ANS-C01 Network Design Practice Test 14 — 15 Questions

Question 1

A company is deploying a critical application that requires low latency between EC2 instances in the same AWS region but across multiple Availability Zones. The instances are part of an Auto Scaling group behind a Network Load Balancer. Which network design provides the lowest latency while maintaining high availability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Do not use a placement group; enable Enhanced Networking (ENA) on all instances.. Enhanced Networking (ENA) provides the highest possible packet-per-second performance and lowest latency by offloading network processing to dedicated hardware on the instance. Since the application requires low latency across multiple Availability Zones, a placement group is not suitable because cluster placement groups cannot span multiple AZs, and spread/partition placement groups do not improve latency — they only control instance placement for fault isolation. ENA alone, combined with a Network Load Balancer, delivers the lowest latency while maintaining high availability across AZs.

Answer

Use a cluster placement group across two Availability Zones.

Answer

Use a spread placement group across two Availability Zones.

Answer

Use a partition placement group across two Availability Zones.

Question 2

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network via AWS Direct Connect. The on-premises network uses 10.0.0.0/16. Which solution allows connectivity without IP overlap?

Accepted Answer

Create a new VPC with a non-overlapping CIDR, connect both VPCs via Transit Gateway, and use NAT on the Transit Gateway attachment to the on-premises network.. When both the VPC and on-premises network use the same 10.0.0.0/16 CIDR, direct connectivity is impossible due to overlapping IP ranges. By creating a new VPC with a non-overlapping CIDR, connecting both VPCs via Transit Gateway, and applying NAT on the Transit Gateway attachment to the on-premises network, traffic from the original VPC can be source-NATed to the new VPC's range before being forwarded to on-premises, resolving the overlap. This allows the on-premises network to receive traffic with unique IPs, avoiding routing conflicts.

Answer

Establish a VPC peering connection between the VPC and on-premises network.

Answer

Use AWS Direct Connect with a private VIF and static routes to route traffic.

Answer

Deploy a NAT instance in the VPC to translate on-premises IPs.

Question 3

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to minimize cost and management overhead. Which solution should be used?

Accepted Answer

Deploy a single NAT Gateway in one public subnet and configure route tables to route 0.0.0.0/0 traffic to it.. A single NAT Gateway in one public subnet provides outbound internet access for private subnets with lower cost and management overhead than multiple NAT Gateways or NAT instances. NAT Gateway is a managed AWS service that automatically handles failover within its Availability Zone, and routing private subnet traffic to it via a 0.0.0.0/0 route allows instances to reach the internet for software updates while remaining unreachable from the internet.

Answer

Deploy a NAT Gateway in each Availability Zone for high availability.

Answer

Launch a NAT instance in a public subnet and configure routing.

Answer

Attach an Internet Gateway to the VPC and add a default route pointing to the IGW in private subnets.

Question 4

A company has a large VPC with multiple workloads. They need to isolate development and production environments within the same VPC, but allow limited communication between them via specific ports. Which approach meets these requirements?

Accepted Answer

Create separate subnets for dev and prod, use network ACLs to allow only specific ports between them.. Placing development and production workloads in separate subnets allows you to apply stateless network ACLs at the subnet boundary. Network ACLs can explicitly allow only specific ports (e.g., TCP 443) between the subnets while blocking all other traffic, providing a clear isolation boundary within the same VPC. Security groups alone cannot enforce inter-subnet filtering because they are stateful and applied at the instance level, not at the subnet edge.

Answer

Place dev and prod in the same subnet and use security groups to filter traffic.

Answer

Use a single subnet and rely on network ACLs to separate traffic.

Answer

Create two VPCs and use VPC peering to allow communication.

Question 5

A company wants to improve disaster recovery by replicating data between two AWS Regions. Which AWS service provides a managed solution for cross-Region network connectivity?

Accepted Answer

VPC Peering. VPC Peering supports cross-Region connections, enabling direct network connectivity between VPCs in different AWS Regions. This allows data replication without traversing the public internet, providing low-latency, private connectivity. AWS Global Accelerator is for traffic optimization and failover, not for direct connectivity for data replication.

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Answer

AWS Global Accelerator

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to add a second CIDR block of 10.1.0.0/16 for additional subnets. After adding the CIDR, the existing subnets cannot communicate with the new subnets. What is the most likely cause?

