ANS-C01 Network Design Practice Test 19 — 15 Questions

Question 1

A company is deploying a critical web application across two AWS Regions, us-east-1 and eu-west-1. The application uses Amazon Route 53 for DNS. The company wants to route users to the Region closest to them, but also needs the ability to shift all traffic to one Region during a maintenance window. The operations team requires a simple, manual failover mechanism that does not rely on health checks. Which Route 53 routing policy should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Weighted routing with weights set to 100 for us-east-1 and 0 for eu-west-1, and the ability to adjust weights manually.. Weighted routing is the correct choice because it allows manual control over traffic distribution by adjusting weights. Setting one Region's weight to 100 and the other to 0 directs all traffic to the first Region. During a maintenance window, the operations team can change the weights to shift traffic to the other Region. This meets the requirements for a simple, manual failover without health checks.

Answer

Geolocation routing with a default record pointing to us-east-1.

Answer

Latency-based routing with a failover record for each Region.

Answer

Failover routing with a primary record in us-east-1 and a secondary record in eu-west-1.

Question 2

A healthcare company needs to connect its on-premises data center to a VPC using AWS Direct Connect. The company requires encryption of data in transit over the Direct Connect connection and wants to avoid managing a separate VPN appliance. The solution must support up to 10 Gbps and provide automatic failover to a backup path if the primary connection fails. Which combination of AWS services should be used?

Accepted Answer

AWS Direct Connect with MACsec encryption and a second Direct Connect connection in a different location for failover. MACsec on AWS Direct Connect provides native encryption at 10 Gbps and 100 Gbps speeds without additional appliances. Combining it with a second Direct Connect connection in a different location ensures physical diversity and automatic BGP failover. This satisfies the encryption, bandwidth, and failover requirements while avoiding the operational overhead of a VPN appliance.

Answer

AWS Direct Connect with a public virtual interface and AWS Transit Gateway Connect

Answer

AWS Site-to-Site VPN over the internet with two tunnels and ECMP enabled

Answer

AWS Direct Connect with a private virtual interface and a software VPN running on an EC2 instance

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16 and an on-premises data center with 10.1.0.0/16. The company wants to connect both networks using AWS Site-to-Site VPN and also allow two VPCs in different AWS Regions to communicate through a transit gateway. The company requires that traffic between the two VPCs and the on-premises network be routed through the transit gateway. Which TWO actions are required to meet these requirements? (Choose two.)

Accepted Answer

Create a VPN attachment on the transit gateway and configure the customer gateway with BGP to advertise on-premises routes.. To connect multiple VPCs and an on-premises network through a transit gateway, you must create a transit gateway, attach the VPCs and the VPN, and enable route propagation on the VPC route tables. The VPN attachment requires BGP configuration on the customer gateway to advertise on-premises routes dynamically. Together, these actions provide the required centralized routing.

Answer

Enable VPC peering between the two VPCs and use a virtual private gateway for the VPN connection.

Answer

Associate a transit gateway route table with the VPC attachments and create a blackhole route for the on-premises CIDR.

Answer

Configure static routes in each VPC route table pointing to the virtual private gateway for the remote VPC CIDRs.

Question 4

A media company has a VPC with CIDR 10.0.0.0/16 and an on-premises data center using 10.0.0.0/16. The company needs to connect the two environments and wants to avoid IP address conflicts without renumbering either side. A network engineer proposes using AWS Transit Gateway with a Site-to-Site VPN. Which solution should the engineer implement to allow overlapping CIDR ranges to communicate?

Accepted Answer

Deploy a third-party NAT appliance in the VPC and translate the overlapping addresses so that on-premises hosts appear on a non-overlapping range.. AWS routing decisions rely on longest-prefix match within a VPC, and a VPC cannot have a route that conflicts with its own local CIDR. When the VPC and on-premises network use the same address range, a translation device inside the VPC is needed to map the remote addresses into a non-overlapping range so that traffic can be routed correctly in both directions.

Answer

Use AWS PrivateLink to expose the on-premises services through a VPC endpoint service and access them by endpoint DNS name.

Answer

Configure the Site-to-Site VPN with static routes and advertise the on-premises 10.0.0.0/16 prefix into the VPC route tables.

