ANS-C01 Network Implementation Practice Test 5 — 15 Questions

Question 1

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket in the same Region. Which solution provides the most secure and cost-effective connectivity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a gateway endpoint for S3 in the VPC and add a route in the private subnet's route table pointing to the endpoint.. A gateway endpoint for S3 uses Amazon's private network to connect the VPC to S3 without traversing the internet, providing the most secure and cost-effective solution. It avoids NAT gateway hourly charges and data processing fees, and it does not require public IPs or internet access for the private subnet EC2 instance.

Answer

Create a NAT gateway in a public subnet and add a route in the private subnet's route table pointing to the NAT gateway.

Answer

Create an interface endpoint for S3 in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 2

A company has multiple AWS accounts and wants to centrally manage network security using AWS Network Firewall. The firewall must inspect traffic between VPCs in the same Region. Which deployment model achieves this with minimal latency?

Accepted Answer

Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.. AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs route traffic through a central inspection VPC. By attaching AWS Network Firewall as a VPC attachment to the transit gateway, traffic between VPCs is routed through the firewall for inspection with minimal latency because the firewall is deployed inline within the transit gateway route table, avoiding the overhead of multiple peering connections or third-party appliances.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC peering between VPCs.

Answer

Deploy AWS Network Firewall in a shared services VPC and use VPC peering to connect all VPCs.

Answer

Use a centralized inspection VPC with a Gateway Load Balancer and third-party appliances.

Question 3

A company has a VPC with an application load balancer (ALB) in public subnets and EC2 instances in private subnets. The EC2 instances must only accept traffic from the ALB. Which security group configuration achieves this?

Accepted Answer

Allow inbound traffic from the ALB's security group on the application port.. Referencing the ALB's security group as the source in the EC2 instances' inbound rule ensures that only traffic originating from the ALB is allowed. This leverages AWS security group referencing, which dynamically resolves to the private IP addresses of the ALB's elastic network interfaces (ENIs), providing a secure and scalable solution without exposing the instances to broader network ranges.

Answer

Allow inbound traffic from 0.0.0.0/0 on the application port.

Answer

Allow inbound traffic from the VPC CIDR on the application port.

Answer

Allow inbound traffic from the private subnet CIDR on the application port.

Question 4

A company has a Direct Connect connection with a public virtual interface (VIF) to access AWS public services. They want to ensure that all traffic to Amazon S3 from on-premises uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Use the public virtual interface and configure a route filter to only accept routes for the S3 service.. A public virtual interface (VIF) provides direct connectivity to AWS public services, including Amazon S3, over the Direct Connect link. By default, the public VIF advertises a default route or specific AWS public prefixes; you must configure a route filter to accept only the S3 service prefixes (e.g., from the S3 service-specific prefix list) to ensure all S3 traffic uses the Direct Connect connection instead of the internet. This prevents any other public traffic from using the link and enforces the desired routing behavior.

Answer

Establish a VPN connection over the Direct Connect private VIF and route S3 traffic through the VPN.

Answer

Create a private virtual interface and attach it to the VPC.

Answer

Create a Direct Connect gateway and associate the public VIF with it.

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. The company wants to ensure that traffic to on-premises from VPC does not overlap with VPC's own CIDR. Which action should be taken?

Accepted Answer

Create a more specific route in the VPC route table for the on-premises network that is within the 10.0.0.0/8 range but not overlapping with the VPC's subnets.. Creating a more specific route (e.g., 10.0.0.0/8 with a longer prefix than the VPC's /16) in the VPC route table allows traffic destined for the on-premises network to be directed through the VPN, while the VPC's own /16 CIDR remains local. AWS uses the most specific route that matches the destination IP, so a route with a longer prefix (e.g., /8) will not override the local /16 route for VPC-internal traffic, preventing overlap.

Answer

Change the VPC CIDR to a non-overlapping range such as 172.16.0.0/16.

Answer

Use a NAT gateway to translate the VPC's IP addresses to a different IP range when communicating with on-premises.

Answer

Use AWS Transit Gateway with a network overlay to encapsulate traffic.

Question 6

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between a VPC and an on-premises network using IPsec. It is a fully managed, quick-to-deploy method that supports both static routes and BGP dynamic routing via the virtual private gateway.

Answer

VPC endpoints

Answer

AWS Transit Gateway

Answer

VPC peering

Question 7

Which THREE of the following are considerations when designing a VPC with multiple Availability Zones for high availability? (Choose THREE.)

Accepted Answer

Use an Application Load Balancer to distribute traffic across instances in different Availability Zones.. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets, such as EC2 instances, in different Availability Zones (AZs). By registering instances from multiple AZs with the ALB, you ensure that if one AZ becomes unavailable, the ALB can route traffic to healthy instances in another AZ, thereby maintaining high availability. This aligns with the AWS Well-Architected Framework's recommendation to deploy workloads across multiple AZs and use a load balancer to handle failover.

Answer

Create a single public subnet that spans all Availability Zones.

Answer

Use a single NAT gateway in one Availability Zone to reduce cost.

Question 8

Which TWO of the following are required to establish a BGP session over a Direct Connect private virtual interface? (Choose TWO.)

Accepted Answer

A VLAN ID. A VLAN ID is required because a Direct Connect private virtual interface operates over a single 802.1Q VLAN trunk. The VLAN ID uniquely identifies the virtual interface on the Direct Connect connection, allowing multiple virtual interfaces to share the same physical link. Without a VLAN ID, the Layer 2 encapsulation cannot be established, and the BGP session cannot form.

