ANS-C01 Network Implementation Practice Test 4 — 15 Questions

Question 1

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket in the same Region. Which solution provides the most secure and cost-effective connectivity?

Accepted Answer

Create a gateway endpoint for S3 in the VPC and add a route in the private subnet's route table pointing to the endpoint.. Option B is correct because a gateway endpoint for S3 is free and provides private connectivity to S3 without traversing the internet. Option A is wrong because an internet gateway would expose the instance to the internet and incur costs. Option C is wrong because a NAT gateway incurs costs and is less secure than a VPC endpoint. Option D is wrong because an interface endpoint for S3 is not available; S3 uses gateway endpoints.

Answer

Create a NAT gateway in a public subnet and add a route in the private subnet's route table pointing to the NAT gateway.

Answer

Create an interface endpoint for S3 in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 2

A company has multiple AWS accounts and wants to centrally manage network security using AWS Network Firewall. The firewall must inspect traffic between VPCs in the same Region. Which deployment model achieves this with minimal latency?

Accepted Answer

Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.. Option D is correct because an AWS Network Firewall in the transit VPC can inspect traffic between VPCs when using Transit Gateway and route tables to steer traffic through the firewall. Option A is wrong because firewall per VPC would not inspect inter-VPC traffic unless routing is configured, and it adds overhead. Option B is wrong because a firewall in each VPC is not centralized. Option C is wrong because the firewall must be in the path of traffic; simply inspecting at the egress point of each VPC would not catch all inter-VPC traffic.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC peering between VPCs.

Answer

Deploy AWS Network Firewall in a shared services VPC and use VPC peering to connect all VPCs.

Answer

Use a centralized inspection VPC with a Gateway Load Balancer and third-party appliances.

Question 3

A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?

Accepted Answer

Allow inbound traffic from the ALB's security group on the application port.. Option C is correct because a security group rule referencing the ALB's security group allows traffic only from the ALB. Option A is wrong because allowing 0.0.0.0/0 allows all traffic. Option B is wrong because allowing the VPC CIDR allows all instances in the VPC, not just the ALB. Option D is wrong because allowing the private subnet CIDR allows all instances in those subnets.

Answer

Allow inbound traffic from 0.0.0.0/0 on the application port.

Answer

Allow inbound traffic from the VPC CIDR on the application port.

Answer

Allow inbound traffic from the private subnet CIDR on the application port.

Question 4

A company has a Direct Connect connection with a public virtual interface (VIF) to access AWS public services. They want to ensure that all traffic to Amazon S3 from on-premises uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Use the public virtual interface and configure a route filter to only accept routes for the S3 service.. Option B is correct because using a public VIF with a route filter that only allows S3 prefixes ensures traffic to S3 uses Direct Connect. Option A is wrong because a private VIF is for private IP connectivity to VPCs, not public services. Option C is wrong because a VPN over Direct Connect is unnecessary and adds complexity. Option D is wrong because a Direct Connect gateway is used for private VIFs to multiple VPCs, not public VIFs.

Answer

Establish a VPN connection over the Direct Connect private VIF and route S3 traffic through the VPN.

Answer

Create a private virtual interface and attach it to the VPC.

Answer

Create a Direct Connect gateway and associate the public VIF with it.

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. The company wants to ensure that traffic to on-premises from VPC does not overlap with VPC's own CIDR. Which action should be taken?

Accepted Answer

Create a more specific route in the VPC route table for the on-premises network that is within the 10.0.0.0/8 range but not overlapping with the VPC's subnets.. Option A is correct because splitting the VPC into smaller subnets and using more specific routes can avoid overlap. Option B is wrong because NAT is used for internet access, not for route overlap. Option C is wrong because VPC CIDR cannot be changed without recreation. Option D is wrong because overlay network is not a standard solution for route overlap.

Answer

Change the VPC CIDR to a non-overlapping range such as 172.16.0.0/16.

Answer

Use a NAT gateway to translate the VPC's IP addresses to a different IP range when communicating with on-premises.

Answer

Use AWS Transit Gateway with a network overlay to encapsulate traffic.

Question 6

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Accepted Answer

AWS Site-to-Site VPN. Options A and D are correct. AWS Site-to-Site VPN and AWS Direct Connect are both valid methods. Option B is wrong because VPC peering is for VPC-to-VPC. Option C is wrong because AWS Transit Gateway is a network transit hub, not a direct connection method. Option E is wrong because VPC endpoints are for accessing AWS services.

Answer

VPC endpoints

Answer

AWS Transit Gateway

Answer

VPC peering

Question 7

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Accepted Answer

Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.. Options B, D, and E are correct. Using NAT gateways in each AZ ensures availability if one AZ fails. Spreading subnets across AZs provides redundancy. Using an Application Load Balancer distributes traffic across AZs. Option A is wrong because a single NAT gateway in one AZ is a single point of failure. Option C is wrong because a single public subnet across all AZs is not possible; subnets are per AZ.

Answer

Create a single public subnet that spans all Availability Zones.

Answer

Use a single NAT gateway in one Availability Zone to reduce cost.

Question 8

Which TWO of the following are required to establish a BGP session over a Direct Connect private virtual interface? (Choose TWO.)

Accepted Answer

A VLAN ID. Options A and C are correct. A VLAN ID is required to tag the traffic on the physical connection. BGP session with Autonomous System Numbers (ASN) is required for routing. Option B is wrong because a public IP is not used on private VIF; private IP addresses are used. Option D is wrong because a VPN connection is separate. Option E is wrong because a Direct Connect gateway is optional for connecting to multiple VPCs.