Accepted Answer

Route tables for the existing subnets do not have routes to the new CIDR.. When you add a secondary CIDR block to a VPC, AWS automatically adds a local route for the new CIDR only to the VPC's main route table. Existing subnets that use custom route tables do not automatically get a route to the new CIDR, so traffic between old and new subnets is dropped. You must manually add a route for the new CIDR (target: local) to each existing subnet's route table.

Answer

Security groups are blocking traffic between the old and new subnets.

Answer

The VPC CIDR cannot be extended; a new VPC must be created.

Answer

Network ACLs are blocking traffic by default.

Question 7

A company wants to ensure that traffic between EC2 instances in the same VPC but different subnets is encrypted. Which solution should be used?

Accepted Answer

Use IPsec VPN between the instances.. An IPsec VPN between EC2 instances creates an encrypted tunnel at Layer 3, ensuring that all traffic between the instances is encrypted regardless of the underlying network path. This is necessary because traffic within a VPC traversing different subnets is not encrypted by default, even though it stays within the AWS network.

Answer

Use security groups to allow traffic.

Answer

Use VPC Peering.

Answer

Use network ACLs to allow traffic.

Question 8

A company has a VPC with a public subnet and a private subnet. The private subnet needs to access an S3 bucket for backups. Which TWO actions are required to provide private connectivity to S3 without using a NAT Gateway?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Option B is correct because an S3 Gateway Endpoint is the specific VPC endpoint type that provides private connectivity to Amazon S3 (and DynamoDB) from within a VPC without requiring a NAT Gateway, internet gateway, or public IP addresses. Option C is correct because creating the gateway endpoint alone is insufficient; the private subnet's route table must be updated with a route whose destination is the S3 prefix list (com.amazonaws.<region>.s3) and whose target is the gateway endpoint, so traffic destined for S3 is directed through the endpoint. Option A is incorrect because the scenario explicitly requires private connectivity without using a NAT Gateway, and a NAT Gateway would also require an internet gateway and public IPs. Option D is incorrect because S3 is accessed via a Gateway Endpoint, not an Interface Endpoint (Interface Endpoints use ENIs and are for services like SQS, KMS, or Secrets Manager; S3 does support interface endpoints but they are not the standard/required solution here and the question asks for the gateway-based private connectivity). Option E is incorrect because there is no 'S3 VPC' to peer with; S3 is a public AWS service accessed via endpoints or the internet, not via VPC peering.

Answer

Create a NAT Gateway in the public subnet.

Answer

Create a VPC Interface Endpoint for S3.

Answer

Create a VPC Peering connection to an S3 VPC.

Question 9

A company is designing a hybrid network using AWS Direct Connect. They need to ensure high availability and failover. Which THREE components should be deployed to meet these requirements?

Accepted Answer

Two Customer Gateways (CGWs).. Option B is correct because deploying two Customer Gateways (CGWs) provides redundant customer-side endpoints for the Direct Connect connections, so the failure of one customer router or CGW does not eliminate all connectivity. Option C is correct because two Virtual Private Gateways (VGWs) allow redundant AWS-side termination points, and each Direct Connect private virtual interface can attach to a separate VGW, supporting failover if one VGW or its attachment fails. Option D is correct because two AWS Direct Connect connections at separate locations or devices provide physical and logical redundancy, which is the core requirement for high availability and failover in a Direct Connect design. Option A is not correct because a single Direct Connect connection is a single point of failure and does not meet the high-availability requirement. Option E is not correct because, while a Site-to-Site VPN can be used as a backup path, it is not one of the three components needed to build the redundant Direct Connect architecture itself and is not marked as correct here.

Answer

A single AWS Direct Connect connection.

Answer

An AWS Site-to-Site VPN connection as backup.

Question 10

A company is designing a multi-Region architecture with active-active failover for a web application. The application uses Application Load Balancers (ALBs) in two AWS Regions. Traffic must be routed to the closest healthy Region with automatic failover. Which AWS service should be used to route traffic?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Amazon Route 53 with latency-based routing and health checks is the correct choice because it directs traffic to the AWS Region with the lowest latency for each user, and health checks automatically fail over to the next best healthy Region if an ALB becomes unhealthy. This satisfies the active-active failover requirement without introducing additional caching or anycast complexities.

