ANS-C01 Network Implementation Practice Test 35 — 15 Questions

Question 1

A network engineer is configuring an AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network advertises a prefix 10.0.0.0/8. One of the VPCs has a CIDR of 10.0.0.0/16. What will happen to traffic destined to 10.0.0.5 from another VPC attached to the Transit Gateway?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Traffic is routed to the VPC because of a more specific route. AWS Transit Gateway uses longest prefix match routing. The VPC's CIDR 10.0.0.0/16 is more specific than the on-premises prefix 10.0.0.0/8, so traffic destined to 10.0.0.5 will be routed to the VPC. Option B is incorrect; routes conflict only if they have the same prefix length, but here different lengths allow the longest prefix to win. Option C is incorrect because the on-premises route is less specific and will not be used. Option D is incorrect because there is no load-balancing; the more specific route takes precedence.

Answer

Traffic is dropped due to conflicting routes

Answer

Traffic is routed to the on-premises network because it is learned via Direct Connect

Answer

Traffic is load-balanced between the VPC and on-premises

Question 2

A network engineer is troubleshooting an AWS Direct Connect connection that is experiencing high latency. The connection is a 1 Gbps dedicated connection. The engineer notices that the link utilization is at 90%. What is the MOST likely cause of the high latency?

Accepted Answer

High bandwidth utilization causing queuing. High bandwidth utilization (90%) leads to queuing delays as packets wait in buffers, increasing latency. Option A is incorrect: the virtual interface type (private vs public) does not directly cause high latency. Option B is incorrect: BGP keepalive timer misconfiguration affects BGP session stability, not latency. Option D is incorrect: jumbo frames can reduce latency by reducing overhead, not increase it.

Answer

The virtual interface is configured as private instead of public

Answer

BGP keepalive timer misconfiguration

Answer

The use of jumbo frames

Question 3

A company is migrating its on-premises data center to AWS using Direct Connect and a VPN connection as backup. The company has multiple VPCs connected via a Transit Gateway. They want to ensure high availability for the Direct Connect connection. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure BGP with multiple virtual interfaces on the Direct Connect connections. Option E is correct because provisioning a second Direct Connect connection at a different Direct Connect location provides physical path diversity, so a failure at one location or its provider equipment does not take down all dedicated connectivity. Option D is correct because configuring BGP with multiple virtual interfaces (for example, a private VIF on each connection) enables dynamic routing and failover between the redundant Direct Connect links, allowing traffic to shift automatically when one path degrades. Together, a second connection at a different location plus BGP on multiple VIFs delivers the high availability the company requires for its Direct Connect connection. Option A is not appropriate because replacing the VPN backup with a second Direct Connect connection removes the diverse VPN backup path rather than adding Direct Connect redundancy. Option B is unrelated to availability, since jumbo frames only affect MTU and packet efficiency, not resiliency. Option C is incorrect because a single higher-bandwidth connection remains a single point of failure and does not provide high availability.

Answer

Replace the VPN backup with a second Direct Connect connection

Answer

Enable jumbo frames on the Direct Connect connection

Answer

Use a single Direct Connect connection but with higher bandwidth

Question 4

A company has a production VPC with CIDR 10.0.0.0/16. They have an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones. The ALB distributes traffic to a fleet of EC2 instances in private subnets. The EC2 instances need to access an Amazon S3 bucket to retrieve configuration files. The company wants to minimize data transfer costs and ensure that traffic to S3 does not traverse the internet. A network engineer created a Gateway VPC Endpoint for S3 in the VPC and added a route in the public subnet route tables pointing to the endpoint. However, the EC2 instances still cannot access the S3 bucket. The security groups for the EC2 instances allow outbound HTTPS to 0.0.0.0/0. The NACLs are default (allow all). The S3 bucket policy allows access from the VPC endpoint. What is the MOST likely reason the EC2 instances cannot access S3?

Accepted Answer

The route to the Gateway VPC Endpoint was added only to public subnets, not to private subnets. Gateway VPC Endpoints are route table targets that must be added to the route tables of the subnets where the instances reside. The engineer added the route only to the public subnet route tables, but the EC2 instances are in private subnets, so their route tables lack the endpoint route. Consequently, traffic to S3 from the instances still goes through the NAT gateway or internet gateway, and if no NAT is present, it fails.

