ANS-C01 Network Implementation Practice Test 7 — 15 Questions

Question 1

A network engineer is setting up a Direct Connect connection from an on-premises data center to AWS. The connection uses a private VIF to connect to a VPC via a Direct Connect gateway. The on-premises network is advertising a BGP prefix 10.0.0.0/16, which overlaps with the VPC CIDR 10.0.0.0/16. What is the expected behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The BGP session will be established, but the overlapping prefix will be ignored and not programmed into the VPC route tables.. When a BGP prefix advertised over a Direct Connect private VIF overlaps with the VPC CIDR, the BGP session establishes successfully, but AWS ignores the overlapping prefix and does not install it into the VPC route tables. This is because AWS always prefers the local VPC route over any propagated BGP route for the same prefix, preventing traffic destined for the VPC from being blackholed or misrouted to on-premises.

Answer

The VPC will automatically reassign a new CIDR to avoid the conflict.

Answer

The BGP session will fail to establish due to the prefix conflict.

Answer

The on-premises prefix will take precedence and override the VPC route.

Question 2

An organization uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to implement traffic inspection between VPCs using a third-party firewall appliance in a central VPC. The firewall must inspect traffic for all inter-VPC flows. Which architecture meets this requirement?

Accepted Answer

Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC's attachment, and enable appliance mode on the attachment.. Enabling appliance mode on a Transit Gateway attachment forces the Transit Gateway to preserve the source MAC address and use flow hash-based load balancing for traffic sent to the inspection VPC. This ensures that all inter-VPC traffic is routed through the third-party firewall appliance in the central VPC, allowing stateful inspection to work correctly. Without appliance mode, the Transit Gateway would perform MAC address rewriting, breaking the firewall's ability to track sessions.

Answer

Create VPC peering connections between all VPCs and route traffic through the central VPC.

Answer

Use a Network Load Balancer in the central VPC to distribute traffic to the firewall appliances.

Answer

Set up Direct Connect gateways and route all traffic through the on-premises network for inspection.

Question 3

A company has a VPC with an IPv6 CIDR block and wants to provide internet access to instances in a private subnet using an egress-only internet gateway. Which of the following must be configured correctly?

Accepted Answer

Add a default route (::/0) in the private subnet's route table pointing to the egress-only internet gateway.. An egress-only internet gateway (EIG) is a horizontally scaled, redundant VPC component that allows outbound-only IPv6 traffic from instances in a private subnet to the internet, while preventing unsolicited inbound connections. To use it, you must add a default route (::/0) in the private subnet's route table pointing to the EIG, which directs all outbound IPv6 traffic through the gateway. This configuration ensures that instances can initiate outbound IPv6 connections (e.g., to download updates) but cannot be reached from the internet.

Answer

Configure NAT64 on the VPC to translate IPv6 to IPv4.

Answer

Enable route propagation for the egress-only internet gateway in the route table.

Answer

Assign an IPv6 address to the egress-only internet gateway.

Question 4

A company is implementing a multi-region architecture with VPCs in us-east-1 and eu-west-1. They want to connect these VPCs using a Transit Gateway and ensure that traffic between regions can be inspected by a firewall in us-east-1. Which configuration is required?

Accepted Answer

Create a Transit Gateway in each region, peer them, and configure route tables to send inter-region traffic through the inspection VPC in us-east-1.. It uses Transit Gateway inter-region peering to connect the two regions, and by attaching an inspection VPC (with a firewall) in us-east-1 to the Transit Gateway, you can route all inter-region traffic through that VPC for inspection. The Transit Gateway route tables in each region are configured to send traffic destined for the other region to the inspection VPC attachment, ensuring traffic is inspected before being forwarded.

Answer

Establish a VPN connection between the two VPCs and route traffic through the firewall.

Answer

Create a VPC peering connection between the two VPCs and update route tables.

Answer

Use a Direct Connect gateway to connect the two VPCs directly.

