ANS-C01 Network Implementation Practice Test 9 — 15 Questions

Question 1

A company is deploying an AWS Client VPN endpoint to provide remote access to its VPC resources. The company wants to allow clients to access resources in multiple subnets within the VPC. Which TWO configurations are necessary?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate the Client VPN endpoint with subnets in the VPC.. Associating the Client VPN endpoint with subnets in the VPC is required to establish the network connectivity between the VPN clients and the VPC. The Client VPN endpoint uses elastic network interfaces in the associated subnets to route traffic from clients into the VPC. Without this association, the endpoint cannot forward traffic to VPC resources.

Answer

Configure route tables in the VPC to direct traffic to the Client VPN endpoint.

Answer

Attach the VPC to a transit gateway.

Answer

Configure security groups on the target subnets.

Question 2

A network engineer runs the above command to list VPC endpoints. The engineer notices that the second endpoint (vpce-0b2c3d4e5f6g7h8i9) does not have a policy document displayed. What does this indicate?

Accepted Answer

The endpoint has the default full-access policy.. When a VPC endpoint is created without a custom policy document, AWS automatically applies a default full-access policy that allows all principals to perform all actions on all resources through the endpoint. The AWS CLI command `describe-vpc-endpoints` omits the policy field when the default policy is in effect, because the default policy is not stored as a separate document; it is an implicit behavior of the endpoint. Therefore, the absence of a policy document in the output indicates the endpoint is using the default full-access policy, making option D correct.

Answer

The endpoint is configured to use an AWS managed policy that is not shown.

Answer

The endpoint is not active and needs to be recreated.

Answer

The endpoint is for DynamoDB, which does not support endpoint policies.

Question 3

A network engineer runs the above command and sees an ENI (eni-0a1b2c3d4e5f6g7h8) with status 'in-use' but no InstanceId attached. What AWS service is most likely using this ENI?

Accepted Answer

An Amazon RDS database instance.. An Amazon RDS database instance uses an Elastic Network Interface (ENI) as its primary network interface, and when the RDS instance is in a 'stopped' or 'failed' state, the ENI may remain in 'in-use' status without an InstanceId attached. This is because RDS manages its own ENI independently of EC2 instances, and the ENI persists even when the database instance is not running.

Answer

A VPC endpoint (Interface type).

Answer

A NAT gateway.

Answer

An AWS Transit Gateway.

Question 4

A network engineer examines the route table above. The VPC has a CIDR of 10.0.0.0/16. There is a VPC peering connection (pcx-...) to a VPC with CIDR 192.168.0.0/16. However, instances in this route table's subnet cannot communicate with the peered VPC. What is the most likely cause?

Accepted Answer

The security group or network ACL in the source subnet is blocking traffic.. The route table shown includes a route for the peered VPC (192.168.0.0/16 via pcx-...), and the route table is associated with the subnet (implied by the question stating 'this route table's subnet'). Since routing is in place, the most likely remaining cause is that a security group (stateful, blocking inbound/outbound traffic) or a network ACL (stateless, blocking inbound/outbound traffic) is filtering the traffic between the subnets. Security groups and network ACLs operate at the instance and subnet level respectively, and misconfigured rules can prevent communication even when routes are correct.

Answer

The route table is not associated with the subnet.

Answer

The VPC peering connection is in 'pending-acceptance' state.

Answer

The route to the peered VPC is missing from the route table.

Question 5

A company is deploying a VPC with public and private subnets in two Availability Zones. The public subnets are used for NAT gateways and an Application Load Balancer (ALB). The private subnets host EC2 instances running a web application. What is the most cost-effective and highly available configuration for internet access from the private instances?

Accepted Answer

Deploy a NAT gateway in each public subnet and configure private route tables with a default route to the NAT gateway in the same AZ.. Deploying a NAT gateway in each public subnet (one per Availability Zone) ensures that private instances in each AZ can route outbound traffic through a NAT gateway in the same AZ, providing both high availability (no single point of failure) and cost efficiency (no cross-AZ data transfer charges). This configuration uses the default route (0.0.0.0/0) in the private route tables pointing to the NAT gateway in the same AZ, which avoids the per-GB data transfer costs that would occur if traffic crossed AZs to reach a single NAT gateway.

