ANS-C01 Network Implementation Practice Test 6 — 15 Questions

Question 1

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company has two Direct Connect connections from different providers for redundancy. The company wants to use BGP to automatically fail over to the VPN if both Direct Connect connections fail. Which TWO configurations are required to achieve this?

Accepted Answer

Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.. Option B and Option E are correct. A VPN connection uses BGP to exchange routes, and adjusting BGP attributes (like local preference) can make the VPN route less preferred than Direct Connect routes. Option A is wrong because static routes do not provide dynamic failover. Option C is wrong because the VPN should be a backup, so it should have lower local preference. Option D is wrong because disabling route propagation on the VPN would remove its routes.

Answer

Set a higher local preference on the VPN route to make it preferred over Direct Connect.

Answer

Configure the VPN connection with static routes instead of BGP.

Answer

Disable route propagation on the VPN connection's route table.

Question 2

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect and a Site-to-Site VPN. The on-premises network advertises 10.0.0.0/8 over BGP. The company wants to ensure that traffic to the VPC's specific subnet 10.0.1.0/24 is routed via the VPN, while all other traffic to 10.0.0.0/8 uses Direct Connect. Which THREE actions should the network engineer take?

Accepted Answer

Set a higher BGP local preference on the VPN routes compared to Direct Connect routes for the same prefix.. Option A, Option B, and Option C are correct. A more specific prefix (10.0.1.0/24) is preferred over 10.0.0.0/8. Setting a higher local preference on the VPN route for 10.0.1.0/24 also ensures it is preferred. Additionally, using an AS path prepend on Direct Connect for the specific prefix can make it less preferred. Option D is wrong because disabling propagation on VPN would remove the route. Option E is wrong because the VPN should be used for the specific subnet, not disabled.

Answer

Disable route propagation on the VPN connection's route table.

Answer

Delete the VPN connection and rely solely on Direct Connect.

Question 3

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets contain NAT gateways for outbound internet access from the private subnets. The private subnets host web servers that need to make API calls to an external service over the internet. After implementation, the web servers cannot reach the internet. Which configuration is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet and does not have a route to the internet gateway.. Option B is correct because each NAT gateway must be in a public subnet with a route to an internet gateway. If the NAT gateway is in a private subnet, it cannot route traffic to the internet. Option A is incorrect because private subnets do not need default routes to the internet gateway. Option C is incorrect because route propagation is not required. Option D is incorrect because NAT gateway is not a required check for public subnets.

Answer

The route table for the private subnets is not associated with the VPC's main route table.

Answer

The private subnets have a default route (0.0.0.0/0) pointing to an internet gateway instead of the NAT gateway.

Answer

The public subnets have a default route pointing to the NAT gateway instead of the internet gateway.

Question 4

A network engineer is setting up a Direct Connect connection from an on-premises data center to AWS. The connection uses a private VIF to connect to a VPC via a Direct Connect gateway. The on-premises network is advertising a BGP prefix 10.0.0.0/16, which overlaps with the VPC CIDR 10.0.0.0/16. What is the expected behavior?

Accepted Answer

The BGP session will be established, but the overlapping prefix will be ignored and not programmed into the VPC route tables.. Option A is correct because AWS Direct Connect with a private VIF will not accept BGP prefixes that overlap with the VPC CIDR. Option B, C, and D are incorrect as they describe behaviors that do not occur in this scenario.

Answer

The VPC will automatically reassign a new CIDR to avoid the conflict.

Answer

The BGP session will fail to establish due to the prefix conflict.

Answer

The on-premises prefix will take precedence and override the VPC route.

Question 5

An organization uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to implement traffic inspection between VPCs using a third-party firewall appliance in a central VPC. The firewall must inspect traffic for all inter-VPC flows. Which architecture meets this requirement?

Accepted Answer

Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC's attachment, and enable appliance mode on the attachment.. Option D is correct because Transit Gateway with appliance mode (enabling asymmetric routing) and appropriate route tables can force traffic through the inspection VPC. Option A is wrong because VPC peering does not allow centralized inspection without complex routing. Option B is wrong because Network Load Balancer does not support traffic inspection. Option C is wrong because Direct Connect alone does not provide inspection.

