ANS-C01 Network Design — 10 Questions

Question 1

A company is deploying a critical application on AWS and needs to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet the encryption requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure IPsec on the EC2 instances to encrypt traffic over the VPC peering connection.. For same-region VPC peering, AWS does not automatically encrypt traffic in transit. Traffic between VPCs in the same region over a peering connection is not encrypted by default. To meet the encryption requirement, you must configure IPsec on the EC2 instances to encrypt the traffic. Inter-region VPC peering automatically encrypts traffic, but that does not apply here.

Answer

No additional configuration is needed; VPC peering traffic is automatically encrypted.

Answer

Create a VPN connection between the two VPCs using the VPC peering connection.

Answer

Use AWS Transit Gateway with VPN attachments between the VPCs.

Question 2

A company has a VPC with multiple subnets and uses an AWS Direct Connect private VIF for connectivity to on-premises. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection, while internet traffic uses an internet gateway. Which configurations must be applied? (Choose TWO.)

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway.. Adding a specific route for the on-premises CIDR block pointing to the virtual private gateway (VGW) ensures that traffic destined for the on-premises network is directed over the Direct Connect private VIF. Option E is correct because adding a default route (0.0.0.0/0) pointing to the internet gateway ensures that internet-bound traffic takes that path. Together, these routes ensure that on-premises traffic uses the Direct Connect connection and internet traffic uses the internet gateway, preventing asymmetric routing.

Answer

Create a VPC endpoint for Direct Connect.

Answer

Deploy a NAT gateway in a public subnet.

Answer

Add a default route (0.0.0.0/0) pointing to the virtual private gateway.

Question 3

A company is deploying a critical application on AWS and needs to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet the encryption requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route 53 health checkers take multiple intervals to detect failure, and timeouts occur before failover completes.. Route 53 health checkers operate from multiple global locations and evaluate the /health endpoint every 10 seconds. However, to declare an endpoint unhealthy, Route 53 requires a configurable number of consecutive failures (default is 3), meaning it can take 30 seconds or more before the DNS record is updated to remove the failed region. During this detection window, some users whose DNS queries are answered by Route 53 before the failure is fully propagated may receive the IP of the failing ALB, leading to timeouts, while others who query after the failover complete successfully.

Answer

The ALB health check is misconfigured and returns a non-200 status code during normal operation.

Answer

The TTL on the Route 53 record is set too low, causing stale DNS responses.

Answer

Users have cached DNS records from the failed region, and Route 53 does not return healthy endpoints.

Question 4

A company is designing a hybrid network with an AWS Direct Connect connection. They have two virtual interfaces (VIFs): a private VIF to a VPC and a public VIF to access AWS public services. They want to ensure that traffic to Amazon S3 in the same region uses the Direct Connect connection and not the internet. Which configuration should be applied?

Accepted Answer

Advertise the S3 prefix via BGP on the public VIF and ensure the VPC route table has a more specific route for S3 pointing to the virtual private gateway.. To force on-premises traffic to Amazon S3 over Direct Connect, you must advertise the S3 IP prefix (e.g., 52.216.0.0/15) via BGP on the public VIF. The customer edge router learns this route from AWS and directs S3 traffic to the Direct Connect connection, bypassing the internet. No VPC route table changes are needed for on-premises traffic; the VPC route table reference in option A is a distractor.

Answer

Add a route in the VPC route table for S3 prefix with target as the internet gateway.

Answer

Create a VPC endpoint for S3 and attach it to the VPC route table.

Answer

Create a VPN connection to the VPC and route S3 traffic through the VPN.

Question 5

A company is designing a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application (web, application, database) across two Availability Zones. They also need a /20 subnet for a future expansion. Which TWO subnet CIDR allocations are valid and efficient?

Accepted Answer

10.0.0.0/20. (10.0.0.0/20) is correct because it provides 4096 IP addresses and leaves contiguous space for other subnets, such as the /20 future expansion. Option D (10.0.16.0/20) is also correct, as it is a valid /20 subnet within the 10.0.0.0/16 VPC that can be used for future expansion without overlapping with the subnets for the three-tier application. Together, these two /20 subnets cover 10.0.0.0/19, which can be further subdivided for the application tiers across two Availability Zones.

Answer

10.0.0.0/18

Answer

10.0.0.0/16

Answer

10.0.0.0/28

Question 6

A company is connecting its on-premises data center to AWS using AWS Direct Connect. The company has two Direct Connect connections and wants to ensure high availability. The on-premises network uses BGP to advertise routes to AWS. Which combination of steps should be taken to achieve the most resilient design? (Choose TWO.)

