ANS-C01 Network Design Practice Test 14 — 15 Questions

Question 1

A company is designing a VPC with both IPv4 and IPv6 CIDR blocks. The VPC must support internet-facing applications accessible via IPv6. Which resource must be configured as IPv6-enabled to allow internet traffic?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is the only resource that supports both IPv4 and IPv6 traffic and provides a target in the VPC route table for IPv6 default routes (::/0) to enable direct internet access for IPv6-enabled resources. Unlike IPv4, which often requires NAT for private addressing, IPv6 globally unique addresses allow direct communication through the IGW without translation.

Answer

VPC Peering connection

Answer

NAT Gateway

Answer

Transit Gateway

Question 2

A company is deploying a web application in a VPC with public and private subnets. The web servers in public subnets must be protected from direct internet access, but they need to receive traffic from an Application Load Balancer (ALB). Which architecture should be used?

Accepted Answer

Internet-facing ALB in public subnets, and internal ALB in private subnets pointing to web servers. Option C is correct because it uses an internet-facing ALB in public subnets to receive traffic from the internet, then forwards it to an internal ALB in private subnets, which distributes traffic to web servers in private subnets. This ensures the web servers are not directly accessible from the internet, meeting the security requirement while still allowing traffic from the ALB. The internal ALB uses private IP addresses, keeping the web servers isolated from direct internet access.

Answer

Internet-facing ALB in public subnets with web servers also in public subnets

Answer

Internal Network Load Balancer in private subnets with web servers

Answer

Amazon CloudFront with origin pointing to web servers in public subnets

Question 3

A company has multiple VPCs connected via AWS Transit Gateway. One VPC contains a shared services endpoint (e.g., Amazon S3) using a VPC Gateway Endpoint. How can other VPCs access this endpoint?

Accepted Answer

Create Gateway Endpoints in each VPC that needs access. A VPC Gateway Endpoint is a regional service that uses route table entries to direct traffic to AWS services like S3 or DynamoDB without leaving the AWS network. Since Gateway Endpoints are not transitive across VPCs, each VPC that needs to access the shared S3 endpoint must have its own Gateway Endpoint created in that VPC, with the appropriate route table entries pointing to the endpoint. The Transit Gateway does not propagate Gateway Endpoint routes, so other VPCs cannot reach the endpoint through the Transit Gateway alone.

Answer

Use AWS PrivateLink to access the S3 endpoint

Answer

Configure Direct Connect to access the endpoint

Answer

Create a route in Transit Gateway pointing to the endpoint

Question 4

A company needs to connect its on-premises data center to AWS using a dedicated, low-latency connection. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, low-latency network connection from an on-premises data center directly to AWS, bypassing the public internet. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, ensuring consistent performance and reduced latency for mission-critical workloads.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 5

A company is designing a multi-region active-active architecture with an Application Load Balancer in each region. Which service can route traffic to the closest ALB based on latency?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS region that provides the lowest latency for the end user, based on historical latency measurements between the user's ISP and each region. This makes it the correct choice for routing users to the closest Application Load Balancer in a multi-region active-active architecture.

Answer

AWS Global Accelerator

Answer

Application Load Balancer cross-zone load balancing

Answer

Amazon CloudFront

Question 6

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet must traverse a centralized inspection appliance for traffic inspection. Which architecture should be used?

Accepted Answer

Use Transit Gateway with VPC attached and route traffic through a shared services VPC containing the inspection appliance. Option C is correct because a Transit Gateway with a shared services VPC architecture allows centralized inspection of all outbound internet traffic. By attaching the VPCs to a Transit Gateway and routing traffic through a shared services VPC that hosts the inspection appliance (e.g., a firewall or proxy), you can enforce security policies. The Transit Gateway acts as a hub, enabling transitive routing between VPCs while directing internet-bound traffic to the inspection appliance before it reaches an internet gateway or NAT gateway.

Answer

Use VPC Peering between all VPCs

Answer

Configure a NAT Gateway in each Availability Zone

Answer

Use AWS Direct Connect to route traffic on-premises

Question 7

A company wants to provide its employees with secure access to internal applications running on AWS without using a VPN. Which AWS service can be used?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN solution that allows employees to securely access AWS resources and internal applications from their devices using OpenVPN or IKEv2 protocols, without requiring a traditional site-to-site VPN or dedicated hardware. It provides per-user authentication via Active Directory, SAML, or mutual authentication, making it ideal for remote user access to internal applications without a VPN appliance on-premises.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 8

A company is designing a VPC with a public subnet and a private subnet. The private subnet instances need to access the internet for software updates. Which TWO options allow outbound internet access while preventing inbound connections? (Choose two.)

Accepted Answer

NAT Gateway in the public subnet. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The NAT Gateway translates the private IP addresses of the instances to its own Elastic IP address, and because it does not maintain state for inbound traffic that was not initiated from within the VPC, it blocks all inbound connection attempts.

