ANS-C01 Network Design Practice Test 18 — 15 Questions

Question 1

A company uses AWS Direct Connect with a private VIF and a virtual private gateway (VGW) to connect its on-premises data center to a VPC. The on-premises network uses BGP to advertise routes to AWS. The VPC has multiple subnets. The company wants to ensure that only traffic destined for the VPC CIDR (10.0.0.0/16) is sent over Direct Connect, and all other traffic uses the internet. However, after configuration, on-premises users can access the internet through the Direct Connect link, which is unintended. What change should be made to restrict traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.. The unintended internet access occurs because the on-premises router is accepting a default route (0.0.0.0/0) advertised from AWS over the private VIF, typically via the VGW's route propagation. Restricting the on-premises router to accept only the VPC CIDR (10.0.0.0/16) from AWS prevents on-premises traffic from being steered into the Direct Connect link for non-VPC destinations, forcing internet-bound traffic out the local internet circuit.

Answer

Add a static route in the VPC route table to send all traffic to the internet gateway.

Answer

Disable route propagation for the private subnet route table.

Answer

Remove the virtual private gateway and use a VPN connection instead.

Question 2

A large e-commerce company is redesigning its global network architecture. They have three VPCs in us-east-1: production (10.0.0.0/16), staging (10.1.0.0/16), and development (10.2.0.0/16). They also have two VPCs in eu-west-1: production (10.10.0.0/16) and staging (10.11.0.0/16). All VPCs are connected via a Transit Gateway with inter-region peering. The company wants to allow the staging VPCs in both regions to communicate with each other for data replication, but no other cross-region traffic should be allowed. Additionally, the production VPC in us-east-1 must be able to send traffic to the production VPC in eu-west-1 for a disaster recovery pilot. The security team has configured Network ACLs and security groups appropriately. However, after implementation, the staging VPCs can communicate, but the production VPCs cannot. A network engineer checks the Transit Gateway route tables and finds that both production VPC attachments are associated with the same route table, which has a static route for the 10.0.0.0/16 and 10.10.0.0/16 prefixes. What is the MOST likely reason for the failure?

Accepted Answer

The production VPCs are attached to the same Transit Gateway route table, causing asymmetric routing. Transit Gateway route tables propagate routes from VPC attachments. If both production VPCs are in the same route table, the routes for their CIDRs will be propagated. However, if there is a propagated route for the local VPC, it may override the static route or cause a conflict. The issue is likely that the static routes are being ignored because a more specific or conflicting propagated route exists, or the route table lacks a route for the remote production CIDR if the attachment is not associated correctly. Actually, the most common issue is that the production VPC attachments are in the same route table, but the static route for the remote production CIDR might be pointing to the VPC attachment itself, causing a loop. But the key point: Transit Gateway route tables do not allow overlapping CIDRs. Since both production VPCs have overlapping CIDRs (10.0.0.0/16 and 10.10.0.0/16 are different), that's not the issue. The issue is likely that the route table has a static route for the remote production CIDR, but the propagation from the local production VPC attachment might be creating a route that is not correct. The best answer is that the production VPC attachments need to be in separate route tables to avoid conflicting routes.

Answer

The security groups in the production VPCs are blocking the traffic

Answer

The production VPCs have overlapping CIDR ranges, causing a routing conflict

Answer

The Transit Gateway route table for the production VPCs does not have a route for the remote production CIDR

Question 3

A company is deploying a new application on AWS and needs a highly available architecture across two Availability Zones (AZs) in a single region. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances running in an Auto Scaling group, and an Amazon RDS for MySQL database with Multi-AZ deployment. The company requires that the application remain available even if an entire AZ fails. The network team has designed the VPC with two public subnets and two private subnets, each in a different AZ. The ALB is internet-facing and placed in the public subnets. The EC2 instances are in the private subnets. The RDS instance is also in the private subnets. The route tables are configured with a default route via an Internet Gateway for public subnets and via a NAT Gateway for private subnets. What change is MOST likely needed to ensure the architecture can survive an AZ failure?

Accepted Answer

Create a NAT Gateway in each Availability Zone. The architecture uses a NAT Gateway for private subnets to allow outbound internet access. If the NAT Gateway is only in one AZ, and that AZ fails, the private subnets in the other AZ will lose outbound connectivity. To survive an AZ failure, a NAT Gateway must be deployed in each AZ, and route tables for private subnets should point to the NAT Gateway in the same AZ. This ensures that if one AZ fails, the other AZ's private subnets still have outbound access.

