ANS-C01 Network Implementation Practice Test 33 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. They want to use the same connection to access another VPC in a different region. What is the simplest way to achieve this?

Accepted Answer

Use a Direct Connect Gateway. A Direct Connect Gateway (DX Gateway) allows you to associate a single private virtual interface (VIF) with multiple VPCs, even across different AWS regions. This is the simplest solution because it avoids creating additional VIFs or complex inter-VPC connectivity, and it supports transitive routing between the on-premises network and all associated VPCs via the same Direct Connect connection.

Answer

Create a new private VIF for the second VPC

Answer

Use a VPN over the internet to connect the VPCs

Answer

Set up VPC peering between the two VPCs

Question 2

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?

Accepted Answer

Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it. The best approach is to create a dedicated firewall VPC that hosts the third-party firewall appliance and use Transit Gateway (TGW) route tables to steer inter-VPC traffic through that VPC. By attaching the firewall VPC to the TGW and configuring route tables with static routes pointing to the firewall VPC attachment, all traffic between other VPCs can be forced to traverse the firewall for inspection. This provides centralized, scalable traffic inspection without requiring changes to individual VPC routing or security group configurations.

Answer

Use VPC security groups across VPCs

Answer

Use AWS Network Firewall directly in each VPC

Answer

Use network ACLs on each VPC subnet

Question 3

A company has a VPC with an IPv6 CIDR and wants to provide internet access to instances in a private subnet using IPv6. Which AWS service should be used?

Accepted Answer

Egress-Only Internet Gateway. An Egress-Only Internet Gateway (EIGW) is the correct AWS service for providing outbound-only IPv6 internet access to instances in a private subnet. Unlike IPv4, IPv6 addresses are globally unique and publicly routable by default, so a NAT-like translation is unnecessary; the EIGW allows outbound traffic while preventing unsolicited inbound connections, aligning with the private subnet's security posture.

Answer

VPC Gateway Endpoint

Answer

Internet Gateway

Answer

NAT Gateway

Question 4

A network engineer is troubleshooting connectivity between two VPCs that are peered. The route tables are correct, and security groups allow traffic. However, ICMP ping fails. What is the most likely cause?

Accepted Answer

The security groups are blocking ICMP. VPC peering supports ICMP, so option B is incorrect. The stem states that security groups allow traffic, but this should be interpreted as common TCP/UDP traffic; ICMP is a separate protocol. Security groups are protocol-specific and default to deny inbound traffic unless explicitly allowed. A rule allowing TCP/UDP does not permit ICMP. Therefore, the most likely cause of ping failure is that the security groups do not have an inbound ICMP rule, making D the correct answer.

Answer

The route tables are not propagated

Answer

VPC peering does not support ICMP

Answer

The VPCs are in different regions

Question 5

A company wants to provide internet access to instances in a public subnet. Which component must be attached to the VPC and have a route to it in the subnet's route table?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For instances in a public subnet to have outbound internet access and be reachable from the internet, the IGW must be attached to the VPC, and the subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW as the target.

Answer

Transit Gateway

Answer

Virtual Private Gateway

Answer

NAT Gateway

Question 6

Which THREE of the following are benefits of using AWS Transit Gateway over VPC peering for inter-VPC connectivity? (Choose three.)

Accepted Answer

Transitive routing between all attached VPCs. Option A is correct because AWS Transit Gateway acts as a regional hub that provides transitive routing, so any attached VPC can reach any other attached VPC through the gateway without needing a full mesh of individual peering connections. Option C is correct because Transit Gateway natively supports attachments for AWS Direct Connect gateways and Site-to-Site VPN, allowing centralized hybrid connectivity to on-premises networks, whereas VPC peering cannot extend to on-premises by itself. Option E is correct because Transit Gateway centralizes connectivity management, letting you attach many VPCs and on-premises links to a single gateway and control routing with a single set of route tables, instead of managing numerous point-to-point peering relationships. Option B is not correct because Transit Gateway adds an extra hop through a central hub, so it does not inherently provide lower latency than direct VPC peering. Option D is not correct because Transit Gateway charges per attachment and per GB of data processed, so it typically costs more than VPC peering, which has no hourly attachment charge.

Answer

Lower latency than VPC peering

Answer

No additional cost compared to VPC peering

Question 7

A network engineer created a VPC endpoint for the service shown in the exhibit. The endpoint is in the 'available' state, but instances in the VPC cannot resolve the private DNS name 'example.com'. What is the most likely cause?

Accepted Answer

The endpoint does not have 'Private DNS names enabled'. The private DNS name is only resolved via Route 53 private hosted zone if 'Private DNS names enabled' is set. The exhibit shows the service has a PrivateDnsName, but the endpoint must have 'Private DNS names enabled' for resolution to work.

Answer

The VPC does not have a Route 53 private hosted zone for example.com

Answer

The VPC does not have an internet gateway

Answer

The security group for the endpoint is blocking DNS traffic

Question 8

A network engineer is designing a hybrid network using AWS Direct Connect. The company requires high availability and wants to use a single AWS Direct Connect location with two connections from different customer routers. Which solution meets the high availability requirement?

Accepted Answer

Use two AWS Direct Connect connections from the same location, each connected to a different customer router, and configure BGP sessions over both connections. It provides two physically separate AWS Direct Connect connections from the same location, each terminating on a different customer router. This architecture eliminates single points of failure at both the connection and router level. By configuring BGP sessions over both connections, the network can use BGP path selection and failover mechanisms (e.g., AS_PATH prepending or MED) to achieve high availability. This design meets the requirement for a single location while ensuring redundancy against a router or connection failure.

