ANS-C01 Network Design Practice Test 15 — 15 Questions

Question 1

A company is designing a hybrid network connecting an on-premises data center to AWS via AWS Direct Connect. The company requires high availability and wants to avoid a single point of failure. Which design meets these requirements?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option D is correct because provisioning two Direct Connect connections at two different Direct Connect locations eliminates any single point of failure. This design ensures that if one connection or location fails, traffic can automatically fail over to the other connection, meeting the high availability requirement. A single Direct Connect connection, regardless of the number of VIFs or VLANs, remains a single point of failure.

Answer

Provision a single Direct Connect connection with multiple virtual interfaces (VIFs).

Answer

Provision one Direct Connect connection with two VLANs to separate production and non-production traffic.

Answer

Use a single Direct Connect connection and a VPN backup over the internet.

Question 2

A company is designing a VPC with subnets in multiple Availability Zones (AZs) for a web application. The application must be fault-tolerant and highly available. Which design should the network engineer implement?

Accepted Answer

Deploy application instances in two AZs behind an Application Load Balancer that spans both AZs.. Option C is correct because deploying application instances in two Availability Zones (AZs) behind an Application Load Balancer (ALB) that spans both AZs provides fault tolerance and high availability. If one AZ fails, the ALB automatically routes traffic to healthy instances in the remaining AZ, ensuring continuous service. This design leverages cross-zone load balancing, which is enabled by default for ALBs, to distribute traffic evenly across instances in multiple AZs.

Answer

Deploy all application instances in a single AZ behind an Application Load Balancer.

Answer

Place one instance in each of two AZs and use an internet gateway for load balancing.

Answer

Use a Network Load Balancer in a single AZ with instances in multiple AZs.

Question 3

A company is migrating a legacy application to AWS. The application requires a fixed IP address that must not change. The application will be deployed on Amazon EC2 instances behind an Application Load Balancer. Which solution meets the requirement for a static IP address?

Accepted Answer

Place the ALB behind AWS Global Accelerator, which provides static IP addresses.. Option C is correct because AWS Global Accelerator provides two static Anycast IP addresses that serve as fixed entry points for traffic. Traffic is then routed over the AWS global network to the Application Load Balancer, preserving the static IP requirement while still allowing the ALB to handle HTTP/HTTPS traffic. This decouples the static IP from the underlying load balancer, ensuring the IP does not change even if the ALB is replaced or recreated.

Answer

Assign an Elastic IP address to the Application Load Balancer.

Answer

Replace the ALB with a Network Load Balancer and assign an Elastic IP to it.

Answer

Use an Elastic IP address on each EC2 instance and point a CNAME record to the ALB.

Question 4

A company wants to securely connect two VPCs in the same region. The VPCs must be able to communicate using private IP addresses, and connectivity should be highly available. Which solution meets these requirements?

Accepted Answer

Create a VPC peering connection between the two VPCs.. Option C is correct because a VPC peering connection allows two VPCs in the same region to communicate using private IPv4 or IPv6 addresses as if they were on the same network, with no single point of failure. It is highly available by design since traffic flows directly between the VPCs using the AWS global network infrastructure, without any intermediate devices or bandwidth limits.

Answer

Set up a VPN connection between the two VPCs using virtual private gateways.

Answer

Create an inter-region VPC peering connection.

Answer

Use an AWS Transit Gateway to connect the two VPCs.

Question 5

An e-commerce company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. During a flash sale, the application experiences high latency. The network team notices that the ALB is receiving more traffic than expected. What is the most likely cause?

Accepted Answer

The ALB is not protected by AWS WAF, allowing a DDoS attack or excessive traffic to reach the backend.. Option D is correct because the sudden spike in traffic reaching the ALB beyond expected levels, combined with high latency, strongly indicates that the ALB is being overwhelmed by malicious or excessive traffic. Without AWS WAF protection, the ALB cannot filter out DDoS attacks or unwanted requests at Layer 7, so all traffic passes through to the backend instances, causing resource exhaustion and latency. AWS WAF integrates directly with ALBs to inspect and block malicious traffic before it reaches the application.

