ANS-C01 Network Design Practice Test 10 — 15 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a network virtual appliance. Which architecture should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.. It uses an inspection VPC as a central point for traffic inspection. By attaching the network virtual appliance to a dedicated inspection VPC and configuring Transit Gateway route tables to route inter-VPC traffic to that attachment, all traffic between VPCs is forced through the appliance for inspection. This leverages Transit Gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without complex peering or per-VPC appliance deployments.

Answer

Use a Network Load Balancer in each VPC to forward traffic to the appliance.

Answer

Attach the appliance directly to each VPC using VPC Peering.

Answer

Place the appliance in each VPC and configure VPC Peering.

Question 2

A company has a VPC with a CIDR of 172.16.0.0/16. They have a subnet 172.16.1.0/24 for web servers and another subnet 172.16.2.0/24 for database servers. The web servers need to access the database servers on port 3306. Which configuration is required?

Accepted Answer

Web SG: outbound to DB SG on port 3306. DB SG: inbound from web SG on port 3306.. Security groups are stateful and control traffic at the instance level. The web server security group needs an outbound rule allowing traffic to the database security group on port 3306, and the database security group needs an inbound rule allowing traffic from the web security group on port 3306. This ensures that only the web servers can initiate connections to the database servers on the required port.

Answer

Configure network ACLs to allow inbound on port 3306 from web subnet.

Answer

Web SG: inbound from 0.0.0.0/0 on port 3306. DB SG: outbound to web SG on port 3306.

Answer

Web SG: outbound to DB SG on all ports. DB SG: inbound from web SG on all ports.

Question 3

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. Instances in the private subnet need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, instances cannot reach the internet. What is a possible cause?

Accepted Answer

The route table for the NAT Gateway's subnet does not have a route to an Internet Gateway.. For a NAT Gateway to route traffic to the internet, its subnet must have a route to an Internet Gateway (IGW). The NAT Gateway resides in the public subnet, and the public subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW. Without this route, the NAT Gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT Gateway.

Answer

The NAT Gateway is in a private subnet.

Answer

The network ACL on the private subnet is blocking outbound traffic.

Answer

The NAT Gateway does not have a security group allowing outbound traffic.

Question 4

A company needs to resolve DNS names for their EC2 instances using custom domain names like "app.example.com". Which AWS service should they use?

Accepted Answer

Amazon Route 53. Amazon Route 53 is a scalable DNS web service that can resolve custom domain names like 'app.example.com' to EC2 instance IP addresses. It supports private hosted zones for VPCs, enabling DNS resolution for internal resources without exposing them to the internet, and integrates with EC2 via alias records or health checks.

Answer

AWS Cloud Map

Answer

AWS Directory Service

Answer

Amazon Cognito

Question 5

A company is designing a VPC with multiple subnets. They want to ensure that EC2 instances in a private subnet can access S3 buckets without going through a NAT Gateway or Internet Gateway. Which TWO methods can accomplish this?

Accepted Answer

Create a Gateway VPC Endpoint for S3. A Gateway VPC Endpoint for S3 allows EC2 instances in a private subnet to access S3 buckets privately using AWS’s internal network, without requiring an Internet Gateway or NAT Gateway. It uses prefix lists and route table entries to direct S3 traffic through the endpoint, leveraging the AWS global network for secure, low-latency access.

Answer

Set up a VPN connection to S3

Answer

Use AWS Direct Connect to access S3

Answer

Attach an Internet Gateway and use a NAT Gateway

Question 6

A company is setting up a Site-to-Site VPN connection between their on-premises network and AWS. Which THREE components are required for a VPN connection?

Accepted Answer

VPN Tunnel. A VPN tunnel is a required component for an AWS Site-to-Site VPN connection because it provides the encrypted, secure communication channel between the on-premises customer gateway and the AWS virtual private gateway. Each VPN connection consists of two tunnels for high availability, each using IPsec (IKEv1 or IKEv2) to encrypt traffic. Without at least one VPN tunnel, no encrypted data can traverse the VPN connection.

