ANS-C01 Network Implementation Practice Test 7 — 15 Questions

Question 1

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application. Which THREE subnet CIDR blocks are valid within this VPC?

Accepted Answer

10.0.1.0/24. Options A (10.0.1.0/24), B (10.0.3.0/24), and C (10.0.5.0/24) are all valid because each falls entirely within the VPC CIDR 10.0.0.0/16, which spans 10.0.0.0 through 10.0.255.255; a /24 subnet occupies the last octet, so 10.0.1.0/24, 10.0.3.0/24, and 10.0.5.0/24 are each fully contained in that range. Option D (10.1.0.0/24) is invalid because 10.1.0.0 lies outside 10.0.0.0/16 (the second octet must be 0), and option E (10.0.0.0/8) is invalid because it is larger than the VPC CIDR and would encompass addresses beyond the VPC's range, so it cannot be a subnet of this VPC.

Answer

10.1.0.0/24

Answer

10.0.0.0/8

Question 2

A company is setting up a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE configuration items should be checked?

Accepted Answer

Route tables in the VPC and on-premises router.. Option A is correct because a Site-to-Site VPN requires matching routes on both sides: the VPC route table must have a route to the on-premises CIDR pointing to the virtual private gateway (or transit gateway), and the on-premises router must route AWS CIDRs back through the tunnel, otherwise traffic is dropped for lack of a return path. Option B is correct because security group rules on the EC2 instances are stateful filters that must allow the on-premises source CIDR on the relevant ports; if inbound rules don't permit that traffic, packets are silently dropped even though the tunnel is up. Option D is correct because network ACLs are stateless subnet-level filters, so both inbound and outbound rules (including ephemeral ports 1024-65535) must explicitly allow the on-premises CIDRs in both directions or traffic is blocked. Option C is not relevant because a NAT gateway only provides outbound internet access for private subnets and is not involved in VPN traffic over a virtual private gateway. Option E is not relevant because an internet gateway is used for public internet connectivity, not for Site-to-Site VPN traffic, which traverses the virtual private gateway or transit gateway.

Answer

NAT gateway configuration in the VPC.

Answer

Internet gateway attachment to the VPC.

Question 3

A network engineer is assigned an IAM policy to manage VPC resources. The engineer attempts to create a VPC with CIDR 10.0.0.0/16 and fails. What is the reason?

Accepted Answer

The Deny statement overrides the Allow statement for the specific CIDR.. The IAM policy includes an explicit Deny statement that denies the CreateVpc action when the CIDR block equals 10.0.0.0/16. Since explicit Deny statements override any Allow statements, the engineer's attempt to create a VPC with that specific CIDR fails regardless of any Allow permissions. This is a fundamental IAM evaluation logic rule: an explicit Deny always takes precedence over an Allow.

Answer

The resource ARN in the Deny statement does not match the VPC being created.

Answer

The condition in the Deny statement is not evaluated correctly.

Answer

The first statement allows only specific actions, not CreateVpc.

Question 4

An organization needs to securely connect its on-premises data center to multiple VPCs in different AWS Regions. The on-premises network uses BGP. Which AWS service should be used to simplify routing and provide a single point of attachment for the on-premises router?

Accepted Answer

AWS Transit Gateway with inter-Region peering attachments.. AWS Transit Gateway with inter-Region peering attachments is the correct choice because it provides a single point of attachment for the on-premises router, simplifying routing and connectivity to multiple VPCs across different AWS Regions. The Transit Gateway supports BGP over VPN connections or Direct Connect, allowing the on-premises network to peer with a single Transit Gateway, which then centrally manages inter-VPC and inter-Region traffic through peering attachments, eliminating the need for multiple separate connections.

Answer

Direct Connect gateway with a private VIF.

Answer

VPC Peering connections between each VPC and the on-premises network.

Answer

AWS Client VPN endpoint.

Question 5

A company has a VPC (10.0.0.0/16) with two subnets: public (10.0.1.0/24) and private (10.0.2.0/24). They have an Application Load Balancer (ALB) in the public subnet that distributes traffic to EC2 instances in the private subnet. The ALB is internet-facing and has a security group that allows inbound HTTP/S from 0.0.0.0/0. The EC2 instances have a security group that allows inbound HTTP from the ALB's security group. Users report that they can access the application, but the application is slow and sometimes times out. The network engineer checks CloudWatch metrics and sees that the ALB's target response time is high. The engineer suspects that the EC2 instances are overwhelmed. Which action should the engineer take to improve performance?

