ANS-C01 Network Design Practice Test 21 — 15 Questions

Question 1

A media company has a 10 Gbps AWS Direct Connect dedicated connection at its on-premises data center and a 1 Gbps Site-to-Site VPN over the internet as backup. The company wants traffic to the AWS Region to prefer the Direct Connect path and fail over to the VPN only when the dedicated connection becomes unavailable. A network engineer must configure the routing so that failover is automatic and the Direct Connect path is always preferred while it is healthy. Which combination of steps will achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

On the on-premises router, set a higher local preference for routes learned over the Direct Connect BGP session than for routes learned over the VPN BGP session, and enable BGP route propagation on the VPN attachment.. Failover between Direct Connect and a VPN is a routing decision on the customer gateway. Because local preference is evaluated before path selection, assigning a higher local preference to the Direct Connect BGP session makes it the preferred path while healthy. When the dedicated connection or its BGP session fails, the lower-preference VPN routes become active, providing automatic failover.

Answer

Create a static route on the on-premises router that points all AWS-bound traffic to the Direct Connect virtual interface, and configure a floating static route with a higher administrative distance for the VPN.

Answer

Advertise the same BGP prefix with equal local preference over both the Direct Connect virtual interface and the VPN tunnel, and let ECMP load-balance the traffic.

Answer

Use AWS Global Accelerator with a endpoint group in the Region, and let Global Accelerator steer traffic over the Direct Connect connection by preferring the lowest-latency endpoint.

Question 2

A financial services company is designing a hybrid network between its on-premises data center and AWS. The company requires a dedicated, private connection that supports jumbo frames and provides consistent low-latency performance for high-volume database replication. They also need to encrypt traffic in transit. Which combination of AWS services should they use?

Accepted Answer

AWS Direct Connect with a private virtual interface and MACsec encryption. Direct Connect with a private virtual interface provides dedicated private connectivity to VPC resources. MACsec adds layer 2 encryption, and private virtual interfaces support jumbo frames. This combination meets the requirements for dedicated bandwidth, low latency, encryption, and large MTU. The other options either use the public internet, lack jumbo frame support, or are not designed for private VPC access.

Answer

AWS Site-to-Site VPN over the public internet

Answer

AWS Direct Connect with a public virtual interface and IPsec VPN

Answer

AWS Transit Gateway with a VPN attachment and BGP

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16 and a subnet with CIDR 10.0.1.0/24. The company wants to launch an EC2 instance in the subnet and assign it a public IPv4 address automatically. The subnet's route table currently has a route to an internet gateway for 0.0.0.0/0. However, the instance cannot reach the internet. Which action should be taken to resolve this?

Accepted Answer

Modify the subnet's auto-assign public IPv4 setting to enabled.. For an EC2 instance to access the internet through an internet gateway, it must have a public IPv4 address. Subnets have an auto-assign public IPv4 setting that is disabled by default. Enabling this setting on the subnet ensures that instances launched receive a public IP automatically, which is the required fix. The other options either misunderstand routing or propose unnecessary solutions.

Answer

Attach an Elastic IP address to the instance's network interface.

Answer

Add a route to the subnet's route table for the VPC CIDR pointing to the internet gateway.

Answer

Create a NAT gateway in the subnet and update the route table to point 0.0.0.0/0 to the NAT gateway.

Question 4

A company runs a two-tier web application in a VPC with a CIDR block of 10.0.0.0/16. The application must remain highly available if a single Availability Zone fails. The company has created two public subnets in us-east-1a and us-east-1b, each with a /24 CIDR block, and two private subnets in the same Availability Zones, each with a /24 CIDR block. An Application Load Balancer (ALB) will distribute traffic to web servers in the public subnets. The database servers in the private subnets must not be accessible from the internet. Which combination of route table configurations will meet these requirements?

Accepted Answer

Associate one route table with each public subnet, each containing a route to an internet gateway. Associate one route table with each private subnet, each containing a route to a NAT gateway in the same Availability Zone.. The correct design uses separate route tables for each subnet, with public subnets routing to an internet gateway and private subnets routing to a NAT gateway in the same Availability Zone. This ensures that if one AZ fails, the other AZ's private subnet can still reach the internet via its local NAT gateway, maintaining high availability and security.