Answer

The ALB is configured to terminate HTTPS, which increases CPU load on the ALB.

Answer

The Auto Scaling group's scaling policies are too aggressive, causing frequent instance launches.

Answer

The ALB health checks are too frequent, consuming resources.

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new CIDR block 10.1.0.0/16 to accommodate more subnets. The VPC already has multiple subnets and route tables. What is the impact of adding this secondary CIDR?

Accepted Answer

Existing subnets and route tables remain unchanged; new subnets can be created in the new CIDR.. Adding a secondary CIDR block to an existing VPC is a non-disruptive operation. The existing subnets and route tables remain completely unchanged because the secondary CIDR is an additional IP address space, not a modification of the existing one. New subnets can be created within the new CIDR block, and you must explicitly associate them with route tables as needed.

Answer

The secondary CIDR will be automatically advertised to all route tables.

Answer

The VPC will experience a brief outage while the new CIDR is being associated.

Answer

Existing subnets will automatically be extended to include IPs from the new CIDR.

Question 7

A company is designing a VPC for a three-tier application (web, application, database). The database tier should not be accessible from the internet, but the web tier must be accessible. Which subnet design should the network engineer use?

Accepted Answer

Place web servers in public subnets with an internet gateway, and app and database servers in private subnets.. Option C is correct because it places the web servers in a public subnet with an Internet Gateway (IGW) to allow inbound HTTP/HTTPS traffic from the internet, while the application and database servers are placed in private subnets with no direct internet path. This design ensures the database tier is isolated from the internet, meeting the security requirement, while the web tier remains accessible. The application servers can communicate with the database via private IP addresses within the VPC, and outbound internet access for the private subnets (if needed) can be provided through a NAT Gateway in a public subnet.

Answer

Place web and app servers in public subnets, and database servers in private subnets.

Answer

Place all servers in private subnets and use a NAT Gateway for internet access.

Answer

Place all servers in public subnets and rely on security group rules to restrict access.

Question 8

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Accepted Answer

10.0.3.0/24. Option B (10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Answer

10.0.1.128/25

Answer

10.1.0.0/16

Answer

10.0.2.64/26

Question 9

A company is designing a Direct Connect solution for high availability. Which of the following are best practices? (Select THREE.)

Accepted Answer

Provision two Direct Connect connections at different locations.. Provisioning two Direct Connect connections at different locations ensures physical diversity, which is a fundamental requirement for high availability. If one data center or fiber path fails, the other connection can continue to carry traffic, preventing a single point of failure. This aligns with the AWS Well-Architected Framework's recommendation for redundant network paths.

Answer

Use the same Direct Connect provider for both connections to simplify management.

Answer

Use a single Direct Connect connection with multiple virtual interfaces.

Question 10

A company is designing a VPC with IPv6. Which components are required to enable IPv6 communication between instances in the VPC and the internet? (Select TWO.)

Accepted Answer

A route in the subnet route table to ::/0 to the internet gateway. To enable IPv6 communication between instances in a VPC and the internet, you need an internet gateway (IGW) attached to the VPC, and a route in the subnet's route table that directs IPv6 traffic (destination ::/0) to that internet gateway. The IGW performs NAT for IPv6 (using eUI-64 addresses) and allows bidirectional traffic, so both components are required.

Answer

An egress-only internet gateway

Answer

A VPC peering connection to a VPC with internet access

Answer

A NAT Gateway

Question 11

A company runs a critical application on EC2 instances in a VPC with a single private subnet (10.0.1.0/24) in us-east-1a. The instances need to download security updates from the internet. The company currently uses a NAT Gateway in a public subnet (10.0.0.0/24) in us-east-1a. Recently, an Availability Zone failure caused us-east-1a to become unavailable, and the application could not reach the internet. The company wants to redesign the network to be highly available across multiple AZs for internet access. The application must continue to use private IP addresses for outbound traffic. The company has a limited budget and wants to minimize costs while meeting high availability. Which solution should the company implement?

