ANS-C01 Network Design Practice Test 18 — 15 Questions

Question 1

A large financial services company is migrating its on-premises data center to AWS. The network design must meet strict low-latency requirements for trading applications that communicate with external exchanges. The company has two AWS Direct Connect connections from two different providers to two different AWS Direct Connect locations in the same region. They have a VPC with multiple subnets across three Availability Zones. The trading applications are deployed on EC2 instances in private subnets and need to communicate with external exchanges over the Direct Connect connections. The company also requires high availability and automatic failover if one Direct Connect connection fails. The network team has configured two virtual interfaces (VIFs) for private connectivity to the VPC, one on each Direct Connect connection, and has set up BGP sessions. However, during a failover test, traffic does not fail over as expected. The team notices that the VPC route tables have static routes pointing to the virtual private gateway (VGW) with the same prefix, but no BGP routes are propagated. What is the most likely cause of the failover issue, and what should be done to resolve it?

Accepted Answer

The VPC route tables have static routes that are overriding the BGP routes. Remove the static routes and rely on BGP routes propagated through the VGW.. The failover issue occurs because static routes in the VPC route tables take precedence over BGP-propagated routes, even when the BGP session goes down. Since the static routes point to the virtual private gateway (VGW) with the same prefix, traffic continues to use the failed Direct Connect connection instead of failing over to the active one. Removing the static routes and enabling route propagation allows BGP to dynamically update the route tables based on the availability of the Direct Connect connections.

Answer

The VPC route tables do not have route propagation enabled for the VGW. Enable route propagation in the route tables.

Answer

The BGP timers are set too high, causing slow convergence. Reduce the BGP keepalive and hold timers.

Answer

The BGP configuration on the on-premises router is using AS_PATH prepending, making the backup path less preferred. Remove AS_PATH prepending.

Question 2

A company is designing a global application that will serve users across North America and Europe. The application consists of a static website hosted on Amazon S3, a REST API hosted on Amazon API Gateway, and a backend application running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The company wants to minimize latency for users by serving content from the closest AWS region. They also want to ensure high availability and automatic failover if a region becomes unavailable. The company is considering using Amazon Route 53 with a latency-based routing policy. However, they are concerned about DNS caching and propagation delays during failover. Which additional service should they use to improve the failover experience and provide a single endpoint for users?

Accepted Answer

Use AWS Global Accelerator to provide a static IP address and route traffic to the ALB in the closest healthy region. AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via the Anycast static IP addresses, bypassing DNS caching and propagation delays. It provides a single fixed endpoint for users and integrates with the ALB in each region, automatically failing over to the next healthy region within seconds when health checks fail.

Answer

Use a Network Load Balancer in each region and configure Route 53 with failover routing

Answer

Use Amazon CloudFront with multiple origins pointing to the S3 bucket and the ALB in each region

Answer

Use Lambda@Edge to dynamically route traffic based on the user's location

Question 3

A company is deploying a multi-tier web application in a VPC. The architecture includes an internet-facing Application Load Balancer (ALB) in public subnets, a fleet of EC2 instances in private subnets, and an Amazon RDS database in a separate private subnet. The security team requires that the web application logs be stored in an Amazon S3 bucket for compliance. The EC2 instances have an instance profile that grants write access to the S3 bucket. The EC2 instances are in a private subnet that does not have a route to the internet. The company wants to ensure that the EC2 instances can upload logs to the S3 bucket without traversing the internet. Which solution should they implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet's route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 over the AWS network without traversing the internet. Since the instances have an instance profile granting write access, adding a route in the private subnet's route table pointing to the gateway endpoint enables direct, private connectivity to S3. This meets the security requirement of keeping traffic within the AWS backbone.

Answer

Create a VPC Interface Endpoint for S3

Answer

Deploy a forward proxy server in a public subnet and configure the EC2 instances to use it

Answer

Attach a NAT Gateway to the private subnet and configure a route to the NAT Gateway

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Accepted Answer

Create a DB subnet group with subnets in two Availability Zones, launch the RDS instance with Multi-AZ enabled, and configure the application to connect to the RDS endpoint DNS name. Option D is correct because creating a DB subnet group with subnets in two Availability Zones and enabling Multi-AZ on the RDS instance ensures automatic failover to a standby in another AZ. The application connects to the RDS endpoint DNS name, which automatically points to the current primary instance, so no application changes are needed during failover. This satisfies the high availability and access requirements while keeping the database in private subnets.

Answer

Place the RDS instances behind an internal Network Load Balancer and configure the application to connect to the NLB's DNS name

Answer

Create the RDS instance in the public subnet and restrict access using a security group that allows traffic from the private subnet

Answer

Configure the application to use the IP address of the primary RDS instance and update the application when failover occurs

Question 5

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit. AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Answer

Use an Application Load Balancer for each service and configure HTTPS listeners

Answer

Use VPC peering between each service's VPC

Answer

Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer

Question 6

A company is expanding its on-premises network to AWS using Direct Connect and VPN backup. They have two Direct Connect connections from different providers to two different Direct Connect locations in the same region. They have configured a private virtual interface (VIF) on each connection to a virtual private gateway (VGW) attached to a VPC. They have also configured a VPN connection as a backup. The company uses BGP to advertise the on-premises prefixes to AWS. They want to ensure that traffic is load-balanced across both Direct Connect connections under normal conditions and that the VPN is used only if both Direct Connect connections fail. They also want to minimize the cost of data transfer. Which BGP configuration should they use?

