ANS-C01 Network Implementation Practice Test 8 — 15 Questions

Question 1

A company has deployed an application in a VPC with public and private subnets across two Availability Zones. The application uses an Application Load Balancer (ALB) in the public subnets to distribute traffic to EC2 instances in the private subnets. The company wants to use AWS WAF to protect against SQL injection attacks. Where should the AWS WAF web ACL be associated?

Accepted Answer

The Application Load Balancer.. Option B is correct because AWS WAF can be associated with an ALB. Option A is wrong because AWS WAF does not directly protect Route 53. Option C is wrong because AWS WAF does not protect an internet gateway. Option D is wrong because AWS WAF is not associated with security groups.

Answer

Amazon Route 53 hosted zone.

Answer

The security group of the EC2 instances.

Answer

The VPC internet gateway.

Question 2

A company is implementing a hybrid network using AWS Direct Connect and VPN backup. The company has two Direct Connect connections from different providers and a site-to-site VPN as a backup. The company wants to ensure that traffic is always routed through the Direct Connect connections when they are healthy, and only fails over to the VPN if both Direct Connect connections fail. Which BGP configuration should be used on the customer gateway device (CGW) to achieve this?

Accepted Answer

Set a lower BGP Local Preference value for routes received from the VPN connection.. Option A is correct because setting a lower Local Preference on the VPN routes makes them less preferred than Direct Connect routes. Option B is wrong because MED is used to influence inbound traffic. Option C is wrong because AS_PATH prepending would affect all traffic, including Direct Connect. Option D is wrong because community tags are not used for route preference directly.

Answer

Apply a BGP community tag to routes received over the VPN to signal less preference.

Answer

Set a higher BGP Multi-Exit Discriminator (MED) value for routes advertised over the VPN.

Answer

Prepend AS_PATH on routes advertised over the Direct Connect connections.

Question 3

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) and AWS Global Accelerator. Which TWO configurations are required to route traffic to the correct regional endpoint based on the client's location?

Accepted Answer

Define endpoint groups in Global Accelerator for each region.. Option B is correct because Global Accelerator uses anycast IPs to route traffic to the nearest healthy endpoint. Option D is correct because endpoint groups in Global Accelerator define the regional endpoints and traffic distribution. Option A is wrong because Route 53 latency routing is not used with Global Accelerator. Option C is wrong because target groups are within a region, not across regions. Option E is wrong because AWS Shield Advanced provides DDoS protection, not traffic routing.

Answer

Enable AWS Shield Advanced on the ALBs.

Answer

Configure cross-region load balancing in the ALB target groups.

Answer

Configure Amazon Route 53 latency-based routing to the ALBs.

Question 4

A company is setting up AWS Transit Gateway with multiple VPC attachments and an AWS Direct Connect Gateway. The company wants to control which VPCs can communicate with each other and with the on-premises network. Which THREE actions should the company take to implement this?

Accepted Answer

Associate the Direct Connect Gateway with the Transit Gateway.. Option A is correct because route tables define how traffic is routed between attachments. Option C is correct because transit gateway peering attachments are used for inter-region connectivity, not intra-region. Option D is correct because the Direct Connect Gateway can be associated with the transit gateway to enable on-premises connectivity. Option B is wrong because VPC peering is not needed with Transit Gateway. Option E is wrong because Security Groups are not used to control traffic between VPCs in Transit Gateway.

Answer

Establish VPC peering connections between VPCs that need to communicate.

Answer

Use security groups to control traffic between VPCs.

Answer

Configure Transit Gateway peering attachments for inter-region connectivity.

Question 5

A company is deploying an AWS Client VPN endpoint to provide remote access to its VPC resources. The company wants to allow clients to access resources in multiple subnets within the VPC. Which TWO configurations are necessary?

Accepted Answer

Associate the Client VPN endpoint with subnets in the VPC.. Option A is correct because the Client VPN endpoint must be associated with the VPC's subnets via a subnet association. Option C is correct because authorization rules specify which groups can access which networks. Option B is wrong because security groups are applied to the Client VPN endpoint, not to the target subnets directly. Option D is wrong because route tables are automatically propagated, but the question asks for necessary configurations. Option E is wrong because a transit gateway is not required for a single VPC.

Answer

Configure route tables in the VPC to direct traffic to the Client VPN endpoint.

