ANS-C01 Network Design — 40 Questions

Question 1

A company is migrating its on-premises data center to AWS. The network team needs to establish connectivity between the on-premises network and multiple VPCs in a single AWS Region. The company has a Direct Connect connection and wants to minimize latency and cost while maximizing bandwidth utilization. Which solution meets these requirements?

Accepted Answer

Use a Direct Connect gateway and associate it with the VPCs.. A Direct Connect gateway allows a single Direct Connect connection to connect to multiple VPCs in the same or different AWS Regions, minimizing latency by using a private, dedicated network path and reducing cost by eliminating the need for separate virtual interfaces or VPN tunnels per VPC. It also maximizes bandwidth utilization by aggregating traffic from multiple VPCs over the same Direct Connect link.

Answer

Provision a separate Direct Connect virtual interface for each VPC.

Answer

Create a VPN connection over the Direct Connect link to each VPC.

Answer

Use VPC peering between the on-premises network and each VPC.

Question 2

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

Accepted Answer

Enable jumbo frames on the transit VPC's EC2-based virtual appliances.. The issue is intermittent connectivity between an on-premises office in ap-southeast-1 and a spoke VPC in eu-west-1, traversing a transit VPC in us-east-1. The VPN is up, so the problem is likely packet fragmentation or MTU mismatch across the long-haul path. Enabling jumbo frames on the transit VPC's EC2-based virtual appliances (e.g., firewall or router instances) increases the maximum transmission unit, reducing fragmentation and improving performance for large packets, which is a common cause of intermittent issues in hub-and-spoke topologies.

Answer

Change the VPN connection from static to dynamic routing.

Answer

Enable BGP route propagation on the transit VPC's route tables.

Answer

Deploy a new transit VPC in eu-west-1.

Question 3

A company is designing a network for a three-tier web application in a single VPC. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The application servers need to make outbound calls to a third-party API. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Application Load Balancer, application servers in private subnets with a NAT gateway, and database servers in private subnets.. Option C is correct because it places web servers in public subnets with an Application Load Balancer for inbound internet traffic, while application and database servers reside in private subnets without direct internet access. A NAT gateway in a public subnet enables the application servers to initiate outbound connections to a third-party API, with return traffic automatically routed back, meeting the requirement for outbound-only internet access.

Answer

Web servers in public subnets, application and database servers in private subnets with an internet gateway for outbound traffic.

Answer

All servers in public subnets with security groups restricting access.

Answer

All servers in private subnets and a VPN connection to the internet.

Question 4

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs in the same AWS Region. The company wants to use AWS Transit Gateway to simplify connectivity between these VPCs and their on-premises network. Which steps are required to integrate the existing Direct Connect connection with Transit Gateway?

Accepted Answer

Create a Direct Connect gateway, associate the existing VIFs, and attach the Direct Connect gateway to the Transit Gateway.. Option D is correct because AWS Direct Connect private VIFs cannot be attached directly to a Transit Gateway. Instead, you must create a Direct Connect Gateway, associate the existing private VIFs with it, and then attach the Direct Connect Gateway to the Transit Gateway. This architecture allows the Transit Gateway to route traffic between the on-premises network (via the Direct Connect connection) and the attached VPCs, while also enabling inter-VPC routing through the Transit Gateway.

Answer

Set up a VPN connection over the Direct Connect link and attach the VPN to the Transit Gateway.

Answer

Attach the existing private VIFs directly to the Transit Gateway.

Answer

Create a new private VIF on the Direct Connect connection and attach it to the Transit Gateway.

Question 5

A company is designing a multi-region architecture with VPCs in us-east-1 and eu-west-1. The company needs low-latency connectivity between the VPCs and wants to avoid traffic over the public internet. The VPCs have overlapping CIDR blocks (10.0.0.0/16). Which solution should the network engineer recommend?

Accepted Answer

Set up an AWS Transit Gateway in each region and connect them via a VPN attachment.. Option A is correct because AWS Transit Gateway supports inter-region peering attachments that use the AWS global network backbone, providing low-latency, private connectivity between VPCs in different regions. Even when VPCs have overlapping CIDR blocks, Transit Gateway can handle this through route table isolation and network segmentation (e.g., using separate route tables for each VPC attachment), which VPC peering cannot do. VPN attachments between Transit Gateways in each region establish encrypted tunnels over the AWS backbone, avoiding the public internet.