Accepted Answer

Add EC2 instances in another Availability Zone and register them with the ALB.. The high target response time indicates that the EC2 instances are overwhelmed. Adding more instances in another Availability Zone and registering them with the ALB will distribute the load and improve performance. This is a horizontal scaling approach, which is more effective than vertical scaling for handling increased traffic and provides high availability.

Answer

Add a NAT gateway in the public subnet to reduce latency.

Answer

Replace the ALB with a Network Load Balancer to reduce overhead.

Answer

Increase the size of the EC2 instances in the private subnet.

Question 6

A company is setting up AWS Direct Connect with a 1 Gbps dedicated connection. They want redundant connectivity with automatic failover. What is the most cost-effective way to achieve this?

Accepted Answer

Provision a second Direct Connect connection at a different location and configure BGP.. Achieving true redundancy with automatic failover for AWS Direct Connect requires physically diverse connections. A second Direct Connect connection at a different location, combined with BGP routing (e.g., using AS_PATH prepending or MED for traffic engineering), ensures that traffic automatically fails over if one connection goes down. While a VPN over the internet (option D) might seem cost-effective, it introduces variable latency, potential bandwidth constraints, and additional data transfer costs, making it less suitable for consistent performance and automatic failover in a dedicated connectivity context. Therefore, provisioning a second Direct Connect connection is the most cost-effective approach that meets the requirements.

Answer

Use a single connection with multiple VLANs.

Answer

Use a single connection with a VPN over the same connection for redundancy.

Answer

Provision a single Direct Connect connection and use a VPN over the internet as backup.

Question 7

A company is deploying a web application across multiple Availability Zones in a VPC. The application needs to be highly available and scale based on traffic. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The company wants to ensure that if an Availability Zone fails, the ALB can still route traffic to healthy instances in other zones. What should the network engineer implement to meet this requirement?

Accepted Answer

Enable cross-zone load balancing on the ALB.. Enabling cross-zone load balancing on an Application Load Balancer (ALB) allows it to distribute incoming traffic evenly across all registered targets in all enabled Availability Zones. If an entire Availability Zone fails, the ALB automatically routes traffic only to healthy instances in the remaining zones, ensuring high availability without requiring manual intervention or additional components.

Answer

Configure a Network Load Balancer instead of an ALB, and enable cross-zone load balancing.

Answer

Use an ALB with a target group that contains instances from only one Availability Zone, and use Route 53 health checks.

Answer

Deploy one ALB in each Availability Zone and use Route 53 latency-based routing.

Question 8

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC. Which action should they take?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. Amazon VPC supports IPv6 through an Amazon-provided IPv6 CIDR block that is automatically allocated from Amazon's pool of global unicast addresses. You cannot bring your own IPv6 CIDR or manually assign one; the only supported method is to associate an Amazon-provided /56 IPv6 CIDR block with the VPC. This enables dual-stack networking, allowing resources to communicate over both IPv4 and IPv6.

Answer

Request an IPv6 CIDR block from your regional internet registry and associate it with the VPC.

Answer

Enable IPv6 on the subnets directly without associating a VPC CIDR.

Answer

Manually assign a /56 IPv6 CIDR block to the VPC.

Question 9

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet to download software updates. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the EC2 instance cannot access the internet. The network engineer verifies that the NAT gateway has an Elastic IP, the security group for the EC2 instance allows outbound HTTPS traffic, and the network ACL for the private subnet allows inbound and outbound ephemeral ports. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a route to an internet gateway.. The NAT gateway resides in the public subnet, which must have a route table with a default route (0.0.0.0/0) pointing to an internet gateway (IGW) for the NAT gateway to forward traffic to the internet. Without this route, the NAT gateway cannot reach the IGW, so traffic from the private subnet EC2 instance fails even though the private subnet route is correctly configured. The security group and network ACL settings are irrelevant if the NAT gateway itself lacks internet connectivity.

Answer

The security group attached to the NAT gateway does not allow outbound traffic.

Answer

The route table for the private subnet does not have a route to the NAT gateway.

Answer

The NAT gateway does not support UDP traffic.

Question 10

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via VPN. The on-premises network advertises a route for 10.0.0.0/8. One VPC has a CIDR of 10.0.1.0/24. How does Transit Gateway handle the overlapping route?