Question 5

A developer wants to allow an EC2 instance in a VPC to access an Amazon S3 bucket without traversing the public internet. Which AWS service should be used?

Accepted Answer

VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows EC2 instances to access S3 buckets privately using AWS’s internal network, without traversing the public internet. Gateway endpoints are specifically designed for services like S3 and DynamoDB, using route table entries to direct traffic to the service via the AWS backbone, with no data transfer costs for traffic within the same region.

Answer

AWS PrivateLink with an interface VPC endpoint.

Answer

NAT gateway in the public subnet.

Answer

AWS Direct Connect with a public VIF.

Question 6

A company has a VPN connection between an on-premises network and AWS using two tunnels for redundancy. The BGP sessions are established, but traffic is only flowing through one tunnel. The engineer wants to ensure both tunnels are actively used. What should be configured?

Accepted Answer

Advertise the same BGP prefixes over both tunnels from the on-premises router.. When both tunnels advertise the same BGP prefixes, the AWS VPN endpoint will see equal-cost paths and load-balance traffic across both tunnels using ECMP (Equal-Cost Multi-Path) routing. This ensures active-active utilization of both tunnels, which is the standard design for AWS VPN redundancy.

Answer

Enable load balancing on the VPN connection in the AWS console.

Answer

Configure static routes for the second tunnel.

Answer

Assign different BGP ASNs to each tunnel.

Question 7

An organization is using AWS Direct Connect with a private VIF to connect to a VPC. They want to extend connectivity to multiple VPCs in the same region without creating multiple private VIFs. Which solution should they implement?

Accepted Answer

Create a Direct Connect gateway and associate it with a Transit Gateway that is attached to the VPCs.. A Direct Connect gateway allows you to associate a single private VIF with multiple VPCs in the same region by connecting to a Transit Gateway. The Transit Gateway then acts as a hub, enabling transitive routing between all attached VPCs without needing separate VIFs. This solution scales efficiently and avoids the complexity of managing multiple private VIFs.

Answer

Create VPC peering connections from the VPC with the Direct Connect VIF to the other VPCs.

Answer

Provision separate private VIFs for each VPC.

Answer

Use a Transit VIF to connect directly to a Transit Gateway.

Question 8

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a private IP only. The instance needs to download patches from the internet. Which configuration is required?

Accepted Answer

Create a NAT gateway in the public subnet and add a default route to the NAT gateway in the private subnet's route table.. A NAT gateway in the public subnet provides outbound internet access for instances in the private subnet while preventing inbound connections from the internet. By adding a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT gateway, traffic from the EC2 instance destined for the internet is forwarded to the NAT gateway, which then uses its Elastic IP to communicate with the internet. This allows the instance to download patches without requiring a public IP or direct internet gateway access.

Answer

Launch a NAT instance in the private subnet and configure source/destination check.

Answer

Create a VPC endpoint for the patch service.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnet's route table.

Question 9

A network engineer is troubleshooting connectivity issues between two VPCs connected via a Transit Gateway. The VPCs are in the same region and have proper route tables. Which TWO actions should the engineer perform to diagnose the problem?

Accepted Answer

Verify that the VPC route tables have routes pointing to the Transit Gateway attachment.. For traffic to flow from a VPC to a Transit Gateway, the VPC's route tables must include a route pointing to the Transit Gateway attachment (e.g., 10.0.0.0/16 -> tgw-xxx). Without this route, the VPC has no path to send traffic into the Transit Gateway, causing connectivity failure regardless of other configurations.

Answer

Check the security groups of the Transit Gateway.

Answer

Ping the Transit Gateway to verify its status.

Answer

Examine the network ACLs for the Transit Gateway.

Question 10

An organization is designing a hybrid network using AWS Direct Connect with a private VIF. They want to ensure high availability and failover. Which THREE components should be part of the design?

Accepted Answer

Two separate Direct Connect connections from different providers or locations.. Using two separate Direct Connect connections from different providers or locations ensures physical diversity, eliminating single points of failure. This design meets the high availability requirement by providing redundant paths for traffic, even if one connection or provider experiences an outage.

