ANS-C01 Network Design Practice Test 17 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route table for the private subnet does not have a route to the NAT gateway.. The private subnet's route table must explicitly point 0.0.0.0/0 to the NAT gateway for traffic to be routed outbound. The question states that the route was added, but the most likely cause is that the route is missing or misconfigured—perhaps the route was added to the wrong route table or the subnet association is incorrect. In AWS, a NAT gateway is only usable if the route table associated with the private subnet has a route to the NAT gateway; otherwise, traffic has no path to the internet. Since the other components (NAT gateway EIP, security groups, NACLs, public subnet route to IGW) are verified as correct, the missing or incorrect route in the private subnet's route table is the most plausible cause.

Answer

The security group for the EC2 instance does not allow outbound traffic.

Answer

The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Question 2

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. They require that traffic from a specific client IP address is always routed to the same AWS Region for session persistence. Which Global Accelerator feature should be used?

Accepted Answer

Enable client IP address affinity (sticky sessions).. Global Accelerator's client IP address affinity (sticky sessions) ensures that traffic from a specific client IP is consistently routed to the same endpoint (in this case, the same AWS Region) for the duration of the session. This feature uses a hash of the client IP to maintain stickiness, which is essential for session persistence in an active-active multi-Region setup.

Answer

Configure health checks on the endpoints.

Answer

Assign endpoint weights to each ALB.

Answer

Set traffic dials to 100% for both Regions.

Question 3

A company runs a critical application on Amazon EC2 instances in a VPC. The application receives data from an on-premises data center over an AWS Direct Connect connection. The company wants to add redundant connectivity using a VPN connection over the internet. They need to ensure that traffic from on-premises to AWS uses the Direct Connect connection when it is healthy, and only fails over to the VPN if Direct Connect fails. Which configuration achieves this?

Accepted Answer

Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN, and set a higher MED value on the VPN routes.. Advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /20) over VPN, combined with a higher MED value on the VPN routes, ensures that the Direct Connect path is preferred when healthy. BGP selects the most specific prefix first, and if prefixes are identical, lower MED is preferred; here, the more specific prefix over Direct Connect wins, and the higher MED on VPN acts as a tie-breaker for any overlapping less specific routes, guaranteeing failover only when Direct Connect is unavailable.

Answer

Advertise the same prefix over both connections but prepend AS_PATH multiple times on the Direct Connect routes.

Answer

Set a higher BGP weight on the VPN routes.

Answer

Set a lower BGP local preference on the Direct Connect routes.

Question 4

A company is designing a VPC with both IPv4 and IPv6 workloads. The VPC has an internet gateway, and the company wants to allow outbound IPv6 traffic to the internet from instances in a private subnet while blocking inbound IPv6 traffic from the internet. Which configuration should be used?

Accepted Answer

Configure an egress-only internet gateway in the VPC and add a route for ::/0 to the egress-only internet gateway in the private subnet's route table.. An egress-only internet gateway (EIGW) is a horizontally scaled, redundant component that allows outbound IPv6 traffic from instances in a private subnet to the internet, but prevents the internet from initiating an inbound IPv6 connection to those instances. By adding a default route (::/0) pointing to the EIGW in the private subnet's route table, outbound IPv6 traffic is forwarded to the internet gateway, while the EIGW inherently drops any unsolicited inbound IPv6 traffic. This meets the requirement exactly, as security groups and network ACLs alone cannot fully block inbound IPv6 from the internet when a standard internet gateway is used.

Answer

Configure a security group that allows outbound traffic and denies inbound traffic.

Answer

Configure a virtual private gateway and route traffic through it.

Answer

Configure a NAT gateway in a public subnet.

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: Subnet A (10.0.1.0/24) and Subnet B (10.0.2.0/24). They launch an EC2 instance in Subnet A and assign it a primary private IP address of 10.0.1.50. They then attach a second elastic network interface (ENI) to the instance with a primary private IP of 10.0.2.100. The instance needs to send traffic from the second ENI. However, when the instance sends traffic from the second ENI, it fails. What is the MOST likely cause?

