ANS-C01 Network Design Practice Test 16 — 15 Questions

Question 1

A company is designing a highly available network for a critical application that requires sub-second failover between two AWS regions. The application uses active-active traffic distribution. Which routing policy should they use in Amazon Route 53?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Latency routing with health checks. Latency routing with health checks is the correct choice because it directs traffic to the region that provides the lowest latency for each user, and when combined with health checks, Route 53 can automatically route traffic away from unhealthy endpoints. This enables sub-second failover between two active-active regions, as Route 53's DNS-based health checking and routing updates occur quickly (typically within a few seconds) without requiring manual intervention or a primary/secondary failover model.

Answer

Failover routing

Answer

Geolocation routing

Answer

Weighted routing

Question 2

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC that has CIDR 10.0.0.0/16. What is the issue and how can it be resolved?

Accepted Answer

The VPCs have overlapping CIDRs, so they cannot be directly peered. You must re-IP one VPC or use a NAT solution.. VPC peering requires non-overlapping CIDR blocks because the route tables in each VPC must have distinct destination prefixes to route traffic correctly. When both VPCs use 10.0.0.0/16, the routes are identical, causing ambiguity and preventing the peering connection from being established. The only resolution is to change the CIDR of one VPC or use a NAT-based solution to translate addresses.

Answer

The VPCs can be peered if you enable DNS resolution.

Answer

Use a Transit Gateway to connect the VPCs, which supports overlapping CIDRs.

Answer

Use a Direct Connect Gateway to connect the VPCs, which ignores CIDR overlap.

Question 3

A company is designing a network for a multi-tier application that must meet compliance requirements. The architecture includes a VPC with public, private, and database subnets. Which TWO actions should be taken to ensure the database subnets are not directly accessible from the internet? (Select TWO.)

Accepted Answer

Configure a network ACL on the database subnets to deny inbound traffic from 0.0.0.0/0.. Option E is correct because placing the database subnets in private subnets means they have no route to an Internet Gateway, so they cannot be reached directly from the internet; this is the foundational design control for isolating database tiers. Option D is correct because a network ACL is a stateless subnet-level firewall, and an explicit inbound DENY rule for 0.0.0.0/0 (and ::/0 for IPv6) blocks internet-sourced traffic at the subnet boundary, adding defense-in-depth even if routing were misconfigured. Option A is wrong because attaching an Internet Gateway to the database subnets would make them public and directly routable from the internet, the opposite of the requirement. Option B is wrong because a NAT Gateway provides outbound-only internet access for private subnets and does not prevent inbound internet access, so it does not satisfy the isolation goal. Option C is wrong because security groups are allow-only and cannot contain explicit deny rules, so a rule 'denying' 0.0.0.0/0 is not a valid security group configuration.

Answer

Attach an Internet Gateway to the database subnets.

Answer

Create a NAT Gateway in the database subnets.

Answer

Associate a security group that denies inbound traffic from 0.0.0.0/0.

Question 4

A company is designing a network for a global application that requires low latency between users and application servers. They plan to use multiple AWS regions and want to route users to the nearest healthy endpoint. Which THREE services should they use together? (Select THREE.)

Accepted Answer

Amazon CloudFront. Amazon CloudFront (A) is correct because it is a global CDN with hundreds of edge locations that caches content and terminates user connections close to the user, reducing latency to the application. Amazon Route 53 with latency-based routing (B) is correct because it resolves DNS queries to the AWS region whose latency measurement is lowest for the user, and it can be combined with health checks to avoid unhealthy endpoints. AWS Global Accelerator (C) is correct because it provides anycast static IP addresses that route traffic over the AWS global backbone to the nearest healthy regional endpoint, improving latency and failover. AWS WAF (D) is a web application firewall for filtering HTTP(S) traffic and does not provide latency-based routing or global endpoint selection. An Application Load Balancer in each region (E) distributes traffic within a single region and is not a global latency-routing service, so it does not fulfill the requirement on its own.

Answer

AWS WAF

Answer

Application Load Balancer in each region

Question 5

A company has deployed a multi-tier web application in a single AWS region. The architecture includes a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier runs on EC2 instances in the private subnets. The database tier uses an Amazon RDS Multi-AZ deployment in the database subnets. The company is experiencing intermittent connectivity issues between the application tier and the database tier. The application logs show connection timeouts. The network engineer has verified that the security groups and network ACLs are correctly configured. The RDS instance is reachable from the application tier via a telnet test from one specific instance, but not consistently from all instances. What is the most likely cause of the intermittent connectivity?

Accepted Answer

The RDS Multi-AZ failover is causing the primary instance to change, and the application is not reconnecting to the new endpoint.. The most likely cause is that the RDS Multi-AZ failover is causing the primary instance to change, and the application is not reconnecting to the new endpoint. In a Multi-AZ deployment, if a failover occurs, the DNS endpoint updates to point to the new primary, but if the application caches the resolved IP address or uses stale connections, it may experience intermittent timeouts. This explains why connectivity works from some instances (those with fresh DNS entries) but not others. Option C is incorrect because within a single VPC, the local route automatically enables routing between all subnets; missing routes would cause consistent failure, not intermittent. Option B is incorrect because network ACLs, if correctly configured, would not cause intermittent issues. Option D is incorrect because a security group misconfiguration would likely cause consistent failure from all instances, not intermittent connectivity.