Answer

Use a single AWS Direct Connect connection with multiple VLANs

Answer

Use a single AWS Direct Connect connection with two BGP sessions

Answer

Use a single AWS Direct Connect connection with Bidirectional Forwarding Detection (BFD) enabled

Question 9

A company is deploying a VPC with public and private subnets. They want to allow instances in a private subnet to access the internet for software updates while preventing inbound internet traffic. Which configuration should be used?

Accepted Answer

Attach an internet gateway to the VPC, and create a NAT gateway in a public subnet. Add a route in the private subnet route table to the NAT gateway for 0.0.0.0/0. A NAT gateway, deployed in a public subnet with an Internet Gateway (IGW) attached, allows instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while the IGW's one-way translation prevents unsolicited inbound traffic from reaching the private instances. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface.

Answer

Create a VPC endpoint for internet access

Answer

Use a transit gateway with a NAT instance

Answer

Attach an internet gateway to the VPC and add a route in the private subnet to the internet gateway for 0.0.0.0/0

Question 10

A company is setting up a Direct Connect connection between its on-premises data center and AWS. The company wants to use a single virtual interface (VIF) to access multiple VPCs in the same AWS Region. Which AWS service should be used to achieve this?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway allows you to associate multiple Virtual Private Clouds (VPCs) in the same AWS Region with a single Direct Connect virtual interface (VIF). This is achieved by creating a Direct Connect gateway and attaching it to the VIF, then associating the desired VPCs with the gateway via virtual private gateways (VGWs) or transit gateways. This enables centralized, private connectivity from on-premises to multiple VPCs without needing separate VIFs per VPC.

Answer

VPC peering connection

Answer

AWS VPN CloudHub

Answer

Transit VPC

Question 11

A company is deploying a multi-region application using two AWS Regions. They want to use an AWS Transit Gateway to interconnect VPCs within each region, and they need to interconnect the Transit Gateways across regions. Which is the most scalable and reliable approach?

Accepted Answer

Use Transit Gateway peering attachments between the Transit Gateways in each region.. AWS Transit Gateway supports inter-region peering, which is the recommended method for connecting Transit Gateways across regions. Option A is correct. Option B is incorrect because VPC peering does not natively interconnect Transit Gateways. Option C is incorrect because using AWS Site-to-Site VPN connections adds complexity, reduces bandwidth, and is less reliable compared to Transit Gateway peering. Option D is incorrect because a Direct Connect gateway is designed for connecting on-premises networks to AWS, not for interconnecting Transit Gateways across regions.

Answer

Create a VPC peering connection between VPCs in different regions and attach them to the Transit Gateways.

Answer

Use AWS Site-to-Site VPN connections between the Transit Gateways in each region.

Answer

Set up a Direct Connect gateway with virtual interfaces in each region and propagate routes.

Question 12

A company is deploying a VPC with both public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which AWS service should be placed in a public subnet to enable this?

Accepted Answer

NAT gateway. A NAT gateway is correct because it enables EC2 instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. The NAT gateway must be placed in a public subnet with an associated Internet Gateway to translate private IP addresses to the public IP of the NAT gateway for outbound traffic.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Direct Connect virtual interface

Question 13

A company has a Direct Connect connection with a private VIF to a VPC. They also have a Site-to-Site VPN connection to the same VPC as a backup. The on-premises router is advertising the same prefixes over both connections. The company wants to ensure that traffic uses Direct Connect when available and fails over to VPN if Direct Connect goes down. Which configuration should be applied?

Accepted Answer

Prepend AS path on the BGP advertisements over the VPN connection to make the path less preferred.. AS path prepending on the VPN BGP advertisements makes the VPN route less preferred because BGP selects the path with the shortest AS path length. Since Direct Connect advertisements have a shorter AS path, traffic will use Direct Connect when available. If Direct Connect fails, the VPN path becomes the only option and is used for failover.

Answer

Set a higher MED value on the Direct Connect BGP advertisements.

Answer

Disable BGP on the VPN connection to force traffic to Direct Connect.

Answer

Set a higher local preference on the VPN BGP advertisements.

Question 14

A company wants to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. Which of the following is required to establish the VPN connection?

Accepted Answer

Virtual private gateway attached to the VPC and a customer gateway representing the on-premises router. To establish a Site-to-Site VPN, you need a virtual private gateway (VGW) or transit gateway on the AWS side, and a customer gateway (CGW) representing the on-premises router. Option C is correct. Option A is incorrect because a Direct Connect gateway is used for Direct Connect connections, not VPN. Option B is incorrect because an internet gateway is used for public internet traffic, not VPN. Option D is incorrect because a VPC endpoint is for private access to AWS services, not for establishing a VPN connection.

Answer

Direct Connect gateway associated with the VPC

Answer

Internet gateway attached to the VPC

Answer

VPC endpoint for the VPN service

Question 15

A company has a VPC with public and private subnets in multiple Availability Zones. They want to deploy a NAT gateway for outbound internet access for instances in private subnets. Which of the following is the most highly available architecture?

Accepted Answer

Deploy one NAT gateway in each Availability Zone with a route table per AZ that points to the NAT gateway in the same AZ.. A NAT gateway is an Availability Zone-scoped resource: it is created in a specific subnet in a specific AZ, and if that AZ fails, the NAT gateway becomes unavailable. The most highly available architecture is therefore to deploy one NAT gateway per AZ and configure each AZ's private subnet route table to point to the NAT gateway in the same AZ. This eliminates cross-AZ dependency and ensures that an AZ failure only affects resources in that AZ.

Answer

Deploy one NAT gateway in the first Availability Zone and route all private subnet traffic to that NAT gateway.

Answer

Use a single NAT instance in a public subnet with an auto scaling group and health checks.

Answer

Deploy two NAT gateways in the first Availability Zone and use a single route table pointing to one of them.