ANS-C01 Network Implementation Practice Test 6 — 15 Questions

Question 1

A company is using AWS Direct Connect with a public virtual interface to access Amazon S3. The on-premises network has a firewall that only allows traffic to specific IP prefixes. What is the best practice to ensure connectivity while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the S3 IP prefix list from AWS to create firewall rules.. AWS publishes managed prefix lists for each service, including Amazon S3, which contain the specific IP prefixes used by S3 in each region. By using these prefix lists in firewall rules, you can allow only the necessary S3 traffic while maintaining strict security, rather than permitting the entire region's IP range. This approach aligns with the principle of least privilege and ensures connectivity over the public VIF without exposing on-premises networks to unnecessary traffic.

Answer

Allow all traffic to the AWS region's IP range.

Answer

Set up a Site-to-Site VPN tunnel over Direct Connect.

Answer

Use a private virtual interface and connect through a VPC endpoint.

Question 2

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

Accepted Answer

The instances are in different Availability Zones.. The primary cause of higher latency between EC2 instances in different Availability Zones is the physical distance and the additional network hops required to traverse the AZ boundary. Even within the same VPC, traffic between AZs must pass through AWS's regional network infrastructure, which introduces a baseline latency of 1-2 milliseconds, whereas instances in the same AZ can communicate with sub-millisecond latency. The question explicitly states the instances are in different AZs, making this the most likely source of the latency issue.

Answer

The instances are using jumbo frames.

Answer

The instances are in a cluster placement group.

Answer

The instances have Enhanced Networking enabled.

Question 3

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC with public and private subnets. The ALB is in public subnets, and the web servers are in private subnets. Clients report intermittent connection errors. Investigation shows that the ALB is marking targets as unhealthy. What is the MOST likely cause?

Accepted Answer

The health check is configured to use the public IP address of the targets, but the targets are in private subnets without public IPs.. When health checks are configured to use the public IP address of targets, the ALB attempts to reach the targets via the internet. Since the web servers are in private subnets without public IPs, the health check traffic cannot be routed to them, causing the ALB to mark them as unhealthy. Health checks must target private IP addresses within the VPC for instances in private subnets.

Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB.

Answer

The security group for the web servers does not allow inbound traffic from the internet.

Answer

The ALB is deployed in private subnets and cannot reach the internet.

Question 4

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise routes to the VPC. The company wants to extend this connectivity to a second VPC in the same region without creating additional Direct Connect connections. Which solution should be used?

Accepted Answer

Use a transit gateway and attach both VPCs and the Direct Connect private VIF.. A transit gateway allows you to centrally connect multiple VPCs and on-premises networks via a single Direct Connect private virtual interface. By attaching both VPCs and the Direct Connect private VIF to the transit gateway, the on-premises network can reach both VPCs without needing additional Direct Connect connections. This solution scales efficiently and supports transitive routing between all attached networks.

Answer

Create a second Direct Connect private VIF for the second VPC.

Answer

Set up a Site-to-Site VPN from the on-premises network to the second VPC.

Answer

Create a VPC peering connection between the two VPCs.

Question 5

A financial services company is designing a multi-region architecture for disaster recovery. They have a primary VPC in us-east-1 and a standby VPC in us-west-2. Each VPC has its own CIDR block (10.0.0.0/16 and 10.1.0.0/16). They want to use an inter-region VPC peering connection for replication traffic. Which of the following is a required step to establish this peering connection?

Accepted Answer

The owner of each VPC must accept the peering connection request.. Inter-region VPC peering connections require both VPC owners to accept the peering request. In AWS, a VPC peering connection is a one-to-one relationship between two VPCs, and the request must be accepted by the owner of the accepter VPC (in this case, the standby VPC in us-west-2) after the requester VPC (us-east-1) initiates it. This acceptance is a mandatory step for the peering connection to become active, regardless of whether the VPCs are in the same or different regions.

Answer

Ensure the VPC CIDR blocks do not overlap.

Answer

Create a VPN attachment between the two VPCs using AWS Site-to-Site VPN.

Answer

Create two separate peering connections, one for each direction of traffic.

Question 6

A company is deploying a web application across multiple Availability Zones in a VPC. The application tier consists of EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which solution meets this requirement?

