Network Implementation — ANS-C01 Practice Quiz

Question 1

A company runs a payment processing API behind a Network Load Balancer (NLB) with targets registered by instance ID across three Availability Zones. The security team requires that the backend EC2 instances see the original client source IP addresses in their application logs. Additionally, the operations team reports that traffic is being distributed unevenly — some AZs receive far more connections than others, causing hot spots. The NLB currently has cross-zone load balancing disabled. Which combination of actions will preserve original client IPs AND resolve the uneven traffic distribution?

Accepted Answer

Keep the targets registered by instance ID (which preserves client IP by default for NLB) and enable cross-zone load balancing on the NLB.

Answer

Re-register the targets by IP address and enable client IP preservation via a target group attribute, then leave cross-zone load balancing disabled.

Answer

Enable proxy protocol v2 on the target group and configure Route 53 weighted records pointing at each AZ's NLB node to balance traffic.

Answer

Place an Application Load Balancer in front of the NLB, enable the X-Forwarded-For header, and turn on cross-zone load balancing on the ALB.

Question 2

A company runs three microservices behind a single Application Load Balancer using the domain shop.example.com. Requests to /api/orders must reach the orders service, /api/inventory must reach the inventory service, and all other paths must reach a default web frontend service. Each service runs in its own target group. The networking team must implement this routing with the fewest ALB resources while ensuring unmatched requests always land on the frontend. Which configuration meets these requirements?

Accepted Answer

On a single HTTPS listener, add path-based routing rules for /api/orders and /api/inventory pointing to their target groups, and set the listener's default action to forward to the frontend target group.

Answer

Create three separate ALBs, one per target group, and use Route 53 weighted records to distribute traffic among them.

Answer

Create one listener rule per target group using host-based conditions on shop.example.com, and rely on rule priority to break ties for unmatched paths.

Answer

Use a single listener with a fixed-response default action and add path-based rules for all three services including the frontend.

Question 3

A retail company runs a production web application behind an Application Load Balancer. The platform team wants to perform blue/green deployments by gradually shifting a percentage of live traffic from the current version (green) to a new version (blue) on the same listener, monitoring error rates before completing the cutover. Both versions are registered in separate target groups. What is the correct way to configure the ALB to shift a controlled percentage of traffic between the two versions?

Accepted Answer

Create a single listener rule with a forward action that references both target groups and assigns weights to each, adjusting the weights incrementally to shift traffic.

Answer

Create two separate listeners on different ports and use Route 53 weighted records to distribute traffic between the listener endpoints.

Answer

Register both versions' instances in a single target group and rely on the ALB round-robin algorithm to distribute traffic proportionally.

Answer

Configure a host-based routing rule that sends a fixed subset of hostnames to the blue target group and the remainder to green.

Question 4

A company has a single 10 Gbps dedicated Direct Connect connection at an AWS Direct Connect location, terminating on one physical port. Traffic to AWS has grown, and the network team wants to increase available bandwidth to 20 Gbps while presenting the connection to their router as a single logical interface for simpler management. They also want the ability to add more connections later without reconfiguring VIFs. Which approach meets these requirements?

Accepted Answer

Create a Link Aggregation Group (LAG) using LACP, bundle two 10 Gbps dedicated connections at the same Direct Connect location, and migrate the existing VIFs onto the LAG.

Answer

Provision a second 10 Gbps dedicated connection and configure ECMP across the two connections by advertising the same prefixes over separate BGP sessions on each private VIF.

Answer

Request a hosted connection from a Direct Connect partner and rely on the partner's edge to aggregate bandwidth automatically.

Answer

Enable jumbo frames (9001 MTU) on the existing 10 Gbps connection to effectively double usable throughput.

Question 5

A company has a single production VPC that needs private connectivity to its on-premises data center over an existing 1 Gbps Direct Connect connection. The networking team wants the simplest configuration that provides private, low-latency access to resources in that one VPC and does not require any additional AWS routing constructs beyond what is strictly necessary. Which implementation should the team use?

Accepted Answer

Create a private virtual interface (VIF) on the Direct Connect connection and associate it with a virtual private gateway (VGW) attached to the VPC.

Answer

Create a transit virtual interface (VIF) on the Direct Connect connection and associate it with a Direct Connect gateway connected to a Transit Gateway that attaches the VPC.

Answer

Create a public virtual interface (VIF) on the Direct Connect connection and route VPC traffic to it using an internet gateway.

Answer

Create a hosted connection with a private VIF and associate it directly with the VPC route table without any gateway.