Answer

Create VPC peering connections between all VPCs and route traffic through the central VPC.

Answer

Use a Network Load Balancer in the central VPC to distribute traffic to the firewall appliances.

Answer

Set up Direct Connect gateways and route all traffic through the on-premises network for inspection.

Question 6

A company has a VPC with an IPv6 CIDR block and wants to provide internet access to instances in a private subnet using an egress-only internet gateway. Which of the following must be configured correctly?

Accepted Answer

Add a default route (::/0) in the private subnet's route table pointing to the egress-only internet gateway.. Option C is correct because an egress-only internet gateway is used for IPv6 outbound-only internet access, and the private subnet's route table must have a default route (::/0) pointing to the egress-only internet gateway. Option A is incorrect because IPv6 addresses are not assigned to the egress-only internet gateway. Option B is incorrect because NAT64 is not required. Option D is incorrect because the egress-only internet gateway does not use route propagation.

Answer

Configure NAT64 on the VPC to translate IPv6 to IPv4.

Answer

Enable route propagation for the egress-only internet gateway in the route table.

Answer

Assign an IPv6 address to the egress-only internet gateway.

Question 7

A company is implementing a multi-region architecture with VPCs in us-east-1 and eu-west-1. They want to connect these VPCs using a Transit Gateway and ensure that traffic between regions can be inspected by a firewall in us-east-1. Which configuration is required?

Accepted Answer

Create a Transit Gateway in each region, peer them, and configure route tables to send inter-region traffic through the inspection VPC in us-east-1.. Option B is correct because Transit Gateway peering attachments between regions allow cross-region connectivity. To route traffic through the inspection VPC in us-east-1, the route tables in both regions must be configured accordingly. Option A is incorrect because VPC peering does not support transitive routing across regions. Option C is incorrect because Direct Connect gateway is not designed for inter-region VPC connectivity. Option D is incorrect because VPN connections do not inherently provide inspection capability.

Answer

Establish a VPN connection between the two VPCs and route traffic through the firewall.

Answer

Create a VPC peering connection between the two VPCs and update route tables.

Answer

Use a Direct Connect gateway to connect the two VPCs directly.

Question 8

A developer wants to allow an EC2 instance in a VPC to access an Amazon S3 bucket without traversing the public internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint for S3.. Option D is correct because a VPC Gateway Endpoint allows private access to S3 without requiring an internet gateway or NAT device. Option A is incorrect because S3 does not use an interface endpoint directly (it uses gateway endpoint). Option B is incorrect because NAT gateway provides internet access but not private access to S3. Option C is incorrect because S3 does not support Direct Connect privately without a VPC endpoint.

Answer

AWS PrivateLink with an interface VPC endpoint.

Answer

NAT gateway in the public subnet.

Answer

AWS Direct Connect with a public VIF.

Question 9

A company has a VPN connection between an on-premises network and AWS using two tunnels for redundancy. The BGP sessions are established, but traffic is only flowing through one tunnel. The engineer wants to ensure both tunnels are actively used. What should be configured?

Accepted Answer

Advertise the same BGP prefixes over both tunnels from the on-premises router.. Option D is correct because BGP supports load balancing by advertising the same prefixes from both tunnels. AWS VPN supports active/active mode if the customer gateway device is configured to advertise the same BGP routes over both tunnels. Option A is incorrect because static routes do not provide automatic failover. Option B is incorrect because different ASNs would break BGP. Option C is incorrect because the VPN connection itself does not have a load balancer.

Answer

Enable load balancing on the VPN connection in the AWS console.

Answer

Configure static routes for the second tunnel.

Answer

Assign different BGP ASNs to each tunnel.

Question 10

An organization is using AWS Direct Connect with a private VIF to connect to a VPC. They want to extend connectivity to multiple VPCs in the same region without creating multiple private VIFs. Which solution should they implement?