Accepted Answer

Use an HTTPS listener on the ALB with a target group that uses HTTPS.. To encrypt traffic between the Application Load Balancer (ALB) and the EC2 instances, the ALB must use an HTTPS listener and the target group must be configured with the HTTPS protocol. This ensures that the ALB terminates the client’s HTTPS connection and then re-encrypts traffic to the backend instances using TLS, meeting the security team’s requirement for end-to-end encryption.

Answer

Use an internal ALB with a TCP listener and a security group that allows only HTTPS.

Answer

Use an HTTP listener on the ALB and enable encryption on the security group.

Answer

Use a TCP listener on the ALB with a target group that uses TCP.

Question 7

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the public subnet is configured as a NAT instance. The company wants to replace the NAT instance with a NAT gateway for better availability and maintenance. After creating a NAT gateway in the public subnet and updating the route table of the private subnet, traffic from the private subnet cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The NAT gateway does not have an Elastic IP address associated with it.. A NAT gateway requires an Elastic IP address to function as a gateway for outbound internet traffic. Without an Elastic IP, the NAT gateway cannot perform source network address translation (SNAT), so instances in the private subnet cannot reach the internet. This is the most likely cause given that the route table update was already performed.

Answer

The public subnet's route table still points to the NAT instance for internet traffic.

Answer

The security group attached to the NAT gateway is blocking outbound traffic.

Answer

The private subnet's route table has a route for 0.0.0.0/0 pointing to the NAT instance instead of the NAT gateway.

Question 8

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

Accepted Answer

Create an RDS Multi-AZ cluster with one writer and two reader instances in different AZs, and use the cluster endpoint for writes and reader endpoint for reads.. A Multi-AZ cluster with one writer and two reader instances provides both high availability and low latency. The cluster endpoint automatically routes write traffic to the primary instance, while the reader endpoint distributes read traffic across the reader instances in different Availability Zones, reducing latency and improving resilience. This architecture ensures that if one Availability Zone fails, the database remains available without manual intervention, meeting the critical application's requirements.

Answer

Launch a single RDS instance in a public subnet and use Route 53 latency-based routing to direct traffic.

Answer

Use a Network Load Balancer in front of the RDS instance to distribute connections across Availability Zones.

Answer

Place the RDS instance in a single Availability Zone and use a read replica in another AZ for failover.

Question 9

A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?

Accepted Answer

Route propagation and route tables in the VPC and on-premises.. The VPN tunnel being up indicates the IPsec/IKE negotiation succeeded, but reachability to the EC2 instance requires proper routing. The most common cause of ping failure when the tunnel is up is missing or incorrect route propagation from the VPN to the VPC route tables, or missing static routes on the on-premises side pointing to the VPN gateway. Without correct routes, traffic from the on-premises network cannot reach the VPC subnets, and return traffic from the EC2 instance cannot reach the on-premises network.

Answer

The VPN connection status in the AWS console.

Answer

Security group inbound rules for ICMP on the EC2 instance.

Answer

IKE version mismatch between the VPN endpoints.

Question 10

A company is setting up a new VPC with a CIDR block of 10.0.0.0/16. They need to create subnets for different tiers: public (web servers), private (application servers), and database (RDS). They want to maximize the number of available IP addresses while ensuring each subnet has at least 256 IP addresses. Which subnet design meets these requirements?

Accepted Answer

Create six /24 subnets (256 IPs each) across two Availability Zones (three per AZ).. It creates six /24 subnets (each with 256 IP addresses) across two Availability Zones, meeting the requirement of at least 256 IPs per subnet while maximizing total available IPs (1,536 IPs) and providing high availability by distributing subnets across multiple AZs. The /24 subnet mask provides exactly 256 IPs (254 usable) per subnet, which satisfies the minimum requirement without wasting address space.

Answer

Create three /25 subnets (128 IPs each) in one Availability Zone.

Answer

Create six /26 subnets (64 IPs each) across two Availability Zones.

Answer

Create three /24 subnets (256 IPs each) in one Availability Zone.

