ANS-C01 Network Implementation Practice Test 8 — 15 Questions

Question 1

A company is migrating a legacy application to AWS. The application uses multicast traffic between servers. The company needs to support multicast in the AWS VPC. Which TWO solutions can the network engineer recommend? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a third-party virtual firewall or router that supports multicast inside the VPC.. A third-party virtual firewall or router appliance (e.g., from vendors like Palo Alto Networks or Cisco) can be deployed in the VPC and configured to forward multicast traffic using protocols such as IGMP and PIM. This allows the legacy application to continue using multicast within the VPC without native AWS multicast support. Option D is correct because AWS Transit Gateway now supports multicast domains, enabling you to create a multicast group and associate subnets, allowing multicast traffic to flow between attached VPCs and VPN connections.

Answer

Use VPC endpoints for multicast support.

Answer

Use VPC peering connections to allow multicast traffic between VPCs.

Answer

Use AWS Direct Connect to extend the on-premises multicast domain.

Question 2

A company has a VPC with a CIDR of 10.0.0.0/16. They create a subnet 10.0.1.0/24 and launch an EC2 instance with a private IP 10.0.1.5. The instance needs to communicate with an on-premises server at 172.16.0.10 over a VPN connection. The VPN connection uses a Virtual Private Gateway. The VPC route table has a route 172.16.0.0/16 pointing to the VPG. The instance cannot reach the on-premises server. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the 172.16.0.0/16 route to the Virtual Private Gateway.. The VPN connection requires the on-premises router to advertise the 172.16.0.0/16 route to the Virtual Private Gateway (VPG) via BGP (or static route configuration) for the VPG to forward traffic to the on-premises network. Without this route advertisement, the VPG will not have a path to 172.16.0.10, even though the VPC route table has a route pointing to the VPG. The instance's traffic reaches the VPG, but the VPG cannot forward it because it lacks the necessary routing information from the on-premises side.

Answer

The security group attached to the instance does not allow outbound traffic to 172.16.0.10.

Answer

The instance's route table does not have a route to the internet gateway.

Answer

The network ACL for the subnet denies outbound traffic to the on-premises IP range.

Question 3

A company is setting up a site-to-site VPN connection between an on-premises network and AWS. The VPN uses two tunnels for high availability. The network engineer needs to ensure that if one tunnel goes down, traffic automatically fails over to the other tunnel. Which THREE steps should the engineer perform? (Choose THREE.)

Accepted Answer

Configure BGP on both VPN tunnels.. BGP is the correct choice for automatic failover because it enables dynamic route advertisement and withdrawal over the VPN tunnels. When a tunnel fails, BGP withdraws the corresponding routes, causing the VPC route table to automatically use the remaining tunnel's routes. This eliminates the need for manual intervention or static route manipulation.

Answer

Configure static routes pointing to the VPN connection.

Answer

Use a single customer gateway device with multiple BGP sessions.

Question 4

A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An Application Load Balancer (ALB) is deployed in the public subnet, and EC2 instances are in the private subnet. The ALB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the ALB's security group on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24) and allows outbound ephemeral ports. However, the ALB health checks are failing with 503 errors. The network engineer checks the ALB logs and sees that TCP connections are established but HTTP requests are timing out. What is the most likely cause?

Accepted Answer

The ALB health check is configured to use HTTPS but the target only listens on HTTP.. The correct answer is C: the ALB health check is configured to use HTTPS while the target only listens on HTTP. Because TCP connections are established but HTTP requests time out, the ALB is reaching the instances on the correct port, but the protocol mismatch (HTTPS health check against an HTTP-only listener) causes the TLS handshake or HTTP response to fail, producing 503 health check failures. Option A is wrong because network ACLs filter by CIDR, not security group, and the private subnet NACL already allows inbound port 80 from 10.0.1.0/24. Option B is wrong because the ALB's security group outbound rules are not the issue when TCP connections are already established. Option D is wrong because the private subnet does not need a route to the ALB subnet for the ALB to initiate health checks to the targets; return traffic uses the existing connection and the instances' route table.