Accepted Answer

Advertise the same prefixes over both Direct Connect connections with equal local preference, and prepend AS path on the VPN routes to make them less preferred. Option D is correct. By using BGP with equal local preference for both Direct Connect paths and AS_PATH prepending on the VPN routes, the VPN will be less preferred. To achieve active/active load balancing across Direct Connect connections, the company should advertise the same prefixes with equal MED or local preference. Option A is wrong because advertising different prefixes would not load-balance traffic. Option B is wrong because a single BGP session over one Direct Connect connection creates a single point of failure. Option C is wrong because increasing MED on one Direct Connect connection makes it less preferred, not equal.

Answer

Configure a single BGP session over both Direct Connect connections using the same virtual interface

Answer

Set a higher MED on one of the Direct Connect connections to make it the primary, and use the VPN as secondary

Answer

Advertise different on-premises prefixes over each Direct Connect connection and use the VPN for all traffic

Question 7

A company has a VPC with a CIDR block of 172.16.0.0/16. They have a public subnet (172.16.1.0/24) and a private subnet (172.16.2.0/24). They have an internet gateway attached to the public subnet. They launch an EC2 instance in the public subnet with a public IP address. The instance is running a web server on port 80. They also launch an EC2 instance in the private subnet that needs to download updates from the internet. The private subnet does not have a route to the internet. The company wants to provide internet access to the private instance in a secure and cost-effective manner. Which solution should they implement?

Accepted Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT Gateway. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for downloading updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is secure because the NAT Gateway uses Elastic IPs and does not accept unsolicited inbound traffic, and it is cost-effective as it is a managed service with no maintenance overhead.

Answer

Create a VPC Gateway Endpoint for S3 and configure the private instance to use it

Answer

Create a forward proxy server in the public subnet and configure the private instance to use it

Answer

Create a NAT instance in the public subnet and configure the private instance to use it

Question 8

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have an internet gateway attached to the public subnet. They deploy a web server on an EC2 instance in the public subnet and a database on an EC2 instance in the private subnet. The database should only be accessible from the web server. The company wants to secure the database by not assigning a public IP address to it. Which configuration will allow the web server to connect to the database?

Accepted Answer

Keep the database instance in the private subnet with no public IP, and configure the security group of the database to allow inbound traffic from the web server's security group on the database port. Option C is correct because security groups in AWS can reference other security groups as a source, allowing traffic from any instance associated with the source security group. By configuring the database's security group to allow inbound traffic on the database port from the web server's security group, the web server can connect to the database without the database needing a public IP address. This leverages AWS's built-in security group chaining, which works across subnets within the same VPC.

Answer

Create a VPC Peering connection between the public and private subnets

Answer

Assign a public IP address to the database instance and configure the security group to allow inbound traffic from the web server's public IP

Answer

Set up a VPN connection between the web server and the database

Question 9

A company has a VPC with a CIDR block of 192.168.0.0/16. They have two subnets: Subnet A (192.168.1.0/24) and Subnet B (192.168.2.0/24). They launch an EC2 instance in Subnet A and another EC2 instance in Subnet B. They want to ensure that both instances can communicate with each other. The instances are in the same VPC. What is the simplest way to enable communication between these instances?

Accepted Answer

No additional configuration is needed; instances in the same VPC can communicate by default. By default, all instances within the same VPC can communicate with each other using private IP addresses, regardless of which subnet they reside in. The VPC's implicit router enables this layer-3 connectivity as long as the subnets' route tables do not explicitly block traffic and the instances' security groups or network ACLs permit the traffic. Since both subnets are within the same VPC (192.168.0.0/16), no additional configuration is required for basic IP-level communication.

Answer

Create a VPC Peering connection between Subnet A and Subnet B

Answer

Create a NAT Gateway in each subnet

Answer

Attach an internet gateway to the VPC

Question 10

A company is designing a network for a real-time trading application that requires extremely low latency (sub-millisecond) between two EC2 instances located in the same AWS region. The instances are in different Availability Zones. The trading application uses a proprietary protocol over TCP. The company wants to minimize latency as much as possible. They are considering using a placement group. Which type of placement group should they use, and what network optimization should they apply?

Accepted Answer

Use a cluster placement group for both instances and enable enhanced networking (SR-IOV). A cluster placement group is the only placement group type that provides low-latency, high-bandwidth network performance by placing instances in a single Availability Zone within the same rack. Enhanced networking using SR-IOV (Single Root I/O Virtualization) bypasses the hypervisor's network stack, reducing per-packet processing latency and jitter, which is critical for sub-millisecond trading traffic over TCP.

