ANS-C01 Network Implementation Practice Test 5 — 15 Questions

Question 1

A company has an AWS Direct Connect connection with a private VIF to a VPC. The VPC has multiple subnets across two Availability Zones. The company wants to use the Direct Connect connection as the primary path for all traffic from on-premises to the VPC, and use a Site-to-Site VPN as a backup. The on-premises router is configured to advertise a default route via BGP over the Direct Connect, and the VPN also advertises a default route. Which configuration ensures that the Direct Connect path is preferred over the VPN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure AS_PATH prepending on the VPN BGP advertisements from the on-premises router to make the VPN path longer.. AS_PATH prepending increases the AS path length for routes advertised over the VPN, making them less preferred compared to the Direct Connect routes when both paths advertise a default route. BGP selects the path with the shortest AS_PATH length when all other attributes are equal, so prepending on the VPN ensures Direct Connect is the primary path.

Answer

Disable route propagation from the VPN in the VPC route tables to ensure Direct Connect routes take precedence.

Answer

Set a higher local preference on the Direct Connect BGP session on the on-premises router.

Answer

Decrease the Multi-Exit Discriminator (MED) value on the Direct Connect BGP advertisements from AWS.

Question 2

A company is deploying a VPC with IPv6 support. The VPC has a CIDR block of 10.0.0.0/16 and an assigned IPv6 CIDR block of 2600:1f16:xxxx:xxxx::/56. The company wants EC2 instances in a public subnet to be able to communicate with the internet using IPv6. Which configuration is necessary?

Accepted Answer

Attach an egress-only internet gateway to the VPC and add a route for ::/0 to the egress-only internet gateway in the public subnet route table.. An egress-only internet gateway (EIGW) is the AWS-managed service designed to enable outbound-only IPv6 communication from a VPC to the internet. Since IPv6 addresses are globally unique and publicly routable, a NAT gateway (used for IPv4) is not needed; instead, the EIGW allows instances to initiate outbound traffic while preventing any unsolicited inbound connections. Adding a route for ::/0 to the EIGW in the public subnet route table directs all outbound IPv6 traffic through it.

Answer

Attach a NAT gateway to the VPC and add a route for ::/0 to the NAT gateway in the public subnet route table.

Answer

Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the internet gateway in the public subnet route table.

Answer

Set up a NAT64 translation service to convert IPv6 requests to IPv4.

Question 3

A company is designing a VPC with multiple subnets. The company wants to use VPC Flow Logs to monitor network traffic. Which TWO of the following are valid destinations for VPC Flow Logs?

Accepted Answer

Amazon CloudWatch Logs. VPC Flow Logs can publish flow log records directly to Amazon CloudWatch Logs, where you can view, search, and filter log data using the CloudWatch Logs console or API. This destination is enabled by default when you create a flow log via the AWS Management Console, making it the most common integration point for monitoring and alerting on network traffic patterns.

Answer

Amazon RDS

Answer

Amazon SQS

Answer

Amazon Kinesis Data Firehose

Question 4

A company is migrating a legacy application that requires static IP addresses for its clients' firewall whitelisting. The application will be hosted on EC2 instances behind a Network Load Balancer (NLB) in a private subnet. Which approach should the company use to provide static IP addresses for outbound traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet with an Elastic IP. A NAT Gateway in a public subnet with an Elastic IP provides a static source IP address for outbound traffic from private subnets. Since the EC2 instances are in a private subnet behind an NLB, they cannot directly reach the internet; the NAT Gateway translates their private IPs to the Elastic IP, which clients can whitelist. This ensures consistent outbound IPs without exposing the instances to inbound traffic.

Answer

Assign Elastic IPs to the EC2 instances

Answer

Use an internet-facing NLB with Elastic IPs

Answer

Use a VPC endpoint for the application

Question 5

Which TWO of the following are true about using a Network Load Balancer (NLB) with AWS PrivateLink? (Choose 2.)

Accepted Answer

NLB can be assigned Elastic IPs. A Network Load Balancer (NLB) supports the assignment of Elastic IPs (EIPs) per Availability Zone, which provides a static, fixed IP address for the NLB. This is critical for AWS PrivateLink, as the service provider's VPC endpoint service uses the NLB's IP addresses to accept traffic from consumer VPCs, ensuring the endpoint remains reachable even if the underlying instances change.

