ANS-C01 Network Implementation Practice Test 5 — 15 Questions

Question 1

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

Accepted Answer

Associate AWS WAF with the ALB and make the ALB internet-facing. Option B is correct because AWS WAF can be integrated with an ALB to inspect HTTP/HTTPS traffic. Option A is incorrect because a Network Load Balancer does not support AWS WAF. Option C is incorrect because Security Groups are stateful firewalls but do not support WAF rules. Option D is incorrect because CloudFront can have WAF, but it is a CDN, not a regional load balancer.

Answer

Use a Network Load Balancer with AWS WAF attached

Answer

Place the ALB behind a Security Group that inspects traffic

Answer

Use Amazon CloudFront in front of the ALB with AWS WAF

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a subnet that hosts an EC2 instance with a sensitive database. The company wants to add an extra layer of encryption for traffic between the on-premises network and the EC2 instance. Which solution should be used?

Accepted Answer

Set up an IPsec VPN tunnel over the Direct Connect private VIF. Option D is correct because IPsec VPN over Direct Connect provides encryption over the private VIF. Option A is incorrect because Direct Connect traffic is not encrypted by default. Option B is incorrect because TLS is for application-level encryption, not network layer. Option C is incorrect because AWS KMS is for encryption keys, not for network encryption.

Answer

Enable TLS on the EC2 instance

Answer

Use an SSL certificate on the on-premises router

Answer

Use AWS Key Management Service (KMS) to encrypt the traffic

Question 3

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC? (Select TWO.)

Accepted Answer

AWS Direct Connect. Options A and D are correct. AWS Site-to-Site VPN and AWS Direct Connect are the primary methods for connecting on-premises networks to VPCs. Option B is incorrect because VPC peering connects VPCs, not on-premises. Option C is incorrect because an Internet Gateway is for internet access. Option E is incorrect because VPC endpoints are for accessing AWS services privately.

Answer

VPC peering connection

Answer

VPC endpoint

Answer

Internet Gateway

Question 4

Which THREE of the following are features of AWS Transit Gateway? (Select THREE.)

Accepted Answer

Multicast support. Options A, B, and D are correct. Transit Gateway supports transitive peering, multicast, and central routing. Option C is incorrect because Transit Gateway does not support edge-to-edge routing for VPN. Option E is incorrect because Transit Gateway does not replace NAT Gateway; NAT Gateway is separate.

Answer

Built-in NAT capabilities

Answer

Edge-to-edge routing for VPN connections

Question 5

A company is designing a multi-region architecture using AWS Direct Connect. Which TWO of the following are valid configurations for connecting to multiple regions? (Select TWO.)

Accepted Answer

Set up separate Direct Connect connections in each region. Options B and D are correct. A Direct Connect Gateway allows connections to multiple VPCs in different regions, and multiple Direct Connect connections can be used to different regions. Option A is incorrect because a single VIF cannot be associated with multiple regions. Option C is incorrect because a Direct Connect connection is tied to a specific AWS region. Option E is incorrect because a Transit Gateway is regional.

Answer

Use a single Direct Connect connection to connect to all regions

Answer

Use a Transit Gateway to connect to multiple regions

Answer

Use a single private VIF associated with multiple regions

Question 6

A company is deploying a multi-tier web application in a VPC with public and private subnets. The web servers in the public subnets must be able to initiate outbound connections to the internet for software updates, but must not be directly accessible from the internet. Which configuration meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet's route table.. Option D is correct because a NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while remaining unreachable from the internet. Option A is wrong because an Internet Gateway alone would allow inbound traffic. Option B is wrong because a NAT Instance in a private subnet cannot reach the internet. Option C is wrong because an ALB does not provide outbound internet access.

Answer

Deploy a NAT instance in a private subnet and add a default route to the NAT instance in the private subnet's route table.

Answer

Deploy an Application Load Balancer (ALB) in a public subnet and route outbound traffic through the ALB.

Answer

Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the public subnet's route table.