Accepted Answer

Create a Direct Connect gateway and associate it with a Transit Gateway that is attached to the VPCs.. Option A is correct because a Direct Connect gateway allows a single private VIF to connect to multiple VPCs via Transit Gateway or virtual private gateways. Option B is incorrect because Transit VIF is for transit gateways, but Direct Connect gateway is the key. Option C is incorrect because VPC peering does not use Direct Connect. Option D is incorrect because multiple VIFs would be needed without a Direct Connect gateway.

Answer

Create VPC peering connections from the VPC with the Direct Connect VIF to the other VPCs.

Answer

Provision separate private VIFs for each VPC.

Answer

Use a Transit VIF to connect directly to a Transit Gateway.

Question 11

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?

Accepted Answer

Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.. Option B is correct because a NAT gateway in the public subnet allows instances in private subnets to initiate outbound traffic to the internet. Option A is incorrect because an internet gateway alone does not allow private instances to access the internet. Option C is incorrect because a NAT instance requires manual configuration. Option D is incorrect because a VPC endpoint is for specific AWS services, not general internet access.

Answer

Launch a NAT instance in the private subnet and configure source/destination check.

Answer

Create a VPC endpoint for the patch service.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.

Question 12

A network engineer is troubleshooting connectivity issues between two VPCs connected via a Transit Gateway. The VPCs are in the same region and have proper route tables. Which TWO actions should the engineer perform to diagnose the problem?

Accepted Answer

Verify that the VPC route tables have routes pointing to the Transit Gateway attachment.. Option B is correct because checking route tables and association ensures traffic is directed to the Transit Gateway. Option D is correct because VPC Flow Logs can show dropped traffic. Option A is incorrect because Transit Gateway does not have a ping command. Option C is incorrect because security groups apply at the instance level, not Transit Gateway. Option E is incorrect because NACLs are stateless and less likely the issue.

Answer

Check the security groups of the Transit Gateway.

Answer

Ping the Transit Gateway to verify its status.

Answer

Examine the network ACLs for the Transit Gateway.

Question 13

An organization is designing a hybrid network using AWS Direct Connect with a private VIF. They want to ensure high availability and failover. Which THREE components should be part of the design?

Accepted Answer

Two separate Direct Connect connections from different providers or locations.. Option A is correct because redundant connections at different locations provide resilience. Option C is correct because BGP enables dynamic failover. Option E is correct because failover to a VPN is a common backup. Option B is incorrect because a single VIF is not redundant. Option D is incorrect because NAT gateway is not related to Direct Connect high availability.

Answer

A NAT gateway in each Availability Zone.

Answer

A single Direct Connect connection with multiple VLANs.

Question 14

A company is deploying an application across multiple VPCs using AWS Transit Gateway. They need to ensure that only specific VPCs can communicate with each other. Which TWO methods can be used to isolate traffic?

Accepted Answer

Use Transit Gateway Network Manager to create a network segmentation design.. Option A is correct because separate route tables can control which VPCs can communicate. Option D is correct because Transit Gateway Network Manager can create segmentation. Option B is incorrect because NACLs are per subnet, not per VPC. Option C is incorrect because security groups are instance-level. Option E is incorrect because VPC endpoints are for accessing services, not inter-VPC traffic.

Answer

Configure network ACLs on the VPC subnets to allow or deny traffic.

Answer

Use security groups on the Transit Gateway attachments.

Answer

Implement VPC endpoints for inter-VPC communication.

Question 15

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?

Accepted Answer

The authorization rules allow access to the VPC's CIDR.. Option B is correct because the subnet association determines which subnets are accessible. Option C is correct because the authorization rules control access to specific networks. Option E is correct because security groups associated with the VPC resources can block traffic. Option A is incorrect because client certificates are for authentication, not routing. Option D is incorrect because the VPN endpoint does not have a public IP; clients connect via a DNS name.

Answer

The Client VPN endpoint has a public IP address.

Answer

The client certificate is issued by a valid CA.