ANS-C01 Network Implementation Practice Test 36 — 15 Questions

Question 1

A company has a VPC with a CIDR block of 10.0.0.0/16 and wants to create a subnet that can host a large number of instances. The network engineer needs to choose a subnet CIDR block from the VPC range. Which subnet CIDR block is valid for use within this VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

10.0.0.0/24. A subnet CIDR block must be a subset of the VPC CIDR block and must not overlap with other subnets. Because the VPC uses 10.0.0.0/16, only a block such as 10.0.0.0/24 falls within that range and is valid for subnet creation.

Answer

192.168.0.0/24

Answer

10.1.0.0/24

Answer

10.0.0.0/15

Question 2

A company runs a latency-sensitive application on EC2 instances in a VPC. The instances must communicate with each other using a protocol that requires multicast. Which AWS networking feature should be used to enable multicast communication within the VPC?

Accepted Answer

AWS Transit Gateway Multicast. Transit Gateway Multicast is the correct choice because it is the only AWS-native feature that enables multicast communication within a VPC. It allows you to create a multicast domain, associate subnets, and manage group membership using IGMP or static configurations. Other options either do not support multicast or are intended for different use cases such as hybrid connectivity or public service access.

Answer

VPC peering with multicast enabled

Answer

AWS Direct Connect with a public VIF

Answer

AWS Site-to-Site VPN with multicast support

Question 3

A company runs a global web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The network team deploys an accelerating endpoint using AWS Global Accelerator with an ALB endpoint in us-east-1. After deployment, users still connect to the us-east-1 ALB directly instead of the accelerator's static IP addresses. The DNS record for the application still points to the ALB's DNS name. What should the team do to route user traffic through the accelerator?

Accepted Answer

Update the application's DNS record to point to the Global Accelerator's static IP addresses instead of the ALB DNS name.. Global Accelerator requires clients to connect to its static anycast IP addresses. If the application's DNS record still points to the ALB DNS name, clients never use the accelerator. Updating DNS to the accelerator's IP addresses ensures traffic enters the AWS global network at the nearest edge, improving latency and reliability. Other options do not change client-facing DNS resolution.

Answer

Create an alias record in Amazon Route 53 that points to the ALB's DNS name with a latency routing policy.

Answer

Add the accelerator's static IP addresses to the ALB's security group inbound rules to allow traffic from the accelerator.

Answer

Enable client IP preservation on the ALB target group so the accelerator can forward client IP addresses.

Question 4

A financial services company uses AWS Transit Gateway to connect 50 VPCs and an on-premises network via AWS Site-to-Site VPN. The security team requires that all traffic between VPCs be inspected by a central firewall appliance running in a dedicated inspection VPC. The appliance supports transparent bridging and must see the original source and destination IP addresses. Which Transit Gateway configuration should be implemented to meet these requirements?

Accepted Answer

Create two Transit Gateway route tables: one for the inspection VPC and one for all other VPCs. Associate the inspection VPC with the inspection route table and all other VPCs with the other route table. In the other route table, add a default route pointing to the inspection VPC attachment. In the inspection route table, add routes for each VPC CIDR pointing to the respective VPC attachments.. To force all inter-VPC traffic through a central inspection VPC, you need separate Transit Gateway route tables. The route table associated with the spoke VPCs should have a default route to the inspection VPC attachment, ensuring all traffic goes there first. The inspection VPC's route table should have specific routes for each spoke VPC CIDR pointing to their attachments, so inspected traffic can be forwarded to the correct destination. This design maintains original IP addresses and avoids loops.

Answer

Create a separate Transit Gateway route table for each VPC attachment and associate the inspection VPC attachment with all of them.

Answer

Use a single Transit Gateway route table, associate all VPC attachments with it, and add a static route for each VPC CIDR pointing to the inspection VPC attachment.

Answer

Enable appliance mode on the inspection VPC attachment and use a single route table with a default route to the inspection VPC.

Question 5

A network engineer is configuring an AWS Site-to-Site VPN connection between an on-premises router and a VPC. The on-premises router uses BGP to exchange routes with the AWS virtual private gateway (VGW). The engineer wants to ensure that the VPN tunnel stays up and that routes are advertised correctly. Which configuration on the customer gateway device is required for the VPN to establish?

Accepted Answer

Configure the customer gateway to use a public IP address and set up the VPN tunnels with pre-shared keys and BGP peering.. A Site-to-Site VPN requires the customer gateway device to have a public IP address and to be configured with pre-shared keys and BGP peering for dynamic routing. The customer gateway ASN must differ from the VGW ASN. Using a private IP without a public NAT device, matching ASNs, or static routing would not satisfy the BGP requirement.

Answer

Configure the customer gateway to use a private IP address and enable NAT traversal (NAT-T) for the VPN tunnels.

Answer

Configure the customer gateway with the same BGP ASN as the virtual private gateway.

Answer

Configure the customer gateway to use IKEv1 with a single tunnel and static routing instead of BGP.

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a second CIDR block to the VPC to accommodate additional subnets. Which AWS action allows this?