Answer

Create a second VPC with a non-overlapping CIDR and use VPC peering between the two VPCs to reach the on-premises network.

Question 5

A media company runs a live-video ingestion fleet in a single VPC. Producers connect over UDP to a Network Load Balancer (NLB) whose target group contains EC2 instances in two Availability Zones. During peak events, producers on the public internet report that some UDP flows are dropped even though the NLB shows healthy targets and CloudWatch shows no target-side saturation. The company must keep the same NLB endpoint and must not change producer client software. Which change should a network engineer make to improve resilience for these long-lived UDP flows?

Accepted Answer

Enable cross-zone load balancing on the NLB so that each load balancer node distributes traffic across all registered targets in all enabled Availability Zones.. Cross-zone load balancing lets each NLB node distribute incoming flows to healthy targets in every enabled Availability Zone, so capacity or impairment in one zone does not strand flows that hashed to a node there. Because the endpoint stays the same and producers are untouched, this is the only listed change that improves resilience within the given constraints.

Answer

Attach an AWS Global Accelerator accelerator with UDP support and point producers at the accelerator's static anycast IP addresses.

Answer

Enable client IP preservation on the target group and increase the deregistration delay to 3600 seconds.

Answer

Switch the target group protocol to TLS and enable the preserve_client_ip attribute so the NLB can re-resolve targets on flow failure.

Question 6

A logistics company is designing a hub-and-spoke network using AWS Transit Gateway. The company has 12 VPCs attached as spokes and one on-premises connection through a VPN attachment. The network team needs the spokes to communicate with each other and with on-premises, but must prevent any spoke from directly reaching another spoke through a path that bypasses the central inspection VPC. Which two actions should the network engineer take to meet these requirements? (Choose two.)

Accepted Answer

Associate the spoke VPC attachments with a transit gateway route table that propagates only the inspection VPC and on-premises routes.. Transit gateway route tables control which attachments can reach which destinations. Associating spoke attachments with a route table that propagates only the inspection VPC and on-premises routes forces spoke-to-spoke traffic through the inspection VPC. Associating the inspection VPC attachment with a route table that propagates all spoke and on-premises routes gives the inspection VPC the paths it needs to forward and return traffic.

Answer

Enable appliance mode on the inspection VPC attachment to preserve flow symmetry.

Answer

Disable route propagation on the transit gateway to prevent spokes from learning each other's routes.

Answer

Use a separate transit gateway route table for each spoke VPC and associate each spoke with its own route table.

Question 7

A financial services company runs a VPC with CIDR 172.31.0.0/16. It connects to an on-premises network through an AWS Direct Connect gateway associated with a transit gateway. A new compliance requirement states that all traffic from the VPC to the on-premises 192.168.0.0/16 network must be inspected by a third-party appliance before leaving AWS, and the appliance must see the original source IP address. Which approach satisfies the requirement?

Accepted Answer

Use two transit gateway route tables: one associated with the VPC and appliance attachments that points 192.168.0.0/16 to the appliance, and one associated with the appliance and Direct Connect gateway attachments that points to the Direct Connect gateway.. Centralized inspection through a transit gateway requires at least two route tables: an inspection table that sends spoke traffic for the on-premises prefix to the appliance attachment, and a separate table for the appliance and Direct Connect gateway attachments so inspected traffic can exit to on-premises. Keeping the appliance in the forward and return path while preserving source IPs satisfies the compliance requirement without loops.

Answer

Configure a transit gateway route table where the VPC attachment and the Direct Connect gateway attachment both associate, and set the appliance VPC attachment as the target for 192.168.0.0/16.

Answer

Enable appliance mode on the transit gateway VPC attachment to the appliance and add a static route for 192.168.0.0/16 pointing to the Direct Connect gateway.

Answer

Attach the appliance VPC and the Direct Connect gateway to the same transit gateway route table and enable equal-cost multipath so traffic is inspected half the time.

Question 8

A company is designing a hybrid network connecting its on-premises data center to AWS using AWS Direct Connect. The company requires a highly available connection that can tolerate the failure of a single Direct Connect location or a single device. They have two Direct Connect locations available, each with a dedicated 10 Gbps connection. They also want to ensure that traffic from on-premises to AWS uses the Direct Connect connection and not the internet. Which configuration should they implement?