Answer

Create a single NAT gateway in one public subnet and route all private traffic to it.

Answer

Attach an internet gateway to the VPC and add a default route to it in the private subnets.

Answer

Launch a NAT instance in each public subnet and configure the private route tables.

Question 6

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The VPC uses a virtual private gateway (VGW). The on-premises network advertises a route to a specific subnet (10.0.0.0/24) via BGP. However, traffic from the VPC to that subnet is failing. What should the network engineer check first?

Accepted Answer

Verify that route propagation is enabled on the VPC's route tables associated with the subnets.. The most common cause of traffic failure from a VPC to an on-premises subnet over Direct Connect is that the VPC route tables do not have a route for the on-premises subnet. Even if the VGW is attached and BGP is established, the VPC subnets must have route propagation enabled on their route tables to automatically learn the routes advertised by the on-premises network via BGP. Without this, the VPC has no path to send traffic to the 10.0.0.0/24 subnet.

Answer

Verify that the customer gateway device is advertising the subnet route.

Answer

Verify that the virtual interface is in the 'available' state and BGP session is established.

Answer

Verify that the VGW is attached to the VPC.

Question 7

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to inspect traffic between VPCs using a centralized network virtual appliance (NVA) in a security VPC. What is the most scalable and highly available design to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway, use separate route tables for inspection, and deploy NVAs behind a Gateway Load Balancer in the security VPC.. It uses Transit Gateway with separate route tables to isolate inspection traffic, and deploys NVAs behind a Gateway Load Balancer (GWLB) in the security VPC. GWLB provides automatic scaling and health checks across multiple NVAs, ensuring high availability and scalability for inter-VPC traffic inspection without introducing a single point of failure or manual routing complexity.

Answer

Place a single NVA in the Transit Gateway and route all inter-VPC traffic through it.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure the NVAs to route traffic.

Answer

Use Direct Connect to connect all VPCs to a central location and route through NVAs there.

Question 8

A company has a VPC with private subnets that use a NAT gateway for outbound internet access. The NAT gateway is in a public subnet with an Elastic IP. Users report that some applications are failing to connect to external services. Network engineers confirm that the NAT gateway is in the 'available' state and the route tables have a default route (0.0.0.0/0) pointing to the NAT gateway. What is the most likely cause?

Accepted Answer

The network ACL for the public subnet is blocking inbound traffic on ephemeral ports.. The network ACL for the public subnet is blocking inbound traffic on ephemeral ports. When a private instance initiates outbound traffic through the NAT gateway, the NAT gateway sends the traffic to the internet and expects return traffic on high-numbered ephemeral ports (1024–65535). If the public subnet's network ACL blocks inbound traffic on these ports, the return traffic cannot reach the NAT gateway, causing asymmetric routing and connection failures. The NAT gateway itself is available and the route tables are correctly configured, so the issue lies in the stateful nature of security groups versus the stateless nature of network ACLs.

Answer

The security group for the private instances is blocking outbound traffic.

Answer

The NAT gateway has reached its connection limit.

Answer

The route table for the private subnets is missing a route to the internet gateway.

Question 9

A company is designing a multi-region architecture with two AWS Regions. They need to connect VPCs in each region to an on-premises data center using AWS Direct Connect. They want to minimize latency and use the same BGP ASN on both sides. Which solution meets these requirements?

Accepted Answer

Use a Direct Connect gateway and create a private virtual interface from each region's Direct Connect connection to the Direct Connect gateway. Use the same BGP ASN on AWS side.. A Direct Connect gateway allows you to associate private virtual interfaces from multiple regions, enabling a single BGP ASN to be used on the AWS side across all connections. This minimizes latency by providing direct, private connectivity from each region to the on-premises data center without traversing the public internet. The ability to use the same BGP ASN on both sides is supported because the Direct Connect gateway presents itself as a single BGP speaker, avoiding ASN conflicts.

Answer

Establish two separate private virtual interfaces from each region to the on-premises router using different BGP ASNs.

Answer

Use AWS Site-to-Site VPN over the internet as a backup and the Direct Connect as primary.

Answer

Create a transit virtual interface from each region to a Transit Gateway in each region and peer the Transit Gateways.

