ANS-C01 Network Design Practice Test 22 — 15 Questions

Question 1

A financial services company runs an application in a VPC that must access an on-premises legacy database over a 1 Gbps AWS Direct Connect dedicated connection. The database performs frequent small reads and writes, and the company requires consistent low-latency, low-jitter communication. The Direct Connect connection is configured as a private virtual interface (VIF). The on-premises network advertises its routes to AWS using BGP. The company wants to ensure that traffic from the VPC to the on-premises database always uses the Direct Connect connection and never the internet. Which configuration should be implemented to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a route in the VPC route tables for the on-premises database CIDR with the target as the virtual private gateway (VGW), and ensure the on-premises network advertises that CIDR over BGP.. To force traffic to the on-premises database over Direct Connect, the VPC route table must have a route for the database CIDR pointing to the virtual private gateway. The on-premises network must advertise that CIDR over BGP so the VGW can accept it. This ensures the traffic uses the private VIF and not the internet. Other options either misdirect traffic or rely on default behavior that may not guarantee the required path.

Answer

Configure a static route in the VPC route tables for the on-premises database CIDR pointing to a NAT gateway, and use a Direct Connect gateway to advertise the VPC CIDR to on-premises.

Answer

Enable BGP route propagation on the VPC route tables and rely on the on-premises network to advertise the database CIDR over the private VIF; no manual route entry is needed.

Answer

Advertise a default route (0.0.0.0/0) from the on-premises network over the private VIF, and remove the VPC's internet gateway route from the route tables.

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to connect this VPC to an on-premises data center that uses the CIDR block 10.1.0.0/16. The company also has a second VPC with CIDR 10.2.0.0/16 that must communicate with the first VPC. The company wants to use AWS Transit Gateway to centralize connectivity. The on-premises network is connected via AWS Site-to-Site VPN to the transit gateway. Which of the following must be configured to allow communication between the on-premises network and the second VPC?

Accepted Answer

Create a transit gateway route table, associate the VPN attachment and the VPC attachments, and add routes for the on-premises CIDR and the second VPC CIDR.. To enable communication between the on-premises network and the second VPC through a transit gateway, you must configure the transit gateway route table. This involves associating the VPN attachment and the VPC attachments with the route table and adding routes for the on-premises CIDR and the second VPC CIDR. Additionally, the VPC route tables must have routes pointing to the transit gateway, and the on-premises router must have routes pointing to the VPN. However, the core requirement is the transit gateway route table configuration.

Answer

Create a static route in the on-premises router pointing to the second VPC CIDR via the VPN tunnel, and create a static route in the second VPC route table pointing to the on-premises CIDR via the transit gateway.

Answer

Enable route propagation on the transit gateway route table for the VPN attachment and the VPC attachments.

Answer

Configure a VPC peering connection between the two VPCs and use the transit gateway only for the VPN connection.

Question 3

A company runs a two-tier web application across two Availability Zones in a single VPC. The web tier resides in public subnets behind an Application Load Balancer, and the database tier runs on Amazon RDS in private subnets. A security audit reveals that the database instances can be reached from the internet through their public IP addresses, even though they are not intended to be public. The company wants to eliminate all direct internet exposure of the database tier while preserving outbound software update capability. Which change should a network engineer make?

Accepted Answer

Move the database instances to subnets with no route to an internet gateway or NAT gateway, and remove any public IP associations.. The database tier is exposed because its subnets route to an internet gateway and the instances have public IP addresses. Removing the route to an internet gateway and NAT gateway, and ensuring no public IP is associated, eliminates both inbound and outbound internet reachability. This is the only change that removes the exposure at the network layer rather than merely filtering it.

Answer

Enable VPC Flow Logs on the database subnets and create an Amazon CloudWatch alarm for any inbound internet traffic.

Answer

Create a network ACL on the database subnets that blocks all inbound traffic from 0.0.0.0/0 and allows all outbound traffic.

Answer

Attach a security group to the database instances that denies all inbound traffic and allows only outbound traffic.

Question 4

A company is using AWS Global Accelerator to route traffic to Application Load Balancers (ALBs) in us-east-1 and eu-west-1. They have configured a custom routing accelerator with a port range of 80-80 and a endpoint group in each region. The company wants to ensure that traffic from users in Europe is directed to the eu-west-1 ALB, while users in the US are directed to us-east-1. They have configured a traffic dial of 100 for both endpoint groups. What should the network engineer do to achieve this?

Accepted Answer

Global Accelerator automatically routes users to the closest endpoint group based on latency; no additional configuration is needed.. AWS Global Accelerator automatically routes traffic to the endpoint group that offers the lowest latency to the user. With endpoint groups in us-east-1 and eu-west-1 and traffic dials set to 100, users in Europe will be directed to eu-west-1, and users in the US to us-east-1, based on network latency. Traffic dials and endpoint weights are for controlling traffic distribution percentages, not geographic routing. Route 53 routing policies do not influence Global Accelerator's internal routing.

Answer

Configure a latency-based routing policy in Amazon Route 53 for the Global Accelerator DNS name.

