ANS-C01 Network Implementation Practice Test 32 — 15 Questions

Question 1

A company is designing a network for a multi-tier application that includes a web tier, application tier, and database tier. The web tier must be accessible from the internet, while the application and database tiers should have no direct internet access. All tiers are in the same VPC. Which configuration meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place web tier in public subnets with Internet Gateway, app and DB tiers in private subnets with a NAT Gateway for outbound traffic. It places the web tier in a public subnet with an Internet Gateway (IGW) for direct inbound internet traffic, while the application and database tiers reside in private subnets with no direct internet path. A NAT Gateway in a public subnet provides outbound-only internet access for the private tiers (e.g., for software updates) without allowing inbound connections, satisfying the requirement that only the web tier be internet-accessible.

Answer

Place all tiers in public subnets and use security group rules to restrict access to app and DB tiers

Answer

Place web tier in a public subnet and app and DB tiers in the same public subnet but with restrictive Network ACLs

Answer

Place all tiers in private subnets and attach an Internet Gateway to the private subnets for the web tier

Question 2

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect and Site-to-Site VPN. The network team wants to ensure that traffic between VPCs does not traverse the on-premises network. Which Transit Gateway feature should be used?

Accepted Answer

Transit Gateway route tables with separate associations and propagations. Transit Gateway route tables with separate associations and propagations allow you to isolate traffic between VPCs and on-premises networks. By associating VPC attachments to one route table and on-premises attachments (Direct Connect, VPN) to another, you can prevent VPC-to-VPC traffic from being routed through the on-premises network. This ensures that inter-VPC traffic stays within AWS, meeting the requirement.

Answer

Transit Gateway Multicast

Answer

Transit Gateway Network Manager

Answer

Transit Gateway BGP over AWS Direct Connect

Question 3

A company wants to securely connect two VPCs in different AWS regions using AWS infrastructure. Which service should be used?

Accepted Answer

VPC peering. VPC peering is the correct service because it allows direct, private connectivity between two VPCs in different AWS regions using AWS's internal network, without traversing the public internet. It uses the existing AWS infrastructure to route traffic between the VPCs via private IP addresses, and it supports inter-region peering as of 2017, making it the simplest and most cost-effective solution for this specific requirement.

Answer

AWS Direct Connect

Answer

Internet Gateway

Answer

AWS Transit Gateway

Question 4

Which TWO scenarios are best suited for using AWS Transit Gateway over VPC peering? (Select TWO.)

Accepted Answer

Connecting hundreds of VPCs across multiple accounts. Option C is correct because AWS Transit Gateway acts as a central hub that supports thousands of VPC attachments across multiple AWS accounts via AWS Resource Access Manager, avoiding the O(n²) mesh of VPC peering connections that becomes unmanageable at hundreds of VPCs. Option D is correct because Transit Gateway natively integrates with AWS Direct Connect through a Direct Connect gateway and Transit VIF, allowing many VPCs to share a single connection to on-premises networks, whereas VPC peering cannot attach to Direct Connect at all. Option A is not the best fit because VPC peering itself supports cross-account connections, so cross-account connectivity alone does not justify Transit Gateway. Option B is not the best fit because a single VPC to on-premises connection is typically handled by a VPN or Direct Connect with a virtual private gateway, which is simpler and cheaper than Transit Gateway. Option E is not the best fit because two VPCs in the same account and region are easily connected with a single VPC peering connection, making Transit Gateway unnecessary overhead.

Answer

Connecting VPCs in different AWS accounts

Answer

Connecting a single VPC to an on-premises network

Answer

Connecting two VPCs in the same account and region

Question 5

Which TWO statements about AWS Direct Connect are correct? (Select TWO.)

Accepted Answer

Direct Connect supports multiple virtual interfaces (VIFs) over a single connection. Option B is correct because a single AWS Direct Connect connection can host multiple virtual interfaces (VIFs) — private VIFs for VPC access, public VIFs for AWS public services, and transit VIFs for Transit Gateway — each with its own VLAN ID and BGP peering. Option E is correct because Direct Connect uses dedicated, private physical links (1 Gbps, 10 Gbps, or 100 Gbps) that bypass the public internet, delivering more consistent latency, jitter, and throughput than an internet-based IPsec VPN. Option A is wrong because Direct Connect does not encrypt traffic by default; encryption requires running an IPsec VPN over the Direct Connect link (or MACsec on supported connections). Option C is wrong because Direct Connect is a dedicated private network connection service, not a managed VPN service like AWS Site-to-Site VPN. Option D is wrong because Direct Connect requires physical cross-connects at an AWS Direct Connect location or through an AWS Direct Connect Partner, so it cannot be provisioned in minutes purely in software.

