ANS-C01 Network Implementation Practice Test 37 — 15 Questions

Question 1

A company is deploying a new VPC and needs to provide internet access to instances in a public subnet. The instances must be able to initiate outbound connections to the internet and receive inbound connections from specific IP addresses. The company wants to minimize management overhead and ensure high availability. Which solution should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an internet gateway to the VPC and create a route in the public subnet's route table pointing to the internet gateway.. An internet gateway is the standard, highly available AWS component that enables bidirectional internet access for public subnets. It requires no management overhead and automatically scales. By attaching an IGW and adding a route, instances with public IPs can send and receive internet traffic as required.

Answer

Create a NAT gateway in a public subnet and route the private subnet's traffic through it.

Answer

Configure a virtual private gateway with a Site-to-Site VPN to route traffic to the internet.

Answer

Use an egress-only internet gateway to provide internet access to the instances.

Question 2

A network engineer is designing a VPC that will host a multi-tier application. The web tier must be accessible from the internet over HTTP and HTTPS, while the database tier must only accept connections from the web tier on port 3306. The engineer wants to use security groups to enforce these requirements and minimize administrative overhead. Which security group configuration should the engineer implement?

Accepted Answer

Create a security group for the web tier that allows inbound HTTP and HTTPS from 0.0.0.0/0, and a security group for the database tier that allows inbound port 3306 from the web tier's security group ID.. Security group referencing lets the database tier security group allow inbound traffic on port 3306 from any instance that belongs to the web tier security group, without needing to know or maintain individual IP addresses. This enforces least privilege because only web tier instances can reach the database, and it reduces administrative overhead because membership changes are handled automatically. Allowing the entire VPC CIDR or using a single shared security group would be overly permissive and insecure.

Answer

Create a security group for the web tier that allows inbound HTTP and HTTPS from 0.0.0.0/0, and a security group for the database tier that allows inbound port 3306 from the web tier's private IP addresses as individual /32 rules.

Answer

Create a security group for the web tier that allows inbound HTTP and HTTPS from 0.0.0.0/0, and a security group for the database tier that allows inbound port 3306 from the VPC CIDR block 10.0.0.0/16.

Answer

Create a single security group that allows inbound HTTP and HTTPS from 0.0.0.0/0 and inbound port 3306 from 0.0.0.0/0, and attach it to all instances in both tiers.

Question 3

A company has a VPC with a CIDR block of 172.31.0.0/16 and a single subnet 172.31.1.0/24 in which all EC2 instances reside. The company needs to add a new subnet to the VPC to support a separate application tier. A network engineer attempts to create a subnet with CIDR block 172.31.1.128/25 but receives an error that the CIDR block conflicts with an existing subnet. Which action should the engineer take to successfully create the new subnet?

Accepted Answer

Create the new subnet with CIDR block 172.31.2.0/24, which does not overlap with any existing subnet.. Subnets within a VPC must not overlap. The existing subnet 172.31.1.0/24 encompasses the entire range from 172.31.1.0 to 172.31.1.255, so any CIDR block within that range, such as 172.31.1.128/25 or 172.31.1.0/25, will conflict. Choosing a different non-overlapping block within the VPC CIDR, such as 172.31.2.0/24, is the correct approach. Deleting and recreating the existing subnet is disruptive and unnecessary, and 172.31.1.128/24 is invalid due to CIDR alignment rules.

Answer

Create the new subnet with CIDR block 172.31.1.128/24, which uses a larger prefix to avoid conflict.

Answer

Create the new subnet with CIDR block 172.31.1.0/25, which splits the existing subnet into two smaller subnets.

Answer

Delete the existing subnet 172.31.1.0/24 and recreate it with a smaller CIDR block, then create the new subnet with 172.31.1.128/25.

Question 4

A company has a Transit Gateway (TGW) with multiple VPC attachments and a Site-to-Site VPN attachment. The company wants to ensure that traffic from an on-premises network can reach a specific VPC, but not other VPCs attached to the same TGW. The TGW has default route table association and propagation enabled. What should a network engineer do to meet this requirement?

