ANS-C01 Network Design Practice Test 11 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. The private subnet contains Amazon RDS instances that should only be accessed by EC2 instances in the same VPC. The EC2 instances are in a security group named 'App-SG'. Which configuration will meet the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a security group on the RDS instances to allow inbound traffic from the 'App-SG' security group.. Security groups are stateful and can reference other security groups as a source, allowing traffic from all instances associated with the source security group. By configuring the RDS security group to allow inbound traffic from 'App-SG', only EC2 instances in that group can access the RDS instances, meeting the requirement without exposing the database to the entire VPC CIDR.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the VPC CIDR.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

Answer

Configure a security group on the RDS instances to allow inbound traffic from the VPC CIDR.

Question 2

A company is designing a Direct Connect solution with two connections to provide high availability. The company has two customer routers, each connected to a separate AWS Direct Connect location. The company uses BGP to advertise the same prefixes from both routers. What is the correct way to configure the BGP attributes to ensure that traffic uses both connections actively?

Accepted Answer

Advertise the same AS path length from both routers.. Advertising the same AS path length from both routers ensures that AWS Direct Connect routers see both paths as equally preferred under the BGP path selection process (which considers AS path length before MED, local preference, and IGP metric). With equal AS path length, traffic will be load-balanced across both Direct Connect connections, actively using both links for inbound traffic from AWS to the customer network.

Answer

Use AS path prepending on both routers to make the paths equally long.

Answer

Set a higher local preference on the primary router and lower on the secondary.

Answer

Advertise a shorter AS path on the primary router and a longer AS path on the secondary router.

Question 3

A company is using AWS CloudFormation to deploy a VPC with public and private subnets across multiple Availability Zones. The template includes a NAT gateway in each public subnet. The company wants to ensure that the private subnet route tables automatically update when the NAT gateway ID changes. Which feature should be used?

Accepted Answer

Use the 'Fn::GetAtt' intrinsic function to retrieve the NAT gateway ID and pass it to the route.. The `Fn::GetAtt` intrinsic function can retrieve the NAT gateway ID (e.g., `Fn::GetAtt: [NatGateway, NatGatewayId]`) and pass it as the `GatewayId` property of an `AWS::EC2::Route` resource. This ensures that when the NAT gateway is replaced (e.g., due to an update or failure), the route automatically updates to reference the new NAT gateway ID, maintaining connectivity for private subnets without manual intervention.

Answer

Use the 'DependsOn' attribute to ensure the route is created after the NAT gateway.

Answer

Use the 'AWS::EC2::Route' resource with a 'GatewayId' property that references the NAT gateway using 'Ref'.

Answer

Use an AWS Lambda custom resource to update the route table when the NAT gateway changes.

Question 4

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to add an additional non-overlapping CIDR for new workloads. Which CIDR should be used?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it provides a non-overlapping CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must not overlap with the existing VPC CIDR or any of its subnets. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, satisfying this requirement.

Answer

10.0.0.0/24

Answer

10.0.1.0/24

Answer

10.0.0.0/8

Question 5

A company is designing a network for a three-tier web application that must be highly available across multiple Availability Zones. The application uses an Application Load Balancer (ALB) for the web tier, EC2 instances for the application tier, and an Amazon RDS Multi-AZ database for the database tier. Which TWO design choices improve availability and fault tolerance?

Accepted Answer

Configure Amazon RDS Multi-AZ with a standby instance in a different Availability Zone.. Amazon RDS Multi-AZ automatically provisions and maintains a synchronous standby replica in a different Availability Zone, providing automatic failover in the event of an AZ failure or database instance failure. This ensures the database tier remains available without manual intervention, directly improving fault tolerance for the three-tier application.

Answer

Launch all EC2 instances in a single Availability Zone to reduce network latency.

Answer

Use a single NAT gateway in one Availability Zone for all outbound traffic.

Answer

Use VPC Gateway Endpoints for S3 to avoid NAT gateway costs.