Answer

Use the Global Accelerator endpoint group's endpoint weights to distribute traffic based on user location.

Answer

Adjust the traffic dial for each endpoint group to control the percentage of traffic routed to each region.

Question 5

A financial services company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to connect this VPC to an on-premises data center that uses 10.0.1.0/24 for a critical application. The company must avoid IP address conflicts and wants to use AWS Site-to-Site VPN. Which solution meets these requirements?

Accepted Answer

Re-IP the on-premises application to a non-overlapping CIDR block, then establish the VPN. Site-to-Site VPN cannot route traffic when the VPC and on-premises CIDRs overlap. The only reliable fix is to ensure unique address ranges on both sides. Re-IPing the on-premises application removes the conflict and enables the VPN to function, whereas NAT or PrivateLink do not solve the routing ambiguity.

Answer

Use AWS PrivateLink to connect the VPC to the on-premises network

Answer

Create a new VPC with a non-overlapping CIDR block, migrate the application, and establish the VPN

Answer

Configure the VPN connection and use NAT on the on-premises side to translate the overlapping addresses

Question 6

A financial services company is deploying a latency-sensitive trading application in a VPC. The application uses a Network Load Balancer (NLB) to distribute TCP traffic to a target group of Amazon EC2 instances. The company requires that client source IP addresses be preserved end-to-end so that the application can perform per-client rate limiting and auditing. The EC2 instances are in an Auto Scaling group behind the NLB. Which configuration should the network engineer implement?

Accepted Answer

Configure the NLB with IP targets and enable client IP preservation, then ensure the target security groups allow traffic from the client CIDR.. A Network Load Balancer preserves the client source IP address for TCP traffic when the target is an instance or an IP address, as long as the target's security group allows traffic from the client. Using IP targets and enabling client IP preservation, with security groups permitting the client CIDR, ensures the application receives the original client IP. This is the correct approach for per-client rate limiting and auditing.

Answer

Enable AWS Global Accelerator in front of the NLB and configure the NLB to use instance targets with client IP preservation disabled.

Answer

Use an Application Load Balancer with proxy protocol v2 enabled and register the instances as targets.

Answer

Configure the NLB target group with the preserve_client_ip attribute enabled and ensure the instances are registered by instance ID.

Question 7

A financial services company is building a hybrid architecture that connects an on-premises data center to multiple VPCs in the same AWS Region. The company wants to use AWS Transit Gateway as the hub and requires that all inter-VPC traffic be inspectable by a security VPC. The network team needs to enforce that traffic between any two attached VPCs is routed through the security VPC without creating a full mesh of attachments. Which TWO configuration steps are required to meet these requirements? (Choose two.)

Accepted Answer

Associate the VPC attachments with a route table that has a default route pointing to the security VPC attachment, and associate the security VPC attachment with a route table that has routes to each spoke VPC.. Centralized inspection with Transit Gateway requires appliance mode on the security VPC attachment to preserve flow symmetry across Availability Zones, plus a routing design that sends spoke traffic to the security attachment and gives the security attachment routes back to every spoke. This combination forces all inter-VPC flows through the inspection VPC without a full mesh of attachments or peering connections.

Answer

Create a peering attachment between each spoke VPC and the security VPC, and disable route propagation on the Transit Gateway attachments.

Answer

Enable Transit Gateway multicast on the security VPC attachment and create a multicast group for all spoke VPC CIDRs.

Answer

Associate each VPC attachment with a separate Transit Gateway route table and create a blackhole route for the VPC CIDRs to force traffic through the security VPC.

Question 8

A financial services firm connects its on-premises data center to AWS using two AWS Site-to-Site VPN tunnels over separate internet providers, terminating on a virtual private gateway. The firm requires that traffic from on-premises to a specific VPC subnet always prefer tunnel 1, and that tunnel 2 be used only if tunnel 1 fails, while avoiding asymmetric routing. Which configuration should the network engineer apply?

Accepted Answer

Use BGP on both tunnels and prepend the on-premises AS multiple times on the customer gateway's tunnel 2 advertisement so the virtual private gateway prefers tunnel 1.. BGP AS path length is the mechanism the virtual private gateway uses to choose among routes learned over multiple VPN tunnels. Prepending the on-premises AS multiple times on one tunnel's advertisement lengthens that path, making the other tunnel preferred while remaining available as a standby. When the preferred tunnel's BGP session fails, the standby path becomes the only candidate and is installed, providing automatic failover.

Answer

Configure the customer gateway to advertise the on-premises prefixes only over tunnel 1, and configure a static route over tunnel 2 as a backup with a higher administrative distance.

Answer

Advertise the on-premises routes with a longer AS path prepend on the customer gateway for tunnel 2, and enable equal-cost multipath on the virtual private gateway.

Answer

Use BGP with the same AS path for both tunnels so the virtual private gateway load-balances, and rely on ECMP to provide automatic failover.