Accepted Answer

Create a new TGW route table, associate the VPN attachment and the specific VPC attachment with it, and add a route to the VPC CIDR.. The requirement is to isolate the VPN attachment so it can only reach one VPC. This is achieved by creating a dedicated TGW route table, associating the VPN and the target VPC with it, and adding a route to the VPC CIDR. Other VPCs remain in the default route table and are not reachable from the VPN. This uses TGW route table segmentation, which is the standard method for network isolation.

Answer

Disable default route table association and propagation on the TGW, then manually associate all attachments with the default route table.

Answer

Use a prefix list on the VPN attachment to filter out routes to other VPCs.

Answer

Configure the VPN connection to use BGP with a custom AS path prepend for the other VPC CIDRs.

Question 5

A startup runs a web application on EC2 instances in a private subnet across two Availability Zones. The instances must fetch objects from Amazon S3 without traversing the internet, and the security team requires that traffic to S3 never leave the AWS network. The VPC has no NAT gateway. Which solution meets these requirements with the least operational effort?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and update the private subnet route tables to use the endpoint prefix list.. A gateway VPC endpoint for Amazon S3 adds a prefix-list route to the subnet route table, keeping S3 traffic on the AWS backbone without NAT or internet gateways. It has no hourly charge and requires only a route table update, making it the least-effort solution that also satisfies the requirement that traffic never leave the AWS network.

Answer

Configure a NAT gateway in a public subnet and point the private subnet route table at it.

Answer

Deploy an interface VPC endpoint for Amazon S3 in each Availability Zone and enable private DNS names.

Answer

Attach an internet gateway to the VPC and add a route to 0.0.0.0/0 in the private subnet route tables.

Question 6

A solutions architect is designing a VPC that must provide outbound internet access for instances in private subnets without assigning public IPv4 addresses. The architecture must be highly available across two Availability Zones and must not allow inbound connections from the internet. Which combination of components should the architect use?

Accepted Answer

A NAT gateway in each Availability Zone's public subnet, with private subnet route tables pointing to the NAT gateway in the same Availability Zone.. Instances in private subnets need a NAT device in a public subnet to reach the internet without public IPv4 addresses. A NAT gateway per Availability Zone, referenced by the route table of the private subnets in the same zone, meets the outbound-only and high availability requirements while avoiding cross-zone dependency.

Answer

A NAT instance in one private subnet with an Elastic IP, and a single route in all private subnet route tables pointing to that instance.

Answer

An internet gateway attached to the VPC and a route in the private subnet route tables pointing to the internet gateway.

Answer

A VPC peering connection to a shared services VPC that has an internet gateway, and a route in the private subnet route tables to the peering connection.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block to the VPC. The company requires that the secondary CIDR be from the 10.0.0.0/8 range and not overlap with any existing subnets or routes. Which CIDR block should be added?

Accepted Answer

10.1.0.0/16. The company requires the secondary CIDR to be from the 10.0.0.0/8 range and not overlap with existing subnets or routes. The primary CIDR is 10.0.0.0/16, so a non-overlapping block like 10.1.0.0/16 is valid. Other options either overlap or fall outside the required range. Thus, 10.1.0.0/16 is the correct choice.

Answer

192.168.0.0/16

Answer

10.0.0.0/16

Answer

10.0.1.0/24

Question 8

A network engineer is deploying an Application Load Balancer (ALB) in front of a fleet of EC2 instances in private subnets. The ALB must be reachable from the internet, and the instances must never receive traffic directly from the internet. The engineer has created public subnets in two Availability Zones. Which configuration is correct?

Accepted Answer

Place the ALB nodes in the public subnets, place the EC2 instances in the private subnets, and configure the instance security group to allow traffic only from the ALB security group.. Internet-facing ALB nodes must live in public subnets with a route to an internet gateway, while backend targets stay in private subnets. Restricting the instance security group to accept traffic only from the ALB security group enforces that clients cannot bypass the load balancer, satisfying both reachability and isolation.

Answer

Place the ALB nodes in the private subnets, create a Network Load Balancer in the public subnets, and chain the NLB to the ALB as its target.

