ANS-C01 Network Implementation Practice Test 34 — 15 Questions

Question 1

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose 2)

Accepted Answer

AWS Direct Connect. AWS Direct Connect (B) is correct because it establishes a dedicated private network connection from an on-premises data center to AWS over a standard Ethernet fiber-optic cable, bypassing the public internet and providing consistent latency and bandwidth for hybrid connectivity. AWS Site-to-Site VPN (E) is also correct because it creates an IPsec VPN tunnel over the public internet between an on-premises customer gateway and an AWS virtual private gateway or transit gateway, securely connecting the on-premises network to the VPC. An Internet gateway (A) only enables communication between a VPC and the public internet, not a private on-premises network. A VPC endpoint (C) provides private connectivity to AWS services (such as S3 or DynamoDB) within the AWS network, not to on-premises networks. A VPC peering connection (D) connects two VPCs to each other, not a VPC to an on-premises network.

Answer

Internet gateway

Answer

VPC endpoint

Answer

VPC peering connection

Question 2

Which THREE considerations are important when implementing a multi-region Direct Connect architecture? (Choose 3)

Accepted Answer

Ensure Direct Connect connections are in at least two separate geographic locations.. Option A is correct because a resilient multi-region Direct Connect architecture requires at least two Direct Connect connections in separate geographic locations, so a single location failure (e.g., a facility outage or fiber cut) cannot take down all private connectivity. Option D is correct because using diverse paths and providers for the Direct Connect connections avoids a shared physical or carrier failure; diversity at the network layer is what actually delivers the redundancy that separate locations imply. Option E is correct because a VPN connection over the internet can serve as a backup path to Direct Connect, providing failover if the dedicated connections are disrupted, and it can also be used during maintenance windows. Option B is not correct because a single Direct Connect connection is a single point of failure and does not meet the high-availability goal of a multi-region architecture. Option C is not correct because connecting all Direct Connect connections to the same AWS Direct Connect device concentrates risk on one device and eliminates the redundancy that diverse connections are meant to provide.

Answer

Use a single Direct Connect connection to reduce complexity.

Answer

Connect all Direct Connect connections to the same AWS Direct Connect device.

Question 3

Which TWO components are required when configuring a transit gateway to connect multiple VPCs and an on-premises network via Direct Connect? (Choose 2)

Accepted Answer

Transit Gateway association with the Direct Connect gateway. Option B is correct because the transit gateway must be associated with the Direct Connect gateway so that traffic from the on-premises network can be routed into the transit gateway and then to the attached VPCs. Option E is correct because a Direct Connect gateway is the required AWS resource that links the Direct Connect connection to the transit gateway association, enabling global routing between on-premises and multiple VPCs. An Internet gateway (A) is not required because this design uses Direct Connect, not public internet connectivity. A virtual private gateway (C) is not required because the transit gateway replaces the VGW for VPC attachment in this architecture. A customer gateway (D) is not required because it is used for Site-to-Site VPN termination, not for Direct Connect transit gateway associations.

Answer

Internet gateway (IGW)

Answer

Virtual private gateway (VGW)

Answer

Customer gateway (CGW)

Question 4

A company has a VPC with public and private subnets across two Availability Zones. The private subnets require outbound internet access for updates, but must not be directly reachable from the internet. The company has a NAT gateway in each public subnet. Security team reports that instances in private subnets cannot reach the internet. Which configuration should be verified first?

Accepted Answer

Verify that the route table for the public subnets has a default route pointing to an internet gateway, and the private subnets' route table has a default route pointing to the NAT gateway. For instances in private subnets to reach the internet via a NAT gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway, and the NAT gateway must be placed in a public subnet whose route table has a default route pointing to an internet gateway. If either route is missing, outbound internet access will fail. Option B is incorrect because VPC endpoints are for accessing specific AWS services (e.g., S3), not general internet access. Option C is incorrect because NACLs are stateless and by default allow all outbound traffic; although custom NACLs could block traffic, routing misconfiguration is a more common first issue. Option D is incorrect because security groups are stateful and outbound traffic is allowed by default; blocking outbound HTTPS would be an intentional change, not the first thing to verify.

Answer

Verify that the VPC has a VPC endpoint for S3 configured

Answer

Verify that the network ACLs for the private subnets allow outbound traffic to 0.0.0.0/0

Answer

Verify that the security groups attached to the instances allow outbound HTTPS traffic

Question 5

A company is designing a multi-tier application with web servers in public subnets and database servers in private subnets. The database servers should only be accessible from the web servers. Which AWS feature should be used to enforce this?

Accepted Answer

Security groups that reference the web server security group as a source. Security groups that reference the web server security group as a source allow the database security group to accept traffic only from instances that are members of the web server security group. This enforces least privilege at the instance level and automatically adapts as web servers are added or removed. It is the recommended AWS best practice for tiered applications.