Answer

Transit Gateway

Answer

Internet Gateway

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to another VPC with CIDR 10.0.0.0/16 via VPC Peering. They encounter an error because of overlapping CIDRs. Which TWO actions can resolve this issue?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and peer with that. Creating a new VPC with a non-overlapping CIDR and establishing a VPC peering connection resolves the conflict. VPC peering requires that the CIDR blocks of the two VPCs do not overlap, as overlapping ranges prevent proper route table entries and cause routing ambiguity. By using a non-overlapping CIDR, you enable direct connectivity between the VPCs without IP address conflicts.

Answer

Use a subnet-level peering connection

Answer

Modify the CIDR of one VPC to a non-overlapping range

Answer

Use a NAT Gateway to translate IPs

Question 8

The EC2 instance has a private IP 10.0.1.5. The first two hops are 10.0.1.1 (the subnet's default gateway) and 10.0.0.1. Based on the traceroute, what is the most likely configuration of the VPC?

Accepted Answer

The subnet is a private subnet with no route to an Internet Gateway, and the default route points to a NAT instance or is missing. The traceroute shows the first hop as 10.0.1.1 (the subnet's default gateway) and the second hop as 10.0.0.1 (the VPC router's IP for the main route table). The absence of a third hop to a public IP or NAT device indicates that the instance's traffic is not being forwarded beyond the VPC router. This is consistent with a private subnet that has no route to an Internet Gateway and either has no default route or a default route pointing to a NAT instance that is not responding or is missing, causing the traceroute to stop at the VPC router.

Answer

The subnet is a public subnet with a route to an Internet Gateway

Answer

The subnet is a private subnet with a route to a NAT Gateway

Answer

The subnet is connected to a VPN

Question 9

A network engineer needs to create a set of IAM permissions for a DevOps team to monitor network resources. The policy above is proposed. What critical missing permission is required to allow the team to list and describe VPCs?

Accepted Answer

ec2:DescribeVpcs. The correct permission to list and describe VPCs is `ec2:DescribeVpcs`. This API call returns information about one or more VPCs, including their CIDR blocks, state, and tags. Without this specific permission, the DevOps team cannot retrieve VPC details, even if they have other EC2 describe permissions.

Answer

ec2:DescribeVpcPeeringConnections

Answer

ec2:DescribeSubnets

Answer

ec2:CreateVpc

Question 10

A network engineer deploys this CloudFormation template. After deployment, an EC2 instance launched in PublicSubnet1 cannot reach the internet. What is the most likely cause?

Accepted Answer

The subnet does not have a route to the Internet Gateway because the route table is not associated with the subnet.. The most likely cause is that the route table containing the default route (0.0.0.0/0) pointing to the Internet Gateway is not associated with PublicSubnet1. Without this association, traffic from the subnet has no path to the Internet Gateway, even if the IGW is attached to the VPC. CloudFormation templates often create separate route tables and subnets, and a missing subnet-to-route-table association is a common misconfiguration.

Answer

The Internet Gateway is not attached to the VPC.

Answer

The subnet does not have MapPublicIpOnLaunch set to true.

Answer

The security group is blocking outbound traffic.

Question 11

A company is designing a hybrid network with AWS Direct Connect and AWS Site-to-Site VPN as backup. The primary Direct Connect connection uses a private VIF to a VPC. If the Direct Connect fails, traffic should automatically fail over to the VPN connection. What is the MOST reliable way to achieve this failover?

Accepted Answer

Use BGP on both connections and prepend AS paths on the VPN routes to make them less preferred.. Using BGP on both connections allows for dynamic routing and automatic failover. By prepending AS paths on the VPN routes, you make the VPN path less preferred, ensuring that Direct Connect is the primary path. If Direct Connect fails, the BGP session drops and the VPN routes become active. This method provides symmetric failover in both directions and is recommended by AWS.

