ANS-C01 Network Design Practice Test 21 — 15 Questions

Question 1

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

Accepted Answer

The PrivateRoute resource references the NAT gateway before it is created.. The PrivateRoute resource references the NAT gateway using a NatGatewayId, but the NAT gateway is defined after the route in the CloudFormation template. Without a DependsOn attribute on the route to ensure the NAT gateway is created first, the route will attempt to reference a non-existent resource, causing a creation failure. This is the most likely cause of the EC2 instance's inability to download patches. Option A is incorrect because the private subnet is indeed associated with a route table (the PrivateRouteTable). Option B is incorrect because the issue pertains to IPv4 traffic, not IPv6; NAT gateway supports IPv4. Option C is incorrect because MapPublicIpOnLaunch is a setting for public subnets and does not affect internet access via NAT gateway.

Answer

The private subnet is not associated with any route table.

Answer

The NAT gateway does not support IPv6 traffic.

Answer

The private subnet does not have MapPublicIpOnLaunch set to true.

Question 2

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC must support IPv6 and have subnets in three Availability Zones. The company plans to use an AWS Transit Gateway to connect multiple VPCs. Which TWO actions are required to enable IPv6 communication between VPCs through the Transit Gateway?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and enable IPv6 on subnets.. To use IPv6 in a VPC, you must associate an IPv6 CIDR block (e.g., a /56 from Amazon's IPv6 pool) with the VPC and enable IPv6 on the subnets by assigning an IPv6 CIDR to each subnet. This ensures that resources in those subnets can have IPv6 addresses. Option B is also correct because to route IPv6 traffic between VPCs through a Transit Gateway, you need to configure the Transit Gateway route tables to include IPv6 routes. Transit Gateway supports IPv6 natively; there is no separate 'enable IPv6' setting, but the route tables must have entries for the IPv6 CIDRs of the attached VPCs. Without these routes, IPv6 packets will not be forwarded. Options C, D, and E are incorrect because VPC endpoints do not route traffic between VPCs, egress-only internet gateways only allow outbound IPv6 internet access, and NAT gateways are for IPv4 only.

Answer

Use VPC endpoints to route IPv6 traffic between VPCs.

Answer

Attach an egress-only internet gateway to the Transit Gateway.

Answer

Create a NAT gateway and attach it to the Transit Gateway.

Question 3

A company has a VPC with public and private subnets. The private subnets must access an S3 bucket without traversing the internet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Create a VPC gateway endpoint for S3 and associate it with the private subnet route tables.. A VPC gateway endpoint for S3 uses AWS's internal network to route traffic to S3 without traversing the internet. This endpoint is a horizontally scaled, redundant, and highly available gateway that is added to the route table of the private subnets, enabling direct, private connectivity to S3.

Answer

Attach an internet gateway to the VPC and route traffic through it.

Answer

Set up a VPN connection to the on-premises network and access S3 from there.

Answer

Place a NAT gateway in the public subnet and route traffic through it.

Question 4

A company is designing a VPC for a web application that requires high availability. The application will be deployed across multiple Availability Zones. Which THREE components are essential for a highly available network design? (Choose THREE.)

Accepted Answer

Subnets in at least two Availability Zones. Deploying subnets in at least two Availability Zones (AZs) ensures that if one AZ fails, the application can continue serving traffic from the other AZ. This is the foundational principle of high availability in AWS, as it provides fault isolation at the data center level. Without multi-AZ subnets, a single AZ failure would cause a complete outage.

Answer

A single VPN connection to on-premises

Answer

VPC peering with a backup VPC

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16 and wants to connect to another VPC with CIDR 10.0.0.0/16 in a different account. The VPCs are in the same region. Which THREE steps are necessary to establish connectivity? (Choose THREE.)

Accepted Answer

Change the CIDR block of one VPC to a non-overlapping range.. VPC peering requires non-overlapping CIDR blocks. Since both VPCs use 10.0.0.0/16, they have identical address spaces, which makes routing ambiguous and prevents the peering connection from being established. AWS enforces this rule to ensure that route tables can uniquely direct traffic between the peered VPCs without conflicts.

Answer

Create VPC endpoints in each VPC for the other VPC's services.