Answer

Use a Direct Connect connection between the regions.

Answer

Use VPC peering between the two VPCs.

Answer

Place all resources in a single VPC with multiple Availability Zones.

Question 6

A company is designing a hybrid network using AWS Transit Gateway. The company has three VPCs (VPC-A, VPC-B, VPC-C) all attached to the same Transit Gateway. The on-premises network connects to the Transit Gateway via a Direct Connect gateway. The company needs to ensure that VPC-C can communicate with the on-premises network but not with VPC-A or VPC-B. Which TWO actions should the network engineer take?

Accepted Answer

Associate the VPC-C route table with the Direct Connect gateway attachment.. Option B is correct because associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with the on-premises network via the Transit Gateway, enabling communication. Option D is correct because creating a separate Transit Gateway route table for VPC-C and not propagating VPC-A and VPC-B routes ensures that VPC-C has no routes to those VPCs, effectively isolating it from them at the network layer.

Answer

Use security groups on VPC-C to deny traffic from VPC-A and VPC-B.

Answer

Establish VPC peering connections between VPC-C and VPC-A, and VPC-C and VPC-B.

Answer

Apply a network ACL on VPC-C subnets to block traffic from VPC-A and VPC-B.

Question 7

A company is deploying a new application in a VPC. The application consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB must only receive traffic from the company's on-premises network via an AWS Site-to-Site VPN. Which THREE steps should the network engineer take to meet this requirement?

Accepted Answer

Place the ALB in a public subnet.. Option B is correct because an Application Load Balancer (ALB) must be placed in a public subnet to be reachable from an on-premises network via an AWS Site-to-Site VPN. The VPN connection terminates on a virtual private gateway or transit gateway, which routes traffic to the VPC, but the ALB itself needs a public subnet with a route to the internet gateway (or virtual private gateway) to accept inbound traffic from the VPN. Without a public subnet, the ALB cannot receive traffic from outside the VPC, including VPN traffic.

Answer

Place the ALB in a private subnet and use a Transit Gateway.

Answer

Create a NAT gateway in the public subnet for outbound traffic.

Question 8

A network engineer has configured an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer checks the VPN status and sees the output above. What is the MOST likely cause of Tunnel2 being down?

Accepted Answer

The IPsec encryption or integrity algorithms do not match between the AWS VPN endpoint and the on-premises device.. Tunnel2 is down while Tunnel1 is up, indicating a per-tunnel configuration mismatch. The most common cause is a mismatch in IPsec security parameters (encryption, integrity, or DH group) between the AWS VPN endpoint and the on-premises device for that specific tunnel. AWS uses separate pre-shared keys and IPsec settings per tunnel, so a mismatch in algorithms would affect only the misconfigured tunnel.

Answer

The BGP ASN on the on-premises device is misconfigured.

Answer

The route tables in the VPC do not have a route to the on-premises network.

Answer

The IKE pre-shared key used for Tunnel2 is incorrect.

Question 9

A network engineer is setting up a cross-account Route 53 Resolver rule association. The engineer creates the above resource-based policy on a resolver rule in account 111111111111. The engineer then tries to associate the rule from account 222222222222 but receives an access denied error. What is the MOST likely reason for the failure?

Accepted Answer

The policy's Principal is set to account 111111111111 instead of account 222222222222.. The resource-based policy on the Route 53 Resolver rule must specify the consuming account (222222222222) as the Principal to authorize cross-account association. Since the policy incorrectly sets the Principal to the owning account (111111111111), the request from account 222222222222 lacks the required permissions, resulting in an access denied error.

Answer

The policy does not allow the 'route53resolver:AssociateResolverRule' action.

Answer

The policy does not include the 'route53resolver:DisassociateResolverRule' action.

Answer

The resolver rule is not shared with account 222222222222.

Question 10

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer in the public subnets distributes traffic to EC2 instances in the private subnets. The security group for the EC2 instances allows inbound traffic from the ALB security group. Users report intermittent timeouts. What is the most likely cause?

Accepted Answer

The security group for the ALB does not allow inbound traffic from the internet.. The most likely cause is that the ALB's security group does not allow inbound traffic from the internet (0.0.0.0/0) on the listener port (e.g., 80 or 443). Without this rule, the ALB will reject incoming client requests, causing intermittent timeouts as users attempt to connect. The ALB must have an inbound rule permitting traffic from the internet to receive and forward requests to the targets.