Accepted Answer

The instance's operating system routing table does not have a route for the second ENI's subnet.. When an EC2 instance has multiple ENIs, the operating system's routing table must have explicit routes for each ENI's subnet to ensure traffic leaves via the correct interface. By default, the OS only adds a route for the primary ENI's subnet, so traffic from the second ENI (10.0.2.100) fails because the OS tries to send it out the primary ENI, which is in a different subnet. This is a common cause of asymmetric routing or connectivity failure.

Answer

The two ENIs are in different subnets, which is not allowed.

Answer

The security group for the second ENI does not allow outbound traffic.

Answer

The subnet route table does not have a route for the second ENI's IP address.

Question 6

A company is designing a multi-VPC architecture in a single AWS Region. The company has three VPCs: Production, Development, and Shared Services. They want to enable transitive routing between all VPCs while minimizing operational overhead. Which TWO solutions meet these requirements?

Accepted Answer

Use AWS Transit Gateway to connect all VPCs.. Option C is correct because AWS Transit Gateway acts as a regional hub that lets you attach multiple VPCs and route traffic between them transitively, which is exactly the any-to-any connectivity the company needs with minimal operational overhead (one gateway, one set of route tables, no full-mesh peering management). Option E is correct because a Transit Gateway with VPN attachments to an on-premises router also provides transitive routing between the VPCs: the VPCs attach to the TGW, and the on-premises router (reachable over the VPN attachments) forwards traffic between them, satisfying the transitive routing requirement. Option A is not correct because VPC peering is non-transitive, so a full mesh of peering connections would be required and each pair must be managed individually, increasing operational overhead. Option B is not correct because VPN connections between VPCs are not a supported transitive routing mechanism and would not scale or simplify operations. Option D is not correct because Direct Connect links each VPC to on-premises but does not by itself provide transitive routing between the VPCs without an additional routing layer such as a Transit Gateway.

Answer

Establish VPC peering connections between each pair of VPCs.

Answer

Configure a VPN connection between each VPC.

Answer

Configure AWS Direct Connect connections from each VPC to the same on-premises router.

Question 7

A company wants to connect its on-premises network to AWS using AWS Direct Connect. The company has two data centers, each with a redundant connection to an AWS Direct Connect location. The company wants to ensure high availability and failover capability. Which THREE steps should be taken?

Accepted Answer

Order at least two Direct Connect connections from different providers or locations.. Option B is correct because ordering at least two Direct Connect connections from different providers or locations provides physical and path diversity, which is essential for high availability and failover if one connection or location fails. Option C is correct because BGP sessions over each Direct Connect connection enable dynamic routing, automatic failover, and path selection between the on-premises network and AWS. Option D is correct because a Direct Connect gateway allows the company to connect its Direct Connect connections to multiple VPCs across regions while maintaining high availability and centralized routing. Option A is not selected because a VPN backup, while useful for redundancy, is not one of the three steps specifically required to ensure high availability and failover for the Direct Connect design described. Option E is not selected because multiple virtual interfaces on a single Direct Connect connection do not provide the physical redundancy needed for high availability and failover.

Answer

Configure a VPN connection as a backup in case Direct Connect fails.

Answer

Provision multiple virtual interfaces on a single Direct Connect connection.

Question 8

A solutions architect is designing a VPC with public and private subnets. The application in the private subnet needs to download patches from the internet. Which TWO options allow outbound internet access while keeping the EC2 instance in the private subnet without a public IP address?

