ANS-C01 Network Implementation Practice Test 38 — 15 Questions

Question 1

A startup is deploying a web application in a single VPC. The application instances run in private subnets and must download software patches from the internet during boot. The security team does not want to attach public IP addresses to the instances or expose them through an internet gateway. Which AWS service should the network engineer configure to allow outbound internet access for the private instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A NAT gateway placed in a public subnet, with a route in the private subnet route table pointing 0.0.0.0/0 to the NAT gateway.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet without receiving inbound connections or requiring public IP addresses. The private subnet route table must have a default route pointing to the NAT gateway for this to work.

Answer

A Gateway Load Balancer endpoint in the private subnet, with a route in the private subnet route table pointing 0.0.0.0/0 to the endpoint.

Answer

An internet gateway attached to the VPC, with a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

Answer

A virtual private gateway attached to the VPC, with a route in the private subnet route table pointing 0.0.0.0/0 to the virtual private gateway.

Question 2

A network engineer needs to connect two VPCs (VPC-A and VPC-B) that are in different AWS accounts. Both VPCs have CIDR blocks that do not overlap. The engineer wants to use AWS PrivateLink to allow a consumer in VPC-A to access a service in VPC-B. Which component must be created in VPC-B to enable the PrivateLink connection?

Accepted Answer

A VPC endpoint service backed by a Network Load Balancer.. AWS PrivateLink enables private connectivity between VPCs and services without exposing the entire network. The provider creates a VPC endpoint service, which is backed by a Network Load Balancer. The consumer then creates an interface VPC endpoint to connect to that service. This approach is secure, scalable, and does not require VPC peering or Transit Gateway.

Answer

A transit gateway with a VPC attachment in VPC-B.

Answer

An AWS Site-to-Site VPN connection between the two VPCs.

Answer

A VPC peering connection between VPC-A and VPC-B.

Question 3

A network engineer is configuring a VPC peering connection between two VPCs in different AWS accounts. The VPCs have non-overlapping CIDR blocks. The engineer needs to ensure that instances in both VPCs can communicate. Which additional configuration is required after the peering connection is accepted?

Accepted Answer

Update the route tables in both VPCs to route traffic destined for the other VPC's CIDR block to the peering connection.. After accepting a VPC peering connection, you must add routes in both VPCs' route tables to direct traffic for the peer VPC's CIDR block to the peering connection. Additionally, security groups and network ACLs must permit the traffic. The other options involve services that are not used for VPC peering and would not enable the required communication.

Answer

Attach an internet gateway to both VPCs and route traffic through it.

Answer

Create a VPN connection between the two VPCs to enable communication.

Answer

Configure a NAT instance in each VPC to translate traffic between the VPCs.

Question 4

A network engineer is designing a VPC that will host a latency-sensitive trading application. The application requires that traffic between two EC2 instances in different subnets within the same Availability Zone never leave the physical hardware of that Availability Zone, and that the instances use enhanced networking with the lowest possible jitter. Which combination of instance configuration and placement should the engineer choose?

Accepted Answer

Launch the instances with Elastic Network Adapter (ENA) enabled and place them in a cluster placement group within the same Availability Zone.. Enhanced networking with ENA reduces latency and jitter, and a cluster placement group packs instances tightly within a single Availability Zone so that traffic stays on low-latency local hardware. This combination is the standard choice for latency-sensitive workloads that must remain within one AZ.

Answer

Launch the instances with ENA enabled and place them in a partition placement group spanning multiple Availability Zones.

Answer

Launch the instances with the Intel 82599 Virtual Function interface and place them in a spread placement group across three Availability Zones.

Answer

Launch the instances with ENA enabled and place them in a spread placement group within a single Availability Zone.

Question 5

A company runs a two-tier web application in a VPC. The web tier consists of EC2 instances behind an internet-facing Application Load Balancer (ALB). The app tier runs on EC2 instances in private subnets and must accept traffic only from the web tier. A network engineer needs to configure the app tier security group to allow the web tier to connect on port 8080. Which source should the engineer specify in the inbound rule?

Accepted Answer

The security group ID of the web tier instances.. Security groups can reference other security groups as sources. When the app tier's inbound rule specifies the web tier's security group ID, only instances that are members of that group can connect on port 8080. This approach is identity-based rather than IP-based, so it remains accurate as instances scale and their addresses change.

Answer

The CIDR block of the VPC.

Answer

The IP address of the Application Load Balancer's elastic network interface.

Answer

The public IP addresses of the web tier instances.

Question 6

A company has an AWS Direct Connect connection with a transit virtual interface (transit VIF) attached to a Direct Connect gateway. The Direct Connect gateway is associated with a Transit Gateway in us-east-1. The company also has a second Transit Gateway in eu-west-1, and both Transit Gateways are peered. On-premises routes are advertised to the us-east-1 Transit Gateway, but workloads in eu-west-1 cannot reach the on-premises network. Which configuration change is required?