Accepted Answer

Associate a new CIDR block with the VPC using the AWS Management Console or CLI.. AWS VPCs support multiple CIDR blocks. You can associate additional IPv4 CIDR blocks with a VPC to expand its address space. The new CIDR must not overlap with existing CIDRs or routes. This is done via the console, CLI, or API. Other options either do not expand the VPC's CIDR or are not supported.

Answer

Create a new VPC with the additional CIDR and peer it with the existing VPC.

Answer

Use AWS Resource Access Manager to share a subnet from another VPC.

Answer

Modify the existing CIDR block to a larger size.

Question 7

A company runs a two-tier application in a VPC. The web tier sits in an Auto Scaling group across three Availability Zones, and the database tier runs on EC2 instances in a separate subnet. The security team requires that the database tier accept connections only from the web tier, and that the web tier be reachable from the internet on TCP 443. A network engineer must design the security group configuration. Which combination of security group rules meets these requirements with the LEAST administrative overhead?

Accepted Answer

Create one security group for the web tier allowing inbound TCP 443 from 0.0.0.0/0, and a separate security group for the database tier allowing inbound TCP 3306 with the web tier's security group ID as the source. Attach each group to its respective tier.. Security groups can reference other security groups as a source, which authorizes the group's members by identity rather than by address. Since the web tier is an Auto Scaling group whose instance addresses change, the group-reference rule is the only approach that satisfies the restriction to the web tier while requiring no ongoing rule maintenance as instances scale in and out.

Answer

Create one security group for the web tier allowing inbound TCP 443 from 0.0.0.0/0, and a database security group allowing inbound TCP 3306 from an AWS-managed prefix list for the Region. Attach each group to its respective tier.

Answer

Create one security group for the web tier allowing inbound TCP 443 from 0.0.0.0/0, and a database security group allowing inbound TCP 3306 from the web tier's subnet CIDR blocks. Attach each group to its respective tier.

Answer

Create one security group for the web tier allowing inbound TCP 443 from 0.0.0.0/0, and a database security group allowing inbound TCP 3306 from the VPC CIDR range. Attach each group to its respective tier.

Question 8

A network engineer needs to capture IP traffic metadata for all traffic entering and leaving a specific network interface in a VPC. The logs must be stored in Amazon S3 for long-term analysis. Which AWS service or feature should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs is the correct service because it captures IP traffic metadata for network interfaces, subnets, or VPCs. You can create a flow log for a specific network interface and direct the logs to Amazon S3. This provides the needed visibility for troubleshooting and analysis. Other services either log different types of data or are scoped to different resources.

Answer

AWS Network Firewall Logging

Answer

AWS CloudTrail

Answer

AWS Transit Gateway Flow Logs

Question 9

A company runs a latency-sensitive trading application on EC2 instances spread across three Availability Zones in a VPC. The application uses a Network Load Balancer (NLB) with a TCP listener on port 443. The company wants the NLB to route each client connection to the same backend instance for the life of the connection, and they want to minimize failover disruption if a target becomes unhealthy. Which NLB configuration should a network engineer implement?

Accepted Answer

Rely on the NLB's default flow hash behavior, which pins each TCP connection to a single healthy target for the connection's lifetime.. Network Load Balancers operate at Layer 4 and by default use a flow hash to select a target for each TCP connection; the connection stays with that target until it closes or the target becomes unhealthy. There is no cookie-based sticky session option on a TCP listener, and no separate source IP affinity attribute. Client IP preservation and cross-zone load balancing change addressing and distribution, not per-connection pinning, so the default flow hash behavior is the correct mechanism.

Answer

Enable sticky sessions using an application-controlled cookie on the TCP listener.

Answer

Configure the target group with client IP preservation and enable cross-zone load balancing.

Answer

Enable source IP affinity on the target group so that each client IP is consistently mapped to the same target.

Question 10

A network engineer is designing a VPC that must provide outbound-only internet access for 40 EC2 instances in a private subnet while keeping them unreachable from the internet. The design uses a NAT gateway in a public subnet, and the route table for the private subnet points 0.0.0.0/0 at that NAT gateway. After deployment, instances can reach the internet, but a later audit reveals the NAT gateway is a single point of failure for the whole subnet. The engineer needs to remove that single point of failure. What should the engineer do?

Accepted Answer

Deploy a NAT gateway in each Availability Zone used by the private subnet, and update each private subnet's route table to point to the NAT gateway in the same Availability Zone.. NAT gateways are highly available within a single Availability Zone but do not survive the loss of that zone. Distributing a NAT gateway into every Availability Zone that hosts private subnets and pointing each subnet's route table at the local gateway is the standard way to eliminate the cross-AZ dependency and keep outbound-only access intact during a zonal failure.

Answer

Create a second NAT gateway in the same Availability Zone as the existing one and add an equal-cost route to the private subnet route table for both gateways.

Answer

Enable VPC Flow Logs on the private subnet and configure a CloudWatch alarm that recreates the NAT gateway in another Availability Zone when traffic drops.

