ANS-C01 Network Implementation Practice Test 7 — 15 Questions

Question 1

An engineer is reviewing VPC Flow Logs for connectivity issues between two EC2 instances (10.0.1.5 and 10.0.2.10) on TCP port 443. The first log entry shows ACCEPT, the second shows REJECT. What is the most likely cause of the REJECT?

Accepted Answer

A security group rule is blocking the return traffic.. Option A is correct because the REJECT indicates that the packet was dropped by a security group or NACL. Since the first packet was accepted, a stateful security group might be blocking the return traffic if the session is not tracked. Option B is incorrect because REJECT is not due to routing. Option C is incorrect because the log shows the traffic as OK. Option D is incorrect because Flow Logs do not indicate interface issues.

Answer

The destination instance has an incorrect network interface configuration.

Answer

The network ACL is blocking the traffic due to an incorrect inbound rule.

Answer

The route table for the subnet does not have a route to the destination.

Question 2

An EC2 instance with the attached IAM role is unable to download objects from an S3 bucket. The instance is in a VPC with CIDR 10.0.0.0/16. The S3 bucket policy allows access from the VPC. What is the most likely reason for the failure?

Accepted Answer

The IAM role does not have permission to list the bucket, which is required for the download operation.. Option B is correct because the condition aws:SourceIp compares the source IP of the request, but when using a VPC Gateway Endpoint, the source IP is the private IP of the instance, which is within 10.0.0.0/16, so that should work. However, the condition is problematic because the aws:SourceIp condition is not effective when the request comes through a VPC endpoint; the source IP is the endpoint's private IP, not the instance's IP. Actually, the correct answer is that the condition is not met because the source IP is the endpoint's IP, not the instance's. But wait, for Gateway Endpoint, the source IP is the instance's private IP. Let me reconsider: For Gateway Endpoints, the source IP is preserved as the instance's private IP. So the condition should be met. The issue might be that the bucket policy also needs to allow access. However, the question states the bucket policy allows access from the VPC. Possibly the IAM policy's condition is using aws:SourceIp which works, but maybe the instance is not using the endpoint? Actually, the most likely reason is that the IAM policy does not authorize the s3:ListBucket action, but the error is about download, which is GetObject. Let me think: The policy allows GetObject, but the condition requires source IP in 10.0.0.0/16. If the instance is using a Gateway Endpoint, the source IP is the instance's private IP, so it should match. However, if the S3 bucket policy denies access from outside the VPC, or if the instance does not have a route to the endpoint, it might fail. But the exhibit shows IAM policy, so the issue is likely the IAM policy itself. Option D is correct because the IAM policy lacks permission for s3:ListBucket, but that is not needed for downloading a specific object if you know the key. However, many S3 operations require ListBucket for the console or SDK. But the question says 'unable to download objects', which could be due to the condition not matching. Actually, I think the correct answer is that the aws:SourceIp condition is not effective because the traffic goes through the VPC endpoint, and the source IP seen by S3 is the endpoint's private IP, which is not the instance's IP. For Gateway Endpoints, the source IP is the instance's private IP. So that should work. Wait, there is a nuance: For Gateway Endpoints, the source IP is the instance's private IP, so the condition should work. But if the VPC endpoint is not used, the traffic goes through the internet and the source IP is the public IP, which would not match. However, the question implies the instance is in the VPC. I think the most plausible cause is that the IAM role does not have permission to access the bucket because the condition is not satisfied. But since the instance is in the VPC, its private IP is within the range. So maybe the issue is that the S3 bucket policy is not allowing the IAM role. Option A is incorrect because the bucket policy is not shown. Option C is incorrect because there is no explicit deny. Option B is the most likely: the condition does not match because the source IP is not the instance's IP when using a VPC endpoint? Actually, I recall that for Gateway Endpoints, the source IP is the instance's private IP. So the condition should work. Let me think again: The correct answer is D because the IAM policy only allows GetObject, but the SDK might first call ListObjects, which is denied. That is a common issue. So Option D.

Answer

The IAM policy does not include an Allow for the s3:GetObject action.

Answer

The condition aws:SourceIp does not match the source IP of the request because the traffic is routed through a VPC Gateway Endpoint.

Answer

The S3 bucket policy has an explicit deny for the IAM role.

Question 3

A company is deploying a hybrid network architecture with an AWS Direct Connect connection. They require high availability with redundant connections to two different AWS Direct Connect locations. Which configuration meets the high availability requirement?

