ANS-C01 Network Design Practice Test 2 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF attached to a virtual private gateway. The VPC has multiple subnets in two Availability Zones. The on-premises network advertises a default route (0.0.0.0/0) via BGP. The company wants all internet-bound traffic from the VPC to go through the on-premises network. Which THREE actions are required to achieve this?

Accepted Answer

Add a default route pointing to the virtual private gateway in the private subnet route tables.. Option B is correct because adding a default route (0.0.0.0/0) pointing to the virtual private gateway in the private subnet route tables ensures that all internet-bound traffic from those subnets is forwarded over the Direct Connect private VIF to the on-premises network. This leverages the BGP-advertised default route from the on-premises network, allowing the company to enforce its security and routing policies for internet access.

Answer

Deploy a NAT Gateway in a public subnet.

Answer

Attach an internet gateway to the VPC.

Question 2

A company runs a multi-tier web application on AWS. The web servers in public subnets need to send traffic to the application servers in private subnets. The application servers must only accept traffic from the web servers. Both tiers are in the same VPC. Which design meets these requirements without introducing a single point of failure or unnecessary complexity?

Accepted Answer

Place the web servers in a public subnet with a security group that allows inbound from 0.0.0.0/0 on port 443. Place the app servers in a private subnet with a security group that allows inbound from the web server security group on the application port.. Option A is correct because it uses security group referencing, which allows the app servers' security group to dynamically allow traffic from any instance associated with the web servers' security group, regardless of IP address changes. This design avoids a single point of failure by not introducing any load balancer or gateway, and it minimizes complexity by leveraging native VPC security group behavior within the same VPC.

Answer

Place the web servers and app servers in the same private subnet behind an internal Network Load Balancer. Route web traffic through the NLB.

Answer

Place the web servers in a public subnet with an Internet Gateway. Place the app servers in a private subnet with a NAT Gateway for outbound traffic. Use NACLs to allow inbound from the web subnet CIDR.

Answer

Place the web servers in a public subnet with a NACL allowing inbound on port 443. Place the app servers in a private subnet with a NACL allowing inbound from the web subnet CIDR on the application port.

Question 3

A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to minimize operational overhead. The on-premises network uses BGP to advertise routes to AWS. Which design meets these requirements?

Accepted Answer

Provision two Direct Connect connections to two different Direct Connect locations, each with a private VIF to the same VPC. Use BGP over the VIFs.. Option A is correct because provisioning two Direct Connect connections to two different Direct Connect locations ensures physical and path diversity, eliminating single points of failure. Using BGP over the private VIFs allows dynamic route advertisement and automatic failover, meeting high availability requirements while minimizing operational overhead through managed BGP sessions.

Answer

Provision one Direct Connect connection with a private VIF and a site-to-site VPN connection as a backup.

Answer

Provision one Direct Connect connection with two virtual interfaces (VIFs) to the same AWS device.

Answer

Provision two Direct Connect connections to the same Direct Connect location, both with private VIFs to the same VPC.

Question 4

A company is designing a VPC with public and private subnets for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of route tables and security groups achieves this?

Accepted Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.. Option A is correct because it uses an Internet Gateway (IGW) in the public subnet route table to enable inbound internet traffic to the web tier, and security groups (SGs) are referenced by logical ID (Web SG, App SG, DB SG) to enforce strict, stateful traffic flow: Web SG allows HTTPS from 0.0.0.0/0, App SG allows traffic only from Web SG, and DB SG allows traffic only from App SG. This layered SG approach ensures that each tier can only be reached from the preceding tier, meeting the access requirements without relying on network ACLs or routing.

Answer

Public subnet route table: 0.0.0.0/0 -> NAT Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.

Answer

Private subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from 0.0.0.0/0 on port 3306.

Question 5

A company is deploying an application that requires low-latency communication between EC2 instances in two different AWS Regions. The application traffic is latency-sensitive and the company wants to minimize jitter. Which network design provides the lowest and most consistent latency?

Accepted Answer

Deploy an AWS Global Accelerator with endpoints in both Regions and use the accelerator's static IP addresses for communication.. AWS Global Accelerator uses the AWS global network and Anycast static IP addresses to route traffic over optimized paths, providing lower and more consistent latency than VPC peering, internet transit, or VPNs. It minimizes jitter by avoiding the public internet and leveraging AWS's internal backbone, which is ideal for latency-sensitive inter-Region communication.

