ANS-C01 Network Design Practice Test 16 — 15 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What is the MOST likely cause?

Accepted Answer

The Transit Gateway route tables do not have a route for the destination VPC CIDR, so traffic is sent to the on-premises network via a default route.. When a Transit Gateway route table lacks a specific route for the destination VPC CIDR, traffic destined for that VPC is evaluated against the remaining routes. If a default route (0.0.0.0/0) exists pointing to an on-premises network attachment (e.g., a VPN or Direct Connect), the traffic will be forwarded over that path, resulting in a suboptimal route that leaves AWS and re-enters through the on-premises network. This is the most likely cause because the Transit Gateway performs destination-based routing, and missing a specific VPC route forces fallback to the default route.

Answer

The subnet route tables in each VPC have a route pointing to the other VPC's CIDR via the Internet Gateway.

Answer

The VPCs are peered directly, bypassing the Transit Gateway.

Answer

Security groups are blocking traffic between the VPCs.

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT Gateway in the public subnet. The download is failing. Which configuration should the network engineer check FIRST?

Accepted Answer

The route table associated with the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway.. Option D is correct because for an EC2 instance in a private subnet to reach the internet via a NAT Gateway, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic from the instance destined for the internet has no path to the NAT Gateway, causing the download to fail.

Answer

The network ACL for the private subnet allows inbound HTTP/HTTPS traffic.

Answer

The EC2 instance has a public IP address assigned.

Answer

The Internet Gateway is attached to the private subnet.

Question 3

A company is designing a network for a critical application that requires high availability across three Availability Zones in a single AWS Region. The application uses Network Load Balancers (NLBs) and Application Load Balancers (ALBs). The company must ensure that cross-zone load balancing is enabled for the NLBs and that the ALBs have a fixed response timeout. Which combination of settings meets these requirements?

Accepted Answer

Enable cross-zone load balancing on the NLB (default) and set the idle timeout on the ALB to a fixed value.. Option B is correct because cross-zone load balancing is enabled by default on Network Load Balancers (NLBs) and ensures traffic is distributed evenly across targets in all Availability Zones, which is critical for high availability across three AZs. The idle timeout on an Application Load Balancer (ALB) is a fixed value (default 60 seconds, configurable from 1 to 4000 seconds) that controls how long the ALB keeps a connection open without data transfer, meeting the requirement for a fixed response timeout. This combination satisfies both requirements without conflicting settings.

Answer

Disable cross-zone load balancing on the ALB and set the idle timeout on the NLB.

Answer

Disable cross-zone load balancing on the NLB and set the connection timeout on the ALB.

Answer

Enable cross-zone load balancing on the ALB and set the connection timeout on the NLB.

Question 4

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The VPN is configured with a server certificate and mutual authentication. Some users report that they cannot connect to the VPN. What should the administrator check FIRST?

Accepted Answer

Verify that each user has a valid client certificate installed on their device.. The question states that mutual authentication is configured, which requires both a server certificate and a valid client certificate on each user's device. Since some users cannot connect while others presumably can, the most likely issue is that the affected users lack a valid client certificate. The administrator should first verify that each user has a valid client certificate installed, as this is a common point of failure in mutual TLS authentication.

Answer

Check the security group associated with the VPN endpoint.

Answer

Verify that the server certificate is uploaded to AWS Certificate Manager (ACM).

Answer

Confirm that the VPN endpoint is associated with all subnets in the VPC.

Question 5

A company is designing a hybrid network using AWS Direct Connect and VPN backup. The company wants to ensure that traffic always uses Direct Connect when it is available. Which TWO configurations should be implemented? (Choose TWO.)

Accepted Answer

Use AS_PATH prepending on the VPN BGP session to make the VPN path less preferred.. AS_PATH prepending on the VPN BGP session increases the AS_PATH length for routes advertised over the VPN, making them less preferred compared to the same routes learned over Direct Connect with a shorter AS_PATH. BGP selects the path with the shortest AS_PATH length, so traffic will use Direct Connect when it is available. This is a standard technique for influencing outbound traffic path selection in a hybrid network.

