ANS-C01 Network Design Practice Test 20 — 15 Questions

Question 1

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company wants to ensure that traffic from on-premises to AWS uses the Direct Connect connection when it is available and automatically fails over to the VPN if the Direct Connect connection goes down. The company also wants to avoid asymmetric routing. Which routing configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advertise the same routes over both the Direct Connect private virtual interface and the VPN, and use BGP attributes to prefer the Direct Connect path.. To prefer Direct Connect and fail over to VPN, both connections should advertise the same prefixes. BGP attributes such as AS_PATH prepending on the VPN or higher local preference on Direct Connect can make Direct Connect preferred. When Direct Connect fails, its routes are withdrawn, and the VPN path becomes active. This maintains symmetric routing because the on-premises router has a consistent view of the preferred path.

Answer

Use static routes for Direct Connect and BGP for the VPN.

Answer

Advertise more specific routes over the VPN and less specific routes over Direct Connect.

Answer

Advertise the same routes over both connections and use BGP AS_PATH prepending on the Direct Connect connection.

Question 2

A company is designing a network architecture that uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a centralized security appliance before being routed to its destination. The security appliance is deployed in a dedicated VPC. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Enable appliance mode on the Transit Gateway attachment for the security VPC.. To route traffic through a centralized security appliance using Transit Gateway, you must enable appliance mode on the security VPC attachment to ensure symmetric traffic flow. Additionally, you need a separate Transit Gateway route table associated with the security VPC to control routing so that traffic from other VPCs is directed to the security appliance. These two configurations enable the inspection of inter-VPC traffic.

Answer

Create a peering connection between the security VPC and each spoke VPC.

Answer

Configure a static route in each spoke VPC route table pointing to the security VPC's CIDR.

Answer

Attach an internet gateway to the security VPC to allow traffic inspection.

Question 3

A financial services firm runs a VPC with a CIDR of 172.31.0.0/16 and an on-premises data center using 10.0.0.0/8. The firm wants to connect the VPC to the data center over AWS Site-to-Site VPN and must ensure that traffic destined for 10.0.0.0/8 is routed over the VPN while all other traffic exits through the internet gateway. Which configuration achieves this?

Accepted Answer

Add a static route for 10.0.0.0/8 in the route table pointing to the virtual private gateway, and leave the default route pointing to the internet gateway.. Routing a specific on-premises prefix over a VPN while keeping internet egress local requires a static route for that prefix pointing to the virtual private gateway. The default route remains with the internet gateway. Advertising a default route over BGP, relying solely on propagation, or using VPC peering all fail to produce the required split behavior for this scenario.

Answer

Advertise 0.0.0.0/0 from the on-premises customer gateway over BGP so all traffic is sent over the VPN.

Answer

Create a peering connection between the VPC and the on-premises network and add a route to the peering connection for 10.0.0.0/8.

Answer

Enable route propagation on the subnet route table and rely on the propagated routes from the virtual private gateway.

Question 4

A company is deploying a containerized application on Amazon ECS using the AWS Fargate launch type. The application needs to access an Amazon RDS database in the same VPC without traversing the internet. The company wants to minimize operational overhead and ensure that the database credentials are not exposed in environment variables. Which combination of AWS services should be used?

Accepted Answer

Amazon RDS in a private subnet and AWS Secrets Manager for credentials, with ECS tasks in the same VPC. For ECS Fargate tasks to access RDS privately, both should reside in the same VPC, with RDS in a private subnet and security groups allowing traffic from the ECS tasks. AWS Secrets Manager securely stores and retrieves database credentials, integrating with ECS task definitions to inject them at runtime. This avoids internet exposure and reduces operational overhead by eliminating the need for custom credential management.

Answer

Amazon RDS with a public endpoint and security group allowing the ECS task's public IP

Answer

AWS PrivateLink endpoint for Amazon RDS and AWS Secrets Manager for credentials

Answer

AWS Transit Gateway to connect the ECS cluster to the RDS instance and AWS Systems Manager Parameter Store for credentials

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect this VPC to an on-premises network that uses the CIDR block 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN for the connection. Which action must they take to ensure proper routing?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 192.168.0.0/16.. Overlapping CIDR blocks between a VPC and on-premises networks prevent proper routing. AWS does not allow you to modify the primary CIDR of a VPC after creation. Therefore, the only viable action is to create a new VPC with a non-overlapping CIDR block and migrate resources. This resolves the conflict and enables the Site-to-Site VPN to route traffic correctly.

Answer

Use a NAT instance in the VPC to translate the overlapping addresses.

Answer

Create a new VPC with a non-overlapping CIDR and migrate resources.

Answer

Configure the VPN connection to use a different routing protocol that ignores overlapping routes.

Question 6

A company operates a global web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe experience high latency because their requests are routed to the ALB in us-east-1. The company wants to improve performance for European users without changing the application architecture or deploying additional ALBs. Which solution should a network engineer recommend?

