ANS-C01 Network Design Practice Test 11 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download updates from the internet. The company wants to minimize costs and avoid exposing the instance to inbound internet traffic. Which solution should the engineer choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway.. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for updates) while remaining unreachable from inbound internet traffic. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then uses the Internet Gateway for outbound traffic. This is the most cost-effective and fully managed solution compared to a NAT instance, as it avoids per-instance management and scales automatically.

Answer

Deploy a NAT instance in the private subnet and route traffic through it.

Answer

Configure a forward proxy on the EC2 instance itself.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 2

A company is designing a Direct Connect solution for high availability. Which TWO actions meet the requirement for diverse physical paths?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option B is correct because provisioning two Direct Connect connections at two different Direct Connect locations ensures physically diverse paths, since each location has separate fiber, power, and equipment, satisfying the high-availability requirement for diverse physical paths. Option C is correct because using a Transit Gateway with attachments to multiple Direct Connect gateways allows traffic to traverse separate Direct Connect connections that can terminate at different locations, providing path diversity and redundancy at the network layer. Option A is not sufficient because two connections at the same Direct Connect location may share the same physical infrastructure and are not considered diverse physical paths. Option D is incorrect because a single Direct Connect connection with LAG aggregates links that typically terminate at the same location and do not provide physical path diversity. Option E is incorrect because a single Direct Connect connection with a VPN backup provides redundancy but the VPN runs over the public internet, not a diverse physical Direct Connect path.

Answer

Provision two Direct Connect connections at the same Direct Connect location.

Answer

Provision a single Direct Connect connection and use link aggregation (LAG).

Answer

Use a single Direct Connect connection with a VPN backup.

Question 3

A Network Engineer is troubleshooting a cross-account VPC endpoint connection. The service provider account (123456789012) has the above IAM policy attached to the endpoint service. The consumer account (111111111111) has created a VPC endpoint (vpce-abc123) and is trying to accept the connection. The consumer receives an 'AccessDenied' error when calling ec2:AcceptVpcEndpointConnections. What is the MOST likely cause?

Accepted Answer

The consumer account does not have permission to accept the connection; only the service provider can accept.. The 'AccessDenied' error occurs because the consumer account (111111111111) is attempting to call ec2:AcceptVpcEndpointConnections, which is an API action that only the service provider account (123456789012) can perform. The IAM policy shown is attached to the endpoint service in the provider account, but the consumer does not have permission to accept its own connection; instead, the provider must accept the endpoint connection request. This is a fundamental AWS VPC endpoint service behavior where the provider controls acceptance, not the consumer.

Answer

The policy action should be 'ec2:CreateVpcEndpoint' instead.

Answer

The policy condition 'aws:SourceArn' does not match the consumer's endpoint ARN.

Answer

The policy resource ARN is incorrect; it should be the endpoint service ARN.

Question 4

A company is designing a multi-region active-active architecture with Amazon Route 53. The application is deployed behind Application Load Balancers (ALBs) in us-east-1 and eu-west-1. The company wants to minimize latency for users and provide automatic failover. Which routing policy should be used?

Accepted Answer

Latency-based routing policy. Latency-based routing policy is the correct choice because it directs traffic to the AWS region that provides the lowest latency for the end user, which aligns with the requirement to minimize latency. Additionally, Route 53 automatically performs health checks on the ALBs; if one region's ALB becomes unhealthy, Route 53 routes traffic to the healthy region, providing automatic failover in an active-active architecture.

Answer

Failover routing policy

Answer

Geolocation routing policy

Answer

Weighted routing policy

Question 5

A financial services company must ensure that all traffic between its on-premises data center and VPC is encrypted in transit and does not traverse the public internet. The company has an AWS Direct Connect connection. Which solution meets these requirements?

Accepted Answer

Use a private virtual interface (VIF) over the Direct Connect connection and establish an IPsec VPN tunnel over the private VIF. A private virtual interface (VIF) provides private, non-internet-routed connectivity between the on-premises data center and the VPC over AWS Direct Connect. However, Direct Connect itself does not natively encrypt traffic; by establishing an IPsec VPN tunnel over the private VIF, you add end-to-end encryption (e.g., using AES-256) while keeping all traffic off the public internet, meeting both requirements.