Answer

Network Load Balancer with cross-zone load balancing

Answer

Amazon CloudFront with multiple origins

Answer

AWS Global Accelerator

Question 11

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to connect their on-premises data center to AWS using AWS Direct Connect. The data center uses RFC 1918 addresses from the 10.0.0.0/8 range, overlapping with the VPC CIDR. The company cannot change the on-premises IP addresses. Which design allows connectivity without IP conflicts?

Accepted Answer

Deploy a Private NAT Gateway in the VPC and configure routes to send on-premises traffic through it. A Private NAT Gateway in the VPC allows the on-premises network to reach the VPC by translating overlapping IP addresses. Since the on-premises network uses the same 10.0.0.0/8 range as the VPC's 10.0.0.0/16 CIDR, traffic from the data center to the VPC must be source NATed to a non-overlapping IP range. The Private NAT Gateway performs this translation, enabling bidirectional communication without IP conflicts.

Answer

Configure Direct Connect Gateway with network address translation

Answer

Use AWS Transit Gateway with route table separation

Answer

Set up VPC Peering between the VPC and on-premises network over Direct Connect

Question 12

A company wants to connect an Amazon RDS for SQL Server database instance in a VPC to an on-premises application. The connection must be encrypted in transit and should traverse the AWS backbone network. Which solution meets these requirements?

Accepted Answer

Establish an AWS Site-to-Site VPN connection over AWS Direct Connect. An AWS Site-to-Site VPN connection over AWS Direct Connect provides an encrypted IPSec tunnel that traverses the AWS backbone network, ensuring encryption in transit and meeting the requirement to keep traffic off the public internet. Direct Connect provides a private physical connection to AWS, and the Site-to-Site VPN adds encryption over that link, which is ideal for connecting an on-premises application to an RDS for SQL Server instance in a VPC.

Answer

Set up an AWS Client VPN endpoint and connect the on-premises application

Answer

Create a VPC endpoint for RDS and connect on-premises to the endpoint

Answer

Configure ClassicLink to connect the on-premises network to the VPC

Question 13

A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that the instance cannot be directly initiated from the internet. Which design should be used?

Accepted Answer

Attach a NAT Gateway to the public subnet and add a route to the NAT Gateway in the private subnet's route table. A NAT Gateway in a public subnet allows outbound internet traffic from private subnets while preventing unsolicited inbound connections. Adding a route in the private subnet's route table pointing to the NAT Gateway enables the EC2 instance to download patches without being directly reachable from the internet.

Answer

Launch a NAT instance in the public subnet and add a route in the private subnet's route table

Answer

Use a VPC endpoint for Amazon S3 and route patch traffic through it

Answer

Add a route to the internet gateway in the private subnet's route table

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16. They want to connect this VPC to a second VPC with CIDR 10.1.0.0/16 using VPC Peering. The VPCs are in the same account and Region. What is the minimum number of route table entries needed in each VPC to enable full bidirectional communication?

Accepted Answer

One route in each VPC's route table. VPC peering requires a route in each VPC's route table pointing to the CIDR of the peer VPC, using the peering connection as the target. The local VPC's CIDR is automatically added to the route table by default, so only one additional route per VPC is needed for full bidirectional communication.

Answer

Two routes in each VPC's route table: one for the local CIDR and one for the peer CIDR

Answer

No routes are needed because VPC Peering automatically enables communication

Answer

One route in only one VPC's route table

Question 15

A company needs to provide secure access to an Amazon S3 bucket for a third-party partner. The partner has their own AWS account. The company wants to avoid exposing the bucket to the public internet. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for S3 in your VPC and allow the partner to access the bucket through a VPC peering connection. A VPC Gateway Endpoint for S3 allows private connectivity to S3 without traversing the public internet. By creating a VPC peering connection between the company's VPC and the partner's VPC, the partner can access the S3 bucket through the gateway endpoint, ensuring the bucket remains private and not exposed to the internet.

Answer

Set up Amazon CloudFront with an origin access identity (OAI)

Answer

Use pre-signed URLs generated by AWS Lambda

Answer

Configure an S3 bucket policy that grants access to the partner's AWS account