Answer

The network ACLs on the database subnets are blocking ephemeral ports used by the application.

Answer

The database subnets are in different Availability Zones than the application subnets, and the route tables in the application subnets do not have routes to the database subnet CIDRs.

Answer

The security group for the database is allowing traffic only from the application tier's security group, but the application tier instances are using a different security group.

Question 6

A company is expanding its on-premises data center to AWS using a hybrid cloud architecture. They have established an AWS Direct Connect connection with a private virtual interface to a VPC. The on-premises network uses BGP to exchange routes with the VPC. The network engineer notices that the on-premises network can reach some EC2 instances in the VPC but not others. All EC2 instances are in the same subnet (10.0.1.0/24) and have private IP addresses. The Direct Connect virtual interface is configured with the VPC CIDR (10.0.0.0/16) advertised to on-premises. The on-premises firewall logs show that traffic to the unreachable instances is being dropped. What is the most likely cause?

Accepted Answer

The security group attached to the unreachable instances is not allowing inbound traffic from the on-premises network.. The most likely cause is that the security group attached to the unreachable EC2 instances does not allow inbound traffic from the on-premises network. Security groups are stateful and must explicitly permit inbound traffic from the on-premises CIDR; if some instances have a security group rule allowing the on-premises range and others do not, only the permitted ones are reachable. Since the on-premises firewall logs show traffic being dropped, the issue is on the AWS side after the packet reaches the instance's security group.

Answer

The subnet route table does not have a route to the on-premises network.

Answer

The BGP session is not advertising the on-premises routes to the VPC.

Answer

The network ACL on the subnet is blocking inbound traffic from on-premises.

Question 7

A company is designing a hybrid network architecture that connects its on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that if the Direct Connect connection fails, traffic automatically fails over to a VPN connection. Which configuration ensures this failover behavior?

Accepted Answer

Advertise the on-premises prefixes over Direct Connect with a lower MED value than over the VPN.. BGP uses the Multi-Exit Discriminator (MED) value to influence inbound path selection, where a lower MED is preferred. By advertising on-premises prefixes over Direct Connect with a lower MED than over the VPN, AWS will prefer the Direct Connect path under normal conditions. If the Direct Connect fails, the routes are withdrawn, and the VPN routes (with higher MED) become active, providing automatic failover.

Answer

Advertise the on-premises prefixes over Direct Connect with a higher AS path prepend than over the VPN.

Answer

Advertise the on-premises prefixes over Direct Connect with a specific BGP community to influence path selection.

Answer

Advertise the on-premises prefixes over Direct Connect with a higher local preference than over the VPN.

Question 8

A global company is deploying a multi-Region application on AWS. The application requires low-latency access to a shared dataset that is updated frequently in multiple Regions. The company wants to use Amazon Route 53 latency-based routing to direct users to the closest Region. Which data store provides the best combination of low-latency reads and cross-Region consistency for this use case?

Accepted Answer

Amazon ElastiCache for Redis Global Datastore. Amazon ElastiCache for Redis Global Datastore provides sub-millisecond read latency by serving data from in-memory caches, and it offers cross-Region consistency by replicating writes from a primary Region to read replicas in secondary Regions with minimal lag. This combination meets the requirement for low-latency access to a frequently updated shared dataset across multiple Regions, as it avoids the higher latency of disk-based storage and the eventual consistency delays of other options.

Answer

Amazon S3 with cross-Region replication

Answer

Amazon Aurora Global Database

Answer

Amazon DynamoDB global tables with eventually consistent reads

Question 9

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use private virtual interfaces (VIFs) to access multiple VPCs in the same AWS Region. Which AWS service should be used to simplify this connectivity?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway allows you to associate multiple virtual private gateways (VGWs) or transit gateways in the same or different AWS accounts, enabling a single private virtual interface to connect to multiple VPCs in the same AWS Region. This simplifies connectivity by eliminating the need for separate VIFs per VPC and reduces operational overhead.

Answer

Transit VPC solution with EC2-based VPN appliances

Answer

AWS Site-to-Site VPN

Answer

VPC peering connection

Question 10

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. The company wants to ensure that traffic from private subnets uses a single, highly available IP address for outbound traffic. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in a public subnet and route traffic from private subnets to it.. A NAT gateway provides managed, highly available outbound internet access for private subnets using a single elastic IP address. It is deployed in a public subnet and automatically handles failover within an Availability Zone, meeting the requirement for a single, highly available IP for outbound traffic.

Answer

Deploy a single EC2 instance configured as a NAT instance in a public subnet.

Answer

Configure a fleet of proxy servers in an Auto Scaling group with a Network Load Balancer.

Answer

Use a VPC endpoint for Amazon S3 to access software updates.

Question 11

A company has a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to make API calls to Amazon S3. Which is the most secure way to provide this access without traffic leaving the AWS network?