Answer

NLB supports Server Name Indication (SNI)

Answer

NLB can perform TLS termination

Answer

NLB supports sticky sessions by default

Question 6

A company is setting up a Direct Connect connection to AWS. The on-premises router is configured with a BGP ASN of 64511. The AWS side uses a public ASN of 64512. Which configuration change is required for BGP peering to establish?

Accepted Answer

Change the customer ASN to a value in the 64512-65534 range.. The customer's BGP ASN 64511 is not within the private ASN range 64512-65534 required by AWS Direct Connect. Therefore, the customer must change their ASN to a value in that range to establish BGP peering.

Answer

Increase the eBGP multihop TTL to 2.

Answer

Configure the BGP peer with a public ASN on the customer side.

Answer

Enable BGP authentication with MD5 password.

Question 7

A company has a multi-account AWS Organizations setup with hundreds of VPCs across multiple regions. The network team needs to centralize outbound internet traffic through a set of inspection VPCs for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Create a Transit Gateway with a central inspection VPC that has a NAT Gateway and route all VPCs to the inspection VPC for egress.. A Transit Gateway with a central inspection VPC centralizes egress traffic through a single NAT Gateway, eliminating the need for per-VPC NAT Gateways. This architecture scales horizontally by attaching hundreds of VPCs to the Transit Gateway and routing all 0.0.0.0/0 traffic to the inspection VPC, which is cost-effective as it reduces NAT Gateway hourly charges and data processing costs across multiple regions.

Answer

Use a Network Load Balancer in each VPC to distribute traffic to inspection appliances.

Answer

Deploy a NAT Gateway in each VPC and route traffic directly to the internet.

Answer

Set up VPC peering between all VPCs and route traffic through a single VPC with an Internet Gateway.

Question 8

An application running on EC2 instances in a private subnet needs to send logs to Amazon CloudWatch Logs. Which step is essential to allow this communication without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for CloudWatch Logs and update the route table.. Amazon CloudWatch Logs supports both VPC Gateway Endpoints and VPC Interface Endpoints (PrivateLink). However, a Gateway Endpoint is more efficient as it does not require an Elastic Network Interface (ENI) and is accessed via route table entries, making it a simpler and more cost-effective solution for this scenario. Therefore, Option B is the appropriate choice.

Answer

Create a VPC Interface Endpoint for CloudWatch Logs and attach it to the subnet.

Answer

Assign a public IP to the EC2 instance and route directly to the internet.

Answer

Attach a NAT Gateway to the private subnet and route traffic to the internet.

Question 9

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise its prefixes. Recently, the on-premises router started advertising a more specific route (10.0.0.0/24) that overlaps with the VPC's CIDR (10.0.0.0/16). What is the impact on traffic destined to 10.0.0.5?

Accepted Answer

Return traffic from the instance to on-premises is routed through Direct Connect instead of staying within the VPC.. When an on-premises router advertises a more specific route (10.0.0.0/24) via BGP over a Direct Connect private VIF, the VPC propagates this route into its route tables. For traffic destined to 10.0.0.5, the VPC now has a more specific route (10.0.0.0/24) pointing to the virtual private gateway (VGW), overriding the local VPC route (10.0.0.0/16). This causes return traffic from the instance to on-premises to be routed through Direct Connect instead of staying within the VPC, as the VPC's route table prefers the longest prefix match.

Answer

The instance becomes unreachable from on-premises.

Answer

Traffic destined to the instance is blackholed.

Answer

Traffic is load-balanced between the VPC and Direct Connect.

Question 10

A company is deploying a multi-tier application across multiple VPCs connected via AWS Transit Gateway. The web tier must be able to initiate connections to the app tier, but the app tier must not be able to initiate connections to the web tier. How can this be achieved?

Accepted Answer

Deploy a centralized firewall appliance in a shared VPC and use Transit Gateway to route all inter-VPC traffic through it.. Routing all inter-VPC traffic through a centralized firewall appliance in a shared VPC via Transit Gateway allows you to enforce stateful inspection and access control policies. The firewall can be configured to permit only outbound connections from the web tier to the app tier while blocking any inbound connections initiated by the app tier, thus meeting the requirement without relying on VPC-native constructs that cannot enforce unidirectional stateful filtering across VPCs.

Answer

Configure network ACLs on the web tier subnets to allow outbound traffic and deny inbound from app tier.