Answer

The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.

Answer

The security group for the ALB does not allow outbound traffic to the targets.

Answer

The route table for the private subnet does not have a route to the ALB's subnet.

Question 5

A company has a VPC with CIDR 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have a Network Load Balancer (NLB) in the public subnet, and EC2 instances in the private subnet. The NLB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the NLB's private IP addresses on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR and outbound ephemeral ports to 0.0.0.0/0. However, clients connecting to the NLB experience intermittent timeouts. The network engineer checks the NLB logs and sees that connections are established but occasionally drop. The engineer also notices that the EC2 instances have a default route to a NAT Gateway in the public subnet. What is the most likely cause of the intermittent timeouts?

Accepted Answer

The EC2 instances have a default route to the NAT Gateway, causing asymmetric routing.. The EC2 instances have a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. When the NLB forwards a client request to a target, the target's reply is routed via the NAT Gateway instead of back through the NLB, creating asymmetric routing. The NAT Gateway rewrites the source IP, so the return packet no longer matches the original connection's 5-tuple, and the NLB drops it — producing intermittent timeouts that correlate with which path the reply takes.

Answer

Cross-zone load balancing is disabled on the NLB.

Answer

The NLB health checks are failing, causing targets to be removed.

Answer

The security group for the NLB is blocking inbound traffic.

Question 6

A company is designing a highly available network architecture using AWS Direct Connect. They have two Direct Connect connections from different providers to two different AWS Direct Connect locations. They want to ensure that if one connection fails, traffic automatically fails over to the other. Which TWO steps should they take? (Select TWO.)

Accepted Answer

Advertise the same prefix over both Direct Connect connections.. Option A is correct because advertising the same prefix (for example, the same on-premises CIDR) over both Direct Connect connections lets BGP multipath and the AWS routing policy select the best path, and if one connection fails, the prefix remains reachable via the other connection, providing automatic failover. Option D is correct because enabling Bidirectional Forwarding Detection (BFD) on both BGP sessions provides sub-second failure detection, allowing BGP to tear down and reconverge the failed session much faster than relying on standard BGP hold timers, which is essential for rapid automatic failover. Option B is not needed and can be counterproductive: using different BGP AS numbers per connection is not required for failover and can complicate routing policy; the same ASN is typically used for the customer side. Option C is incorrect because static routes do not automatically reconverge or fail over when a connection drops, unlike BGP. Option E is incorrect because a single virtual interface cannot span two separate Direct Connect connections at different locations; each connection requires its own virtual interface (and typically its own BGP session).

Answer

Use a different BGP AS number for each Direct Connect connection.

Answer

Use static routes instead of BGP for the Direct Connect connections.

Answer

Configure a single virtual interface for both connections.

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a subnet that hosts a web application. They need to ensure that traffic from the on-premises network to the web application does not traverse the internet. Which TWO components are required? (Select TWO.)

Accepted Answer

Direct Connect Gateway associated with the Transit Gateway. Option B is correct because a Direct Connect Gateway is the component that allows a private virtual interface to reach a Transit Gateway, enabling on-premises traffic to be routed into the VPC through the Transit Gateway without using the public internet. Option C is correct because the Direct Connect private virtual interface is the actual Layer 2/3 connection that carries private RFC 1918 traffic from the on-premises router into the Direct Connect Gateway, which then associates with the Transit Gateway. Together, B and C form the private path: on-premises router → private VIF → Direct Connect Gateway → Transit Gateway → VPC subnet hosting the web application. Option A is not required because an Internet Gateway would route traffic over the public internet, which the scenario explicitly forbids. Option D is not required because a Site-to-Site VPN to the Transit Gateway would send traffic over the internet (encrypted, but still internet), and the question asks for a non-internet path. Option E is not required because CloudFront is a public content-delivery service and does not provide private on-premises-to-VPC connectivity.