Answer

Disable BGP on the VPN connection to force traffic to Direct Connect.

Answer

Set a lower MED value on the Direct Connect BGP session.

Answer

Advertise the same prefixes over both connections with the same AS_PATH length.

Question 6

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Accepted Answer

Create a Transit Gateway in the central account and attach the central VPC.. Option B is correct because a Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.

Answer

Create a VPC peering connection between each spoke VPC and the central VPC.

Answer

Deploy a firewall appliance in each spoke VPC.

Question 7

A company is designing a VPC with public and private subnets. The company needs to provide internet access to instances in the private subnets. Which TWO components are required? (Choose TWO.)

Accepted Answer

Internet Gateway attached to the VPC. An Internet Gateway (IGW) is required to provide a target in the VPC route tables for internet-bound traffic. For instances in private subnets, a NAT Gateway placed in a public subnet translates their private IP addresses to the public IP of the NAT Gateway, allowing outbound internet access while preventing unsolicited inbound connections. The private subnet's route table must point 0.0.0.0/0 to the NAT Gateway, and the public subnet's route table must point 0.0.0.0/0 to the IGW.

Answer

Transit Gateway

Answer

VPC Gateway Endpoint for S3

Answer

Virtual Private Gateway

Question 8

A company runs a multi-tier web application in a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier uses EC2 instances in private subnets. The database tier uses an RDS MySQL Multi-AZ instance in private subnets. The company has implemented a network ACL (NACL) on the private subnets to allow only traffic from the ALB security group. Recently, the application tier instances are unable to connect to the RDS database. The security group for RDS allows inbound traffic on port 3306 from the application tier security group. The network team has verified that the application tier instances can reach the internet through a NAT Gateway. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The NACL on the private subnets is blocking outbound traffic from the application tier to the RDS database.. The NACL on the private subnets is stateful only for inbound rules; outbound traffic is evaluated separately. Since the NACL allows only inbound traffic from the ALB security group but does not have an outbound rule permitting traffic from the application tier to the RDS database (port 3306), the outbound SYN packets from the application instances are dropped, preventing the TCP handshake from completing.

Answer

The application tier instances are in a different Availability Zone than the RDS primary instance.

Answer

The NAT Gateway is blocking traffic to the RDS endpoint.

Answer

The RDS security group is not allowing inbound traffic from the application tier security group.

Question 9

A company is deploying a new application in a VPC that uses a single Availability Zone. The application consists of an Application Load Balancer (ALB) in a public subnet and EC2 instances in a private subnet. The EC2 instances need to send logs to an Amazon S3 bucket. The company has created a VPC gateway endpoint for S3 and associated it with the route table for the private subnet. The EC2 instances have an instance profile that grants access to the S3 bucket. However, the log delivery fails. The network team has verified that the route table for the private subnet includes a route to the S3 prefix list via the gateway endpoint. What is the MOST likely cause of the failure?

Accepted Answer

The VPC endpoint policy does not allow the PutObject action on the S3 bucket.. The most likely cause is that the VPC endpoint policy does not allow the PutObject action on the S3 bucket. Even though the route table has a route to the S3 prefix list via the gateway endpoint and the EC2 instance profile grants access, the endpoint policy acts as an additional layer of authorization. If the endpoint policy does not explicitly allow the s3:PutObject action for the target bucket, requests will be denied, causing the log delivery to fail.

Answer

The route table does not have a route to the S3 prefix list.

Answer

The VPC endpoint is not configured with private DNS.