Answer

The Gateway VPC Endpoint is in a different region than the S3 bucket

Answer

The security group for the EC2 instances does not allow outbound traffic to the S3 prefix list

Answer

The S3 bucket policy does not include a condition for the VPC endpoint

Question 5

A small company has a single VPC with one public subnet and one private subnet. They have a web server in the public subnet and a database server in the private subnet. The web server needs to access the database server on port 3306 (MySQL). The network engineer has configured the security group for the database server to allow inbound TCP port 3306 from the security group of the web server. However, the web server cannot connect to the database server. The network ACL for the private subnet is the default (allows all inbound and outbound). The web server can ping the database server's private IP. What is the MOST likely cause of the connection failure?

Accepted Answer

The MySQL service on the database server is not running or not listening on port 3306. The web server can ping the database server's private IP, indicating network connectivity (including security group and NACL rules for ICMP) is working. The security group for the database server allows inbound TCP 3306 from the web server's security group, and the NACL is default (allow all). Therefore, the most likely cause is that the MySQL service on the database server is not running or not listening on port 3306. This would prevent the connection even though network paths are open.

Answer

The web server cannot reach the private IP of the database server because it is in a different subnet

Answer

The network ACL for the private subnet is blocking inbound traffic on port 3306

Answer

The security group for the database server is not allowing inbound traffic from the web server's security group

Question 6

A company is using AWS Direct Connect to connect its on-premises network to a VPC via a private virtual interface (VIF) attached to a virtual private gateway (VGW). The company wants to add redundant connectivity using a second Direct Connect connection from a different provider. The network team proposes using a Direct Connect gateway (DXGW) with two private VIFs from different connections, each attached to the DXGW. The DXGW will be associated with the VGW. Which THREE steps are required to complete this configuration? (Choose three.)

Accepted Answer

Associate both private virtual interfaces with the same Direct Connect gateway.. Option B is correct because a Direct Connect gateway can aggregate multiple private VIFs from different Direct Connect connections, so both private VIFs must be associated with the same DXGW to provide redundant paths into the same VPC. Option C is correct because the DXGW must be associated with the virtual private gateway (VGW) attached to the VPC, which allows the DXGW to advertise and route traffic to that VPC over the private VIFs. Option D is correct because the on-premises network must advertise its prefixes over both BGP sessions (one per private VIF) so that AWS can learn the routes and use both connections for active-active load sharing or failover. Option A is not required because, with a DXGW associated to a VGW, the VPC route tables point to the virtual private gateway, not directly to the Direct Connect gateway. Option E is incorrect because a single VGW can be associated with the DXGW; separate VGWs per connection are not needed and would not provide the intended redundant attachment to the same VPC.

Answer

Add routes to the VPC subnets' route tables pointing to the Direct Connect gateway.

Answer

Create a separate virtual private gateway for each Direct Connect connection.

Question 7

A company is deploying an AWS Network Firewall in a centralized inspection VPC to inspect traffic between VPCs connected to an AWS Transit Gateway. The architecture uses Transit Gateway route tables to send inter-VPC traffic through the inspection VPC. The Network Firewall is configured with stateful and stateless rule groups. After deployment, the security team notices that traffic from VPC A to VPC B is being dropped. Other traffic flows correctly. What is the MOST likely cause of this issue?

Accepted Answer

The stateless rule group is set to forward traffic, but the stateful rule group is not configured to allow the traffic.. In AWS Network Firewall, stateless rule groups evaluate traffic first. If the stateless rule group is set to 'forward' (i.e., pass traffic to the stateful engine), the stateful rule group must then explicitly allow the traffic. If the stateful rule group is not configured to allow the traffic (e.g., it has no matching allow rule or has a default drop), the traffic will be dropped. This explains why only traffic from VPC A to VPC B is dropped while other flows work, as the issue is specific to the stateful rule group's handling of that particular flow.

Answer

The route table for VPC A's subnets does not have a route to the inspection VPC.

Answer

The stateful rule group is configured to drop all traffic that is not explicitly allowed.

