ANS-C01 Network Design Practice Test 2 — 15 Questions

Question 1

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application servers are in private subnets behind Network Load Balancers (NLBs). The company needs to ensure that traffic from a client is consistently routed to the same ALB endpoint for the duration of a session. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable client IP address preservation on the Global Accelerator endpoint groups and configure stickiness on the ALB based on the client IP.. Global Accelerator preserves the client IP address when client IP address preservation is enabled on the endpoint group, allowing the ALB to see the original client IP. Configuring stickiness on the ALB based on the client IP ensures that all requests from the same client IP are routed to the same ALB endpoint for the duration of the session, which is essential for session persistence in an active-active multi-region architecture.

Answer

Configure cross-zone load balancing on the NLBs and enable stickiness on the target groups.

Answer

Enable proxy protocol on the NLB target groups and configure stickiness on the NLB.

Answer

Enable stickiness on the ALB target groups with a duration of 1 second.

Question 2

A company is migrating a legacy on-premises application to AWS. The application requires multicast traffic between instances within a VPC. The network engineer must design a solution that supports multicast without modifying the application. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast domain.. AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows multicast traffic to flow between instances in different subnets within the same VPC or across attached VPCs without modifying the application. This is the only native AWS service that provides multicast forwarding, making it the correct choice for this requirement.

Answer

VPC peering connections between all instance subnets.

Answer

Application Load Balancer with UDP listener.

Answer

AWS Site-to-Site VPN connections with multicast routing enabled.

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to peer with another VPC that has a CIDR block of 10.0.0.0/16. What should the network engineer do to enable connectivity between the two VPCs?

Accepted Answer

Use an AWS Transit Gateway with Network Address Translation (NAT) to resolve overlapping CIDRs.. When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), a standard VPC peering connection cannot be established due to route table conflicts. An AWS Transit Gateway can be used with Network Address Translation (NAT) to translate the overlapping IP addresses, enabling connectivity between the VPCs by allowing traffic to be routed through the Transit Gateway with NAT applied to resolve the address conflict.

Answer

Use an internet gateway to route traffic between the VPCs.

Answer

Create a VPC peering connection and add routes in both route tables.

Answer

Create a VPC peering connection and use a network address translation (NAT) device.

Question 4

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and use it from the VPC.. A Gateway VPC Endpoint for S3 allows private access to S3 from within the VPC without traversing the internet or requiring public IPs. It avoids IP overlap because the endpoint uses prefix lists and route table entries within the VPC's 10.0.0.0/16 range, and does not involve the on-premises 10.0.0.0/8 network. The Direct Connect private VIF is not used for S3 traffic, so the overlapping CIDR is irrelevant.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it.

Answer

Use a public virtual interface and access S3 via public endpoints.

Answer

Add a route in the VPC route table pointing to the Direct Connect virtual interface for the S3 prefix list.

Question 5

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, while the application and database tiers must be in private subnets. The company wants to minimize the number of load balancers. Which design should be used?

Accepted Answer

Place an internet-facing Application Load Balancer in a public subnet, web tier instances in public subnets, and app/database instances in private subnets.. An internet-facing Application Load Balancer (ALB) in a public subnet can receive internet traffic and forward it to web tier instances in public subnets, while the application and database tiers remain in private subnets with no direct internet access. This design uses a single load balancer to handle all external traffic, minimizing the number of load balancers while maintaining security boundaries.

Answer

Place an internal Application Load Balancer in a private subnet and use a NAT gateway for internet access.

Answer

Place an internet-facing Network Load Balancer in a public subnet and use it for all tiers.

Answer

Place an internet-facing Application Load Balancer in a private subnet.

Question 6

A company is designing a VPC with the following requirements: (1) Ability to connect to on-premises via AWS Direct Connect with BGP, (2) Ability to route traffic between multiple VPCs, (3) Centralized inspection of traffic between VPCs. Which AWS services should the company use? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (C) is correct because it acts as a regional hub that connects multiple VPCs and on-premises networks, supports dynamic BGP routing, and enables centralized traffic inspection by attaching a security VPC or appliance for inspection between VPCs. Direct Connect Gateway (D) is correct because it allows a single AWS Direct Connect connection to reach multiple VPCs across regions via a transit gateway or virtual private gateway, and it supports BGP for advertising on-premises routes. VPC peering (A) is not suitable because it only connects two VPCs at a time, does not support transitive routing, and cannot provide centralized inspection. VPC endpoints (B) only provide private access to AWS services within a VPC and do not route traffic between VPCs or to on-premises. Site-to-Site VPN (E) is a backup or alternative to Direct Connect but does not meet the requirement for centralized multi-VPC routing and inspection by itself.

