ANS-C01 Network Design Practice Test 10 — 15 Questions

Question 1

A company is designing a global network with multiple AWS Regions. The company needs to connect VPCs in different Regions with low latency and high throughput. Which THREE services should the company consider? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway inter-Region peering. AWS Transit Gateway inter-Region peering (A) is correct because it connects transit gateways across Regions, allowing VPCs in different Regions to route traffic through a hub-and-spoke topology with low latency and high throughput over the AWS global backbone. VPC Peering (D) is correct because it establishes direct, private connectivity between VPCs in different Regions (inter-Region peering), providing low-latency, high-bandwidth communication without traversing the public internet. AWS Direct Connect with Direct Connect Gateway (E) is correct because a Direct Connect Gateway lets a customer connect on-premises networks to multiple VPCs across different Regions over dedicated private links, supporting high throughput and consistent low latency. AWS Global Accelerator (B) is not correct here because it optimizes global traffic to applications via edge locations and anycast IPs, but it does not interconnect VPCs across Regions. Amazon CloudFront (C) is not correct because it is a content delivery network for caching and distributing content at edge locations, not a VPC-to-VPC connectivity service.

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Question 2

A company has a multi-tier web application running on EC2 instances in a VPC. The web tier must be accessible from the internet, but the application tier should only be accessible from the web tier. Which network design configuration meets these requirements?

Accepted Answer

Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.. Placing both tiers in public subnets with an internet gateway allows the web tier to be accessible from the internet. Security groups can then be used to restrict inbound traffic to the application tier to only come from the web tier's security group, ensuring that the application tier is not directly accessible from the internet. This design meets the requirement without unnecessary complexity.

Answer

Use a VPN connection from the web tier to the application tier, and place both tiers in private subnets.

Answer

Place web servers in a public subnet with a NAT gateway, and application servers in a private subnet with a default route to the NAT gateway.

Answer

Place web servers in a public subnet with an internet gateway, and application servers in a private subnet with a route to the web subnet via a VPC peering connection.

Question 3

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC will host multiple environments (dev, test, prod) and requires subnets in three Availability Zones. The network engineer must allocate subnets efficiently while reserving at least 25% of the address space for future growth. What is the minimum subnet size that should be used for each environment?

Accepted Answer

/18. The VPC CIDR is 10.0.0.0/16, providing 65,536 total IP addresses. Reserving 25% for future growth leaves 49,152 addresses for current use across 3 environments (dev, test, prod) and 3 Availability Zones, totaling 9 subnets. Each subnet therefore needs at least 49,152 / 9 ≈ 5,462 addresses. Among the options, /20 (4,096 addresses) is too small, /21 (2,048) and /22 (1,024) are also insufficient. The only option that provides enough addresses is /18 (16,384 addresses), making it the minimum subnet size from the given choices.

Answer

/20

Answer

/22

Answer

/21

Question 4

Refer to the exhibit. An EC2 instance launched in subnet-1a is unable to access the internet. Which is the most likely cause?

Accepted Answer

Subnet-1a does not assign public IP addresses automatically.. If subnet-1a does not have the 'Auto-assign public IPv4 address' setting enabled, EC2 instances launched in that subnet will not receive a public IP address automatically. Without a public IP, the instance cannot communicate with the internet through an internet gateway, even if the route table has a default route (0.0.0.0/0) pointing to the internet gateway. The instance would need an Elastic IP or a public IP assigned at launch to enable internet access.

Answer

The route table rtb-main does not have a default route to the internet gateway.

Answer

The VPC does not have DNS hostnames enabled.

Answer

Subnet-1a is not associated with any route table.

Question 5

A financial services company requires that all traffic between two VPCs in the same region be encrypted in transit. The VPCs are in separate AWS accounts and use non-overlapping CIDR blocks. Which solution meets the requirement with the least operational overhead?

Accepted Answer

Use VPC endpoints to connect the VPCs via AWS PrivateLink.. AWS PrivateLink (VPC endpoints) allows you to connect VPCs privately using AWS's internal network. Traffic between VPC endpoints and services is encrypted using TLS/SSL by default, meeting the encryption-in-transit requirement with minimal operational overhead. No additional VPN configurations or third-party appliances are needed, making it the simplest solution.

Answer

Set up a VPC peering connection and configure VPN encryption using a virtual private gateway in each VPC.

Answer

Attach both VPCs to an AWS Direct Connect connection.

Answer

Establish a VPC peering connection between the VPCs.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN. What configuration change is required to avoid routing conflicts?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16.. The VPC CIDR 10.0.0.0/16 is a subset of the on-premises CIDR 10.0.0.0/8. AWS Site-to-Site VPN cannot route traffic correctly when the VPC and on-premises networks have overlapping IP ranges because the VPN connection relies on distinct destination prefixes. The only way to eliminate the conflict is to change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, ensuring no IP address overlap between the two networks.

