ANS-C01 Network Implementation Practice Test 4 — 15 Questions

Question 1

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. The company has two Direct Connect connections from different providers and a site-to-site VPN as a backup. The company wants to ensure that traffic is always routed through the Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail. Which BGP configuration should be used on the customer gateway device (CGW) to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a lower BGP Local Preference value for routes received from the VPN connection.. BGP Local Preference is a well-known mandatory attribute used to influence outbound traffic from the AS. By setting a lower Local Preference value for routes received from the VPN connection, the customer gateway device (CGW) will prefer routes learned via Direct Connect (which have a default or higher Local Preference) over those learned via VPN. This ensures traffic is routed through Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail.

Answer

Apply a BGP community tag to routes received over the VPN to signal less preference.

Answer

Set a higher BGP Multi-Exit Discriminator (MED) value for routes advertised over the VPN.

Answer

Prepend AS_PATH on routes advertised over the Direct Connect connections.

Question 2

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) and AWS Global Accelerator. Which TWO configurations are required to route traffic to the correct regional endpoint based on the client's location?

Accepted Answer

Define endpoint groups in Global Accelerator for each region.. Endpoint groups in AWS Global Accelerator define the regional endpoints (such as ALBs) and allow you to control traffic routing based on the client's source location. Global Accelerator uses the Anycast IP addresses and the AWS global network to direct traffic to the nearest endpoint group, providing performance-based routing without relying on DNS.

Answer

Enable AWS Shield Advanced on the ALBs.

Answer

Configure cross-region load balancing in the ALB target groups.

Answer

Configure Amazon Route 53 latency-based routing to the ALBs.

Question 3

A company is setting up AWS Transit Gateway with multiple VPC attachments and an AWS Direct Connect Gateway. The company wants to control which VPCs can communicate with each other and with the on-premises network. Which TWO actions should the company take to implement this?

Accepted Answer

Associate the Direct Connect Gateway with the Transit Gateway.. To route traffic from on-premises networks through AWS Direct Connect to VPCs attached to a Transit Gateway, the Direct Connect Gateway must be associated with the Transit Gateway. This association creates a dedicated attachment that enables the Transit Gateway to exchange routes with the Direct Connect Gateway, allowing seamless connectivity between on-premises and VPC resources.

Answer

Establish VPC peering connections between VPCs that need to communicate.

Answer

Use security groups to control traffic between VPCs.

Answer

Configure Transit Gateway peering attachments for inter-region connectivity.

Question 4

A network engineer runs the above command to list VPC endpoints. The engineer notices that the second endpoint (vpce-0b2c3d4e5f6g7h8i9) does not have a policy document displayed. What does this indicate?

Accepted Answer

The endpoint has the default full-access policy.. When a VPC endpoint is created without a custom policy document, AWS automatically applies a default full-access policy that allows all principals to perform all actions on all resources through the endpoint. The AWS CLI command `describe-vpc-endpoints` omits the policy field when the default policy is in effect, because the default policy is not stored as a separate document; it is an implicit behavior of the endpoint. Therefore, the absence of a policy document in the output indicates the endpoint is using the default full-access policy, making option D correct.

Answer

The endpoint is configured to use an AWS managed policy that is not shown.

Answer

The endpoint is not active and needs to be recreated.

Answer

The endpoint is for DynamoDB, which does not support endpoint policies.

Question 5

A network engineer runs the above command and sees an ENI (eni-0a1b2c3d4e5f6g7h8) with status 'in-use' but no InstanceId attached. What AWS service is most likely using this ENI?

Accepted Answer

An Amazon RDS database instance.. An Amazon RDS database instance uses an Elastic Network Interface (ENI) as its primary network interface, and when the RDS instance is in a 'stopped' or 'failed' state, the ENI may remain in 'in-use' status without an InstanceId attached. This is because RDS manages its own ENI independently of EC2 instances, and the ENI persists even when the database instance is not running.

Answer

A VPC endpoint (Interface type).

Answer

A NAT gateway.

Answer

An AWS Transit Gateway.

Question 6

A network engineer examines the route table above. The VPC has a CIDR of 10.0.0.0/16. There is a VPC peering connection (pcx-...) to a VPC with CIDR 192.168.0.0/16. However, instances in this route table's subnet cannot communicate with the peered VPC. What is the most likely cause?