Accepted Answer

Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.. Option C is correct because it ensures high availability for outbound internet traffic by deploying a NAT Gateway in each of two Availability Zones (us-east-1a and us-east-1b) with separate private subnets and route tables. This design eliminates the single point of failure; if one AZ fails, the other NAT Gateway continues to route traffic. The application retains private IP addresses for outbound traffic, and the cost is minimized by using only two NAT Gateways (one per AZ) rather than a more expensive multi-AZ architecture like a transit gateway or VPN.

Answer

Deploy one NAT Gateway in a new public subnet in us-east-1b and update the private subnet route table to use it.

Answer

Remove the NAT Gateway and attach an internet gateway to the VPC. Add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

Answer

Replace the NAT Gateway with a NAT instance in a public subnet in us-east-1a and configure a secondary ENI in us-east-1b for failover.

Question 12

A company has a VPC with CIDR 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private) in us-west-2a. They have an EC2 instance in the private subnet that needs to access an S3 bucket for log uploads. The company wants to avoid using a NAT Gateway to reduce costs. The S3 bucket is in the same region. Which solution should the network engineer implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route from the private subnet to the endpoint.. Option C is correct because a VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet or requiring a NAT Gateway. The endpoint uses AWS PrivateLink to route traffic directly to S3 over the AWS network, and you must add a route in the private subnet's route table pointing to the endpoint (prefix list ID) to enable connectivity.

Answer

Assign an IAM instance profile to the EC2 instance that allows S3 access.

Answer

Set up a VPN connection from the VPC to the S3 bucket.

Answer

Create an S3 access point and configure the VPC to use it.

Question 13

A company is designing a multi-Region application using Amazon Route 53 latency-based routing. The application must be highly available and failover automatically if an AWS Region becomes unavailable. What should the company do to meet these requirements?

Accepted Answer

Configure active-passive failover with latency-based routing and associate health checks with each record.. Option B is correct because it combines latency-based routing with health checks and active-passive failover, which allows Route 53 to route traffic to the region with the lowest latency under normal conditions and automatically fail over to the passive region if the active region's health check fails. This meets the high availability and automatic failover requirements by leveraging Route 53's DNS failover mechanism, which updates DNS responses based on health check status.

Answer

Configure latency-based routing with health checks and enable DNS failover.

Answer

Configure geolocation routing policies and associate health checks.

Answer

Configure weighted routing policies with equal weights for all regions.

Question 14

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates. The company must ensure that traffic from the private instances uses a single, predictable public IP address. What is the MOST cost-effective solution?

Accepted Answer

Deploy a NAT Gateway in a public subnet in one Availability Zone, and route private subnet traffic to it.. Option C is correct because a NAT Gateway in a public subnet provides outbound-only internet access for private instances, and it uses a single Elastic IP address, ensuring a predictable public IP. This is the most cost-effective managed solution, as NAT Gateways are highly available within an Availability Zone and require no manual instance management.

Answer

Attach an Internet Gateway to the VPC and update the private subnet route table with a default route to the Internet Gateway.

Answer

Create a Transit Gateway with a VPC attachment and route traffic through a central egress VPC.

Answer

Launch a NAT instance in a public subnet and configure source/destination check.

Question 15

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company has a single hosted virtual interface (VIF) with a private VIF to a VPC. The network team notices that traffic from on-premises to AWS is asymmetric—some packets go through the Direct Connect while others use a VPN backup. The team wants all traffic to use Direct Connect when available. What should they do?

Accepted Answer

Advertise more specific prefixes (e.g., /24) over Direct Connect and less specific (e.g., /16) over VPN.. Option D is correct because BGP route selection prefers more specific prefixes (longest prefix match) over less specific ones. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over the VPN, the on-premises router will prefer the Direct Connect path for the more specific route, ensuring all traffic uses Direct Connect when available. This leverages BGP's prefix-length-based path selection without requiring removal of the VPN backup.

Answer

Disable AS_PATH prepending on the Direct Connect BGP session.

Answer

Convert the private VIF to a public VIF.

Answer

Remove the VPN connection to force all traffic through Direct Connect.