Answer

Set up a VPN connection between the VPCs.

Question 6

A company is designing a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which THREE design elements are required? (Choose THREE.)

Accepted Answer

A public subnet for the web tier with an internet gateway. The web tier requires direct internet accessibility, which is achieved by placing it in a public subnet associated with an internet gateway. The internet gateway provides a target for the subnet's route table to allow inbound traffic from the internet and outbound responses, enabling users to reach the web application.

Answer

A NAT gateway in the public subnet for outbound traffic from private subnets

Answer

A VPN connection to on-premises

Question 7

Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?

Accepted Answer

The policy must include a condition that the accepter VPC owner is the target account.. When creating a VPC peering connection across AWS accounts, the requester's IAM policy must include a condition that explicitly allows the action only when the accepter VPC owner is the target account. Without this condition, the ec2:CreateVpcPeeringConnection action will fail because the policy lacks the necessary cross-account authorization context. The condition key aws:SourceAccount or ec2:AccepterVpcOwnerId must be used to restrict the action to the specific accepter account.

Answer

The ec2:CreateVpcPeeringConnection action is not allowed on the accepter VPC.

Answer

The user needs ec2:ModifyVpcPeeringConnectionOptions permission.

Answer

The user needs ec2:CreateVpcEndpoint permission.

Question 8

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application uses Aurora MySQL global database. Which design should be used to minimize cross-region latency for writes?

Accepted Answer

Deploy an ALB in each region with a Global Accelerator endpoint group containing both ALBs.. Deploying an ALB in each region and adding both to a Global Accelerator endpoint group enables active-active traffic distribution with optimal path routing via the AWS global network. Global Accelerator uses Anycast IPs to direct user traffic to the nearest healthy endpoint, minimizing latency. For writes to an Aurora MySQL global database, the primary region handles all write operations, but Global Accelerator ensures that write requests are routed to the primary region's ALB with the lowest possible latency from the client's location, while read traffic can be served locally from the secondary region's ALB.

Answer

Use Route 53 latency-based routing with a single ALB in the primary region.

Answer

Use Amazon CloudFront with origins in both regions and cache invalidation for writes.

Answer

Use Global Accelerator with a single ALB endpoint in one region and failover to the second region.

Question 9

A network engineer is designing a hybrid network using AWS Transit Gateway with multiple VPCs and an on-premises data center connected via AWS Direct Connect. The VPCs need to communicate with each other and with on-premises, but must isolate development VPCs from production VPCs. What is the MOST scalable and cost-effective approach?

Accepted Answer

Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.. A single Transit Gateway with separate route tables allows you to isolate development and production VPCs from each other while sharing a common route table for the Direct Connect attachment to reach on-premises. This design is highly scalable (no mesh of peering connections) and cost-effective (no per-VPN-tunnel charges), leveraging Transit Gateway’s native segmentation and centralized routing.

Answer

Use a single Transit Gateway with one route table for all VPCs and on-premises, and use network ACLs for isolation.

Answer

Create VPC peering connections between all VPCs and a Direct Connect gateway for on-premises connectivity.

Answer

Use a VPN connection from each VPC to on-premises over Direct Connect, and allow VPC communication via VPN.

Question 10

A company has a VPC with public and private subnets in three Availability Zones. An internet-facing Network Load Balancer (NLB) is deployed in the public subnets, and a fleet of EC2 instances is in the private subnets. The application logs show intermittent connection timeouts. The security group for the EC2 instances allows traffic from the NLB's security group. What is the MOST likely cause?

Accepted Answer

The EC2 instances' security group allows traffic from the NLB's security group, but the NLB preserves client IP, so the security group must allow client IPs directly.. When an NLB is configured with `preserve_client_ip` enabled (the default for internet-facing NLBs), the source IP of incoming packets is the actual client IP, not the NLB's private IP. Therefore, the EC2 instances' security group must allow traffic from the client IPs, not from the NLB's security group. Since the security group only allows traffic from the NLB's security group, packets from client IPs are dropped, causing intermittent connection timeouts.

Answer

Cross-zone load balancing is disabled on the NLB.

Answer

The NLB's security group is not allowing traffic from the EC2 instances.

Answer

The network ACLs in the private subnets are blocking return traffic.