Answer

Place the ALB nodes in the private subnets and attach an Elastic IP to each ALB node so that internet clients can reach the load balancer directly.

Answer

Place the ALB nodes in the public subnets and place the instances in the same public subnets, relying on the instance security group to block all inbound traffic except from the ALB.

Question 9

A network engineer is designing a VPC that must host a latency-sensitive trading application. The design requires that each subnet can reach every other subnet in the same VPC without additional routing configuration, and that the VPC can be extended to a second VPC with minimal management overhead. The company also wants to control which Availability Zones the subnets use. Which TWO statements are correct about the VPC design elements involved? (Choose two.)

Accepted Answer

A VPC peering connection requires a route in both VPCs and does not support transitive routing to a third VPC.. The local route in every VPC route table enables all subnets in the VPC to communicate without extra configuration, satisfying the intra-VPC requirement. VPC peering provides a deliberate, non-transitive connection between two VPCs with routes in both, which extends the design to a second VPC while keeping management overhead low. Subnets remain single-AZ constructs and the local route cannot be removed.

Answer

The local route in a VPC route table can be removed and replaced with a more specific route to control intra-VPC traffic.

Answer

VPC peering connections support transitive routing so a peered VPC can forward traffic to a third VPC.

Answer

A subnet can span multiple Availability Zones to provide high availability for the trading application.

Question 10

A company runs a critical web application in a VPC that spans three Availability Zones. The application must be highly available and support millions of concurrent TCP connections. The network team needs to distribute traffic across EC2 instances while preserving the client source IP address for logging and security analysis. Which AWS load balancer should they use?

Accepted Answer

Network Load Balancer (NLB). The Network Load Balancer is the correct choice because it operates at layer 4, preserves the client source IP address, and is built to handle millions of concurrent TCP connections with low latency. It also supports cross-zone load balancing and high availability across multiple Availability Zones, directly addressing the application's requirements.

Answer

Classic Load Balancer (CLB)

Answer

Application Load Balancer (ALB)

Answer

Gateway Load Balancer (GWLB)

Question 11

A company has an AWS Site-to-Site VPN connection between its on-premises data center and a VPC. The VPN uses a virtual private gateway (VGW) and dynamic BGP routing. The on-premises router advertises 172.16.0.0/16, and the VPC advertises 10.0.0.0/16. The company wants to ensure that if the primary VPN tunnel fails, traffic automatically fails over to the secondary tunnel within seconds, without manual intervention. The on-premises router supports BGP and is configured with both tunnels as neighbors. What should the network engineer verify to meet this requirement?

Accepted Answer

That the BGP hold time and keepalive timers on both the on-premises router and the AWS VPN endpoints are tuned so that a dead tunnel is detected quickly and its routes are withdrawn.. For a Site-to-Site VPN with dynamic BGP routing, failover between tunnels depends on how quickly the on-premises router detects that the primary tunnel is down. BGP hold time and keepalive timers control this detection. Tuning them on both the customer gateway and the AWS VPN endpoints ensures that a failed tunnel's routes are withdrawn promptly, allowing the secondary tunnel to take over automatically within seconds.

Answer

That the on-premises router is configured with BGP graceful restart and that both tunnels are in the same BGP peer group.

Answer

That the VGW is configured with a higher BGP weight for the secondary tunnel and that the on-premises router uses the same autonomous system number for both tunnels.

Answer

That the VGW is advertising the VPC CIDR with a higher BGP local preference on the secondary tunnel than on the primary tunnel.

Question 12

A company has an on-premises data center connected to AWS over a 10 Gbps AWS Direct Connect dedicated connection. The network team needs to advertise a summary route of 172.16.0.0/16 to AWS while also ensuring that a more specific 172.16.5.0/24 prefix is preferred for a migration cutover. The on-premises router supports BGP. Which approach should the engineer use?

Accepted Answer

Advertise both 172.16.0.0/16 and 172.16.5.0/24 from the on-premises router over the same BGP session; AWS will prefer the more specific prefix for matching destinations.. BGP forwarding decisions use the longest matching prefix before comparing path attributes, so advertising both the aggregate and the more specific prefix naturally sends 172.16.5.0/24 traffic over the specific route. This supports a staged migration cutover while keeping the summary for all other destinations.