Answer

The security group attached to the Transit Gateway is blocking the traffic.

Question 8

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and an IPv6 CIDR of 2001:db8:1234::/56. The company hosts a web application on IPv4-only EC2 instances in a private subnet. The application must be accessible from the internet via IPv6. The company has an internet-facing Application Load Balancer (ALB) with dual-stack IP address type. The ALB is in a public subnet. The target group is configured with IP address type IPv4. Users report that they can access the application via IPv4 but not via IPv6. The ALB security group allows inbound HTTP/HTTPS from ::/0. What is the MOST likely cause?

Accepted Answer

The public subnet does not have an associated IPv6 CIDR.. For an internet-facing dual-stack ALB to serve IPv6 traffic, the public subnet hosting the ALB must have an associated IPv6 CIDR block. Even though the VPC has an IPv6 CIDR (2001:db8:1234::/56), subnets do not automatically inherit IPv6 — each subnet must be explicitly assigned an IPv6 CIDR. Without an IPv6 CIDR on the public subnet, the ALB cannot obtain IPv6 addresses and cannot respond to IPv6 clients, even though its security group allows ::/0.

Answer

The target group is configured with IP address type IPv4, but the ALB must use IPv6 to communicate with the targets.

Answer

The ALB is configured as IPv4-only instead of dual-stack.

Answer

The private subnet's route table does not have an IPv6 route to the NAT gateway or egress-only internet gateway.

Question 9

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: Public Subnet A (10.0.1.0/24) and Private Subnet B (10.0.2.0/24). They launch a Network Load Balancer (NLB) in Public Subnet A. The NLB must forward traffic to targets in Private Subnet B. However, the targets are not receiving traffic, and the NLB target group shows all targets as unhealthy. The security groups and network ACLs are correctly configured to allow traffic. What is the most likely cause of the unhealthy targets?

Accepted Answer

The target group health check is configured to use a protocol or port that the targets are not listening on.. The targets are unhealthy because the NLB target group health check is likely misconfigured. NLB health checks must use the same protocol and port that the target application is listening on. Even with correct security groups and NACLs, an incorrect health check port or protocol will cause targets to fail health checks and be marked unhealthy. Ensuring the health check settings match the application configuration resolves the issue.

Answer

The NLB requires targets to be in the same subnet as the load balancer nodes.

Answer

The NLB requires the targets to have Elastic IP addresses assigned to them.

Answer

The NLB does not support targets in private subnets; they must be in public subnets.

Question 10

A company has a VPC with an internet gateway and a NAT gateway in a public subnet. They launch an EC2 instance in a private subnet that needs to access the internet for software updates. The instance's security group allows outbound traffic, and the route table for the private subnet has a route to the NAT gateway. However, the instance cannot reach the internet. Which of the following is the most likely cause?

Accepted Answer

The NAT gateway's subnet route table does not have a route to the internet gateway.. The NAT gateway requires its own subnet to have a route to an internet gateway. If the NAT gateway's subnet route table lacks a route to the internet gateway, the NAT gateway cannot route traffic to the internet. Even if the private subnet's route table points to the NAT gateway, the NAT gateway itself must have internet connectivity. This misconfiguration is a frequent cause of outbound connectivity failures.

Answer

The private subnet's route table does not have a route to the internet gateway.

Answer

The EC2 instance does not have a public IP address.

Answer

The NAT gateway must be deployed in the same subnet as the private instance.

Question 11

A company is using AWS Transit Gateway to connect multiple VPCs. They have a VPC attachment with a CIDR of 10.0.0.0/16 and another with 10.1.0.0/16. They want to ensure that traffic between these VPCs is allowed. They have configured the Transit Gateway route tables and associations. However, traffic between the VPCs is not flowing. Which of the following is the most likely reason?

Accepted Answer

The VPC route tables do not have routes pointing to the Transit Gateway for the other VPC's CIDR.. Traffic between VPCs via Transit Gateway requires routes in both the Transit Gateway route table and the VPC subnet route tables. The VPC route tables must have entries for the remote VPC CIDRs pointing to the Transit Gateway. If these routes are missing, traffic will not be sent to the Transit Gateway, resulting in connectivity failure. This is a common configuration step that is often overlooked.