Answer

Create a more specific route in the VPC route table for the on-premises CIDR.

Answer

Enable route propagation on the VPC route tables.

Answer

Use a VPN connection with static routes instead of BGP.

Question 7

A company is designing a VPC with multiple subnets across three Availability Zones. The application requires that all traffic between subnets within the same AZ stay within that AZ to minimize latency and data transfer costs. Which configuration achieves this?

Accepted Answer

Create a route table for each AZ and associate the subnets in that AZ with the route table. Ensure the route tables have only local routes for the VPC CIDR.. Each Availability Zone (AZ) has its own route table with only the local VPC CIDR route. This ensures that traffic between subnets in the same AZ uses the VPC's local routing, which stays within the AZ's physical infrastructure, minimizing latency and avoiding cross-AZ data transfer costs. AWS VPC local routes inherently keep traffic within the same AZ when source and destination are in the same AZ, as the underlying network fabric directs traffic locally without traversing AZ boundaries.

Answer

Use a single route table for all subnets and add specific routes for each AZ.

Answer

Use an AWS Transit Gateway with separate attachments for each AZ.

Answer

Create a VPC peering connection between subnets in the same AZ.

Question 8

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

Accepted Answer

The PrivateRoute resource references the NAT gateway before it is created.. The PrivateRoute resource references the NAT gateway using a NatGatewayId, but the NAT gateway is defined after the route in the CloudFormation template. Without a DependsOn attribute on the route to ensure the NAT gateway is created first, the route will attempt to reference a non-existent resource, causing a creation failure. This is the most likely cause of the EC2 instance's inability to download patches. Option A is incorrect because the private subnet is indeed associated with a route table (the PrivateRouteTable). Option B is incorrect because the issue pertains to IPv4 traffic, not IPv6; NAT gateway supports IPv4. Option C is incorrect because MapPublicIpOnLaunch is a setting for public subnets and does not affect internet access via NAT gateway.

Answer

The private subnet is not associated with any route table.

Answer

The NAT gateway does not support IPv6 traffic.

Answer

The private subnet does not have MapPublicIpOnLaunch set to true.

Question 9

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC must support IPv6 and have subnets in three Availability Zones. The company plans to use an AWS Transit Gateway to connect multiple VPCs. Which TWO actions are required to enable IPv6 communication between VPCs through the Transit Gateway?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and enable IPv6 on subnets.. Option A is correct because a VPC must first have an Amazon-provided or BYOIP IPv6 CIDR block associated with it, and each subnet must have IPv6 enabled (via an IPv6 subnet CIDR assignment) before any IPv6 traffic can originate or terminate in that VPC. Option B is correct because AWS Transit Gateway supports IPv6, but the TGW route tables must have IPv6 routes propagated or statically added, and the attached VPC route tables must point IPv6 traffic to the TGW, so enabling IPv6 support and configuring IPv6 route propagation is required for inter-VPC IPv6 communication. Option C is incorrect because VPC endpoints (Interface or Gateway) only provide private access to specific AWS services, not transit routing between VPCs. Option D is incorrect because an egress-only internet gateway is a VPC-level component for outbound-only IPv6 internet access and cannot be attached to a Transit Gateway. Option E is incorrect because NAT gateways handle IPv4 NAT and do not support IPv6 or attach to a Transit Gateway.

Answer

Use VPC endpoints to route IPv6 traffic between VPCs.

Answer

Attach an egress-only internet gateway to the Transit Gateway.

Answer

Create a NAT gateway and attach it to the Transit Gateway.

Question 10

A company has a VPC with public and private subnets. The private subnets must access an S3 bucket without traversing the internet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Create a VPC gateway endpoint for S3 and associate it with the private subnet route tables.. Option B is correct because a VPC gateway endpoint for S3 is a route-table target that lets instances in private subnets reach S3 over the AWS private network using the prefix list (pl-xxxxxxxx) for S3, so no internet gateway or NAT is involved. Option D is correct because AWS PrivateLink provides interface VPC endpoints (powered by ENIs with private IP addresses) that allow private connectivity to S3 without traversing the internet, and this is the PrivateLink-based method for reaching S3 privately. Option A is wrong because attaching an internet gateway and routing through it sends traffic over the public internet, which the scenario forbids. Option C is wrong because a VPN to on-premises would route S3 access through the corporate network and the internet, not directly and privately within AWS. Option E is wrong because a NAT gateway in a public subnet still uses the internet gateway to reach S3, so traffic traverses the internet.

Answer

Attach an internet gateway to the VPC and route traffic through it.

Answer

Set up a VPN connection to the on-premises network and access S3 from there.

Answer

Place a NAT gateway in the public subnet and route traffic through it.

