ANS-C01 Network Design Practice Test 15 — 15 Questions

Question 1

A company wants to ensure that traffic between Amazon EC2 instances in the same VPC but different subnets is inspected by a network security appliance. The appliance is deployed in a separate security VPC. Which AWS service should be used to route traffic through the security VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a hub-and-spoke router that can interconnect multiple VPCs, including a security VPC, and centrally route traffic between them. By attaching both the workload VPC and the security VPC to a Transit Gateway, you can configure route tables to force all inter-subnet traffic (or inter-VPC traffic) through the network security appliance in the security VPC. This enables inspection without requiring a full mesh of VPC peering connections or complex routing.

Answer

VPC Peering

Answer

VPC Endpoint

Answer

Network Load Balancer

Question 2

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The company needs to ensure that traffic from the VPC to the on-premises network uses the Direct Connect connection and that traffic does not traverse the internet. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Create a private virtual interface (VIF) on the Direct Connect connection. Option B is correct because a private virtual interface (VIF) is the required Direct Connect construct for reaching private VPC resources over a private IP address space such as 10.0.0.0/16; it associates the Direct Connect connection with a virtual private gateway (VGW) or Direct Connect gateway so RFC 1918 traffic stays off the public internet. Option C is correct because the VPC must learn the on-premises prefix 10.0.0.0/8 via BGP over the private VIF (or via static routes on the VGW/VPC route table), and the on-premises side must likewise know how to return traffic to 10.0.0.0/16; without this route exchange, traffic cannot be directed over the Direct Connect link. Option A is not required because a Transit Gateway is only needed for hub-and-spoke topologies or many VPCs/VPNs, not for a single VPC-to-on-premises Direct Connect path. Option D is wrong because a public VIF only enables connectivity to AWS public services (e.g., S3, DynamoDB public endpoints) and cannot carry private VPC traffic. Option E is not required because a Direct Connect gateway is used to connect multiple VPCs across regions or to associate with a Transit Gateway; a single VPC can attach directly via a virtual private gateway, so it is not one of the two necessary actions here.

Answer

Attach the VPC to an AWS Transit Gateway

Answer

Create a public virtual interface (VIF) on the Direct Connect connection

Answer

Create a Direct Connect Gateway to connect the VPC to the on-premises network

Question 3

A company has a VPC with multiple subnets across three Availability Zones. They deploy an Amazon RDS for MySQL Multi-AZ DB instance. The application tier consists of EC2 instances in private subnets. To improve read performance, the company wants to add read replicas. Which THREE design considerations are important for network connectivity? (Choose THREE.)

Accepted Answer

Read replicas can be placed in different Availability Zones than the primary DB instance. Option A is correct because Amazon RDS read replicas can be created in a different Availability Zone (or even a different Region for cross-Region replicas) than the primary DB instance, giving flexibility to distribute read traffic across AZs for resilience and latency. Option B is correct because, for the EC2 application tier to reach the RDS endpoint over private networking, the instances must reside in the same VPC as the RDS instance (or use VPC peering/PrivateLink); within a single VPC, the RDS DNS endpoint resolves to private IPs reachable from the private subnets. Option C is correct because RDS MySQL listens on TCP port 3306, and the DB instance's security group must have an inbound rule permitting traffic from the application instances' security group or subnet CIDR on that port for connections to succeed. Option D is not correct because read replicas do not require public subnets or public IP addresses; they are typically placed in private subnets and accessed via private endpoints. Option E is not correct because RDS supports cross-Region read replicas, so a replica does not have to be in the same Region as the primary.

Answer

Read replicas must be in public subnets with public IP addresses

Answer

Read replicas must be in the same Region as the primary DB instance

Question 4

A company is designing a network architecture for a critical application that requires high availability and fault tolerance. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones. The instances must be able to communicate with each other across AZs. Which TWO design decisions improve the fault tolerance of the application? (Choose TWO.)

Accepted Answer

Configure the Auto Scaling group to launch instances in multiple Availability Zones. Option C is correct because configuring the Auto Scaling group to launch instances in multiple Availability Zones ensures that the application can continue running even if one AZ fails, as instances will be distributed across independent failure domains. Option E is correct because deploying EC2 instances evenly across three Availability Zones provides balanced capacity and fault tolerance; if one AZ becomes unavailable, the remaining instances in the other two AZs can handle the load, and the application remains operational. Option A is incorrect because a single NAT Gateway in one AZ is a single point of failure for outbound internet access, reducing fault tolerance. Option B is incorrect because VPC endpoints for Amazon S3 improve security and reduce internet dependency but do not directly enhance fault tolerance across AZs. Option D is incorrect because a single Network Load Balancer in one AZ is a single point of failure; for high availability, the load balancer should be deployed across multiple AZs.