Answer

Replace the NAT gateway with an internet gateway and adjust the private subnet route table to target the internet gateway, relying on security groups to block inbound traffic.

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16 and wants to create a subnet that can host a large number of instances. The network engineer needs to choose a subnet CIDR block from the VPC range. Which subnet CIDR block is valid for use within this VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an NLB with one subnet in each Availability Zone, disable cross-zone load balancing, and register targets in all three AZs.. To achieve low latency and high availability, the NLB should be deployed with subnets in multiple Availability Zones and have cross-zone load balancing disabled. This ensures that each NLB node routes traffic only to targets in its own AZ, minimizing cross-AZ latency. If an AZ fails, the NLB nodes in the remaining AZs continue to operate, and targets in those AZs handle the traffic. Registering targets in all AZs ensures that each AZ has local targets to serve requests.

Answer

Create an NLB with subnets in only one Availability Zone and register targets in all three AZs.

Answer

Create an NLB with one subnet in each Availability Zone, enable cross-zone load balancing, and register targets in only one AZ.

Answer

Create an NLB with one subnet in each Availability Zone, enable cross-zone load balancing, and register targets in all three AZs.

Question 12

A company operates a VPC with a CIDR block of 10.0.0.0/16 and an on-premises data center using 10.1.0.0/16. The company attaches a virtual private gateway to the VPC and creates a Site-to-Site VPN connection over the internet. The on-premises router advertises 10.1.0.0/16 over BGP, and the VPN tunnel comes up. Instances in the VPC can ping the on-premises router's tunnel address, but cannot reach any on-premises application servers behind that router. Routes for 10.1.0.0/16 appear in the VPC route table pointing at the virtual private gateway. What is the MOST likely cause?

Accepted Answer

The on-premises network is not advertising the application server subnets over BGP, or those subnets fall outside the advertised 10.1.0.0/16 summary.. BGP reachability to the tunnel endpoint only proves the control plane and IPsec are functioning. End-to-end access to application servers depends on the on-premises router advertising the prefixes that contain those servers, or on a summary prefix that encompasses them, so that the VPC route table receives a usable route.

Answer

The VPC security group attached to the instances does not permit outbound ICMP to the on-premises ranges, so replies are blocked.

Answer

The VPN connection is using a single tunnel, and AWS only forwards traffic over the second tunnel when both are established.

Answer

The virtual private gateway requires a static route for 10.1.0.0/16 in addition to the propagated BGP route before traffic can be forwarded.

Question 13

A company is deploying a global application that uses Amazon Route 53 for DNS. They have resources in multiple AWS Regions and want to route users to the closest healthy endpoint. The company also needs to comply with data sovereignty requirements that require certain users to be routed to a specific Region regardless of latency. Which two Route 53 routing policies should be combined to meet these requirements? (Choose two.)

Accepted Answer

Latency-based routing. Latency-based routing sends users to the lowest-latency Region, satisfying the closest healthy endpoint requirement. Geolocation routing sends users to a specific Region based on their geographic location, satisfying data sovereignty. Together, they can be used in a hierarchical DNS design where geolocation takes precedence for certain users, and latency-based routing handles the rest.

Answer

Multivalue answer routing

Answer

Weighted routing

Answer

Failover routing

Question 14

A company is deploying AWS Transit Gateway to connect 30 VPCs and two on-premises sites over AWS Direct Connect. The network team wants to segment routing so that production VPCs can reach shared services while development VPCs cannot reach production, and both environments can reach on-premises. Which TWO transit gateway features should the team use to satisfy these routing requirements? (Choose two.)

Accepted Answer

Use transit gateway route table associations and propagations to prevent development route propagation into the production route table.. Segmentation on a transit gateway is achieved through route table associations and propagations. Distinct route tables per environment, with each attachment associated to the correct table and only the intended routes propagated into it, let both environments reach shared services and on-premises while keeping development traffic out of production.

Answer

Enable transit gateway appliance mode on the Direct Connect attachment so that traffic between environments is inspected before forwarding.

Answer

Attach a VPN connection to the transit gateway for each environment and use BGP communities to separate the routing domains.

Answer

Configure transit gateway peering between the production and development attachments to filter routes at the peering boundary.

Question 15

A company has a VPC with an internet gateway and a NAT gateway in a public subnet. Instances in a private subnet need to access the internet for software updates. The company wants to ensure that the NAT gateway is highly available and can handle increased traffic during peak times. Which action should be taken?

Accepted Answer

Create a NAT gateway in each Availability Zone and update the route tables in the private subnets to point to the NAT gateway in the same Availability Zone.. For high availability and scalability, deploy a NAT gateway in each Availability Zone and configure private subnet route tables to use the NAT gateway in the same AZ. This ensures that if one AZ fails, the others continue to provide internet access, and it distributes the traffic load across multiple NAT gateways.

Answer

Attach an Elastic IP address to the NAT gateway and enable enhanced networking on the instances in the private subnet.

Answer

Create a single NAT gateway and enable cross-zone load balancing on the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it in an Auto Scaling group across multiple Availability Zones.