ANS-C01 Network Implementation Practice Test 8 — 15 Questions

Question 1

A company needs to connect multiple VPCs to a common on-premises network through a single AWS Direct Connect connection. Which AWS service should be used to simplify this architecture?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks through a single Direct Connect connection. It simplifies the architecture by replacing complex mesh or star topologies with a single gateway that manages routing and attachments, reducing operational overhead and cost.

Answer

AWS VPN CloudHub

Answer

VPC peering

Answer

Virtual Private Gateway (VGW)

Question 2

A company is implementing a multi-region active-active application. They want to route users to the nearest healthy endpoint using DNS. Which AWS service should be used?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic based on the lowest network latency between the user and the endpoint, making it ideal for routing users to the nearest healthy endpoint in a multi-region active-active setup. It continuously monitors endpoint health via health checks and only routes to healthy endpoints, ensuring high availability and performance.

Answer

Elastic Load Balancer (ELB)

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. They notice that the BGP session is flapping every few minutes. The network team confirms that the customer router and AWS router are configured correctly. What is the MOST likely cause of the BGP flapping?

Accepted Answer

MTU mismatch between the customer router and the AWS Direct Connect endpoint. B is correct because an MTU mismatch between the customer router and the AWS Direct Connect endpoint can cause BGP session flapping. When the MTU is mismatched, larger BGP keepalive or update packets may be fragmented or dropped, leading to hold timer expirations and session resets. This occurs even if both routers are configured correctly for BGP, as the issue lies at the Layer 2/3 boundary rather than the BGP configuration itself.

Answer

The BGP community string is not set correctly

Answer

Incorrect BGP ASN configuration on the virtual interface

Answer

Bidirectional Forwarding Detection (BFD) is not enabled

Question 4

A company is setting up a new VPC with both IPv4 and IPv6 support. They need to ensure that instances in a private subnet can access the Internet for software updates. Which combination of resources is required?

Accepted Answer

NAT gateway and egress-only internet gateway. For IPv6 traffic, an egress-only internet gateway allows outbound-only internet access from private subnets, while a NAT gateway provides similar functionality for IPv4 traffic. Together, they enable instances in a private subnet to initiate outbound connections to the internet for software updates without allowing inbound connections from the internet.

Answer

VPC endpoint and internet gateway

Answer

NAT instance and internet gateway

Answer

Internet gateway and NAT gateway

Question 5

A company is deploying a web application across multiple Availability Zones in a single region. They want to distribute incoming traffic evenly across all healthy EC2 instances. Which AWS service should be used as the entry point?

Accepted Answer

Application Load Balancer (ALB). An Application Load Balancer (ALB) operates at Layer 7 and can distribute HTTP/HTTPS traffic across multiple targets in different Availability Zones. It supports health checks and round-robin routing to evenly distribute incoming requests across healthy EC2 instances, making it the correct entry point for a web application requiring even traffic distribution across AZs.

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53 with simple routing

Question 6

A network engineer is troubleshooting connectivity issues between an on-premises network and a VPC over a Direct Connect private VIF. The on-premises network can reach EC2 instances in the VPC, but cannot reach an RDS database in the same VPC. The VPC has a single subnet. What is the MOST likely cause?

Accepted Answer

The RDS database security group is not allowing inbound traffic from the on-premises CIDR. Since the on-premises network can reach EC2 instances but not the RDS database, the issue is likely at the security group level, not the network ACL or routing. Security groups are stateful and act as a virtual firewall for instances; by default, they deny all inbound traffic unless explicitly allowed. The RDS database's security group must have an inbound rule permitting traffic from the on-premises CIDR range, and its absence would block the connection while leaving EC2 access unaffected.

Answer

The VPC network ACL is blocking inbound traffic from on-premises

Answer

The direct connect virtual interface is configured for a different VLAN

Answer

The VPC route table does not have a route to the on-premises network

Question 7

A company needs to establish a dedicated, private, high-bandwidth connection between its on-premises data center and AWS. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center to AWS, bypassing the public internet. This is achieved through a physical cross-connect at an AWS Direct Connect location, delivering consistent latency and higher throughput compared to internet-based connections.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering

Question 8

A company is designing a highly available network in AWS. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to use BGP as the routing protocol. Which TWO actions should be taken to ensure high availability?

Accepted Answer

Advertise the same on-premises prefixes over both connections with different AS_PATH prepend values. Options B and E are correct. B: Advertising the same on-premises prefixes over both connections with different AS_PATH prepend values allows you to influence inbound traffic path selection, favoring the connection with the shorter AS_PATH (less prepending). E: Configuring separate BGP sessions for each Direct Connect connection ensures that if one connection or BGP session fails, the other remains active, providing redundancy. Option A is wrong because BGP community values do not directly influence path selection; they are used for tagging and policy. Option C is wrong because jumbo frames affect MTU, not high availability. Option D is wrong because multiple virtual interfaces on a single connection create a single point of failure; separate connections are needed for high availability.

Answer

Use the same BGP community values for both connections

Answer

Enable jumbo frames on both connections

Answer

Configure multiple virtual interfaces on a single Direct Connect connection

Question 9

A company is deploying a new VPC with public and private subnets. The VPC will host web servers in the public subnet and database servers in the private subnet. The web servers need to access the internet for updates, and the database servers need to receive traffic only from the web servers. Which THREE components are essential for this architecture?