Answer

Add a second Internet Gateway in the other AZ

Answer

Use a Network Load Balancer instead of an Application Load Balancer

Answer

Configure the Auto Scaling group to launch instances in both AZs

Question 4

A media company is designing a global streaming platform using AWS. They have a primary workload in us-east-1 (VPC A, 10.0.0.0/16) and a secondary workload in eu-west-1 (VPC B, 10.1.0.0/16). They need to replicate data between these VPCs with low latency and high throughput, and also allow their on-premises data center (10.2.0.0/16) in us-east-2 to communicate with both VPCs. The on-premises network is connected to AWS via two Direct Connect connections terminating in us-east-1 and eu-west-1. The company uses a Transit Gateway in each region, with inter-region peering between the Transit Gateways. The on-premises network has BGP advertisements for 10.2.0.0/16. The routing is set up such that the on-premises network can reach both VPCs via the Direct Connect connections. However, the VPCs cannot reach each other's CIDRs. The network engineer checks the Transit Gateway route tables and sees that the inter-region peering attachment is associated with the appropriate route tables, and static routes for the remote VPC CIDRs are present. What is the MOST likely cause of the problem?

Accepted Answer

The static routes for the remote VPC CIDRs are pointing to the Direct Connect attachment instead of the inter-region peering attachment. For inter-region Transit Gateway peering to route traffic between VPCs, the static routes for the remote VPC CIDRs must point to the inter-region peering attachment (tgw-attach-xxxx for peering), not to the Direct Connect attachment. If those static routes point to the DX attachment, the TGW will forward VPC-to-VPC traffic toward the on-premises network, which has no route back to the remote VPC CIDR, causing blackholing. The scenario confirms the peering attachment is associated and static routes exist, so the misdirected next-hop is the most likely cause.

Answer

The inter-region peering attachment is not in the same route table as the VPC attachments

Answer

The VPC CIDRs overlap with each other

Answer

The on-premises network is advertising a default route that is being preferred

Question 5

A company is designing a hybrid network architecture using AWS Direct Connect. They have a single Direct Connect connection with a private virtual interface (VIF) to a VPC in us-east-1. The on-premises network uses BGP to advertise a prefix (10.0.0.0/8) to AWS. The VPC has a CIDR of 10.1.0.0/16. The company wants to add a second VPC (10.2.0.0/16) in the same region and allow on-premises to communicate with both VPCs. They plan to use a Transit Gateway to connect the VPCs and the Direct Connect gateway. The Direct Connect gateway is associated with the Transit Gateway. The on-premises router is advertising 10.0.0.0/8. After configuration, the on-premises network can communicate with 10.1.0.0/16 but not with 10.2.0.0/16. The network engineer verifies that the Transit Gateway route table has routes for both VPC attachments and that the Direct Connect gateway is associated with the Transit Gateway. What is the MOST likely issue?

Accepted Answer

The Direct Connect gateway is not associated with the Transit Gateway route table that contains the 10.2.0.0/16 route. When using a Direct Connect gateway with a Transit Gateway, the Direct Connect gateway propagates routes to the Transit Gateway. The Transit Gateway route table must have a route for the on-premises prefix (10.0.0.0/8) pointing to the Direct Connect gateway attachment. Also, the Transit Gateway must propagate the VPC CIDRs to the Direct Connect gateway so that on-premises can learn them. The issue is likely that the 10.2.0.0/16 route is not being propagated to the Direct Connect gateway. This can happen if the Transit Gateway route table does not have the VPC attachment associated or if the route propagation is disabled for that VPC attachment. The engineer verified routes in the Transit Gateway route table, so the issue might be that the Direct Connect gateway is not receiving the route for 10.2.0.0/16. Typically, the Transit Gateway automatically propagates routes from attachments to the Direct Connect gateway if the route table is associated. However, if the VPC attachment is not associated with the same route table as the Direct Connect gateway attachment, propagation may not happen. The most likely fix is to ensure that both VPC attachments and the Direct Connect gateway attachment are in the same Transit Gateway route table.

