ANS-C01 Network Design Practice Test 18 — 15 Questions

Question 1

A company has multiple VPCs in the same AWS region that need to communicate with each other. The network team wants to minimize the number of connections and simplify management. The solution must support transitive routing between all VPCs. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (TGW) is a network transit hub that enables transitive routing between multiple VPCs and on-premises networks through a single gateway. It uses a hub-and-spoke architecture, which inherently supports transitive routing (e.g., VPC A can reach VPC C via the TGW without requiring direct peering between A and C). This minimizes the number of connections (N VPCs require only N attachments instead of N*(N-1)/2 VPC peering connections) and simplifies management with a central routing table.

Answer

VPC Peering

Answer

AWS Direct Connect Gateway

Answer

VPC Endpoints

Question 2

A company wants to provide its employees with secure access to internal applications hosted in a VPC. The employees work remotely and use personal laptops. The solution must authenticate users against the company's existing identity provider (IdP) and must support both Windows and macOS clients. Which AWS service should be used?

Accepted Answer

AWS Client VPN. AWS Client VPN is a fully managed, cloud-based VPN solution that allows remote employees to securely access resources in a VPC using their personal laptops. It supports both Windows and macOS clients natively and can integrate with the company's existing identity provider (IdP) via SAML-based authentication, meeting all stated requirements.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Question 3

A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Place the web servers in a public subnet and the application and database servers in private subnets. The correct answers are C and D. Option C: Placing web servers in a public subnet (with an internet gateway) enables internet access, while placing application and database servers in private subnets prevents direct internet access, ensuring they are only reachable from within the VPC. Option D: Security groups act as stateful firewalls at the instance level, allowing fine-grained control over traffic between tiers (e.g., allowing only HTTP from web to app servers, and only database port from app to database servers). Option A is incorrect because a NAT gateway provides outbound internet access for private instances, not inbound access for web servers. Option B is incorrect because network ACLs are stateless and less granular; while they can restrict traffic between subnets, security groups are the recommended approach for tier-to-tier access control. Option E is incorrect because placing all servers in public subnets exposes application and database servers to the internet unnecessarily, increasing security risk.

Answer

Use a NAT gateway to allow the web servers to access the internet

Answer

Use network ACLs to restrict traffic between the tiers

Answer

Place all servers in public subnets and use security groups to restrict traffic

Question 4

A company has a VPC with public and private subnets. The public subnet contains a NAT gateway and a bastion host. The private subnet contains application servers. The company wants to ensure that the application servers can download patches from the internet. Which TWO steps should be taken to allow this while maintaining security? (Choose two.)

Accepted Answer

Allow outbound HTTPS (port 443) traffic from the application servers in the security group. The application servers need to initiate outbound HTTPS connections (port 443) to download patches from the internet. By allowing outbound HTTPS traffic in the security group associated with the application servers, you permit the necessary traffic while maintaining stateful filtering and restricting other outbound traffic. This is a security best practice that follows the principle of least privilege.

Answer

Modify the network ACL of the private subnet to allow all outbound traffic

Answer

Add a route in the public subnet route table that points 0.0.0.0/0 to the NAT gateway

Answer

Associate an Elastic IP address with the NAT gateway

Question 5

A company is designing a hybrid network using AWS Direct Connect. The company wants to use the same Direct Connect connection to access both VPC resources and public AWS services (such as S3 and DynamoDB) from its on-premises network. Which THREE components are required to meet this goal? (Choose three.)

Accepted Answer

Private virtual interface (VIF). A private virtual interface (VIF) is required to connect your on-premises network to a VPC via Direct Connect. However, to also access public AWS services like S3 and DynamoDB over the same Direct Connect connection, you need a public VIF (Option E) for public endpoint connectivity and a Direct Connect Gateway (Option C) to enable transitive routing between the private VIF and multiple VPCs or to simplify the architecture. Together, these three components allow a single Direct Connect connection to serve both private VPC resources and public AWS services.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN connection

Question 6

A company has deployed a multi-tier application across three VPCs (VPC-A, VPC-B, VPC-C) in the us-east-1 region. Each VPC has its own CIDR block (10.0.0.0/16, 10.1.0.0/16, 10.2.0.0/16 respectively). All VPCs are attached to an AWS Transit Gateway. The web tier is in VPC-A, the application tier is in VPC-B, and the database tier is in VPC-C. The application servers in VPC-B need to connect to the database servers in VPC-C on TCP port 3306. The database servers are in a private subnet with a security group (sg-db) that allows inbound traffic from the application server security group (sg-app). The application servers have a security group (sg-app) that allows outbound traffic to the database servers. However, the application servers cannot connect to the database servers. The route tables in VPC-B and VPC-C have routes pointing to the Transit Gateway for the other VPC CIDRs. The Transit Gateway has attachments in all three VPCs and has a default route table with propagation enabled. What is the MOST likely cause of the connectivity failure?