Answer

Internet Gateway attached to the VPC

Answer

Site-to-Site VPN connection to the Transit Gateway

Answer

CloudFront distribution in front of the web application

Question 8

A company has a VPC with a public subnet and a private subnet. They want to allow instances in the private subnet to download patches from the internet. Which THREE components are required? (Select THREE.)

Accepted Answer

Internet Gateway attached to the VPC. The scenario requires private-subnet instances to reach the internet for patch downloads, which is the classic NAT Gateway architecture. Option B is correct because the VPC needs an Internet Gateway attached so that traffic from the NAT Gateway can ultimately reach the internet. Option E is correct because the NAT Gateway must be deployed in the public subnet, which has a route to the Internet Gateway, so it can forward private-subnet traffic outbound. Option D is correct because the private subnet's route table must have a 0.0.0.0/0 route targeting the NAT Gateway so instances in that subnet send internet-bound traffic through it. Option A is incorrect because AWS Direct Connect is a dedicated private network connection to on-premises or AWS, not a requirement for general internet access from a private subnet. Option C is incorrect because a NAT Gateway is not assigned an Elastic IP address; NAT Gateways use an Elastic IP only in the sense that you associate an Elastic IP when creating it, but the option as written describes assigning an EIP to the NAT Gateway as a required component, which is not the accurate requirement here.

Answer

AWS Direct Connect connection

Answer

Elastic IP address assigned to the NAT Gateway

Question 9

A network engineer is troubleshooting connectivity from an EC2 instance in a private subnet to an S3 bucket. The VPC has a VPC endpoint for S3 configured. The instance can access the internet via a NAT Gateway. Which configuration is MOST likely causing the connection to S3 to fail?

Accepted Answer

The route table for the private subnet is missing a route to the S3 VPC endpoint.. For an EC2 instance in a private subnet to use a VPC endpoint for S3, the subnet's route table must include a route with the S3 endpoint's prefix list as the destination and the VPC endpoint ID as the target. Without this route, traffic destined for S3 will be sent to the NAT Gateway instead, which may fail if the instance lacks a public IP or if the NAT Gateway's route table or security groups block the traffic. Option B correctly identifies this missing route as the most likely cause.

Answer

The S3 VPC endpoint is in a different Availability Zone than the instance.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The EC2 instance does not have a public IP address.

Question 10

Refer to the exhibit. A Lambda function is attached to a VPC using the network interface eni-1234567890abcdef0. The Lambda function needs to send traffic to an on-premises server via a Direct Connect connection. The traffic is failing. Which setting on the network interface is most likely causing the issue?

Accepted Answer

The SourceDestCheck flag is enabled, which prevents the Lambda function from sending traffic that it is not the source or destination of.. Lambda functions attached to a VPC use elastic network interfaces (ENIs) with the Source/Destination Check flag enabled by default. This flag causes the ENI to drop any traffic where the ENI's IP address is not the source or destination of the packet. Since the Lambda function is sending traffic to an on-premises server via Direct Connect, the ENI is acting as an intermediate hop, and the flag must be disabled for the traffic to pass.

Answer

The network interface is in a subnet that does not have a route to the Direct Connect.

Answer

The network interface has two private IP addresses.

Answer

The security group attached to the network interface may be blocking outbound traffic.

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (443) traffic. The route table for the private subnet has a default route pointing to a NAT Gateway in the public subnet. Which additional configuration is required to ensure the NAT Gateway can route the traffic?

Accepted Answer

Assign an Elastic IP address to the NAT Gateway.. A NAT Gateway must have an Elastic IP address assigned to it to communicate with the internet. Without an Elastic IP, the NAT Gateway cannot send traffic to the internet or receive return traffic. The private subnet route table correctly points to the NAT Gateway, and the security group on the instance allows outbound HTTPS. The missing configuration is the Elastic IP address, which is required for the NAT Gateway to function.

Answer

Configure the security group of the NAT Gateway to allow inbound traffic from the private subnet.

Answer

Add a route in the private subnet route table to the NAT Gateway's private IP.

Answer

Add a route in the public subnet route table to the Internet Gateway.