Accepted Answer

Enable AWS Global Accelerator with an endpoint group pointing to the ALB in us-east-1.. AWS Global Accelerator improves performance for global users by leveraging the AWS global network and edge locations. It provides static anycast IPs that route traffic to the optimal endpoint, reducing latency for dynamic content. CloudFront is better for cacheable content, while other options are local or connectivity solutions that do not address global latency. Global Accelerator is the correct choice for improving performance without architectural changes.

Answer

Configure the ALB to use cross-zone load balancing and enable sticky sessions.

Answer

Create an Amazon CloudFront distribution with the ALB as the origin.

Answer

Set up an AWS Site-to-Site VPN between the European offices and the VPC in us-east-1.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to create a subnet that can accommodate at least 500 EC2 instances, with room for growth. The subnet must be in the us-east-1a Availability Zone. Which CIDR block should be used for the subnet?

Accepted Answer

10.0.0.0/22. The subnet must support at least 500 EC2 instances and allow for growth. A /22 subnet provides 1024 total IP addresses, leaving 1019 usable after AWS reserves 5 addresses per subnet. This comfortably meets the requirement and provides room for expansion. A /23 offers only 507 usable addresses, which is tight. A /24 is too small. A /21 is larger than necessary and may waste address space. Therefore, a /22 is the optimal choice.

Answer

10.0.0.0/24

Answer

10.0.0.0/21

Answer

10.0.0.0/23

Question 8

A startup is deploying a web application in a single VPC. The application servers run in a private subnet and must be reachable from the internet only through an Application Load Balancer. The load balancer must be able to route to the application servers, and the application servers must not have public IP addresses. Which configuration supports this requirement?

Accepted Answer

Place the load balancer in public subnets and the application servers in private subnets, with the load balancer's security group allowing inbound traffic to the servers' security group.. Internet-facing Application Load Balancers are placed in public subnets, and their targets can be in private subnets with no public IPs. Security group referencing allows only load-balancer traffic to reach the servers. Elastic IPs, public IPs on targets, and NAT gateways are either unsupported for this load balancer type or irrelevant to the required traffic path.

Answer

Place the load balancer and the application servers in the same private subnet, and attach an Elastic IP to the load balancer.

Answer

Place the load balancer in public subnets and assign public IP addresses to the application servers so health checks succeed.

Answer

Place the load balancer in public subnets and configure a NAT gateway so the load balancer can reach the private servers.

Question 9

A company runs a shared services VPC (10.0.0.0/16) and multiple workload VPCs, all attached to the same AWS Transit Gateway. The security team has configured a transit gateway route table for the shared services VPC that contains a static route for 10.1.0.0/16 pointing to a workload VPC attachment. A network engineer notices that traffic from the shared services VPC to 10.1.0.0/16 is being dropped even though the route exists. What is the MOST likely cause?

Accepted Answer

The workload VPC's subnet route tables do not have a route for the shared services VPC CIDR pointing to the transit gateway.. Traffic between VPCs attached to a transit gateway requires routes in both directions: the source VPC's route table must point to the transit gateway, and the destination VPC's subnet route tables must also point back to the transit gateway for the return traffic. Even if the transit gateway route table has the correct static route, the workload VPC subnets need a route for the shared services CIDR pointing to the transit gateway attachment. Without that, return packets are dropped.

Answer

The transit gateway does not support static routes between VPC attachments; only propagated routes are allowed.

Answer

The workload VPC attachment has not been associated with the shared services transit gateway route table.

Answer

The workload VPC attachment has not been propagated into the shared services transit gateway route table.

Question 10

A financial-services company runs a latency-sensitive trading platform on Amazon EC2 instances spread across three Availability Zones in the same AWS Region. The instances must exchange market-data updates with the lowest possible latency and the highest possible packet throughput, and the traffic must never traverse the public internet. The company wants to use an AWS-managed service rather than building its own overlay mesh. Which solution should a network engineer recommend?

Accepted Answer

Create a cluster placement group and launch the instances into it, then enable enhanced networking with the Elastic Network Adapter on each instance.. The workload needs maximum east-west bandwidth and minimum latency inside one Region. A cluster placement group places instances on tightly coupled hardware within a single Availability Zone, while the Elastic Network Adapter gives each instance SR-IOV-based networking with higher packets-per-second and lower latency. Together these AWS-managed features satisfy the latency and throughput goals without exposing traffic to the public internet.

Answer

Deploy a third-party overlay SD-WAN appliance in each Availability Zone and build an encrypted mesh between the instances.

Answer

Attach all instances to a single AWS Transit Gateway and enable equal-cost multipath routing across the three Availability Zones.

Answer

Associate all three subnets with one network ACL that permits all traffic, and rely on the default VPC route table to keep traffic local.

