correct because a Direct Connect Gateway is a globally available resource that lets a single private VIF (attached to the gateway) reach VPCs in multiple AWS Regions through the same private virtual interface, which is exactly the multi-Region connectivity this design requires. Option E is correct because a public VIF is used to reach AWS public services—such as Amazon S3, DynamoDB, and other public endpoints—over the dedicated Direct Connect link using AWS public IP addresses rather than traversing the internet. Option A is wrong because every virtual interface, including a private VIF, requires a customer-side device (router/firewall) to terminate the 802.1Q VLAN and BGP peering. Option B is wrong because a Direct Connect Gateway only associates with private VIFs (and transit VIFs), not public VIFs, so a public VIF cannot connect to a VPC through a DX Gateway. Option C is wrong because accessing Amazon S3 over a private IP address requires an interface VPC endpoint (PrivateLink) or a gateway endpoint within the VPC, not a private VIF alone.

Answer

The private VIF can be used without a virtual interface termination device on the customer side

Answer

The public VIF can be used to connect to a VPC via a Direct Connect Gateway

Answer

The private VIF can be used to access Amazon S3 over a private IP address

Question 2

A financial services company has a VPC with a public subnet and a private subnet. EC2 instances in the private subnet need to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, instances cannot reach the internet. The NAT gateway is in an 'available' state and has an Elastic IP attached. The security group for the NAT gateway allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a default route (0.0.0.0/0) pointing to an internet gateway. A NAT gateway itself does not provide internet connectivity — it only translates addresses. For traffic to actually reach the internet, the public subnet hosting the NAT gateway must have its own route table with a 0.0.0.0/0 route pointing to an Internet Gateway. Without that IGW route in the public subnet's route table, the NAT gateway has no path to forward translated traffic to the internet, so private instances fail to reach external endpoints even though the NAT gateway is 'available' and has an EIP.

Answer

The security group for the NAT gateway is blocking inbound traffic from private instances

Answer

The NAT gateway is not provisioned with sufficient bandwidth

Answer

The NAT gateway does not have an IAM role to access the internet

Question 3

A company is deploying a new application in a VPC with public and private subnets. The application needs to access an S3 bucket in the same AWS Region. Which configuration provides the MOST secure and cost-effective connectivity?

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and add a route to it.. An S3 Gateway Endpoint allows private subnet resources to access S3 over the AWS network without traversing the internet, eliminating the need for a NAT gateway or proxy. This provides the most secure connectivity (no public exposure) and is cost-effective because there are no hourly or data processing charges for the endpoint itself, only standard S3 data transfer costs.

Answer

Configure a proxy server in the public subnet to forward requests to S3.

Answer

Set up an AWS Direct Connect connection to S3.

Answer

Create a NAT gateway in the public subnet and route traffic through it.

Question 4

A company is deploying a fleet of EC2 instances in private subnets. The instances need to download patches from the internet. The company wants to minimize cost and avoid managing NAT instances. The VPC has an internet gateway (IGW) attached. What should the company do?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing inbound connections from the internet. This solution is fully managed by AWS, eliminating the need to manage a NAT instance, and it is cost-effective compared to maintaining a dedicated instance. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway ID.

Answer

Attach the IGW to the private subnet route table.

Answer

Create a VPC endpoint for internet access.

Answer

Launch a NAT instance and configure routing.

Question 5

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add an additional non-overlapping CIDR to the VPC. What is a valid CIDR block they can add?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it is a non-overlapping IPv4 CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must be from the private IP address ranges (RFC 1918) and must not overlap with any existing CIDR blocks in the VPC. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, as they are different /16 subnets within the 10.0.0.0/8 space.

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 6

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS Region? (Choose TWO.)

