ANS-C01 Network Implementation Practice Test 9 — 15 Questions

Question 1

A company uses AWS Client VPN for remote access. Users report intermittent disconnections. The network engineer notices that the Client VPN endpoint is associated with a single subnet. What change should be made to improve reliability?

Accepted Answer

Associate the Client VPN endpoint with subnets in at least two Availability Zones.. Option C is correct because associating the Client VPN endpoint with subnets in multiple AZs provides high availability. Option A is wrong because increasing subnet size does not improve availability. Option B is wrong because multiple route tables are not needed; Client VPN uses one route table per subnet association. Option D is wrong because splitting the CIDR does not add redundancy.

Answer

Split the client CIDR into smaller ranges for each Availability Zone.

Answer

Create multiple route tables for the same subnet.

Answer

Increase the subnet CIDR size to accommodate more clients.

Question 2

A company has a VPC with both IPv4 and IPv6 CIDRs. They need to allow outbound IPv6 traffic from private subnets to the internet. What should they use?

Accepted Answer

An egress-only internet gateway.. Option B is correct because an egress-only internet gateway allows outbound IPv6 traffic from private subnets while preventing inbound traffic. Option A is wrong because NAT gateway is for IPv4 only. Option C is wrong because internet gateway allows inbound traffic. Option D is wrong because the prefix list is for route targets, not a device.

Answer

An internet gateway attached to the VPC.

Answer

A customer-managed prefix list.

Answer

A NAT gateway in a public subnet.

Question 3

Which TWO of the following are requirements for establishing an AWS Direct Connect private virtual interface? (Choose two.)

Accepted Answer

A BGP session between the customer router and the AWS device.. Options A and C are correct. A: You need a VLAN ID that matches on both sides. C: BGP session is required for routing. B is wrong because you can use a private virtual interface without a public ASN; private ASNs are allowed. D is wrong because public virtual interfaces are for public services. E is wrong because Jumbo frames are optional.

Answer

Jumbo frames support (MTU 9001).

Answer

A public IP address for the VIF.

Answer

A public BGP ASN.

Question 4

Which THREE of the following are valid considerations when designing a multi-VPC architecture using AWS Transit Gateway? (Choose three.)

Accepted Answer

You can route internet-bound traffic from multiple VPCs through a single shared VPC with a NAT gateway.. Options A, D, and E are correct. A: Transit Gateway supports transitive routing, but route tables control which VPCs can communicate. B is wrong because each VPC needs a unique CIDR to avoid routing conflicts. C is wrong because Transit Gateway supports multicast. D is correct: you can attach Direct Connect Gateway to Transit Gateway for on-premises connectivity. E is correct: you can centralize internet access via a NAT gateway in a shared VPC.

Answer

Transit Gateway does not support multicast traffic.

Answer

VPCs attached to the same Transit Gateway can have overlapping CIDR blocks.

Question 5

Which TWO of the following are true about AWS VPC endpoints? (Choose two.)

Accepted Answer

Gateway Endpoints can be used to access Amazon S3 and DynamoDB.. Options B and D are correct. A is wrong because Gateway Endpoint does not use PrivateLink; it uses route table entries. C is wrong because Interface Endpoints are not free; you pay per hour and per GB processed. B: Gateway Endpoints support S3 and DynamoDB. D: Interface Endpoints are powered by PrivateLink.

Answer

Interface Endpoints are free of charge.

Answer

Gateway Endpoints use AWS PrivateLink.

Answer

Both Gateway and Interface Endpoints require a NAT gateway.

Question 6

A company is deploying a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer (ALB), and the application tier runs on EC2 instances that connect to an RDS MySQL Multi-AZ DB instance. The application tier must be isolated from the internet and only accessible from the web tier. Which network implementation meets these requirements with the LEAST administrative overhead?

Accepted Answer

Place the web tier in a public subnet and the application tier in a private subnet, and configure security groups to allow inbound traffic to the application tier only from the web tier's security group.. Option C is correct because placing the web tier in a public subnet and the application tier in a private subnet with security groups allowing traffic only from the web tier is the standard design for multi-tier web applications with minimal overhead. Option A is wrong because using a network ACL alone would not isolate the application tier from the internet; a private subnet is needed. Option B is wrong because a NAT gateway is unnecessary for outbound access from the application tier (not required) and adds cost. Option D is wrong because using a different VPC and VPC peering adds complexity.

Answer

Create two VPCs: one for the web tier with a public subnet, and one for the application tier with a private subnet, and connect them using VPC peering.

Answer

Place the web tier in a public subnet and the application tier in a private subnet with a NAT gateway for outbound access, and use security groups to allow traffic from the web tier.