Answer

The Transit Gateway attachment for each VPC must be in a public subnet.

Answer

The security groups on the instances do not allow traffic from the other VPC's CIDR.

Answer

The Transit Gateway does not support inter-VPC routing; a peering connection is required.

Question 12

A network engineer is deploying a new VPC that must reach an Amazon S3 gateway endpoint from instances in a private subnet. The route table for the private subnet currently contains only the local route. After creating the gateway endpoint and associating it with the private subnet's route table, the engineer notices that instances still cannot reach S3. Which action should the engineer take to resolve this?

Accepted Answer

Add a route in the private subnet's route table with the prefix list of the S3 gateway endpoint as the destination and the gateway endpoint as the target.. Gateway endpoints for Amazon S3 rely on a route-table entry that uses the service's managed prefix list as the destination and the gateway endpoint as the target. If that route is absent, traffic from the private subnet has no path to S3 even though the endpoint is associated. Re-adding the prefix-list route to the endpoint target is the required fix.

Answer

Modify the VPC's DHCP options set to include the S3 endpoint DNS name so instances resolve the endpoint.

Answer

Create an interface endpoint for S3 in the same subnet and point the route table to its elastic network interface.

Answer

Attach an internet gateway to the VPC and add a 0.0.0.0/0 route to the internet gateway in the private subnet's route table.

Question 13

A company runs a latency-sensitive workload in a VPC and has deployed a Network Load Balancer (NLB) with a TLS listener. The security team requires that client IP addresses be preserved for logging. The NLB is configured with an IP-type target group pointing to application instances in the same VPC. Which statement correctly describes client IP preservation in this configuration?

Accepted Answer

Client IP preservation is enabled by default for IP-type target groups, and the client IP is visible to the target instances.. Network Load Balancers preserve the client source IP by default when the target group is of type IP. Because the workload uses an IP-type target group, the application instances already receive the original client address, and no proxy protocol or listener modification is required to meet the logging requirement.

Answer

Client IP preservation requires enabling the proxy protocol v2 attribute on the target group.

Answer

Client IP preservation must be explicitly enabled in the NLB listener attributes because TLS listeners strip the source address.

Answer

Client IP preservation is only available when the NLB uses an instance-type target group, not an IP-type target group.

Question 14

A company is deploying a new application in a VPC. They need to ensure that the application can resolve DNS names for AWS services such as Amazon RDS and Amazon ElastiCache within the VPC. They have not modified any DHCP options sets. Which DNS resolution behavior is enabled by default in a VPC?

Accepted Answer

DNS resolution is enabled, and DNS hostnames are disabled by default.. In an Amazon VPC, DNS resolution is enabled by default, allowing instances to resolve DNS names such as those for AWS services. DNS hostnames, which provide public DNS hostnames for instances with public IPs, are disabled by default. This default setting ensures that applications can resolve necessary service endpoints without additional configuration, while giving control over public DNS naming.

Answer

DNS resolution and DNS hostnames are both enabled by default.

Answer

DNS resolution is disabled, and DNS hostnames are enabled by default.

Answer

Both DNS resolution and DNS hostnames are disabled by default.

Question 15

A company is setting up a VPC peering connection between two VPCs in different AWS accounts and different AWS Regions. They need to ensure that the connection is properly configured for bidirectional traffic. Which TWO of the following steps are required to enable communication between the VPCs? (Choose two.)

Accepted Answer

Accept the VPC peering connection request in the accepter VPC's account.. To enable communication over a VPC peering connection, you must update the route tables in both VPCs to direct traffic for the peer CIDR to the peering connection. Additionally, for cross-account peering, the accepter VPC owner must accept the peering request. These two steps are essential for establishing the connection and allowing traffic to flow bidirectionally. Security group and NACL configurations are also important but are not part of the peering setup itself.

Answer

Ensure that security groups in both VPCs allow traffic from the peer VPC's CIDR block.

Answer

Create a VPN connection between the two VPCs to secure the traffic.

Answer

Configure a NAT gateway in each VPC to allow traffic to the peer VPC.