Answer

Use a single NAT Gateway in one Availability Zone for internet access

Answer

Use VPC endpoints for Amazon S3 to reduce internet dependency

Answer

Use a single Network Load Balancer in one Availability Zone

Question 5

A company uses AWS Direct Connect with a private VIF to access a VPC. They also have a site-to-site VPN as backup. They notice that during Direct Connect maintenance, the VPN does not take over traffic as expected. All routes are advertised over BGP. What is the most likely reason?

Accepted Answer

The VPN BGP advertisements have a longer AS PATH than the Direct Connect advertisements, making them less preferred.. BGP path selection prefers routes with the shortest AS_PATH. During normal operation, the Direct Connect private VIF advertises routes with a shorter AS_PATH than the VPN backup. When the Direct Connect physical link goes down, the BGP session over the private VIF also goes down, and the VPN routes should take over. However, if the VPN BGP advertisements have a longer AS_PATH, they remain less preferred in the BGP routing table, and the router may still try to use the now-unreachable Direct Connect routes until they are withdrawn, causing traffic to drop instead of failing over to the VPN.

Answer

The Direct Connect virtual interface is still in the 'available' state even though the physical link is down.

Answer

The VPN tunnel is using a different BGP ASN than the Direct Connect.

Answer

The VPN is configured with a higher local preference than Direct Connect.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. They need to peer with another VPC that has a CIDR of 10.0.0.0/24. What will happen?

Accepted Answer

The peering connection will fail because the CIDRs overlap.. AWS VPC peering requires that the CIDR blocks of the two VPCs do not overlap. When both VPCs use the same IP range (10.0.0.0/16 and 10.0.0.0/24), the peering connection request will fail because overlapping CIDRs create routing ambiguity and are not supported by the VPC peering service. This is a hard limit enforced at the time of peering creation, not during route table configuration.

Answer

The peering connection will be established, but only the first VPC's CIDR will be used.

Answer

The peering connection will be established, but routes with overlapping CIDRs will not be added automatically.

Answer

The peering connection will be established, and the overlapping CIDRs will be ignored.

Question 7

A company wants to use AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to centrally manage and enforce security policies. Which THREE components are required?

Accepted Answer

Transit Gateway route tables. Option A (Transit Gateway route tables) is correct because TGW route tables are the mechanism that controls which attachments can route to which other attachments, enabling centralized, policy-based segmentation and enforcement across all connected VPCs and on-premises networks. Option C (AWS Resource Access Manager) is correct because RAM is required to share the Transit Gateway across multiple AWS accounts (and/or Organizations), which is how a centrally managed hub-and-spoke TGW is distributed to the VPC-owning accounts. Option E (AWS Network Firewall) is correct because it provides the stateful, centrally managed inspection and enforcement of security policies (domain, IPS, and traffic filtering) on traffic traversing the Transit Gateway. Option B (VPC Gateway Endpoints) is not required — gateway endpoints only provide private access to S3 and DynamoDB and play no role in TGW attachment or policy enforcement. Option D (AWS Direct Connect Gateway) is not required — it is only needed to connect a Direct Connect connection to multiple VPCs via virtual private gateways, whereas with a Transit Gateway the DX connection attaches directly to the TGW.

Answer

VPC Gateway Endpoints

Answer

AWS Direct Connect Gateway

Question 8

Based on the following VPC Flow Logs entry, which of the following statements is correct?
- source IP: 10.0.2.10
- source port: 443
- destination IP: 10.0.1.20
- destination port: 80
- protocol: TCP

Accepted Answer

The traffic originated from a web server (port 443) and was sent to a client (port 80). Based on the VPC Flow Logs entry (which shows source IP 10.0.2.10, source port 443, destination IP 10.0.1.20, destination port 80, protocol TCP), the traffic originated from a web server (listening on port 443) and was sent to a client (listening on port 80). The direction is from the source (10.0.2.10) to the destination (10.0.1.20). Therefore, option D is correct.

Answer

The destination port is 443

Answer

The protocol used is UDP

Answer

The source IP address is 10.0.2.10

Question 9

Based on the route table, which of the following is true?

Accepted Answer

The subnet has a VPN connection to a network with CIDR 172.31.0.0/16. The route table includes a route for destination 172.31.0.0/16 pointing to a virtual private gateway (vgw-xxxx), which is used for a VPN connection. This indicates that the subnet associated with this route table has a VPN connection to a network with CIDR 172.31.0.0/16, as the route directs traffic for that CIDR to the VPN gateway.

Answer

The route table is the main route table for the VPC

Answer

The subnet is connected to a Transit Gateway

Answer

The subnet is a private subnet with no internet access

Question 10

Based on the output, which of the following is true?

Accepted Answer

The Direct Connect Gateway uses ASN 64512. The output shows the Direct Connect Gateway with ASN 64512, which is a private autonomous system number commonly used for Direct Connect Gateways. This ASN is assigned to the gateway and is visible in the output, confirming that option A is correct.

Answer

The Direct Connect Gateway is in a 'deleted' state

Answer

The Direct Connect Gateway is a virtual private gateway

Answer

The Direct Connect Gateway is owned by a different account

Question 11

A company is designing a multi-account architecture using AWS Transit Gateway. They need to isolate development and production environments but allow shared services account access to both. What is the most scalable and secure design?

