ANS-C01 Network Implementation Practice Test 9 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to AWS. The VPC CIDR is 10.0.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection. However, traffic is going over the internet instead. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC CIDR overlaps with the on-premises prefix, and the local route in the VPC route table takes precedence.. When a VPC CIDR (10.0.0.0/16) exactly matches a prefix advertised via Direct Connect (10.0.0.0/16), the VPC's local route (which is implicitly created for the VPC CIDR) takes precedence over any propagated BGP route. This is because AWS route tables prioritize the most specific matching route, and when prefixes are identical, the local route is preferred over static or propagated routes. As a result, traffic destined for 10.0.0.0/16 stays within the VPC instead of being sent over the Direct Connect connection.

Answer

The on-premises BGP ASN is prepended, causing the route to be less preferred.

Answer

The on-premises prefix is less specific than the VPC CIDR, so the VPC route takes precedence.

Answer

The BGP route is not being propagated into the VPC route table.

Question 2

An organization is migrating to AWS and needs to connect multiple VPCs in different AWS regions using a hub-and-spoke topology. The hub VPC will host centralized services. Which solution is most cost-effective and provides high throughput?

Accepted Answer

Create VPC peering connections between the hub VPC and each spoke VPC.. VPC peering connections provide high-throughput, low-latency connectivity between VPCs using the AWS global network, with no bandwidth limits and no single point of failure. For a hub-and-spoke topology with a limited number of VPCs, VPC peering is the most cost-effective solution as it incurs no hourly or per-GB data transfer charges beyond standard inter-region data transfer costs, unlike Transit Gateway which has hourly attachment fees. This makes it ideal for organizations migrating to AWS that need simple, direct connectivity without the complexity or cost of additional appliances or transit infrastructure.

Answer

Deploy a software VPN appliance in the hub VPC and connect each spoke VPC with VPN tunnels.

Answer

Establish Direct Connect connections from each VPC to a central on-premises location.

Answer

Set up AWS Transit Gateway with attachments to each VPC.

Question 3

A company has an AWS Direct Connect connection and wants to connect to multiple VPCs in the same region. Which TWO services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (B) is correct because it acts as a regional hub that can attach to the Direct Connect connection (via a transit VIF) and to multiple VPCs in the same region, allowing the on-premises network to reach all attached VPCs through a single gateway. Direct Connect Gateway (D) is correct because it is specifically designed to let a single Direct Connect connection (private or transit VIF) reach multiple VPCs across the same or different regions via virtual private gateways or transit gateways, which is exactly the multi-VPC connectivity scenario described. VPC Peering (A) only connects two VPCs directly and does not by itself extend the Direct Connect connection to multiple VPCs without additional components. AWS Site-to-Site VPN (C) creates encrypted tunnels over the internet and is not the service used to fan out a Direct Connect connection to multiple VPCs. AWS CloudHub (E) is not a real AWS service, so it cannot be used here.

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Answer

AWS CloudHub

Question 4

A company is using a Network Load Balancer (NLB) to distribute traffic to a fleet of EC2 instances. The NLB is configured with a target group that has health checks enabled. Some instances are marked as unhealthy even though they are running and responding to requests on the health check port. What is a likely cause?

Accepted Answer

The security group for the EC2 instances does not allow inbound traffic from the VPC CIDR on the health check port.. When a Network Load Balancer performs health checks, it sends requests from its private IP addresses within the NLB subnet to the target instances. The security group on the EC2 instances must explicitly allow inbound traffic from the VPC CIDR (or the NLB subnet CIDR) on the health check port. If the security group only allows traffic from the internet or a different source, the health check packets are dropped, causing the instances to be marked unhealthy even though they are running and responding to other traffic.

Answer

The route table for the NLB subnet does not have a route to the internet.

Answer

The internet gateway is not attached to the VPC.

Answer

The health check is being blocked by a network ACL that allows inbound traffic only from the internet.