Question 11

A company uses AWS Direct Connect with a private VIF to connect its data center to a VPC. The VPC has multiple subnets. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot connect to an EC2 instance's port 443. The EC2 instance's security group allows HTTPS from the on-premises CIDR. What should the engineer check NEXT?

Accepted Answer

Check the EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) to see if port 443 is blocked.. Since the on-premises team can ping the EC2 instance (ICMP works) but cannot connect to port 443 (HTTPS), the network path is functional at Layer 3. The security group already allows HTTPS from the on-premises CIDR, so the next logical step is to check the EC2 instance's OS-level firewall (e.g., iptables, Windows Firewall), which operates at Layer 4 and can independently block TCP port 443 even when the security group permits it.

Answer

Check the security group's inbound rules for port 443.

Answer

Confirm that the Direct Connect virtual interface is in the 'up' state.

Answer

Verify that the route tables in the VPC have a route back to the on-premises CIDR.

Question 12

A company is building a serverless application using API Gateway, Lambda, and DynamoDB. The API must be accessible from the internet and be resilient to Regional failures. Which design provides the HIGHEST availability?

Accepted Answer

Deploy in two Regions with API Gateway, Lambda, and DynamoDB global tables. Use Route 53 failover routing with health checks.. It combines multi-Region deployment with Route 53 failover routing and health checks, ensuring that if one Region becomes unavailable, traffic is automatically redirected to the healthy Region. API Gateway, Lambda, and DynamoDB global tables provide the necessary cross-Region replication and stateless compute to maintain full functionality during a Regional outage, offering the highest availability.

Answer

Deploy API Gateway, Lambda, and DynamoDB in a single Region with multi-AZ.

Answer

Deploy API Gateway in two Regions behind a Global Accelerator accelerator.

Answer

Use a single API Gateway with CloudFront distribution in front, and Lambda@Edge for compute.

Question 13

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download updates from the internet. The company wants to minimize costs and avoid exposing the instance to inbound internet traffic. Which solution should the engineer choose?

Accepted Answer

Deploy a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway.. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for updates) while remaining unreachable from inbound internet traffic. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then uses the Internet Gateway for outbound traffic. This is the most cost-effective and fully managed solution compared to a NAT instance, as it avoids per-instance management and scales automatically.

Answer

Deploy a NAT instance in the private subnet and route traffic through it.

Answer

Configure a forward proxy on the EC2 instance itself.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 14

A company has a global application that uses Amazon Route 53 for DNS. The application is deployed in us-east-1 and eu-west-1. The company wants to route users to the Region with the lowest latency, but also provide failover if one Region becomes unhealthy. Which Route 53 routing policy should be used?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks is correct because it directs users to the Region that provides the lowest latency for each individual request, while health checks automatically remove unhealthy endpoints from the routing pool. This combination meets both the latency optimization and failover requirements without requiring a static primary/secondary configuration.

Answer

Weighted routing with equal weights

Answer

Failover routing with primary in us-east-1

Answer

Geoproximity routing

Question 15

A company is designing a network for a three-tier application that must be PCI DSS compliant. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers are in the same VPC. What is the MOST secure way to implement this?

Accepted Answer

Place web tier in public subnets, application and database tiers in private subnets. Use security groups to allow only necessary traffic between tiers.. The most secure because it places the web tier in public subnets (for internet access) and the application and database tiers in private subnets (no direct internet access). Security groups are used to allow only the necessary traffic between tiers: from web to app on specific ports, and from app to db on specific ports. Security groups are stateful, which simplifies rule management and reduces attack surface. Option A is wrong because a VPN is unnecessary for intra-VPC traffic and adds complexity without improving security. Option B is wrong because placing all tiers in the same private subnet does not provide network isolation between tiers; security groups alone cannot prevent all lateral movement. Option D is wrong because placing all tiers in public subnets exposes the application and database tiers to the internet, and network ACLs are stateless, requiring symmetric rules and increasing management overhead.

Answer

Use a VPN between the web and application tiers and between application and database tiers.

Answer

Place all tiers in the same private subnet and use security groups for isolation.

Answer

Place all tiers in public subnets and use network ACLs to restrict traffic.