ANS-C01 Network Design Practice Test 12 — 15 Questions

Question 1

A company wants to use Amazon Route 53 to resolve DNS queries for a domain they own. They want to ensure that DNS queries are answered quickly and that there is no single point of failure. Which configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a hosted zone and let Route 53 automatically handle the DNS resolution.. When you create a hosted zone in Route 53, AWS automatically provisions four authoritative name servers (NS records) distributed across multiple globally redundant data centers. This design inherently provides high availability and low-latency DNS resolution without any additional configuration, as Route 53 uses Anycast routing to direct queries to the nearest healthy name server.

Answer

Deploy Route 53 in multiple AWS Regions.

Answer

Create multiple hosted zones in separate AWS accounts.

Answer

Create a single hosted zone and assign it to one Route 53 name server.

Question 2

A company is designing a VPC architecture with a public subnet and a private subnet. They want to allow instances in the private subnet to download software updates from the internet. Which TWO options satisfy this requirement? (Choose TWO.)

Accepted Answer

Set up a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.. A NAT Gateway in a public subnet provides outbound-only internet access to instances in a private subnet. By adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source-NATed to the NAT Gateway's Elastic IP, allowing downloads while preventing inbound connections from the internet.

Answer

Configure a forward proxy in the private subnet and configure the instances to use it.

Answer

Create a VPC Gateway Endpoint for Amazon S3 and route traffic to it.

Answer

Attach an Internet Gateway to the private subnet and add a default route to it.

Question 3

A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an RDS database in subnet B. Both subnets have network ACLs that allow all inbound and outbound traffic. However, the instance cannot connect to the database. Which TWO configuration changes could solve this issue? (Choose TWO.)

Accepted Answer

Ensure that the route tables associated with both subnets have a local route for the VPC CIDR.. The local route for the VPC CIDR (10.0.0.0/16) is automatically added to the main route table, but if custom route tables are associated with subnets A and B, they must explicitly include this local route to enable routing between subnets within the same VPC. Without it, traffic from the EC2 instance in subnet A cannot reach the RDS database in subnet B, even if network ACLs allow all traffic.

Answer

Attach an Internet Gateway to the VPC.

Answer

Create a VPC peering connection between the subnets.

Answer

Add a NAT Gateway in a public subnet and route traffic through it.

Question 4

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to centralize network management and enable VPC connectivity across accounts. Which THREE services should they consider? (Choose THREE.)

Accepted Answer

AWS Resource Access Manager. AWS Resource Access Manager (RAM) is correct because it enables you to share centrally managed resources, such as Transit Gateways and VPC subnets, across multiple AWS accounts within an AWS Organization. This eliminates the need to create duplicate resources in each account and allows for centralized network management without requiring cross-account IAM roles or complex peering configurations.

Answer

VPC Peering

Answer

AWS Direct Connect

Question 5

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. The company currently has two Direct Connect connections from different providers terminating at two different AWS Direct Connect locations. Which solution provides the most resilient and high-performance connectivity?

Accepted Answer

Use two Direct Connect connections from different providers at different locations with a VPN backup.. Using two Direct Connect connections from different providers at different locations ensures physical and provider diversity, eliminating single points of failure. Adding a VPN backup provides an additional failover path over the internet, which is essential for maintaining connectivity if both Direct Connect links fail. This design meets the requirements for high availability and low latency by leveraging active/active or active/passive traffic engineering with BGP routing and AS path prepending.

Answer

Use a single Direct Connect connection with multiple VLANs.

Answer

Use Site-to-Site VPN over the internet as the primary connection.

Answer

Use two Direct Connect connections from the same provider at the same location.

Question 6

A company is planning to connect multiple VPCs in different AWS accounts using AWS Transit Gateway. The VPCs must be able to communicate with each other, but the company wants to centralize egress traffic to the internet through a single VPC that has a NAT gateway. Which configuration meets these requirements?

Accepted Answer

Attach all VPCs to a Transit Gateway, create a central egress VPC with a NAT gateway, and configure Transit Gateway route tables to send default traffic to the central VPC.. AWS Transit Gateway allows you to attach multiple VPCs from different accounts and centrally manage routing. By configuring the Transit Gateway route tables to send default traffic (0.0.0.0/0) to a central egress VPC that contains a NAT gateway, all other VPCs can route internet-bound traffic through that single NAT gateway, centralizing egress while maintaining inter-VPC communication.

Answer

Use AWS Site-to-Site VPN to connect the VPCs and route traffic through a central VPN endpoint.

Answer

Use VPC peering to connect all VPCs and configure a NAT gateway in one VPC.

Answer

Attach each VPC to a Transit Gateway and configure a NAT gateway in each VPC.

Question 7

A company has a multi-VPC architecture with VPCs in the same region. They need to ensure that traffic between VPCs never traverses the public internet and is encrypted in transit. Which solution meets these requirements with the lowest operational overhead?

