ANS-C01 Mock Exam 91 — 25 Questions

Question 1

A company is expanding its on-premises network to AWS using Direct Connect and VPN backup. They have two Direct Connect connections from different providers to two different Direct Connect locations in the same region. They have configured a private virtual interface (VIF) on each connection to a virtual private gateway (VGW) attached to a VPC. They have also configured a VPN connection as a backup. The company uses BGP to advertise the on-premises prefixes to AWS. They want to ensure that traffic is load-balanced across both Direct Connect connections under normal conditions and that the VPN is used only if both Direct Connect connections fail. They also want to minimize the cost of data transfer. Which BGP configuration should they use?

Accepted Answer

Advertise the same prefixes over both Direct Connect connections with equal local preference, and prepend AS path on the VPN routes to make them less preferred. Option D is correct. By using BGP with equal local preference for both Direct Connect paths and AS_PATH prepending on the VPN routes, the VPN will be less preferred. To achieve active/active load balancing across Direct Connect connections, the company should advertise the same prefixes with equal MED or local preference. Option A is wrong because advertising different prefixes would not load-balance traffic. Option B is wrong because a single BGP session over one Direct Connect connection creates a single point of failure. Option C is wrong because increasing MED on one Direct Connect connection makes it less preferred, not equal.

Answer

Configure a single BGP session over both Direct Connect connections using the same virtual interface

Answer

Set a higher MED on one of the Direct Connect connections to make it the primary, and use the VPN as secondary

Answer

Advertise different on-premises prefixes over each Direct Connect connection and use the VPN for all traffic

Question 2

A media company is designing a network for a new AWS environment. They have a VPC with public and private subnets in three Availability Zones. In the private subnets, they run a fleet of Amazon EC2 instances that process video files from an Amazon S3 bucket. The S3 bucket is in the same region. The company wants to ensure that all traffic to S3 stays within the AWS network and does not traverse the internet. They also need to allow the EC2 instances to access the internet for software updates, but only through a centralized NAT gateway. Currently, there is one NAT gateway in AZ1. The network engineer has created a VPC endpoint for S3 (Gateway type) and associated it with the route tables for the private subnets. However, the EC2 instances in AZ2 and AZ3 cannot reach the NAT gateway for internet access. What is the most likely cause?

Accepted Answer

The route table for private subnets now has a more specific route for S3 that overrides the default route to the NAT gateway. Option B is correct. The Gateway VPC Endpoint for S3 adds a route in the private subnet route tables that points 0.0.0.0/0 to the endpoint, which overrides the default route to the NAT gateway. This prevents traffic destined for the internet from reaching the NAT gateway. Option A is wrong because the VPC endpoint is in the same region and works across AZs. Option C is wrong because the NAT gateway is in AZ1, but instances in other AZs can still route to it if the route table has a 0.0.0.0/0 route pointing to the NAT gateway. Option D is wrong because the S3 endpoint does not need to be in every AZ; Gateway endpoints are regional.

Answer

The VPC endpoint needs to be created in each Availability Zone

Answer

The NAT gateway is only available in the AZ where it is deployed

Answer

The S3 VPC endpoint is only accessible from the AZ where it was created

Question 3

A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?

Accepted Answer

The Transit Gateway route tables allow direct communication between application VPCs. Option C is correct. For east-west traffic to be inspected, the Transit Gateway must route traffic from one VPC to the inspection VPC, then to the destination VPC. This requires that the route tables in the Transit Gateway are configured so that traffic between VPCs is forced through the inspection VPC. If the application VPCs have a direct route to each other via the Transit Gateway (e.g., a static route or a route in the same route table), traffic will not go through the inspection VPC. The most common cause is that the Transit Gateway route table association allows direct VPC-to-VPC routing. Option A is wrong because Network Firewall can inspect traffic at scale. Option B is wrong because Network Firewall is stateful and can handle return traffic. Option D is wrong because the inspection VPC can have multiple subnets for different traffic types.