Question 10

A company wants to allow an EC2 instance in a private subnet to download files from an S3 bucket without traversing the internet. Which AWS service should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. It uses prefix lists and route table entries to direct S3 traffic to the endpoint, avoiding the need for NAT gateways or internet gateways.

Answer

Establish an AWS Direct Connect connection to the VPC.

Answer

Attach an internet gateway and route through a NAT gateway.

Answer

Create a VPC Interface Endpoint for S3.

Question 11

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to another VPC (192.168.0.0/16) using VPC peering. Both VPCs have overlapping CIDRs with some on-premises networks. What must be done to ensure proper routing?

Accepted Answer

Verify that the CIDR blocks do not overlap. If they do, you must re-IP one VPC or use other solutions like Transit Gateway with network address translation.. VPC peering requires non-overlapping CIDR blocks because AWS uses the destination CIDR to route traffic; if the CIDRs overlap, the route tables cannot distinguish between the two VPCs, causing asymmetric routing or dropped traffic. Option B correctly identifies that overlapping CIDRs must be resolved, either by re-IPing one VPC or using Transit Gateway with NAT capabilities to translate addresses and avoid conflicts.

Answer

Use AWS Transit Gateway instead and attach both VPCs.

Answer

Use a NAT gateway in one VPC to translate addresses.

Answer

Create the peering connection and add routes for the full CIDR ranges in both route tables.

Question 12

A company uses AWS Client VPN for remote access. Users report intermittent disconnections. The network engineer notices that the Client VPN endpoint is associated with a single subnet. What change should be made to improve reliability?

Accepted Answer

Associate the Client VPN endpoint with subnets in at least two Availability Zones.. Associating the Client VPN endpoint with subnets in at least two Availability Zones provides high availability for the VPN tunnel endpoints. If a single subnet (and its underlying AZ) fails or experiences network issues, the Client VPN endpoint can still route traffic through the other AZ's subnet, preventing the intermittent disconnections users are experiencing.

Answer

Split the client CIDR into smaller ranges for each Availability Zone.

Answer

Create multiple route tables for the same subnet.

Answer

Increase the subnet CIDR size to accommodate more clients.

Question 13

A company has a VPC with both IPv4 and IPv6 CIDRs. They need to allow outbound IPv6 traffic from private subnets to the internet. What should they use?

Accepted Answer

An egress-only internet gateway.. An egress-only internet gateway (EIGW) is a horizontally scaled, redundant VPC component that allows outbound IPv6 traffic from instances in a VPC to the internet, while preventing the internet from initiating an IPv6 connection to those instances. It is specifically designed for IPv6 traffic and must be used with a route table entry that directs all outbound IPv6 traffic (::/0) to the EIGW. Unlike an internet gateway, an EIGW does not support inbound IPv6 connections, making it the correct choice for private subnets that need outbound-only IPv6 internet access.

Answer

An internet gateway attached to the VPC.

Answer

A customer-managed prefix list.

Answer

A NAT gateway in a public subnet.

Question 14

Which TWO of the following are requirements for establishing an AWS Direct Connect private virtual interface? (Choose two.)

Accepted Answer

A BGP session between the customer router and the AWS device.. A BGP session between the customer router and the AWS device is a fundamental requirement for establishing a private virtual interface. The private VIF uses BGP to exchange routing information (typically a /30 or /31 subnet) between the on-premises network and the VPC, enabling dynamic route advertisement and failover. Without this BGP session, the VIF cannot be activated or used for traffic.

Answer

Jumbo frames support (MTU 9001).

Answer

A public IP address for the VIF.

Answer

A public BGP ASN.

Question 15

Which THREE of the following are valid considerations when designing a multi-VPC architecture using AWS Transit Gateway? (Choose three.)

Accepted Answer

You can route internet-bound traffic from multiple VPCs through a single shared VPC with a NAT gateway.. AWS Transit Gateway allows you to centralize internet-bound traffic by routing it from multiple VPCs through a single shared VPC that contains a NAT gateway. This design reduces costs and simplifies management by avoiding the need for a separate NAT gateway in each VPC, as the Transit Gateway can propagate routes to direct traffic to the shared VPC's NAT gateway for egress to the internet.

Answer

Transit Gateway does not support multicast traffic.

Answer

VPCs attached to the same Transit Gateway can have overlapping CIDR blocks.