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection to on-premises

Answer

VPC Peering connection to a VPC with internet access

Question 9

A company has multiple VPCs connected via a Transit Gateway. They want to implement network segmentation so that only specific VPCs can communicate with each other. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Deploy AWS Network Firewall in a centralized inspection VPC. AWS Network Firewall can be deployed in a centralized inspection VPC to filter traffic between VPCs attached to a Transit Gateway. By routing inter-VPC traffic through the firewall appliance, you can enforce stateful inspection and allow or deny traffic based on source/destination VPCs, achieving network segmentation.

Answer

Assign instances to different security groups

Answer

Configure network ACLs on each subnet

Answer

Create separate VPC peering connections

Question 10

A company is designing a high-availability architecture for an application that will be deployed across multiple Availability Zones. Which THREE components are recommended for this design? (Choose three.)

Accepted Answer

Application Load Balancer across multiple AZs. An Application Load Balancer (ALB) distributes incoming traffic across multiple targets in different Availability Zones (AZs). By enabling cross-zone load balancing, the ALB can route requests to healthy instances in any AZ, ensuring that if one AZ fails, traffic is automatically redirected to instances in the remaining AZs. This is a foundational component for high availability because it eliminates a single point of failure at the traffic distribution layer.

Answer

One EC2 instance in each AZ

Answer

Single NAT Gateway in one AZ

Question 11

Refer to the exhibit. A route table shows routes for a VPC. What is the correct interpretation of this route table?

Accepted Answer

The VPC has CIDR 10.0.0.0/16, an internet gateway, and a VPC peering connection to a VPC with CIDR 192.168.0.0/16. Option A is correct because the route table shows a local route for 10.0.0.0/16, which is the VPC's CIDR, a default route (0.0.0.0/0) pointing to an internet gateway (igw-xxx), and a specific route for 192.168.0.0/16 pointing to a VPC peering connection (pcx-xxx). This configuration allows traffic destined for the peered VPC's CIDR to be routed over the peering connection, while all other internet-bound traffic goes through the internet gateway.

Answer

The VPC has CIDR 10.0.0.0/16, a NAT gateway, and a VPN connection to 192.168.0.0/16

Answer

The VPC has CIDR 192.168.0.0/16, an internet gateway, and a VPC peering connection to 10.0.0.0/16

Answer

The VPC has CIDR 10.0.0.0/16, a virtual private gateway, and a peering connection

Question 12

Refer to the exhibit. A bucket policy allows access to an S3 bucket. What is the intended effect?

Accepted Answer

Denies all requests because the IP condition uses a private IP range. The bucket policy includes a condition that denies requests unless the source IP is within the private IP range 10.0.0.0/16. Since private IP addresses are not routable over the public internet, any request originating from outside the VPC (i.e., from the internet) will not have a source IP in that range, causing the Deny statement to block the request. This effectively denies all requests because the only allowed IP range is a private CIDR that cannot be the source of a public internet request.

Answer

Allows requests from any public IP address

Answer

Allows any request to the bucket

Answer

Allows requests only from a VPC with CIDR 10.0.0.0/16

Question 13

Refer to the exhibit. A VPN connection has two tunnels. Which statement is correct about this VPN configuration?

Accepted Answer

The VPN provides high availability with two tunnels. The exhibit shows a VPN connection with two tunnels, which is the standard design for AWS Site-to-Site VPN to provide high availability. Each tunnel is on a separate device and path, so if one tunnel fails, traffic automatically fails over to the other tunnel. This ensures that the VPN connection remains operational even during maintenance or failure of a single tunnel.

Answer

The VPN uses BGP dynamic routing

Answer

The tunnel inside CIDRs are /24 networks

Answer

Both tunnels use the same inside CIDR

Question 14

A company is designing a multi-region architecture using AWS Global Accelerator and Application Load Balancers (ALBs) in two AWS Regions. They want to route traffic to the closest healthy endpoint and minimize latency. Which configuration best meets these requirements?

Accepted Answer

Create a Global Accelerator with endpoint groups in each region, each pointing to the regional ALB.. AWS Global Accelerator uses the Anycast IP address to route traffic to the nearest edge location, then forwards it over the AWS global network to the closest healthy endpoint group. By configuring endpoint groups in each region, each pointing to the regional ALB, Global Accelerator provides both low-latency routing and automatic failover, meeting the requirement for multi-region traffic distribution to the closest healthy endpoint.

Answer

Deploy a single ALB in one region and use Route 53 geolocation routing to direct traffic.

Answer

Use Amazon Route 53 latency-based routing with ALBs in each region.

Answer

Use an Application Load Balancer in one region and a Network Load Balancer in another with cross-zone load balancing.

Question 15

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates but must not be directly reachable from the internet. The company wants to minimize cost and operational overhead. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway, deployed in a public subnet with an associated Elastic IP, enables instances in private subnets to initiate outbound IPv4 connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway satisfies the requirement for outbound-only internet access with minimal cost and operational overhead, as NAT Gateway is a managed service that scales automatically.

Answer

Use an egress-only internet gateway and route 0.0.0.0/0 to it from the private subnets.

Answer

Create a VPC peering connection to a VPC with internet access and route 0.0.0.0/0 through the peering connection.

Answer

Attach an internet gateway to the VPC and add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.