ANS-C01 Network Design Practice Test 19 — 15 Questions

Question 1

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an Amazon RDS for MySQL DB instance in the private subnet. The DB instance needs to be accessed by an EC2 instance in the public subnet. The security group for the DB instance allows inbound traffic on port 3306 from the security group of the EC2 instance. However, the EC2 instance cannot connect to the DB instance. What is the most likely cause?

Accepted Answer

The private subnet does not have a route to the public subnet. The most likely cause is that the private subnet does not have a route to the public subnet. For an EC2 instance in the public subnet to reach an RDS DB instance in the private subnet, the private subnet's route table must include a route that directs return traffic back to the public subnet (e.g., via a VPC peering connection, a NAT gateway, or a transit gateway). Without this return path, the DB instance's response packets are dropped, even though the security group allows inbound traffic from the EC2 instance's security group.

Answer

The network ACL for the private subnet is blocking inbound traffic

Answer

The security group for the EC2 instance does not allow outbound traffic

Answer

The DB instance does not have a public IP address

Question 2

A large e-commerce company is designing a network for a new microservices architecture. They have hundreds of microservices running on Amazon ECS with Fargate launch type. The services need to communicate with each other and with external APIs. The company wants to minimize network latency and maximize security. They also need to ensure that traffic between services does not leave the VPC. The network engineer is considering using AWS PrivateLink to allow services to communicate via VPC endpoints. However, they are concerned about the cost of creating an endpoint for each service. Which design should the network engineer recommend?

Accepted Answer

Use AWS App Mesh to enable service-to-service communication within the VPC. AWS App Mesh provides a service mesh that enables secure, low-latency communication between microservices within the same VPC using Envoy sidecar proxies. It handles service discovery, traffic routing, and encryption (mTLS) without requiring VPC endpoints or public IPs, keeping all traffic within the VPC and minimizing cost. This directly addresses the requirement for hundreds of services to communicate privately and efficiently.

Answer

Use a Transit Gateway to connect all services

Answer

Assign public IP addresses to the Fargate tasks and use security groups

Answer

Create a VPC endpoint for each microservice and use PrivateLink

Question 3

A company has a VPC with a CIDR block of 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private). They launch an EC2 instance in the private subnet and an Application Load Balancer (ALB) in the public subnet. The ALB needs to forward traffic to the EC2 instance on port 80. The security group for the EC2 instance allows inbound traffic on port 80 from the security group of the ALB. The ALB health checks are failing. What is the most likely cause?

Accepted Answer

The security group for the EC2 instance does not allow inbound traffic from the ALB's security group. Option D is correct because the EC2 instance's security group must have an inbound rule allowing traffic from the ALB's security group. If this rule is missing or misconfigured, the ALB's health check requests (which originate from the ALB's private IP addresses) will be blocked, causing health checks to fail. The scenario states the rule 'allows inbound traffic on port 80 from the security group of the ALB,' but if the rule is not properly associated or the ALB's security group ID is incorrect, traffic will be denied.

Answer

The ALB cannot route traffic to a private subnet

Answer

The private subnet does not have a route to a NAT gateway

Answer

The ALB is in a different VPC than the EC2 instance

Question 4

A company is designing a network for a new VPC. They want to ensure that the VPC can connect to an on-premises data center via a site-to-site VPN. The on-premises network uses a CIDR block of 10.0.0.0/8. The VPC will use a CIDR block of 10.0.0.0/16. The network engineer is concerned about overlapping IP addresses. What is the best way to avoid IP address overlap?

Accepted Answer

Use a different RFC 1918 CIDR block for the VPC. Option B is correct because using a different RFC 1918 CIDR block (e.g., 172.16.0.0/12 or 192.168.0.0/16) for the VPC completely avoids IP address overlap with the on-premises 10.0.0.0/8 network. Overlapping CIDR blocks (both using 10.0.0.0/8) would prevent successful route propagation and cause asymmetric routing or connectivity failures in the site-to-site VPN. NAT can mitigate overlap but adds complexity and is not the 'best' design choice when a non-overlapping private range is available.