Accepted Answer

Create a static route in the eu-west-1 Transit Gateway route table pointing to the peering attachment for the on-premises CIDR.. Transit Gateway peering does not automatically exchange routes for all prefixes. Each Transit Gateway must have explicit routes in its route table for the remote prefixes, pointing to the peering attachment. For the on-premises CIDR to be reachable from eu-west-1, a static route targeting the peering attachment must be added to the eu-west-1 Transit Gateway route table, and a reciprocal route for the eu-west-1 CIDR must exist in the us-east-1 route table.

Answer

Enable equal-cost multi-path (ECMP) on the transit virtual interface.

Answer

Enable route propagation from the Direct Connect gateway attachment into the eu-west-1 Transit Gateway route table.

Answer

Associate the Direct Connect gateway with the eu-west-1 Transit Gateway.

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a Transit Gateway with multiple route tables. A network engineer needs to ensure that traffic from a specific VPC (VPC-A) can reach an on-premises network via a VPN attachment, but VPC-A should not be able to communicate with another VPC (VPC-B). Which configuration should the engineer implement?

Accepted Answer

Associate VPC-A and the VPN attachment with a dedicated Transit Gateway route table that contains routes to each other, and associate VPC-B with a different route table.. Transit Gateway route tables provide segmentation. By associating VPC-A and the VPN attachment with a route table that includes routes to each other, and placing VPC-B in a separate route table without routes to VPC-A, the engineer ensures VPC-A can reach on-premises but not VPC-B. This is the standard method for network isolation in a hub-and-spoke topology.

Answer

Use a network ACL on the subnet in VPC-A to deny traffic to VPC-B's CIDR.

Answer

Create a new Transit Gateway and attach VPC-A and the VPN to it, leaving VPC-B on the original Transit Gateway.

Answer

Modify the VPC route tables in VPC-A to remove the route to VPC-B's CIDR.

Question 8

A solutions architect is deploying a latency-sensitive application that requires a static IP address per Availability Zone and must preserve the source IP address of clients when forwarding traffic to backend instances. The backend instances are in an Auto Scaling group spread across three Availability Zones, and the application must handle millions of requests per second with extreme low latency. Which load balancer configuration meets these requirements?

Accepted Answer

A Network Load Balancer with one Elastic IP per Availability Zone and client IP preservation enabled.. A Network Load Balancer provides static Elastic IP addresses per Availability Zone and preserves client source IP addresses by default, while operating at Layer 4 for extremely high throughput and low latency. These characteristics align exactly with the static IP, source IP preservation, and performance constraints. Other load balancer types either lack static IP support or are intended for different traffic patterns.

Answer

An Application Load Balancer with cross-zone load balancing enabled and a static Elastic IP per subnet.

Answer

A Gateway Load Balancer with a private IP per Availability Zone and source IP preservation disabled.

Answer

A Classic Load Balancer with an Elastic IP attached to each backend instance.

Question 9

A network engineer is designing connectivity for a VPC that will host a three-tier web application. The application tier must reach an Amazon RDS for MySQL database, and the engineering team wants to enforce that all database traffic stays on the AWS backbone and never traverses the public internet. The database resides in a different VPC in the same AWS account and Region, and the two VPCs are already peered. Which configuration should the engineer implement to meet the requirement with the LEAST operational overhead?

Accepted Answer

Configure the VPC peering connection with routes in both route tables pointing to the peer CIDR, and restrict the RDS security group to accept traffic only from the application tier's security group.. Because the two VPCs are already peered in the same Region, adding reciprocal routes for the peer CIDR and tightening the RDS security group keeps all database traffic on the private AWS backbone with no new infrastructure. Peering traffic does not traverse the public internet, so the requirement is met without introducing an NLB, endpoint service, or NAT gateway.

Answer

Deploy a NAT gateway in the database VPC and route application-tier traffic through it to reach the RDS endpoint.

Answer

Create an AWS PrivateLink endpoint service in the database VPC backed by a Network Load Balancer, and create an interface VPC endpoint in the application VPC.

Answer

Attach an internet gateway to both VPCs and add routes so the application tier can reach the database over its public endpoint.

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16 and an on-premises network using 10.1.0.0/16. They establish an AWS Site-to-Site VPN connection to a virtual private gateway. The on-premises firewall allows only specific protocols. A network engineer notices that traffic from on-premises to a private EC2 instance fails, but traffic between EC2 instances in different subnets works. The VPN tunnel status is UP. Which action should the engineer take first to diagnose the issue?

Accepted Answer

Verify that the route table for the subnet associated with the EC2 instance has a route to 10.1.0.0/16 pointing to the virtual private gateway.. The most likely cause is a missing route in the subnet's route table for the on-premises CIDR pointing to the virtual private gateway. Even with the VPN tunnel up, without this route the VPC does not know how to send return traffic to the on-premises network. Verifying the route table is the correct first step.

Answer

Confirm that the customer gateway device is configured with the correct BGP ASN.

Answer

Ensure that the VPC has an internet gateway attached and that the subnet is public.