Question 12

Refer to the exhibit. The bucket policy shown is applied to an S3 bucket. A VPC endpoint for S3 is created in a VPC with CIDR 10.0.0.0/16. An EC2 instance in the VPC tries to access an object in the bucket using the VPC endpoint. The request fails. What is the most likely reason?

Accepted Answer

The condition uses aws:SourceIp, which does not work with VPC endpoint traffic.. The bucket policy uses the `aws:SourceIp` condition key, which is not supported for traffic originating from a VPC endpoint. When requests are made through a VPC endpoint, the source IP address is replaced by the endpoint's private IP, making `aws:SourceIp` ineffective. To restrict access based on the VPC endpoint, you must use the `aws:SourceVpce` or `aws:SourceVpc` condition keys instead.

Answer

The bucket policy does not allow s3:ListBucket.

Answer

The EC2 instance does not have an IAM role that allows s3:GetObject.

Answer

The VPC endpoint does not have a route table associated with the instance's subnet.

Question 13

A company is running a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application needs to store session state in an ElastiCache Redis cluster. The Redis cluster should not be accessible from the internet. Which network design should be used?

Accepted Answer

Place both the EC2 instances and the Redis cluster in private subnets with appropriate security groups.. Placing both the EC2 instances and the ElastiCache Redis cluster in private subnets ensures that the Redis cluster is not accessible from the internet, meeting the security requirement. The EC2 instances can communicate with the Redis cluster within the same VPC using private IP addresses, and security groups can be used to restrict traffic to only the necessary ports (e.g., TCP 6379 for Redis) from the EC2 instances' security group. This design avoids exposing the Redis cluster to any public network, aligning with best practices for internal caching layers.

Answer

Place the Redis cluster in a public subnet and restrict access via security group.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a private subnet, with a NAT Gateway for outbound traffic.

Answer

Place the Redis cluster in a private subnet and the EC2 instances in a public subnet.

Question 14

A company is deploying a multi-tier web application in a VPC. The web tier must be accessible from the internet, while the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. Which design best meets these requirements?

Accepted Answer

Place the web tier in public subnets with an internet gateway, and the application and database tiers in private subnets. Use security groups to allow traffic from the web tier to the application tier, and from the application tier to the database tier.. It places the web tier in a public subnet with an Internet Gateway (IGW) for direct internet access, while the application and database tiers reside in private subnets with no direct internet path. Security groups act as stateful virtual firewalls at the instance level, allowing you to specify inbound rules that permit traffic only from the web tier security group to the application tier, and from the application tier security group to the database tier. This layered approach enforces the principle of least privilege and meets the access requirements without exposing the internal tiers to the internet.

Answer

Place all tiers in public subnets and use security groups to control traffic between tiers.

Answer

Place all tiers in the same subnet and use network ACLs to restrict traffic between tiers.

Answer

Place the web tier in a private subnet and use a NAT gateway for outbound internet access. Place the application and database tiers in public subnets.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). They launch a NAT Gateway in the public subnet and add a route in the private subnet route table: destination 0.0.0.0/0, target nat-gateway-id. An EC2 instance in the private subnet can ping an external server, but cannot connect to it via SSH. The security group allows outbound SSH (port 22), and the NACL allows outbound ephemeral ports. What is the likely cause?

Accepted Answer

The external server's firewall is blocking traffic from the NAT Gateway's Elastic IP address.. The NAT Gateway translates the private instance's source IP to its own Elastic IP address for outbound traffic. SSH connections require bidirectional communication: the external server must send SYN-ACK packets back to the source IP. If the external server's firewall blocks traffic from the NAT Gateway's Elastic IP, the TCP handshake fails, preventing SSH while ICMP (ping) may still work because ICMP echo requests and replies are stateless and often allowed by default.

Answer

The NACL on the private subnet is blocking outbound ephemeral ports.

Answer

The route table in the private subnet does not have a route to the NAT Gateway.

Answer

The NAT Gateway is not configured to allow SSH traffic.