Answer

Direct Connect traffic is encrypted by default

Answer

Direct Connect is a managed VPN service

Answer

Direct Connect can be provisioned in minutes without any physical infrastructure

Question 6

Refer to the exhibit. A CloudFormation template creates a VPC with public and private subnets. The template includes an Internet Gateway and a route table with a default route to the IGW, associated with the public subnet. An EC2 instance launched in the public subnet cannot be reached from the internet. The security group allows inbound HTTP from 0.0.0.0/0. What is the MOST likely missing resource?

Accepted Answer

An Elastic IP address assigned to the instance or auto-assign public IP enabled on the subnet. The EC2 instance in the public subnet cannot be reached from the internet because it lacks a publicly routable IP address. Even though the subnet has a default route to the Internet Gateway (IGW) and the security group allows inbound HTTP from 0.0.0.0/0, the instance must have either an Elastic IP address assigned directly or the subnet must have the 'Auto-assign public IPv4 address' attribute enabled. Without a public IP, the IGW cannot perform 1-to-1 NAT to translate the instance's private IP to a public IP, making it unreachable from the internet.

Answer

A VPN connection to the VPC

Answer

A NAT Gateway in the public subnet

Answer

A route table for the private subnet

Question 7

Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?

Accepted Answer

The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway. The on-premises network can ping the VPC because the VPC route table has a route to 10.0.0.0/16 pointing to the virtual private gateway (VGW), so return traffic from the VPC is correctly forwarded. However, the VPC cannot ping the on-premises network because the on-premises router lacks a route back to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway (CGW). Without this return route, traffic from the VPC reaches the on-premises network, but the on-premises router drops the response packets as it does not know how to reach 172.16.0.0/16.

Answer

The VPN tunnels are not both in UP state

Answer

The VPN acceleration is disabled, causing high latency

Answer

The VPN connection is configured with static routes only and BGP is not used

Question 8

A company is using AWS CloudFormation to deploy a VPC with two public subnets and two private subnets across two Availability Zones. The template includes an internet gateway and a NAT gateway in each public subnet. The company needs to ensure that instances in the private subnets can access the internet. Which route table configuration should be used?

Accepted Answer

Add a route 0.0.0.0/0 pointing to the NAT gateway in the same AZ in each private subnet route table.. Private subnets require a default route (0.0.0.0/0) pointing to a NAT gateway in the same Availability Zone to ensure internet-bound traffic is source-NATed. This design maintains high availability by avoiding cross-AZ data transfer costs and single points of failure. The NAT gateway must be placed in a public subnet, and the private subnet route table must explicitly direct traffic to it.

Answer

Add a route to the internet gateway in the private subnet route tables.

Answer

Add a route to the NAT gateway in the public subnet route tables.

Answer

Add a route 0.0.0.0/0 pointing to a single NAT gateway in both private subnet route tables.

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to establish a site-to-site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN tunnel is up, but traffic from the VPC to on-premises is not flowing. Which of the following is the most likely cause?

Accepted Answer

The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.. For traffic from a VPC to an on-premises network over a site-to-site VPN, the VPC route table must contain a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC has no path to forward packets destined for 192.168.0.0/16, even though the VPN tunnel is up. Security groups and NACLs are stateful or stateless filters, but they do not create routing paths.

Answer

The security groups do not allow outbound traffic.

Answer

The NACLs are blocking outbound traffic.

Answer

The VPN connection is in the wrong AWS region.

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize network security by inspecting all traffic between VPCs and between VPCs and on-premises. Which architecture should be used?

Accepted Answer

Attach all VPCs to a Transit Gateway and use route tables to send traffic through a firewall appliance in one VPC.. AWS Transit Gateway supports centralized routing through a shared services VPC. By attaching all VPCs and VPN connections to the Transit Gateway and configuring route tables to point default or inter-VPC routes to a network firewall appliance (e.g., a third-party firewall or AWS Network Firewall) in a dedicated inspection VPC, all traffic between VPCs and between VPCs and on-premises can be forced through the firewall for inspection. This architecture leverages Transit Gateway route tables and blackhole routes to enforce traffic steering without requiring complex peering or VPN meshes.

Answer

Use VPN connections between all VPCs and on-premises.