Answer

The security group on the EC2 instances does not allow outbound traffic to the S3 prefix list.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an Amazon DynamoDB table. The company wants to avoid sending traffic over the internet. A VPC gateway endpoint for DynamoDB is created and attached to the route table of the private subnet. The EC2 instance has an IAM role that grants access to DynamoDB. However, the application running on the instance cannot connect to DynamoDB. The network team confirms that the route table has a route to the DynamoDB prefix list. What is the MOST likely cause?

Accepted Answer

The VPC does not have DNS resolution enabled, or the endpoint's private DNS option is disabled.. Option D is correct because a VPC gateway endpoint for DynamoDB requires DNS resolution to resolve the DynamoDB public hostnames to private IP addresses within the VPC. If DNS resolution is disabled or the endpoint's private DNS option is disabled, the EC2 instance will resolve DynamoDB endpoints to public IPs, causing traffic to attempt internet routing rather than using the gateway endpoint. Since the route table already has the prefix list route, the most likely remaining issue is DNS-related.

Answer

The security group on the EC2 instance blocks outbound traffic to DynamoDB.

Answer

The IAM role does not include the dynamodb:PutItem action.

Answer

The route table does not have a route to the DynamoDB prefix list.

Question 11

A company is designing a hybrid network architecture that requires a dedicated, private, and consistent connection between its on-premises data center and AWS. The connection must support multiple VLANs and provide a service-level agreement (SLA) of 99.99% availability. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, and consistent network connection from an on-premises data center to AWS, bypassing the public internet. It supports multiple VLANs via 802.1Q tagging over a single physical connection, and offers a 99.99% service-level agreement (SLA) when configured with redundant connections at separate Direct Connect locations.

Answer

AWS Transit Gateway

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 12

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

Answer

Attach the ENI to the EC2 instance

Answer

Create the VPC endpoint

Answer

Describe VPC endpoints

Answer

Modify the VPC endpoint

Question 13

A company wants to ensure that traffic between two VPCs in the same region is encrypted and does not traverse the public internet. Which solution meets these requirements?

Accepted Answer

Configure VPC Peering between the two VPCs. VPC Peering (Option A) is correct because it establishes a direct, private network connection between two VPCs using AWS's internal infrastructure, ensuring traffic never traverses the public internet. All inter-VPC traffic over a VPC peering connection remains within the AWS global network, and encryption is inherently provided by the underlying physical layer security of AWS data centers, meeting both requirements without additional configuration.

Answer

Create VPC Endpoints in each VPC for the other VPC's CIDR

Answer

Use an AWS Transit Gateway to route traffic between the VPCs

Answer

Establish an AWS Site-to-Site VPN connection between the VPCs

Question 14

An organization has multiple VPCs connected to a common Transit Gateway. The network team wants to centrally manage and enforce routing policies, such as allowing or denying traffic between specific VPCs based on tags. Which AWS feature should be used to implement this requirement?

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager provides a central dashboard to manage and monitor transit gateways, on-premises networks, and attached VPCs. It supports defining and enforcing routing policies based on tags, enabling the network team to centrally allow or deny traffic between specific VPCs without manually managing individual route tables.

Answer

AWS Direct Connect Gateway

Answer

Amazon Route 53 Resolver

Answer

VPC Peering with route tables

Question 15

A network engineer is troubleshooting connectivity to a VPC endpoint service. The engineer runs the CLI command shown in the exhibit. The output shows two service names. Which statement is correct based on this output?

Accepted Answer

The engineer can create an interface VPC endpoint to the services. The CLI command `aws ec2 describe-vpc-endpoint-services` returns a list of AWS services that support VPC endpoints. The output shows two service names, which are AWS-managed services (e.g., `com.amazonaws.vpce.us-east-1.s3`). These services can be accessed via interface VPC endpoints, which use Elastic Network Interfaces (ENIs) with private IP addresses to route traffic privately within the VPC. Therefore, the engineer can create an interface VPC endpoint to these services.

Answer

The services are Gateway VPC endpoints

Answer

The services are VPC peering connections

Answer

The services are Gateway Load Balancer endpoint services