Question 7

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to the VPC. Recently, the company deployed a new VPC with CIDR 10.0.0.0/16 in a different region and established a VPC peering connection between the two VPCs. Now, traffic from on-premises to the new VPC is being routed to the old VPC instead. How should the company resolve this issue?

Accepted Answer

Update the on-premises router to advertise a more specific prefix for the new VPC over Direct Connect, such as 10.0.1.0/24, and ensure the new VPC's route table has a route to the on-premises network.. Option B is correct because the BGP advertisement of 10.0.0.0/16 over Direct Connect is more specific and takes precedence over the VPC peering route. By advertising a more specific prefix (e.g., 10.0.1.0/24) for the new VPC over Direct Connect or adjusting the route propagation, traffic can be directed correctly. Option A is wrong because deleting the peering connection would break connectivity between VPCs. Option C is wrong because VPC peering does not support transitive routing. Option D is wrong because disabling route propagation would remove all propagated routes, including the correct ones.

Answer

Delete the VPC peering connection and use a VPN instead.

Answer

Configure the VPC peering connection to propagate routes to the Direct Connect virtual interface.

Answer

Disable route propagation on the VPC route tables and add static routes.

Question 8

A company wants to provide internet access to instances in a private subnet while ensuring that traffic is logged and inspected. The solution must be highly available within a single AWS Region. Which approach should the company use?

Accepted Answer

Deploy a NAT Gateway in each Availability Zone and configure the private subnet route tables to point to the NAT Gateway in the same AZ. Use Gateway Load Balancer endpoint for traffic inspection.. Option C is correct because a NAT Gateway in each AZ is managed by AWS, provides high availability, and can be combined with a Gateway Load Balancer and third-party appliances for inspection and logging. Option A is wrong because a single NAT instance is not highly available. Option B is wrong because an Internet Gateway allows inbound traffic. Option D is wrong because VPC endpoints are for private connectivity to AWS services, not internet access.

Answer

Launch a NAT instance in a public subnet and configure it as the default route for the private subnet.

Answer

Create a VPC endpoint for the internet and attach it to the private subnet.

Answer

Attach an Internet Gateway to the VPC and add a default route to it in the private subnet's route table.

Question 9

A company has deployed an application across multiple AWS Regions using Application Load Balancers (ALBs). The company wants to route traffic to the nearest healthy endpoint using latency-based routing. Which AWS service should be used to distribute traffic across the ALBs?

Accepted Answer

Amazon Route 53 with latency routing policy.. Option A is correct because Amazon Route 53 supports latency-based routing policies to route traffic to the endpoint with the lowest latency. Option B is wrong because AWS Global Accelerator uses Anycast IPs and directs traffic to the nearest edge location, not necessarily latency-based routing. Option C is wrong because CloudFront is a CDN and not designed for routing to ALBs based on latency. Option D is wrong because Network Load Balancer is a regional service and does not route across regions.

Answer

Amazon CloudFront with multiple origins.

Answer

AWS Network Load Balancer with cross-zone load balancing.

Answer

AWS Global Accelerator.

Question 10

A company has a Direct Connect connection with a private VIF to a VPC. The company also has a Site-to-Site VPN connection to the same VPC as a backup. During a failover test, traffic from on-premises to the VPC continues to use the Direct Connect even after it is intentionally failed. The BGP timers are set to default values. What is the most likely cause?

Accepted Answer

The BGP session with the Direct Connect router is still established because the physical link is up, but the link is not forwarding traffic.. Option C is correct because even if the Direct Connect fails, the BGP session may remain established if there is still layer 2 connectivity (e.g., the physical link is up but degraded). The route will remain in the routing table until the BGP hold timer expires. Option A is wrong because longer AS path actually makes the route less preferred. Option B is wrong because the VPN route may have a longer AS path or a different prefix length. Option D is wrong because local preference is typically set to favor Direct Connect over VPN.

Answer

The Direct Connect route is more specific than the VPN route.

Answer

The VPN BGP route has a longer AS path than the Direct Connect route.

