ANS-C01 Network Design Practice Test 2 — 15 Questions

Question 1

A financial services company requires that all traffic between two VPCs in the same region be encrypted in transit. The VPCs are in separate AWS accounts and use non-overlapping CIDR blocks. Which solution meets the requirement with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use VPC endpoints to connect the VPCs via AWS PrivateLink.. AWS PrivateLink (VPC endpoints) allows you to connect VPCs privately using AWS's internal network. Traffic between VPC endpoints and services is encrypted using TLS/SSL by default, meeting the encryption-in-transit requirement with minimal operational overhead. No additional VPN configurations or third-party appliances are needed, making it the simplest solution.

Answer

Set up a VPC peering connection and configure VPN encryption using a virtual private gateway in each VPC.

Answer

Attach both VPCs to an AWS Direct Connect connection.

Answer

Establish a VPC peering connection between the VPCs.

Question 2

A company wants to provide its employees with access to a set of internal web applications hosted in a VPC. The applications are accessed via an internet-facing ALB. Security requirements mandate that employees connect only from the corporate network (on-premises) and not from the public internet. Which solution meets these requirements?

Accepted Answer

Set up an AWS Client VPN endpoint in the VPC and make the ALB internal. Employees connect via the VPN.. Making the ALB internal ensures it is only reachable from within the VPC, and using an AWS Client VPN endpoint provides a secure, authenticated tunnel from the corporate network. This enforces the requirement that employees connect only from on-premises, as traffic must traverse the VPN and cannot originate from the public internet.

Answer

Make the ALB internal and use a NAT gateway to provide internet access.

Answer

Deploy a CloudFront distribution with an origin access identity pointing to the ALB.

Answer

Keep the ALB internet-facing but restrict access using a security group that allows only the corporate public IP range.

Question 3

A company is designing a Direct Connect solution for high availability. Which TWO actions meet the requirement for diverse physical paths?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Provisioning two Direct Connect connections at two different Direct Connect locations ensures physical path diversity, eliminating a single point of failure. Option C is correct because using a Transit Gateway with attachments to multiple Direct Connect gateways allows traffic to be routed over separate connections; when these connections are established at different Direct Connect locations, they provide the required diverse physical paths. (Note: The diversity comes from the connections being at different locations, not just from the use of Transit Gateway or multiple gateways.)

Answer

Provision two Direct Connect connections at the same Direct Connect location.

Answer

Provision a single Direct Connect connection and use link aggregation (LAG).

Answer

Use a single Direct Connect connection with a VPN backup.

Question 4

An engineer runs the command above for a subnet associated with this network ACL. The subnet's CIDR is 10.0.1.0/24. An EC2 instance in the subnet attempts to initiate an HTTPS connection to a server on the internet. What is the result?

Accepted Answer

The connection fails because the inbound HTTPS return traffic is denied by rule 200.. Based on the provided network ACL exhibit, inbound rule 200 denies all traffic (0.0.0.0/0, ALL traffic). Even though outbound HTTPS is allowed, the return traffic for the HTTPS connection (which is inbound) is evaluated against the inbound rules. Since rule 200 denies all inbound traffic, the return packets are dropped, causing the connection to fail. Network ACLs are stateless, so both inbound and outbound rules must explicitly allow the traffic.

Answer

The connection fails because the outbound rule does not allow HTTPS.

Answer

The connection succeeds because outbound traffic is allowed.

Answer

The connection succeeds because inbound rule 100 allows HTTPS from the subnet.

Question 5

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host databases that must be accessible only from the application servers in the public subnets. Which VPC feature should be used to allow the application servers to access the databases while preventing direct internet access to the databases?

Accepted Answer

Attach a NAT Gateway in a public subnet and update the route table of the private subnets to point to the NAT Gateway for outbound traffic.. Although application servers in public subnets can reach databases in private subnets using private IPs within the VPC, a NAT Gateway enables instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while blocking inbound traffic from the internet. This meets the requirement to prevent direct internet access to the databases. The private subnet route table is updated to direct 0.0.0.0/0 traffic to the NAT Gateway, and because there is no route to an Internet Gateway, the databases remain inaccessible from the internet.

Answer

Create a VPC Peering connection between the public and private subnets.

Answer

Attach an Internet Gateway to the VPC and update the route table of the private subnets to point to the Internet Gateway.

Answer

Attach a Virtual Private Gateway to the VPC and update the route table of the private subnets.