Accepted Answer

Create two Transit Gateways: one for development and one for production. Share the Transit Gateways with the shared services account via AWS Resource Access Manager.. Using two separate Transit Gateways (one for dev, one for prod) provides complete network isolation between environments at the routing layer, while AWS Resource Access Manager (RAM) allows the shared services account to attach its VPC to both Transit Gateways. This design is scalable as each environment can grow independently without route table conflicts, and secure because there is no transitive routing path between dev and prod. A single Transit Gateway with separate route tables (Option A) still shares the same data plane, introducing risk of misconfiguration or route leaks, whereas two Transit Gateways enforce hard isolation.

Answer

Use a single Transit Gateway and configure separate route tables for each environment, attaching VPCs from each account.

Answer

Use a single Transit Gateway with one route table for all environments and implement security groups to isolate traffic.

Answer

Use VPC Peering between each VPC and the shared services VPC, and set up Internet Gateway for each environment.

Question 12

A company is migrating to AWS and needs to connect its on-premises data center to multiple VPCs across several AWS regions. The on-premises network uses BGP and requires high availability with sub-second failover. The solution must be cost-effective and support traffic segmentation. Which design meets these requirements?

Accepted Answer

Order an AWS Direct Connect connection and create multiple virtual interfaces, each connecting to a different VPC in different regions. Use BGP with Bidirectional Forwarding Detection (BFD) for fast failover.. AWS Direct Connect with multiple virtual interfaces (VIFs) provides dedicated, low-latency connectivity to multiple VPCs across different regions. Using BGP with Bidirectional Forwarding Detection (BFD) enables sub-second failover detection (typically 150ms or less), meeting the high availability requirement. This design is cost-effective compared to multiple VPN connections and supports traffic segmentation through separate VIFs or VLANs.

Answer

Set up a Site-to-Site VPN connection between on-premises and each VPC using a VPN appliance on AWS.

Answer

Use AWS Transit Gateway with inter-region peering and attach VPN connections from on-premises to a central Transit Gateway.

Answer

Use a combination of Direct Connect and VPN as a backup, and route all traffic through a single VPC that acts as a transit hub.

Question 13

A company is designing a hybrid network using AWS Direct Connect with multiple VPCs in the same region. They need to ensure that traffic between on-premises and VPCs is encrypted and that VPC-to-VPC traffic does not traverse the internet. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway with an IPsec VPN over Direct Connect using a virtual private gateway on each VPC, and configure Transit Gateway route tables.. It uses AWS Transit Gateway to centrally route traffic between on-premises and multiple VPCs, and an IPsec VPN over Direct Connect provides encryption for traffic between on-premises and VPCs. The Transit Gateway route tables ensure VPC-to-VPC traffic stays within the AWS network without traversing the internet, meeting both requirements.

Answer

Use a single Direct Connect connection with multiple virtual interfaces and enable encryption on the physical connection.

Answer

Use AWS Transit Gateway with Direct Connect Gateway and enable encryption on the Transit Gateway attachments.

Answer

Set up a VPN connection over the internet between on-premises and each VPC, and use VPC Peering for VPC-to-VPC traffic.

Question 14

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their application. What is the simplest way to enable IPv6 communication for instances in the VPC?

Accepted Answer

Assign an Amazon-provided IPv6 CIDR block to the VPC and subnets, and create an Egress-Only Internet Gateway for outbound traffic.. The simplest way to enable IPv6 communication in a VPC is to associate an Amazon-provided IPv6 CIDR block (a /56 from the 2002::/25 range) to the VPC and its subnets, then create an Egress-Only Internet Gateway (EIGW) for outbound-only IPv6 traffic. This allows instances with IPv6 addresses to initiate outbound connections to the internet while preventing inbound connections, which is the default security model for IPv6 in AWS.

Answer

Create a VPN connection to an external IPv6 network.

Answer

Configure a NAT Gateway in a public subnet and assign IPv6 addresses to instances.

Answer

Use an Internet Gateway with NAT for IPv6 traffic.

Question 15

A company is using AWS Transit Gateway to connect multiple VPCs. They notice that traffic between two VPCs in different Availability Zones is taking a suboptimal path, resulting in cross-AZ data transfer costs. How can they optimize the path and reduce costs?

Accepted Answer

Use Availability Zone affinity by launching resources in the same AZ and using Transit Gateway to route within the same AZ.. Configuring resources in the same Availability Zone (AZ) and using Transit Gateway to route within that AZ eliminates cross-AZ data transfer costs. AWS Transit Gateway charges for cross-AZ traffic, so keeping traffic local to a single AZ avoids these charges while still leveraging Transit Gateway for centralized routing.

Answer

Replace Transit Gateway with VPC Peering between the VPCs.

Answer

Enable Transit Gateway multicast to replicate traffic across AZs.

Answer

Configure the Transit Gateway to use a single Availability Zone for all attachments.