Answer

The Transit Gateway route table does not have a route for 10.2.0.0/16

Answer

The private virtual interface is not configured to support multiple VPCs

Answer

The on-premises router is not advertising the 10.2.0.0/16 prefix

Question 6

A company is migrating its on-premises data center to AWS. As part of the migration, they need to establish connectivity between their on-premises network (10.0.0.0/8) and multiple VPCs in a single region. They are using AWS Transit Gateway with a Direct Connect gateway. They have two Direct Connect connections, each with a private virtual interface (VIF) to the Direct Connect gateway. The on-premises routers are configured with BGP and are advertising 10.0.0.0/8. The Transit Gateway has three VPC attachments: VPC1 (10.1.0.0/16), VPC2 (10.2.0.0/16), and VPC3 (10.3.0.0/16). All VPC attachments are in the same Transit Gateway route table, which also includes the Direct Connect gateway attachment. Initially, all VPCs can communicate with on-premises. After a maintenance window, the network team adds a new on-premises subnet (10.4.0.0/16) and updates the BGP advertisement to include 10.4.0.0/16. However, after the change, instances in VPC3 can no longer reach on-premises resources in any subnet, while VPC1 and VPC2 can still communicate with all on-premises subnets including the new one. The network engineer checks the Transit Gateway route table and sees that the route for 10.0.0.0/8 is present, pointing to the Direct Connect gateway attachment. What is the MOST likely cause of the issue?

Accepted Answer

The VPC3 subnet route tables have a static route for 10.0.0.0/8 that points to a non-existent or unavailable target. The issue is specific to VPC3. Since the route table has a route for 10.0.0.0/8, all VPCs should be able to reach on-premises. However, if VPC3 has a more specific route that conflicts, it might cause issues. But the most common cause is that the VPC3 route table (in the VPC itself) might have a local route or a VPN route that is more specific and overriding the Transit Gateway route. Alternatively, the Transit Gateway route table might have a specific route for VPC3 that is misconfigured. However, the description says the Transit Gateway route table has the correct route. The issue could be that VPC3's subnet route tables have a route for the on-premises CIDR pointing to a different target (like a VPN connection) that is now inactive or incorrect. But the question says after adding the new subnet, VPC3 lost connectivity entirely. Perhaps the BGP update caused a route flap or a prefix limit was exceeded on the Direct Connect gateway, but that would affect all VPCs. Since only VPC3 is affected, it's likely a VPC-specific issue. The most plausible is that the VPC3's route tables have a static route for the on-premises CIDR that was manually added and is now incorrect or conflicting. However, the best answer among the options is that the Transit Gateway route table has a blackhole route for 10.4.0.0/16, but that wouldn't affect all on-premises subnets. Let's think: The Direct Connect gateway might have a prefix limit that was exceeded when adding 10.4.0.0/16, causing the BGP session to drop, but that would affect all VPCs. The most likely single-VPC issue is that VPC3's route tables have a route for the on-premises CIDR pointing to an incorrect attachment, like a peering connection or VPN that is not working. But the options given might include such a scenario. I'll go with: The VPC3 route tables have a static route for 10.0.0.0/8 pointing to a network interface that no longer exists.

Answer

The BGP advertisement for 10.4.0.0/16 exceeded the allowed prefix limit on the Direct Connect gateway

Answer

The Direct Connect gateway is not propagating routes to the Transit Gateway for VPC3

Answer

The Transit Gateway route table has a route for 10.4.0.0/16 that is blackholed

Question 7

A company is designing a network architecture for a two-tier web application. The web tier runs on EC2 instances behind an Application Load Balancer (ALB) in public subnets. The application tier runs on EC2 instances in private subnets. The application tier needs to access an Amazon RDS for PostgreSQL database in the same private subnets. The company requires that all traffic between the ALB and web tier, as well as between web tier and application tier, remain within the AWS network and not traverse the internet. The current design uses an Internet Gateway (IGW) for public subnet internet access and a NAT Gateway for private subnet outbound internet access. The web tier instances have a default route to the IGW, and the application tier instances have a default route to the NAT Gateway. The security groups are configured correctly. However, the application tier cannot connect to the RDS database. What is the MOST likely cause?

Accepted Answer

The application tier instances are using the RDS public DNS name instead of the private DNS name. The most likely cause is that the application tier instances are using the RDS public DNS name instead of the private DNS name. When an EC2 instance in a private subnet resolves the public DNS name of an RDS instance in the same VPC, it resolves to the public IP address, which requires internet access via NAT Gateway. However, the NAT Gateway only allows outbound internet traffic, and the RDS security group likely does not allow inbound traffic from the NAT Gateway's public IP. Using the private DNS name resolves to the private IP, allowing direct communication within the VPC.

Answer

The RDS database is in a different VPC

Answer

The ALB is not configured to forward traffic to the web tier

Answer

The NAT Gateway is not configured with the correct route to the RDS subnet

Question 8

A global company is designing a multi-region architecture with VPCs in us-east-1, eu-west-1, and ap-southeast-1. They are using AWS Transit Gateway with inter-region peering between all three regions. The company also has on-premises data centers in the US and Europe connected via Direct Connect to the Transit Gateways in us-east-1 and eu-west-1 respectively. The on-premises networks use BGP to advertise their CIDRs (10.0.0.0/8 for US, 172.16.0.0/12 for Europe). The Transit Gateway route tables are configured to propagate routes from all attachments. The company needs all VPCs and on-premises networks to be able to communicate with each other. After configuration, the VPC in ap-southeast-1 can communicate with the VPCs in us-east-1 and eu-west-1, but cannot communicate with either on-premises network. The VPCs in us-east-1 and eu-west-1 can communicate with all on-premises networks. What is the MOST likely cause of this issue?

