ANS-C01 Network Implementation Practice Test 6 — 15 Questions

Question 1

A company has a VPC with an Application Load Balancer (ALB) that distributes traffic to EC2 instances in private subnets. The ALB needs to be accessible from the internet. The security team requires that all traffic to the ALB be inspected by AWS WAF. Which configuration meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate AWS WAF with the ALB and make the ALB internet-facing. AWS WAF can be directly associated with an Application Load Balancer (ALB) to inspect HTTP/HTTPS traffic before it reaches the ALB. Making the ALB internet-facing allows it to receive traffic directly from the internet while WAF provides the required traffic inspection. This combination meets both the accessibility and security requirements without additional components.

Answer

Use a Network Load Balancer with AWS WAF attached

Answer

Place the ALB behind a Security Group that inspects traffic

Answer

Use Amazon CloudFront in front of the ALB with AWS WAF

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a subnet that hosts an EC2 instance with a sensitive database. The company wants to add an extra layer of encryption for traffic between the on-premises network and the EC2 instance. Which solution should be used?

Accepted Answer

Set up an IPsec VPN tunnel over the Direct Connect private VIF. An IPsec VPN tunnel over a Direct Connect private VIF adds an extra layer of encryption to traffic between on-premises and the EC2 instance. Direct Connect private VIFs provide a private, isolated connection but do not encrypt data by default; IPsec encrypts the IP payload at Layer 3, ensuring confidentiality over the physical link. This meets the requirement for an additional encryption layer without altering the application or network stack on the EC2 instance.

Answer

Enable TLS on the EC2 instance

Answer

Use an SSL certificate on the on-premises router

Answer

Use AWS Key Management Service (KMS) to encrypt the traffic

Question 3

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC? (Select TWO.)

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and higher bandwidth. This is a valid method for connecting an on-premises network to a VPC, as it establishes a direct physical link that can be associated with a virtual interface to a VPC.

Answer

VPC peering connection

Answer

VPC endpoint

Answer

Internet Gateway

Question 4

Which THREE of the following are features of AWS Transit Gateway? (Select THREE.)

Accepted Answer

Multicast support. AWS Transit Gateway supports multicast traffic by acting as a multicast router within a VPC, enabling you to send a single stream of data to multiple receivers across different VPCs. This is achieved through the creation of a multicast domain and the association of subnets as sources or members, using IGMPv2 for group membership management.

Answer

Built-in NAT capabilities

Answer

Edge-to-edge routing for VPN connections

Question 5

A company is designing a multi-region architecture using AWS Direct Connect. Which TWO of the following are valid configurations for connecting to multiple regions? (Select TWO.)

Accepted Answer

Set up separate Direct Connect connections in each region. Each AWS Direct Connect connection is physically provisioned at a specific Direct Connect location and terminates in a single AWS region. To connect to multiple regions, you must establish separate Direct Connect connections in each target region. Option E is correct because a Direct Connect Gateway allows you to associate Virtual Private Clouds (VPCs) from different regions to a single private virtual interface (VIF), enabling inter-region connectivity over the Direct Connect connection.

Answer

Use a single Direct Connect connection to connect to all regions

Answer

Use a Transit Gateway to connect to multiple regions

Answer

Use a single private VIF associated with multiple regions

Question 6

A company wants to provide internet access to instances in a private subnet while ensuring that traffic is logged and inspected. The solution must be highly available within a single AWS Region. Which approach should the company use?

Accepted Answer

Deploy a NAT Gateway in each Availability Zone and configure the private subnet route tables to point to the NAT Gateway in the same AZ. Use Gateway Load Balancer endpoint for traffic inspection.. It combines NAT Gateways (one per AZ) for highly available outbound internet access from private subnets with a Gateway Load Balancer endpoint for traffic inspection. NAT Gateways are managed, scale automatically, and are AZ-resilient when deployed in each AZ, while the Gateway Load Balancer endpoint allows traffic to be routed through third-party inspection appliances without disrupting the NAT path. This meets the requirements for high availability within a single Region and ensures all egress traffic is logged and inspected.

Answer

Launch a NAT instance in a public subnet and configure it as the default route for the private subnet.

Answer

Create a VPC endpoint for the internet and attach it to the private subnet.

Answer

Attach an Internet Gateway to the VPC and add a default route to it in the private subnet's route table.

Question 7

A company has deployed an application across multiple AWS Regions using Application Load Balancers (ALBs). The company wants to route traffic to the nearest healthy endpoint using latency-based routing. Which AWS service should be used to distribute traffic across the ALBs?

Accepted Answer

Amazon Route 53 with latency routing policy.. Amazon Route 53 with a latency routing policy is the correct choice because it directs traffic to the ALB endpoint that provides the lowest latency for the end user, based on measured round-trip times between the user and each AWS Region. This aligns with the requirement to route traffic to the nearest healthy endpoint using latency-based routing, as Route 53 evaluates health checks on the ALBs and only considers healthy endpoints when determining the lowest latency.

Answer

Amazon CloudFront with multiple origins.

Answer

AWS Network Load Balancer with cross-zone load balancing.

Answer

AWS Global Accelerator.

Question 8

A company has a Direct Connect connection with a private VIF to a VPC. The company also has a Site-to-Site VPN connection to the same VPC as a backup. During a failover test, traffic from on-premises to the VPC continues to use the Direct Connect even after it is intentionally failed. The BGP timers are set to default values. What is the most likely cause?

Accepted Answer

The BGP session with the Direct Connect router is still established because the physical link is up, but the link is not forwarding traffic.. The Direct Connect physical link is still up, so the BGP session remains established even though the link is not forwarding traffic. With default BGP timers (keepalive 60s, hold 180s), the session does not time out, so the VPC continues to receive the Direct Connect route and prefers it over the VPN backup. A failover requires either the BGP session to go down or the route to be withdrawn, neither of which occurs when only the data plane fails.