Question 5

Refer to the exhibit. A company has an S3 bucket with the bucket policy shown. An EC2 instance in a VPC with CIDR 10.0.0.0/16 tries to retrieve an object from the bucket using the S3 console, but receives an 'Access Denied' error. The instance's security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The EC2 instance is accessing the S3 bucket through a NAT Gateway, so the source IP is the public IP of the NAT Gateway, which does not match the condition.. The bucket policy uses the `aws:SourceIp` condition to restrict access to requests originating from the specific IP range 10.0.0.0/16. However, when the EC2 instance accesses S3 through a NAT Gateway, the source IP seen by S3 is the public IP of the NAT Gateway, not the private IP of the instance. Since the NAT Gateway's public IP does not fall within the 10.0.0.0/16 range, the condition fails and S3 returns an 'Access Denied' error.

Answer

The bucket policy does not allow the s3:GetObject action.

Answer

The bucket policy does not specify a principal, so it defaults to deny.

Answer

The condition aws:SourceIp is too restrictive and blocks all traffic.

Question 6

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to AWS. The VPC CIDR is 10.0.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection. However, traffic is going over the internet instead. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Direct Connect BGP session with a higher local preference (e.g., 200) than the VPN BGP session.. Local preference is a BGP attribute used to influence outbound traffic from the local AS. By setting a higher local preference (e.g., 200) on the Direct Connect BGP session, the router will prefer that path over the VPN session (default local preference 100) for the same prefix. This ensures traffic from the VPC to on-premises uses Direct Connect as the primary path.

Answer

Set the Multi-Exit Discriminator (MED) on the VPN advertisement to a lower value.

Answer

Prepend the AS path on the Direct Connect advertisement to make it longer.

Answer

Configure the VPN BGP session with a higher local preference than the Direct Connect session.

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16. They have two Availability Zones, each with a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). They have an internet-facing ALB in the public subnets and EC2 instances in the private subnets. The EC2 instances need to download updates from the internet. They deploy a NAT Gateway in each public subnet and add routes in the private subnet route tables pointing to the respective NAT Gateway in the same AZ. However, the EC2 instances in AZ2 cannot access the internet, while those in AZ1 can. What is the most likely cause?

Accepted Answer

The NAT Gateway in AZ2 does not have an Elastic IP address assigned.. The NAT Gateway in AZ2 does not have an Elastic IP address assigned. A NAT Gateway requires an Elastic IP to enable outbound internet traffic. Without it, the NAT Gateway cannot route traffic to the internet, causing the EC2 instances in AZ2 to fail to download updates. Option A is incorrect because security group rules are account-level and would affect both AZs equally. Option C is incorrect because the route table in AZ2 is configured to point to the NAT Gateway in the same AZ, not cross-AZ. Option D is incorrect because the route table for the private subnet in AZ2 does have a route to the NAT Gateway, but the NAT Gateway itself is missing the Elastic IP.

Answer

The security group of the EC2 instances in AZ2 is blocking outbound traffic.

Answer

The private subnet in AZ2 is routing traffic to the NAT Gateway in AZ1, which is in a different Availability Zone and incurs cross-AZ charges but should still work.

Answer

The route table for the private subnet in AZ2 is missing a route to the NAT Gateway.

Question 8

A network engineer is troubleshooting connectivity between an on-premises data center and a VPC over an AWS Site-to-Site VPN. The tunnel status shows UP, but traffic from on-premises to the VPC is intermittently dropped. Which TWO of the following are likely causes? (Choose 2.)

Accepted Answer

Asymmetric routing across multiple tunnels. Option C is correct because when multiple VPN tunnels are active (for example, two tunnels per connection or multiple connections), traffic can leave through one tunnel and return through another; AWS and on-premises devices may drop the return packets due to stateful inspection or asymmetric routing, producing intermittent drops even though the tunnel shows UP. Option D is correct because Site-to-Site VPN has an IPsec overhead that reduces the usable MTU (typically to around 1400 bytes or less); if the on-premises or VPC-side MTU is not adjusted, large packets get fragmented or dropped, and since small packets (like pings) succeed while larger ones fail, the symptom appears as intermittent connectivity loss. Option A is not the likely cause here because a DPD timeout would normally bring the tunnel down or trigger renegotiation, not leave it stably UP with intermittent drops. Option B is not the likely cause because BGP hold timer expiration would tear down the BGP session and withdraw routes, again changing the tunnel/route state rather than causing intermittent drops with the tunnel UP. Option E is not the likely cause because an IPsec SA lifetime mismatch typically causes rekeying failures that bring the tunnel down or cause it to flap at the lifetime boundary, not continuous intermittent drops while the tunnel remains UP.