Accepted Answer

The inter-region peering attachments in ap-southeast-1 do not have route propagation enabled. For the ap-southeast-1 VPC to reach the on-premises networks, its Transit Gateway must have routes to the on-premises CIDRs. Those routes are learned via the inter-region peering attachments from us-east-1 and eu-west-1, where the Direct Connect attachments advertise 10.0.0.0/8 and 172.16.0.0/12. If route propagation is not enabled on the inter-region peering attachments in ap-southeast-1's TGW route table, the on-premises CIDRs never appear in that route table, so traffic from ap-southeast-1 to on-premises is dropped. The fact that VPC-to-VPC connectivity works confirms the peering itself is up, isolating the issue to route propagation.

Answer

The VPC in ap-southeast-1 has a security group that blocks traffic from on-premises IP ranges

Answer

The on-premises networks are not advertising their CIDRs to the ap-southeast-1 region

Answer

The Direct Connect gateways are not attached to the Transit Gateways in us-east-1 and eu-west-1

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16 and a subnet 10.0.1.0/24. They need to assign a private IP address to an EC2 instance that will be used for a critical database. The company wants to ensure the IP address is static and does not change even if the instance is stopped and started. Which method should they use?

Accepted Answer

Manually assign a specific private IP address when launching the instance.. To ensure a static private IP address for an EC2 instance, you can manually assign a specific private IP from the subnet's CIDR during instance launch. This IP is associated with the primary elastic network interface (ENI) and persists across stop/start cycles as long as the ENI remains attached. Other methods like Elastic IPs are for public addresses, and secondary IPs do not address the primary IP's persistence.

Answer

Assign an Elastic IP address to the instance.

Answer

Specify a secondary private IP address from the subnet and associate it with the instance.

Answer

Use a NAT gateway to assign a static private IP to the instance.

Question 10

A company runs a UDP-based telemetry collection service in a VPC in us-east-1. The service must receive packets from thousands of external devices, each sending to a single destination IP and port. The company wants a single static public IPv4 address, must avoid connection tracking limits, and requires the lowest possible latency. Which solution meets these requirements MOST cost-effectively?

Accepted Answer

Network Load Balancer (NLB) with a UDP listener and one Elastic IP per enabled Availability Zone. A Network Load Balancer is the only AWS load balancer that natively supports UDP listeners at Layer 4. It preserves source IP, avoids connection tracking for UDP, and can be assigned one Elastic IP per enabled Availability Zone, giving the required static public IPv4 address. Performance and scale characteristics make it the correct fit for high-volume telemetry.

Answer

Gateway Load Balancer (GWLB) with a UDP listener and a Gateway Load Balancer endpoint in each subnet

Answer

Application Load Balancer (ALB) with a UDP listener and a static IP through AWS Global Accelerator

Answer

Classic Load Balancer with a TCP listener and proxy protocol enabled

Question 11

A financial services company runs a latency-sensitive trading platform on Amazon EC2 instances distributed across three Availability Zones in a single VPC. The instances must exchange market data with each other at the lowest possible network latency and highest throughput. The company does not want to manage a separate overlay network or encryption layer. Which VPC configuration should a network engineer implement to meet these requirements?

Accepted Answer

Enable Elastic Network Adapter (ENA) Express on the instances and place them in a cluster placement group within a single subnet that spans the three Availability Zones.. ENA Express raises single-flow bandwidth and lowers tail latency for supported instance types, while a cluster placement group places instances on closely packed hardware to minimize network distance. Together they deliver the lowest-latency, highest-throughput communication for a latency-sensitive workload without requiring an overlay network or encryption layer that the company wants to avoid.

Answer

Deploy a third-party SD-WAN virtual appliance in each Availability Zone and route all instance traffic through the appliances.

Answer

Create a transit gateway with a dedicated VPC attachment and enable appliance mode on the attachment to route traffic between the instances.

Answer

Attach an Elastic Fabric Adapter (EFA) to every instance and enable EFA-only mode on the elastic network interfaces.

