ANS-C01 Network Design Practice Test 20 — 15 Questions

Question 1

A company is designing a global network with multiple AWS Regions. The company needs to connect VPCs in different Regions with low latency and high throughput. Which THREE services should the company consider? (Choose three.)

Accepted Answer

AWS Transit Gateway inter-Region peering. Options A, C, and D are correct. AWS Transit Gateway supports cross-region peering. AWS Direct Connect can be used with Direct Connect Gateway to connect multiple Regions. AWS Global Accelerator improves performance by routing traffic over the AWS global network. Option B is wrong because VPC Peering can be cross-region but is limited. Option E is wrong because CloudFront is a CDN, not for VPC connectivity.

Answer

Amazon CloudFront

Answer

VPC Peering

Question 2

A company has a multi-tier web application running on EC2 instances in a VPC. The web tier must be accessible from the internet, but the application tier should only be accessible from the web tier. Which network design configuration meets these requirements?

Accepted Answer

Place web servers in a public subnet with an internet gateway, and application servers in a private subnet with a route to the web subnet via a VPC peering connection.. Option A is correct because public subnets with internet gateways allow internet access, and private subnets without direct internet access ensure the application tier is only reachable from the web tier via internal routing. Option B is wrong because NAT gateways are for outbound internet access from private subnets, not for inbound. Option C is wrong because VPC peering does not provide internet access. Option D is wrong because a VPN connection is for on-premises connectivity, not internet access.

Answer

Use a VPN connection from the web tier to the application tier, and place both tiers in private subnets.

Answer

Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.

Answer

Place web servers in a public subnet with a NAT gateway, and application servers in a private subnet with a default route to the NAT gateway.

Question 3

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC will host multiple environments (dev, test, prod) and requires subnets in three Availability Zones. The network engineer must allocate subnets efficiently while reserving at least 25% of the address space for future growth. What is the minimum subnet size that should be used for each environment?

Accepted Answer

/20. Option B is correct. The total /16 has 65536 addresses. Reserving 25% leaves 49152 addresses for use. With 3 environments × 3 AZs = 9 subnets, each subnet gets 5461 addresses on average. A /19 subnet provides 8191 addresses per subnet, totaling 9×8191=73719, which exceeds the available 49152. A /20 provides 4095 addresses per subnet (9×4095=36855), which is within the available 49152 and allows efficient use. The smallest subnet that fits the requirement is /20. Option A (/18) is too large, C (/21) provides too few addresses per subnet, D (/22) also insufficient.

Answer

/18

Answer

/22

Answer

/21

Question 4

A solutions architect needs to design a VPC with both IPv4 and IPv6 support. The VPC will have public and private subnets. Resources in private subnets need outbound IPv6 access to the internet. Which combination of resources should be used?

Accepted Answer

Internet gateway for public subnets and egress-only internet gateway for private subnets. Option D is correct because an egress-only internet gateway (EIGW) is the AWS-managed service designed specifically to provide outbound-only IPv6 access from private subnets to the internet, while an internet gateway (IGW) handles both inbound and outbound IPv4/IPv6 traffic for public subnets. Unlike a NAT gateway, which only supports IPv4, the EIGW works with IPv6 and prevents any inbound IPv6 connections from the internet, meeting the requirement for outbound-only IPv6 access.

Answer

Internet gateway for public subnets and VPC gateway endpoints for private subnets

Answer

Internet gateway for public subnets and NAT gateway for private subnets

Answer

Internet gateway for both public and private subnets using route tables

Question 5

Refer to the exhibit. An EC2 instance launched in subnet-1a is unable to access the internet. Which is the most likely cause?

Accepted Answer

Subnet-1a does not assign public IP addresses automatically.. Option C is correct. Subnet-1a is associated with route table rtb-main which has a default route to an internet gateway, but the subnet does not have MapPublicIpOnLaunch set to true (it is false). For a subnet to have internet access via an internet gateway, instances must have public IP addresses. Option A is wrong because the route table has a default route to the internet gateway. Option B is wrong because the route table is associated with the subnet. Option D is wrong because the VPC has DNS hostnames enabled, but that does not affect internet access.