Accepted Answer

Provision two private virtual interfaces, one over each Direct Connect connection.. Provisioning two private virtual interfaces, one over each Direct Connect connection, ensures that if one connection or virtual interface fails, BGP can continue to route traffic over the other. This design provides redundancy at both the physical layer (connections) and the logical layer (virtual interfaces), which is essential for high availability.

Answer

Provision a single private virtual interface and use both connections for link aggregation.

Answer

Configure static routes instead of BGP to simplify the design.

Answer

Use the same BGP ASN for both connections.

Question 7

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs in different regions is encrypted. Which solution should be used?

Accepted Answer

Use AWS Transit Gateway inter-region peering with a VPN attachment between the transit gateways.. AWS Transit Gateway inter-region peering inherently encrypts traffic as it traverses the AWS global network. No separate VPN attachment is required; the peering connection itself provides encryption. Although the option wording includes 'with a VPN attachment', the core solution of using inter-region peering is what meets the requirement. Options A, C, and D do not provide encrypted cross-region VPC connectivity without additional configurations.

Answer

Use a Site-to-Site VPN from each VPC to the on-premises network and route traffic through the corporate network.

Answer

Use VPC Peering connections between the VPCs, which encrypts traffic automatically.

Answer

Use AWS PrivateLink to connect the VPCs across regions.

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an Amazon DynamoDB table. The company wants to avoid sending traffic over the internet. A VPC gateway endpoint for DynamoDB is created and attached to the route table of the private subnet. The EC2 instance has an IAM role that grants access to DynamoDB. However, the application running on the instance cannot connect to DynamoDB. The network team confirms that the route table has a route to the DynamoDB prefix list. What is the MOST likely cause?

Accepted Answer

The VPC does not have DNS resolution enabled, or the endpoint's private DNS option is disabled.. A VPC gateway endpoint for DynamoDB requires DNS resolution to resolve DynamoDB public hostnames to private IP addresses within the VPC. If DNS resolution is disabled in the VPC, the EC2 instance will resolve DynamoDB endpoints to public IPs, causing traffic to attempt internet routing rather than using the gateway endpoint. Note that gateway endpoints do not have a 'private DNS' option—that is for interface endpoints. The essential requirement is that the VPC's DNS resolution attribute (enableDnsSupport) is enabled.

Answer

The security group on the EC2 instance blocks outbound traffic to DynamoDB.

Answer

The IAM role does not include the dynamodb:PutItem action.

Answer

The route table does not have a route to the DynamoDB prefix list.

Question 9

An enterprise is migrating a critical application to AWS. The application requires low latency (under 5 ms) between two EC2 instances that are in different VPCs in the same region. The company also needs to ensure that traffic is encrypted in transit and that the connection is highly available. Which design should be used?

Accepted Answer

Configure VPC Peering and use an AWS Transit Gateway with VPN attachments. The closest correct design because AWS Transit Gateway with VPN attachments provides encrypted IPsec tunnels between VPCs, ensuring confidentiality in transit. The VPN attachments are highly available with multiple tunnels, and traffic stays within the AWS backbone, meeting the sub-5 ms latency requirement within the same region. Although the option mentions VPC Peering, it is redundant—Transit Gateway alone connects the VPCs without needing peering. The core components (Transit Gateway + VPN) satisfy both latency and encryption. Option A (Direct Connect) is for on-premises connectivity, not VPC-to-VPC. Option C (PrivateLink) is for accessing services via endpoints, not for VPC-to-VPC routing. Option D (Site-to-Site VPN) traverses the internet, introducing latency that fails the 5 ms requirement.

Answer

Use an AWS Direct Connect connection between the VPCs

Answer

Use VPC endpoints with PrivateLink

Answer

Establish an AWS Site-to-Site VPN between the VPCs

Question 10

A company is deploying a multi-tier web application in a VPC. The architecture includes an internet-facing Application Load Balancer (ALB) in public subnets, a fleet of EC2 instances in private subnets, and an Amazon RDS database in a separate private subnet. The security team requires that the web application logs be stored in an Amazon S3 bucket for compliance. The EC2 instances have an instance profile that grants write access to the S3 bucket. The EC2 instances are in a private subnet that does not have a route to the internet. The company wants to ensure that the EC2 instances can upload logs to the S3 bucket without traversing the internet. Which solution should they implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet's route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 over the AWS network without traversing the internet. Since the instances have an instance profile granting write access, adding a route in the private subnet's route table pointing to the gateway endpoint enables direct, private connectivity to S3. This meets the security requirement of keeping traffic within the AWS backbone.

Answer

Create a VPC Interface Endpoint for S3

Answer

Deploy a forward proxy server in a public subnet and configure the EC2 instances to use it

Answer

Attach a NAT Gateway to the private subnet and configure a route to the NAT Gateway