Answer

Associate one route table with both public subnets, containing a route to an internet gateway. Associate another route table with both private subnets, containing a route to a NAT gateway in one of the public subnets.

Answer

Associate one route table with both public subnets, containing a route to a NAT gateway. Associate one route table with both private subnets, containing a route to an internet gateway.

Answer

Associate one route table with each public subnet, each containing a route to a NAT gateway. Associate one route table with both private subnets, containing a route to an internet gateway.

Question 5

A company is deploying a new VPC with a CIDR block of 10.0.0.0/16. They plan to create multiple subnets and need to ensure that the VPC can communicate with an on-premises network that uses the CIDR block 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN for connectivity. Which TWO of the following statements are true regarding the IP address planning and routing for this scenario? (Choose two.)

Accepted Answer

The company can resolve the overlap by using a different VPC CIDR block that does not fall within 10.0.0.0/8, such as 172.16.0.0/16.. The VPC CIDR 10.0.0.0/16 overlaps with the on-premises CIDR 10.0.0.0/8, which will cause routing conflicts and prevent connectivity. The correct solution is to use a non-overlapping CIDR block for the VPC, such as 172.16.0.0/16. AWS VPN does not perform automatic NAT, and BGP or Transit Gateway cannot resolve overlapping CIDRs. Proper IP address planning is essential before deploying VPN connections.

Answer

The company can use AWS Transit Gateway to connect the VPC and on-premises network without changing the CIDR blocks.

Answer

AWS Site-to-Site VPN automatically performs NAT to resolve overlapping CIDR blocks.

Answer

The VPC can use the overlapping CIDR block as long as the VPN connection uses BGP for dynamic routing.

Question 6

A company is designing a hybrid network architecture. They need to connect their on-premises data center to a VPC using AWS Direct Connect. The company requires high availability and redundancy for the Direct Connect connection. Which TWO configurations should be used to achieve this? (Choose two.)

Accepted Answer

Order two Direct Connect connections from different Direct Connect locations.. To achieve high availability for Direct Connect, you should have at least two connections from different Direct Connect locations. This provides physical redundancy. Additionally, a VPN backup over the internet ensures connectivity if Direct Connect fails. Together, these configurations provide both physical diversity and a failover path. Using a single connection with multiple VIFs does not provide physical redundancy, and other options are either invalid or unrelated to availability.

Answer

Set up a Direct Connect gateway with two virtual private gateways attached to the same VPC.

Answer

Use a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.

Answer

Enable jumbo frames on the Direct Connect connection to improve throughput.

Question 7

A company is designing a hybrid network that connects its on-premises data center to a VPC using AWS Site-to-Site VPN over a public internet connection. The company requires high availability and wants to ensure that traffic automatically fails over if one tunnel becomes unavailable. The company has configured two tunnels on the virtual private gateway. Which TWO additional configuration steps are required to achieve automatic failover and high availability for this VPN connection? (Choose two.)

Accepted Answer

Configure the on-premises customer gateway device to use BGP for dynamic routing and advertise the on-premises network prefixes to AWS.. To achieve automatic failover for a Site-to-Site VPN with two tunnels, the on-premises device must use BGP dynamic routing so that it can withdraw routes when a tunnel fails. Alternatively, static routing with dead peer detection can also trigger failover by detecting tunnel failure and removing routes. Both approaches enable traffic to shift to the remaining tunnel without manual intervention.

Answer

Configure the two tunnels to terminate on different Availability Zones within the VPC.

Answer

Set up a second customer gateway device in the on-premises network and configure a second VPN connection to the same virtual private gateway.

Answer

Enable AWS Global Accelerator for the VPN connection to route traffic through the AWS global network.

Question 8

A media company runs a latency-sensitive application on EC2 instances in a single VPC. The instances are distributed across three Availability Zones and communicate with each other using a cluster placement group. The company wants to ensure that inter-instance traffic within the placement group uses the lowest-latency network path and does not traverse the public internet. Which configuration should the company use?