Accepted Answer

A Direct Connect gateway with a private VIF at each Direct Connect location, and each VIF associated with the same Direct Connect gateway.. A Direct Connect gateway enables you to connect multiple VIFs from different Direct Connect locations to a single gateway, providing redundancy and high availability. By associating a private VIF at each location with the same Direct Connect gateway, you ensure that if one location fails, traffic can fail over to the other location via BGP. This configuration keeps traffic on the Direct Connect path and avoids the internet.

Answer

A VPN connection over the internet as a backup, with BGP routing to prefer the Direct Connect connection.

Answer

Two virtual interfaces (VIFs) on the same connection at one Direct Connect location, with BGP for failover.

Answer

One private VIF at each Direct Connect location, with each VIF associated with a different virtual private gateway (VGW) in the same VPC.

Question 9

A company is deploying a multi-tier web application in a VPC. The application requires that the web tier can initiate connections to the internet, but the database tier must not have any internet access. The company also wants to minimize the number of NAT gateways while ensuring high availability across two Availability Zones. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Associate the database tier subnets with a route table that has no route to a NAT gateway or internet gateway.. High availability for the web tier requires a NAT gateway in each AZ with route tables directing traffic to the local NAT gateway. The database tier must be isolated by using a route table with no route to a NAT gateway or internet gateway. These two actions together satisfy the internet access and isolation requirements while minimizing NAT gateways to one per AZ.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the database tier route table.

Answer

Create a single NAT gateway in one AZ and route all web tier subnets to it.

Answer

Use AWS PrivateLink to provide internet access to the web tier.

Question 10

A company is deploying a global application that uses Amazon Route 53 for DNS. The application is hosted in two AWS Regions: us-east-1 and eu-west-1. The company wants to route users to the closest Region based on network latency, but also wants to ensure that if the primary Region (us-east-1) becomes unavailable, traffic fails over to eu-west-1. The company has configured latency-based routing records for both Regions. Which additional configuration is required to achieve automatic failover?

Accepted Answer

Create a health check for the us-east-1 endpoint and associate it with the latency record for us-east-1. Route 53 will automatically fail over to the eu-west-1 latency record if the health check fails.. Latency-based routing with health checks enables automatic failover. When a health check on a latency record fails, Route 53 excludes that record from DNS responses and returns the next lowest latency record. This maintains latency-based routing during normal operation and provides failover without reconfiguring to a different routing policy. Associating health checks with each record is the correct method.

Answer

Create a health check for the us-east-1 endpoint and associate it with the latency record for us-east-1. Then create a failover record set with the primary pointing to us-east-1 and secondary to eu-west-1.

Answer

Create a health check for the us-east-1 endpoint and associate it with the eu-west-1 latency record. Configure Route 53 to use failover routing policy instead of latency-based routing.

Answer

Create a health check for the us-east-1 endpoint and associate it with both latency records. Configure Route 53 to use geolocation routing policy to route users to the closest Region.

Question 11

A company is designing a hybrid network architecture that connects its on-premises data center to a VPC using AWS Direct Connect. The company requires high availability and must ensure that traffic continues to flow if the primary Direct Connect connection fails. The network engineer is evaluating a design that uses two Direct Connect connections from different Direct Connect locations. Which TWO components are required to achieve automatic failover and maintain connectivity in this design? (Choose two.)

Accepted Answer

Configure a Direct Connect gateway and associate it with the virtual private gateway or transit gateway in the VPC.. To achieve high availability with two Direct Connect connections from different locations, you must use a Direct Connect gateway associated with a virtual private gateway or transit gateway. Each connection needs a private virtual interface, and both must advertise the same on-premises prefixes so BGP can fail over automatically. These two components together ensure that traffic can reach the VPC even if one connection fails.

Answer

Use a public virtual interface for each connection and advertise the on-premises prefixes to the AWS public network.

Answer

Configure a transit gateway in the VPC and attach only one Direct Connect connection to it.

Answer

Enable BGP routing on the virtual interfaces and set the local preference to prefer the primary connection.

Question 12

A financial services company runs a latency-sensitive trading platform on Amazon EC2 instances spread across three Availability Zones in the same VPC. The instances must communicate with each other using a protocol that requires multicast, but the company wants to avoid managing a separate overlay network. Which AWS service or feature should be used to meet these requirements?