Answer

Establish VPC peering between the web and app VPCs and restrict routes.

Answer

Use security groups across the VPCs by referencing each other's CIDR blocks.

Question 11

A network engineer needs to monitor network traffic in a VPC. Which TWO AWS services can capture and analyze VPC flow logs?

Accepted Answer

Amazon S3. Amazon S3 is a correct destination for VPC Flow Logs because you can publish flow log data directly to an S3 bucket, where it can be stored, queried with Amazon Athena, or processed by other analytics tools. Amazon CloudWatch Logs is also a correct destination, allowing you to publish flow logs to a log group for real-time monitoring, metric filters, and integration with CloudWatch alarms or third-party solutions via subscription filters.

Answer

Amazon GuardDuty

Answer

VPC Traffic Mirroring

Answer

AWS Config

Question 12

A company needs to connect its on-premises data center to AWS using a site-to-site VPN. The on-premises firewall does not support IPsec. What alternative solution can the company use?

Accepted Answer

Use AWS Client VPN to establish a VPN connection from the on-premises network.. AWS Client VPN is a managed, OpenVPN-based service that allows on-premises clients to securely access AWS resources without requiring IPsec support on the on-premises firewall. Since the firewall does not support IPsec, Client VPN provides an alternative by using TLS-based VPN tunnels that only require standard TCP/UDP ports (typically 443) to be open, making it compatible with nearly any firewall.

Answer

Create a VPC peering connection between the on-premises router and the VPC.

Answer

Deploy an AWS Transit Gateway and attach the on-premises network via a VPC attachment.

Answer

Use AWS Direct Connect to establish a dedicated physical link.

Question 13

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

Accepted Answer

Traffic goes through the NAT Gateway nat-67890.. When a subnet is created in a VPC without an explicit route table association, it is implicitly associated with the VPC's main route table. The main route table in this scenario includes a default route (0.0.0.0/0) pointing to NAT Gateway nat-67890, so internet-bound traffic from this subnet is directed through the NAT Gateway. This allows instances in private subnets to initiate outbound internet connections while preventing inbound traffic from the internet.

Answer

Traffic is dropped because no explicit association is set.

Answer

Traffic goes through the Internet Gateway.

Answer

Traffic is dropped because no Internet Gateway is present.

Question 14

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to add IPv6 support for its public-facing web application. The application must be accessible via both IPv4 and IPv6. The VPC already has an Internet Gateway attached. What is the correct set of steps to enable IPv6?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and allocate IPv6 addresses to the subnets.. To enable IPv6 in a VPC, you must associate an Amazon-provided IPv6 CIDR block (a /56 block by default), add a route for the IPv6 default route (::/0) to the Internet Gateway, and allocate IPv6 addresses to the subnets. The Internet Gateway already supports IPv6 traffic natively, so no additional gateway is required for public-facing IPv6 access.

Answer

Assign a custom IPv6 CIDR block from your own range to the VPC and add a route to the Internet Gateway.

Answer

Associate an IPv6 CIDR block, create an Egress-Only Internet Gateway, and route ::/0 to it.

Answer

Associate a /64 IPv6 CIDR block to the VPC, add a route for ::/0 to the Internet Gateway, and assign IPv6 addresses to instances.

Question 15

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

Accepted Answer

Establish VPC peering connections in a full mesh and manage routes centrally.. Option B is correct because VPC peering connections can be arranged in a hub-and-spoke pattern (each spoke peered to a central hub VPC) and route tables in each VPC can be managed centrally to control traffic flow, giving centralized control without a full mesh. Option D is correct because AWS Transit Gateway is purpose-built for hub-and-spoke topologies: it acts as a regional hub that attaches multiple VPCs, and a central VPC or centralized route tables on the Transit Gateway provide centralized control over inter-VPC routing. Option A is not a valid native method for connecting multiple VPCs in a hub-and-spoke topology with centralized control, since a VPN appliance does not itself provide VPC-to-VPC attachment and routing at scale. Option C is incorrect because AWS Direct Connect links on-premises networks to AWS, not VPCs to each other. Option E is incorrect because VPC Gateway Endpoints provide private access to supported AWS services (such as S3 and DynamoDB), not connectivity between VPCs.

Answer

Create a VPN connection between each VPC and a central VPN appliance.

Answer

Use Direct Connect to connect VPCs.

Answer

Use VPC Gateway Endpoints to connect VPCs.