Accepted Answer

The Transit Gateway attachments are not associated with the same route table. The most likely cause is that the Transit Gateway attachments are not associated with the same route table. In AWS Transit Gateway, for traffic to flow between VPCs, the attachments must be associated with a route table that contains routes for the destination VPC CIDRs. Even though propagation is enabled on the default route table, if the attachments are associated with different route tables (or the default route table is not shared), transitive routing will fail. Without a common route table association, the Transit Gateway cannot forward traffic between VPC-B and VPC-C.

Answer

The network ACLs in VPC-B or VPC-C are blocking the traffic

Answer

The Transit Gateway does not support transitive routing between VPCs

Answer

The security group sg-app does not allow outbound traffic to the database server's security group

Question 7

A company is setting up a new AWS environment for a project. The network architect decides to use a hub-and-spoke model with a central inspection VPC for east-west traffic inspection. The inspection VPC (VPC-Hub) contains a firewall appliance that inspects traffic between spoke VPCs. All VPCs are attached to an AWS Transit Gateway. The architect creates a route table in the Transit Gateway for the inspection VPC and another route table for the spoke VPCs. The inspection VPC route table has a default route (0.0.0.0/0) pointing to the firewall appliance. The spoke VPCs have route tables that point to the inspection VPC for traffic to other spoke VPCs. The firewall appliance is configured to forward traffic after inspection. However, traffic between spoke VPCs is not being routed through the inspection VPC. Which configuration change should the architect make to ensure traffic between spoke VPCs is inspected?

Accepted Answer

Enable route propagation on the inspection VPC attachment for the inspection route table. The inspection VPC route table needs to learn the spoke VPC CIDRs dynamically via route propagation from the Transit Gateway attachment. Without propagation, the inspection VPC route table only has a default route pointing to the firewall appliance, but no specific routes for the spoke VPCs. When the firewall appliance forwards traffic after inspection, it needs to know how to reach the destination spoke VPC; enabling route propagation on the inspection VPC attachment for the inspection route table allows the Transit Gateway to inject the spoke VPC routes into that route table, enabling proper return traffic flow.

Answer

Use VPC Peering between the spoke VPCs instead of Transit Gateway

Answer

Create a static route in the inspection VPC route table for each spoke VPC CIDR

Answer

Remove the default route from the spoke VPC route tables

Question 8

A company has an existing VPC with a public subnet and a private subnet. The company launches an EC2 instance in the private subnet. The instance needs to access an S3 bucket to download software updates. The company does not want the instance to have a public IP address. The company creates a VPC endpoint for S3 (Gateway type) in the VPC, and associates it with the private subnet route table by adding a route for the S3 prefix list. However, the instance still cannot access the S3 bucket. The security group for the instance allows all outbound traffic. The network ACL for the private subnet allows all inbound and outbound traffic. What is the MOST likely reason for the connectivity failure?

Accepted Answer

The VPC endpoint policy does not grant access to the S3 bucket. The most likely reason is that the VPC endpoint policy does not grant access to the S3 bucket. Even though the Gateway VPC Endpoint is created and associated with the private subnet route table, the endpoint's policy controls which S3 buckets and actions are allowed. If the policy is too restrictive (e.g., default deny or does not explicitly allow access to the specific bucket), traffic will be dropped at the endpoint, preventing the instance from downloading updates. The security group and network ACL are already permissive, and internet access is not required because the Gateway endpoint uses AWS's private network.

Answer

The network ACL is blocking the traffic

Answer

The security group does not allow outbound HTTPS traffic

Answer

The instance does not have a route to the internet

Question 9

A company is designing a hybrid network with AWS Direct Connect and a VPN backup. They have two on-premises sites connected via MPLS. They want to ensure that if the Direct Connect fails, traffic automatically fails over to the VPN without manual intervention. Which routing configuration should they use?

Accepted Answer

Use BGP and set a higher local preference for routes learned via Direct Connect, and enable BGP graceful shutdown on the Direct Connect router. Using BGP with a higher local preference for routes learned via Direct Connect ensures that the Direct Connect path is preferred over the VPN backup. If the Direct Connect fails, the BGP session goes down, the routes are withdrawn, and traffic automatically fails over to the VPN without manual intervention. BGP graceful shutdown is not required for failover but can be used to gracefully drain traffic before maintenance.

Answer

Configure static routes with equal cost pointing to Direct Connect and VPN

Answer

Use BGP and advertise the same prefixes with a lower MED on the VPN connection

Answer

Create a VPC peering connection between the VPC and on-premises network

Question 10

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Accepted Answer

Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.. It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Answer

Use VPC Peering for all inter-VPC communication

Answer

Use AWS Site-to-Site VPN between each VPC and a central VPN hub

Answer

Use AWS Client VPN to connect development VPCs to the production VPC

Question 11

A company is deploying a web application across multiple Availability Zones in a single AWS Region. The application consists of an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group, and an Amazon RDS Multi-AZ database. The company needs to ensure that the application can survive the loss of an entire Availability Zone. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones. Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) still have healthy EC2 instances to serve traffic. This is a fundamental requirement for multi-AZ high availability, as the Auto Scaling group will automatically replace failed instances in the remaining AZs.

