ANS-C01 Network Design Practice Test 13 — 15 Questions

Question 1

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) in us-east-1 and eu-west-1, with Route 53 latency-based routing. Users report that after a failover, existing connections fail. What should the company implement to ensure seamless failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Global Accelerator instead of Route 53. AWS Global Accelerator provides a static anycast IP address that remains constant during failover. Clients connect to the same IP, and the accelerator directs traffic to the healthy regional endpoint without breaking existing connections. Route 53 latency-based routing relies on DNS, which changes the resolved IP on failover, causing existing TCP connections to fail. Sticky sessions (session affinity) on ALBs only persist within a single ALB and do not help when traffic is redirected to a different region. Therefore, Global Accelerator ensures seamless failover for existing connections.

Answer

Enable client IP affinity on the ALBs

Answer

Use Amazon Route 53 geolocation routing instead of latency

Answer

Enable sticky sessions (session affinity) on the ALBs with a cookie duration

Question 2

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates but must not be accessible from the internet. Which combination of resources meets these requirements with the least operational overhead?

Accepted Answer

A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway. A NAT Gateway in each public subnet provides outbound-only internet access for instances in private subnets, with no inbound accessibility from the internet. This solution requires minimal operational overhead because NAT Gateways are fully managed by AWS, automatically handle failover across Availability Zones, and scale up to 45 Gbps without manual intervention. The private route table simply needs a default route (0.0.0.0/0) pointing to the NAT Gateway, which forwards traffic to the Internet Gateway attached to the VPC.

Answer

A VPC endpoint for Amazon S3 in each private subnet

Answer

A NAT instance in each public subnet, with a route in the private route tables pointing to the NAT instance

Answer

An Internet Gateway attached to the VPC with a route in the private route tables pointing to the Internet Gateway

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16. It needs to create a secondary CIDR block for additional subnets that must not overlap with the existing CIDR. Which CIDR block should be used?

Accepted Answer

172.16.0.0/16. Both A (172.16.0.0/16) and D (10.1.0.0/16) are correct because they are private, non-overlapping secondary CIDRs. The primary CIDR is 10.0.0.0/16; any non-overlapping CIDR is valid, regardless of RFC 1918 class. Options B and C overlap with the primary and therefore cannot be used.

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 4

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to add a second VPC in the same AWS Region using the same Direct Connect connection. Which solution meets the requirements with the least operational effort?

Accepted Answer

Create a Direct Connect gateway and associate both VPCs, then associate the private VIF with the Direct Connect gateway. A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region, eliminating the need for multiple VIFs or complex routing. By associating both VPCs with the Direct Connect gateway and attaching the private VIF to it, you achieve the goal with minimal operational overhead, as the gateway handles the routing between the on-premises network and the VPCs.

Answer

Set up a VPN connection over the Direct Connect for the second VPC

Answer

Create a transit virtual interface and attach it to a transit gateway, then attach both VPCs

Answer

Create a second private virtual interface for the second VPC

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to connect to a partner's VPC with CIDR 10.0.0.0/16. The VPCs are in the same Region. What is the best solution?

Accepted Answer

Use an AWS Transit Gateway with a transit gateway attachment and configure NAT on the transit gateway to translate IPs. When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), VPC peering and Direct Connect cannot resolve the IP conflict, as they require non-overlapping address spaces. An AWS Transit Gateway with NAT attachments can translate IP addresses at the transit gateway level, allowing traffic to flow between overlapping VPCs by mapping source/destination IPs to non-conflicting ranges. This solution provides a scalable, managed way to handle overlapping CIDRs without complex manual routing.

Answer

Use an AWS Site-to-Site VPN connection

Answer

Establish VPC peering between the two VPCs

Answer

Use an AWS Direct Connect private virtual interface

Question 6

A company is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates but must not be directly accessible from the internet. Which AWS service should be used to provide internet access to instances in the private subnets?

Accepted Answer

NAT gateway. A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT), and it does not maintain state for inbound connections that were not initiated from within the VPC.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Transit gateway

Question 7

A company is deploying a critical application across multiple Availability Zones (AZs) in a single AWS region. The application requires a highly available network layer that can automatically detect and reroute traffic away from failed endpoints. Which AWS service should be used to meet this requirement?

