ANS-C01 Network Design Practice Test 20 — 15 Questions

Question 1

A company is deploying an internet-facing application in AWS. The application must only accept traffic from specific IP addresses of business partners. Which AWS service should be used to enforce this restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS WAF with an IP set rule. AWS WAF with an IP set rule is the correct choice because it operates at the application layer (Layer 7) and can inspect HTTP/HTTPS requests to allow or block traffic based on source IP addresses. This service is specifically designed to filter web traffic to internet-facing applications, making it ideal for enforcing IP-based restrictions from business partners. Network ACLs and Security Groups operate at the network and instance levels, respectively, and cannot provide the granular, application-layer control required for this use case.

Answer

Network ACLs with inbound allow rules

Answer

Security Groups with inbound allow rules

Answer

Amazon Route 53 geoproximity routing

Question 2

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.. A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows outbound IPv4 traffic from private subnets to the internet while preventing unsolicited inbound connections. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling the EC2 instance to download patches without being directly exposed.

Answer

Use VPC Gateway Endpoints for S3 and DynamoDB.

Answer

Attach an Internet Gateway to the VPC and assign a public IP to the instance.

Answer

Configure a VPN connection from the VPC to an on-premises network that has internet access.

Question 3

A company has multiple VPCs connected via a Transit Gateway. Each VPC has its own CIDR block. The company wants to isolate network traffic between specific VPCs. What is the most scalable way to achieve this?

Accepted Answer

Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.. Transit Gateway route tables allow you to isolate traffic between VPCs by controlling which VPC attachments can communicate with each other. By associating each VPC attachment with a specific route table and configuring route propagation appropriately, you can enforce isolation without additional appliances or complex routing. This approach scales seamlessly as you add more VPCs, because you simply create new route tables and associate attachments as needed.

Answer

Deploy AWS Network Firewall in each VPC.

Answer

Use Security Groups in each VPC to filter traffic.

Answer

Use VPC Peering connections and modify route tables.

Question 4

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Internet Gateway; application servers in private subnets with a route to the NAT Gateway.. It places web servers in public subnets with an Internet Gateway (IGW) for direct internet access, while application servers reside in private subnets that lack a direct route to the IGW. The private subnets have a route to a NAT Gateway, allowing the application servers to initiate outbound internet connections (e.g., for updates) without being reachable from the internet. Security Groups on the application servers can further restrict inbound traffic to only the web servers' security group, ensuring the application tier is isolated.

Answer

All servers in private subnets; use a load balancer in a public subnet.

Answer

Web servers in private subnets; application servers in public subnets with an Internet Gateway.

Answer

All servers in public subnets; use Security Groups to restrict access.

Question 5

A company is designing a network for a critical application that requires low latency and high throughput between EC2 instances in the same AWS Region. Which network design should the company use?

Accepted Answer

Launch the instances in a Cluster Placement Group.. A Cluster Placement Group is the correct choice because it provides the lowest possible latency and highest throughput between EC2 instances by placing them in a single Availability Zone with non-blocking, high-bandwidth networking. This design is ideal for tightly coupled, high-performance computing (HPC) or latency-sensitive applications that require consistent, low-latency communication within the same AWS Region.

Answer

Launch the instances in a Spread Placement Group.

Answer

Launch the instances as larger instance types with enhanced networking.

Answer

Launch the instances in different Availability Zones.

Question 6

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The company wants to connect to multiple VPCs in the same AWS Region. What is the MOST cost-effective and scalable design?

Accepted Answer

Create a Transit Gateway, attach it to the Direct Connect Gateway using a Transit VIF, and attach each VPC to the Transit Gateway.. It uses a Transit Gateway (TGW) to interconnect multiple VPCs and a Direct Connect Gateway (DXGW) via a Transit VIF, which is the most cost-effective and scalable design. The Transit VIF allows a single Direct Connect connection to be shared across many VPCs through the TGW, avoiding the need for multiple private VIFs or complex peering arrangements. This design scales to hundreds of VPCs and reduces operational overhead by centralizing routing.

Answer

Provision multiple private VIFs, each connected to a different VPC.

Answer

Create a Direct Connect Gateway and associate each VPC's Virtual Private Gateway to it using a private VIF.

Answer

Use a private VIF to connect to a Virtual Private Gateway in one VPC and use VPC Peering to reach other VPCs.

Question 7

A company wants to ensure that all traffic to and from its VPC is inspected by a security appliance. The appliance must be able to inspect traffic between subnets within the VPC. Which architecture should the company use?

Accepted Answer

Use a Gateway Load Balancer with security appliances in a separate inspection VPC and configure route tables to send traffic to the GWLB endpoint.. A Gateway Load Balancer (GWLB) with security appliances in a separate inspection VPC allows you to centrally inspect all traffic, including east-west traffic between subnets within the same VPC. By configuring route tables to send traffic to the GWLB endpoint, you can enforce stateful inspection for all inbound, outbound, and inter-subnet traffic without introducing a single point of failure or complex routing.

Answer

Deploy a NAT Gateway and route all internet traffic through it.

Answer

Create a VPC Peering connection to a centralized VPC with security appliances.

Answer

Attach an Internet Gateway and use Security Groups to log traffic.

Question 8

A company is designing a network for a multi-account AWS environment using AWS Organizations. The company must centralize internet egress for all accounts. Which TWO solutions should the company use? (Choose two.)

Accepted Answer

Use AWS Transit Gateway to route traffic from all VPCs to the egress VPC.. AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs. This allows traffic from multiple VPCs to be routed to a centralized egress VPC without requiring complex peering relationships or full mesh connectivity.