Answer

Use VPC peering between all VPCs and configure security groups.

Answer

Use Network Load Balancer to distribute traffic across VPCs.

Question 11

A company is deploying a web application in a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The ALB must only accept traffic from the internet and forward it to the instances. Which subnet configuration is correct for the ALB and EC2 instances?

Accepted Answer

ALB in public subnets, EC2 in private subnets.. An Application Load Balancer (ALB) must be deployed in public subnets to accept traffic directly from the internet, as it requires an internet gateway (IGW) route to receive inbound connections. The EC2 instances should reside in private subnets to enhance security, as they only need to respond to the ALB via the VPC's internal routing, not directly from the internet. This configuration ensures the ALB handles internet-facing traffic while the instances remain isolated from direct external access.

Answer

ALB in private subnets, EC2 in private subnets with a NAT gateway.

Answer

ALB in public subnets, EC2 in public subnets.

Answer

ALB in private subnets, EC2 in public subnets.

Question 12

A company is configuring a site-to-site VPN connection between its on-premises network and AWS. The VPN tunnel is up, but traffic is not passing. The company has verified that routes are correct on both sides. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Check the security group rules for the EC2 instances in the VPC.. Option C is correct because security groups in AWS act as stateful instance-level firewalls, and if they do not permit the relevant traffic (e.g., ICMP for testing or the application ports) from the on-premises CIDR, packets will be silently dropped even though the VPN tunnel and routes are fine. Option E is correct because network ACLs are stateless subnet-level filters; their inbound and outbound rules must explicitly allow the on-premises CIDR on both directions (including ephemeral ports for return traffic), otherwise traffic will be blocked despite correct routing. Option A is not the issue here because a virtual private gateway must already be attached to the VPC for the site-to-site VPN tunnel to come up at all, and the scenario states the tunnel is up. Option B is not the issue because if the on-premises firewall were blocking IPSec (UDP 500/4500, ESP), the tunnel would not have established. Option D is not the issue because a mismatched encryption algorithm would prevent Phase 2/IPSec SA negotiation, so the tunnel would not be up.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Ensure that the on-premises firewall is configured to allow IPSec traffic.

Answer

Verify that the VPN tunnel is using the correct encryption algorithm.

Question 13

A network engineer is reviewing VPC Flow Logs for a VPC. The logs show that traffic from 10.0.1.5 to 10.0.2.10 on port 443 is being accepted and rejected intermittently. Both instances are in the same VPC. What is the most likely cause?

Accepted Answer

The network ACL is blocking traffic.. VPC Flow Logs show intermittent ACCEPT and REJECT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Since the traffic is within the same VPC, the route table is not involved (Option C is unlikely). Security groups are stateful, so even if the destination security group denies outbound traffic, return traffic for the established inbound connection is still allowed; thus Option A is incorrect. The intermittent behavior is characteristic of a stateless network ACL (NACL). A NACL is applied at the subnet level and evaluates inbound and outbound rules independently. If the NACL allows inbound traffic but blocks outbound response traffic (or vice versa), the flow will be partially accepted (initial packets) and then rejected when return packets hit the blocking rule. This matches the logs showing both ACCEPT and REJECT for the same flow. Therefore, the most likely cause is a misconfigured NACL (Option B).

Answer

The security group on the destination instance is configured to allow inbound HTTPS but deny outbound traffic.

Answer

The route table is misconfigured.

Answer

The source instance's security group is denying outbound traffic.

Question 14

A network engineer is troubleshooting connectivity issues. The route table shows a blackhole route for 10.0.0.0/8 pointing to a VPC endpoint (vpce-12345678). What is the most likely cause of the blackhole state?

Accepted Answer

The VPC endpoint (vpce-12345678) has been deleted.. A blackhole route in a VPC route table indicates that the target for the route (in this case, a VPC endpoint) is not in a valid state. When a VPC endpoint (vpce-12345678) is deleted, all routes pointing to it become blackhole routes because the target no longer exists. This causes traffic destined for 10.0.0.0/8 to be dropped silently.

Answer

The VPC CIDR 10.0.0.0/16 is overlapping with the endpoint route.

Answer

The route table does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.

Question 15

A company is deploying a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for software updates but must not be reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing the internet from initiating connections back to those instances. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate private source IPs to the gateway's public IP, ensuring the private instances remain unreachable from external hosts.

Answer

VPC Peering

Answer

Virtual Private Gateway

Answer

Internet Gateway