2.0 Network Implementation ANS-C01 Practice Quiz

• A. Provide the LOA-CFA and confirm the port location, cross-connect details, optics, and speed settings
• B. Use a single hosted zone for both internet and split-horizon private records without separation
• C. Disable VPC route propagation and manage every prefix manually at scale
• D. Use ALB access logs as the primary source for VPC-internal east-west traffic analysis

The facility can complete the cross-connect only when the authorization, port assignment, and physical interface details align.

• A. End-to-end MTU compatibility across routers, VIFs, AWS paths, and instances
• B. Skip BFD and rely on default BGP keepalive timers for sub-second failover
• C. Use a single shared CDK app deployed manually for production and dev
• D. Advertise the same prefix from every BGP peer with identical attributes

Large frames work only when every segment in the data path supports the selected MTU.

• A. Treat AWS PrivateLink as a layer 3 routed mesh between VPCs
• B. A Direct Connect link aggregation group using compatible dedicated connections
• C. Use AWS Firewall Manager only after each account opts in individually with no central policy
• D. Use ACM-imported certificates without renewal monitoring or alerting

A link aggregation group combines supported Direct Connect circuits for a single logical bundle with greater aggregate capacity.

• A. Use an external CA without ACM Private CA for AWS-native certificate distribution
• B. Cross-connect status, optics, cabling, speed, duplex, and interface state
• C. Use a Site-to-Site VPN as the only path for sustained 10 Gbps throughput
• D. Use AWS PrivateLink to share full IP-level connectivity between two VPCs

A physical link failure is most likely corrected by verifying the facility patch, transceivers, and interface negotiation.

• A. Use sticky sessions to compensate for missing identity tokens in API calls
• B. Add the new CIDR to the VPN static routes and update corresponding on-premises routing
• C. Skip CloudFormation drift detection and trust manual change tickets
• D. Use a Direct Connect public VIF to reach a private VPC subnet

Static routing does not learn new prefixes automatically, so each side must include the new destination.

• A. Place the customer gateway IP inside the VPC CIDR range
• B. Choose subnets without ENA-supported instance types for high packet-per-second workloads
• C. VLAN tag, BGP peer addresses, ASN, authentication if used, and allowed prefixes
• D. Create a public hosted zone to serve only VPC-internal DNS queries

A VIF requires the logical VLAN and BGP parameters to match before route exchange can occur.

• A. Use the AWS CLI from a developer laptop as the production deployment automation tool
• B. Use an ALB host-based routing rule to load balance non-HTTP TCP services
• C. Provision redundant Direct Connect connections in separate locations with diverse customer equipment where possible
• D. Use Global Accelerator to reduce data egress charges to on-premises

Facility and equipment diversity reduces the chance that one site or router failure removes all private connectivity.

• A. Use AS_PATH prepending to make a path more preferred than its peer
• B. Use Route 53 Resolver outbound endpoints inside an isolated subnet without on-prem reachability
• C. Use DNS TTL values as a hybrid routing protocol
• D. Accept the hosted connection and create the required virtual interface

Hosted connectivity is not usable by the customer account until it is accepted and a VIF is configured.