Answer

Dead Peer Detection (DPD) timeout configuration

Answer

BGP hold timer expiration

Answer

IPsec SA lifetime mismatch between peers

Question 9

A company uses AWS Direct Connect with a private VIF to connect to a VPC. They have an on-premises application that needs to resolve private hosted zone names in Amazon Route 53. The on-premises DNS server forwards queries for the private domain to the VPC's DNS resolver. However, resolution fails. What is the most likely cause?

Accepted Answer

The private hosted zone is not associated with the VPC.. The most likely cause is that the private hosted zone is not associated with the VPC. For Route 53 private hosted zones, the zone must be explicitly associated with the VPC in which the DNS resolver operates. If the zone is not associated, the VPC's DNS resolver (Route 53 Resolver) will not respond to queries for that domain, even if queries are forwarded from on-premises. The on-premises DNS server forwards queries to the VPC's DNS resolver, but without zone association, the resolver has no knowledge of the private hosted zone. Options B and C are incorrect because DHCP option sets and security groups do not directly affect the VPC DNS resolver's ability to resolve private hosted zones. Option D is incorrect because an outbound endpoint is used to forward queries from the VPC to on-premises, not to accept inbound queries; the correct component would be an inbound endpoint, but the primary issue here is zone association.

Answer

The VPC's DHCP option set is not configured to use the Route 53 Resolver.

Answer

The security group for the VPC DNS resolver is blocking inbound UDP port 53 from the on-premises network.

Answer

A Route 53 Resolver outbound endpoint is not configured to forward queries from on-premises to the VPC.

Question 10

A company uses AWS Transit Gateway with multiple VPC attachments and a VPN attachment to an on-premises network. The on-premises network advertises the same prefix via two separate VPN connections for redundancy. The TGW route table shows both routes as active. Traffic from a VPC to on-premises is not load-balanced and prefers one connection. Which THREE actions would help achieve active-active load balancing? (Choose 3.)

Accepted Answer

Configure BGP AS_PATH prepending on the preferred VPN connection to make it less preferred. Option B is correct because AWS Transit Gateway only performs active-active load balancing across multiple VPN connections when equal-cost multi-path (ECMP) routing is enabled on the TGW route table; without ECMP, the TGW installs only one best path per prefix even if multiple BGP routes exist. Option A is correct because BGP AS_PATH prepending on the preferred VPN connection makes that path longer and therefore less preferred, which helps equalize path selection so both connections can be used when ECMP is enabled. Option E is correct because adjusting the BGP Multi-Exit Discriminator (MED) attribute on the on-premises routers influences which path AWS prefers for inbound traffic, allowing the two VPN connections to be balanced rather than one being consistently preferred. Option C is not correct because BGP weight is a Cisco-proprietary attribute local to a router and is not used by AWS Transit Gateway for path selection. Option D is not correct because replacing BGP with static routes removes the dynamic path attributes needed for ECMP and does not provide active-active load balancing across redundant VPN connections.

Answer

Set a higher BGP weight on the less preferred connection

Answer

Use static routes for both VPN connections instead of BGP

Question 11

A media company runs a latency-sensitive streaming application on Amazon EC2 instances in a VPC. The application sends UDP traffic to multiple on-premises destinations via an AWS Transit Gateway with a VPN attachment. Users report occasional freezing. Network monitoring shows no packet loss on the VPN tunnel, but the application logs show out-of-order packets and high jitter. The company uses a single VPN tunnel with BGP dynamic routing over the public internet. The on-premises router has a 50ms latency to the AWS endpoint. The application requires low jitter and in-order delivery. What should a network engineer do to resolve the issue?