Answer

Use BGP on Direct Connect and static routes on the VPN connection, with a higher metric for the VPN static route.

Answer

Configure static routes on the customer gateway device with a lower metric for the Direct Connect interface.

Answer

Use BGP on both connections and set a lower local preference on the Direct Connect routes.

Question 12

A financial services company must meet PCI DSS compliance for its VPC design. It requires that all traffic between application tiers be encrypted in transit and that no traffic can bypass the encryption. The architecture includes a public-facing Application Load Balancer (ALB), a web tier in public subnets, an app tier in private subnets, and a database tier in isolated subnets. Which design meets these requirements?

Accepted Answer

Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use TLS mutual authentication between web and app tier. Use TLS between app and database tier.. It ensures encryption in transit for all traffic between application tiers, meeting PCI DSS requirements. The ALB terminates TLS from clients, then uses HTTPS (TLS) to the web tier, mutual TLS between web and app tiers for strong authentication and encryption, and TLS between app and database tiers. This design prevents any unencrypted traffic from bypassing encryption, as every hop uses TLS.

Answer

Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.

Answer

Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.

Answer

Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use HTTP between web and app tier. Use TLS between app and database tier.

Question 13

A company is deploying a multi-region Active-Active application using Amazon Route 53 latency-based routing. The application runs on EC2 instances behind Network Load Balancers (NLBs) in two AWS regions. The health checks are configured for the NLBs. What should the company do to ensure that traffic is sent only to healthy endpoints?

Accepted Answer

Use Route 53 latency-based routing and associate health checks.. Route 53 latency-based routing directs traffic to the region with the lowest latency for the user. By associating health checks with the latency records, Route 53 automatically excludes any endpoint that fails its health check (e.g., an unhealthy NLB) from DNS responses, ensuring traffic is sent only to healthy endpoints. This meets the requirement for an Active-Active multi-region setup where both regions serve traffic simultaneously.

Answer

Use Route 53 geolocation routing and associate health checks.

Answer

Use Route 53 weighted routing and associate health checks.

Answer

Use Route 53 failover routing with primary and secondary records.

Question 14

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center over AWS Direct Connect. The on-premises network uses the 10.0.0.0/8 address space. The company cannot change the on-premises addressing. Which solution will allow connectivity without overlapping IP addresses?

Accepted Answer

Assign IPv6 CIDR to the existing VPC, use IPv6 for all resources, and connect over Direct Connect using IPv6.. Assigning an IPv6 CIDR to the existing VPC and using IPv6 for all resources avoids the IPv4 address overlap with the on-premises 10.0.0.0/8 network. AWS Direct Connect supports both IPv4 and IPv6 traffic, so you can establish a BGP session over IPv6 and route IPv6 traffic between the VPC and on-premises, completely bypassing the conflicting IPv4 address space.

Answer

Use VPC peering between the existing VPC and a new VPC with a non-overlapping CIDR, then route traffic through the new VPC.

Answer

Create a new VPC with a non-overlapping CIDR such as 172.16.0.0/16 and migrate resources.

Answer

Use AWS Transit Gateway with a Network Address Translation (NAT) attachment to translate the VPC CIDR.

Question 15

A company has a VPC with public and private subnets. The public subnet has a NAT gateway for outbound internet access from private subnets. The private subnets have EC2 instances that need to access an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. What is the MOST cost-effective solution?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach a policy allowing access from the private subnets.. A VPC Gateway Endpoint for S3 allows private subnet instances to access S3 over the AWS network without traversing the internet or a NAT gateway, eliminating data transfer costs for the NAT gateway and avoiding internet egress charges. This is the most cost-effective solution because gateway endpoints are free and use prefix lists in the route table to direct traffic to S3 via the AWS backbone.

Answer

Configure an S3 bucket policy that restricts access to the VPC's public IP addresses.

Answer

Route traffic to the NAT gateway and then to the S3 bucket using a VPC peering connection.

Answer

Create a VPC Interface Endpoint for S3 and associate with the private subnets.