Question 11

A company has a VPC with CIDR block 10.0.0.0/16. The VPC has two subnets: a public subnet 10.0.0.0/24 and a private subnet 10.0.1.0/24. Instances in the private subnet need to access the internet for software updates, but must not be directly reachable from the internet. The company wants to minimize cost and administrative overhead. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in the public subnet, allocate an Elastic IP, and add a route in the private subnet's route table to the NAT gateway.. A NAT gateway deployed in a public subnet enables instances in a private subnet to access the internet for updates while remaining unreachable from the internet. The private subnet's route table must point to the NAT gateway, and the NAT gateway uses an Elastic IP for outbound traffic. This managed service reduces operational overhead and provides high availability within an Availability Zone. It is the standard AWS best practice for this scenario.

Answer

Attach an internet gateway to the VPC, add a route in the private subnet's route table to the internet gateway, and assign public IP addresses to the private instances.

Answer

Launch a NAT instance in the public subnet with a public IP, disable source/destination checks, and add a route in the private subnet's route table to the NAT instance.

Answer

Attach an internet gateway to the VPC and add a route in the private subnet's route table to the internet gateway, but do not assign public IP addresses to the private instances.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to add a second CIDR block to the VPC to support additional subnets. Which CIDR block can be associated with the VPC?

Accepted Answer

10.1.0.0/16. AWS allows additional CIDR blocks to be associated with a VPC as long as they do not overlap with existing blocks. The existing block is 10.0.0.0/16, so 10.1.0.0/16 is a valid non-overlapping block. The other options either overlap or are identical to the existing block, which is not allowed. Therefore, the correct choice is the non-overlapping private CIDR block.

Answer

192.168.0.0/16

Answer

10.0.1.0/24

Answer

10.0.0.0/16

Question 13

A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company wants to ensure that traffic from on-premises to AWS uses the Direct Connect connection when it is available and automatically fails over to the VPN if the Direct Connect connection goes down. The company also wants to avoid asymmetric routing. Which routing configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provision two Direct Connect connections from two different Direct Connect locations and terminate them on the same virtual private gateway or transit gateway.. High availability for Direct Connect requires diversity at the location and device level. Two connections at different Direct Connect locations terminated on the same gateway provide geographic redundancy, and a Site-to-Site VPN backup on the same gateway provides a diverse path that survives a Direct Connect outage. LAGs, same-location pairs, and shared customer gateway devices leave location or device single points of failure.

Answer

Provision two Direct Connect connections at the same location and use the same customer gateway device for both.

Answer

Provision two Direct Connect connections at the same Direct Connect location and terminate them on two different virtual private gateways.

Answer

Provision a single Direct Connect connection and enable link aggregation group (LAG) across two ports at the same location.

Question 14

A company is deploying a global web application that uses an Application Load Balancer (ALB) in us-east-1 and eu-west-1. The application must provide static anycast IP addresses to clients, automatically route users to the closest healthy endpoint, and fail over between Regions within seconds. The company also wants to minimize latency for TCP-based gaming traffic. Which solution meets these requirements?

Accepted Answer

Use AWS Global Accelerator with an accelerator in each Region, and configure endpoint groups for the ALBs.. AWS Global Accelerator provides static anycast IP addresses that are globally advertised, directing clients to the nearest healthy endpoint. It supports TCP and UDP, integrates with ALBs and NLBs as endpoints, and performs health checks to fail over between Regions within seconds. This makes it the only option that satisfies static IPs, low latency, and rapid failover for both HTTP and TCP traffic.

Answer

Use Amazon Route 53 latency-based routing with health checks and ALB aliases in both Regions.

Answer

Use a Network Load Balancer in each Region with Elastic IPs and Route 53 failover routing.

Answer

Use Amazon CloudFront with origin groups and Lambda@Edge for failover.

Question 15

A media company is deploying a hybrid architecture that connects its on-premises data center to a VPC using AWS Site-to-Site VPN over a 10 Gbps AWS Direct Connect connection. The company wants to ensure that traffic from on-premises to AWS prefers the Direct Connect path and uses the VPN only as a backup. The company also wants to minimize asymmetric routing. Which TWO configuration steps should be taken to meet these requirements? (Choose two.)

Accepted Answer

Advertise more specific BGP prefixes over the Direct Connect virtual interface than over the VPN tunnel.. To make Direct Connect the preferred path and VPN the backup, you can either advertise more specific prefixes over Direct Connect or set a higher BGP local preference on the on-premises router for Direct Connect routes. Both methods influence BGP path selection deterministically. ECMP would load-balance, not prefer, and local preference on the AWS side is ineffective because it is a different autonomous system. AS path prepending on Direct Connect would make it less preferred.

Answer

Enable equal-cost multi-path routing on the Direct Connect virtual interface and the VPN tunnel simultaneously.

Answer

Configure the VPN tunnel with a lower BGP local preference than the Direct Connect virtual interface on the AWS side.

Answer

Use AS path prepending on the Direct Connect virtual interface to make it less preferred.