Answer

Use a Direct Connect gateway with a transit virtual interface and advertise 172.16.0.0/16 only, because a transit VIF does not support more specific prefix advertisements.

Answer

Advertise only 172.16.0.0/16 and rely on AS_PATH prepending on the more specific prefix to make AWS prefer 172.16.5.0/24.

Answer

Advertise 172.16.0.0/16 with a longer AS_PATH and 172.16.5.0/24 with a shorter AS_PATH to force the specific prefix to be preferred.

Question 13

A company runs a hybrid workload where an on-premises application server must reach an EC2 instance in a VPC over an AWS Site-to-Site VPN. The VPN uses a virtual private gateway, and the on-premises router advertises 10.10.0.0/16 while the VPC CIDR is 10.20.0.0/16. The on-premises server can ping the EC2 instance, but TCP connections to port 443 time out. The VPC route table has a route for 10.10.0.0/16 pointing to the virtual private gateway, and the EC2 security group allows 10.10.0.0/16 on port 443. Which is the most likely cause?

Accepted Answer

The network ACL on the subnet containing the EC2 instance is blocking inbound TCP port 443 from the on-premises CIDR.. The protocol-specific failure is the key clue: ICMP succeeds while TCP 443 times out. Network ACLs are stateless and evaluated per direction, so an inbound rule that omits TCP 443 from the on-premises CIDR drops the SYN while allowing ICMP. Security groups are stateful and already permit the source, so the ACL is the most likely culprit.

Answer

The EC2 instance is in a private subnet and therefore cannot accept traffic from on-premises networks.

Answer

The virtual private gateway does not support BGP, so the on-premises prefix is not learned.

Answer

The VPN tunnel is down, so no traffic can pass between the on-premises network and the VPC.

Question 14

A network engineer is designing a VPC that will host a fleet of EC2 instances needing to reach both Amazon S3 and an on-premises database over AWS Direct Connect. The S3 traffic must never traverse the public internet, and the on-premises traffic must use a private virtual interface (VIF). The engineer creates a gateway VPC endpoint for S3 and a private VIF with a virtual private gateway (VGW). After deployment, instances in the private subnet can reach S3 but cannot reach the on-premises database. Route tables show the S3 prefix list pointing to the gateway endpoint and a propagated route to the on-premises CIDR via the VGW. What is the MOST likely cause of the connectivity failure to the on-premises database?

Accepted Answer

The on-premises router is not advertising the database subnet over BGP to the VGW, so the route is present but the return path is missing.. When a propagated BGP route to an on-premises CIDR appears in a VPC route table but connectivity still fails, the missing piece is usually the reverse advertisement from the customer edge router. The VGW will install whatever it learns, so a route's presence does not validate bidirectional reachability. Confirming the on-premises device advertises the database subnet, and that no route map filters it, resolves this class of asymmetric routing failure.

Answer

The gateway VPC endpoint for S3 is overriding the propagated VGW route because prefix lists take precedence over BGP-propagated routes.

Answer

The security group on the EC2 instances is blocking outbound traffic to the on-premises CIDR range.

Answer

The private VIF must be associated with a Direct Connect gateway instead of a VGW to carry traffic to on-premises networks.

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a second CIDR block to the VPC to accommodate additional subnets. The new CIDR block must not overlap with the existing one. Which action should a network engineer take?

Accepted Answer

Associate a new CIDR block with the VPC using the AWS Management Console or AWS CLI.. To add a second CIDR block to an existing VPC, you associate a new CIDR block with the VPC. This is a supported operation in AWS. The new block must not overlap with any existing CIDR block in the VPC or with any routes in your route tables. Other options either create separate VPCs or attempt unsupported modifications.

Answer

Use AWS Direct Connect to advertise the new CIDR block to the VPC.

Answer

Modify the existing VPC CIDR block to a larger range that includes the additional addresses.

Answer

Create a new VPC with the desired CIDR block and peer it with the existing VPC.