Answer

Create a VPC peering connection between the two VPCs and route traffic through the peering connection.

Answer

Use internet gateways and route traffic over the public internet between the instances.

Answer

Use a Site-to-Site VPN connection between the two VPCs over the internet.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to two on-premises data centers, each with overlapping CIDR blocks (192.168.0.0/16). The company wants to use AWS Site-to-Site VPN with dynamic routing (BGP). Which design allows the VPC to reach both data centers without route conflicts?

Accepted Answer

Create two separate virtual private gateways, each in a different VPC, and use VPC peering. Alternatively, use a transit gateway with separate VPN attachments and BGP communities to tag routes.. Option C is correct because overlapping CIDR blocks cannot be advertised to the same virtual private gateway (VPG) without causing route conflicts. By using a transit gateway with separate VPN attachments, each data center's routes are isolated in separate route tables, and BGP communities can be used to tag and differentiate routes. This design allows the VPC to reach both data centers by leveraging the transit gateway's ability to manage overlapping prefixes through separate route tables and path selection.

Answer

Create two VPN connections to a single virtual private gateway and advertise the same CIDR from both data centers. Use BGP AS_PATH prepending to influence routing.

Answer

Create a single VPN connection with two tunnels to the same virtual private gateway. Use different BGP ASNs for each data center.

Answer

Create two VPN connections to the same virtual private gateway. Use static routes with different metric values.

Question 7

Which TWO of the following are valid components of an AWS Transit Gateway design for connecting multiple VPCs and on-premises networks?

Accepted Answer

Transit Gateway route table. Option D is correct because a Transit Gateway route table is a fundamental component that controls how traffic is routed between attachments (VPCs, VPNs, Direct Connect) within the Transit Gateway. Each attachment is associated with exactly one route table, and route propagation enables dynamic learning of routes across the network.

Answer

VPC Endpoint Gateway

Answer

Transit Gateway endpoint attached to a subnet in a VPC

Answer

Direct Connect Gateway associated with a Transit Gateway

Question 8

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Accepted Answer

You can assign different weights to endpoints in different Regions to control traffic distribution.. Option B is correct because AWS Global Accelerator allows you to assign different weights to endpoints in different Regions, enabling granular control over traffic distribution for active-active architectures. This is achieved through endpoint group weights, where you can adjust the proportion of traffic sent to each Regional endpoint group, supporting scenarios like gradual rollouts or load balancing across Regions.

Answer

Global Accelerator supports sticky sessions (session affinity) based on client IP.

Answer

Global Accelerator provides a set of static IP addresses that are unique to each Region.

Question 9

A network engineer analyzes a VPC Flow Log entry showing an ACCEPT for a TCP connection from 203.0.113.50 (internet) to 10.0.1.5 on port 443. The security group for the instance allows inbound HTTPS only from 10.0.0.0/16, and the NACL for the subnet has the rules shown. Why was the traffic accepted?

Accepted Answer

The flow log entry represents outbound traffic from the instance (source 10.0.1.5:443 to destination 203.0.113.50:38000). The security group's default outbound rule allows all traffic, and the NACL outbound (not shown) also allows it, resulting in ACCEPT.. The VPC Flow Log entry shows an ACCEPT for traffic from 203.0.113.50:38000 to 10.0.1.5:443. Because flow logs record connection state, this entry actually represents the return traffic of an outbound connection initiated by the instance (10.0.1.5) to the internet host on port 443. The security group's default outbound rule allows all traffic, and the NACL outbound rules (not shown) also permit it, so the return ACCEPT is valid.

Answer

The NACL inbound rule #120 allows HTTPS from 10.0.0.0/16, but the source is 203.0.113.50, so it should be denied.

Answer

The NACL inbound rule #100 allows HTTP from anywhere, and the traffic is HTTP.

Answer

The security group allows inbound HTTPS from 10.0.0.0/16, but the flow log source is 203.0.113.50, so it should be denied. The ACCEPT must be an error.