Answer

Check the security group on the EC2 instance to ensure it allows traffic from 10.1.0.0/16.

Question 11

A network engineer is designing a VPC that uses AWS PrivateLink to expose an internal service to consumers in other VPCs. The service runs behind a Network Load Balancer in the provider VPC. The engineer must ensure that consumers can reach the service without VPC peering, and that the provider retains control over which accounts can connect. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Accept the connection request from each consumer account in the endpoint service configuration.. To publish a service with AWS PrivateLink, the provider creates a VPC endpoint service configuration that references the Network Load Balancer. Consumers then create interface VPC endpoints in their own VPCs. If the service is not configured to auto-accept, the provider must accept each connection request, which gives the provider control over which accounts can connect. These two actions together enable private, controlled access without VPC peering.

Answer

Create an interface VPC endpoint in the provider VPC for the service.

Answer

Add a route in the consumer VPC route table pointing to the Network Load Balancer's private IP address.

Answer

Attach an internet gateway to the provider VPC and configure the NLB as internet-facing.

Question 12

A network engineer is designing a VPC that uses a Gateway Load Balancer to insert a third-party firewall appliance fleet into the traffic path for east-west and inbound flows. The engineer needs to ensure that the Gateway Load Balancer endpoint and target appliances function correctly. Which TWO actions are required? (Choose two.)

Accepted Answer

Create a Gateway Load Balancer endpoint in the consumer VPC and update the route tables to send traffic to that endpoint.. The two essential pieces are the Gateway Load Balancer endpoint in the consumer VPC with route table entries that steer traffic to it, and the target group that registers the appliances using GENEVE on port 6081. Together they form the transparent bump-in-the-wire path that the firewall fleet inspects.

Answer

Attach an internet gateway to the appliance VPC and assign public IP addresses to the appliance instances.

Answer

Create a Network Load Balancer in front of the appliances and point the Gateway Load Balancer endpoint to the Network Load Balancer.

Answer

Enable client IP preservation on the Gateway Load Balancer target group.

Question 13

A company runs a global web application behind Amazon Route 53. They want to route users to the closest healthy endpoint and automatically fail over if an endpoint becomes unhealthy. The endpoints are Application Load Balancers in three Regions. The network team must also ensure that users in a specific country are always routed to a designated Region for data residency, regardless of latency. Which Route 53 configuration should the team implement?

Accepted Answer

A latency-based routing policy with health checks on all three Regions and a geolocation routing policy for the specific country.. Latency-based routing with health checks sends users to the lowest-latency healthy endpoint and provides automatic failover when an endpoint is unhealthy. Adding a geolocation record for the specific country enforces data residency because Route 53 prefers a matching geolocation record over latency records for those users. This combination satisfies both proximity-based routing and residency in one hosted zone.

Answer

A failover routing policy with a primary record for the designated Region and secondary records for the other two Regions.

Answer

A multivalue answer routing policy with health checks and a geolocation record for the specific country.

Answer

A weighted routing policy with equal weights for all three Regions and a geolocation record for the specific country.

Question 14

A company wants to provide internet access to instances in a private subnet without assigning public IP addresses to those instances. The instances must be able to initiate outbound connections to the internet but must not be reachable from the internet. Which component should the network engineer configure?

Accepted Answer

A NAT gateway in a public subnet, with the private subnet route table pointing 0.0.0.0/0 to the NAT gateway.. A NAT gateway placed in a public subnet gives private instances outbound internet access by translating their source addresses, while remaining unreachable from the internet. Directing the private subnet's default route to that NAT gateway is the intended design for the stated requirement.

Answer

A virtual private gateway with a Site-to-Site VPN connection, and the private subnet route table pointing 0.0.0.0/0 to the virtual private gateway.

Answer

An internet gateway attached to the VPC, with the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

Answer

A Gateway Load Balancer endpoint in the private subnet, with the private subnet route table pointing 0.0.0.0/0 to the endpoint.

Question 15

A network engineer is deploying a new VPC and needs instances in a private subnet to reach the public AWS Systems Manager service endpoints without traversing the internet or a NAT gateway. The VPC has no internet gateway attached. The engineer creates interface VPC endpoints for ssm, ssmmessages, and ec2messages in the private subnet, but the instances still cannot register with Systems Manager. Security groups and route tables have been verified as correct, and the endpoint ENIs show an available state. Which additional configuration is required for the interface endpoints to function?

Accepted Answer

Enable Private DNS names for the interface endpoints in the VPC.. Interface endpoints for Systems Manager require Private DNS to be enabled so the SSM agent's calls to the standard service hostnames resolve to the endpoint ENIs inside the VPC. Without it, DNS still returns public addresses and the agent's traffic has no path in an internet-free VPC. Enabling Private DNS completes the private connectivity design without adding internet egress.

Answer

Add a gateway endpoint for ssm and associate it with the private subnet route table.

Answer

Attach an internet gateway to the VPC and add a route to it from the private subnet.

Answer

Create a NAT gateway in a public subnet and update the private subnet route table.