Answer

The Direct Connect route is more specific than the VPN route.

Answer

The VPN BGP route has a longer AS path than the Direct Connect route.

Answer

The VPN route has a lower local preference than the Direct Connect route.

Question 9

A company needs to securely connect multiple VPCs across different AWS Regions using AWS backbone network infrastructure without traversing the public internet. The solution must be managed centrally and support transitive routing between VPCs. Which service should the company use?

Accepted Answer

AWS Transit Gateway with inter-region peering.. AWS Transit Gateway with inter-region peering allows you to connect VPCs across different AWS Regions using the AWS global backbone, avoiding the public internet. It provides a central hub for managing connectivity and supports transitive routing between all attached VPCs, which is not possible with VPC peering alone. This makes it the correct choice for a centrally managed, transitive, cross-region solution.

Answer

VPC peering connections in a full mesh.

Answer

AWS PrivateLink and VPC Endpoints.

Answer

AWS ClassicLink.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should the company implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach it to the private subnet's route table.. A VPC Gateway Endpoint for S3 provides private, cost-free connectivity to S3 from within a VPC without traversing the internet. It uses prefix-based routing via the route table, ensuring traffic to S3 stays within the AWS network, minimizing data transfer costs and avoiding internet egress charges.

Answer

Create a VPC Interface Endpoint for S3 and attach it to the private subnet.

Answer

Configure an S3 bucket policy to allow access from the VPC and use an Internet Gateway.

Answer

Create a NAT Gateway in the public subnet and route traffic to the S3 bucket through it.

Question 11

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer notices that the BGP session is flapping intermittently. The connection is a 1 Gbps dedicated connection with a single private VIF. The router configuration uses default BGP timers. What is the most likely cause of the flapping?

Accepted Answer

The link experiences occasional packet loss causing BGP hold timer expiration.. B is correct because the BGP hold timer (default 90 seconds) expires when the link experiences intermittent packet loss, causing the BGP session to flap. This is a common issue on Direct Connect when the underlying physical link has transient errors or congestion, leading to missed keepalive messages and session resets.

Answer

The MTU size is set to 9001 (jumbo frames) on the Direct Connect interface.

Answer

The BGP authentication key is mismatched between the customer router and AWS.

Answer

The Multi-Exit Discriminator (MED) value is set too high on the customer router.

Question 12

A company has a VPC with multiple subnets across three Availability Zones. The company wants to deploy a Network Load Balancer (NLB) to distribute TCP traffic to a fleet of EC2 instances. The NLB must preserve the source IP address of the client. Which configuration is required?

Accepted Answer

Create the NLB with a TCP listener and register the EC2 instances as targets in a target group.. Network Load Balancers (NLBs) preserve the source IP address of clients by default when using a TCP listener. No additional configuration is required to enable this behavior; the NLB forwards packets with the original source IP intact. Therefore, simply creating the NLB with a TCP listener and registering EC2 instances as targets is sufficient.

Answer

Enable Proxy Protocol v2 on the NLB target group.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Attach a security group to the NLB that allows inbound traffic from the client IP range.

Question 13

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company has two Direct Connect connections from different providers for redundancy. The company wants to use BGP to automatically fail over to the VPN if both Direct Connect connections fail. Which TWO configurations are required to achieve this?

Accepted Answer

Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.. Setting a higher local preference on Direct Connect routes makes them more preferred over VPN routes under normal conditions. Option E is correct because dynamic BGP routing on the VPN is required to allow automatic failover and route advertisement when Direct Connect fails, enabling BGP to withdraw routes and trigger failover.

Answer

Set a higher local preference on the VPN route to make it preferred over Direct Connect.

Answer

Configure the VPN connection with static routes instead of BGP.

Answer

Disable route propagation on the VPN connection's route table.

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect and a Site-to-Site VPN. The on-premises network advertises 10.0.0.0/8 over BGP. The company wants to ensure that traffic to the VPC's specific subnet 10.0.1.0/24 is routed via the VPN, while all other traffic to 10.0.0.0/8 uses Direct Connect. Which THREE actions should the network engineer take?

Accepted Answer

Set a higher BGP local preference on the VPN routes compared to Direct Connect routes for the same prefix.. Setting a higher BGP local preference on the VPN routes makes them more preferred over Direct Connect routes for the same prefix. Since the on-premises network advertises 10.0.0.0/8 over both connections, BGP local preference is the first tiebreaker; a higher value on the VPN side ensures that traffic to 10.0.1.0/24 uses the VPN as desired.

Answer

Disable route propagation on the VPN connection's route table.

Answer

Delete the VPN connection and rely solely on Direct Connect.

Question 15

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets contain NAT gateways for outbound internet access from the private subnets. The private subnets host web servers that need to make API calls to an external service over the internet. After implementation, the web servers cannot reach the internet. Which configuration is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.. A NAT gateway must be placed in a public subnet with a route to an internet gateway (IGW) to translate private IP addresses for outbound traffic. If the NAT gateway is in a private subnet, it cannot reach the IGW, so the private web servers' traffic destined for the internet (via the 0.0.0.0/0 route pointing to the NAT gateway) will fail, as the NAT gateway itself has no path to the internet.

Answer

The route table for the private subnets is not associated with the VPC's main route table.

Answer

The private subnets have a default route (0.0.0.0/0) pointing to an internet gateway instead of the NAT gateway.

Answer

The public subnets have a default route pointing to the NAT gateway instead of the internet gateway.