Answer

The ALB is not associated with an internet gateway.

Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.

Answer

Cross-zone load balancing is disabled on the ALB.

Question 11

A solutions architect is designing a VPC with public and private subnets in two Availability Zones. The private subnets require outbound internet access for software updates, but inbound internet access must be blocked. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.. Option B is correct because a NAT Gateway, deployed in a public subnet with an Elastic IP and a route to an Internet Gateway, enables outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. The private subnet route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) on outbound packets, ensuring responses return to the NAT Gateway without exposing private instances directly.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

Answer

Launch an EC2 instance in a public subnet with a proxy software and route private subnet traffic through it.

Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route tables.

Question 12

A company has a Direct Connect connection with a private VIF to a VPC. The VPC has a virtual private gateway attached. The on-premises network advertises a specific route 10.0.0.0/16, but the VPC uses the same CIDR 10.0.0.0/16. The company requires connectivity to the VPC from on-premises but cannot change the VPC CIDR. What is the most cost-effective solution?

Accepted Answer

Create a Transit Gateway with a VPN attachment to on-premises and use route table separation.. Option C is correct because a Transit Gateway with a VPN attachment allows you to use route table separation to isolate the overlapping CIDR (10.0.0.0/16) between the on-premises network and the VPC. By creating separate route tables for the VPN attachment and the VPC attachment, you can control traffic flow and avoid routing conflicts without changing the VPC CIDR. This is the most cost-effective solution as it leverages existing VPN connectivity and avoids the expense of migrating workloads or provisioning additional infrastructure.

Answer

Use VPC peering between the on-premises network and the VPC.

Answer

Set up a Direct Connect Gateway and attach the VPC and on-premises networks.

Answer

Create a new VPC with a different CIDR and migrate workloads.

Question 13

A company's VPC has an internet gateway and a NAT Gateway in a public subnet. The private subnet route table has a default route pointing to the NAT Gateway. EC2 instances in the private subnet can access the internet, but cannot access an on-premises network connected via AWS Site-to-Site VPN. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route to the on-premises network via the virtual private gateway.. The private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway, which allows outbound internet traffic. However, traffic destined for the on-premises network must be routed via the Virtual Private Gateway (VGW) attached to the VPC. Since the route table lacks a specific route (e.g., 10.0.0.0/8) pointing to the VGW, packets to the on-premises CIDR are instead sent to the NAT Gateway, which drops them because it has no route or interface for the on-premises network.

Answer

The NAT Gateway is not configured to route traffic to the VPN.

Answer

The internet gateway is not attached to the VPC.

Answer

The VPN connection is not advertising the on-premises CIDR via BGP.

Question 14

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

Accepted Answer

Create VPC peering connections between each pair of VPCs.. Option C is correct because VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Answer

Set up AWS Site-to-Site VPN connections between each VPC.

Answer

Use ClassicLink to connect the VPCs.

Answer

Create a Transit Gateway and attach all VPCs.

Question 15

A company has a VPC with an internet gateway and a NAT Gateway. The private subnet route table has a default route to the NAT Gateway. The company wants to enable instances in the private subnet to access an S3 bucket in the same region without traversing the internet. Which TWO actions should the company take?

Accepted Answer

Add a route to the S3 prefix list via the gateway endpoint in the private subnet route table.. Option B is correct because adding a route to the S3 prefix list via the gateway endpoint directs traffic destined for S3 through the VPC endpoint, keeping it within the AWS network. Option C is correct because a gateway VPC endpoint for S3 provides a private, scalable connection to S3 without requiring internet access or a NAT Gateway. Together, these actions allow private subnet instances to access S3 privately and efficiently.

Answer

Remove the default route to the NAT Gateway from the private subnet route table.

Answer

Add a route to the S3 prefix list via the NAT Gateway in the private subnet route table.

Answer

Create an interface VPC endpoint for S3.

Question 16

A company has a Direct Connect connection with a private VIF attached to a virtual private gateway. The VPC has multiple subnets in two Availability Zones. The on-premises network advertises a default route (0.0.0.0/0) via BGP. The company wants all internet-bound traffic from the VPC to go through the on-premises network. Which THREE actions are required to achieve this?