Accepted Answer

Create a VPC endpoint for Amazon S3 and update the route table.. Option E is correct because a NAT Gateway deployed in a public subnet provides outbound-only internet access for instances in private subnets; the private subnet's route table must have a route for 0.0.0.0/0 pointing to the NAT Gateway, and the instance itself needs no public IP. Option C is correct because a VPC endpoint (specifically a gateway endpoint for Amazon S3, or an interface endpoint for other services) allows private connectivity to supported AWS services without traversing the internet, and the route table must be updated to direct traffic to the endpoint. Option A is wrong because assigning a public IP and using an Internet Gateway places the instance effectively in a public-facing configuration, violating the requirement to keep it private without a public IP. Option B is wrong because Direct Connect links to an on-premises data center, not the public internet, and does not by itself provide internet patch downloads. Option D is wrong because a VPN to a third-party proxy is not a native, standard AWS pattern for private-subnet internet egress and is unnecessary when NAT Gateway or VPC endpoints suffice.

Answer

Attach an Internet Gateway to the VPC and assign a public IP to the instance.

Answer

Set up a Direct Connect connection to an on-premises data center.

Answer

Establish a VPN connection to a third-party proxy service.

Question 9

A company is migrating a legacy application to AWS. The application uses multicast for service discovery. Which AWS service or feature can be used to support multicast traffic within a VPC?

Accepted Answer

AWS Transit Gateway with multicast domain. AWS Transit Gateway multicast domains (option B) is the only service that natively supports multicast traffic within a VPC. The other listed options do not support multicast: Direct Connect requires additional on-premises configuration and does not provide VPC-native multicast, VPC multicast groups are not a supported feature, Internet Gateway only handles unicast, and VPC Peering also only supports unicast. Therefore, the correct answer is B.

Answer

AWS Direct Connect with multicast

Answer

VPC multicast groups using network interfaces

Answer

Internet Gateway (IGW)

Answer

VPC Peering

Question 10

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application experiences intermittent timeouts during peak hours. The network team suspects that the security group or network ACL is misconfigured. They enable VPC Flow Logs and notice that outbound traffic from the ALB to the EC2 instances on port 8080 shows 'ACCEPT' records, but the ALB returns 504 errors. The ALB health check is configured to hit the EC2 instances on port 8080/health. What is the most likely cause of the 504 errors?

Accepted Answer

The ALB idle timeout is set too low, and the application takes longer to respond.. The VPC Flow Logs show ACCEPT for outbound traffic from the ALB to the EC2 instances on port 8080, which means the security group and NACL are permitting the traffic. A 504 Gateway Timeout from an ALB indicates that the ALB established a connection to the target but the target did not respond within the configured idle timeout. Since the health check is on port 8080/health and the application is experiencing intermittent timeouts during peak hours, the most likely cause is that the ALB idle timeout is too low for the application's response time under load.

Answer

The network ACL for the private subnet is blocking inbound traffic from the ALB.

Answer

The security group for the EC2 instances is missing an outbound rule to allow traffic from the ALB.

Answer

The health check path is incorrectly configured, causing the ALB to mark all targets as unhealthy.

Question 11

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have subnets with EC2 instances. The security groups allow all traffic between the instances. The instances in VPC A can ping the instances in VPC B, but cannot initiate TCP connections to a web server running on port 443 in VPC B. What is the most likely cause?

Accepted Answer

The security group for the web server in VPC B does not allow inbound traffic from VPC A on TCP port 443.. The most likely cause is that the security group for the web server in VPC B does not allow inbound traffic from VPC A on TCP port 443. Although ping (ICMP) works, TCP port 443 is blocked by the security group, which is stateful and must explicitly allow the traffic.

Answer

The VPC peering connection does not support TCP traffic.

Answer

The DNS resolution settings for the VPC peering are not enabled.

Answer

The network ACL in VPC B is blocking inbound TCP traffic on port 443.

