ANS-C01 Network Design Practice Test 14 — 15 Questions

Question 1

A company is designing a hybrid network using AWS Direct Connect. They want to extend their on-premises network to multiple VPCs in the same AWS Region. Which resource should they use to achieve this?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway is the correct resource because it allows you to associate up to 10 VPCs (or 20 with a quota increase) in the same or different AWS Regions with a single Direct Connect connection. It acts as a central hub, enabling connectivity from your on-premises network to multiple VPCs via a single private virtual interface (VIF) attached to the Direct Connect gateway, without needing separate VIFs per VPC.

Answer

Direct Connect transit virtual interface

Answer

Direct Connect private virtual interface (VIF)

Answer

Link Aggregation Group (LAG)

Question 2

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity for their internet-facing applications. The VPC currently has an internet gateway attached. What is the MOST efficient way to enable IPv6?

Accepted Answer

Assign an Amazon-provided IPv6 CIDR block to the VPC and subnets, and update route tables to use an internet gateway for IPv6. The most efficient way to enable IPv6 for an existing VPC with an internet gateway is to request an Amazon-provided IPv6 CIDR block (a /56 block) for the VPC, assign a /64 IPv6 CIDR to each subnet, and then update the route tables to direct ::/0 traffic to the internet gateway. The internet gateway is a dual-stack resource that inherently supports both IPv4 and IPv6 traffic, so no additional gateway is needed for outbound-only or inbound IPv6 connectivity.

Answer

Create a transit gateway and attach the VPC, then route IPv6 traffic through a VPN

Answer

Create a NAT Gateway in a public subnet and route IPv6 traffic through it

Answer

Assign an IPv6 CIDR to the VPC and subnets, and add an egress-only internet gateway

Question 3

A company is designing a network for a critical application that requires low latency between EC2 instances. The instances are in the same AWS Region but different Availability Zones. Which configuration will provide the lowest latency?

Accepted Answer

Launch instances in the same placement group within a single Availability Zone. Placing EC2 instances within the same placement group in a single Availability Zone ensures they are in close physical proximity, often on the same rack or within the same cluster, which minimizes network hops and achieves the lowest possible latency (typically under 1 ms). This configuration is specifically designed for low-latency, high-throughput workloads like HPC or real-time data processing.

Answer

Use an Application Load Balancer to distribute traffic

Answer

Use Direct Connect to connect the VPCs

Answer

Use VPC peering to connect the VPCs

Question 4

A company needs to monitor network traffic to and from EC2 instances for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring network traffic to and from EC2 instances for security analysis, as it provides detailed network-level logs without requiring any agent installation on the instances.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises data centers. They want to centralize internet traffic through a single VPC that has an internet gateway. Which Transit Gateway feature should they enable?

Accepted Answer

Transit Gateway route tables. To centralize internet traffic through a single VPC with an internet gateway, you need to control the routing of traffic from other VPCs and on-premises networks. Transit Gateway route tables allow you to isolate or share routes between attachments, enabling you to create a default route (0.0.0.0/0) pointing to the centralized VPC's attachment. This ensures all outbound internet traffic from other VPCs is forwarded to the egress VPC, which then uses its internet gateway.

Answer

VPN attachments

Answer

Multicast support

Answer

IPsec acceleration

Question 6

A company has a VPC with a CIDR block of 172.16.0.0/20. They need to create subnets for three tiers: web, application, and database. The web tier must be public and support at least 1000 hosts. The application and database tiers must be private. Which subnet design meets the requirements?

Accepted Answer

Web: 172.16.0.0/22, App: 172.16.4.0/24, DB: 172.16.5.0/24. The web tier subnet 172.16.0.0/22 provides 2^(32-22) - 5 = 1024 - 5 = 1019 usable host addresses (AWS reserves 5 IPs per subnet), which meets the requirement of at least 1000 hosts. The application and database subnets use /24 masks, each offering 251 usable hosts, and are private. All subnets fall within the VPC CIDR 172.16.0.0/20 without overlap.

Answer

Web: 172.16.0.0/23, App: 172.16.2.0/23, DB: 172.16.4.0/23

Answer

Web: 172.16.0.0/20, App: 172.16.0.0/20, DB: 172.16.0.0/20

Answer

Web: 172.16.0.0/24, App: 172.16.1.0/24, DB: 172.16.2.0/24

Question 7

A company wants to allow their employees to securely access resources in a VPC from their home offices. Which AWS service should they use?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows individual users to securely access AWS resources from remote locations, such as home offices, using a VPN client installed on their device. It supports OpenVPN-based connections and integrates with Active Directory for user authentication, making it ideal for remote employee access to a VPC without requiring dedicated hardware or complex site-to-site configurations.