Accepted Answer

The security group or network ACL in the source subnet is blocking traffic.. The route table shown includes a route for the peered VPC (192.168.0.0/16 via pcx-...), and the route table is associated with the subnet (implied by the question stating 'this route table's subnet'). Since routing is in place, the most likely remaining cause is that a security group (stateful, blocking inbound/outbound traffic) or a network ACL (stateless, blocking inbound/outbound traffic) is filtering the traffic between the subnets. Security groups and network ACLs operate at the instance and subnet level respectively, and misconfigured rules can prevent communication even when routes are correct.

Answer

The route table is not associated with the subnet.

Answer

The VPC peering connection is in 'pending-acceptance' state.

Answer

The route to the peered VPC is missing from the route table.

Question 7

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The VPC uses a virtual private gateway (VGW). The on-premises network advertises a route to a specific subnet (10.0.0.0/24) via BGP. However, traffic from the VPC to that subnet is failing. What should the network engineer check first?

Accepted Answer

Verify that route propagation is enabled on the VPC's route tables associated with the subnets.. The most common cause of traffic failure from a VPC to an on-premises subnet over Direct Connect is that the VPC route tables do not have a route for the on-premises subnet. Even if the VGW is attached and BGP is established, the VPC subnets must have route propagation enabled on their route tables to automatically learn the routes advertised by the on-premises network via BGP. Without this, the VPC has no path to send traffic to the 10.0.0.0/24 subnet.

Answer

Verify that the customer gateway device is advertising the subnet route.

Answer

Verify that the virtual interface is in the 'available' state and BGP session is established.

Answer

Verify that the VGW is attached to the VPC.

Question 8

A company has a VPC with private subnets that use a NAT gateway for outbound internet access. The NAT gateway is in a public subnet with an Elastic IP. Users report that some applications are failing to connect to external services. Network engineers confirm that the NAT gateway is in the 'available' state and the route tables have a default route (0.0.0.0/0) pointing to the NAT gateway. What is the most likely cause?

Accepted Answer

The network ACL for the public subnet is blocking inbound traffic on ephemeral ports.. The network ACL for the public subnet is blocking inbound traffic on ephemeral ports. When a private instance initiates outbound traffic through the NAT gateway, the NAT gateway sends the traffic to the internet and expects return traffic on high-numbered ephemeral ports (1024–65535). If the public subnet's network ACL blocks inbound traffic on these ports, the return traffic cannot reach the NAT gateway, causing asymmetric routing and connection failures. The NAT gateway itself is available and the route tables are correctly configured, so the issue lies in the stateful nature of security groups versus the stateless nature of network ACLs.

Answer

The security group for the private instances is blocking outbound traffic.

Answer

The NAT gateway has reached its connection limit.

Answer

The route table for the private subnets is missing a route to the internet gateway.

Question 9

A company wants to allow an EC2 instance in a private subnet to download files from an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic to the endpoint, avoiding the need for NAT gateways or internet gateways.

Answer

Establish an AWS Direct Connect connection to the VPC.

Answer

Attach an internet gateway and route through a NAT gateway.

Answer

Create a VPC Interface Endpoint for S3.

Question 10

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to another VPC (192.168.0.0/16) using VPC peering. Both VPCs have overlapping CIDRs with some on-premises networks. What must be done to ensure proper routing?

Accepted Answer

Verify that the CIDR blocks do not overlap. If they do, you must re-IP one VPC or use other solutions like Transit Gateway with network address translation.. VPC peering requires non-overlapping CIDR blocks because AWS uses the destination CIDR to route traffic; if the CIDRs overlap, the route tables cannot distinguish between the two VPCs, causing asymmetric routing or dropped traffic. Option B correctly identifies that overlapping CIDRs must be resolved, either by re-IPing one VPC or using Transit Gateway with NAT capabilities to translate addresses and avoid conflicts.

Answer

Use AWS Transit Gateway instead and attach both VPCs.

Answer

Use a NAT gateway in one VPC to translate addresses.

Answer

Create the peering connection and add routes for the full CIDR ranges in both route tables.

Question 11

Which THREE of the following are valid considerations when designing a multi-VPC architecture using AWS Transit Gateway? (Choose three.)