Question 11

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The Transit Gateway route table has a static route for 10.0.0.0/8 pointing to the VPN attachment. However, traffic from on-premises to the VPC is not working. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.. For traffic from on-premises to reach the VPC, the VPC's route table must have a route pointing to the Transit Gateway (TGW) attachment as the target for the on-premises CIDR (10.0.0.0/8). Without this route, the VPC subnet will not forward return traffic to the TGW, causing a one-way communication failure. The TGW route table already has a static route for 10.0.0.0/8 pointing to the VPN attachment, so the issue is on the VPC side, not the TGW.

Answer

The VPN attachment is in the wrong TGW route table.

Answer

The VPC CIDR overlaps with the on-premises CIDR.

Answer

The Transit Gateway route table does not have a route for the VPC CIDR.

Question 12

A company is designing a hybrid network using AWS Direct Connect. Which TWO of the following are required to establish a private virtual interface (VIF) to a single VPC?

Accepted Answer

A VLAN ID for the virtual interface.. Option B is correct because every private virtual interface on a Direct Connect connection must be configured with a unique 802.1Q VLAN ID that tags the traffic between the customer router and the AWS Direct Connect endpoint. Option E is correct because a private VIF requires a BGP session between the customer's router and the AWS peer to exchange routes for the VPC's private IP address range (the AWS-side ASN is 64512 and the customer supplies their own ASN). Option A is not required for a single VPC, since a Direct Connect Gateway is only needed when attaching a private VIF to multiple VPCs across regions or accounts; a single VPC can be attached directly via a virtual private gateway. Option C is wrong because the AWS side of a private VIF BGP session uses private IP addresses from the VPC's address space, not a public IP. Option D is wrong because BGP over public IPs describes a public virtual interface, which is used to reach AWS public services, not a private VIF to a VPC.

Answer

A Direct Connect Gateway to connect to the VPC.

Answer

A public IP address for the AWS side of the BGP session.

Answer

A BGP session with the AWS Direct Connect endpoint using public IPs.

Question 13

A company has a Direct Connect connection with a private virtual interface to a VPC. They want to use the same Direct Connect connection to access another VPC in the same region. Which solution should they implement?

Accepted Answer

Use a Transit Gateway and a transit virtual interface.. A Transit Gateway (TGW) allows you to attach multiple VPCs and a Direct Connect Gateway (DXGW) via a transit virtual interface (VIF). This enables a single Direct Connect connection to route traffic to multiple VPCs in the same region without additional physical connections or private VIFs. The TGW acts as a central hub, simplifying network architecture and reducing operational overhead.

Answer

Create a second private virtual interface to the second VPC.

Answer

Set up a Site-to-Site VPN over the Direct Connect connection to the second VPC.

Answer

Order a second Direct Connect connection.

Question 14

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet. The company has a NAT gateway in the public subnet. The NAT gateway has an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, the EC2 instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's Elastic IP is not allowed by the destination's firewall.. The NAT gateway's Elastic IP is a public IP address that the destination server sees as the source of the outbound traffic. If the destination's firewall (e.g., a security appliance or an internet-based service) explicitly blocks traffic from that Elastic IP, the EC2 instance will be unable to reach the internet, even though the VPC routing and NAT configuration are correct. This is a common scenario when the destination uses IP-based allowlists or blacklists.

Answer

The security group of the EC2 instance blocks outbound traffic.

Answer

The route table in the public subnet does not have a default route to the internet gateway.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 15

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Register EC2 instances in multiple Availability Zones.. Option B is correct because an ALB distributes traffic to registered targets, so registering EC2 instances across multiple Availability Zones ensures that if one AZ fails, healthy targets in other AZs continue serving requests, which is essential for high availability. Option E is correct because an internet-facing ALB is required for a public web application to receive client traffic from the internet; the ALB's nodes are provisioned across the enabled AZs, providing redundancy at the load-balancing layer. Option A is not correct because a Network Load Balancer is a Layer 4 alternative, not a requirement for high availability, and the scenario specifies an ALB. Option C is not correct because placing all EC2 instances in a single AZ creates a single point of failure. Option D is not correct because an internal ALB only routes traffic from within the VPC and would not serve an internet-facing web application.

Answer

Use a Network Load Balancer instead of an ALB.

Answer

Place the EC2 instances in a single Availability Zone.

Answer

Configure the ALB as internal.