Answer

Use VPC Peering to connect all VPCs to the egress VPC.

Answer

Deploy a AWS Client VPN endpoint in each VPC.

Answer

Attach an Internet Gateway to each VPC and allow direct internet access.

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16. The company needs to add a new subnet for a container cluster that requires at least 2000 IP addresses. Which TWO subnet CIDR blocks meet this requirement? (Choose two.)

Accepted Answer

10.0.0.0/20. (10.0.0.0/20) provides 2^(32-20) = 4096 IP addresses, and option D (10.0.0.0/21) provides 2^(32-21) = 2048 IP addresses. Both meet the requirement of at least 2000 usable IP addresses (after subtracting AWS reserved addresses, each still offers well over 2000).

Answer

10.0.0.0/24

Answer

10.0.0.0/25

Answer

10.0.0.0/26

Question 10

A company has a multi-tier web application running on EC2 instances in a VPC. The web tier must be accessible from the internet, but the application tier should only be accessible from the web tier. Which network design configuration meets these requirements?

Accepted Answer

Place both tiers in public subnets and use security groups to restrict traffic from the web tier to the application tier.. Placing both tiers in public subnets with an internet gateway allows the web tier to be accessible from the internet. Security groups can then be used to restrict inbound traffic to the application tier to only come from the web tier's security group, ensuring that the application tier is not directly accessible from the internet. This design meets the requirement without unnecessary complexity.

Answer

Use a VPN connection from the web tier to the application tier, and place both tiers in private subnets.

Answer

Place web servers in a public subnet with a NAT gateway, and application servers in a private subnet with a default route to the NAT gateway.

Answer

Place web servers in a public subnet with an internet gateway, and application servers in a private subnet with a route to the web subnet via a VPC peering connection.

Question 11

A solutions architect needs to design a VPC with both IPv4 and IPv6 support. The VPC will have public and private subnets. Resources in private subnets need outbound IPv6 access to the internet. Which combination of resources should be used?

Accepted Answer

Internet gateway for public subnets and egress-only internet gateway for private subnets. An egress-only internet gateway (EIGW) is the AWS-managed service designed specifically to provide outbound-only IPv6 access from private subnets to the internet, while an internet gateway (IGW) handles both inbound and outbound IPv4/IPv6 traffic for public subnets. Unlike a NAT gateway, which only supports IPv4, the EIGW works with IPv6 and prevents any inbound IPv6 connections from the internet, meeting the requirement for outbound-only IPv6 access.

Answer

Internet gateway for public subnets and VPC gateway endpoints for private subnets

Answer

Internet gateway for public subnets and NAT gateway for private subnets

Answer

Internet gateway for both public and private subnets using route tables

Question 12

Refer to the exhibit. An EC2 instance launched in subnet-1a is unable to access the internet. Which is the most likely cause?

Accepted Answer

Subnet-1a does not assign public IP addresses automatically.. If subnet-1a does not have the 'Auto-assign public IPv4 address' setting enabled, EC2 instances launched in that subnet will not receive a public IP address automatically. Without a public IP, the instance cannot communicate with the internet through an internet gateway, even if the route table has a default route (0.0.0.0/0) pointing to the internet gateway. The instance would need an Elastic IP or a public IP assigned at launch to enable internet access.

Answer

The route table rtb-main does not have a default route to the internet gateway.

Answer

The VPC does not have DNS hostnames enabled.

Answer

Subnet-1a is not associated with any route table.

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN. What configuration change is required to avoid routing conflicts?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16.. The VPC CIDR 10.0.0.0/16 is a subset of the on-premises CIDR 10.0.0.0/8. AWS Site-to-Site VPN cannot route traffic correctly when the VPC and on-premises networks have overlapping IP ranges because the VPN connection relies on distinct destination prefixes. The only way to eliminate the conflict is to change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, ensuring no IP address overlap between the two networks.

Answer

Create a more specific route in the VPC route table for the on-premises CIDR.

Answer

Enable route propagation on the VPC route tables.

Answer

Use a VPN connection with static routes instead of BGP.

Question 14

An application running on EC2 instances in a private subnet needs to download patches from the internet. The VPC has an internet gateway and public subnets. Which resource should be used to provide outbound internet access to the instances?

Accepted Answer

NAT gateway in a public subnet. A NAT gateway in a public subnet provides outbound-only internet access to instances in private subnets by translating their private IP addresses to the NAT gateway's Elastic IP address. This allows the EC2 instances to download patches from the internet while preventing any unsolicited inbound connections from the internet, which is the standard design for secure outbound internet access in a VPC.

Answer

VPC gateway endpoint for S3

Answer

AWS Site-to-Site VPN connection

Answer

Internet gateway in the private subnet

Question 15

A company is designing a VPC with multiple subnets across three Availability Zones. The application requires that all traffic between subnets within the same AZ stay within that AZ to minimize latency and data transfer costs. Which configuration achieves this?

Accepted Answer

Create a route table for each AZ and associate the subnets in that AZ with the route table. Ensure the route tables have only local routes for the VPC CIDR.. Each Availability Zone (AZ) has its own route table with only the local VPC CIDR route. This ensures that traffic between subnets in the same AZ uses the VPC's local routing, which stays within the AZ's physical infrastructure, minimizing latency and avoiding cross-AZ data transfer costs. AWS VPC local routes inherently keep traffic within the same AZ when source and destination are in the same AZ, as the underlying network fabric directs traffic locally without traversing AZ boundaries.

Answer

Use a single route table for all subnets and add specific routes for each AZ.

Answer

Use an AWS Transit Gateway with separate attachments for each AZ.

Answer

Create a VPC peering connection between subnets in the same AZ.