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Answer

Amazon CloudFront

Question 8

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose 2.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel between a VPC and an on-premises network using IPsec. It uses a virtual private gateway or transit gateway on the AWS side and a customer gateway device on-premises, enabling secure communication over the public internet.

Answer

Internet gateway

Answer

NAT gateway

Answer

VPC peering

Question 9

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Answer

VPC peering

Answer

AWS Direct Connect

Question 10

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Accepted Answer

Place web servers in private subnets and use a load balancer in a public subnet. Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Answer

Allow all inbound traffic from the internet to the public subnets

Answer

Use a single subnet for all application tiers

Answer

Disable ICMP traffic on the network ACL

Question 11

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs for an EC2 instance with IP 10.0.1.5. Based on the logs, which statement is true?

Accepted Answer

The instance is communicating with both internal and internet hosts. The VPC Flow Logs show the EC2 instance (10.0.1.5) communicating with both an internal IP (10.0.2.10) on port 443 and an external IP (203.0.113.50) on port 80, with ACCEPT records for both flows. This indicates successful bidirectional traffic to both internal and internet hosts, confirming option D is correct.

Answer

The instance is not communicating with the internet

Answer

The instance's security group is blocking traffic

Answer

The instance is only communicating with another instance in the same subnet

Question 12

Refer to the exhibit. A developer created this CloudFormation template to create a public subnet. However, instances in the subnet cannot access the internet. What is the MOST likely cause?

Accepted Answer

The subnet does not have auto-assign public IP enabled. The CloudFormation template creates a public subnet but does not set the 'MapPublicIpOnLaunch' property to 'true'. Without this setting, EC2 instances launched in the subnet do not automatically receive a public IPv4 address, which is required for internet-bound traffic to be routed through the Internet Gateway (IGW). Even if the route table has a default route (0.0.0.0/0) pointing to the IGW, the instance lacks a public IP, so the IGW cannot perform source NAT for outbound traffic, making internet access impossible.

Answer

The route to the internet gateway is missing

Answer

The route table is not associated with the subnet

Answer

The internet gateway is not attached to the VPC

Question 13

Refer to the exhibit. A network architect is reviewing an IAM policy for a junior engineer. What is the security concern with this policy?

Accepted Answer

The policy allows deletion of VPCs and subnets, which could lead to resource loss. The IAM policy grants `ec2:DeleteVpc` and `ec2:DeleteSubnet` permissions, which allow the junior engineer to delete VPCs and subnets. This could lead to irreversible resource loss, including all associated resources like route tables, security groups, and network interfaces, disrupting network connectivity and services.

Answer

The policy does not include a condition to restrict the actions to specific VPCs

Answer

The policy allows creation of VPCs and subnets, which could cause resource exhaustion

Answer

The policy allows read-only actions that could expose sensitive network configurations

Question 14

A company wants to connect multiple VPCs across different AWS Regions using AWS Transit Gateway. Which feature allows the VPCs to communicate with each other using private IP addresses without creating peering connections?

Accepted Answer

Transit Gateway inter-Region peering. Transit Gateway inter-Region peering allows VPCs in different AWS Regions to communicate using private IP addresses through a central Transit Gateway, without requiring individual VPC peering connections. This feature uses the AWS global network to route traffic between peered Transit Gateways, enabling cross-region connectivity with a hub-and-spoke architecture.

Answer

AWS Direct Connect gateway

Answer

AWS PrivateLink

Answer

VPC Peering

Question 15

A network engineer is designing a hybrid network with multiple AWS accounts. The company wants to simplify management by using a single AWS Direct Connect connection shared among accounts. Which service should be used to achieve this?

Accepted Answer

Transit Gateway with Direct Connect Gateway. A Transit Gateway with a Direct Connect Gateway allows you to attach multiple VPCs from different AWS accounts to a single Direct Connect connection. The Direct Connect Gateway acts as a bridge between the on-premises network and the Transit Gateway, which then routes traffic to the appropriate VPCs across accounts. This setup simplifies management by centralizing the Direct Connect connection while supporting multi-account architectures.

Answer

VPC Peering

Answer

AWS PrivateLink

Answer

AWS VPN CloudHub