ANS-C01 Network Design Practice Test 19 — 15 Questions

Question 1

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a DB subnet group with subnets in two Availability Zones, launch the RDS instance with Multi-AZ enabled, and configure the application to connect to the RDS endpoint DNS name. Creating a DB subnet group with subnets in two Availability Zones and enabling Multi-AZ on the RDS instance ensures automatic failover to a standby in another AZ. The application connects to the RDS endpoint DNS name, which automatically points to the current primary instance, so no application changes are needed during failover. This satisfies the high availability and access requirements while keeping the database in private subnets.

Answer

Place the RDS instances behind an internal Network Load Balancer and configure the application to connect to the NLB's DNS name

Answer

Create the RDS instance in the public subnet and restrict access using a security group that allows traffic from the private subnet

Answer

Configure the application to use the IP address of the primary RDS instance and update the application when failover occurs

Question 2

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit. AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Answer

Use an Application Load Balancer for each service and configure HTTPS listeners

Answer

Use VPC peering between each service's VPC

Answer

Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer

Question 3

A company is expanding its on-premises network to AWS using Direct Connect and VPN backup. They have two Direct Connect connections from different providers to two different Direct Connect locations in the same region. They have configured a private virtual interface (VIF) on each connection to a virtual private gateway (VGW) attached to a VPC. They have also configured a VPN connection as a backup. The company uses BGP to advertise the on-premises prefixes to AWS. They want to ensure that traffic is load-balanced across both Direct Connect connections under normal conditions and that the VPN is used only if both Direct Connect connections fail. They also want to minimize the cost of data transfer. Which BGP configuration should they use?

Accepted Answer

Advertise the same prefixes over both Direct Connect connections with equal local preference, and prepend AS path on the VPN routes to make them less preferred. By advertising the same prefixes over both Direct Connect connections with equal local preference, traffic is load-balanced across both connections under normal conditions. AS path prepending on VPN routes makes the VPN less preferred than Direct Connect, so the VPN is used only when both Direct Connect connections fail. This configuration also minimizes cost by preferring Direct Connect over VPN. Option A is incorrect because a single BGP session over one Direct Connect connection creates a single point of failure. Option C is incorrect because setting a higher MED on one Direct Connect connection makes it less preferred, resulting in active/passive rather than load-balanced traffic. Option D is incorrect because advertising different prefixes over each connection does not load-balance traffic; it routes different destinations through each connection.

Answer

Configure a single BGP session over both Direct Connect connections using the same virtual interface

Answer

Set a higher MED on one of the Direct Connect connections to make it the primary, and use the VPN as secondary

Answer

Advertise different on-premises prefixes over each Direct Connect connection and use the VPN for all traffic

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT Gateway. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for downloading updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is secure because the NAT Gateway uses Elastic IPs and does not accept unsolicited inbound traffic, and it is cost-effective as it is a managed service with no maintenance overhead.

Answer

Create a VPC Gateway Endpoint for S3 and configure the private instance to use it

Answer

Create a forward proxy server in the public subnet and configure the private instance to use it

Answer

Create a NAT instance in the public subnet and configure the private instance to use it

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Keep the database instance in the private subnet with no public IP, and configure the security group of the database to allow inbound traffic from the web server's security group on the database port. Security groups in AWS can reference other security groups as a source, allowing traffic from any instance associated with the source security group. By configuring the database's security group to allow inbound traffic on the database port from the web server's security group, the web server can connect to the database without the database needing a public IP address. This leverages AWS's built-in security group chaining, which works across subnets within the same VPC.

Answer

Create a VPC Peering connection between the public and private subnets

Answer

Assign a public IP address to the database instance and configure the security group to allow inbound traffic from the web server's public IP

Answer

Set up a VPN connection between the web server and the database

Question 6

A company has a VPC with a CIDR block of 192.168.0.0/16. They have two subnets: Subnet A (192.168.1.0/24) and Subnet B (192.168.2.0/24). They launch an EC2 instance in Subnet A and another EC2 instance in Subnet B. They want to ensure that both instances can communicate with each other. The instances are in the same VPC. What is the simplest way to enable communication between these instances?

Accepted Answer

No additional configuration is needed; instances in the same VPC can communicate by default. By default, all instances within the same VPC can communicate with each other using private IP addresses, regardless of which subnet they reside in. The VPC's implicit router enables this layer-3 connectivity as long as the subnets' route tables do not explicitly block traffic and the instances' security groups or network ACLs permit the traffic. Since both subnets are within the same VPC (192.168.0.0/16), no additional configuration is required for basic IP-level communication.