Question 6

A company has a VPC with a public subnet and a private subnet. The private subnet contains Amazon RDS instances that should only be accessed by EC2 instances in the same VPC. The EC2 instances are in a security group named 'App-SG'. Which configuration will meet the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the route to an internet gateway from the private subnet's route table.. Options C and D are the correct actions. Removing the route to an internet gateway from the private subnet's route table ensures that the subnet cannot send traffic to or receive traffic from the internet. Launching RDS instances in a private subnet without a public IP address ensures they do not have direct internet connectivity. Option A is not effective because disabling 'Publicly accessible' only prevents RDS from being assigned a public IP address, but if the instance is in a public subnet with a public route, it could still be accessible. Option B is incorrect because a network ACL that denies all inbound traffic from 0.0.0.0/0 would block all inbound traffic, including necessary traffic from within the VPC, and is not a recommended approach. Option E is wrong because configuring a security group to deny all inbound traffic would block all inbound connections, which would prevent legitimate access to RDS from authorized resources.

Answer

Disable the 'Publicly accessible' option for the RDS instances.

Answer

Create a network ACL that denies all inbound traffic from 0.0.0.0/0.

Answer

Configure the security group for the RDS instances to deny all inbound traffic.

Question 7

A company is planning to connect its on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to ensure that if one Direct Connect connection fails, traffic automatically fails over to another. Which THREE design elements should be included?

Accepted Answer

Provision two Direct Connect connections at different AWS Direct Connect locations.. Provisioning two Direct Connect connections at different AWS Direct Connect locations ensures physical diversity. If one location fails, the other connection remains available, providing high availability. This design eliminates a single point of failure at the network edge.

Answer

Use a single customer router with multiple connections to both Direct Connect locations.

Answer

Configure a VPN connection as a backup to Direct Connect.

Question 8

A company has a VPC with public and private subnets in three Availability Zones. They want to provide outbound internet access to instances in private subnets while preventing inbound traffic from the internet. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.. A NAT Gateway is a fully managed AWS service that provides outbound internet access for instances in private subnets while blocking unsolicited inbound connections. By placing the NAT Gateway in a public subnet and adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source NATed to the NAT Gateway's Elastic IP, ensuring inbound traffic from the internet cannot reach the private instances. This solution offers the least operational overhead as AWS handles scaling, patching, and availability, unlike a self-managed NAT instance.

Answer

Deploy a NAT instance in a public subnet and configure the private subnet route table to point to it.

Answer

Attach an Internet Gateway to the VPC and add a default route to it in the private subnet route table.

Answer

Create a VPC Gateway Endpoint for Amazon S3 and route outbound traffic through it.

Question 9

A global company is designing a multi-region architecture with an Active-Passive setup. They want to use Amazon Route 53 to route traffic to the active region and fail over to the passive region during an outage. They need to ensure that the failover is automatic based on health checks. Which routing policy should they use?

Accepted Answer

Failover routing policy. The Failover routing policy in Amazon Route 53 is specifically designed for active-passive configurations. It allows you to designate one record as primary (active) and another as secondary (passive), and Route 53 automatically routes traffic to the secondary record only when the health check associated with the primary record fails. This meets the requirement for automatic failover based on health checks without manual intervention.

Answer

Weighted routing policy

Answer

Latency routing policy

Answer

Geolocation routing policy

Question 10

A company is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company wants to ensure high availability and avoid a single point of failure. The on-premises router connects to two separate AWS Direct Connect locations. Which configuration should be used to meet these requirements?

Accepted Answer

Create two Direct Connect connections, each with a private VIF, and connect them to a Direct Connect gateway that is associated with a Transit VPC.. It uses two separate Direct Connect connections, each with a private VIF, both attached to a Direct Connect gateway. This eliminates a single point of failure at the connection level and, when combined with a Transit VPC, provides redundant, highly available connectivity from the on-premises data center to multiple VPCs. The Direct Connect gateway aggregates the private VIFs and allows traffic to be forwarded to the Transit VPC, which then routes to the attached VPCs, ensuring no single component failure disrupts the hybrid network.