Accepted Answer

VPC peering. VPC peering (C) is a valid method because it creates a direct, one-to-one private network connection between two VPCs in the same Region (or across Regions), allowing traffic to route between them using private IPv4/IPv6 addresses without traversing the public internet. AWS Transit Gateway (D) is also valid because it acts as a regional hub that connects multiple VPCs (and on-premises networks) through a single gateway, supporting transitive routing between many attached VPCs in the same Region. An Internet gateway (A) only provides internet connectivity to a single VPC and does not interconnect VPCs. AWS Site-to-Site VPN (B) connects an on-premises network to a VPC, not multiple VPCs to each other. AWS Direct Connect (E) is a dedicated private link between on-premises infrastructure and AWS, not a VPC-to-VPC connection method.

Answer

Internet gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Question 7

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose THREE.)

Accepted Answer

Virtual Private Gateway. To build a site-to-site VPN between on-premises and AWS, you must create a Virtual Private Gateway (C) and attach it to the target VPC; it is the AWS-side VPN endpoint that terminates the IPSec tunnels. You also need a Customer Gateway (D), which is the AWS resource representing the on-premises VPN device's public IP address and BGP ASN, so AWS knows the remote peer. Finally, the VPN Connection (E) is the actual IPSec tunnel resource that binds the Virtual Private Gateway and Customer Gateway together, providing the encrypted link. AWS Direct Connect (A) is a dedicated private circuit, not an IPSec VPN, and AWS Transit Gateway (B) is a hub for connecting VPCs/VPNs at scale but is not required for a basic site-to-site VPN.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 8

Which TWO of the following are benefits of using AWS Global Accelerator? (Choose TWO.)

Accepted Answer

Static anycast IP addresses that serve as a fixed entry point. Option A is correct because AWS Global Accelerator provides two static anycast IPv4 addresses (and optionally IPv6) that act as a fixed entry point to your application, so clients always connect to the same IPs even if you change the underlying endpoints or regions. Option E is correct because Global Accelerator uses the AWS global network and edge locations to route user traffic over the optimized AWS backbone, reducing latency and jitter and improving application performance compared with the public internet. Option B is not correct because AWS WAF is not built into Global Accelerator; WAF is associated with CloudFront, Application Load Balancer, API Gateway, or AppSync. Option C is not correct because Global Accelerator does not cache content at edge locations; caching is a CloudFront feature. Option D is not correct because Global Accelerator does not perform DNS-based load balancing; it uses static anycast IP addresses and health checks to direct traffic to healthy endpoints.

Answer

Built-in AWS WAF capabilities

Answer

Content caching similar to CloudFront

Answer

DNS-based load balancing

Question 9

A network engineer is troubleshooting connectivity between an EC2 instance in a VPC and an on-premises server connected via AWS Site-to-Site VPN. The ping from the EC2 instance to the on-premises server fails. The VPN tunnel status shows 'UP'. Which configuration should the engineer check first?

Accepted Answer

Check the route table associated with the EC2 instance's subnet for a route to the on-premises network. Even when the VPN tunnel is UP, traffic from the EC2 instance to the on-premises server will be dropped if the VPC route table associated with the instance's subnet does not contain a route pointing to the on-premises network via the virtual private gateway (VGW). The ping failure in this scenario is most likely due to missing routing, not tunnel misconfiguration, since the tunnel status is UP.

Answer

Ensure the customer gateway device is configured with the correct public IP address

Answer

Check that the pre-shared key matches on both sides

Answer

Verify that the VPN tunnel is using the correct encryption algorithms

Question 10

A company has an AWS Transit Gateway with multiple VPC attachments. They want to centralize outbound internet traffic through a single VPC that has a NAT gateway and an internet gateway. All other VPCs should route internet-bound traffic through this central VPC. What configuration is required?

Accepted Answer

Add a route in the transit gateway route table pointing 0.0.0.0/0 to the central VPC's transit gateway attachment. To centralize outbound internet traffic through a single VPC using AWS Transit Gateway, add a route in the transit gateway route table for 0.0.0.0/0 pointing to the central VPC's TGW attachment. The central VPC's subnet route tables then direct traffic to the NAT gateway, which uses the internet gateway for egress. Option A is incorrect because a virtual private gateway is used for VPN or Direct Connect connections, not for centralizing internet traffic through a VPC. Options B and C do not achieve the required centralized routing.