Accepted Answer

You can route internet-bound traffic from multiple VPCs through a single shared VPC with a NAT gateway.. AWS Transit Gateway allows you to centralize internet-bound traffic by routing it from multiple VPCs through a single shared VPC that contains a NAT gateway. This design reduces costs and simplifies management by avoiding the need for a separate NAT gateway in each VPC, as the Transit Gateway can propagate routes to direct traffic to the shared VPC's NAT gateway for egress to the internet.

Answer

Transit Gateway does not support multicast traffic.

Answer

VPCs attached to the same Transit Gateway can have overlapping CIDR blocks.

Question 12

A company is deploying a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer (ALB), and the application tier runs on EC2 instances that connect to an RDS MySQL Multi-AZ DB instance. The application tier must be isolated from the internet and only accessible from the web tier. Which network implementation meets these requirements with the LEAST administrative overhead?

Accepted Answer

Place the web tier in a public subnet and the application tier in a private subnet, and configure security groups to allow inbound traffic to the application tier only from the web tier's security group.. Placing the web tier in a public subnet and the application tier in a private subnet, then using a security group rule that references the web tier's security group as the source, provides a stateful, application-layer firewall that allows traffic only from the web tier to the application tier. This design isolates the application tier from the internet while requiring no additional infrastructure like NAT gateways or VPC peering, minimizing administrative overhead. The security group reference automatically scales with the web tier's instances, eliminating the need to manage IP addresses.

Answer

Create two VPCs: one for the web tier with a public subnet, and one for the application tier with a private subnet, and connect them using VPC peering.

Answer

Place the web tier in a public subnet and the application tier in a private subnet with a NAT gateway for outbound access, and use security groups to allow traffic from the web tier.

Answer

Place both tiers in the same public subnet, and use a network ACL to restrict traffic from the web tier to the application tier.

Question 13

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. The company has two Direct Connect connections from different providers and a site-to-site VPN as a backup. The company wants to ensure that traffic is always routed through the Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail. Which BGP configuration should be used on the customer gateway device (CGW) to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure BGP AS_PATH prepending on the secondary Direct Connect and VPN connections to make them less preferred than the primary Direct Connect.. BGP AS_PATH prepending on the secondary Direct Connect and VPN connections artificially increases the AS path length, making those routes less preferred in the BGP best-path selection process. This ensures that the primary Direct Connect connection is chosen for traffic from on-premises to VPCs when available, with automatic failover to the secondary Direct Connect and then to the VPN as the least preferred path.

Answer

Disable route propagation from the VPN to the transit gateway route tables, and rely on the Direct Connect connections only.

Answer

Configure equal-cost multipath (ECMP) routing across all three connections to load balance traffic.

Answer

Use static routes in the transit gateway route tables with higher metric values for the secondary Direct Connect and VPN.

Question 14

A company is setting up AWS Client VPN to allow remote employees to access resources in a VPC. The VPC has a CIDR block of 10.0.0.0/16. The Client VPN endpoint is associated with a subnet 10.0.1.0/24. The company wants to assign client IP addresses from a different CIDR range than the VPC to avoid overlap. Which client CIDR range should the company specify?

Accepted Answer

172.16.0.0/12. The client CIDR range must not overlap with the VPC CIDR (10.0.0.0/16) or any on-premises networks. Both 172.16.0.0/12 (A) and 192.168.0.0/16 (D) are private RFC 1918 ranges that do not overlap, making them valid choices. Options B and C overlap with the VPC CIDR and are invalid. Note: This question accepts multiple correct answers (multi-select).

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 15

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to download patches from the internet. The company wants to minimize costs while ensuring high availability. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in a public subnet in each Availability Zone and configure route tables for private subnets to use the NAT gateway in the same AZ.. Deploying a NAT gateway in each Availability Zone ensures high availability by eliminating a single point of failure, while the private subnets in each AZ use the local NAT gateway for outbound internet access. This design meets the requirement for high availability at minimal cost compared to other resilient architectures, as NAT gateways are fully managed and scale automatically.

Answer

Create a NAT gateway in one public subnet and use a second NAT gateway in a different AZ as a backup, but only route traffic to the primary.

Answer

Create a NAT gateway in one public subnet and configure route tables for private subnets to use it.

Answer

Launch a NAT instance in one public subnet and configure route tables for private subnets to use it.