Accepted Answer

Two Direct Connect connections at two different AWS Direct Connect locations. Option C is correct because using two separate Direct Connect locations provides physical diversity and redundancy. Option A is wrong because a single location is a single point of failure. Option B is wrong because two connections at the same location lack diversity. Option D is wrong because VPN over internet is not as reliable as dedicated connections.

Answer

One Direct Connect connection and one AWS Site-to-Site VPN as backup

Answer

Two virtual interfaces (VIFs) on the same Direct Connect connection

Answer

Two Direct Connect connections at the same AWS Direct Connect location

Question 4

A company is troubleshooting high latency on an AWS Direct Connect connection. The network team notices that the latency increases during peak hours. The connection uses a single virtual interface (VIF) with a 1 Gbps capacity. What is the MOST likely cause of the latency?

Accepted Answer

The bandwidth limit of the virtual interface is being exceeded. Option B is correct because traffic can be dropped if it exceeds the bandwidth limit, causing retransmissions and increased latency. Option A is wrong because jumbo frames typically reduce latency. Option C is wrong because BGP timers affect convergence, not latency. Option D is wrong because VLAN mismatch would cause connectivity loss, not just latency.

Answer

The VLAN ID is mismatched between the customer router and AWS

Answer

Jumbo frames are not enabled on the customer router

Answer

BGP keepalive timers are set too high

Question 5

A company needs to connect multiple VPCs to a common on-premises network through a single AWS Direct Connect connection. Which AWS service should be used to simplify this architecture?

Accepted Answer

AWS Transit Gateway. Option D is correct because Transit Gateway allows connecting multiple VPCs and on-premises networks via a single Direct Connect connection using a transit VIF. Option A is wrong because VPC peering is point-to-point and does not scale to many VPCs. Option B is wrong because VPN CloudHub connects VPNs, not Direct Connect. Option C is wrong because VGW is per-VPC.

Answer

AWS VPN CloudHub

Answer

VPC peering

Answer

Virtual Private Gateway (VGW)

Question 6

A company is implementing a multi-region active-active application. They want to route users to the nearest healthy endpoint using DNS. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Option C is correct because Route 53 latency-based routing routes traffic to the region with the lowest latency. Option A is wrong because Global Accelerator uses Anycast IPs and does not rely on DNS routing policy. Option B is wrong because CloudFront is for content delivery, not application routing. Option D is wrong because ELB is regional and does not perform latency-based DNS routing.

Answer

Elastic Load Balancer (ELB)

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 7

A company has a Direct Connect connection with a private VIF to a VPC. They notice that the BGP session is flapping every few minutes. The network team confirms that the customer router and AWS router are configured correctly. What is the MOST likely cause of the BGP flapping?

Accepted Answer

MTU mismatch between the customer router and the AWS Direct Connect endpoint. Option A is correct because if the maximum transmission unit (MTU) is mismatched, large packets may be dropped, causing BGP to reset. Option B is wrong because a single mismatch in ASN would prevent the session from establishing. Option C is wrong because BFD does not cause flapping; it detects failures faster. Option D is wrong because community strings are not used in BGP peering.

Answer

The BGP community string is not set correctly

Answer

Incorrect BGP ASN configuration on the virtual interface

Answer

Bidirectional Forwarding Detection (BFD) is not enabled

Question 8

A company is setting up a new VPC with both IPv4 and IPv6 support. They need to ensure that instances in a private subnet can access the Internet for software updates. Which combination of resources is required?

Accepted Answer

NAT gateway and egress-only internet gateway. Option B is correct because a NAT gateway provides IPv4 internet access, and an egress-only internet gateway provides IPv6 internet access for private instances. Option A is wrong because internet gateway is for public subnets. Option C is wrong because NAT instance is outdated and more complex. Option D is wrong because VPC endpoint is for AWS services, not internet.

Answer

VPC endpoint and internet gateway

Answer

NAT instance and internet gateway

Answer

Internet gateway and NAT gateway

Question 9

A company is deploying a web application across multiple Availability Zones in a single region. They want to distribute incoming traffic evenly across all healthy EC2 instances. Which AWS service should be used as the entry point?

Accepted Answer

Application Load Balancer (ALB). Option B is correct because an Application Load Balancer distributes traffic across targets in multiple AZs and performs health checks. Option A is wrong because NLB is for TCP/UDP, not HTTP. Option C is wrong because Route 53 with simple routing does not load balance across instances. Option D is wrong because CloudFront distributes content, not application traffic.