Question 6

A company needs to provide secure access to an Amazon S3 bucket for a third-party partner. The partner has their own AWS account. The company wants to avoid exposing the bucket to the public internet. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for S3 in your VPC and allow the partner to access the bucket through a VPC peering connection. A VPC Gateway Endpoint for S3 allows private connectivity to S3 without traversing the public internet. By creating a VPC peering connection between the company's VPC and the partner's VPC, the partner can access the S3 bucket through the gateway endpoint, ensuring the bucket remains private and not exposed to the internet.

Answer

Set up Amazon CloudFront with an origin access identity (OAI)

Answer

Use pre-signed URLs generated by AWS Lambda

Answer

Configure an S3 bucket policy that grants access to the partner's AWS account

Question 7

A company is designing a network for a real-time financial trading application. The application requires deterministic low-latency connectivity between two EC2 instances in different Availability Zones within the same VPC. Which placement group type and networking feature should the company use?

Accepted Answer

Spread placement group and EC2 networking with jumbo frames. Spread placement groups can span multiple Availability Zones, meeting the requirement for cross-AZ connectivity. Jumbo frames reduce network overhead and latency by increasing the maximum transmission unit, providing deterministic low latency for real-time financial trading. Other options either use cluster placement groups (limited to a single AZ) or lack the latency benefits of jumbo frames.

Answer

Partition placement group and Elastic Network Adapter (ENA) with SR-IOV

Answer

Cluster placement group and standard TCP/IP networking

Answer

Cluster placement group and Elastic Fabric Adapter (EFA)

Question 8

A company is migrating its on-premises data center to AWS. The network team needs to establish connectivity between the on-premises network and multiple VPCs in a single AWS Region. The company has a Direct Connect connection and wants to minimize latency and cost while maximizing bandwidth utilization. Which solution meets these requirements?

Accepted Answer

Use a Direct Connect gateway and associate it with the VPCs.. A Direct Connect gateway allows a single Direct Connect connection to connect to multiple VPCs in the same or different AWS Regions, minimizing latency by using a private, dedicated network path and reducing cost by eliminating the need for separate virtual interfaces or VPN tunnels per VPC. It also maximizes bandwidth utilization by aggregating traffic from multiple VPCs over the same Direct Connect link.

Answer

Provision a separate Direct Connect virtual interface for each VPC.

Answer

Create a VPN connection over the Direct Connect link to each VPC.

Answer

Use VPC peering between the on-premises network and each VPC.

Question 9

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

Accepted Answer

Enable jumbo frames on the transit VPC's EC2-based virtual appliances.. The issue is intermittent connectivity between an on-premises office in ap-southeast-1 and a spoke VPC in eu-west-1, traversing a transit VPC in us-east-1. The VPN is up, so the problem is likely packet fragmentation or MTU mismatch across the long-haul path. Enabling jumbo frames on the transit VPC's EC2-based virtual appliances (e.g., firewall or router instances) increases the maximum transmission unit, reducing fragmentation and improving performance for large packets, which is a common cause of intermittent issues in hub-and-spoke topologies.

Answer

Change the VPN connection from static to dynamic routing.

Answer

Enable BGP route propagation on the transit VPC's route tables.

Answer

Deploy a new transit VPC in eu-west-1.

Question 10

A company is designing a network for a three-tier web application in a single VPC. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The application servers need to make outbound calls to a third-party API. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Application Load Balancer, application servers in private subnets with a NAT gateway, and database servers in private subnets.. It places web servers in public subnets with an Application Load Balancer for inbound internet traffic, while application and database servers reside in private subnets without direct internet access. A NAT gateway in a public subnet enables the application servers to initiate outbound connections to a third-party API, with return traffic automatically routed back, meeting the requirement for outbound-only internet access.

Answer

Web servers in public subnets, application and database servers in private subnets with an internet gateway for outbound traffic.

Answer

All servers in public subnets with security groups restricting access.

Answer

All servers in private subnets and a VPN connection to the internet.

Question 11

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs in the same AWS Region. The company wants to use AWS Transit Gateway to simplify connectivity between these VPCs and their on-premises network. Which steps are required to integrate the existing Direct Connect connection with Transit Gateway?

Accepted Answer

Create a Direct Connect gateway, associate the existing VIFs, and attach the Direct Connect gateway to the Transit Gateway.. AWS Direct Connect private VIFs cannot be attached directly to a Transit Gateway. Instead, you must create a Direct Connect Gateway, associate the existing private VIFs with it, and then attach the Direct Connect Gateway to the Transit Gateway. This architecture allows the Transit Gateway to route traffic between the on-premises network (via the Direct Connect connection) and the attached VPCs, while also enabling inter-VPC routing through the Transit Gateway.