Answer

The inspection VPC does not have a subnet for east-west traffic

Answer

Network Firewall cannot inspect traffic between VPCs at high throughput

Answer

Network Firewall is not stateful and cannot handle return traffic

Question 4

A startup wants to design a cost-effective network for a new application. They expect low traffic initially but need to handle sudden spikes. They plan to use Amazon EC2 instances behind an Application Load Balancer (ALB) in a single VPC. The application must be highly available within the region. The network engineer has proposed using two public subnets in two Availability Zones for the ALB, and two private subnets for the EC2 instances. The EC2 instances need to access the internet for updates. What is the MOST cost-effective and highly available design?

Accepted Answer

Use a NAT gateway in each public subnet (one per AZ). Option C is correct. A NAT gateway in each AZ provides high availability and is managed, reducing operational overhead. Option A is wrong because a NAT instance in one AZ is a single point of failure. Option B is wrong because a single NAT gateway is a single point of failure. Option D is wrong because although a NAT instance in each AZ is highly available, it requires more management than NAT gateways.

Answer

Use a single NAT instance in one public subnet

Answer

Use a NAT instance in each public subnet (one per AZ)

Answer

Use a single NAT gateway in one public subnet

Question 5

A company has a global application deployed across multiple AWS Regions. They use an Amazon Route 53 latency-based routing policy to direct users to the closest region. Recently, users in Asia are experiencing high latency even though traffic is being directed to the nearest region. The network team reviews the latency measurements and notices that the Route 53 latency values are based on the region where the resources are hosted, but the actual application performance is poor. What is the most likely cause?

Accepted Answer

The application in the Asian region is overloaded, causing increased response times.. Option B is correct. Route 53 latency routing measures latency between the user and the region, not the actual application response time. If the application itself is slow, users still experience high latency. Option A is incorrect because Route 53 health checks can fail over but don't improve latency. Option C is incorrect because anycast routes to the nearest edge but doesn't affect application performance. Option D is incorrect because DNSSEC does not affect latency.

Answer

The Route 53 health checks are failing, causing traffic to be routed to a different region.

Answer

The company has not enabled DNSSEC, causing additional DNS resolution time.

Answer

The Route 53 latency routing policy is not using anycast, causing suboptimal routing.

Question 6

A company has deployed a multi-tier web application in a single AWS region. The architecture includes a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier runs on EC2 instances in the private subnets. The database tier uses an Amazon RDS Multi-AZ deployment in the database subnets. The company is experiencing intermittent connectivity issues between the application tier and the database tier. The application logs show connection timeouts. The network engineer has verified that the security groups and network ACLs are correctly configured. The RDS instance is reachable from the application tier via a telnet test from one specific instance, but not consistently from all instances. What is the most likely cause of the intermittent connectivity?

Accepted Answer

The database subnets are in different Availability Zones than the application subnets, and the route tables in the application subnets do not have routes to the database subnet CIDRs.. Option B is correct because if the RDS subnet group spans subnets in different AZs, the RDS endpoint may resolve to an IP in a different subnet that is not routable due to missing route table entries. Option A is wrong because RDS Multi-AZ does not use a separate IP for failover; the DNS CNAME changes. Option C is wrong because security groups are stateful and allow return traffic. Option D is wrong because network ACLs are stateless but if configured correctly they should allow traffic.

Answer

The RDS Multi-AZ failover is causing the primary instance to change, and the application is not reconnecting to the new endpoint.

Answer

The network ACLs on the database subnets are blocking ephemeral ports used by the application.

Answer

The security group for the database is allowing traffic only from the application tier's security group, but the application tier instances are using a different security group.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They have three subnets: Subnet A (10.0.1.0/24) in us-east-1a, Subnet B (10.0.2.0/24) in us-east-1b, and Subnet C (10.0.3.0/24) in us-east-1c. The company has deployed a set of EC2 instances in Subnet A that need to access an Amazon S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet and remains within the AWS network. The VPC has a VPC endpoint for S3 (gateway type) created and associated with the route table for Subnet A. However, the instances are unable to access the S3 bucket. What is the MOST likely cause?