Question 10

A company is designing a multi-Region architecture using AWS Transit Gateway and Direct Connect. They have VPCs in us-east-1 and eu-west-1, each with an attached Transit Gateway. The Direct Connect gateway is associated with the Transit Gateway in us-east-1. They need to enable communication between VPCs across Regions using the Direct Connect gateway. What is the correct design to achieve this?

Accepted Answer

Create a Transit Gateway peering attachment between the Transit Gateways in us-east-1 and eu-west-1, and route traffic over the Direct Connect gateway via the peering.. Option C is correct because Transit Gateway peering attachments allow transitive routing between Transit Gateways in different AWS Regions. By establishing a peering attachment between the Transit Gateways in us-east-1 and eu-west-1, traffic from the VPC in eu-west-1 can be routed through its local Transit Gateway, across the peering attachment to the Transit Gateway in us-east-1, and then over the Direct Connect gateway to on-premises networks. This design enables cross-region VPC communication via Direct Connect without requiring a single Transit Gateway or direct VPC peering.

Answer

Create a single Transit Gateway that spans both Regions and attach VPCs in both Regions.

Answer

Use VPC peering between the VPCs and route Direct Connect traffic through the VPC peering connection.

Answer

Associate the Direct Connect gateway with both Transit Gateways in us-east-1 and eu-west-1.

Question 11

A company has a hub-and-spoke network topology using AWS Transit Gateway in us-east-1. The hub VPC hosts centralized inspection appliances from a third-party vendor. The spokes include VPCs with application workloads and a Direct Connect VIF attached to a Direct Connect gateway which is associated with the Transit Gateway. The company notices that traffic from the on-premises network to the spoke VPCs is not being inspected by the centralized appliances. They have verified that the Transit Gateway route tables are correctly configured with static routes pointing to the inspection VPC for all spoke CIDRs, and the inspection appliances are properly configured to forward traffic. What is the most likely cause of this issue?

Accepted Answer

The Transit Gateway route table associated with the Direct Connect gateway attachment does not have a route that sends traffic to the inspection VPC.. Option B is correct because in a hub-and-spoke topology with AWS Transit Gateway, traffic from on-premises (via Direct Connect) to spoke VPCs must be routed through the inspection VPC. This requires the Transit Gateway route table associated with the Direct Connect gateway attachment to contain a static route pointing to the inspection VPC attachment for the spoke CIDRs. Without this route, traffic bypasses inspection entirely.

Answer

The Direct Connect gateway is not propagating routes to the Transit Gateway, causing the on-premises traffic to be dropped.

Answer

The inspection VPC is sending traffic back to the on-premises network via a different path, causing asymmetric routing that drops packets.

Answer

The Transit Gateway route table for the spoke VPC attachments does not have a route to the on-premises network via the Direct Connect gateway.

Question 12

A startup is launching a new web application on AWS and needs to design a highly available and secure network architecture. The application will run on EC2 instances in an Auto Scaling group across two Availability Zones in a single region. The application must be accessible from the internet over HTTPS. The company expects variable traffic and wants to reduce costs where possible. They also need to protect against common web exploits like SQL injection and cross-site scripting. Which combination of AWS services should be used for the network design?

Accepted Answer

Use an Application Load Balancer (ALB) in public subnets. Enable AWS WAF on the ALB. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.. Option B is correct because an Application Load Balancer (ALB) in public subnets can terminate HTTPS and distribute traffic to EC2 instances in private subnets, which enhances security by removing direct internet access from the instances. Enabling AWS WAF on the ALB protects against common web exploits like SQL injection and cross-site scripting. A NAT gateway in public subnets provides outbound internet access for instances in private subnets, which is cost-effective for variable traffic as it scales automatically and incurs charges only when used.

Answer

Use an Application Load Balancer (ALB) in private subnets. Enable AWS WAF on the ALB. Place EC2 instances in public subnets with a VPC endpoint for outbound traffic.

Answer

Use an Application Load Balancer (ALB) in public subnets. Use a VPC endpoint for outbound traffic. Place EC2 instances in public subnets with Elastic IPs.