Answer

Set up a VPN connection over the Direct Connect link and attach the VPN to the Transit Gateway.

Answer

Attach the existing private VIFs directly to the Transit Gateway.

Answer

Create a new private VIF on the Direct Connect connection and attach it to the Transit Gateway.

Question 12

A company is designing a multi-region architecture with VPCs in us-east-1 and eu-west-1. The company needs low-latency connectivity between the VPCs and wants to avoid traffic over the public internet. The VPCs have overlapping CIDR blocks (10.0.0.0/16). Which solution should the network engineer recommend?

Accepted Answer

Set up an AWS Transit Gateway in each region and connect them via Transit Gateway peering.. AWS Transit Gateway supports inter-region peering, which uses the AWS global backbone to provide low-latency, private connectivity between VPCs in different regions without traversing the public internet. This solution also handles overlapping CIDRs by using separate route tables per VPC attachment, ensuring isolation. Option B (Direct Connect) is used for on-premises connectivity, not inter-region. Option C (VPC peering) does not support overlapping CIDRs. Option D (single VPC) does not meet the multi-region requirement.

Answer

Use a Direct Connect connection between the regions.

Answer

Use VPC peering between the two VPCs.

Answer

Place all resources in a single VPC with multiple Availability Zones.

Question 13

A company is designing a hybrid network using AWS Transit Gateway. The company has three VPCs (VPC-A, VPC-B, VPC-C) all attached to the same Transit Gateway. The on-premises network connects to the Transit Gateway via a Direct Connect gateway. The company needs to ensure that VPC-C can communicate with the on-premises network but not with VPC-A or VPC-B. Which TWO actions should the network engineer take?

Accepted Answer

Associate the VPC-C route table with the Direct Connect gateway attachment.. Associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with the on-premises network via the Transit Gateway, enabling communication. Option D is correct because creating a separate Transit Gateway route table for VPC-C and not propagating VPC-A and VPC-B routes ensures that VPC-C has no routes to those VPCs, effectively isolating it from them at the network layer. Option A is incorrect because a VPN attachment does not provide connectivity to on-premises via Direct Connect; the Direct Connect gateway attachment is required. Option C is incorrect because VPC peering enables direct communication between VPCs, which is not desired. Option E is incorrect because network ACLs at the subnet level do not control routing across a Transit Gateway; route table isolation is needed.

Answer

Establish a VPN attachment between VPC-C and the Direct Connect gateway.

Answer

Establish VPC peering connections between VPC-C and VPC-A, and VPC-C and VPC-B.

Answer

Apply a network ACL on VPC-C subnets to block traffic from VPC-A and VPC-B.

Question 14

A company is deploying a new application in a VPC. The application consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB must only receive traffic from the company's on-premises network via an AWS Site-to-Site VPN. Which THREE steps should the network engineer take to meet this requirement?

Accepted Answer

Place the ALB in a private subnet and use a Transit Gateway.. To restrict ALB traffic exclusively to the on-premises network via Site-to-Site VPN, three steps are needed. First, place the ALB in a private subnet to keep it internal and use a Transit Gateway to route VPN traffic to private subnets. Second, configure the network ACL on the ALB's subnet to allow inbound traffic only from the on-premises CIDR. Third, configure the ALB's security group to allow inbound traffic from the same CIDR. Option B (public subnet) is incorrect because it would make the ALB internet-facing, which is unnecessary and less secure. Option E (NAT gateway) is irrelevant for inbound traffic restriction.

Answer

Place the ALB in a public subnet.

Answer

Create a NAT gateway in the public subnet for outbound traffic.

Question 15

A network engineer has configured an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer checks the VPN status and sees the output above. What is the MOST likely cause of Tunnel2 being down?

Accepted Answer

The IPsec encryption or integrity algorithms do not match between the AWS VPN endpoint and the on-premises device.. Tunnel2 is down while Tunnel1 is up, indicating a per-tunnel configuration mismatch. The most common cause is a mismatch in IPsec security parameters (encryption, integrity, or DH group) between the AWS VPN endpoint and the on-premises device for that specific tunnel. AWS uses separate pre-shared keys and IPsec settings per tunnel, so a mismatch in algorithms would affect only the misconfigured tunnel.

Answer

The BGP ASN on the on-premises device is misconfigured.

Answer

The route tables in the VPC do not have a route to the on-premises network.

Answer

The IKE pre-shared key used for Tunnel2 is incorrect.