Answer

VPC peering connections

Answer

VPC endpoints

Answer

AWS Site-to-Site VPN

Question 7

A company is designing a global network with multiple VPCs connected via AWS Transit Gateway. The company wants to route traffic between VPCs through a centralized inspection VPC that hosts firewalls. Which configurations are required? (Choose THREE.)

Accepted Answer

Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.. Option A is correct because the Transit Gateway route table must have a default route (0.0.0.0/0) pointing to the inspection VPC attachment so that traffic without a more specific route is redirected through the centralized firewall VPC for inspection. Option C is correct because static routes in the Transit Gateway route tables are needed to direct traffic from the inspection VPC attachment back to the appropriate VPC attachments, ensuring return traffic and inspected traffic reach their destinations. Option D is correct because propagating VPC attachment routes to a dedicated route table allows the Transit Gateway to learn the CIDR ranges of the attached VPCs, which is essential for routing traffic between VPCs and toward the inspection VPC. Option B is not required because VPC endpoints are used for private access to AWS services, not for routing traffic between VPCs through a Transit Gateway. Option E is not required because VPC peering connections are unnecessary when using a Transit Gateway, and they would bypass the centralized inspection architecture.

Answer

Create VPC endpoints for the inspection services.

Answer

Establish VPC peering connections between each VPC and the inspection VPC.

Question 8

A company has a VPC with multiple subnets and uses an AWS Direct Connect private VIF for connectivity to on-premises. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection, while internet traffic uses an internet gateway. Which configurations must be applied? (Choose TWO.)

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway.. Option D is correct because the VPC route table must contain a specific route for the on-premises CIDR range (e.g., 192.168.0.0/16) with the virtual private gateway (VGW) as the target; the VGW is the AWS-side anchor for the Direct Connect private VIF, so this route directs on-premises-bound traffic over the Direct Connect connection. Option E is correct because internet-bound traffic requires a default route (0.0.0.0/0) pointing to the internet gateway (IGW) attached to the VPC, ensuring that traffic not matching the on-premises CIDR goes to the internet rather than the VGW. Option A is incorrect because there is no such thing as a VPC endpoint for Direct Connect; VPC endpoints are for AWS services (Gateway/Interface endpoints), not for DX connectivity. Option B is incorrect because a NAT gateway only provides outbound internet access for private subnets and is unrelated to directing on-premises traffic over Direct Connect. Option C is incorrect because pointing the default route to the virtual private gateway would send all internet-bound traffic to on-premises, which contradicts the requirement that internet traffic use the internet gateway.

Answer

Create a VPC endpoint for Direct Connect.

Answer

Deploy a NAT gateway in a public subnet.

Answer

Add a default route (0.0.0.0/0) pointing to the virtual private gateway.

Question 9

A network engineer is creating an IAM policy for a DevOps team. The team needs to manage VPN connections. What is the effect of this policy?

Accepted Answer

Allows full management of VPN connections and associated resources.. The IAM policy grants the `ec2:*` action on VPN-related resources (`*vpn*`), which includes all VPN connection operations (create, modify, delete, describe) and associated resources like VPN gateways and customer gateways. This full wildcard on VPN resources enables complete lifecycle management, making option B correct.

Answer

Denies deletion of VPN connections.

Answer

Restricts access to only VPN connections.

Answer

Allows read-only access to VPN configurations.

Question 10

A company needs to provide internet access to instances in a private subnet while preventing inbound connections from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It achieves this by translating the private source IP addresses of the instances to the NAT Gateway's Elastic IP address, and by default it does not allow inbound traffic unless an explicit inbound rule is added to the associated route table, which is not recommended for this use case.