Accepted Answer

Network Load Balancer (NLB). A Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is designed to handle millions of requests per second with extremely low latency. It performs health checks on targets (e.g., EC2 instances) in each Availability Zone and automatically reroutes traffic away from unhealthy endpoints, providing the required high availability and automatic failover across AZs.

Answer

AWS Global Accelerator

Answer

Application Load Balancer (ALB)

Answer

NAT gateway

Question 8

A company is designing a hybrid network with a Direct Connect connection. The VPC has multiple subnets that need to communicate with on-premises. The company wants to use a single VIF for both private and public traffic. Which type of VIF should be used?

Accepted Answer

A single VIF cannot carry both private and public traffic. A single Virtual Interface (VIF) on an AWS Direct Connect connection is designed to carry either private traffic (VPC-to-on-premises via private IPs) or public traffic (to AWS public services like S3, DynamoDB via public IPs), but not both simultaneously. This is because a Private VIF uses BGP to exchange routes over private IP addresses within a VPC, while a Public VIF uses BGP to exchange routes for AWS public IP prefixes. The two traffic types require separate BGP sessions and separate VLANs, making it impossible to combine them into one VIF.

Answer

Public VIF

Answer

Hosted VIF

Answer

Private VIF

Question 9

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing with health checks. The application is deployed in us-east-1 and eu-west-1. During a load test, users in South America experience high latency despite the Route 53 configuration. What is the most likely cause?

Accepted Answer

The health check for one region is failing, causing all traffic to be routed to the remaining healthy region.. Latency-based routing directs traffic to the region with the lowest latency for the user. If a health check fails, Route 53 treats that region as unhealthy and stops routing traffic to it, even if it would otherwise provide lower latency. In this scenario, users in South America likely experience high latency because the eu-west-1 region (which might have lower latency for them) is marked unhealthy, forcing all traffic to us-east-1, which is farther away.

Answer

The company should use geolocation routing instead of latency-based routing.

Answer

The latency records are not refreshed frequently enough, causing stale routing decisions.

Answer

The Route 53 health check is configured to use CloudWatch alarms, which introduced additional latency.

Question 10

A company is deploying a hybrid network with AWS Direct Connect and a VPN backup. The Direct Connect virtual interface is configured for private VIF with BGP. The VPN uses IPsec tunnels over the internet. What is the best practice to ensure symmetric routing and failover?

Accepted Answer

Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.. Using the same BGP ASN for both Direct Connect and VPN, and setting a higher MED on the VPN routes, ensures symmetric routing by making the Direct Connect path more preferred. AWS uses the BGP AS_PATH length as a tie-breaker; with the same ASN, the paths are equal in AS_PATH length, so MED is evaluated. A higher MED on the VPN routes causes AWS to prefer the Direct Connect path, and if Direct Connect fails, the VPN routes (with higher MED) become active, providing failover.

Answer

Configure ASN prepending on the VPN BGP advertisements to make them less preferred.

Answer

Use different BGP ASNs for Direct Connect and VPN to allow AWS to prefer the Direct Connect path.

Answer

Disable BGP on the Direct Connect private VIF and use static routes to force traffic through Direct Connect.

Question 11

A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The tunnel status is up, but traffic from on-premises cannot reach an EC2 instance in the VPC. The instance's security group allows inbound traffic from the on-premises CIDR. Which configuration should be checked first?

Accepted Answer

Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.. For traffic from on-premises to reach an EC2 instance in a VPC via a Site-to-Site VPN, the VPC route table must contain a route pointing the on-premises CIDR to the VPN gateway (virtual private gateway or transit gateway). Without this route, the VPC has no path to send return traffic back to on-premises, causing asymmetric routing and connectivity failure even if the tunnel is up.

Answer

Ensure the VPN connection is attached to a transit gateway instead of a virtual private gateway.

Answer

Check the network ACL associated with the EC2 instance's subnet to ensure it allows inbound traffic from on-premises.

Answer

Confirm that BGP session is established and exchanging routes.