Accepted Answer

Enable enhanced networking with Elastic Network Adapter (ENA) on all instances and keep them in the same cluster placement group. Enhanced networking with ENA reduces latency and increases bandwidth, while a cluster placement group places instances close together in a single Availability Zone. This combination ensures inter-instance traffic uses the low-latency private network path and never traverses the public internet, meeting the performance and privacy requirements.

Answer

Attach an internet gateway to the VPC and configure route tables to prefer the internet gateway for inter-instance traffic

Answer

Launch all instances with public IP addresses and use Elastic IP addresses for communication

Answer

Place the instances in a spread placement group across the three Availability Zones

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect this VPC to an on-premises network that uses the CIDR block 10.0.0.0/8. The company wants to use AWS Transit Gateway to centralize connectivity. However, they cannot change the on-premises IP addressing. What should the company do to enable communication between the VPC and on-premises?

Accepted Answer

Re-IP the VPC with a non-overlapping CIDR block and then connect via AWS Transit Gateway.. When CIDR blocks overlap between a VPC and on-premises, routing becomes ambiguous. AWS Transit Gateway does not support NAT, so the only viable solution is to eliminate the overlap by re-IPing one side. Since the on-premises network cannot be changed, the VPC must be re-addressed with a non-overlapping CIDR. This allows for proper routing and connectivity via Transit Gateway. Other options do not resolve the fundamental overlap issue.

Answer

Implement a NAT solution on the on-premises side to translate the VPC CIDR to a non-overlapping range.

Answer

Use AWS Transit Gateway with a Connect attachment and configure route propagation with a more specific route for the VPC.

Answer

Use AWS PrivateLink to create an interface VPC endpoint for the on-premises services.

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to create a subnet that can accommodate at least 500 EC2 instances and must reserve the first four IP addresses and the last IP address in the subnet for AWS use. Which subnet CIDR block should a network engineer choose?

Accepted Answer

10.0.0.0/22. AWS reserves the first four IP addresses and the last IP address in each subnet, totaling 5 reserved addresses. To support at least 500 instances, the subnet must have more than 505 addresses. A /23 subnet has 512 addresses, leaving 507 usable, which meets the minimum. However, a /22 subnet provides 1024 addresses, leaving 1019 usable, offering more room for growth. The question asks for the subnet CIDR that should be chosen; while /23 is technically sufficient, /22 is a better choice for scalability. However, the correct answer is /22 because it is the smallest standard subnet that provides ample space beyond 500, and it is a common best practice to avoid subnets that are too close to the limit. In this context, /22 is the most appropriate.

Answer

10.0.0.0/23

Answer

10.0.0.0/24

Answer

10.0.0.0/25

Question 11

A company is building a hybrid network between its on-premises data center and AWS. The company wants to use AWS Direct Connect for dedicated connectivity and needs the connection to survive the failure of a single device or link in the AWS Direct Connect location. The network engineer must design for maximum resiliency as defined by AWS. Which two steps should the engineer take? (Choose two.)

Accepted Answer

Configure the on-premises routers to run BGP with the virtual interfaces at both locations, and use AS-path prepending or local preference to control which path is preferred.. Maximum Direct Connect resiliency is a physical-topology property: two dedicated connections at two different locations, each terminating on separate devices. Redundancy alone is not enough, because the on-premises network must also run BGP on the virtual interfaces at both locations and express a preference so that the secondary path is used only when the primary fails.

Answer

Attach both Direct Connect connections to the same AWS Transit Gateway and rely on the transit gateway's default route table to fail over between them.

Answer

Enable jumbo frames on the virtual interfaces and set the maximum transmission unit to 9001 on the on-premises routers to reduce fragmentation during failover.

Answer

Order a single hosted connection with a 10 Gbps port speed and configure a link aggregation group across the two virtual interfaces on that connection.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to add a new subnet that will host a large number of EC2 instances, and the subnet must support at least 500 instances. The company also wants to reserve the first four IP addresses and the last IP address in the subnet, as AWS does. Which CIDR block should be used for the new subnet to meet these requirements with the smallest possible size?