Answer

VPC endpoints to restrict access to the database servers

Answer

Network ACLs with allow rules for the web server subnet CIDR

Answer

Network ACLs with deny rules for all traffic except from the web server subnet

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to a partner's VPC with CIDR 10.0.0.0/16 using a VPC peering connection. What is the issue with this configuration?

Accepted Answer

Overlapping CIDR ranges are not supported for VPC peering. VPC peering requires that the CIDR blocks of the peered VPCs do not overlap. In this case, both VPCs use 10.0.0.0/16, which creates an identical address space. When routes are added to the route tables for the peering connection, the destination CIDR would be ambiguous, and the VPC cannot distinguish between local resources and those in the peered VPC, leading to routing conflicts. AWS explicitly rejects peering requests between VPCs with overlapping or identical CIDR ranges.

Answer

The company has reached the maximum number of VPC peering connections

Answer

VPC peering is only supported within the same region

Answer

VPC peering does not support transitive routing

Question 7

A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?

Accepted Answer

Verify that the VPC route table has a route to the on-premises network via the virtual private gateway. Even though the VPN tunnel is 'UP', traffic from the VPC to the on-premises network must be routed through the virtual private gateway (VGW). If the VPC route table does not contain a route for the on-premises CIDR (e.g., 192.168.1.0/24) pointing to the VGW, the instances have no path to reach the on-premises server, regardless of tunnel status.

Answer

Verify that the internet gateway is attached to the VPC

Answer

Verify that the security group for the instances allows outbound ICMP

Answer

Verify that the VPN tunnel is up on both ends

Question 8

A company needs to establish a dedicated, low-latency, and consistent network connection from their on-premises data center to AWS. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, low-latency, and consistent private network connection from on-premises to AWS, bypassing the internet. Option A (Site-to-Site VPN) uses the public internet and is less consistent. Option B (VPN CloudHub) connects multiple on-premises sites to AWS but still relies on the internet. Option C (VPC peering) connects VPCs within AWS, not on-premises. Therefore, D is correct.

Answer

AWS Site-to-Site VPN

Answer

AWS VPN CloudHub

Answer

VPC peering

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 172.16.0.0/12. They are using an AWS Transit Gateway with a VPN attachment to the on-premises network. The transit gateway route table has a static route for 172.16.0.0/12 pointing to the VPN attachment. Which THREE of the following are necessary for traffic to flow from the VPC to on-premises?

Accepted Answer

The VPC route tables include a route for 172.16.0.0/12 pointing to the transit gateway. Option B is correct because the VPC must have a Transit Gateway attachment (a VPC attachment) before any traffic can be sent to or received from the transit gateway; without this attachment, the TGW cannot route packets into the VPC. Option A is correct because the VPC's route tables must contain a route for 172.16.0.0/12 targeting the transit gateway; otherwise instances in the VPC have no path toward the on-premises CIDR. Option C is correct because the transit gateway route table must have a route for 172.16.0.0/12 pointing to the VPN attachment, which is exactly the static route described in the scenario and is required for the TGW to forward traffic to the VPN. Option D is not required because the scenario already states a static route exists on the TGW, so BGP advertisement from the on-premises router is unnecessary for the TGW to know the route. Option E is not required because the VPN can use static routing; dynamic BGP is optional and not mandated by the scenario.

Answer

The on-premises router is advertising the 172.16.0.0/12 route over BGP

Answer

The VPN tunnel is configured with dynamic BGP routing

Question 10

Which TWO of the following are valid methods to provide outbound internet access to instances in a private subnet?

Accepted Answer

Deploy a NAT instance in a public subnet and configure routing. Option C is correct because a NAT instance placed in a public subnet can perform source NAT for instances in a private subnet, and the private subnet's route table can point its default route (0.0.0.0/0) to that NAT instance's ENI, allowing outbound-only internet access. Option D is correct because an AWS NAT gateway is a managed NAT service deployed in a public subnet with an Elastic IP, and the private subnet's route table can direct 0.0.0.0/0 to the NAT gateway, providing scalable outbound internet access without exposing the private instances. Option A is not valid because VPC endpoints (interface or gateway) only provide private connectivity to specific AWS services or supported partner services, not general outbound internet access. Option B is not valid because an internet gateway is attached at the VPC level, not to a subnet, and a private subnet by definition has no route to an internet gateway. Option E is not valid because a VPN connection links to a remote network (such as on-premises) and does not by itself provide general internet egress for private-subnet instances.