Answer

Attach a virtual private gateway to the central VPC and add a static route in the transit gateway route table pointing 0.0.0.0/0 to the virtual private gateway

Answer

Add a default route in the central VPC's subnet route tables pointing to the internet gateway

Answer

Create a route table in the central VPC and associate it with the transit gateway attachment

Question 11

A company has a VPC with an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security group for the EC2 instances must allow traffic only from the ALB. Which source should be specified in the security group inbound rule?

Accepted Answer

The ID of the ALB's security group. You can reference the ALB's security group ID as the source in the EC2 instances' security group inbound rule. This allows traffic from any network interface that is associated with the ALB's security group, regardless of the ALB's IP addresses or subnets. This is the recommended AWS best practice for controlling traffic between an ALB and its target instances, as it automatically adapts to changes in the ALB's underlying infrastructure.

Answer

The ALB's public IP address

Answer

The subnet CIDR block of the ALB's subnets

Answer

The VPC CIDR block

Question 12

A company is deploying a global application behind an Application Load Balancer (ALB) in AWS. They want to use AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. Which configuration is required to achieve this?

Accepted Answer

Create an accelerator with an endpoint group that includes the ALB as an endpoint. AWS Global Accelerator uses endpoint groups to direct traffic to the nearest healthy endpoint. By creating an accelerator with an endpoint group that includes the ALB as an endpoint, Global Accelerator can route user traffic over the AWS global network to the optimal ALB based on latency and health, improving performance for global users.

Answer

Configure Route 53 health checks for the ALB and associate them with Global Accelerator

Answer

Configure a CloudFront distribution with the ALB as an origin and enable Global Accelerator

Answer

Create a Route 53 latency-based routing record set pointing to the ALB

Question 13

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download software patches from the internet. Which AWS service should be used to provide outbound internet access without allowing inbound traffic?

Accepted Answer

NAT gateway. A NAT gateway enables EC2 instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing any unsolicited inbound traffic from the internet. It resides in a public subnet with an Elastic IP and performs source network address translation (SNAT), replacing the private source IP with the gateway's public IP. This satisfies the requirement of outbound-only internet access without exposing the private instances to inbound connections.

Answer

Site-to-Site VPN connection

Answer

VPC endpoint

Answer

Internet gateway

Question 14

A company is designing a multi-account AWS environment using AWS Transit Gateway. They want to centralize network management and ensure that VPCs in different accounts can communicate. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Create a Transit Gateway in the central networking account. Option A is correct because the Transit Gateway must first be created in the central networking account, which serves as the hub for centralized network management. Option B is correct because AWS Resource Access Manager (RAM) is the mechanism used to share the Transit Gateway with other AWS accounts so their VPCs can attach to it. Option D is correct because Transit Gateway route tables are required to control routing, and VPC attachments must be associated with a route table for traffic to flow between VPCs. Option C is not correct because creating and peering separate Transit Gateways per account is unnecessary and does not provide the centralized single-hub design described. Option E is not correct because VPC peering connects VPCs directly and does not attach a VPC to a Transit Gateway; Transit Gateway VPC attachments are used instead.

Answer

Create a separate Transit Gateway in each account and peer them together

Answer

Create a VPC peering connection between each VPC and the Transit Gateway

Question 15

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team reports intermittent connectivity loss to resources in the VPC, but the Direct Connect tunnel status shows as UP. Which configuration is MOST likely causing the issue?

Accepted Answer

Traffic is being routed asymmetrically through the Direct Connect and a VPN backup. Asymmetric routing occurs when traffic from on-premises to the VPC uses Direct Connect, but return traffic from the VPC takes the VPN backup path. This can cause stateful firewalls (e.g., AWS Network Firewall, security groups, or on-premises firewalls) to drop packets because they expect traffic to arrive on the same interface. The Direct Connect tunnel status remains UP because the BGP session is still established, but connectivity is intermittent due to dropped return packets.

Answer

The BGP keepalive interval is set to 60 seconds

Answer

Jumbo frames are enabled on the Direct Connect interface but not on on-premises routers

Answer

A separate private VIF is required for each VPC in the account