Accepted Answer

Replace the VPN attachment with an AWS Direct Connect private VIF to provide a consistent path. The application requires low jitter and in-order delivery, but the VPN over the public internet introduces variable latency and jitter, causing out-of-order packets. AWS Direct Connect provides a dedicated, private network connection with consistent latency and jitter, which is ideal for latency-sensitive applications. A private VIF connects directly to the VPC, bypassing the public internet. Adding a second VPN tunnel does not eliminate jitter; jumbo frames do not address jitter; changing to TCP would not solve the underlying network issue and may increase latency.

Answer

Add a second VPN tunnel to the same Transit Gateway to load balance traffic

Answer

Enable jumbo frames on the VPN tunnel to reduce packet overhead

Answer

Change the application to use TCP instead of UDP

Question 12

Which THREE of the following are required to establish a highly available site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Two VPN tunnels (one primary, one secondary). AWS Site-to-Site VPN requires two tunnels per VPN connection to provide high availability. Each tunnel uses separate endpoints and paths; if one tunnel fails, traffic automatically fails over to the other. This design ensures continuous connectivity even during maintenance or failures.

Answer

Two separate VPN connections

Answer

An AWS Direct Connect connection

Question 13

Which TWO of the following are true about AWS VPC security groups? (Choose two.)

Accepted Answer

They have an implicit deny all rule at the end.. Option B is correct because security groups end with an implicit deny-all rule: any traffic not explicitly permitted by an allow rule is dropped, so nothing is allowed by default. Option C is correct because security groups are stateful — when an inbound or outbound connection is permitted, the response traffic for that connection is automatically allowed in the reverse direction without needing a matching rule. Option A is wrong because security groups evaluate all rules together rather than in numbered order (that ordered, first-match behavior describes network ACLs). Option D is wrong because security groups only support allow rules; deny rules are not available (network ACLs support both allow and deny). Option E is wrong because security groups are associated with ENIs/instances, whereas subnets are associated with network ACLs.

Answer

Rules are evaluated in order, and the first matching rule is applied.

Answer

They support both allow and deny rules.

Answer

They can be associated with subnets.

Question 14

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect two separate branch offices using AWS Client VPN. Each branch office has a different subnet: Branch A uses 10.0.1.0/24 and Branch B uses 10.0.2.0/24. The Client VPN endpoint is configured with a CIDR range of 10.0.3.0/24. The route table for the VPC has the local route and routes to the Client VPN endpoint. Users from both branches can connect to the VPN but cannot communicate with each other. What is the most likely reason?

Accepted Answer

The branch subnets 10.0.1.0/24 and 10.0.2.0/24 are part of the VPC CIDR, so the VPC routes traffic locally instead of via the VPN. Because 10.0.1.0/24 and 10.0.2.0/24 fall inside the VPC CIDR 10.0.0.0/16, the VPC's local route (which is more specific and always present) matches traffic destined for those subnets and keeps it inside the VPC rather than sending it through the Client VPN endpoint. The branch subnets must not overlap the VPC CIDR for inter-branch traffic to route via the VPN.

Answer

The route tables in the branch subnets do not have routes to the Client VPN endpoint

Answer

The Client VPN endpoint is configured with a CIDR that overlaps with the branch subnets

Answer

The security group for the Client VPN endpoint does not allow inbound traffic from branch subnets

Question 15

A global e-commerce company uses AWS CloudFront to distribute content. They have an origin behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTPS traffic from CloudFront's IP ranges. Users in some regions report slow loading times. The company wants to reduce latency and improve performance. They are considering using Lambda@Edge and origin failover. However, they also notice that the ALB is receiving traffic directly from some IPs that are not CloudFront IPs, causing unnecessary load. What should a network engineer do to restrict access to the ALB to only CloudFront?

Accepted Answer

Update the ALB security group to allow inbound HTTPS only from the CloudFront managed prefix list. The ALB security group can be configured to allow inbound HTTPS traffic only from the AWS-managed prefix list for CloudFront. This prefix list contains all current CloudFront IP ranges and is automatically updated by AWS, ensuring that only CloudFront can reach the ALB. This is the most direct and secure method to restrict access at the network layer.

Answer

Use AWS WAF to block requests that do not come from CloudFront IPs

Answer

Configure the ALB to require a custom header (e.g., X-Origin-Verify) and validate it in the origin

Answer

Set up a VPC endpoint for CloudFront to route traffic privately