Accepted Answer

10.0.0.0/23. AWS reserves five IP addresses in each subnet: the network address, the VPC router, the DNS server, and the broadcast address, plus one for future use. A /23 subnet provides 512 total addresses, leaving 507 usable, which satisfies the need for at least 500 instances. A /24 only provides 251 usable addresses, which is insufficient. A /22 and /21 are larger than necessary, so they do not meet the smallest-size requirement.

Answer

10.0.0.0/22

Answer

10.0.0.0/21

Answer

10.0.0.0/24

Question 13

A media company runs a live video ingestion pipeline in a VPC with CIDR 10.0.0.0/16. Producers stream to EC2 instances behind a Network Load Balancer, and the security team requires that all traffic to the NLB be inspected by a third-party firewall appliance running on EC2. The firewall must see the original client source IP address and must return traffic inline without asymmetric routing. The design must remain highly available across two Availability Zones. Which design meets these requirements?

Accepted Answer

Deploy the firewall appliances in a Gateway Load Balancer endpoint service and create a Gateway Load Balancer endpoint in the producer VPC, then use route table entries to send traffic through the GWLB endpoint.. Gateway Load Balancer is the AWS service designed for inline inspection by third-party virtual appliances. It uses GWLB endpoints and the GENEVE encapsulation protocol so appliances receive flow metadata including the original source address, and return traffic follows the same path, avoiding asymmetric routing. Distributing appliances across multiple Availability Zones behind a single GWLB endpoint provides the required resilience for the ingestion pipeline.

Answer

Place the firewall appliances behind an internal Application Load Balancer and configure the NLB to forward to the ALB, then forward from the ALB to the application targets.

Answer

Deploy AWS Network Firewall in a centralized inspection VPC and use AWS Transit Gateway to route traffic from the producer VPC, keeping the NLB in the producer VPC.

Answer

Enable VPC Traffic Mirroring on the NLB elastic network interfaces and send mirrored packets to the firewall appliances, allowing the appliances to drop malicious flows.

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect this VPC to an on-premises data center that uses the CIDR block 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN for the connection. They have configured a virtual private gateway (VGW) on the VPC and a customer gateway on the on-premises side. However, after establishing the VPN tunnel, instances in the VPC cannot communicate with servers in the on-premises network. The on-premises network can ping the VPC instances, but the VPC instances cannot ping the on-premises servers. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for the on-premises CIDR block pointing to the virtual private gateway.. The most likely cause is that the VPC route table lacks a route for the on-premises CIDR block pointing to the virtual private gateway. Without this route, VPC instances cannot send traffic to the on-premises network, even though the VPN tunnel is operational and the on-premises side can initiate connections.

Answer

The security group on the VPC instances does not allow outbound ICMP traffic.

Answer

The customer gateway device is not configured to allow traffic from the VPC CIDR block.

Answer

The VPN tunnel is not fully established because the pre-shared keys do not match.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16 and a subnet in each of three Availability Zones. They need to assign IPv6 addresses to instances and ensure they can communicate over IPv6 within the VPC and to the internet. The company also wants to minimize administrative overhead. Which combination of steps should be taken?

Accepted Answer

Associate an IPv6 CIDR block with the VPC, assign IPv6 CIDR blocks to each subnet, and create an internet gateway that supports IPv6.. To enable IPv6 for a VPC, you must associate an IPv6 CIDR block with the VPC, assign IPv6 CIDR blocks to subnets, and attach an internet gateway that supports IPv6. This allows instances to communicate over IPv6 both within the VPC and with the internet. It is the standard dual-stack configuration and minimizes administrative overhead by using AWS-managed IPv6 addressing.

Answer

Associate an IPv6 CIDR block with the VPC, enable IPv6 on existing subnets, and create a NAT gateway for IPv6 traffic.

Answer

Associate an IPv6 CIDR block with the VPC, assign IPv6 CIDR blocks to each subnet, and create an egress-only internet gateway for outbound IPv6 traffic.

Answer

Assign IPv6 addresses directly to instances from a public IPv6 pool, and update security groups to allow IPv6 traffic.