Answer

A public IP address for the BGP peer

Answer

A Direct Connect gateway

Answer

A VPN connection to the VPC

Question 9

A company is deploying an application across multiple Availability Zones in a single AWS Region. The application requires that all traffic between EC2 instances in the same subnet be inspected by a network appliance. Which configuration should be used to meet this requirement?

Accepted Answer

Create a Gateway Load Balancer and configure the appliance as a target. Option B is correct because a Gateway Load Balancer (GWLB) can be deployed in a subnet and configured to route traffic between instances in the same subnet through the network appliance. Option A is incorrect because a Transit Gateway is used for inter-VPC routing, not intra-subnet inspection. Option C is incorrect because a VPC peering connection connects different VPCs. Option D is incorrect because AWS Network Firewall inspects traffic at VPC boundaries, not within a subnet.

Answer

Set up a VPC peering connection between the subnets

Answer

Use a Transit Gateway to route traffic through the appliance

Answer

Deploy AWS Network Firewall in the subnet

Question 10

A company has multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The appliance must be deployed in a single VPC and all inter-VPC traffic must be routed through it. Which architecture should be used?

Accepted Answer

Configure the Transit Gateway with a central inspection VPC that hosts the firewall appliance. Option C is correct because a Transit Gateway with a central inspection VPC allows all inter-VPC traffic to be routed through the firewall appliance. Option A is incorrect because VPC peering does not provide central inspection. Option B is incorrect because a Network Load Balancer does not route traffic through a firewall. Option D is incorrect because AWS Network Firewall is a managed service, not a third-party appliance.

Answer

Create a Network Load Balancer in each VPC and point to the firewall

Answer

Deploy AWS Network Firewall in each VPC

Answer

Use VPC peering connections between all VPCs and route traffic through the inspection VPC

Question 11

A company has a Direct Connect connection with multiple Virtual Interfaces (VIFs) to an on-premises network. The VIFs are associated with a Direct Connect Gateway that is attached to multiple VPCs. The company is experiencing asymmetric routing and wants to ensure that traffic from on-premises to the VPCs always uses the same VIF. Which configuration should be implemented?

Accepted Answer

Configure BGP communities on the VIFs to influence route preference. Option A is correct because BGP communities can be used to influence routing decisions on the on-premises router to prefer a specific VIF. Option B is incorrect because Jumbo Frames do not affect routing. Option C is incorrect because the Local Preference attribute is set on the on-premises router, not in AWS. Option D is incorrect because AS_PATH prepending is used to make a path less preferred, not more.

Answer

Use AS_PATH prepending on the VIFs to make one path more preferred

Answer

Enable Jumbo Frames on the Direct Connect connection

Answer

Set the Local Preference attribute on the AWS side

Question 12

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses static routes. Recently, the on-premises network administrator added a new subnet (10.0.3.0/24) and needs to ensure that traffic to this subnet is routed through the VPN tunnel. What must be done in the AWS VPC to enable this connectivity?

Accepted Answer

Add a static route for 10.0.3.0/24 in the VPN connection's route table. Option C is correct because static routes for the VPN connection must be updated to include the new subnet. Option A is incorrect because route propagation is for dynamic routing. Option B is incorrect because the VPN connection itself does not need to be recreated. Option D is incorrect because the customer gateway represents the on-premises device and only needs to be updated if the device's IP or BGP ASN changes.

Answer

Update the customer gateway configuration

Answer

Enable route propagation on the VPN connection

Answer

Create a new VPN connection for the new subnet

Question 13

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to ensure that traffic can only go out to the internet and not be initiated from the internet. Which configuration should be used?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route table. Option B is correct because a NAT Gateway in a public subnet allows private instances to initiate outbound traffic to the internet while blocking inbound traffic. Option A is incorrect because an Internet Gateway allows both inbound and outbound traffic. Option C is incorrect because a VPC endpoint is for accessing AWS services, not the internet. Option D is incorrect because a VPN connection is for private connectivity to on-premises.

Answer

Attach an Internet Gateway to the private subnets

Answer

Set up a VPN connection to an on-premises network

Answer

Create a VPC endpoint for S3

Question 14

A company is migrating a legacy application to AWS. The application requires multicast communication between instances. The company needs to implement a multicast solution within a VPC. Which AWS service or feature should be used to support multicast?

Accepted Answer

Create a Transit Gateway multicast domain. Option D is correct because AWS Transit Gateway supports multicast groups. Option A is incorrect because VPC does not natively support multicast. Option B is incorrect because AWS Global Accelerator is for anycast, not multicast. Option C is incorrect because VPC peering does not support multicast.

Answer

Configure multicast in the VPC's route tables

Answer

Use AWS Global Accelerator for multicast distribution

Answer

Set up VPC peering to enable multicast between subnets

Question 15

A company needs to connect its on-premises network to a VPC using AWS Direct Connect. The company wants to use a single Direct Connect connection to connect to multiple VPCs in the same region. Which configuration should be used?

Accepted Answer

Create a Direct Connect Gateway and associate it with multiple VPCs. Option C is correct because a Direct Connect Gateway can be associated with multiple VPCs, allowing a single Direct Connect connection to connect to multiple VPCs. Option A is incorrect because a single VIF can only connect to a single VPC (unless using a Direct Connect Gateway). Option B is incorrect because Transit Gateway is for inter-VPC routing, not Direct Connect. Option D is incorrect because a VPN connection is a separate service.

Answer

Create a private VIF for each VPC

Answer

Use a VPN connection to extend the Direct Connect to other VPCs

Answer

Use a Transit Gateway to connect the Direct Connect to multiple VPCs