Answer

A public IP address for the BGP peer

Answer

A Direct Connect gateway

Answer

A VPN connection to the VPC

Question 9

A company is deploying an application across multiple Availability Zones in a single AWS Region. The application requires that all traffic between EC2 instances in the same subnet be inspected by a network appliance. Which configuration should be used to meet this requirement?

Accepted Answer

Create a Gateway Load Balancer and configure the appliance as a target. A Gateway Load Balancer (GWLB) can inspect intra-subnet traffic between EC2 instances in the same subnet. Traffic between instances in the same subnet is Layer 2 and does not traverse route tables, so traditional routing methods cannot intercept it. GWLB uses Geneve encapsulation to transparently redirect traffic at the hypervisor level to the appliance targets without modifying the route table. The appliance must be configured to handle this encapsulation. Other options do not support inspection of same-subnet traffic.

Answer

Set up a VPC peering connection between the subnets

Answer

Use a Transit Gateway to route traffic through the appliance

Answer

Deploy AWS Network Firewall in the subnet

Question 10

A company has multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The appliance must be deployed in a single VPC and all inter-VPC traffic must be routed through it. Which architecture should be used?

Accepted Answer

Configure the Transit Gateway with a central inspection VPC that hosts the firewall appliance. A Transit Gateway supports centralised inspection by attaching a dedicated inspection VPC that hosts the third‑party firewall appliance. By adjusting the Transit Gateway route tables, all inter‑VPC traffic can be forced through the inspection VPC using static routes or a default route pointing to the firewall’s elastic network interface, enabling full traffic inspection without modifying individual VPC route tables.

Answer

Create a Network Load Balancer in each VPC and point to the firewall

Answer

Deploy AWS Network Firewall in each VPC

Answer

Use VPC peering connections between all VPCs and route traffic through the inspection VPC

Question 11

A company has a Direct Connect connection with multiple Virtual Interfaces (VIFs) to an on-premises network. The VIFs are associated with a Direct Connect Gateway that is attached to multiple VPCs. The company is experiencing asymmetric routing and wants to ensure that traffic from on-premises to the VPCs always uses the same VIF. Which configuration should be implemented?

Accepted Answer

Configure BGP communities on the VIFs to influence route preference. BGP communities allow you to tag routes on the Direct Connect VIFs with specific community values (e.g., 7224:7100 for the primary VIF, 7224:7200 for the secondary VIF). AWS Direct Connect uses these community tags to influence route preference, ensuring that traffic from on-premises to the VPCs consistently uses the designated primary VIF. This mechanism provides granular control over path selection without modifying AS_PATH or local preference, directly addressing asymmetric routing.

Answer

Use AS_PATH prepending on the VIFs to make one path more preferred

Answer

Enable Jumbo Frames on the Direct Connect connection

Answer

Set the Local Preference attribute on the AWS side

Question 12

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses static routes. Recently, the on-premises network administrator added a new subnet (10.0.3.0/24) and needs to ensure that traffic to this subnet is routed through the VPN tunnel. What must be done in the AWS VPC to enable this connectivity?

Accepted Answer

Add a static route for 10.0.3.0/24 in the VPN connection's route table. For a Site-to-Site VPN connection using static routes, the on-premises network administrator must add a new static route in the VPC route table for the new subnet (10.0.3.0/24), pointing to the virtual private gateway. Option D accomplishes this by adding a static route in the VPN connection's route table. Route propagation (Option B) is only available when the VPN uses BGP dynamic routing, not static routes. Options A and C are incorrect because the customer gateway configuration does not affect VPC routing, and creating a new VPN connection is unnecessary.

Answer

Update the customer gateway configuration

Answer

Enable route propagation on the VPN connection

Answer

Create a new VPN connection for the new subnet

Question 13

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket in the same Region. Which solution provides the most secure and cost-effective connectivity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route table. A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet’s route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, which translates the private source IP to the gateway’s Elastic IP for return traffic. This meets the requirement of outbound-only internet access without exposing private instances to inbound initiation.

Answer

Attach an Internet Gateway to the private subnets

Answer

Set up a VPN connection to an on-premises network

Answer

Create a VPC endpoint for S3

Question 14

A company is migrating a legacy application to AWS. The application requires multicast communication between instances. The company needs to implement a multicast solution within a VPC. Which AWS service or feature should be used to support multicast?

Accepted Answer

Create a Transit Gateway multicast domain. AWS Transit Gateway supports multicast through the creation of a Transit Gateway multicast domain. This feature allows you to send multicast traffic from a source to multiple receivers within a VPC, which is required for legacy applications that rely on multicast communication. Transit Gateway multicast domains work with IGMP (Internet Group Management Protocol) to manage group memberships and route multicast traffic efficiently.

Answer

Configure multicast in the VPC's route tables

Answer

Use AWS Global Accelerator for multicast distribution

Answer

Set up VPC peering to enable multicast between subnets

Question 15

A company needs to connect its on-premises network to a VPC using AWS Direct Connect. The company wants to use a single Direct Connect connection to connect to multiple VPCs in the same region. Which configuration should be used?

Accepted Answer

Create a Direct Connect Gateway and associate it with multiple VPCs. A Direct Connect Gateway allows a single Direct Connect connection (via a private virtual interface) to be associated with multiple VPCs in the same region (or across regions). The Direct Connect Gateway acts as a hub, enabling transitive routing between the on-premises network and all associated VPCs without needing separate private VIFs per VPC.

Answer

Create a private VIF for each VPC

Answer

Use a VPN connection to extend the Direct Connect to other VPCs

Answer

Use a Transit Gateway to connect the Direct Connect to multiple VPCs