Answer

The route table rtb-main does not have a default route to the internet gateway.

Answer

The VPC does not have DNS hostnames enabled.

Answer

Subnet-1a is not associated with any route table.

Question 6

A financial services company requires that all traffic between two VPCs in the same region be encrypted in transit. The VPCs are in separate AWS accounts and use non-overlapping CIDR blocks. Which solution meets the requirement with the least operational overhead?

Accepted Answer

Set up a VPC peering connection and configure VPN encryption using a virtual private gateway in each VPC.. Option A is correct because it combines a VPC peering connection (for private, low-latency connectivity between VPCs in the same region) with VPN encryption via a virtual private gateway in each VPC. This ensures all traffic between the VPCs is encrypted in transit, meeting the compliance requirement with minimal operational overhead, as it leverages existing AWS-managed VPN capabilities without requiring additional third-party appliances or complex routing.

Answer

Use VPC endpoints to connect the VPCs via AWS PrivateLink.

Answer

Attach both VPCs to an AWS Direct Connect connection.

Answer

Establish a VPC peering connection between the VPCs.

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN. What configuration change is required to avoid routing conflicts?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16.. The VPC CIDR 10.0.0.0/16 is a subset of the on-premises CIDR 10.0.0.0/8. AWS Site-to-Site VPN cannot route traffic correctly when the VPC and on-premises networks have overlapping IP ranges because the VPN connection relies on distinct destination prefixes. The only way to eliminate the conflict is to change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, ensuring no IP address overlap between the two networks.

Answer

Create a more specific route in the VPC route table for the on-premises CIDR.

Answer

Enable route propagation on the VPC route tables.

Answer

Use a VPN connection with static routes instead of BGP.

Question 8

An application running on EC2 instances in a private subnet needs to download patches from the internet. The VPC has an internet gateway and public subnets. Which resource should be used to provide outbound internet access to the instances?

Accepted Answer

NAT gateway in a public subnet. A NAT gateway in a public subnet provides outbound-only internet access to instances in private subnets by translating their private IP addresses to the NAT gateway's Elastic IP address. This allows the EC2 instances to download patches from the internet while preventing any unsolicited inbound connections from the internet, which is the standard design for secure outbound internet access in a VPC.

Answer

VPC gateway endpoint for S3

Answer

AWS Site-to-Site VPN connection

Answer

Internet gateway in the private subnet

Question 9

A company is designing a VPC with multiple subnets across three Availability Zones. The application requires that all traffic between subnets within the same AZ stay within that AZ to minimize latency and data transfer costs. Which configuration achieves this?

Accepted Answer

Create a route table for each AZ and associate the subnets in that AZ with the route table. Ensure the route tables have only local routes for the VPC CIDR.. Option A is correct. By creating separate route tables for each AZ and ensuring that routes for other AZs use the local route (which keeps traffic within the VPC), traffic between subnets in the same AZ will stay within the AZ because AWS uses local routing within the same AZ by default. Option B is wrong because a single route table would not segregate traffic by AZ. Option C is wrong because VPC peering is for cross-VPC. Option D is wrong because a transit gateway would route traffic centrally, not necessarily keep it within the AZ.

Answer

Use a single route table for all subnets and add specific routes for each AZ.

Answer

Use an AWS Transit Gateway with separate attachments for each AZ.

Answer

Create a VPC peering connection between subnets in the same AZ.

Question 10

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

Accepted Answer

The PrivateRoute resource references the NAT gateway before it is created.. Option C is correct. The PrivateRoute uses a NatGatewayId but the NAT gateway is defined after the route in the template, and the route has no DependsOn to ensure the NAT gateway is created first. This can cause a dependency error or the route to reference a non-existent resource. Option A is wrong because the private subnet does not need MapPublicIpOnLaunch. Option B is wrong because NAT gateways do not support IPv6, but the question is about internet access (IPv4). Option D is wrong because the route table is associated with the private subnet.