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53 with simple routing

Question 10

A network engineer is troubleshooting connectivity issues between an on-premises network and a VPC over a Direct Connect private VIF. The on-premises network can reach EC2 instances in the VPC, but cannot reach an RDS database in the same VPC. The VPC has a single subnet. What is the MOST likely cause?

Accepted Answer

The RDS database security group is not allowing inbound traffic from the on-premises CIDR. Option C is correct because the RDS security group likely does not allow inbound traffic from the on-premises CIDR. Option A is wrong because VPC route table would affect all traffic to the subnet. Option B is wrong if the security group is not the issue; NACLs are stateless and could be the cause but security group is more likely for RDS. Option D is wrong because Direct Connect routing is working for EC2.

Answer

The VPC network ACL is blocking inbound traffic from on-premises

Answer

The direct connect virtual interface is configured for a different VLAN

Answer

The VPC route table does not have a route to the on-premises network

Question 11

A company needs to establish a dedicated, private, high-bandwidth connection between its on-premises data center and AWS. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. Option B is correct because AWS Direct Connect provides dedicated private connectivity. Option A is wrong because VPN uses the public internet. Option C is wrong because Transit Gateway is a network hub, not a connection type. Option D is wrong because VPC peering connects VPCs, not on-premises.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering

Question 12

A company is designing a highly available network in AWS. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to use BGP as the routing protocol. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Advertise the same on-premises prefixes over both connections with different AS_PATH prepend values. Options A and B are correct because using separate BGP sessions and advertising the same prefixes with different AS_PATH prepending provides path selection and redundancy. Option C is wrong because same community values do not help with path selection. Option D is wrong because only one VIF per connection is needed. Option E is wrong because jumbo frames do not affect availability.

Answer

Use the same BGP community values for both connections

Answer

Enable jumbo frames on both connections

Answer

Configure multiple virtual interfaces on a single Direct Connect connection

Question 13

A company is deploying a new VPC with public and private subnets. The VPC will host web servers in the public subnet and database servers in the private subnet. The web servers need to access the internet for updates, and the database servers need to receive traffic only from the web servers. Which THREE components are essential for this architecture?

Accepted Answer

NAT gateway in the public subnet. Options A, C, and D are correct because an internet gateway provides internet access for public subnets, a NAT gateway provides internet access for private subnets, and security groups act as firewalls for EC2 instances. Option B is wrong because NACLs are stateless and less granular. Option E is wrong because VPC endpoint is not needed for general internet access.

Answer

Network ACL for subnets

Answer

VPC endpoint for S3

Question 14

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The network team wants to isolate traffic between VPCs while allowing all VPCs to reach the on-premises network. Which TWO configurations should be implemented?

Accepted Answer

Attach the Direct Connect virtual interface to a VPN attachment on the Transit Gateway. Options B and C are correct because Transit Gateway route tables can be used to isolate traffic, and VPN attachments can be used for segmentation. Option A is wrong because VPC peering is not needed if Transit Gateway is used. Option D is wrong because a single route table would allow all VPCs to communicate. Option E is wrong because Direct Connect gateway does not isolate traffic between VPCs.

Answer

Use a Direct Connect gateway to propagate routes to all VPCs

Answer

Use a single Transit Gateway route table for all attachments

Answer

Create VPC peering connections between each VPC

Question 15

A company needs to connect its on-premises data center to AWS using AWS Direct Connect. The company has two redundant connections and wants to use BGP as the routing protocol. Which BGP attribute should be manipulated to influence outbound traffic from AWS to the on-premises network?

Accepted Answer

Prepend AS_PATH on routes advertised to AWS.. Option C is correct because the AS_PATH prepend attribute can be used to influence outbound traffic from AWS by making one path less preferred. Option A is wrong because MED influences inbound traffic. Option B is wrong because Local Preference is used within an AS to influence outbound traffic, but it is not sent to peers. Option D is wrong because the community attribute can be used for various routing policies but not directly for outbound traffic influence in this context.

Answer

Set the Local Preference attribute on routes received from AWS.

Answer

Set the MED attribute on routes advertised to AWS.

Answer

Apply a BGP community tag to routes received from AWS.

ANS-C01 Network Implementation Practice Test 7 — 15 Questions

Exhibit

ANS-C01 Network Implementation Practice Test 7 — 15 Questions

Exhibit