Question 12

A financial services company runs a latency-sensitive trading application on EC2 instances spread across three Availability Zones in a single VPC. The application uses a proprietary UDP protocol for market data distribution, and all instances must receive every packet with minimal jitter. The company wants to minimize cross-AZ data transfer costs while maintaining the multicast-like behavior. Which AWS feature should they use?

Accepted Answer

AWS Transit Gateway multicast. The trading application requires one-to-many UDP delivery, which is multicast behavior. AWS Transit Gateway multicast is the only native AWS service that supports multicast domains, IGMPv2, and static group membership within a VPC and across AZs. It avoids per-receiver unicast replication and reduces cross-AZ traffic by sending a single stream that is replicated only where needed, meeting the low-jitter requirement.

Answer

Network Load Balancer with UDP support

Answer

VPC peering with jumbo frames enabled

Answer

AWS Global Accelerator with UDP listener

Question 13

A retail company runs a three-tier web application across three Availability Zones in one VPC. The web tier sits in public subnets behind an Application Load Balancer, the application tier sits in private subnets, and the database tier sits in isolated subnets with no route to a NAT gateway. The security team requires that the application tier initiate connections to the database tier, but the database tier must never initiate connections back to the application tier. Which combination of controls should the network engineer implement to enforce this requirement?

Accepted Answer

Apply a security group on the database instances that allows inbound traffic only from the application tier security group, and use network ACLs on the isolated subnets to block outbound traffic from the database tier.. Enforcing one-way initiation requires a stateful control that permits the allowed inbound connections and a stateless control that blocks outbound initiation. A security group referencing the application tier's security group handles the permitted inbound flow, while network ACLs on the isolated subnets block outbound traffic from the database tier. The other options either rely on default permissive behavior, add unnecessary rules that allow the forbidden direction, or misapply stateless ACL semantics.

Answer

Apply a security group on the application tier that allows outbound to the database tier, and rely on the default security group behavior on the database tier.

Answer

Apply a security group on the database instances that allows inbound traffic from the application tier, and apply a security group on the application tier that allows inbound from the database tier.

Answer

Use network ACLs on both the application and database subnets to allow only the specific database port in one direction.

Question 14

A financial services company operates a VPC with CIDR 10.0.0.0/16. They have a central VPC (10.0.0.0/16) that hosts shared services and two spoke VPCs: VPC-A (10.1.0.0/16) and VPC-B (10.2.0.0/16). Both spokes are attached to the central VPC using AWS Transit Gateway. The company requires that traffic from VPC-A to VPC-B must be inspected by a security appliance in the central VPC before reaching VPC-B. The security appliance is deployed in a subnet in the central VPC with IP 10.0.1.10. Which solution will meet these requirements?

Accepted Answer

Create a transit gateway route table for the central VPC and associate the VPC-A and VPC-B attachments. Add a route in the central VPC route table for 10.2.0.0/16 pointing to the security appliance ENI. In VPC-A's route table, add a route for 10.2.0.0/16 pointing to the transit gateway.. To inspect traffic between VPC-A and VPC-B, the security appliance must be in the forwarding path. A separate transit gateway route table for the central VPC allows association of both spoke attachments, and a route to the appliance ENI ensures traffic is sent there. The appliance then forwards to VPC-B. The spoke VPC route table directs traffic to the transit gateway. This design achieves centralized inspection without using public internet or unsupported transitive peering.

Answer

Attach an internet gateway to the central VPC and configure the security appliance to perform NAT. Create a route in VPC-A's route table for 10.2.0.0/16 pointing to the transit gateway. In the central VPC, create a route for 10.2.0.0/16 pointing to the internet gateway.

Answer

Use AWS PrivateLink to create an endpoint service in the central VPC for the security appliance. Create interface VPC endpoints in VPC-A and VPC-B. Update route tables to point to the endpoint ENIs.

Answer

Configure VPC peering between VPC-A and VPC-B, and between each spoke and the central VPC. In VPC-A's route table, add a route for 10.2.0.0/16 pointing to the VPC peering connection. In the central VPC, add a route for 10.2.0.0/16 pointing to the security appliance.

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new subnet that will host a large number of EC2 instances and must support at least 500 private IP addresses. The subnet should be in an Availability Zone that currently has no subnets. Which subnet CIDR block should they use?

Accepted Answer

10.0.2.0/23. A /23 subnet provides 512 total IP addresses, and after AWS reserves five, 507 are usable, which meets the requirement of at least 500. A /24 only provides 251 usable, which is insufficient. A /22 provides more than needed and wastes IP space. The /23 is the smallest subnet that satisfies the requirement.

Answer

10.0.4.0/22

Answer

10.0.0.0/23

Answer

10.0.1.0/24