ANS-C01 Network Design Practice Test 21 — 15 Questions

Question 1

Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?

Accepted Answer

The policy must include a condition that the accepter VPC owner is the target account.. Option B is correct because when creating a VPC peering connection across AWS accounts, the requester's IAM policy must include a condition that explicitly allows the action only when the accepter VPC owner is the target account. Without this condition, the ec2:CreateVpcPeeringConnection action will fail because the policy lacks the necessary cross-account authorization context. The condition key aws:SourceAccount or ec2:AccepterVpcOwnerId must be used to restrict the action to the specific accepter account.

Answer

The ec2:CreateVpcPeeringConnection action is not allowed on the accepter VPC.

Answer

The user needs ec2:ModifyVpcPeeringConnectionOptions permission.

Answer

The user needs ec2:CreateVpcEndpoint permission.

Question 2

A company is designing a multi-region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application uses Aurora MySQL global database. Which design should be used to minimize cross-region latency for writes?

Accepted Answer

Deploy an ALB in each region with a Global Accelerator endpoint group containing both ALBs.. Option D is correct because deploying an ALB in each region and adding both to a Global Accelerator endpoint group enables active-active traffic distribution with optimal path routing via the AWS global network. Global Accelerator uses Anycast IPs to direct user traffic to the nearest healthy endpoint, minimizing latency. For writes to an Aurora MySQL global database, the primary region handles all write operations, but Global Accelerator ensures that write requests are routed to the primary region's ALB with the lowest possible latency from the client's location, while read traffic can be served locally from the secondary region's ALB.

Answer

Use Route 53 latency-based routing with a single ALB in the primary region.

Answer

Use Amazon CloudFront with origins in both regions and cache invalidation for writes.

Answer

Use Global Accelerator with a single ALB endpoint in one region and failover to the second region.

Question 3

A network engineer is designing a hybrid network using AWS Transit Gateway with multiple VPCs and an on-premises data center connected via AWS Direct Connect. The VPCs need to communicate with each other and with on-premises, but must isolate development VPCs from production VPCs. What is the MOST scalable and cost-effective approach?

Accepted Answer

Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.. Option A is correct because Transit Gateway route tables allow isolation between VPCs while sharing connectivity to on-premises. Option B is wrong because VPC peering does not scale and requires full mesh. Option C is wrong because a single route table would not isolate development and production. Option D is wrong because VPN over Direct Connect adds complexity and cost without benefit.

Answer

Use a single Transit Gateway with one route table for all VPCs and on-premises, and use network ACLs for isolation.

Answer

Create VPC peering connections between all VPCs and a Direct Connect gateway for on-premises connectivity.

Answer

Use a VPN connection from each VPC to on-premises over Direct Connect, and allow VPC communication via VPN.

Question 4

A company wants to provide its employees with access to a set of internal web applications hosted in a VPC. The applications are accessed via an internet-facing ALB. Security requirements mandate that employees connect only from the corporate network (on-premises) and not from the public internet. Which solution meets these requirements?

Accepted Answer

Set up an AWS Client VPN endpoint in the VPC and make the ALB internal. Employees connect via the VPN.. Option D is correct because AWS Client VPN provides secure access from on-premises without exposing the ALB to the internet. Option A is wrong because security groups don't filter by IP of the VPN; the ALB would still be internet-facing. Option B is wrong because it still exposes the ALB to the internet. Option C is wrong because on-premises users would need public internet access to reach the ALB.

Answer

Make the ALB internal and use a NAT gateway to provide internet access.

Answer

Deploy a CloudFront distribution with an origin access identity pointing to the ALB.

Answer

Keep the ALB internet-facing but restrict access using a security group that allows only the corporate public IP range.

Question 5

A company has a VPC with public and private subnets in three Availability Zones. An internet-facing Network Load Balancer (NLB) is deployed in the public subnets, and a fleet of EC2 instances is in the private subnets. The application logs show intermittent connection timeouts. The security group for the EC2 instances allows traffic from the NLB's security group. What is the MOST likely cause?