Accepted Answer

Use AWS PrivateLink to connect VPCs via Network Load Balancers.. AWS PrivateLink allows you to connect VPCs privately using VPC endpoints and Network Load Balancers. Traffic stays within the AWS network and never traverses the public internet. When the application uses TLS/HTTPS, the traffic is encrypted end-to-end. This solution has low operational overhead because PrivateLink is fully managed and requires no VPN tunnels or third-party appliances.

Answer

Use AWS Transit Gateway with IPsec VPN attachments between VPCs.

Answer

Use VPC peering connections between all VPCs.

Answer

Use AWS Transit Gateway with VPC attachments and enable multicast.

Question 8

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which VPC design meets these requirements with the highest security?

Accepted Answer

Create public subnets for web tier and private subnets for app and database tiers. Use security groups to allow traffic from web to app and app to database.. It uses separate public subnets for the web tier (with an Internet Gateway for inbound traffic) and private subnets for the application and database tiers, which have no direct route to the internet. Security groups act as stateful virtual firewalls at the instance level, allowing you to precisely control traffic flows: the web tier security group allows inbound HTTP/HTTPS from the internet, the application tier security group allows inbound traffic only from the web tier security group, and the database tier security group allows inbound traffic only from the application tier security group. This layered approach enforces least-privilege access and minimizes the attack surface.

Answer

Create a single public subnet and use security groups to restrict traffic between instances.

Answer

Place all instances in public subnets but assign private IP addresses only.

Answer

Use network ACLs on subnets to restrict traffic instead of security groups.

Question 9

A company needs to provide internet access to instances in a private subnet. The instances must not be directly accessible from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate the private IPs of the instances to the gateway's public IP, ensuring the instances remain inaccessible from the outside.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 10

A company is deploying a global application with users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. To reduce latency, the company wants to route users to the nearest region and provide automatic failover. Which combination of AWS services should be used?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks.. Amazon Route 53 latency-based routing directs users to the region with the lowest latency, automatically routing traffic to the nearest region. Combined with health checks, if an endpoint fails, Route 53 automatically fails over to the next lowest-latency healthy endpoint, meeting both the latency reduction and automatic failover requirements.

Answer

Amazon CloudFront with origins in each region.

Answer

AWS Global Accelerator with endpoint groups in each region.

Answer

Amazon Route 53 with geolocation routing and health checks.

Question 11

A company has a VPC with multiple subnets. They want to capture and analyze network traffic between EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the VPC, subnet, or network interface level, enabling detailed analysis of traffic between EC2 instances within the same VPC. This is the correct service because it provides the network-level visibility needed for troubleshooting traffic flows without requiring agents or changes to the instances.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon CloudWatch Metrics

Question 12

A company is designing a network for a real-time gaming application that requires extremely low latency between players. The application will be deployed on EC2 instances in multiple AWS regions. Which AWS service provides the best latency performance by using the AWS global network and anycast IPs?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network and anycast IPs to route traffic to the optimal edge location, then over the AWS backbone to the nearest healthy endpoint. This minimizes internet hops and latency, making it ideal for real-time gaming applications that require consistent low latency across multiple regions.

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Answer

Amazon Route 53 Latency Routing

Question 13

A company needs to connect its on-premises data center to a VPC in AWS using a dedicated, private, and high-bandwidth connection. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center directly to AWS, bypassing the public internet. This meets the requirements for a private, low-latency, and consistent network path, unlike VPN-based solutions that traverse the internet.

Answer

AWS Client VPN

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 14

A company is designing a multi-region active-active application. They need to ensure that traffic is routed to the closest healthy region and that failover happens automatically. Which TWO services should be used together to achieve this?

Accepted Answer

AWS Global Accelerator with endpoint groups. AWS Global Accelerator (C) uses Anycast IPs to direct traffic to the closest healthy endpoint group, automatically rerouting traffic if a region becomes unhealthy. This provides fast regional failover and low-latency routing without DNS caching delays, making it ideal for active-active multi-region applications.

Answer

AWS Transit Gateway with inter-region peering

Answer

Amazon CloudFront with multiple origins

Answer

AWS Direct Connect with multiple locations

Question 15

A company has a VPC with public and private subnets. They want to implement a bastion host to allow secure SSH access to instances in private subnets. Which TWO components are required for this design?

Accepted Answer

A bastion host deployed in a public subnet. A bastion host must be deployed in a public subnet because it needs direct internet access via an Internet Gateway (IGW) to allow administrators to initiate SSH connections from the internet. The bastion then acts as a jump box, forwarding SSH traffic to private instances. Security group rules on the private instances must explicitly allow inbound SSH (TCP port 22) from the bastion host's private IP or security group, ensuring that only the bastion can reach them, not the internet directly.

Answer

A NAT gateway in the public subnet

Answer

An Internet Gateway attached to the VPC

Answer

A Site-to-Site VPN connection to the VPC