Question 11

A company has a VPC with a CIDR of 10.0.0.0/16 and wants to connect to another VPC with CIDR 10.0.0.0/16 in a different account. The VPCs are in the same region. Which THREE steps are necessary to establish connectivity? (Choose THREE.)

Accepted Answer

Change the CIDR block of one VPC to a non-overlapping range.. Option A is correct because VPC peering requires the two VPC CIDR blocks to be non-overlapping; since both VPCs use 10.0.0.0/16, one VPC's CIDR must be changed to a different, non-overlapping range before peering can be established. Option D is correct because cross-account VPC peering is initiated by creating a peering connection request from one account and then accepting that request in the other account. Option E is correct because, after the peering connection is active, route tables in both VPCs must be updated with routes pointing the peer's CIDR block to the pcx peering connection ID. Option B is not correct because VPC endpoints are used to privately access AWS services or endpoint services, not to connect two VPCs to each other. Option C is not correct because a VPN connection is not required for same-region VPC peering and would not by itself establish the peering relationship.

Answer

Create VPC endpoints in each VPC for the other VPC's services.

Answer

Set up a VPN connection between the VPCs.

Question 12

Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?

Accepted Answer

The policy must include a condition that the accepter VPC owner is the target account.. When creating a VPC peering connection across AWS accounts, the requester's IAM policy must include a condition that explicitly allows the action only when the accepter VPC owner is the target account. Without this condition, the ec2:CreateVpcPeeringConnection action will fail because the policy lacks the necessary cross-account authorization context. The condition key aws:SourceAccount or ec2:AccepterVpcOwnerId must be used to restrict the action to the specific accepter account.

Answer

The ec2:CreateVpcPeeringConnection action is not allowed on the accepter VPC.

Answer

The user needs ec2:ModifyVpcPeeringConnectionOptions permission.

Answer

The user needs ec2:CreateVpcEndpoint permission.

Question 13

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application uses Aurora MySQL global database. Which design should be used to minimize cross-region latency for writes?

Accepted Answer

Deploy an ALB in each region with a Global Accelerator endpoint group containing both ALBs.. Deploying an ALB in each region and adding both to a Global Accelerator endpoint group enables active-active traffic distribution with optimal path routing via the AWS global network. Global Accelerator uses Anycast IPs to direct user traffic to the nearest healthy endpoint, minimizing latency. For writes to an Aurora MySQL global database, the primary region handles all write operations, but Global Accelerator ensures that write requests are routed to the primary region's ALB with the lowest possible latency from the client's location, while read traffic can be served locally from the secondary region's ALB.

Answer

Use Route 53 latency-based routing with a single ALB in the primary region.

Answer

Use Amazon CloudFront with origins in both regions and cache invalidation for writes.

Answer

Use Global Accelerator with a single ALB endpoint in one region and failover to the second region.

Question 14

A company wants to provide its employees with access to a set of internal web applications hosted in a VPC. The applications are accessed via an internet-facing ALB. Security requirements mandate that employees connect only from the corporate network (on-premises) and not from the public internet. Which solution meets these requirements?

Accepted Answer

Set up an AWS Client VPN endpoint in the VPC and make the ALB internal. Employees connect via the VPN.. Making the ALB internal ensures it is only reachable from within the VPC, and using an AWS Client VPN endpoint provides a secure, authenticated tunnel from the corporate network. This enforces the requirement that employees connect only from on-premises, as traffic must traverse the VPN and cannot originate from the public internet.

Answer

Make the ALB internal and use a NAT gateway to provide internet access.

Answer

Deploy a CloudFront distribution with an origin access identity pointing to the ALB.

Answer

Keep the ALB internet-facing but restrict access using a security group that allows only the corporate public IP range.

Question 15

A company has a VPC with public and private subnets in three Availability Zones. An internet-facing Network Load Balancer (NLB) is deployed in the public subnets, and a fleet of EC2 instances is in the private subnets. The application logs show intermittent connection timeouts. The security group for the EC2 instances allows traffic from the NLB's security group. What is the MOST likely cause?

Accepted Answer

The EC2 instances' security group allows traffic from the NLB's security group, but the NLB preserves client IP, so the security group must allow client IPs directly.. When an NLB is configured with `preserve_client_ip` enabled (the default for internet-facing NLBs), the source IP of incoming packets is the actual client IP, not the NLB's private IP. Therefore, the EC2 instances' security group must allow traffic from the client IPs, not from the NLB's security group. Since the security group only allows traffic from the NLB's security group, packets from client IPs are dropped, causing intermittent connection timeouts.

Answer

Cross-zone load balancing is disabled on the NLB.

Answer

The NLB's security group is not allowing traffic from the EC2 instances.

Answer

The network ACLs in the private subnets are blocking return traffic.