Accepted Answer

The EC2 instances' security group allows traffic from the NLB's security group, but the NLB preserves client IP, so the security group must allow client IPs directly.. Option C is correct because NLB's source IP preservation by default sends traffic with client IP, not NLB's private IP, so security group must allow client IPs. Option A is wrong because subnet ACLs are stateless and need ephemeral ports open. Option B is wrong because NLB does not have a security group. Option D is wrong because cross-zone load balancing is enabled by default for NLB.

Answer

Cross-zone load balancing is disabled on the NLB.

Answer

The NLB's security group is not allowing traffic from the EC2 instances.

Answer

The network ACLs in the private subnets are blocking return traffic.

Question 6

A company uses AWS Direct Connect with a private VIF to connect its data center to a VPC. The VPC has multiple subnets. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot connect to an EC2 instance's port 443. The EC2 instance's security group allows HTTPS from the on-premises CIDR. What should the engineer check NEXT?

Accepted Answer

Check the EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) to see if port 443 is blocked.. Option C is correct because the instance may have a host-based firewall blocking the port; this is a common issue. Option A is wrong because route tables are for routing, not port filtering. Option B is wrong because security group already allows the traffic. Option D is wrong because the virtual interface is up (ping works).

Answer

Check the security group's inbound rules for port 443.

Answer

Confirm that the Direct Connect virtual interface is in the 'up' state.

Answer

Verify that the route tables in the VPC have a route back to the on-premises CIDR.

Question 7

A company is building a serverless application using API Gateway, Lambda, and DynamoDB. The API must be accessible from the internet and be resilient to Regional failures. Which design provides the HIGHEST availability?

Accepted Answer

Deploy in two Regions with API Gateway, Lambda, and DynamoDB global tables. Use Route 53 failover routing with health checks.. Option B is correct because using a custom domain with Route 53 failover routing to API Gateway in two regions provides regional failover. Option A is wrong because a single region is not resilient. Option C is wrong because CloudFront does not provide active-active for API Gateway across regions. Option D is wrong because Global Accelerator does not support API Gateway as an endpoint.

Answer

Deploy API Gateway, Lambda, and DynamoDB in a single Region with multi-AZ.

Answer

Deploy API Gateway in two Regions behind a Global Accelerator accelerator.

Answer

Use a single API Gateway with CloudFront distribution in front, and Lambda@Edge for compute.

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download updates from the internet. The company wants to minimize costs and avoid exposing the instance to inbound internet traffic. Which solution should the engineer choose?

Accepted Answer

Deploy a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway.. Option C is correct because a NAT Gateway in the public subnet allows outbound internet access from private instances while blocking inbound traffic. Option A is wrong because a NAT instance is more expensive and less managed. Option B is wrong because an internet gateway alone does not allow private instances to reach the internet. Option D is wrong because a proxy would need to be managed and adds latency.

Answer

Deploy a NAT instance in the private subnet and route traffic through it.

Answer

Configure a forward proxy on the EC2 instance itself.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet's route table.

Question 9

A company has a global application that uses Amazon Route 53 for DNS. The application is deployed in us-east-1 and eu-west-1. The company wants to route users to the Region with the lowest latency, but also provide failover if one Region becomes unhealthy. Which Route 53 routing policy should be used?

Accepted Answer

Latency-based routing with health checks. Option D is correct because latency-based routing with health checks automatically routes to the lowest latency region that is healthy. Option A is wrong because geoproximity routing uses location, not latency. Option B is wrong because failover routing does not consider latency. Option C is wrong because weighted routing does not consider latency or health.

Answer

Weighted routing with equal weights

Answer

Failover routing with primary in us-east-1

Answer

Geoproximity routing

Question 10

A company is designing a network for a three-tier application that must be PCI DSS compliant. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers are in the same VPC. What is the MOST secure way to implement this?

Accepted Answer

Place web tier in public subnets, application and database tiers in private subnets. Use security groups to allow only necessary traffic between tiers.. Option A is correct because separate public and private subnets with security groups restricting traffic between tiers provide the required isolation. Option B is wrong because network ACLs are stateless and harder to manage for this use case. Option C is wrong because a single subnet does not provide isolation. Option D is wrong because a VPN is unnecessary for intra-VPC traffic.