Answer

Attach the VPC to a transit gateway.

Answer

Configure security groups on the target subnets.

Question 6

A network engineer runs the above command to list VPC endpoints. The engineer notices that the second endpoint (vpce-0b2c3d4e5f6g7h8i9) does not have a policy document displayed. What does this indicate?

Accepted Answer

The endpoint has the default full-access policy.. Option B is correct because by default, a Gateway endpoint for DynamoDB uses a full-access policy if no custom policy is specified. Option A is wrong because the endpoint is active. Option C is wrong because the missing policy field indicates no custom policy was set. Option D is wrong because DynamoDB endpoints do not require a policy; the default allows all actions.

Answer

The endpoint is configured to use an AWS managed policy that is not shown.

Answer

The endpoint is not active and needs to be recreated.

Answer

The endpoint is for DynamoDB, which does not support endpoint policies.

Question 7

A network engineer runs the above command and sees an ENI (eni-0a1b2c3d4e5f6g7h8) with status 'in-use' but no InstanceId attached. What AWS service is most likely using this ENI?

Accepted Answer

An Amazon RDS database instance.. Option C is correct because RDS uses managed ENIs that appear 'in-use' without an InstanceId. Option A is wrong because NAT Gateway ENIs have specific descriptions. Option B is wrong because VPC Endpoints use ENIs with descriptions like 'VPC Endpoint'. Option D is wrong because Transit Gateway does not use ENIs directly.

Answer

A VPC endpoint (Interface type).

Answer

A NAT gateway.

Answer

An AWS Transit Gateway.

Question 8

A network engineer examines the route table above. The VPC has a CIDR of 10.0.0.0/16. There is a VPC peering connection (pcx-...) to a VPC with CIDR 192.168.0.0/16. However, instances in this route table's subnet cannot communicate with the peered VPC. What is the most likely cause?

Accepted Answer

The security group or network ACL in the source subnet is blocking traffic.. Option D is correct because the route table shows a route to the peered VPC via pcx, so routing seems configured. The issue is likely that the security groups or NACLs in the source subnet are blocking traffic. Option A is wrong because the route exists. Option B is wrong because the peering connection may be active; the issue is not shown. Option C is wrong because the route table is associated with the subnet (implied by the question).

Answer

The route table is not associated with the subnet.

Answer

The VPC peering connection is in 'pending-acceptance' state.

Answer

The route to the peered VPC is missing from the route table.

Question 9

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets are used for NAT gateways and an Application Load Balancer (ALB). The private subnets host EC2 instances running a web application. What is the most cost-effective and highly available configuration for internet access from the private instances?

Accepted Answer

Deploy a NAT gateway in each public subnet and configure private route tables with a default route to the NAT gateway in the same AZ.. Option D is correct because using a NAT gateway in each AZ provides high availability and cost-effectiveness compared to NAT instances (which require management) or a single NAT gateway (single point of failure). Option A is wrong because NAT instances are less reliable and require maintenance. Option B is wrong because a single NAT gateway lacks high availability. Option C is wrong because internet gateway is not used for private instances; it's for public subnets.

Answer

Create a single NAT gateway in one public subnet and route all private traffic to it.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnets.

Answer

Launch a NAT instance in each public subnet and configure the private route tables.

Question 10

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The VPC uses a virtual private gateway (VGW). The on-premises network advertises a route to a specific subnet (10.0.0.0/24) via BGP. However, traffic from the VPC to that subnet is failing. What should the network engineer check first?

Accepted Answer

Verify that route propagation is enabled on the VPC's route tables associated with the subnets.. Option B is correct because the route propagation from the VGW to the VPC route tables must be enabled for the learned BGP routes to be used. Option A is wrong because the VGW is the correct attachment. Option C is wrong because the VIF state being up doesn't guarantee route propagation. Option D is wrong because the customer gateway (CGW) is configured on the AWS side; the on-premises router is separate.

Answer

Verify that the customer gateway device is advertising the subnet route.

Answer

Verify that the virtual interface is in the 'available' state and BGP session is established.

Answer

Verify that the VGW is attached to the VPC.