Accepted Answer

The Transit Gateway uses the longest prefix match; the VPC route 10.0.1.0/24 is more specific.. AWS Transit Gateway uses the longest prefix match (LPM) rule to select the most specific route when multiple routes overlap. In this case, the on-premises network advertises 10.0.0.0/8 via BGP, while the VPC has a directly attached CIDR of 10.0.1.0/24. Since /24 is more specific than /8, traffic destined for 10.0.1.0/24 is routed to the VPC, not the on-premises network.

Answer

The Transit Gateway prefers the on-premises route because it is learned via BGP.

Answer

The Transit Gateway drops traffic to 10.0.1.0/24 due to conflict.

Answer

The Transit Gateway summarises the on-premises route to 10.0.0.0/16.

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should a network engineer implement?

Accepted Answer

Create a VPC gateway endpoint for S3 and add a route to the S3 prefix list via the endpoint.. A VPC gateway endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the S3 prefix list via the gateway endpoint, traffic destined for S3 is directed through the endpoint, which uses AWS's private backbone. This solution is cost-effective and does not require a NAT gateway or internet gateway.

Answer

Create a VPC interface endpoint for S3 and attach it to the private subnet.

Answer

Deploy an S3 VPN endpoint in the VPC.

Answer

Set up a NAT gateway in the public subnet and add a route to the S3 prefix list via the NAT gateway.

Question 12

Which TWO of the following are valid methods to connect an on-premises network to an Amazon VPC over a private, dedicated connection? (Select TWO.)

Accepted Answer

AWS Direct Connect Gateway. AWS Direct Connect Gateway allows you to connect an on-premises network to multiple VPCs in different AWS regions over a single private, dedicated connection. AWS Direct Connect provides a dedicated private network link from your on-premises data center to AWS, bypassing the public internet for lower latency and increased security.

Answer

AWS Client VPN

Answer

VPC Peering

Answer

AWS VPN CloudHub

Question 13

A company has deployed a Network Load Balancer (NLB) in a VPC. The NLB is configured with a target group that points to EC2 instances in the same VPC. The network engineer notices that traffic from clients is not being forwarded to the targets. The NLB's security groups and network ACLs allow all traffic. What is the most likely cause?

Accepted Answer

The EC2 instances are missing a route back to the NLB's subnet.. When an NLB forwards traffic to targets, the targets must send response traffic back to the clients. If the EC2 instances lack a route to the NLB's subnet (or the client's IP via the NLB), the return traffic will be dropped, causing the connection to fail. Since the NLB operates at layer 4 and preserves the client IP, the targets need a route back to the client, often via the NLB's private IP or the VPC's default gateway, depending on the architecture.

Answer

The security group attached to the NLB is blocking traffic.

Answer

The NLB health checks are failing, causing targets to be marked unhealthy.

Answer

Cross-zone load balancing is disabled on the NLB.

Question 14

A company has a Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to ensure that traffic always uses the Direct Connect connection when it is available, and only fails over to the VPN if Direct Connect goes down. How should they configure routing?

Accepted Answer

Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN.. BGP selects the most specific prefix (longest prefix match) first, regardless of other attributes. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over VPN, traffic will always prefer the Direct Connect path when it is available. If Direct Connect fails, the more specific prefix is withdrawn, and traffic automatically falls back to the VPN using the less specific prefix.

Answer

Use static routes pointing to the Direct Connect virtual interface with a lower metric than the VPN route.

Answer

Advertise the same prefix over both connections but with a lower AS path length over Direct Connect.

Answer

Advertise the same prefix over both connections but set a higher weight on the VPN BGP session.

Question 15

A company deployed an Application Load Balancer (ALB) in front of a fleet of EC2 instances. Users report intermittent timeouts. The ALB's target group health checks are failing for some instances. The instances are in private subnets with a single NAT Gateway. What is the most likely cause?

Accepted Answer

The security group on the EC2 instances does not allow inbound traffic from the ALB's security group.. The most likely cause is that the security group on the EC2 instances does not allow inbound traffic from the ALB's security group. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health checks will fail, causing intermittent timeouts as the ALB stops routing traffic to unhealthy targets.

Answer

The route tables in the private subnets do not have a default route pointing to the NAT Gateway.

Answer

The EC2 instances are of an unsupported instance type for ALB target groups.

Answer

The NAT Gateway is in a single Availability Zone, causing traffic to fail during an AZ outage.