ANS-C01 Network Implementation Practice Test 4 — 15 Questions

Question 1

A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.. The most likely cause is that the VPC route tables lack a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Even though the VPN tunnel is UP (indicating Phase 1 and Phase 2 IPsec SAs are established), traffic from on-premises cannot reach EC2 instances if the VPC does not know how to forward return traffic back through the VGW. Without this route, the VPC drops inbound packets or sends them to the internet gateway instead of the VPN tunnel.

Answer

The pre-shared keys are mismatched.

Answer

The VPN tunnel has been idle for too long and needs to be re-initiated.

Answer

The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.

Question 2

A company runs a critical application on EC2 instances behind an Application Load Balancer. They need to ensure that if an instance fails health checks, it is automatically terminated and replaced. Which AWS service should they use?

Accepted Answer

Auto Scaling group. An Auto Scaling group (Option C) is the correct service because it automatically replaces unhealthy EC2 instances by integrating with the Application Load Balancer's health checks. When an instance fails the configured health check (e.g., HTTP 5xx or TCP timeout), the Auto Scaling group marks it as unhealthy, terminates it, and launches a new instance to maintain the desired capacity. This lifecycle management is a core feature of Auto Scaling groups, not available in the other options.

Answer

AWS Lambda

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch

Question 3

A company is designing a VPC with public and private subnets. They want EC2 instances in private subnets to be able to access the internet for software updates. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway enables EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT Gateway's Elastic IP address using source network address translation (SNAT), allowing them to reach public endpoints.

Answer

AWS Direct Connect

Answer

Internet Gateway (IGW)

Answer

VPC Peering connection

Question 4

A company has multiple VPCs that need to communicate with each other. They want to use a hub-and-spoke model with centralized network management. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (D) is the correct choice because it acts as a central hub that interconnects multiple VPCs and on-premises networks using a hub-and-spoke topology. It simplifies network management by providing a single point of connectivity and supports transitive routing between all attached VPCs, which is exactly what the company needs for centralized network management.

Answer

AWS Direct Connect

Answer

VPN CloudHub

Answer

VPC Peering

Question 5

A company is deploying a latency-sensitive application across multiple AWS Regions. They want to use the AWS global network to route traffic to the nearest edge location for fast content delivery. Which service should they use?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network to direct traffic to the nearest edge location via Anycast IP addresses, then routes it over the AWS backbone to the optimal regional endpoint. This minimizes latency and jitter for latency-sensitive applications by avoiding the public internet and providing static IP addresses for traffic management.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Question 6

A company needs to connect its on-premises data center to AWS with a dedicated, private network connection that provides consistent performance. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. This ensures consistent, low-latency performance and can reduce bandwidth costs for high-volume data transfer, making it the ideal choice for the stated requirement.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Site-to-Site VPN

Question 7

A company has a VPC with multiple subnets. They want to centrally control outbound traffic to the internet and log all traffic. Which AWS service should they use?

Accepted Answer

NAT Gateway. NAT Gateway provides centralized outbound internet access for instances in private subnets. While it does not natively log traffic, you can enable VPC Flow Logs on the VPC to capture metadata of all traffic, including that traversing the NAT Gateway. This combination meets both the control and logging requirements. Other options either fail to control traffic (VPC Traffic Mirroring only copies, VPC Flow Logs only logs) or provide control at a different level (Network ACL is stateless and subnet-level).

Answer

Network ACL

Answer

VPC Flow Logs

Answer

VPC Traffic Mirroring

Question 8

A company is running a two-tier application with a web tier and a database tier. The web tier must be accessible from the internet, but the database tier should only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web tier in public subnet, database tier in private subnet with a security group allowing only web tier.. The correct architecture places the web tier in a public subnet with an internet gateway for inbound traffic, and the database tier in a private subnet with a security group that only allows inbound traffic from the web tier's security group. This ensures the database is not directly reachable from the internet, adhering to the principle of least privilege and defense in depth. The security group acts as a stateful virtual firewall, allowing you to reference the web tier's security group as the source, which automatically adapts to any changes in the web tier's IP addresses.

Answer

Both tiers in public subnets with security groups restricting database access.

Answer

Both tiers in private subnets with a NAT Gateway for internet access.

Answer

Web tier in private subnet, database tier in public subnet with a security group.

Question 9

Which TWO of the following are valid options for implementing network segmentation in a VPC?

Accepted Answer

Security Groups. Security Groups (A) are stateful virtual firewalls that operate at the instance level (ENI), allowing you to control inbound and outbound traffic based on rules. They are a valid mechanism for network segmentation because you can assign different Security Groups to different instances or groups of instances to isolate traffic between tiers (e.g., web, app, database). Subnets (B) provide network segmentation at the VPC subnet level by dividing the VPC's IP address range into smaller segments, each associated with a specific Availability Zone and route table, enabling logical separation of resources.