Answer

Internet Gateway

Answer

AWS Direct Connect

Answer

VPC Endpoint

Question 11

A company is designing a hybrid network with AWS Direct Connect. They have multiple VPCs in the same Region and want to use a single Direct Connect connection to access all VPCs. Which AWS resource should be used?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows you to associate up to 10 Virtual Private Gateways (VGWs) or Transit Gateways in the same or different AWS accounts, enabling a single Direct Connect connection to reach multiple VPCs in the same Region. This is the correct resource because it acts as a hub that terminates the Direct Connect virtual interfaces (VIFs) and propagates routes to the associated VPCs via their VGWs or Transit Gateways.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

Virtual Private Gateway

Question 12

Which THREE are benefits of using AWS Transit Gateway over VPC peering in a multi-VPC environment? (Select THREE.)

Accepted Answer

Centralized management of network policies. Option A is correct because AWS Transit Gateway acts as a central hub where route tables, attachments, and network policies are managed in one place, rather than configuring individual peering connections and route entries across every VPC. Option E is correct because Transit Gateway supports transitive routing, so any attached VPC can reach any other attached VPC through the hub without needing a full mesh of peering connections. Option F is correct because Transit Gateway natively supports attaching AWS Site-to-Site VPN and AWS Direct Connect gateway connections, allowing on-premises networks to reach multiple VPCs through a single attachment. Option B is not a defining benefit, since VPC peering and Transit Gateway bandwidth are both constrained by instance and connection limits rather than Transit Gateway inherently providing higher per-connection bandwidth. Option C is not correct because for only a few VPCs, VPC peering is typically simpler to configure than deploying and managing a Transit Gateway. Option D is not correct because Transit Gateway charges hourly per attachment and per GB of data processed, which can make it more expensive than VPC peering for simple or low-traffic topologies.

Answer

Higher bandwidth per connection

Answer

Simpler configuration for a few VPCs

Answer

Lower cost compared to VPC peering

Question 13

An IAM policy is attached to a user who needs to manage VPC peering connections. The policy allows creating and accepting peering connections, but the user reports they cannot add routes to the route table of their VPC (vpc-11111111) for the peered connection. What is the most likely cause?

Accepted Answer

The condition in the policy restricts the VPC, but the route table is not associated with that VPC.. The IAM policy includes a condition that restricts the VPC (e.g., `ec2:Vpc` condition key set to `vpc-11111111`), but the route table the user is trying to modify is not associated with that VPC. Even though the user has permissions to create and accept peering connections, the condition on the route table modification action (like `ec2:CreateRoute`) limits the operation to route tables belonging to the specified VPC. Since the route table belongs to a different VPC or is not associated with `vpc-11111111`, the request fails.

Answer

The user does not have permission to create routes.

Answer

The user needs additional permissions for the peering connection.

Answer

The user needs to accept the peering connection first.

Question 14

A network administrator is troubleshooting connectivity to a web server in subnet with network ACL 'acl-12345678'. The web server is on port 443. The administrator finds that traffic from IP 10.0.1.5 is being denied. Why is the traffic being denied?

Accepted Answer

The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.. Network ACLs are stateless and evaluated in ascending order by rule number. Rule 100 denies traffic from 10.0.0.0/8, which includes the source IP 10.0.1.5, so any traffic from that IP is denied regardless of later allow rules. Since network ACLs do not track connection state, the deny is applied immediately upon matching rule 100.

Answer

The subnet is not associated with this network ACL.

Answer

The security group attached to the web server is blocking the traffic.

Answer

The network ACL rule 100 allows traffic from 0.0.0.0/0, but rule 200 denies traffic from 10.0.0.0/8, and rule 200 is evaluated first.

Question 15

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in us-east-1 and a Network Load Balancer (NLB) in eu-west-1. They need to route traffic from the ALB to the NLB using a fixed IP address. Which AWS service should be used to provide a static IP for the NLB and enable cross-region load balancing?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides two static anycast IP addresses that serve as a fixed entry point for traffic. It can route traffic from the ALB in us-east-1 to the NLB in eu-west-1 by using an endpoint group that includes the NLB's IP address, enabling cross-region load balancing with a static IP. This allows the ALB to forward traffic to the Global Accelerator's static IP, which then optimally routes to the NLB in the other region.

Answer

AWS WAF

Answer

Amazon CloudFront

Answer

AWS Transit Gateway