Answer

Use larger EC2 instance types to handle the load

Answer

Deploy a single NAT Gateway in one AZ for outbound traffic

Question 12

A company is designing a network for a real-time data analytics platform that ingests data from thousands of IoT devices. The devices send data via UDP to a UDP-based collector service running on EC2 instances. The collector service must be highly available and scalable. The data is then processed by a stream processing application. The company wants to minimize latency and jitter. Which TWO architectural choices should they make?

Accepted Answer

Use AWS Global Accelerator to provide a static anycast IP address and route traffic to the NLB endpoints. AWS Global Accelerator provides static anycast IP addresses that route traffic over the AWS global network to the optimal NLB endpoint, reducing latency and jitter by avoiding public internet hops and using the AWS backbone. This is ideal for UDP-based real-time analytics where consistent performance is critical.

Answer

Use an Application Load Balancer (ALB) with a TCP listener and configure the collector to receive TCP

Answer

Use AWS Global Accelerator with EC2 instances as endpoints directly

Answer

Deploy an internet-facing NLB with Elastic IP addresses in each Availability Zone

Question 13

Refer to the exhibit. An AWS administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile is associated with an IAM role that has the above trust policy. The S3 bucket policy allows s3:GetObject only for the role's ARN. What is the most likely cause of the access failure?

Accepted Answer

The instance profile is not attached to the EC2 instance. The instance profile must be attached to the EC2 instance for the IAM role's credentials to be available to the instance. Without this attachment, the EC2 instance cannot assume the role or use its permissions to access the S3 bucket, even if the trust policy and bucket policy are correctly configured.

Answer

The VPC does not have an S3 VPC endpoint

Answer

The S3 bucket policy does not allow s3:ListBucket

Answer

The trust policy does not allow the S3 service to assume the role

Question 14

A large financial services company is migrating its on-premises data center to AWS. The network design must meet strict low-latency requirements for trading applications that communicate with external exchanges. The company has two AWS Direct Connect connections from two different providers to two different AWS Direct Connect locations in the same region. They have a VPC with multiple subnets across three Availability Zones. The trading applications are deployed on EC2 instances in private subnets and need to communicate with external exchanges over the Direct Connect connections. The company also requires high availability and automatic failover if one Direct Connect connection fails. The network team has configured two virtual interfaces (VIFs) for private connectivity to the VPC, one on each Direct Connect connection, and has set up BGP sessions. However, during a failover test, traffic does not fail over as expected. The team notices that the VPC route tables have static routes pointing to the virtual private gateway (VGW) with the same prefix, but no BGP routes are propagated. What is the most likely cause of the failover issue, and what should be done to resolve it?

Accepted Answer

The VPC route tables have static routes that are overriding the BGP routes. Remove the static routes and rely on BGP routes propagated through the VGW.. The failover issue occurs because static routes in the VPC route tables take precedence over BGP-propagated routes, even when the BGP session goes down. Since the static routes point to the virtual private gateway (VGW) with the same prefix, traffic continues to use the failed Direct Connect connection instead of failing over to the active one. Removing the static routes and enabling route propagation allows BGP to dynamically update the route tables based on the availability of the Direct Connect connections.

Answer

The VPC route tables do not have route propagation enabled for the VGW. Enable route propagation in the route tables.

Answer

The BGP timers are set too high, causing slow convergence. Reduce the BGP keepalive and hold timers.

Answer

The BGP configuration on the on-premises router is using AS_PATH prepending, making the backup path less preferred. Remove AS_PATH prepending.

Question 15

A company is designing a global application that will serve users across North America and Europe. The application consists of a static website hosted on Amazon S3, a REST API hosted on Amazon API Gateway, and a backend application running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The company wants to minimize latency for users by serving content from the closest AWS region. They also want to ensure high availability and automatic failover if a region becomes unavailable. The company is considering using Amazon Route 53 with a latency-based routing policy. However, they are concerned about DNS caching and propagation delays during failover. Which additional service should they use to improve the failover experience and provide a single endpoint for users?

Accepted Answer

Use AWS Global Accelerator to provide a static IP address and route traffic to the ALB in the closest healthy region. AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via the Anycast static IP addresses, bypassing DNS caching and propagation delays. It provides a single fixed endpoint for users and integrates with the ALB in each region, automatically failing over to the next healthy region within seconds when health checks fail.

Answer

Use a Network Load Balancer in each region and configure Route 53 with failover routing

Answer

Use Amazon CloudFront with multiple origins pointing to the S3 bucket and the ALB in each region

Answer

Use Lambda@Edge to dynamically route traffic based on the user's location