Accepted Answer

The route table for Subnet A does not have a route for the S3 prefix list pointing to the VPC endpoint.. Option B is correct. A gateway VPC endpoint for S3 is only accessible from the subnet whose route table has a route to the endpoint. The route table for Subnet A must have a route for the S3 prefix list pointing to the VPC endpoint. If that route is missing, traffic will not use the endpoint. Option A is incorrect because a VPC endpoint does not require an internet gateway. Option C is incorrect because a gateway endpoint does not use security groups; it uses endpoint policies. Option D is incorrect because the endpoint policy does not need to be explicitly attached to the bucket; the bucket policy must grant access to the VPC endpoint.

Answer

The VPC does not have an internet gateway attached.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The VPC endpoint is not associated with a security group that allows outbound traffic to S3.

Question 8

A company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The on-premises router advertises a specific route for a subnet (192.168.1.0/24) to the VPC via BGP. However, instances in the VPC cannot reach the 192.168.1.0/24 subnet. The VPC route table shows the route as 'active' and 'propagated' from the Direct Connect virtual interface. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route to the 192.168.1.0/24 subnet pointing to the virtual private gateway.. Option B is correct. Even if the route is propagated, the VPC subnet route table must have a route pointing to the virtual private gateway for that CIDR. If the route is not explicitly added (or not propagated due to route table association), traffic will not be directed. Option A is incorrect because BGP is used, so AS_PATH does not affect reachability inside VPC. Option C is incorrect because security groups don't apply to on-premises traffic via Direct Connect. Option D is incorrect because the VPC route table shows the route as active, so the prefix is known.

Answer

The security group for the VPC instances is blocking inbound traffic from the on-premises network.

Answer

The VPC has overlapping CIDR with the on-premises network.

Answer

The on-premises router is not advertising the correct BGP community.

Question 9

A company is expanding its on-premises data center to AWS using a hybrid cloud architecture. They have established an AWS Direct Connect connection with a private virtual interface to a VPC. The on-premises network uses BGP to exchange routes with the VPC. The network engineer notices that the on-premises network can reach some EC2 instances in the VPC but not others. All EC2 instances are in the same subnet (10.0.1.0/24) and have private IP addresses. The Direct Connect virtual interface is configured with the VPC CIDR (10.0.0.0/16) advertised to on-premises. The on-premises firewall logs show that traffic to the unreachable instances is being dropped. What is the most likely cause?

Accepted Answer

The security group attached to the unreachable instances is not allowing inbound traffic from the on-premises network.. Option D is correct because security groups are stateful and control inbound traffic; if the security group does not allow inbound traffic from on-premises, it will be dropped. Option A is wrong because the subnet route table has a route to the virtual private gateway, which is correct. Option B is wrong because the VPC CIDR is advertised. Option C is wrong because network ACLs are stateless and need both inbound and outbound rules; but if they were misconfigured, all instances would be affected.

Answer

The subnet route table does not have a route to the on-premises network.

Answer

The BGP session is not advertising the on-premises routes to the VPC.

Answer

The network ACL on the subnet is blocking inbound traffic from on-premises.

Question 10

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. Option B is correct. The public subnet must have a route to an internet gateway for the NAT gateway to work. The NAT gateway resides in the public subnet, but if that subnet's route table does not have a route to an internet gateway, the NAT gateway cannot forward traffic to the internet. Option A is incorrect because the NAT gateway does not need a security group. Option C is incorrect because the private subnet's route table has a route to the NAT gateway. Option D is incorrect because the Elastic IP is needed for the NAT gateway, and if it is attached, it is not the cause.

Answer

The NAT gateway is not associated with a security group that allows outbound traffic.

Answer

The NAT gateway's Elastic IP address is not properly allocated.

Answer

The private subnet's route table does not have a route to the NAT gateway.

Question 11

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in a VPC. The application experiences unpredictable traffic spikes. The company notices that during peak traffic, the ALB returns 503 errors. The network engineer checks the ALB's CloudWatch metrics and sees that the 'ActiveConnectionCount' is high but 'TargetResponseTime' is low. The ALB's target group is configured with a deregistration delay of 300 seconds. The ALB is internet-facing and uses an SSL/TLS certificate from AWS Certificate Manager. The security group for the ALB allows inbound HTTPS from 0.0.0.0/0. The target instances' security group allows inbound traffic from the ALB's security group. The VPC has a CIDR of 10.0.0.0/16 with public and private subnets. The ALB is in public subnets, and the instances are in private subnets. The route tables for private subnets have a default route to a NAT gateway in the public subnets. The company wants to resolve the 503 errors. What should the network engineer do?