Question 6

A media company runs an on-premises rendering farm connected to AWS through a 10 Gbps Direct Connect connection. They currently upload large render outputs to an Amazon S3 bucket in us-east-1 over the public internet, but want the traffic to traverse the Direct Connect link instead to reduce cost and improve consistency. The workload must reach S3 and other AWS public service endpoints without going through a VPC. Which Direct Connect configuration meets this requirement?

Accepted Answer

Create a public virtual interface (VIF) on the Direct Connect connection and advertise the on-premises prefixes over BGP.

Answer

Create a private virtual interface (VIF) associated with a virtual private gateway attached to a VPC that has an S3 gateway endpoint.

Answer

Create a transit virtual interface (VIF) attached to a Transit Gateway and add a route to the S3 prefix list.

Answer

Create an interface VPC endpoint (PrivateLink) for S3 and route the private VIF traffic through it.

Question 7

A retail company has two Direct Connect locations, one in London and one in Frankfurt, each terminating a dedicated connection with a transit VIF attached to a separate Transit Gateway in eu-west-2 and eu-central-1. The company also has on-premises data centers connected at each Direct Connect location. The networking team wants traffic between the two on-premises data centers to flow directly across the AWS global backbone between the two Direct Connect locations, without traversing the customer's own WAN and without routing through a Transit Gateway. Which approach meets this requirement?

Accepted Answer

Enable SiteLink on the transit VIFs at both Direct Connect locations so the data centers can exchange routes over the AWS global network.

Answer

Create an inter-region Transit Gateway peering between the two Transit Gateways and advertise the on-premises prefixes across the peering.

Answer

Attach both transit VIFs to a single Direct Connect gateway and rely on the Direct Connect gateway to route between the two connections.

Answer

Provision a Site-to-Site VPN between the two customer gateways over public VIFs to bridge the two data centers.

Question 8

A company has a 10 Gbps Direct Connect connection at a single location. They need to provide private connectivity from their on-premises data center to five VPCs spread across three AWS accounts, all attached to a single Transit Gateway in one Region. They want to minimize the number of virtual interfaces they must provision and manage on the Direct Connect connection. Which approach meets these requirements?

Accepted Answer

Create a single transit VIF on the Direct Connect connection and associate it with a Direct Connect gateway that is associated with the Transit Gateway.

Answer

Create one private VIF per VPC and use VPC peering between the VPCs to share the connection.

Answer

Create a public VIF and route traffic to each VPC's public endpoints over the Direct Connect connection.

Answer

Create one private VIF per VPC and associate each with its own virtual private gateway attached to the respective VPC.

Question 9

A company runs a fleet of EC2 instances in a private subnet of a dual-stack VPC. The instances have both IPv4 and IPv6 addresses. For IPv4, they already reach the internet through a NAT gateway for software updates. The security team now requires that these instances be able to initiate outbound IPv6 connections to the internet (for example, to fetch packages from IPv6-enabled repositories) but must NOT be reachable from the internet over IPv6. Which configuration meets this requirement?

Accepted Answer

Add an egress-only internet gateway to the VPC and add a route for ::/0 pointing to it in the private subnet's route table.

Answer

Route IPv6 traffic through the existing NAT gateway by adding a ::/0 route pointing to the NAT gateway.

Answer

Attach a standard internet gateway and add a ::/0 route to it, then use security groups to block inbound IPv6.

Answer

Assign the instances IPv6 addresses from a BYOIP pool and rely on the default VPC route table to provide outbound-only access.

Question 10

A company operates a centralized security account containing a Gateway Load Balancer (GWLB) fronting a fleet of firewall appliances. Application teams in separate AWS accounts within the same AWS Organization must route their VPC egress traffic through this inspection fleet using Gateway Load Balancer endpoints (GWLBEs) deployed in each application VPC. The networking team wants application teams to be able to create GWLBEs in their own accounts that point to the centralized GWLB, while keeping the appliance fleet fully managed in the security account. What is the correct way to enable this cross-account architecture?

Accepted Answer

Create a VPC endpoint service backed by the GWLB in the security account, then share it with the application accounts by adding their account principals to the endpoint service allowed principals; application teams create GWLBEs referencing the service name.

Answer

Use AWS Resource Access Manager (RAM) to share the Gateway Load Balancer resource directly with the application accounts so they can attach GWLBEs to it.

Answer

Establish VPC peering between the security VPC and each application VPC, then add routes in the application route tables pointing at the peering connection to reach the GWLB.

Answer

Create a Transit Gateway attachment for the GWLB in the security account and share the Transit Gateway via RAM so application accounts can route traffic to the appliances.

Question 11

A company deploys a fleet of third-party firewall appliances behind a Gateway Load Balancer (GWLB) to inspect north-south traffic for a set of application VPCs. During testing, engineers observe that some TCP sessions inspected by the firewalls are being dropped intermittently, while others pass cleanly. Packet captures on the appliances show that return packets for the affected flows are arriving at a different appliance than the one that processed the initial forward packets. Which GWLB configuration change will resolve the dropped sessions?