Answer

Use the same CIDR block and rely on NAT

Answer

Use a smaller subnet within the same 10.0.0.0/8 range

Answer

Use a public IP range for the VPC

Question 5

A company is designing a hybrid network connecting on-premises data centers to AWS via AWS Direct Connect. The company requires high availability with multiple connections. Which design ensures that a failure of a single Direct Connect location does not impact connectivity?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option B is correct because deploying two Direct Connect connections at two different Direct Connect locations ensures that a single location failure (e.g., power outage, fiber cut, or facility issue) does not affect connectivity. This design provides geographic redundancy, meeting the high availability requirement by eliminating a single point of failure at the Direct Connect location level.

Answer

Provision a single Direct Connect connection with a large bandwidth.

Answer

Provision two Direct Connect connections at the same AWS Direct Connect location.

Answer

Provision one Direct Connect connection and one AWS Site-to-Site VPN as backup.

Question 6

A company wants to connect multiple VPCs in different AWS accounts to on-premises networks using AWS Transit Gateway. Each VPC must be able to communicate with on-premises resources over AWS Direct Connect. What is the MINIMUM number of Transit Gateway attachments required if the company has 5 VPCs and 2 Direct Connect connections from different locations?

Accepted Answer

7. Option D is correct. Each VPC requires one attachment to the Transit Gateway. For Direct Connect, a single Transit Virtual Interface (VIF) attachment per Direct Connect connection is sufficient, but the question asks for the minimum number of attachments. With two Direct Connect connections, you need at least one attachment per connection, but typically you would have one attachment per Direct Connect gateway. However, the minimum is 5 VPC attachments plus 2 Direct Connect attachments = 7. Option A is wrong because it misses the Direct Connect attachments. Option B is wrong because it assumes only one Direct Connect attachment. Option C is wrong because it underestimates the VPC attachments.

Answer

6

Answer

5

Answer

8

Question 7

A company is deploying an internet-facing application in AWS. The application must only accept traffic from specific IP addresses of business partners. Which AWS service should be used to enforce this restriction?

Accepted Answer

AWS WAF with an IP set rule. Option A is correct because AWS WAF allows you to create IP set rules to block or allow traffic from specific IP addresses. Option B is wrong because Security Groups do not support allow lists for specific IP addresses from different sources (they support CIDR blocks but not dynamic IP sets). Option C is wrong because Network ACLs are stateless and operate at the subnet level; they can allow/deny by CIDR but are not as flexible as WAF for partner IP lists. Option D is wrong because Route 53 is for DNS, not traffic filtering.

Answer

Network ACLs with inbound allow rules

Answer

Security Groups with inbound allow rules

Answer

Amazon Route 53 geoproximity routing

Question 8

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.. Option B is correct. A NAT Gateway in a public subnet allows outbound internet traffic from private instances while preventing inbound traffic from the internet. Option A is wrong because an Internet Gateway alone does not provide outbound-only access; it would require a public IP and could allow inbound traffic. Option C is wrong because a VPN does not provide internet access. Option D is wrong because VPC endpoints are for AWS services, not general internet.

Answer

Use VPC Gateway Endpoints for S3 and DynamoDB.

Answer

Attach an Internet Gateway to the VPC and assign a public IP to the instance.

Answer

Configure a VPN connection from the VPC to an on-premises network that has internet access.

Question 9

A company has multiple VPCs connected via a Transit Gateway. Each VPC has its own CIDR block. The company wants to isolate network traffic between specific VPCs. What is the most scalable way to achieve this?

Accepted Answer

Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.. Option C is correct. Transit Gateway supports route tables that can be used to control which VPCs can communicate. By creating separate route tables and associating them with the appropriate attachments, you can isolate traffic without complex routing. Option A is wrong because VPC Peering requires many connections and manual routing; it is not scalable. Option B is wrong because Security Groups cannot filter traffic between VPCs. Option D is wrong because AWS Network Firewall is not the most scalable solution for simple isolation.

Answer

Deploy AWS Network Firewall in each VPC.

Answer

Use Security Groups in each VPC to filter traffic.

Answer

Use VPC Peering connections and modify route tables.

Question 10

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Internet Gateway; application servers in private subnets with a route to the NAT Gateway.. Option D is correct because it places web servers in public subnets with an Internet Gateway (IGW) for direct internet access, while application servers reside in private subnets that lack a direct route to the IGW. The private subnets have a route to a NAT Gateway, allowing the application servers to initiate outbound internet connections (e.g., for updates) without being reachable from the internet. Security Groups on the application servers can further restrict inbound traffic to only the web servers' security group, ensuring the application tier is isolated.