Answer

Use a spread placement group and enable dedicated tenancy

Answer

Use a partition placement group and enable EBS-optimized instances

Answer

Use a cluster placement group but launch instances in different Availability Zones

Question 11

A company wants to design a multi-region active-active architecture with Amazon Route 53 latency-based routing and failover using health checks. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Configure a latency alias record for each region's resource. Option C is correct because latency-based routing in Route 53 uses alias records to route traffic based on the lowest latency for the end user. Configuring a latency alias record for each regional resource (e.g., an Application Load Balancer) allows Route 53 to respond with the IP of the resource that provides the best latency. Option D is correct because health checks must be associated with each latency record to enable failover; if a resource fails its health check, Route 53 removes it from the pool of healthy endpoints, ensuring traffic is only routed to healthy regions.

Answer

Use geolocation routing to direct users to the nearest region

Answer

Assign a weight to each record for traffic distribution

Answer

Set the failover record type to 'Active-Active'

Question 12

A network engineer is designing a hybrid network with AWS Direct Connect and VPN backup. The goal is to maximize availability and ensure automatic failover. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Configure BGP community tags to influence route preference. Option C is correct because BGP community tags allow you to influence route preference on the AWS side by tagging routes from Direct Connect with a community that reduces their local preference (e.g., 7224:7100 for lower preference) or from VPN with a community that increases preference. This enables automatic failover by ensuring Direct Connect routes are preferred over VPN routes when both are available, and VPN routes take over when Direct Connect fails.

Answer

Set VPN BGP hold timer to a higher value than Direct Connect

Answer

Enable BGP as-prepending on the Direct Connect virtual interface

Question 13

A media company is designing a network for a new AWS environment. They have a VPC with public and private subnets in three Availability Zones. In the private subnets, they run a fleet of Amazon EC2 instances that process video files from an Amazon S3 bucket. The S3 bucket is in the same region. The company wants to ensure that all traffic to S3 stays within the AWS network and does not traverse the internet. They also need to allow the EC2 instances to access the internet for software updates, but only through a centralized NAT gateway. Currently, there is one NAT gateway in AZ1. The network engineer has created a VPC endpoint for S3 (Gateway type) and associated it with the route tables for the private subnets. However, the EC2 instances in AZ2 and AZ3 cannot reach the NAT gateway for internet access. What is the most likely cause?

Accepted Answer

The route table for private subnets now has a more specific route for S3 that overrides the default route to the NAT gateway. Option B is correct. The Gateway VPC Endpoint for S3 adds a route in the private subnet route tables that points 0.0.0.0/0 to the endpoint, which overrides the default route to the NAT gateway. This prevents traffic destined for the internet from reaching the NAT gateway. Option A is wrong because the VPC endpoint is in the same region and works across AZs. Option C is wrong because the NAT gateway is in AZ1, but instances in other AZs can still route to it if the route table has a 0.0.0.0/0 route pointing to the NAT gateway. Option D is wrong because the S3 endpoint does not need to be in every AZ; Gateway endpoints are regional.

Answer

The VPC endpoint needs to be created in each Availability Zone

Answer

The NAT gateway is only available in the AZ where it is deployed

Answer

The S3 VPC endpoint is only accessible from the AZ where it was created

Question 14

A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?

Accepted Answer

The Transit Gateway route tables allow direct communication between application VPCs. Option C is correct. For east-west traffic to be inspected, the Transit Gateway must route traffic from one VPC to the inspection VPC, then to the destination VPC. This requires that the route tables in the Transit Gateway are configured so that traffic between VPCs is forced through the inspection VPC. If the application VPCs have a direct route to each other via the Transit Gateway (e.g., a static route or a route in the same route table), traffic will not go through the inspection VPC. The most common cause is that the Transit Gateway route table association allows direct VPC-to-VPC routing. Option A is wrong because Network Firewall can inspect traffic at scale. Option B is wrong because Network Firewall is stateful and can handle return traffic. Option D is wrong because the inspection VPC can have multiple subnets for different traffic types.

Answer

The inspection VPC does not have a subnet for east-west traffic

Answer

Network Firewall cannot inspect traffic between VPCs at high throughput

Answer

Network Firewall is not stateful and cannot handle return traffic

Question 15

A startup wants to design a cost-effective network for a new application. They expect low traffic initially but need to handle sudden spikes. They plan to use Amazon EC2 instances behind an Application Load Balancer (ALB) in a single VPC. The application must be highly available within the region. The network engineer has proposed using two public subnets in two Availability Zones for the ALB, and two private subnets for the EC2 instances. The EC2 instances need to access the internet for updates. What is the MOST cost-effective and highly available design?

Accepted Answer

Use a NAT gateway in each public subnet (one per AZ). Option C is correct. A NAT gateway in each AZ provides high availability and is managed, reducing operational overhead. Option A is wrong because a NAT instance in one AZ is a single point of failure. Option B is wrong because a single NAT gateway is a single point of failure. Option D is wrong because although a NAT instance in each AZ is highly available, it requires more management than NAT gateways.

Answer

Use a single NAT instance in one public subnet

Answer

Use a NAT instance in each public subnet (one per AZ)

Answer

Use a single NAT gateway in one public subnet