Accepted Answer

AWS Transit Gateway with multicast support enabled on a transit gateway. For multicast communication between EC2 instances in a VPC, AWS Transit Gateway with multicast enabled is the native solution. It allows sources to send to a multicast group and receivers to join, without needing an overlay. Other options either do not support multicast or address different networking needs.

Answer

Amazon Route 53 Resolver with a multicast DNS (mDNS) endpoint

Answer

AWS Direct Connect with a public virtual interface

Answer

VPC peering with a static route for the multicast group address

Question 13

A financial services company connects its on-premises data center to a VPC using an AWS Site-to-Site VPN over a single internet connection. During month-end batch processing, the tunnel occasionally flaps and throughput degrades. The company has ordered a second AWS Direct Connect connection at a different Direct Connect location and wants a design that keeps traffic on AWS-controlled paths and fails over automatically without changing on-premises routing protocols beyond BGP. Which combination should the engineer implement?

Accepted Answer

Create a transit gateway, associate a Direct Connect gateway for each connection, and use equal-cost multipath BGP so both connections carry traffic with automatic failover.. A transit gateway with one Direct Connect gateway per connection lets both dedicated links participate in BGP, and equal-cost multipath keeps both active. When a connection or location fails, BGP withdraws the affected routes and the remaining link takes over, satisfying the requirement for automatic failover on AWS-controlled paths with no routing-protocol changes beyond BGP.

Answer

Attach each Direct Connect connection to its own virtual private gateway and rely on BGP AS_PATH prepending from on-premises to select the primary connection.

Answer

Use a Direct Connect gateway with a hosted connection and enable jumbo frames on the on-premises router to increase throughput during batch windows.

Answer

Create a transit gateway, attach both Direct Connect gateways, and associate a single VPN attachment as the only failover path.

Question 14

A healthcare company is deploying AWS Global Accelerator in front of Application Load Balancers in three Regions to serve a latency-sensitive patient portal. The company requires that client IP addresses be preserved for audit logging and that traffic be routed to the endpoint group with the lowest latency. Which two actions should the network engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enable client IP address preservation on the accelerator so the Application Load Balancer receives the original client address.. Global Accelerator routes each client to the endpoint group in the Region with the lowest latency and preserves the client IP address when the endpoint is an Application Load Balancer. Registering the Regional ALBs as endpoints and relying on client IP preservation gives both the latency-based routing and the original client address needed for audit logging, with no changes to the ALB type.

Answer

Attach an Elastic IP address to each Application Load Balancer and advertise it through the accelerator.

Answer

Set the accelerator's traffic dial for each endpoint group to 100 percent and disable health checks.

Answer

Create a Network Load Balancer in each Region and use it as the endpoint instead of the Application Load Balancer.

Question 15

A company is designing a hybrid network architecture that connects its on-premises data center to AWS using AWS Direct Connect. The company requires high availability and redundancy for the Direct Connect connection. The company has two Direct Connect locations available, each with a dedicated 10 Gbps connection. They also have a VPN connection as a backup. Which TWO configurations will provide the required redundancy and ensure that traffic fails over automatically if the primary Direct Connect connection fails? (Choose two.)

Accepted Answer

Configure a Direct Connect gateway and associate it with virtual private gateways in multiple VPCs. Create a private VIF for each Direct Connect connection and advertise the same prefixes over both with different BGP attributes.. To achieve high availability with Direct Connect, you need redundant physical connections at different locations and a backup path. A Direct Connect gateway with multiple private VIFs and BGP attributes allows automatic failover between Direct Connect connections. A Site-to-Site VPN backup with BGP and longer AS_PATH provides an alternative path if Direct Connect fails. Both configurations ensure automatic failover.

Answer

Configure two virtual interfaces (VIFs) on the same Direct Connect connection, one for each Direct Connect location, and use BGP to advertise the same routes over both.

Answer

Configure a transit gateway in AWS and attach both Direct Connect connections to it. Use equal-cost multi-path (ECMP) routing to load balance traffic across both connections.

Answer

Configure two Direct Connect connections at the same location and use link aggregation group (LAG) to combine them into a single logical connection. Advertise routes over the LAG.