Answer

Create a VPC Peering connection between Subnet A and Subnet B

Answer

Create a NAT Gateway in each subnet

Answer

Attach an internet gateway to the VPC

Question 7

A company is designing a network for a real-time trading application that requires extremely low latency (sub-millisecond) between two EC2 instances located in the same AWS region. The instances are in different Availability Zones. The trading application uses a proprietary protocol over TCP. The company wants to minimize latency as much as possible. They are considering using a placement group. Which type of placement group should they use, and what network optimization should they apply?

Accepted Answer

Use a cluster placement group for both instances and enable enhanced networking (SR-IOV). A cluster placement group is the only placement group type that provides low-latency, high-bandwidth network performance by placing instances in a single Availability Zone within the same rack. Enhanced networking using SR-IOV (Single Root I/O Virtualization) bypasses the hypervisor's network stack, reducing per-packet processing latency and jitter, which is critical for sub-millisecond trading traffic over TCP.

Answer

Use a spread placement group and enable dedicated tenancy

Answer

Use a partition placement group and enable EBS-optimized instances

Answer

Use a cluster placement group but launch instances in different Availability Zones

Question 8

A company wants to design a multi-region active-active architecture with Amazon Route 53 latency-based routing and failover using health checks. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Configure a latency alias record for each region's resource. Latency-based routing in Route 53 uses alias records to route traffic based on the lowest latency for the end user. Configuring a latency alias record for each regional resource (e.g., an Application Load Balancer) allows Route 53 to respond with the IP of the resource that provides the best latency. Option D is correct because health checks must be associated with each latency record to enable failover; if a resource fails its health check, Route 53 removes it from the pool of healthy endpoints, ensuring traffic is only routed to healthy regions.

Answer

Use geolocation routing to direct users to the nearest region

Answer

Assign a weight to each record for traffic distribution

Answer

Set the failover record type to 'Active-Active'

Question 9

A media company is designing a network for a new AWS environment. They have a VPC with public and private subnets in three Availability Zones. In the private subnets, they run a fleet of Amazon EC2 instances that process video files from an Amazon S3 bucket. The S3 bucket is in the same region. The company wants to ensure that all traffic to S3 stays within the AWS network and does not traverse the internet. They also need to allow the EC2 instances to access the internet for software updates, but only through a centralized NAT gateway. Currently, there is one NAT gateway in AZ1. The network engineer has created a VPC endpoint for S3 (Gateway type) and associated it with the route tables for the private subnets. However, the EC2 instances in AZ2 and AZ3 cannot reach the NAT gateway for internet access. What is the most likely cause?

Accepted Answer

The NAT gateway is only available in the AZ where it is deployed. The most likely cause is that the NAT gateway is only available in the AZ where it is deployed because the private subnets in AZ2 and AZ3 likely do not have a default route pointing to the NAT gateway. A NAT gateway is created in a specific AZ, and while it can be accessed from other AZs using cross-AZ routing, the route tables for those subnets must be explicitly configured with a 0.0.0.0/0 route to the NAT gateway. The S3 Gateway Endpoint adds a specific route for S3 traffic, which does not override the default route; therefore, adding the endpoint does not affect internet access. Option A is incorrect because the endpoint route is more specific for S3, not a default route. Options B and D are false because Gateway Endpoints are regional and do not require per-AZ creation, and NAT gateways can be used cross-AZ with proper routing.

Answer

The route table for private subnets now has a more specific route for S3 that overrides the default route to the NAT gateway

Answer

The VPC endpoint needs to be created in each Availability Zone

Answer

The S3 VPC endpoint is only accessible from the AZ where it was created

Question 10

A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?

Accepted Answer

The Transit Gateway route tables allow direct communication between application VPCs. The most likely reason east-west traffic is bypassing the Network Firewall is that the Transit Gateway route tables allow direct communication between application VPCs. For traffic to be inspected, it must be routed through the inspection VPC. If the application VPCs have routes in the same Transit Gateway route table that point directly to each other (e.g., a static route or a propagated route from the same VPC attachment), traffic will take that direct path and bypass the Network Firewall. Option B is incorrect because the inspection VPC can have subnets for east-west traffic; the issue is routing, not subnet design. Option C is incorrect because Network Firewall can inspect traffic between VPCs at high throughput. Option D is incorrect because Network Firewall is stateful and handles return traffic correctly.

Answer

The inspection VPC does not have a subnet for east-west traffic

Answer

Network Firewall cannot inspect traffic between VPCs at high throughput

Answer

Network Firewall is not stateful and cannot handle return traffic

Question 11

A startup wants to design a cost-effective network for a new application. They expect low traffic initially but need to handle sudden spikes. They plan to use Amazon EC2 instances behind an Application Load Balancer (ALB) in a single VPC. The application must be highly available within the region. The network engineer has proposed using two public subnets in two Availability Zones for the ALB, and two private subnets for the EC2 instances. The EC2 instances need to access the internet for updates. What is the MOST cost-effective and highly available design?