Accepted Answer

Add a default route pointing to the virtual private gateway in the private subnet route tables.. Option B is correct because adding a default route (0.0.0.0/0) pointing to the virtual private gateway in the private subnet route tables ensures that all internet-bound traffic from those subnets is forwarded over the Direct Connect private VIF to the on-premises network. This leverages the BGP-advertised default route from the on-premises network, allowing the company to enforce its security and routing policies for internet access.

Answer

Deploy a NAT Gateway in a public subnet.

Answer

Attach an internet gateway to the VPC.

Question 17

A company runs a multi-tier web application on AWS. The web servers in public subnets need to send traffic to the application servers in private subnets. The application servers must only accept traffic from the web servers. Both tiers are in the same VPC. Which design meets these requirements without introducing a single point of failure or unnecessary complexity?

Accepted Answer

Place the web servers in a public subnet with a security group that allows inbound from 0.0.0.0/0 on port 443. Place the app servers in a private subnet with a security group that allows inbound from the web server security group on the application port.. Option A is correct because it uses security group referencing, which allows the app servers' security group to dynamically allow traffic from any instance associated with the web servers' security group, regardless of IP address changes. This design avoids a single point of failure by not introducing any load balancer or gateway, and it minimizes complexity by leveraging native VPC security group behavior within the same VPC.

Answer

Place the web servers and app servers in the same private subnet behind an internal Network Load Balancer. Route web traffic through the NLB.

Answer

Place the web servers in a public subnet with an Internet Gateway. Place the app servers in a private subnet with a NAT Gateway for outbound traffic. Use NACLs to allow inbound from the web subnet CIDR.

Answer

Place the web servers in a public subnet with a NACL allowing inbound on port 443. Place the app servers in a private subnet with a NACL allowing inbound from the web subnet CIDR on the application port.

Question 18

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to minimize operational overhead. The on-premises network uses BGP to advertise routes to AWS. Which design meets these requirements?

Accepted Answer

Provision two Direct Connect connections to two different Direct Connect locations, each with a private VIF to the same VPC. Use BGP over the VIFs.. Option A is correct because provisioning two Direct Connect connections to two different Direct Connect locations ensures physical and path diversity, eliminating single points of failure. Using BGP over the private VIFs allows dynamic route advertisement and automatic failover, meeting high availability requirements while minimizing operational overhead through managed BGP sessions.

Answer

Provision one Direct Connect connection with a private VIF and a site-to-site VPN connection as a backup.

Answer

Provision one Direct Connect connection with two virtual interfaces (VIFs) to the same AWS device.

Answer

Provision two Direct Connect connections to the same Direct Connect location, both with private VIFs to the same VPC.

Question 19

A company is designing a VPC with public and private subnets for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of route tables and security groups achieves this?

Accepted Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.. Option A is correct because it uses an Internet Gateway (IGW) in the public subnet route table to enable inbound internet traffic to the web tier, and security groups (SGs) are referenced by logical ID (Web SG, App SG, DB SG) to enforce strict, stateful traffic flow: Web SG allows HTTPS from 0.0.0.0/0, App SG allows traffic only from Web SG, and DB SG allows traffic only from App SG. This layered SG approach ensures that each tier can only be reached from the preceding tier, meeting the access requirements without relying on network ACLs or routing.

Answer

Public subnet route table: 0.0.0.0/0 -> NAT Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.

Answer

Private subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from 0.0.0.0/0 on port 3306.

Question 20

A company is deploying an application that requires low-latency communication between EC2 instances in two different AWS Regions. The application traffic is latency-sensitive and the company wants to minimize jitter. Which network design provides the lowest and most consistent latency?

Accepted Answer

Deploy an AWS Global Accelerator with endpoints in both Regions and use the accelerator's static IP addresses for communication.. AWS Global Accelerator uses the AWS global network and Anycast static IP addresses to route traffic over optimized paths, providing lower and more consistent latency than VPC peering, internet transit, or VPNs. It minimizes jitter by avoiding the public internet and leveraging AWS's internal backbone, which is ideal for latency-sensitive inter-Region communication.

Answer

Create a VPC peering connection between the two VPCs and route traffic through the peering connection.

Answer

Use internet gateways and route traffic over the public internet between the instances.

Answer

Use a Site-to-Site VPN connection between the two VPCs over the internet.