Question 12

A company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The on-premises router advertises a specific route for a subnet (192.168.1.0/24) to the VPC via BGP. However, instances in the VPC cannot reach the 192.168.1.0/24 subnet. The VPC route table shows the route as 'active' and 'propagated' from the Direct Connect virtual interface. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route to the 192.168.1.0/24 subnet pointing to the virtual private gateway.. Even though the VPC route table shows the route as 'active' and 'propagated', this might be the main route table. If the instance's subnet is associated with a different route table that does not have a route to 192.168.1.0/24 pointing to the virtual private gateway, traffic will not be directed properly. The most likely cause is that the subnet's route table lacks this specific route. Option A is incorrect because security groups do not affect outbound traffic initiated by instances, and the issue is routing, not security. Option B is incorrect because overlapping CIDR would cause the route to not appear as active or propagated, contradicting the scenario. Option C is incorrect because BGP communities are not used for route propagation in Direct Connect private VIFs.

Answer

The security group for the VPC instances is blocking inbound traffic from the on-premises network.

Answer

The VPC has overlapping CIDR with the on-premises network.

Answer

The on-premises router is not advertising the correct BGP community.

Question 13

A company has a multi-VPC architecture connected via AWS Transit Gateway. They have VPCs in different AWS accounts. The network team wants to centralize internet traffic through a single egress VPC that has a NAT Gateway and an Internet Gateway. All other VPCs should route outbound internet traffic through the Transit Gateway to the egress VPC. They have configured route tables accordingly, but instances in non-egress VPCs cannot reach the internet. What is the most likely missing configuration?

Accepted Answer

The Transit Gateway route table does not have a route to the non-egress VPC attachments for the return traffic.. For traffic from non-egress VPCs to reach the internet, the Transit Gateway must have a route table that includes a route to the non-egress VPC attachments for the return traffic. Without this route, return traffic from the internet (via the egress VPC's NAT Gateway) cannot be forwarded back to the originating VPC through the Transit Gateway. The other options are incorrect: B is false because security groups are stateful, so inbound rules do not affect return traffic; C is false because the egress VPC needs a route to the Transit Gateway for outbound traffic, not return traffic; D is false because VPC endpoints are not used for general internet access.

Answer

The security group for the NAT Gateway in the egress VPC is blocking inbound traffic from other VPCs.

Answer

The egress VPC's route table does not have a route to the Transit Gateway for the return traffic from the internet.

Answer

The non-egress VPCs are using VPC endpoints instead of the Transit Gateway for internet access.

Question 14

An application running on EC2 instances in a VPC needs to access an Amazon S3 bucket to read configuration files. The VPC has an S3 VPC endpoint configured. The instances are in a private subnet and have a security group that allows all outbound traffic. The bucket policy allows access from the VPC endpoint. However, the application fails to access the S3 bucket. What is the most likely cause?

Accepted Answer

The VPC endpoint's route table does not include the subnet's route table, so traffic to S3 is not routed through the endpoint.. The most likely cause is that the VPC endpoint's route table does not include the subnet's route table, meaning traffic from the private subnet to S3 is not routed through the endpoint. Option B is correct because if the subnet's route table lacks a route for the S3 prefix list pointing to the VPC endpoint, traffic will go via a NAT gateway or internet gateway (if configured) or fail if no such connectivity exists. Option A is incorrect because network ACLs are not mentioned and typically allow outbound HTTPS. Option C is incorrect since the security group allows all outbound traffic. Option D is incorrect because the bucket policy already permits access from the VPC endpoint.

Answer

The network ACL for the private subnet is blocking outbound HTTPS traffic.

Answer

The security group for the EC2 instances has an outbound rule that blocks HTTPS traffic to S3.

Answer

The S3 bucket policy does not grant access to the VPC endpoint's ID.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create a subnet for a new application that requires at least 2000 usable IP addresses. Which subnet size should they choose?

Accepted Answer

/20 (4096 IPs). A /20 subnet provides 4096 total IP addresses, of which 4091 are usable in AWS (since AWS reserves 5 IPs per subnet). This meets the requirement of at least 2000 usable IP addresses. The next smaller size, /21, would provide 2048 total IPs and only 2043 usable, which is also sufficient, but /20 is the smallest option listed that meets the requirement.

Answer

/24 (256 IPs)

Answer

/22 (1024 IPs)

Answer

/19 (8192 IPs)