Answer

Use a Network Load Balancer (NLB) in public subnets. Enable AWS Shield Advanced for DDoS protection. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

Question 13

A financial services company is designing a hybrid network architecture using AWS Direct Connect. They have a Direct Connect connection with a public VIF and a private VIF. The private VIF is associated with a Direct Connect gateway that is attached to a Transit Gateway in us-east-1. The Transit Gateway has attachments to a production VPC and a shared services VPC. The company wants to ensure that all traffic from the on-premises network to the production VPC flows through a centralized inspection appliance in the shared services VPC for security compliance. Additionally, traffic from the production VPC to the internet must use a NAT gateway in the shared services VPC. The inspection appliance in the shared services VPC performs stateful inspection and must see both directions of traffic. The network engineer configured the following route tables: In the Transit Gateway route table associated with the Direct Connect gateway attachment, a static route for 0.0.0.0/0 points to the shared services VPC attachment. In the Transit Gateway route table associated with the production VPC attachment, a static route for the on-premises CIDR (10.0.0.0/8) points to the shared services VPC attachment. In the Transit Gateway route table associated with the shared services VPC attachment, a static route for the on-premises CIDR points to the Direct Connect gateway attachment, and a static route for 0.0.0.0/0 points to the Direct Connect gateway attachment (for outbound internet traffic, the shared services VPC has its own internet gateway and NAT gateway). The production VPC has a default route (0.0.0.0/0) pointing to the Transit Gateway. The shared services VPC has a default route pointing to the NAT gateway. However, traffic from on-premises to the production VPC is not being inspected; it goes directly to the production VPC. What is the most likely reason?

Accepted Answer

The Transit Gateway route table associated with the Direct Connect gateway attachment has propagation enabled, which installs a more specific route for the production VPC CIDR directly to the production VPC attachment, bypassing the shared services VPC.. Option A is correct because when propagation is enabled on the Transit Gateway route table associated with the Direct Connect gateway attachment, the production VPC CIDR is automatically learned as a more specific route (e.g., 10.1.0.0/16) pointing directly to the production VPC attachment. This more specific route overrides the static 0.0.0.0/0 route that was intended to force traffic through the shared services VPC, causing on-premises traffic to bypass the inspection appliance.

Answer

The shared services VPC has a default route pointing to the NAT gateway, which is not a valid next hop for traffic coming from the Transit Gateway.

Answer

The production VPC route table has a default route pointing to the Transit Gateway, but the NAT gateway is in the shared services VPC, causing asymmetric routing.

Answer

The Transit Gateway route table associated with the shared services VPC attachment does not have a route for the production VPC CIDR pointing to the production VPC attachment, so return traffic cannot reach production.

Question 14

A large e-commerce company operates a multi-tier application across multiple AWS accounts. The web tier is in a VPC (10.0.0.0/16) in Account A, and the application tier is in a separate VPC (10.1.0.0/16) in Account B. Both VPCs are connected via a VPC peering connection. The application tier uses an NLB to distribute traffic to EC2 instances in private subnets. The web tier sends traffic to the NLB's private IP address. Recently, the company migrated the application tier to use AWS PrivateLink instead of the VPC peering connection, creating a VPC endpoint service in Account B and an interface VPC endpoint in Account A. After the migration, the web tier cannot connect to the application tier. The security groups and NACLs allow the traffic. Which of the following is the MOST likely cause of the connectivity issue?

Accepted Answer

The web tier instances are using the private IP address of the Network Load Balancer instead of the VPC endpoint DNS name or private IP addresses.. After migrating from VPC peering to AWS PrivateLink, the web tier instances must use the VPC endpoint's DNS name or its private IP addresses to connect to the application tier. The VPC endpoint provides a different set of IP addresses (from the subnet in Account A) than the NLB's private IP, which remains in Account B. Since the web tier continues to send traffic to the NLB's private IP, the packets are not routed through the VPC endpoint, causing connectivity failure because the VPC peering connection is no longer available.

Answer

The route tables in Account A's VPC do not have a route to the VPC endpoint service in Account B.

Answer

The VPC endpoint in Account A requires an Internet Gateway (IGW) to route traffic to the VPC endpoint service in Account B.

Answer

The Network Load Balancer in Account B is not configured to support TCP traffic.

Question 15

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs: