ANS-C01 Network Design Practice Test 13 — 15 Questions

Question 1

A company is designing a network for a critical application that requires maximum availability. The application will be deployed across multiple Availability Zones in a single region. Which THREE design choices improve network availability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Application Load Balancer with targets in multiple Availability Zones. An Application Load Balancer (ALB) with targets in multiple Availability Zones (AZs) improves availability by distributing incoming traffic across healthy targets in different AZs. If one AZ fails, the ALB automatically routes traffic to targets in the remaining AZs, ensuring the application remains accessible. This design eliminates a single point of failure at the load balancer level and leverages the regional nature of the ALB to provide cross-AZ fault tolerance.

Answer

Use a single NAT gateway in one Availability Zone

Answer

Use a single subnet per Availability Zone

Question 2

A company is designing a hybrid network architecture that connects an on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that the on-premises network can reach all VPCs in the AWS account using a single Direct Connect virtual interface. Which solution should the architect use?

Accepted Answer

Create a transit gateway and a Direct Connect gateway. Attach the VPCs to the transit gateway and associate the transit gateway with the Direct Connect gateway.. A transit gateway acts as a central hub for VPC-to-VPC and on-premises connectivity, and when associated with a Direct Connect gateway via a transit virtual interface, it allows a single Direct Connect connection to reach multiple VPCs. The Direct Connect gateway terminates the BGP session from on-premises and forwards traffic to the transit gateway, which then routes to the attached VPCs. This design scales to many VPCs without requiring multiple virtual interfaces or complex peering.

Answer

Create a Direct Connect gateway and associate all VPCs directly.

Answer

Create VPC peering connections between all VPCs and the on-premises network.

Answer

Create a virtual private gateway and attach all VPCs to it.

Question 3

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must have the lowest possible latency for global users. Which design meets these requirements?

Accepted Answer

Use AWS Global Accelerator with endpoints in both regions and configure traffic dials to distribute traffic.. AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal endpoint based on health, latency, and traffic dials. By configuring endpoints in both regions with traffic dials, you can distribute traffic actively across both regions, ensuring the lowest possible latency for global users by directing them to the nearest healthy endpoint.

Answer

Use Amazon CloudFront with multiple origins pointing to each ALB.

Answer

Use Amazon Route 53 with latency routing policy to route users to the closest ALB.

Answer

Use AWS Global Accelerator with a single endpoint in one region and failover to the other region.

Question 4

A company has a VPC with public and private subnets. The private subnets need internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT gateway. A NAT gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses the internet gateway for outbound traffic, but it does not allow inbound traffic to reach the private instances directly.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC endpoint

Question 5

A company is designing a network for a three-tier web application. The web tier must be able to scale out and in automatically based on CPU utilization. The database tier must be highly available and use Multi-AZ deployment. Which combination of AWS services should the architect use?

Accepted Answer

Application Load Balancer, Auto Scaling group, Amazon RDS Multi-AZ. An Application Load Balancer (ALB) operates at Layer 7, which is ideal for distributing HTTP/HTTPS traffic to a web tier that scales out and in automatically via an Auto Scaling group based on CPU utilization. Amazon RDS Multi-AZ provides synchronous standby replication across Availability Zones, ensuring high availability for the database tier by automatically failing over to the standby in case of an outage.

Answer

Network Load Balancer, Auto Scaling group, Amazon RDS Multi-AZ

Answer

Application Load Balancer, Auto Scaling group, Amazon DynamoDB

Answer

Classic Load Balancer, Auto Scaling group, Amazon RDS Single-AZ

Question 6

A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?

Accepted Answer

Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.. AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.

Answer

Create VPC peering connections between each VPC in different accounts.

Answer

Configure VPC endpoints in each account to communicate through the network account.

Answer

Set up AWS Direct Connect between accounts and route through the network account.

Question 7

A company wants to provide secure access to an S3 bucket from a VPC without using an internet gateway or NAT device. Which AWS feature should be used?

Accepted Answer

VPC endpoint (Gateway type) for S3. A VPC endpoint (Gateway type) for S3 allows instances within a VPC to access S3 buckets privately using the AWS network, without requiring an internet gateway or NAT device. This is achieved by adding an endpoint route in the VPC route table that directs S3 traffic through the AWS backbone, ensuring data never traverses the public internet.

Answer

Internet gateway

Answer

NAT gateway

Answer

AWS Site-to-Site VPN connection

Question 8

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to add a secondary CIDR block for additional subnets. Which CIDR block can be used?

Accepted Answer

10.1.0.0/16. Options A (10.1.0.0/16), B (172.16.0.0/16), and C (192.168.0.0/16) are all valid secondary CIDR blocks for a VPC with a primary CIDR of 10.0.0.0/16. They are all RFC 1918 private IP ranges that do not overlap with the primary CIDR. AWS allows adding any non-overlapping private CIDR block as a secondary, regardless of whether it belongs to the same /8 range. Option D (10.0.0.0/16) is invalid because it overlaps exactly with the primary CIDR. Note: This question has multiple correct answers; you must select all that apply.

Answer

10.0.0.0/16

Question 9

A company is designing a network for a real-time gaming application that requires low latency and high throughput between game servers in multiple regions. The application uses UDP traffic. Which AWS service should be used to route traffic between regions?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the Anycast IP address and the AWS global network to route UDP traffic from users to the optimal regional endpoint, minimizing latency and jitter. It is designed for real-time applications like gaming that require low-latency and high-throughput UDP traffic between regions, as it bypasses the public internet and leverages AWS's internal backbone.

Answer

AWS Transit Gateway

Answer

Amazon CloudFront

Answer

Amazon Route 53

Question 10

A company has an on-premises data center connected to AWS via a Site-to-Site VPN. The VPN connection uses BGP for dynamic routing. The company wants to add an additional VPN tunnel for redundancy. What must be configured?

Accepted Answer

Create a second VPN connection to a second customer gateway device.. To add an additional VPN tunnel for redundancy, you must create a second VPN connection that uses a second customer gateway device. This provides a second BGP session and a separate tunnel, ensuring failover if the primary tunnel or customer gateway fails. The existing virtual private gateway can support multiple VPN connections, so no replacement or additional VGW is needed.

Answer

Create a second virtual private gateway and attach it to the VPC.

Answer

Add a transit gateway to replace the virtual private gateway.

Answer

Configure static routes instead of BGP.

Question 11

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (Option A) is a valid method to connect multiple VPCs in the same AWS region. It uses the AWS global network infrastructure to create a one-to-one, private IPv4 or IPv6 routing connection between two VPCs, allowing traffic to flow as if they were on the same network. This is a direct, non-transitive connection that does not require a separate transit hub.

Answer

AWS Direct Connect

Answer

VPC endpoints

Answer

Site-to-Site VPN

Question 12

Which THREE of the following are benefits of using AWS Global Accelerator over Amazon CloudFront for a global application that uses TCP traffic? (Select THREE.)

Accepted Answer

Provides static IP addresses that act as a fixed entry point.. AWS Global Accelerator provides static IP addresses that act as a fixed entry point for your application, which is a key benefit over Amazon CloudFront. CloudFront uses dynamic, regional edge IP addresses that can change, whereas Global Accelerator offers two static anycast IP addresses that remain constant, simplifying DNS management and firewall whitelisting for TCP-based global applications.

Answer

Provides content caching at edge locations.

Answer

Automatically integrates with AWS WAF and AWS Shield Advanced.

Question 13

Which TWO of the following are required to establish an AWS Site-to-Site VPN connection? (Select TWO.)

Accepted Answer

Virtual private gateway. A virtual private gateway (VGW) is required as the AWS-side endpoint for the VPN tunnel; it anchors the encrypted IPsec session and routes traffic from the VPC to the on-premises network. The customer gateway (CGW) represents the on-premises VPN device in AWS, providing the public IP and BGP ASN (for dynamic routing) or static route configuration needed to establish the tunnel. Both are mandatory components of an AWS Site-to-Site VPN connection.

Answer

Direct Connect gateway

Answer

Transit gateway

Answer

VPN connection

Question 14

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs in different AWS Regions is encrypted. Which solution should they use?

Accepted Answer

Transit Gateway inter-Region peering. Transit Gateway inter-Region peering is the correct solution because it provides encrypted traffic between VPCs in different AWS Regions natively, using the AWS global network infrastructure with automatic encryption at the transport layer. This feature supports transitive routing and does not require additional VPN tunnels or third-party appliances, making it the most efficient and scalable option for multi-region VPC connectivity.

Answer

Direct Connect gateway with VIFs

Answer

Transit Gateway VPN attachments

Answer

VPC peering with VPN encryption

Question 15

A financial services company must meet PCI DSS compliance requirements. They have a VPC with public and private subnets. The web servers in the public subnets must only accept traffic from the internet on ports 80 and 443. The application servers in the private subnets must only accept traffic from the web servers. Which network design ensures least-privilege access?

Accepted Answer

Use a Network ACL on the public subnet allowing inbound ports 80 and 443 from 0.0.0.0/0, and security groups on web and app servers with the app servers' security group referencing the web servers' security group. It uses security groups for stateful, least-privilege access control. The web servers' security group allows inbound ports 80 and 443 from 0.0.0.0/0, and the app servers' security group references the web servers' security group as the source, ensuring only traffic from the web servers is permitted. This design leverages security group chaining, which automatically handles return traffic and avoids the need for explicit CIDR management, aligning with PCI DSS least-privilege requirements.

Answer

Use security groups on web servers allowing 0.0.0.0/0 on ports 80/443, and on app servers allowing the web servers' CIDR block

Answer

Use a single Network ACL for both public and private subnets with allow rules for ports 80 and 443

Answer

Use a single Network ACL on the private subnet allowing inbound ports 80 and 443 from the public subnet CIDR