Answer

Use a VPN between the web and application tiers and between application and database tiers.

Answer

Place all tiers in the same private subnet and use security groups for isolation.

Answer

Place all tiers in public subnets and use network ACLs to restrict traffic.

Question 11

A company is designing a Direct Connect solution for high availability. Which TWO actions meet the requirement for diverse physical paths?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Option B is correct because provisioning two Direct Connect connections at two different Direct Connect locations ensures that the physical paths are geographically diverse, eliminating a single point of failure. Option C is correct because using a Transit Gateway with attachments to multiple Direct Connect gateways allows traffic to be routed over separate connections, providing path diversity even if the connections are at the same location, as long as they are associated with different gateways and virtual interfaces.

Answer

Provision two Direct Connect connections at the same Direct Connect location.

Answer

Provision a single Direct Connect connection and use link aggregation (LAG).

Answer

Use a single Direct Connect connection with a VPN backup.

Question 12

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Options A, B, and C are correct. Transit Gateway requires VPC attachments, route tables with routes to each other's CIDR, and association of attachments to route tables. Option D is wrong because you can create a single route table and associate all attachments; separate route tables are needed for isolation, not required for full mesh. Option E is wrong because a transit gateway does not require a VPN attachment for VPC-to-VPC routing.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 13

A company is designing a VPC architecture for a web application that must be highly available across multiple Availability Zones. Which TWO components should be deployed in at least two Availability Zones to meet this requirement?

Accepted Answer

NAT Gateway. Options B and D are correct. NAT Gateways are AZ-specific, so deploying in multiple AZs ensures availability if one AZ fails. Application Load Balancers are regional services but can be configured with subnets in multiple AZs. Option A is wrong because an Internet Gateway is a horizontally scaled, redundant service per VPC, not per AZ. Option C is wrong because a VPN connection is per VPC, not per AZ. Option E is wrong because a Transit Gateway is a regional service.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPN connection

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which THREE entries must exist in the route table for the traffic to succeed?

Accepted Answer

Destination: 0.0.0.0/0, Target: nat-xxxxxxxx. Options A, B, and D are correct. The subnet route table needs a default route to the NAT Gateway for internet, but for on-premises, it needs a route to the virtual private gateway. A local route for the VPC CIDR is automatically added. For outbound traffic to on-premises, a route to the virtual private gateway for the on-premises CIDR is required. Option C is wrong because the subnet is 10.0.1.0/24, not 10.0.1.0/29. Option E is wrong because a route to the internet gateway is not needed for on-premises traffic.

Answer

Destination: 0.0.0.0/0, Target: igw-xxxxxxxx

Answer

Destination: 10.0.1.0/29, Target: local

Question 15

An engineer runs the command above for a subnet associated with this network ACL. The subnet's CIDR is 10.0.1.0/24. An EC2 instance in the subnet attempts to initiate an HTTPS connection to a server on the internet. What is the result?

Accepted Answer

The connection fails because the inbound HTTPS return traffic is denied by rule 200.. Option C is correct. The outbound rule allows ephemeral ports for return traffic. Inbound rule 100 allows HTTPS from the subnet CIDR only, not from the internet. Rule 200 denies all other HTTPS inbound. Therefore, the outbound SYN packet is allowed by the default outbound allow (since no outbound deny), but the inbound SYN-ACK from the internet is denied by rule 200 (since it is HTTPS return traffic, source port 443, destination ephemeral port). However, the outbound rule allows traffic to any destination on ephemeral ports, but the inbound rule for return traffic must match the source port (443) and destination port (ephemeral). The inbound rules show rule 100 allows from 10.0.1.0/24 port 443, which is not the return path. Rule 200 denies all HTTPS from anywhere. So the inbound SYN-ACK is dropped. The connection fails.

Answer

The connection fails because the outbound rule does not allow HTTPS.

Answer

The connection succeeds because outbound traffic is allowed.

Answer

The connection succeeds because inbound rule 100 allows HTTPS from the subnet.

ANS-C01 Network Design Practice Test 21 — 15 Questions

Exhibit

ANS-C01 Network Design Practice Test 21 — 15 Questions

Exhibit