Accepted Answer

Create a VPC gateway endpoint for Amazon S3 and attach it to the route table of the private subnet.. A VPC gateway endpoint for Amazon S3 allows resources in a private subnet to access S3 privately using the AWS network, without traversing the internet or requiring a NAT gateway. This is the most secure option because traffic stays within the AWS backbone and does not require public IPs or external connectivity.

Answer

Use an AWS Site-to-Site VPN to connect to a remote network that has access to S3.

Answer

Set up a NAT gateway in the public subnet and route the web server's traffic through it.

Answer

Use an internet gateway and a public IP address on the web server.

Question 12

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

Accepted Answer

No instances in the VPC can resolve DNS records from the private hosted zone.. The AWS CLI command shown in the exhibit sets the `enableDnsHostnames` and `enableDnsSupport` attributes to `false` for the VPC. When `enableDnsSupport` is false, Amazon Route 53 private hosted zones cannot be resolved by instances within that VPC because the VPC's DNS resolution is disabled entirely. This means no instances in the VPC can query the Route 53 Resolver for private hosted zone records, making option A correct.

Answer

Only instances in public subnets can resolve private hosted zone records.

Answer

The DHCP option set must be updated to provide DNS resolution.

Answer

The private hosted zone is automatically deleted.

Question 13

A company wants to connect multiple VPCs in different AWS Regions using AWS Transit Gateway. The company requires full mesh connectivity with centralized inspection of inter-Region traffic. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create Transit Gateway peering attachments between the Transit Gateways in each Region.. Option A is correct because inter-Region Transit Gateway connectivity is established by creating a Transit Gateway peering attachment between the Transit Gateways in each Region, which enables full mesh connectivity across Regions. Option D is correct because centralized inspection of inter-Region traffic is achieved by steering traffic through a central inspection VPC using Transit Gateway route tables, where routes and associations/propagations direct traffic to the inspection VPC's attachment. Option B is incorrect because VPN attachments are used for encrypted connectivity to on-premises networks or remote sites, not for connecting Transit Gateways across Regions for this design. Option C is incorrect because VPC peering does not provide the centralized Transit Gateway-based routing and inspection required here. Option E is incorrect because disabling cross-Region peering would prevent the required inter-Region connectivity.

Answer

Create VPN attachments between each Transit Gateway and the inspection VPC.

Answer

Use VPC peering connections between VPCs in different Regions.

Answer

Disable cross-Region peering on the Transit Gateway.

Question 14

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in a VPC. The application experiences unpredictable traffic spikes. The company notices that during peak traffic, the ALB returns 503 errors. The network engineer checks the ALB's CloudWatch metrics and sees that the 'ActiveConnectionCount' is high but 'TargetResponseTime' is low. The ALB's target group is configured with a deregistration delay of 300 seconds. The ALB is internet-facing and uses an SSL/TLS certificate from AWS Certificate Manager. The security group for the ALB allows inbound HTTPS from 0.0.0.0/0. The target instances' security group allows inbound traffic from the ALB's security group. The VPC has a CIDR of 10.0.0.0/16 with public and private subnets. The ALB is in public subnets, and the instances are in private subnets. The route tables for private subnets have a default route to a NAT gateway in the public subnets. The company wants to resolve the 503 errors. What should the network engineer do?

Accepted Answer

Increase the idle timeout setting on the ALB to a higher value.. The ALB returns 503 errors when it cannot establish or maintain connections to targets, often due to connection timeouts. With high ActiveConnectionCount and low TargetResponseTime, the targets are responsive, but the ALB's idle timeout (default 60 seconds) may be shorter than the time clients keep connections open, causing the ALB to close connections prematurely and return 503s. Increasing the idle timeout allows the ALB to keep connections open longer, aligning with client behavior and preventing these errors.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay to 600 seconds.

Answer

Move the ALB to private subnets and use a NAT gateway for internet access.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. It has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The company hosts a web application on EC2 instances in the private subnets behind an Application Load Balancer (ALB) in the public subnets. The ALB is internet-facing. The company wants to add a second ALB in the same VPC for a different application but using the same public subnets. The new ALB also needs to be internet-facing. However, when the company tries to create the new ALB, they receive an error: 'The subnet 'subnet-xxxxxxxx' does not have enough free IP addresses to satisfy the request.' The network engineer checks the subnets and finds that the public subnets have only 2 free IP addresses each. The private subnets have plenty of free IP addresses. The company wants to resolve this error without changing the architecture of the existing applications. What should the network engineer do?

Accepted Answer

Create new public subnets with larger CIDR blocks (e.g., /23) and associate them with the same route table.. The error indicates that the public subnets lack sufficient free IP addresses to support the new ALB, which requires at least one IP address per subnet (and typically more for scaling). Creating new public subnets with larger CIDR blocks (e.g., /23) provides ample IP addresses and can be associated with the same route table to maintain internet accessibility. This resolves the error without altering the existing architecture.

Answer

Use the private subnets for the new ALB and add a NAT gateway for internet access.

Answer

Reduce the size of the existing public subnets by modifying their CIDR blocks.

Answer

Launch a NAT gateway in one public subnet to free up IP addresses.