Answer

Use a private virtual interface (VIF) and rely on Direct Connect encryption

Answer

Use a public virtual interface (VIF) over the Direct Connect connection and configure an IPsec VPN tunnel over it

Answer

Use a transit virtual interface (VIF) over the Direct Connect connection and attach it to a transit gateway

Question 6

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

Accepted Answer

Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group. The most secure architecture because it restricts SSH access to the bastion host from only the corporate IP range, and the database security group allows MySQL (port 3306) traffic solely from the bastion host's security group. This ensures the database is never directly exposed to the internet and only accepts connections from the bastion, which itself is locked down to authorized corporate IPs. The use of security group referencing (instead of IP-based rules) provides dynamic, scalable access control that automatically applies to any instances with the bastion's security group.

Answer

Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

Answer

Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

Answer

Connect to the database directly using a Site-to-Site VPN without a bastion host

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. It has a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet, using AWS's internal network. By adding a route in the private subnet's route table pointing to the gateway endpoint (prefix list for S3), traffic destined for S3 stays within the AWS network, meeting the requirement to avoid internet transit.

Answer

Create a VPC Interface Endpoint for S3 and associate it with the private subnet

Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway

Answer

Set up an AWS Direct Connect connection and use a private virtual interface

Question 8

A company has a VPC with two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an EC2 instance in subnet B. The instances are in the same VPC. What is the default behavior?

Accepted Answer

Communication is allowed by default because they are in the same VPC. By default, all instances within the same VPC can communicate with each other regardless of which subnet they reside in, as long as the VPC's main route table and network ACLs allow the traffic. The VPC's implicit router provides connectivity between all subnets, and the default security group allows inbound traffic from other members of the same security group. Therefore, an EC2 instance in subnet A can communicate with an instance in subnet B without any additional configuration.

Answer

Communication is not allowed by default; a VPC peering connection is required

Answer

Communication is allowed only if they are in the same subnet

Answer

Communication is allowed only if a transit gateway is attached

Question 9

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host databases that must be accessible only from the application servers in the public subnets. Which VPC feature should be used to allow the application servers to access the databases while preventing direct internet access to the databases?

Accepted Answer

Attach a NAT Gateway in a public subnet and update the route table of the private subnets to point to the NAT Gateway for outbound traffic.. Although application servers in public subnets can reach databases in private subnets using private IPs within the VPC, a NAT Gateway enables instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while blocking inbound traffic from the internet. This meets the requirement to prevent direct internet access to the databases. The private subnet route table is updated to direct 0.0.0.0/0 traffic to the NAT Gateway, and because there is no route to an Internet Gateway, the databases remain inaccessible from the internet.

Answer

Create a VPC Peering connection between the public and private subnets.

Answer

Attach an Internet Gateway to the VPC and update the route table of the private subnets to point to the Internet Gateway.

Answer

Attach a Virtual Private Gateway to the VPC and update the route table of the private subnets.

Question 10

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add additional IP address space for new subnets. The existing subnets use 10.0.0.0/17 and 10.0.128.0/17. Which CIDR block should be added as a secondary CIDR to the VPC to provide the most additional contiguous address space?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because the VPC already uses the entire 10.0.0.0/16 range (split into 10.0.0.0/17 and 10.0.128.0/17). To add contiguous address space, you must use a different /16 block that is adjacent in the private IPv4 address space, such as 10.1.0.0/16. AWS VPCs support secondary CIDRs that must not overlap with existing CIDRs, and 10.1.0.0/16 provides a non-overlapping, contiguous block.

Answer

10.0.0.0/0

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 11

A company has deployed a web application using an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The application experiences intermittent high latency. The network team suspects that the ALB is being overwhelmed by traffic. Which metrics should be analyzed in Amazon CloudWatch to determine if the ALB is the bottleneck?

Accepted Answer

SurgeQueueLength and SpilloverCount. SurgeQueueLength and SpilloverCount are the correct metrics to analyze because they directly indicate whether the ALB is overwhelmed. SurgeQueueLength measures the number of requests waiting to be routed to a target, and SpilloverCount tracks requests that were rejected because the queue was full. If these metrics are consistently high or non-zero, the ALB is the bottleneck, as it cannot keep up with incoming traffic.