Accepted Answer

Increase the idle timeout setting on the ALB to a higher value.. Option C is correct. The 503 errors are likely due to the ALB's connection limit or insufficient target capacity. Since target response time is low, the targets are not overloaded. The deregistration delay of 300 seconds may cause connections to drain slowly, but the main issue is that the ALB may be hitting its connection limit. Increasing the ALB's idle timeout will allow connections to stay open longer, reducing the rate of new connections. Option A is incorrect because increasing the deregistration delay would make the problem worse. Option B is incorrect because the ALB is already in public subnets. Option D is incorrect because disabling cross-zone load balancing would reduce capacity.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay to 600 seconds.

Answer

Move the ALB to private subnets and use a NAT gateway for internet access.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create a subnet for a new application that requires at least 2000 usable IP addresses. Which subnet size should they choose?

Accepted Answer

/20 (4096 IPs). Option C is correct. A /20 subnet provides 4096 total IPs, with 4091 usable (AWS reserves 5). For 2000 usable, /20 is sufficient. Option A (/24) provides 251 usable. Option B (/22) provides 1023 usable. Option D (/19) provides 8191 usable, which is more than needed but acceptable, though /20 is the smallest sufficient.

Answer

/24 (256 IPs)

Answer

/22 (1024 IPs)

Answer

/19 (8192 IPs)

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16. It has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The company hosts a web application on EC2 instances in the private subnets behind an Application Load Balancer (ALB) in the public subnets. The ALB is internet-facing. The company wants to add a second ALB in the same VPC for a different application but using the same public subnets. The new ALB also needs to be internet-facing. However, when the company tries to create the new ALB, they receive an error: 'The subnet 'subnet-xxxxxxxx' does not have enough free IP addresses to satisfy the request.' The network engineer checks the subnets and finds that the public subnets have only 2 free IP addresses each. The private subnets have plenty of free IP addresses. The company wants to resolve this error without changing the architecture of the existing applications. What should the network engineer do?

Accepted Answer

Create new public subnets with larger CIDR blocks (e.g., /23) and associate them with the same route table.. Option B is correct. The public subnets are running out of IP addresses. Adding new public subnets with larger CIDR blocks (e.g., /23) will provide more IP addresses without affecting the existing subnets. Option A is incorrect because the private subnets cannot be used for internet-facing ALBs. Option C is incorrect because shrinking existing subnets would disrupt running resources. Option D is incorrect because launching a NAT gateway does not add IP addresses to subnets.

Answer

Use the private subnets for the new ALB and add a NAT gateway for internet access.

Answer

Reduce the size of the existing public subnets by modifying their CIDR blocks.

Answer

Launch a NAT gateway in one public subnet to free up IP addresses.

Question 14

A company uses AWS Direct Connect with a private VIF and a virtual private gateway (VGW) to connect its on-premises data center to a VPC. The on-premises network uses BGP to advertise routes to AWS. The VPC has multiple subnets. The company wants to ensure that only traffic destined for the VPC CIDR (10.0.0.0/16) is sent over Direct Connect, and all other traffic uses the internet. However, after configuration, on-premises users can access the internet through the Direct Connect link, which is unintended. What change should be made to restrict traffic?

Accepted Answer

Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.. Option B is correct. On-premises routers should only advertise the VPC CIDR (10.0.0.0/16) to AWS, and AWS should not advertise a default route to on-premises. By default, Direct Connect private VIF can propagate a default route if configured. To prevent on-premises from using Direct Connect for internet, ensure that the on-premises router does not accept a default route from AWS or that AWS does not advertise one. Option A is incorrect because removing the VGW disconnects the VPC. Option C is incorrect because adding a static route would not fix the issue. Option D is incorrect because disabling route propagation for the specific subnet does not affect BGP advertisements.