Question 11

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to inspect traffic between VPCs using a centralized network virtual appliance (NVA) in a security VPC. What is the most scalable and highly available design to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway, use separate route tables for inspection, and deploy NVAs behind a Gateway Load Balancer in the security VPC.. Option B is correct because Transit Gateway route tables can be used to direct traffic to the inspection VPC for east-west traffic. Using a Gateway Load Balancer (GWLB) provides high availability and scaling for the NVAs. Option A is wrong because VPC peering does not support transitive routing. Option C is wrong because Direct Connect is for on-premises, not VPC-to-VPC. Option D is wrong because a single NVA is a single point of failure.

Answer

Place a single NVA in the Transit Gateway and route all inter-VPC traffic through it.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure the NVAs to route traffic.

Answer

Use Direct Connect to connect all VPCs to a central location and route through NVAs there.

Question 12

A company has a VPC with private subnets that use a NAT gateway for outbound internet access. The NAT gateway is in a public subnet with an Elastic IP. Users report that some applications are failing to connect to external services. Network engineers confirm that the NAT gateway is in the 'available' state and the route tables have a default route (0.0.0.0/0) pointing to the NAT gateway. What is the most likely cause?

Accepted Answer

The network ACL for the public subnet is blocking inbound traffic on ephemeral ports.. Option C is correct because NACLs are stateless and must allow both inbound and outbound traffic for the ephemeral ports used by the NAT gateway. If the inbound rule for ephemeral ports is missing, return traffic is blocked. Option A is wrong because the route table is correct. Option B is wrong because NAT gateway can handle multiple connections. Option D is wrong because the problem is inbound return traffic, not outbound.

Answer

The security group for the private instances is blocking outbound traffic.

Answer

The NAT gateway has reached its connection limit.

Answer

The route table for the private subnets is missing a route to the internet gateway.

Question 13

A company is designing a multi-region architecture with two AWS Regions. They need to connect VPCs in each region to an on-premises data center using AWS Direct Connect. They want to minimize latency and use the same BGP ASN on both sides. Which solution meets these requirements?

Accepted Answer

Use a Direct Connect gateway and create a private virtual interface from each region's Direct Connect connection to the Direct Connect gateway. Use the same BGP ASN on AWS side.. Option A is correct because a Direct Connect gateway allows you to associate multiple virtual interfaces from different regions to a single gateway, and you can use the same BGP ASN. Option B is wrong because transit VIFs connect to Transit Gateway, but Direct Connect gateway is needed for multi-region. Option C is wrong because each Direct Connect connection must use different ASNs if not using Direct Connect gateway. Option D is wrong because VPN over internet adds latency and does not meet Direct Connect requirement.

Answer

Establish two separate private virtual interfaces from each region to the on-premises router using different BGP ASNs.

Answer

Use AWS Site-to-Site VPN over the internet as a backup and the Direct Connect as primary.

Answer

Create a transit virtual interface from each region to a Transit Gateway in each region and peer the Transit Gateways.

Question 14

A company wants to allow an EC2 instance in a private subnet to download files from an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Option D is correct because a VPC Gateway Endpoint for S3 allows private connectivity to S3 without internet. Option A is wrong because NAT gateway uses internet. Option B is wrong because Direct Connect is for on-premises. Option C is wrong because S3 does not support VPC Interface Endpoint by default; Gateway Endpoint is used for S3.

Answer

Establish an AWS Direct Connect connection to the VPC.

Answer

Attach an internet gateway and route through a NAT gateway.

Answer

Create a VPC Interface Endpoint for S3.

Question 15

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to another VPC (192.168.0.0/16) using VPC peering. Both VPCs have overlapping CIDRs with some on-premises networks. What must be done to ensure proper routing?

Accepted Answer

Verify that the CIDR blocks do not overlap. If they do, you must re-IP one VPC or use other solutions like Transit Gateway with network address translation.. Option B is correct because VPC peering does not support overlapping CIDRs; you cannot have routes to the same CIDR via different targets. If there is any overlap, you cannot create the peering connection or the routes. Option A is wrong because it suggests ignoring overlap. Option C is wrong because NAT does not solve routing ambiguity. Option D is wrong because Transit Gateway also has limitations with overlapping CIDRs.

Answer

Use AWS Transit Gateway instead and attach both VPCs.

Answer

Use a NAT gateway in one VPC to translate addresses.

Answer

Create the peering connection and add routes for the full CIDR ranges in both route tables.