Answer

The private subnet is not associated with any route table.

Answer

The NAT gateway does not support IPv6 traffic.

Answer

The private subnet does not have MapPublicIpOnLaunch set to true.

Question 11

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC must support IPv6 and have subnets in three Availability Zones. The company plans to use an AWS Transit Gateway to connect multiple VPCs. Which TWO actions are required to enable IPv6 communication between VPCs through the Transit Gateway?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and enable IPv6 on subnets.. Option A is correct: IPv6 must be enabled on the VPC and subnets. Option C is correct: The Transit Gateway must be configured with IPv6 support. Option B is wrong because NAT gateways do not support IPv6. Option D is wrong because egress-only internet gateways are for internet access, not inter-VPC traffic. Option E is wrong because VPC endpoints do not provide transit routing.

Answer

Use VPC endpoints to route IPv6 traffic between VPCs.

Answer

Attach an egress-only internet gateway to the Transit Gateway.

Answer

Create a NAT gateway and attach it to the Transit Gateway.

Question 12

A company has a VPC with public and private subnets. The private subnets must access an S3 bucket without traversing the internet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Create a VPC gateway endpoint for S3 and associate it with the private subnet route tables.. Option A is correct: A VPC gateway endpoint for S3 allows private subnet instances to access S3 privately. Option B is correct: AWS PrivateLink (VPC endpoint services) can also provide private access to S3 if the bucket is configured as an endpoint service. Option C is wrong because NAT gateway routes through the internet. Option D is wrong because a VPN does not provide private S3 access. Option E is wrong because an internet gateway exposes traffic to the internet.

Answer

Attach an internet gateway to the VPC and route traffic through it.

Answer

Set up a VPN connection to the on-premises network and access S3 from there.

Answer

Place a NAT gateway in the public subnet and route traffic through it.

Question 13

A company is designing a VPC for a web application that requires high availability. The application will be deployed across multiple Availability Zones. Which THREE components are essential for a highly available network design? (Choose THREE.)

Accepted Answer

Subnets in at least two Availability Zones. Option A is correct: Multiple AZs ensure availability if one AZ fails. Option B is correct: An internet gateway provides internet access. Option D is correct: A NAT gateway in each AZ ensures outbound internet access even if one AZ fails. Option C is wrong because a single VPN connection is a single point of failure. Option E is wrong because VPC peering is for connecting VPCs, not for high availability within a VPC.

Answer

A single VPN connection to on-premises

Answer

VPC peering with a backup VPC

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16 and wants to connect to another VPC with CIDR 10.0.0.0/16 in a different account. The VPCs are in the same region. Which THREE steps are necessary to establish connectivity? (Choose THREE.)

Accepted Answer

Change the CIDR block of one VPC to a non-overlapping range.. Option A is correct: Overlapping CIDRs must be resolved, typically by changing one VPC's CIDR. Option B is correct: VPC peering requires a request from one account and acceptance from the other. Option D is correct: Route tables must be updated to route traffic to the peering connection. Option C is wrong because a VPN is unnecessary. Option E is wrong because VPC endpoints are for accessing services, not for VPC peering.

Answer

Create VPC endpoints in each VPC for the other VPC's services.

Answer

Set up a VPN connection between the VPCs.

Question 15

A company is designing a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which THREE design elements are required? (Choose THREE.)

Accepted Answer

A public subnet for the web tier with an internet gateway. Option A is correct: Public subnet for web servers. Option B is correct: Private subnet for application servers. Option D is correct: Private subnet for database servers. Option C is wrong because a NAT gateway is not required for inbound access; outbound access for private subnets may be needed but is not specified. Option E is wrong because a VPN is not required.

Answer

A NAT gateway in the public subnet for outbound traffic from private subnets

Answer

A VPN connection to on-premises