Answer

Add a static route in the VPC route table to send all traffic to the internet gateway.

Answer

Disable route propagation for the private subnet route table.

Answer

Remove the virtual private gateway and use a VPN connection instead.

Question 15

A company has a multi-VPC architecture connected via AWS Transit Gateway. They have VPCs in different AWS accounts. The network team wants to centralize internet traffic through a single egress VPC that has a NAT Gateway and an Internet Gateway. All other VPCs should route outbound internet traffic through the Transit Gateway to the egress VPC. They have configured route tables accordingly, but instances in non-egress VPCs cannot reach the internet. What is the most likely missing configuration?

Accepted Answer

The Transit Gateway route table does not have a route to the non-egress VPC attachments for the return traffic.. Option D is correct. For Transit Gateway to forward traffic from one VPC to another, attachment routes must be propagated and route tables must allow transitive routing. Also, the egress VPC must have a route to the Transit Gateway for return traffic. Option A is incorrect because security groups are stateful. Option B is incorrect because NAT Gateway does not need routes back to Transit Gateway; it sends traffic to IGW. Option C is incorrect because VPC endpoints are not for general internet.

Answer

The security group for the NAT Gateway in the egress VPC is blocking inbound traffic from other VPCs.

Answer

The egress VPC's route table does not have a route to the Transit Gateway for the return traffic from the internet.

Answer

The non-egress VPCs are using VPC endpoints instead of the Transit Gateway for internet access.

Question 16

A company is designing a hybrid network architecture using AWS Direct Connect. They have a single Direct Connect connection with a private virtual interface (VIF) to a VPC in us-east-1. The on-premises network uses BGP to advertise a prefix (10.0.0.0/8) to AWS. The VPC has a CIDR of 10.1.0.0/16. The company wants to add a second VPC (10.2.0.0/16) in the same region and allow on-premises to communicate with both VPCs. They plan to use a Transit Gateway to connect the VPCs and the Direct Connect gateway. The Direct Connect gateway is associated with the Transit Gateway. The on-premises router is advertising 10.0.0.0/8. After configuration, the on-premises network can communicate with 10.1.0.0/16 but not with 10.2.0.0/16. The network engineer verifies that the Transit Gateway route table has routes for both VPC attachments and that the Direct Connect gateway is associated with the Transit Gateway. What is the MOST likely issue?

Accepted Answer

The Direct Connect gateway is not associated with the Transit Gateway route table that contains the 10.2.0.0/16 route. When using a Direct Connect gateway with a Transit Gateway, the Direct Connect gateway propagates routes to the Transit Gateway. The Transit Gateway route table must have a route for the on-premises prefix (10.0.0.0/8) pointing to the Direct Connect gateway attachment. Also, the Transit Gateway must propagate the VPC CIDRs to the Direct Connect gateway so that on-premises can learn them. The issue is likely that the 10.2.0.0/16 route is not being propagated to the Direct Connect gateway. This can happen if the Transit Gateway route table does not have the VPC attachment associated or if the route propagation is disabled for that VPC attachment. The engineer verified routes in the Transit Gateway route table, so the issue might be that the Direct Connect gateway is not receiving the route for 10.2.0.0/16. Typically, the Transit Gateway automatically propagates routes from attachments to the Direct Connect gateway if the route table is associated. However, if the VPC attachment is not associated with the same route table as the Direct Connect gateway attachment, propagation may not happen. The most likely fix is to ensure that both VPC attachments and the Direct Connect gateway attachment are in the same Transit Gateway route table.

Answer

The Transit Gateway route table does not have a route for 10.2.0.0/16

Answer

The private virtual interface is not configured to support multiple VPCs

Answer

The on-premises router is not advertising the 10.2.0.0/16 prefix

Question 17

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?

Accepted Answer

The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.. Option D is correct. The NAT gateway must be in a public subnet with a route to an internet gateway. The question states the public subnet has that route, so that's fine. However, the NAT gateway itself needs to be associated with a route table that has a route to the internet gateway. The most likely cause is that the NAT gateway's route table does not have a default route to the internet gateway. Option A is incorrect because the NAT gateway has an Elastic IP. Option B is incorrect because the security group is not the issue. Option C is incorrect because the private subnet's route is correct.