Answer

All servers in private subnets; use a load balancer in a public subnet.

Answer

Web servers in private subnets; application servers in public subnets with an Internet Gateway.

Answer

All servers in public subnets; use Security Groups to restrict access.

Question 11

A company is designing a network for a critical application that requires low latency and high throughput between EC2 instances in the same AWS Region. Which network design should the company use?

Accepted Answer

Launch the instances in a Cluster Placement Group.. A Cluster Placement Group is the correct choice because it provides the lowest possible latency and highest throughput between EC2 instances by placing them in a single Availability Zone with non-blocking, high-bandwidth networking. This design is ideal for tightly coupled, high-performance computing (HPC) or latency-sensitive applications that require consistent, low-latency communication within the same AWS Region.

Answer

Launch the instances in a Spread Placement Group.

Answer

Launch the instances as larger instance types with enhanced networking.

Answer

Launch the instances in different Availability Zones.

Question 12

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The company wants to connect to multiple VPCs in the same AWS Region. What is the MOST cost-effective and scalable design?

Accepted Answer

Create a Transit Gateway, attach it to the Direct Connect Gateway using a Transit VIF, and attach each VPC to the Transit Gateway.. Option C is correct because it uses a Transit Gateway (TGW) to interconnect multiple VPCs and a Direct Connect Gateway (DXGW) via a Transit VIF, which is the most cost-effective and scalable design. The Transit VIF allows a single Direct Connect connection to be shared across many VPCs through the TGW, avoiding the need for multiple private VIFs or complex peering arrangements. This design scales to hundreds of VPCs and reduces operational overhead by centralizing routing.

Answer

Provision multiple private VIFs, each connected to a different VPC.

Answer

Create a Direct Connect Gateway and associate each VPC's Virtual Private Gateway to it using a private VIF.

Answer

Use a private VIF to connect to a Virtual Private Gateway in one VPC and use VPC Peering to reach other VPCs.

Question 13

A company wants to ensure that all traffic to and from its VPC is inspected by a security appliance. The appliance must be able to inspect traffic between subnets within the VPC. Which architecture should the company use?

Accepted Answer

Use a Gateway Load Balancer with security appliances in a separate inspection VPC and configure route tables to send traffic to the GWLB endpoint.. Option A is correct because a Gateway Load Balancer (GWLB) with security appliances in a separate inspection VPC allows you to centrally inspect all traffic, including east-west traffic between subnets within the same VPC. By configuring route tables to send traffic to the GWLB endpoint, you can enforce stateful inspection for all inbound, outbound, and inter-subnet traffic without introducing a single point of failure or complex routing.

Answer

Deploy a NAT Gateway and route all internet traffic through it.

Answer

Create a VPC Peering connection to a centralized VPC with security appliances.

Answer

Attach an Internet Gateway and use Security Groups to log traffic.

Question 14

A company is designing a network for a multi-account AWS environment using AWS Organizations. The company must centralize internet egress for all accounts. Which TWO solutions should the company use? (Choose two.)

Accepted Answer

Use AWS Transit Gateway to route traffic from all VPCs to the egress VPC.. Option C is correct because AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs. This allows traffic from multiple VPCs to be routed to a centralized egress VPC without requiring complex peering relationships or full mesh connectivity.

Answer

Use VPC Peering to connect all VPCs to the egress VPC.

Answer

Deploy a AWS Client VPN endpoint in each VPC.

Answer

Attach an Internet Gateway to each VPC and allow direct internet access.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. The company needs to add a new subnet for a container cluster that requires at least 2000 IP addresses. Which TWO subnet CIDR blocks meet this requirement? (Choose two.)

Accepted Answer

10.0.0.0/20. Option C (10.0.0.0/20) provides 2^(32-20) = 4096 IP addresses, and option D (10.0.0.0/21) provides 2^(32-21) = 2048 IP addresses. Both meet the requirement of at least 2000 usable IP addresses (after subtracting AWS reserved addresses, each still offers well over 2000).

Answer

10.0.0.0/24

Answer

10.0.0.0/25

Answer

10.0.0.0/26