Accepted Answer

Use a NAT gateway in each public subnet (one per AZ). Using a NAT gateway in each Availability Zone provides high availability because each AZ has its own NAT gateway, eliminating a single point of failure. NAT gateways are managed by AWS, reducing operational overhead compared to NAT instances. Option A is wrong because a single NAT instance is a single point of failure. Option C is wrong because while NAT instances per AZ provide high availability, they require manual management and are less cost-effective than using managed NAT gateways. Option D is wrong because a single NAT gateway is a single point of failure.

Answer

Use a single NAT instance in one public subnet

Answer

Use a NAT instance in each public subnet (one per AZ)

Answer

Use a single NAT gateway in one public subnet

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The network ACL for the private subnet is blocking inbound traffic. The most likely cause is that the network ACL (NACL) for the private subnet is blocking inbound traffic on port 3306. In Amazon VPC, each subnet has a default NACL that allows all inbound and outbound traffic by default, but if the NACL has been modified to block inbound traffic on port 3306, the connection from the EC2 instance will be denied. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit rules for both inbound and outbound traffic. The private subnet's route table automatically includes a local route to the entire VPC CIDR (10.0.0.0/16), which cannot be deleted, so a missing route is not a possible cause. The DB instance does not need a public IP for VPC internal communication, and the EC2 security group likely allows all outbound traffic by default.

Answer

The private subnet does not have a route to the public subnet

Answer

The security group for the EC2 instance does not allow outbound traffic

Answer

The DB instance does not have a public IP address

Question 13

A large e-commerce company is designing a network for a new microservices architecture. They have hundreds of microservices running on Amazon ECS with Fargate launch type. The services need to communicate with each other and with external APIs. The company wants to minimize network latency and maximize security. They also need to ensure that traffic between services does not leave the VPC. The network engineer is considering using AWS PrivateLink to allow services to communicate via VPC endpoints. However, they are concerned about the cost of creating an endpoint for each service. Which design should the network engineer recommend?

Accepted Answer

Use AWS App Mesh to enable service-to-service communication within the VPC. AWS App Mesh provides a service mesh that enables secure, low-latency communication between microservices within the same VPC using Envoy sidecar proxies. It handles service discovery, traffic routing, and encryption (mTLS) without requiring VPC endpoints or public IPs, keeping all traffic within the VPC and minimizing cost. This directly addresses the requirement for hundreds of services to communicate privately and efficiently.

Answer

Use a Transit Gateway to connect all services

Answer

Assign public IP addresses to the Fargate tasks and use security groups

Answer

Create a VPC endpoint for each microservice and use PrivateLink

Question 14

A company is designing a network for a new VPC. They want to ensure that the VPC can connect to an on-premises data center via a site-to-site VPN. The on-premises network uses a CIDR block of 10.0.0.0/8. The VPC will use a CIDR block of 10.0.0.0/16. The network engineer is concerned about overlapping IP addresses. What is the best way to avoid IP address overlap?

Accepted Answer

Use a different RFC 1918 CIDR block for the VPC. Using a different RFC 1918 CIDR block (e.g., 172.16.0.0/12 or 192.168.0.0/16) for the VPC completely avoids IP address overlap with the on-premises 10.0.0.0/8 network. Overlapping CIDR blocks (both using 10.0.0.0/8) would prevent successful route propagation and cause asymmetric routing or connectivity failures in the site-to-site VPN. NAT can mitigate overlap but adds complexity and is not the 'best' design choice when a non-overlapping private range is available.

Answer

Use the same CIDR block and rely on NAT

Answer

Use a smaller subnet within the same 10.0.0.0/8 range

Answer

Use a public IP range for the VPC

Question 15

A company is designing a hybrid network connecting on-premises data centers to AWS via AWS Direct Connect. The company requires high availability with multiple connections. Which design ensures that a failure of a single Direct Connect location does not impact connectivity?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Deploying two Direct Connect connections at two different Direct Connect locations ensures that a single location failure (e.g., power outage, fiber cut, or facility issue) does not affect connectivity. This design provides geographic redundancy, meeting the high availability requirement by eliminating a single point of failure at the Direct Connect location level.

Answer

Provision a single Direct Connect connection with a large bandwidth.

Answer

Provision two Direct Connect connections at the same AWS Direct Connect location.

Answer

Provision one Direct Connect connection and one AWS Site-to-Site VPN as backup.