Accepted Answer

Network ACL for subnets. An internet gateway (IGW) is essential to allow web servers in the public subnet to directly access the internet. Security groups are essential to control traffic between web and database servers, ensuring only web servers can access the database. Network ACLs are essential for subnet-level traffic control, such as allowing inbound traffic from the public subnet to the private subnet while denying other inbound traffic. A NAT gateway is not essential because the database servers do not require outbound internet access (only web servers need internet for updates). A VPC endpoint for S3 is not essential as there is no requirement to access S3.

Answer

NAT gateway in the public subnet

Answer

VPC endpoint for S3

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The network team wants to isolate traffic between VPCs while allowing all VPCs to reach the on-premises network. Which TWO configurations should be implemented?

Accepted Answer

Use a Direct Connect gateway to propagate routes to all VPCs. Creating separate Transit Gateway route tables for each VPC and associating them with the respective VPC attachments enforces traffic isolation between VPCs: each VPC route table only contains routes to the on-premises network, not to other VPCs, thus achieving the isolation requirement. Additionally, using a Direct Connect gateway to propagate routes to all VPCs ensures that the on-premises network routes are available in these isolated route tables. Option A is incorrect because a Direct Connect virtual interface must be attached to a Direct Connect Gateway, which then associates with the Transit Gateway via a transit gateway attachment. A VPN attachment is for VPN connections, not Direct Connect. Option D is incorrect because a single Transit Gateway route table for all attachments would allow VPC-to-VPC communication via automatically propagated routes. Option E is incorrect because VPC peering connections would create direct connectivity between VPCs, violating the isolation requirement.

Answer

Attach the Direct Connect virtual interface to a VPN attachment on the Transit Gateway

Answer

Use a single Transit Gateway route table for all attachments

Answer

Create VPC peering connections between each VPC

Question 11

A company needs to connect its on-premises data center to AWS using AWS Direct Connect. The company has two redundant connections and wants to use BGP as the routing protocol. Which BGP attribute should be manipulated to influence outbound traffic from AWS to the on-premises network?

Accepted Answer

Prepend AS_PATH on routes advertised to AWS.. To influence outbound traffic from AWS to the on-premises network, you must make the on-premises routes less attractive to AWS. Prepend AS_PATH on routes advertised to AWS increases the AS path length, making those routes less preferred by AWS's BGP best-path selection, thus steering traffic away from that Direct Connect virtual interface.

Answer

Set the Local Preference attribute on routes received from AWS.

Answer

Set the MED attribute on routes advertised to AWS.

Answer

Apply a BGP community tag to routes received from AWS.

Question 12

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

Accepted Answer

The Application Load Balancer.. AWS WAF is a web application firewall that protects web resources from common exploits like SQL injection. It integrates directly with Application Load Balancers (ALBs) by allowing you to associate a web ACL with the ALB, which inspects HTTP/HTTPS traffic before it reaches the backend EC2 instances. This is the only supported integration point among the options for protecting application-layer traffic in this architecture.

Answer

Amazon Route 53 hosted zone.

Answer

The security group of the EC2 instances.

Answer

The VPC internet gateway.

Question 13

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. The company has two Direct Connect connections from different providers and a site-to-site VPN as a backup. The company wants to ensure that traffic is always routed through the Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail. Which BGP configuration should be used on the customer gateway device (CGW) to achieve this?

Accepted Answer

Set a lower BGP Local Preference value for routes received from the VPN connection.. BGP Local Preference is a well-known mandatory attribute used to influence outbound traffic from the AS. By setting a lower Local Preference value for routes received from the VPN connection, the customer gateway device (CGW) will prefer routes learned via Direct Connect (which have a default or higher Local Preference) over those learned via VPN. This ensures traffic is routed through Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail.

Answer

Apply a BGP community tag to routes received over the VPN to signal less preference.

Answer

Set a higher BGP Multi-Exit Discriminator (MED) value for routes advertised over the VPN.

Answer

Prepend AS_PATH on routes advertised over the Direct Connect connections.

Question 14

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) and AWS Global Accelerator. Which TWO configurations are required to route traffic to the correct regional endpoint based on the client's location?

Accepted Answer

Define endpoint groups in Global Accelerator for each region.. Endpoint groups in AWS Global Accelerator define the regional endpoints (such as ALBs) and allow you to control traffic routing based on the client's source location. Global Accelerator uses the Anycast IP addresses and the AWS global network to direct traffic to the nearest endpoint group, providing performance-based routing without relying on DNS.

Answer

Enable AWS Shield Advanced on the ALBs.

Answer

Configure cross-region load balancing in the ALB target groups.

Answer

Configure Amazon Route 53 latency-based routing to the ALBs.

Question 15

A company is setting up AWS Transit Gateway with multiple VPC attachments and an AWS Direct Connect Gateway. The company wants to control which VPCs can communicate with each other and with the on-premises network. Which TWO actions should the company take to implement this?

Accepted Answer

Associate the Direct Connect Gateway with the Transit Gateway.. To route traffic from on-premises networks through AWS Direct Connect to VPCs attached to a Transit Gateway, the Direct Connect Gateway must be associated with the Transit Gateway. This association creates a dedicated attachment that enables the Transit Gateway to exchange routes with the Direct Connect Gateway, allowing seamless connectivity between on-premises and VPC resources.

Answer

Establish VPC peering connections between VPCs that need to communicate.

Answer

Use security groups to control traffic between VPCs.

Answer

Configure Transit Gateway peering attachments for inter-region connectivity.