Question 12

A company is designing a network for a large-scale e-commerce platform that must handle sudden traffic spikes. The architecture uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances across multiple Availability Zones. The ALB is internet-facing. To protect against DDoS attacks, which AWS services should be used at the network edge?

Accepted Answer

Subscribe to AWS Shield Advanced and deploy AWS WAF on the ALB.. AWS Shield Advanced provides enhanced DDoS protection for internet-facing resources like ALBs, including cost protection and access to the DDoS Response Team (DRT). Deploying AWS WAF on the ALB allows you to create custom rules to filter malicious traffic, such as SQL injection or cross-site scripting attempts, and rate-limit requests to mitigate application-layer DDoS attacks. Together, they form a layered defense at the network edge, addressing both infrastructure (Layer 3/4) and application (Layer 7) threats.

Answer

Configure network ACLs to allow only known IP ranges.

Answer

Enable AWS Shield Standard and configure security groups to block traffic from suspicious sources.

Answer

Use Amazon Route 53 with DNS-based failover to redirect traffic away from the ALB during an attack.

Question 13

A company is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates, but must not be directly reachable from the internet. Which two components are required for this design? (Choose two.)

Accepted Answer

NAT Gateway in a public subnet. Option A is correct because a NAT Gateway must be deployed in a public subnet and provides outbound-only internet connectivity for instances in private subnets, translating their private source IPs to its Elastic IP so they are never directly reachable from the internet. Option E is correct because the private subnet's route table must contain a default route (0.0.0.0/0) whose target is that NAT Gateway; without this route, traffic from the private subnets has no path to the internet. Option B is not required for the design itself: a security group permitting outbound HTTPS (TCP 443) is a useful best practice for software updates, but it is a stateful instance-level control, not a component that enables the VPC routing architecture. Option C is not one of the two required answers here because, while an Internet Gateway is needed for the public subnet and the NAT Gateway to reach the internet, the question asks specifically for the components enabling private-subnet outbound access, which are the NAT Gateway and its route. Option D is incorrect because an AWS Site-to-Site VPN provides connectivity to on-premises networks, not general outbound internet access for private subnets.

Answer

Security Group allowing outbound HTTPS

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 14

A company is designing a multi-account AWS environment using AWS Transit Gateway. They have 10 VPCs in separate accounts that need to communicate with each other and with an on-premises network via Direct Connect. Which three components are required to enable this connectivity? (Choose three.)

Accepted Answer

AWS Resource Access Manager to share the Transit Gateway with other accounts. Option C is correct because a single AWS Transit Gateway must exist as the central hub, and in a multi-account design it is created in the dedicated network (shared services) account so it can be centrally managed and shared. Option A is correct because AWS Resource Access Manager (RAM) is the mechanism that shares the Transit Gateway from the network account to the other accounts, allowing the 10 VPCs in separate accounts to attach to it without duplicating the gateway. Option B is correct because a Direct Connect Gateway attached to the Transit Gateway is required to connect the Transit Gateway to the on-premises network over AWS Direct Connect, since a DX gateway is the component that links private virtual interfaces to a Transit Gateway. Option D is not needed because VPC peering creates point-to-point connections and does not scale or route through a central hub; the Transit Gateway replaces the need for full-mesh peering. Option E is not required because the scenario specifies connectivity via Direct Connect, so a Site-to-Site VPN to on-premises is not a necessary component.

Answer

VPC Peering connections between each pair of VPCs

Answer

AWS Site-to-Site VPN connection from the Transit Gateway to the on-premises network

Question 15

A company is designing a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. The database should not have direct internet access. Which architecture meets these requirements?

Accepted Answer

Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.. It places the web server in a public subnet with a route to an Internet Gateway (IGW) for direct outbound internet access to download patches, while the database resides in a private subnet with a route to a NAT Gateway in the public subnet. The NAT Gateway enables outbound-only internet access for the database (e.g., for license validation or updates) without exposing it to unsolicited inbound connections, meeting the requirement that the database should not have direct internet access.

Answer

Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet without any internet access.

Answer

Place both instances in the public subnet and use security groups to restrict inbound access to the database.

Answer

Place the web server in the private subnet with a NAT Gateway, and the database in the public subnet with an Internet Gateway.