Answer

Place both tiers in the same public subnet, and use a network ACL to restrict traffic from the web tier to the application tier.

Question 7

A company is implementing a hybrid network architecture with AWS Direct Connect and a VPN backup. The company has two Direct Connect connections from different providers terminating at two AWS Direct Connect locations, each connecting to a separate AWS Transit Gateway in the same region. The VPCs are attached to both transit gateways. The company needs to ensure that traffic from on-premises to VPCs uses the primary Direct Connect connection when available and fails over to the secondary Direct Connect connection, then to the VPN. How should the company configure routing to achieve this?

Accepted Answer

Configure BGP AS_PATH prepending on the secondary Direct Connect and VPN connections to make them less preferred than the primary Direct Connect.. Option A is correct because adjusting BGP attributes like AS_PATH prepending on the secondary Direct Connect and VPN connections will influence path selection, with the VPN having the longest AS_PATH. Option B is wrong because static routes cannot be used with Direct Connect; BGP is required. Option C is wrong because disabling route propagation on the VPN would not affect Direct Connect failover order. Option D is wrong because equal-cost multipath (ECMP) would load balance, not provide failover priority.

Answer

Disable route propagation from the VPN to the transit gateway route tables, and rely on the Direct Connect connections only.

Answer

Configure equal-cost multipath (ECMP) routing across all three connections to load balance traffic.

Answer

Use static routes in the transit gateway route tables with higher metric values for the secondary Direct Connect and VPN.

Question 8

A company is setting up AWS Client VPN to allow remote employees to access resources in a VPC. The VPC has a CIDR block of 10.0.0.0/16. The Client VPN endpoint is associated with a subnet 10.0.1.0/24. The company wants to assign client IP addresses from a different CIDR range than the VPC to avoid overlap. Which client CIDR range should the company specify?

Accepted Answer

192.168.0.0/16. Option B is correct because the client CIDR range must be different from the VPC CIDR and any connected networks. 192.168.0.0/16 is a valid private range that does not overlap with 10.0.0.0/16. Option A overlaps with the VPC CIDR. Option C is a public range, not recommended. Option D overlaps with the VPC CIDR.

Answer

172.16.0.0/12

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 9

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to download patches from the internet. The company wants to minimize costs while ensuring high availability. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in a public subnet in each Availability Zone and configure route tables for private subnets to use the NAT gateway in the same AZ.. Option D is correct because two NAT gateways (one per AZ) provide high availability, and each is placed in a public subnet. Option A is wrong because a single NAT gateway is a single point of failure. Option B is wrong because NAT instances are less reliable and require more management. Option C is wrong because a NAT gateway in one AZ provides no cross-AZ high availability if that AZ fails.

Answer

Create a NAT gateway in one public subnet and use a second NAT gateway in a different AZ as a backup, but only route traffic to the primary.

Answer

Create a NAT gateway in one public subnet and configure route tables for private subnets to use it.

Answer

Launch a NAT instance in one public subnet and configure route tables for private subnets to use it.

Question 10

A company has an AWS Direct Connect connection with a private VIF to a VPC. The VPC has multiple subnets across two Availability Zones. The company wants to use the Direct Connect connection as the primary path for all traffic from on-premises to the VPC, and use a Site-to-Site VPN as a backup. The on-premises router is configured to advertise a default route via BGP over the Direct Connect, and the VPN also advertises a default route. Which configuration ensures that the Direct Connect path is preferred over the VPN?

Accepted Answer

Configure AS_PATH prepending on the VPN BGP advertisements from the on-premises router to make the VPN path longer.. Option C is correct because by default, BGP routes from Direct Connect have a lower MED if not set, but the VPN may also have lower metrics. The most reliable way is to prepend AS_PATH on the VPN BGP advertisements to make them less preferred. Option A is wrong because local preference is typically set on the router, not in AWS. Option B is wrong because decreasing the MED on the Direct Connect side would make it more preferred, but it's not a standard approach; AS_PATH prepending is more straightforward. Option D is wrong because disabling route propagation on the VPN route table would prevent the VPN routes from being used at all, but does not affect the BGP path selection.

Answer

Disable route propagation from the VPN in the VPC route tables to ensure Direct Connect routes take precedence.

Answer

Set a higher local preference on the Direct Connect BGP session on the on-premises router.

Answer

Decrease the Multi-Exit Discriminator (MED) value on the Direct Connect BGP advertisements from AWS.