Answer

ActiveConnectionCount and NewConnectionCount

Answer

RequestCount and TargetResponseTime

Answer

HealthyHostCount and UnhealthyHostCount

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They have set up a VPC peering connection with another VPC (CIDR 172.16.0.0/16). The route tables are configured correctly. However, instances in the first VPC cannot communicate with instances in the peered VPC. The security groups and network ACLs are configured to allow all traffic. What is the most likely cause?

Accepted Answer

The DNS resolution settings for the VPC peering connection are not enabled.. The most likely cause is that the VPC peering connection's DNS resolution settings are not enabled. While basic IP connectivity does not require DNS, if instances are using private DNS hostnames (a common default), DNS queries for the peered VPC will fail unless this setting is enabled. Since the route tables are correctly configured, security groups allow all traffic, and CIDR ranges do not overlap, the DNS resolution setting is the only remaining plausible cause from the options.

Answer

The route tables in the VPCs are not propagated to the subnets.

Answer

The instances do not have ICMP traffic allowed.

Answer

The VPC CIDR ranges overlap.

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16. They have created a VPC peering connection with another VPC (CIDR 10.1.0.0/16). They want to enable DNS resolution between the VPCs. Which TWO actions must be taken?

Accepted Answer

Both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings.. Option B is correct because enabling DNS resolution across a VPC peering connection requires that both the requester and accepter VPCs have their enableDnsSupport attribute set to true (via the VPC settings 'Enable DNS Resolution'), which allows the VPC DNS server to resolve names for the peered VPC. Option D is correct because DNS resolution over a peering connection is not enabled by default; the accepter of the peering connection must explicitly modify the peering connection attributes to enable DNS resolution from their side (the requester also enables it on their side), using the modify-vpc-peering-connection-options action with the allowDnsResolutionFromRemoteVpc flag. Option A is incorrect because accepting the peering connection does not include an 'Enable DNS Resolution' checkbox; DNS resolution is a separate attribute modified after acceptance. Option C is incorrect because VPC peering and DNS resolution work for both inter-region and intra-region peering, so same-region placement is not required. Option E is incorrect because route table entries are needed for traffic routing, not for DNS name resolution between peered VPCs.

Answer

The requester must accept the peering connection with the 'Enable DNS Resolution' option checked.

Answer

Ensure both VPCs are in the same AWS region.

Answer

The route tables must include a route for the peered VPC's CIDR.

Question 14

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). They have added routes in both route tables. However, instances in VPC A cannot ping instances in VPC B. The security groups and network ACLs allow ICMP. What is the most likely cause?

Accepted Answer

The route tables in VPC A do not have a route to VPC B CIDR pointing to the peering connection. The question states that routes have been added in both route tables, but the most likely cause is that the route in VPC A's route table does not point to the VPC peering connection as the target. Without a specific route for VPC B's CIDR (10.1.0.0/16) with the peering connection ID as the target, traffic from VPC A to VPC B will not be forwarded over the peering link, even if security groups and NACLs permit ICMP.

Answer

The security groups in VPC B do not allow inbound ICMP from VPC A CIDR

Answer

The VPC peering connection is not in the 'active' state

Answer

The instances are in different Availability Zones

Question 15

A company is deploying a critical application across multiple Availability Zones in a single AWS Region. They need a network design that provides the lowest possible latency between application tiers and supports automatic failover if an AZ becomes unavailable. Which design meets these requirements?

Accepted Answer

Deploy an internal NLB per Availability Zone, with each NLB only registering targets in its own AZ, and an internet-facing Application Load Balancer (ALB) with targets in all AZs. Deploying an internal NLB per Availability Zone ensures cross-zone traffic is minimized, reducing latency between application tiers, while the internet-facing ALB provides automatic failover by distributing incoming traffic across healthy targets in all AZs. The NLB's per-AZ design keeps traffic within the same AZ for internal communication, and the ALB's health checks enable automatic rerouting if an AZ becomes unavailable.

Answer

Use Amazon Route 53 weighted routing to distribute traffic to each AZ

Answer

Use a single internal Classic Load Balancer across all AZs

Answer

Deploy an internal Network Load Balancer (NLB) in a single AZ and route traffic from other AZs through it