Answer

Use a VPC endpoint for internet access

Answer

Attach an internet gateway directly to the private subnet

Answer

Use a VPN connection to the internet

Question 11

Refer to the exhibit. A company has two VPCs (vpc-aaaaaaaa and vpc-bbbbbbbb) that are peered. The CIDR blocks are both 10.0.0.0/16. The peering connection status is 'active'. Which of the following is true about this configuration?

Accepted Answer

The VPCs cannot communicate because of overlapping CIDR blocks. VPC peering does not support overlapping CIDR blocks. Even though the peering connection status is active, routes cannot be added to the route tables because the CIDR blocks are identical (both 10.0.0.0/16), preventing communication. Option B is incorrect because the peering connection can become active despite overlapping CIDRs; the issue arises at the routing layer. Option C is incorrect because the overlapping CIDRs prevent any communication between the VPCs. Option D is incorrect because DNS resolution is not automatically enabled; it requires additional configuration.

Answer

The VPC peering connection will not become active due to overlapping CIDRs

Answer

The VPCs can communicate using the peering connection without any issues

Answer

DNS resolution between the VPCs will be automatically enabled

Question 12

A company has a Direct Connect connection with a single private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The VPC CIDR is 10.0.0.0/16. The on-premises CIDR is 172.16.0.0/12. The BGP session is established, and the on-premises router is advertising the 172.16.0.0/12 route to the VGW. The VGW is configured to propagate routes to the VPC route tables. However, instances in the VPC cannot reach on-premises resources. The VPC route table shows a propagated route for 172.16.0.0/12 with a target of the VGW. What is the most likely issue?

Accepted Answer

The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface. The most likely issue is that the on-premises router does not have a route to the VPC CIDR via the Direct Connect interface. Even though the BGP session is established and the VPC route table has a propagated route to on-premises, return traffic from on-premises to the VPC will fail if the on-premises router lacks a route pointing back through the Direct Connect connection. This is a common asymmetric routing problem.

Answer

The security groups for the VPC instances do not allow outbound traffic to the on-premises network

Answer

The VPC route table does not have a route for the on-premises CIDR

Answer

The BGP session is not advertising the VPC CIDR to the on-premises router

Question 13

A company is deploying a multi-tier application on AWS and needs to ensure that traffic between the web tier and the application tier does not traverse the internet. Both tiers are deployed in the same VPC but in different subnets. What is the MOST secure way to meet this requirement?

Accepted Answer

Use route tables and security groups to allow traffic within the VPC. The most secure way to ensure that traffic between the web tier and the application tier does not traverse the internet is to use route tables and security groups to allow traffic within the VPC. Both tiers are in the same VPC but in different subnets, so traffic stays within the VPC by default if routing is configured correctly. Route tables direct traffic between subnets, and security groups act as virtual firewalls to control inbound and outbound traffic. Option D is correct. Option A is wrong because an Internet Gateway is used for internet access, not for routing within a VPC. Option B is wrong because VPC Peering connects different VPCs, not subnets within the same VPC. Option C is wrong because a NAT Gateway is for outbound internet access from private subnets, not for inter-subnet communication.

Answer

Use an Internet Gateway to route traffic between subnets

Answer

Use VPC Peering between the subnets

Answer

Use a NAT Gateway in each subnet for inter-subnet communication

Question 14

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The ALB is internet-facing and uses TLS termination. The application requires that client IP addresses be preserved in the backend logs. The backend instances are in private subnets behind the ALB. Which configuration will ensure client IP addresses are preserved without additional overhead?

Accepted Answer

Configure the ALB to pass the X-Forwarded-For header and ensure backend logs parse it. The ALB automatically adds the X-Forwarded-For header to HTTP requests, containing the original client IP address. Since the backend instances are in private subnets and receive traffic from the ALB's private IPs, parsing this header in the backend logs is the standard, zero-overhead method to preserve client IPs for HTTP/HTTPS traffic with TLS termination.

Answer

Attach a VPC Endpoint to the ALB to capture client IP

Answer

Enable Proxy Protocol v2 on the target group

Answer

Replace the ALB with a Network Load Balancer (NLB)

Question 15

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They want to add a second Direct Connect connection for redundancy. What is the MINIMUM number of virtual interfaces required to achieve active-active failover for the VPC?

Accepted Answer

Two private virtual interfaces (one on each connection). To achieve active-active failover for a VPC over Direct Connect, each physical connection must carry its own private virtual interface (VIF) bound to the same virtual private gateway. Two private VIFs — one per connection — allow BGP to advertise the same VPC prefixes over both links, enabling ECMP-style active-active forwarding. A single VIF cannot span two physical connections, so redundancy requires one VIF per connection.

Answer

Two transit virtual interfaces (one on each connection)

Answer

One private virtual interface and one transit virtual interface

Answer

One private virtual interface