Answer

Create two private VIFs on the same Direct Connect connection and connect each to a different VPC.

Answer

Create a single private virtual interface (VIF) on one Direct Connect connection and connect it to a single VPC.

Answer

Create a Direct Connect gateway and attach a single private VIF from one connection.

Question 11

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and receives traffic from clients. The company wants to improve security by adding an additional layer of protection against common web exploits like SQL injection and cross-site scripting. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF (Web Application Firewall) is the correct service because it is specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and apply customizable rules to block malicious traffic before it reaches the EC2 instances.

Answer

AWS Firewall Manager

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 12

A company has a VPC with CIDR 10.0.0.0/16. They have an on-premises network with CIDR 172.16.0.0/12 connected via AWS Site-to-Site VPN. The company also has a second VPC (VPC B) with CIDR 10.1.0.0/16 peered with the first VPC. They notice that instances in VPC B cannot reach the on-premises network. What is the most likely cause?

Accepted Answer

VPC peering does not support transitive routing.. VPC peering does not support transitive routing. This means that if VPC A is peered with VPC B and also connected to an on-premises network via VPN, traffic from VPC B cannot use VPC A as a transit point to reach the on-premises network. Each VPC must have its own direct connection to the on-premises network, or a transit gateway must be used to enable transitive routing.

Answer

Route propagation is disabled in VPC B.

Answer

The VPN connection is not compatible with VPC peering.

Answer

The VPN tunnel is down.

Question 13

A company is designing a network for a three-tier web application in AWS. The web tier must be accessible from the internet, but the application and database tiers must be private. The company wants to use a single AWS Region and ensure high availability across multiple Availability Zones. What is the MOST cost-effective network design that meets these requirements?

Accepted Answer

Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use a NAT Gateway in each AZ for outbound traffic.. It places web servers in public subnets across three Availability Zones (AZs) for internet-facing access and high availability, while application and database servers reside in private subnets across three AZs for isolation. A NAT Gateway in each AZ provides cost-effective outbound internet connectivity for private instances without exposing them to inbound traffic, and using one NAT Gateway per AZ avoids cross-AZ data transfer charges, which would increase costs if a single NAT Gateway were shared across AZs.

Answer

Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use NAT instances in each AZ behind an Auto Scaling group.

Answer

Place web servers in public subnets and application/database servers in private subnets in one AZ. Use a single NAT Gateway in the public subnet for outbound traffic.

Answer

Place all tiers in public subnets and use security groups to restrict inbound traffic to the web tier only.

Question 14

A company is migrating an on-premises application to AWS. The application requires low-latency, high-throughput connectivity between the on-premises data center and the AWS VPC. The company wants a dedicated, private connection that bypasses the internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This ensures low-latency, high-throughput connectivity ideal for latency-sensitive or high-volume workloads, as it uses a physical cross-connect or hosted virtual interface over a private circuit.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 15

A company has a VPC with multiple subnets. They have an Amazon RDS for MySQL database in a private subnet. The application team needs to access the database for maintenance from a bastion host in a public subnet. The security group for the database allows inbound traffic from the security group of the bastion host on port 3306. However, the application team cannot connect. What is the most likely cause?

Accepted Answer

The network ACL on the private subnet is blocking inbound traffic on port 3306.. The most likely cause is that the network ACL (NACL) on the private subnet is blocking inbound traffic on port 3306. Even though the security group on the RDS instance allows traffic from the bastion host's security group, NACLs are stateless and must explicitly allow both inbound and outbound traffic. By default, custom NACLs deny all inbound traffic, so unless an inbound rule for port 3306 (MySQL) is added, the connection will be dropped at the subnet boundary.

Answer

The database does not have a route to the internet.

Answer

The security group rule for the database is incorrectly configured.

Answer

The bastion host does not have a route to the database subnet.