Answer

The VPN route has a lower local preference than the Direct Connect route.

Question 11

A company needs to securely connect multiple VPCs across different AWS Regions using AWS backbone network infrastructure without traversing the public internet. The solution must be managed centrally and support transitive routing between VPCs. Which service should the company use?

Accepted Answer

AWS Transit Gateway with inter-region peering.. Option D is correct because AWS Transit Gateway supports transitive routing between VPCs across regions and uses the AWS backbone. Option A is wrong because VPC peering does not support transitive routing. Option B is wrong because VPC endpoints are for service access. Option C is wrong because ClassicLink is obsolete and does not support transitive routing.

Answer

VPC peering connections in a full mesh.

Answer

AWS PrivateLink and VPC Endpoints.

Answer

AWS ClassicLink.

Question 12

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should the company implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet's route table.. Option B is correct because a VPC Gateway Endpoint for S3 allows private connectivity to S3 without internet, reducing costs. Option A is wrong because a NAT Gateway incurs costs and uses internet. Option C is wrong because a VPC Interface Endpoint for S3 is also charged per hour and per GB. Option D is wrong because an S3 bucket policy does not provide connectivity.

Answer

Create a VPC Interface Endpoint for S3 and attach it to the private subnet.

Answer

Configure an S3 bucket policy to allow access from the VPC and use an Internet Gateway.

Answer

Create a NAT Gateway in the public subnet and route traffic to the S3 bucket through it.

Question 13

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer notices that the BGP session is flapping intermittently. The connection is a 1 Gbps dedicated connection with a single private VIF. The router configuration uses default BGP timers. What is the most likely cause of the flapping?

Accepted Answer

The link experiences occasional packet loss causing BGP hold timer expiration.. Option D is correct because BGP hold timers (default 90 seconds) may cause the session to drop if the link has high latency or occasional packet loss. Increasing the hold timer can prevent flapping. Option A is wrong because jumbo frames are unrelated to BGP flapping. Option B is wrong because BGP authentication errors would cause persistent failures, not intermittent flaps. Option C is wrong because the MED attribute is used for inbound traffic engineering, not session stability.

Answer

The MTU size is set to 9001 (jumbo frames) on the Direct Connect interface.

Answer

The BGP authentication key is mismatched between the customer router and AWS.

Answer

The Multi-Exit Discriminator (MED) value is set too high on the customer router.

Question 14

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

Accepted Answer

Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.. Option A is correct because NLB preserves the source IP address by default when using TCP traffic and target group with instance targets. Option B is wrong because enabling Proxy Protocol would add a proxy header, but NLB still preserves source IP. Option C is wrong because an NLB does not use security groups. Option D is wrong because cross-zone load balancing does not affect source IP preservation.

Answer

Enable Proxy Protocol v2 on the NLB target group.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Attach a security group to the NLB that allows inbound traffic from the client IP range.

Question 15

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network advertises the prefix 10.0.0.0/8 to AWS. The VPC has a CIDR of 10.0.0.0/16. A network engineer wants to ensure that traffic from on-premises to a specific subnet 10.0.1.0/24 in the VPC is routed via a dedicated VPN connection instead of Direct Connect for testing purposes. Which TWO actions should the engineer take?

Accepted Answer

Advertise the specific prefix 10.0.1.0/24 from the VPN connection to the VPC.. Option A and Option D are correct. A more specific route (10.0.1.0/24) will be preferred over the less specific 10.0.0.0/8. Additionally, setting a lower MED on the VPN route (lower is better) can influence the path selection. Option B is wrong because disabling route propagation on the VPN would remove the VPN route. Option C is wrong because changing AS path prepend on Direct Connect would make it less preferred, but the Direct Connect may still be used. Option E is wrong because BGP communities do not apply in this context.

Answer

Prepend the AS path on the Direct Connect BGP advertisement.

Answer

Disable route propagation on the VPN connection's route table.

Answer

Use a BGP community to tag the Direct Connect route as no-export.