Accepted Answer

Enable flow stickiness on the GWLB target group using an appropriate flow-hashing algorithm (5-tuple, 3-tuple, or 2-tuple) so both directions of a flow map to the same appliance.

Answer

Increase the health check interval on the GWLB target group so appliances are not marked unhealthy during inspection spikes.

Answer

Enable cross-zone load balancing on the GWLB so traffic is distributed evenly across appliances in all Availability Zones.

Answer

Switch the GWLB listener from the GENEVE protocol to TCP so the load balancer can track connection state per session.

Question 12

A company runs a fleet of third-party firewall appliances that must inspect all north-south traffic entering and leaving several application VPCs. The security team wants to centralize these appliances in a dedicated inspection VPC, scale them horizontally, and preserve flow symmetry so that both directions of a connection hit the same appliance. Application teams must not manage the appliances directly. Which implementation meets these requirements?

Accepted Answer

Deploy a Gateway Load Balancer in the inspection VPC fronting the appliances, expose it via a GWLB endpoint (Gateway Load Balancer Endpoint) in each application VPC, and route traffic through the endpoint using route tables.

Answer

Deploy a Network Load Balancer in front of the appliances and update application VPC route tables to point the default route at the NLB's private IP addresses.

Answer

Place the appliances behind an Application Load Balancer in the inspection VPC and use VPC peering plus security groups to force application traffic through the ALB.

Answer

Attach the appliances to a Transit Gateway and rely on TGW appliance-mode disabled routing to distribute connections across the appliance ENIs.

Question 13

A company runs a workload across three private subnets in three Availability Zones (AZ-a, AZ-b, AZ-c) within a single VPC. Instances in all three subnets need outbound internet access for software updates. The networking team initially deployed one NAT gateway in AZ-a's public subnet and pointed the route tables of all three private subnets to it. During a recent AZ-a service event, instances in AZ-b and AZ-c also lost outbound connectivity. The team wants to eliminate this cross-AZ dependency while following AWS best practices. What should they implement?

Accepted Answer

Deploy a NAT gateway in a public subnet in each of the three AZs, and update each private subnet's route table to send 0.0.0.0/0 to the NAT gateway in its own AZ.

Answer

Deploy two additional NAT gateways in AZ-a and configure the private subnet route tables to load balance across all three NAT gateways in AZ-a.

Answer

Replace the NAT gateway with a NAT instance in AZ-a and enable source/destination check so all AZs continue to route through it.

Answer

Attach an egress-only internet gateway to the VPC and route all three private subnets' 0.0.0.0/0 traffic to it.

Question 14

A media company runs a fleet of EC2 instances in private subnets that push telemetry to a single third-party analytics endpoint (one destination IP and port) over HTTPS. Traffic flows through a NAT gateway. During peak events, application logs show connection failures and the CloudWatch metric ErrorPortAllocation for the NAT gateway spikes above zero, even though bandwidth utilization is well below the NAT gateway's throughput limit. What is the MOST effective way to resolve these connection failures?

Accepted Answer

Deploy multiple NAT gateways across different subnets and distribute the private instances so their traffic uses different NAT gateways, increasing the pool of available source ports to the same destination.

Answer

Increase the NAT gateway's bandwidth by requesting a service quota increase for maximum throughput per NAT gateway.

Answer

Replace the NAT gateway with a NAT instance running on a larger instance type to raise the connection limit.

Answer

Enable cross-zone load balancing on the NAT gateway so connections are balanced across Availability Zones.

Question 15

A company runs a public HTTPS web application behind an Application Load Balancer (ALB) that they want to protect with AWS WAF. They also have a requirement from their security team: the backend EC2 instances must see the original client source IP addresses in the application logs for fraud analysis, without deploying any additional software on the instances. The ALB terminates TLS. Which approach meets both the WAF protection and original client IP requirements with the least operational overhead?

Accepted Answer

Associate the AWS WAF web ACL with the ALB and configure the application to read the X-Forwarded-For HTTP header for the original client IP.

Answer

Replace the ALB with a Network Load Balancer, enable client IP preservation on the target group, and attach the WAF web ACL to the NLB.

Answer

Keep the ALB, enable Proxy Protocol v2 on the target group, and associate the WAF web ACL with the ALB so the instances receive the TCP source IP.

Answer

Place a Gateway Load Balancer in front of the ALB, associate the WAF web ACL with the GWLB, and forward traffic transparently to preserve the source IP.