Answer

The security group for the EC2 instance does not allow outbound traffic.

Answer

The route table for the private subnet does not have a route to the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Question 18

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application experiences intermittent timeouts during peak hours. The network team suspects that the security group or network ACL is misconfigured. They enable VPC Flow Logs and notice that outbound traffic from the ALB to the EC2 instances on port 8080 shows 'ACCEPT' records, but the ALB returns 504 errors. The ALB health check is configured to hit the EC2 instances on port 8080/health. What is the most likely cause of the 504 errors?

Accepted Answer

The ALB idle timeout is set too low, and the application takes longer to respond.. Option C is correct. ALB requires idle timeout settings on both client and target sides; if the target response exceeds the ALB idle timeout, it returns 504. Option A is incorrect because flow logs show ACCEPT. Option B is incorrect because health checks failing would cause unhealthy targets, but the issue is intermittent. Option D is incorrect because security group rules are stateful and outbound traffic is allowed.

Answer

The network ACL for the private subnet is blocking inbound traffic from the ALB.

Answer

The security group for the EC2 instances is missing an outbound rule to allow traffic from the ALB.

Answer

The health check path is incorrectly configured, causing the ALB to mark all targets as unhealthy.

Question 19

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?

Accepted Answer

Create a web ACL in AWS WAF and associate it with the ALB.. Option A is correct. AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level. Option D is incorrect because WAF is not a Network Load Balancer feature.

Answer

Replace the ALB with a Network Load Balancer and use AWS WAF with it.

Answer

Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.

Answer

Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.

Question 20

A company is designing a network for a critical application that requires high availability across two AWS Regions (us-east-1 and us-west-2). The application uses an Application Load Balancer (ALB) in each region, with Auto Scaling groups behind them. The database is an Amazon Aurora Global Database with a primary cluster in us-east-1 and a secondary cluster in us-west-2. The company wants to use Amazon Route 53 to route traffic to the closest healthy ALB. They also need to ensure that if the primary database fails over to the secondary region, the application can still write to the database with minimal latency. Additionally, the application must be able to read from the local database in each region for read-intensive workloads. The network team has designed the following: Route 53 with latency-based routing and health checks for the ALBs. The application instances in each region are configured to connect to the local Aurora cluster endpoint. For writes, they use the global writer endpoint. What is the MOST significant design flaw?

Accepted Answer

The Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity. Aurora Global Database has a single writer endpoint that always points to the primary region. If the primary region fails and the secondary is promoted, the writer endpoint updates to point to the new primary. However, during normal operations, writes to the global writer endpoint go to the primary region, which might be far away for users in us-west-2. The latency for writes from us-west-2 to us-east-1 could be high. The design should consider using the local cluster for reads and the global writer for writes, but the write latency issue remains. The flaw is that writes from us-west-2 will always incur cross-region latency, which may be unacceptable. A better design would be to use a multi-master or sharded database, but for Aurora Global Database, the only way to reduce write latency is to use the secondary cluster for writes only after failover. So the design flaw is that the write path is not optimized for the secondary region. However, among the options, the most significant flaw is likely that the application instances in us-west-2 are connecting to the global writer endpoint for writes, which routes to us-east-1, causing high latency. But that is by design. The question asks for the most significant design flaw. Perhaps it's that there is no mechanism to redirect writes to the local cluster after failover without manual intervention? Actually, the global writer endpoint automatically updates, so that's fine. The flaw might be that the application is using the global endpoint for reads? No, it uses local for reads. Maybe the flaw is that the health checks for ALBs are not configured to check the database health, so if the database fails, the ALB might still be healthy and traffic continues to a region with a failed database. That is a common design flaw: the application health check should include database connectivity. So the most significant flaw is that the Route 53 health checks only check ALB health, not the overall application health including database.

Answer

The Auto Scaling groups are not configured with lifecycle hooks to drain connections during scale-in

Answer

The application instances in us-west-2 experience high latency for write operations due to cross-region traffic to the primary database

Answer

The Aurora Global Database does not support cross-region replication for read replicas