Answer

A NAT gateway in each Availability Zone.

Answer

A single Direct Connect connection with multiple VLANs.

Question 11

A company is deploying an application across multiple VPCs using AWS Transit Gateway. They need to ensure that only specific VPCs can communicate with each other. Which TWO methods can be used to isolate traffic?

Accepted Answer

Use Transit Gateway Network Manager to create a network segmentation design.. Transit Gateway Network Manager provides a centralized view and allows you to create network segmentation designs by grouping resources and defining routing policies, which helps isolate traffic between specific VPCs. Option B is correct because by creating separate Transit Gateway route tables for different groups of VPCs and associating VPC attachments accordingly, you control which VPCs can route traffic to each other, effectively isolating traffic between groups.

Answer

Configure network ACLs on the VPC subnets to allow or deny traffic.

Answer

Use security groups on the Transit Gateway attachments.

Answer

Implement VPC endpoints for inter-VPC communication.

Question 12

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?

Accepted Answer

The authorization rules allow access to the VPC's CIDR.. Authorization rules in AWS Client VPN define which networks (CIDRs) users are allowed to access. If the rule does not include the VPC's CIDR, traffic to resources in the VPC will be dropped even though the VPN tunnel is established. This is a common misconfiguration that prevents resource reachability.

Answer

The Client VPN endpoint has a public IP address.

Answer

The client certificate is issued by a valid CA.

Question 13

An engineer is reviewing VPC Flow Logs for connectivity issues between two EC2 instances (10.0.1.5 and 10.0.2.10) on TCP port 443. The first log entry shows ACCEPT, the second shows REJECT. What is the most likely cause of the REJECT?

Accepted Answer

The network ACL is blocking the traffic due to an incorrect inbound rule.. The first log entry shows ACCEPT for the outbound SYN packet, indicating the initial connection attempt succeeded. The second REJECT indicates that the return SYN-ACK packet from 10.0.2.10 to 10.0.1.5 was dropped. Since security groups are stateful and automatically allow return traffic for established connections, they cannot cause this REJECT. Network ACLs are stateless, so they require explicit inbound rules for return traffic. If the inbound rule on the NACL for the subnet of 10.0.2.10 does not allow the return traffic (e.g., using an ephemeral port range), it will be REJECTED. Therefore, option B is correct.

Answer

The destination instance has an incorrect network interface configuration.

Answer

The route table for the subnet does not have a route to the destination.

Answer

A security group rule is blocking the return traffic.

Question 14

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

Accepted Answer

Two Direct Connect connections at two different AWS Direct Connect locations. Deploying two Direct Connect connections at two different AWS Direct Connect locations provides physical and logical redundancy. This ensures that if one location experiences an outage, the other location can continue to handle traffic, meeting the high availability requirement. AWS recommends this architecture for production workloads requiring resilient hybrid connectivity.

Answer

One Direct Connect connection and one AWS Site-to-Site VPN as backup

Answer

Two virtual interfaces (VIFs) on the same Direct Connect connection

Answer

Two Direct Connect connections at the same AWS Direct Connect location

Question 15

A company is troubleshooting high latency on an AWS Direct Connect connection. The network team notices that the latency increases during peak hours. The connection uses a single virtual interface (VIF) with a 1 Gbps capacity. What is the MOST likely cause of the latency?

Accepted Answer

The bandwidth limit of the virtual interface is being exceeded. The most likely cause of increased latency during peak hours is that the bandwidth limit of the virtual interface (VIF) is being exceeded. When traffic approaches or surpasses the 1 Gbps capacity, the router's egress queue begins to fill, causing packet buffering and queuing delay. This queuing delay directly manifests as higher round-trip time (RTT) and is a classic symptom of link saturation.

Answer

The VLAN ID is mismatched between the customer router and AWS

Answer

Jumbo frames are not enabled on the customer router

Answer

BGP keepalive timers are set too high