Question 16

A financial services company is deploying a payment processing API for external partners. Requirements: partners must whitelist a small set of static IP addresses in their firewalls; TLS termination must occur on the backend EC2 instances (not on the load balancer) because a hardware security module (HSM) integration is required; and the solution must support millions of concurrent connections with ultra-low latency. Which load balancing implementation meets all requirements?

Accepted Answer

Deploy a Network Load Balancer with a TCP listener on port 443, assign Elastic IPs per subnet, and forward traffic to an instance target group where TLS is terminated on the backend.

Answer

Deploy an Application Load Balancer with an HTTPS listener and import certificates into AWS Certificate Manager for TLS termination at the ALB.

Answer

Deploy a Network Load Balancer with a TLS listener so the NLB decrypts traffic before forwarding to the backend instances.

Answer

Deploy a Gateway Load Balancer with GENEVE encapsulation and forward decrypted traffic to backend appliances for TLS processing.

Question 17

A financial services company runs a high-throughput trading API behind a Network Load Balancer (NLB). Currently, the NLB uses a TCP listener on port 443 and passes encrypted traffic through to the EC2 backends, which perform TLS termination. The security team wants to centralize certificate management using AWS Certificate Manager (ACM) and reduce CPU load on the backend instances, while keeping the NLB (not an ALB) as the entry point to preserve ultra-low latency and static IP addresses. Which implementation meets these requirements?

Accepted Answer

Change the NLB listener to a TLS listener on port 443, attach an ACM certificate to the listener, and configure the target group to forward decrypted traffic to the backends over TCP.

Answer

Keep the TCP passthrough listener and install the ACM certificate directly on each EC2 instance using the ACM export feature.

Answer

Replace the NLB with an Application Load Balancer using an HTTPS listener and an ACM certificate, then place the ALB behind a Global Accelerator for static IPs.

Answer

Add a TLS listener to the NLB but configure the target group protocol as TLS so traffic is re-encrypted to the backends, offloading nothing from the instances.

Question 18

A company runs a fleet of custom UDP-based real-time telemetry servers behind a Network Load Balancer (NLB) in a single VPC. Operations reports that unhealthy backend instances continue to receive UDP traffic, causing packet loss for clients. The team confirms the target group protocol is set to UDP and instances are registered correctly. What is the MOST likely cause and appropriate fix?

Accepted Answer

UDP target groups cannot use UDP for health checks, so a separate TCP or HTTP health check port must be configured on the targets to detect and drain unhealthy instances.

Answer

NLB does not support UDP; migrate the listener and target group to an Application Load Balancer with a UDP listener.

Answer

Cross-zone load balancing must be disabled so the NLB only routes to healthy targets in the same Availability Zone.

Answer

Connection draining (deregistration delay) must be set to 0 seconds so unhealthy targets are removed immediately.

Question 19

A company hosts a critical web application in the us-east-1 Region behind an internet-facing Application Load Balancer (ALB), with a warm standby stack behind a second ALB in us-west-2. Both ALBs share the same domain name, app.example.com, in a public Route 53 hosted zone. The networking team must ensure that if the primary ALB in us-east-1 becomes unhealthy, DNS automatically directs users to the us-west-2 ALB, and that traffic returns to the primary once it recovers. Which Route 53 configuration meets these requirements?

Accepted Answer

Create two failover alias records for app.example.com: a PRIMARY record targeting the us-east-1 ALB with an associated health check, and a SECONDARY record targeting the us-west-2 ALB.

Answer

Create two weighted alias records for app.example.com with weights of 100 and 0, and attach a health check only to the weight-100 record.

Answer

Create a single multivalue answer record listing both ALB IP addresses with a health check on each value.

Answer

Create two latency-based alias records for app.example.com, one per Region, and attach a health check to the us-east-1 record only.

Question 20

A company operates a shared services VPC (Account A) that hosts internal APIs resolvable via the domain internal.example.com. Application teams run workloads in several VPCs spread across Account B and Account C. All VPCs are attached to a Transit Gateway and have non-overlapping CIDRs. The networking team wants every application VPC to resolve records in the internal.example.com private hosted zone using native Route 53, without deploying Resolver endpoints or running custom DNS servers. What is the correct way to implement this?

Accepted Answer

Associate the private hosted zone with each application VPC, using cross-account authorization (create-vpc-association-authorization in Account A, then associate-vpc from Accounts B and C).

Answer

Create Route 53 Resolver inbound endpoints in the shared services VPC and configure forwarding rules in each application VPC pointing to those endpoint IPs.

Answer

Enable DNS resolution and DNS hostnames on the Transit Gateway so private hosted zone records propagate automatically to all attached VPCs.

Answer

Convert the private hosted zone to a public hosted zone and rely on the VPC's default DNS resolver to answer queries privately over the Transit Gateway.

More ANS-C01 practice