Task 2.1: Implement Routing and Connectivity Between On-Premises Networks and the AWS Cloud ANS-C01 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of enabling route propagation on a virtual private gateway (VGW) attached to a VPC?

   • ATo enable DNS resolution between VPCs
   • BTo allow the VPC to send traffic to the internet
   • CTo automatically add routes to the VPC route table from the VPN connection
   • DTo automatically create a peering connection
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has an on-premises data center with a 1 Gbps internet connection and needs to connect it to a single VPC in us-east-1. The workload is not latency-sensitive and can tolerate brief interruptions. The network team wants the simplest configuration that provides redundant connectivity without requiring additional physical infrastructure. What should they do?

   • ACreate one Site-to-Site VPN connection with two tunnels using a single customer gateway and a single virtual private gateway.
   • BProvision a Direct Connect connection with a private VIF and a VPN as a backup.
   • CCreate two Site-to-Site VPN connections, each with two tunnels, using two customer gateways and two virtual private gateways.
   • DCreate two separate VPC peering connections to the on-premises network.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has a VPC with private subnets that host application servers. These servers need outbound internet access for software updates but must not be reachable from the internet. The VPC has a Site-to-Site VPN to the on-premises network, and the on-premises network advertises a default route (0.0.0.0/0) over BGP. What should the network team do to ensure the application servers can reach the internet?

   • AAdd a NAT gateway in a public subnet and add a route in the private subnet route table for 0.0.0.0/0 to the NAT gateway.
   • BRemove the propagated default route from the VPN and rely on the on-premises network for internet access.
   • CConfigure the instances with a public IP address and add a route to the internet gateway.
   • DAdd an internet gateway to the VPC and add a route in the private subnet route table for 0.0.0.0/0 to the internet gateway.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is using a Transit Gateway to connect two VPCs (VPC-A and VPC-B) and an on-premises network via a Site-to-Site VPN. The on-premises network advertises 10.0.0.0/8 over BGP. VPC-A has a route table that propagates from the TGW attachment, and VPC-B has a route table that propagates from the TGW attachment. The company wants VPC-A to be able to reach the on-premises network, but VPC-B should NOT be able to reach the on-premises network. VPC-A and VPC-B should still be able to communicate with each other. What is the most efficient way to achieve this?

   • AUse VPC peering between VPC-A and VPC-B and keep the VPN attachment only in VPC-A's route table.
   • BCreate a network ACL in VPC-B that blocks traffic to 10.0.0.0/8.
   • CCreate a single TGW route table and add a static route for 10.0.0.0/8 pointing to the VPN attachment, then remove the propagation from VPC-B's attachment.
   • DCreate two TGW route tables. One route table has the VPN attachment and VPC-A attachment, and the other has only the VPC-B attachment. Associate VPC-A with the first and VPC-B with the second.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which component of an AWS Transit Gateway is used to connect a VPC to the transit gateway?

   • AVirtual interface
   • BRoute table
   • CVPC attachment
   • DPeering connection
   Reveal Solution Discussion Select an answer first