Answer

Route Tables

Answer

NAT Gateway

Answer

Internet Gateway

Question 10

Which THREE of the following are valid methods to connect a VPC to an on-premises network?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is a valid method to connect a VPC to an on-premises network because it provides a dedicated, private, high-bandwidth physical connection from your on-premises data center to AWS, bypassing the public internet. This connection uses industry-standard 802.1Q VLANs to create virtual interfaces (VIFs) that directly access VPCs or AWS services, offering consistent network performance and reduced latency compared to internet-based connections.

Answer

VPC Peering

Answer

VPC Endpoint

Question 11

Which TWO of the following are characteristics of an AWS Network Load Balancer (NLB)?

Accepted Answer

Preserves the source IP address of the client. Network Load Balancers operate at Layer 4 and preserve the client source IP address by default. When a client sends a request, the NLB forwards the packet with the original source IP intact, unlike Application Load Balancers which replace it with their own IP. This is critical for applications that require client IP logging or security filtering.

Answer

Supports SSL offloading

Answer

Supports routing based on HTTP headers

Answer

Operates at Layer 7 of the OSI model

Question 12

A company is deploying a new application in a VPC with public and private subnets. The application servers in the private subnets need to access the internet to download patches. Which configuration meets this requirement without allowing inbound internet traffic?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway from the private subnets' route tables.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet (e.g., for patch downloads) while preventing unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface. This is the standard AWS pattern for outbound-only internet access from private subnets.

Answer

Attach an internet gateway to the private subnets and configure route tables accordingly.

Answer

Establish a site-to-site VPN connection to an on-premises internet gateway.

Answer

Configure a VPC endpoint for the internet in the private subnets.

Question 13

A global company wants to connect multiple VPCs across different AWS Regions using a hub-and-spoke model. The hub VPC contains shared services such as Active Directory and DNS. Which AWS service provides the most scalable and maintainable solution for this architecture?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. AWS Transit Gateway with inter-Region peering attachments is the most scalable and maintainable solution because it provides a central hub to connect multiple VPCs across different AWS Regions using a fully managed service. Inter-Region peering attachments allow transitive routing between all attached VPCs without requiring full mesh peering, and they support route propagation and centralized management of shared services like Active Directory and DNS. This architecture scales linearly as new VPCs or Regions are added, unlike VPC peering which requires individual non-transitive connections.

Answer

AWS VPN CloudHub to interconnect all VPCs.

Answer

AWS Direct Connect gateway with virtual interfaces to each VPC.

Answer

VPC peering between each spoke VPC and the hub VPC.

Question 14

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise a route for 10.0.0.0/8. The VPC CIDR is 10.1.0.0/16. The company wants to ensure that all traffic from the VPC to on-premises uses the Direct Connect connection, but if the Direct Connect fails, traffic should fail over to a VPN connection. Which configuration achieves this?

Accepted Answer

Configure a BGP local preference of 200 on the Direct Connect VIF and 100 on the VPN connection, and use the same ASN for both.. B is correct because BGP local preference is an administrative weight used to prefer one path over another within the same AS. By setting a higher local preference (200) on the Direct Connect VIF and a lower value (100) on the VPN, the on-premises router will prefer the Direct Connect path for outbound traffic. If the Direct Connect fails, the BGP session drops, and the VPN route with the lower local preference becomes active, providing failover. Using the same ASN for both connections ensures the routes are compared as equal under BGP best-path selection.

Answer

Create a static route in the VPC route table pointing to the VPN with a metric of 100, and let BGP propagate the Direct Connect route.

Answer

Set the MED attribute on the Direct Connect VIF to 100 and on the VPN to 200.

Answer

Configure AS path prepend on the Direct Connect side to advertise a longer AS path.

Question 15

A company wants to enable DNS resolution for hybrid network using Route 53 Resolver. The on-premises DNS servers are reachable via Direct Connect. The company wants to forward queries for a custom domain (example.corp) from VPC to on-premises. Which resource should be created in the VPC?

Accepted Answer

Route 53 Resolver outbound endpoint and associate a resolver rule.. To forward DNS queries from a VPC to on-premises DNS servers, you need a Route 53 Resolver outbound endpoint, which initiates outbound DNS traffic from the VPC. You then associate a resolver rule that specifies the domain (example.corp) and the target on-premises DNS server IPs, enabling conditional forwarding via Direct Connect.

Answer

A VPC endpoint for Route 53 Resolver service.

Answer

Route 53 Resolver rule that forwards example.corp to on-premises DNS servers.

Answer

Route 53 Resolver inbound endpoint.