Question 11

A company is deploying a VPC with IPv6 support. The VPC has a CIDR block of 10.0.0.0/16 and an assigned IPv6 CIDR block of 2600:1f16:xxxx:xxxx::/56. The company wants EC2 instances in a public subnet to be able to communicate with the internet using IPv6. Which configuration is necessary?

Accepted Answer

Attach an egress-only internet gateway to the VPC and add a route for ::/0 to the egress-only internet gateway in the public subnet route table.. Option A is correct because an egress-only internet gateway allows outbound IPv6 traffic from EC2 instances while preventing inbound connections, similar to a NAT gateway for IPv4. Option B is wrong because an internet gateway with route 0.0.0.0/0 is for IPv4. Option C is wrong because NAT64 is for translating IPv6 to IPv4, not required here. Option D is wrong because a NAT gateway is for IPv4 only.

Answer

Attach a NAT gateway to the VPC and add a route for ::/0 to the NAT gateway in the public subnet route table.

Answer

Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the internet gateway in the public subnet route table.

Answer

Set up a NAT64 translation service to convert IPv6 requests to IPv4.

Question 12

A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?

Accepted Answer

Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.. Option C is correct because using a Gateway Load Balancer with the firewall appliance in a separate subnet and configuring route tables with a route to the GWLBe endpoint for inter-subnet traffic is the recommended pattern. Option A is wrong because a security group cannot route traffic; it only filters. Option B is wrong because a network ACL is stateless and not suitable for stateful inspection. Option D is wrong because a transit gateway with appliance mode could work but is more complex than GWLB.

Answer

Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.

Answer

Place the firewall in a separate subnet and use network ACLs to force traffic through it.

Answer

Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.

Question 13

A company has multiple VPCs connected via AWS Transit Gateway. Each VPC has its own route table in the transit gateway. The company wants to restrict traffic between certain VPCs. For example, VPC A should be able to send traffic to VPC B but not to VPC C. VPC B should be able to send traffic to VPC C. Which configuration should the company use?

Accepted Answer

Create separate transit gateway route tables for each VPC and add only the desired routes for other VPCs.. Option C is correct because each VPC has its own route table, and you can add routes for specific VPC attachments. By not adding a route for VPC C in VPC A's route table, traffic is blocked. Option A is wrong because a single shared route table would allow all VPCs to communicate. Option B is wrong because network ACLs are not applied at transit gateway attachments. Option D is wrong because security groups are not used for inter-VPC routing decisions.

Answer

Use network ACLs on the transit gateway attachments to filter traffic.

Answer

Use security groups on the VPC attachments to allow or deny traffic.

Answer

Create a single transit gateway route table and associate all VPC attachments with it.

Question 14

A company is setting up a Site-to-Site VPN connection to AWS. The customer gateway device is behind a NAT device that performs address translation. Which tunnel option must be enabled to ensure the VPN tunnel establishes correctly?

Accepted Answer

NAT Traversal (NAT-T). Option A is correct because NAT traversal (NAT-T) is required when the customer gateway is behind a NAT device to encapsulate IPsec packets in UDP. Option B is wrong because dead peer detection is for monitoring, not for NAT. Option C is wrong because perfect forward secrecy is a security feature. Option D is wrong because IKEv2 is a protocol version, not specifically for NAT traversal.

Answer

Perfect Forward Secrecy (PFS)

Answer

Dead Peer Detection (DPD)

Answer

IKEv2

Question 15

A company is designing a VPC with a public subnet and a private subnet. The private subnet hosts an RDS database, and the public subnet hosts a web server. The web server needs to access the database. Which TWO of the following are required to allow the web server to connect to the database?

Accepted Answer

An inbound rule in the database's security group that references the web server's security group.. Option B is correct because a security group on the database must allow inbound traffic from the web server's security group. Option D is correct because the private subnet route table does not need a route to the internet gateway, but it must have a route to the NAT gateway or VPC peering if needed, but for database access, no route to internet is needed. However, the question asks for required components. Actually, to allow the web server to connect to the database, you need a security group rule on the database allowing the web server's security group, and you need the private subnet to have a route to the public subnet's CIDR via the local route (already present). So the correct options are B and C? Wait, let's analyze: A is not required because you can use security group IDs. B is required. C is required because the private subnet must have a route to the public subnet's CIDR (which is local and automatically added). D is not required because internet gateway is not needed for private subnet to communicate within VPC. E is not required because NAT gateway is for internet access. So the two correct are B and C. But C says "A route table associated with the private subnet that includes a route to the internet gateway" which is wrong. I need to correct the options. Let me rephrase:

Answer

An inbound rule in the database's security group that allows traffic from the web server's private IP address.

Answer

An internet gateway attached to the VPC.

Answer

A NAT gateway in the public subnet.