Question 9

A financial-services company runs a latency-sensitive trading platform in a single AWS Region. The platform's EC2 instances are spread across three Availability Zones, and the company wants to eliminate cross-AZ data transfer charges for inter-node communication while keeping the ability to survive an AZ failure. The application uses a leader-follower replication protocol that requires all nodes to be in the same Layer 2 broadcast domain. Which network design should a network engineer implement?

Accepted Answer

Place the instances in subnets in all three Availability Zones, attach them to a single VPC, and use AWS Transit Gateway with multicast to carry the broadcast traffic.. Transit Gateway multicast is the only listed option that both preserves multi-AZ placement for AZ-failure survival and provides a one-to-many delivery mechanism that can stand in for Layer 2 broadcast across subnets. Cluster and spread placement groups constrain placement or do not bridge broadcast domains, and VPC peering is a Layer 3 service that never forwards broadcast traffic.

Answer

Create a cluster placement group in a single Availability Zone and use AWS Transit Gateway to connect the other two AZs.

Answer

Deploy the instances in subnets across the three Availability Zones and peer the VPCs with a VPC peering connection in each AZ.

Answer

Deploy a spread placement group across the three Availability Zones and enable enhanced networking with Elastic Fabric Adapter on each instance.

Question 10

A company has an AWS Direct Connect connection with a private virtual interface (VIF) to access resources in a VPC. The company also has a backup AWS Site-to-Site VPN connection over the internet. The on-premises network advertises a default route (0.0.0.0/0) to AWS over both the Direct Connect and the VPN. The company wants to ensure that all traffic from the VPC to on-premises uses the Direct Connect connection primarily, and fails over to the VPN only if Direct Connect becomes unavailable. Which configuration should be implemented?

Accepted Answer

Configure the on-premises router to advertise the same routes over both connections, and use AS_PATH prepending on the VPN BGP session to make the Direct Connect path preferred.. To make Direct Connect primary and VPN backup, the on-premises router should advertise the same routes over both, but with AS_PATH prepending on the VPN session. AWS BGP path selection prefers shorter AS_PATH, so Direct Connect is chosen. If Direct Connect fails, the VPN path becomes active. This is a common BGP design for primary/backup connectivity.

Answer

Advertise more specific routes over the VPN than over Direct Connect, and rely on longest prefix match.

Answer

Use BGP attributes to set a higher local preference for routes learned over Direct Connect, and a lower local preference for VPN routes.

Answer

Create a static route in the VPC route table pointing to the virtual private gateway for the on-premises CIDR, and remove the VPN route.

Question 11

A company is designing a hybrid network that connects an on-premises data center to a VPC using AWS Site-to-Site VPN over the internet. The company requires high availability and wants to ensure that traffic automatically fails over if one VPN tunnel becomes unavailable. The company also wants to minimize data transfer costs while maintaining redundancy. Which TWO actions should the network engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enable dynamic routing using BGP on the customer gateway and the AWS VPN endpoints to allow automatic failover between tunnels.. A Site-to-Site VPN connection includes two tunnels that terminate on different AWS VPN endpoints in separate Availability Zones, providing AWS-side redundancy. Enabling BGP dynamic routing allows the customer gateway and AWS to exchange routes and automatically fail over when a tunnel becomes unavailable. Together, these actions deliver high availability and automatic failover for the hybrid connection.

Answer

Configure a single VPN tunnel with a larger BGP hold time to reduce failover latency.

Answer

Use AWS Direct Connect with a VPN backup to reduce data transfer costs while maintaining redundancy.

Answer

Attach an Elastic IP address to each VPN tunnel endpoint on the AWS side to ensure stable public IP addresses.

Question 12

A financial services company runs a critical trading application in a VPC. The application requires extremely low-latency, high-throughput network performance between two EC2 instances that are in the same placement group and the same Availability Zone. The instances use the latest generation Elastic Network Adapter (ENA). The company wants to ensure that inter-instance traffic achieves the lowest possible latency and highest packet-per-second rate. Which configuration should the network engineer implement to meet these requirements?

Accepted Answer

Enable Elastic Network Adapter (ENA) Express for the instances and attach them to a cluster placement group.. ENA Express leverages the AWS Scalable Reliable Datagram (SRD) protocol to deliver higher throughput and lower tail latency for inter-instance communication. When instances are in a cluster placement group, they are physically close in a single Availability Zone, further minimizing latency. This combination is specifically designed for latency-sensitive, high-performance workloads, making it the correct choice.

Answer

Attach an Elastic Fabric Adapter (EFA) to each instance and configure the application to use the EFA device.

Answer

Enable jumbo frames on the instances and set the MTU to 9001.

Answer

Create a transit gateway and route all inter-instance traffic through it to reduce latency.

Question 13

A company is designing a hybrid network using AWS Direct Connect. The company needs to ensure that traffic from its on-premises data center to AWS is encrypted and that the connection remains available if the primary Direct Connect link fails. The company wants to use a Direct Connect gateway to connect to multiple VPCs in different Regions. Which TWO actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Set up a second Direct Connect connection at a different location for redundancy. To encrypt traffic over Direct Connect, run a Site-to-Site VPN over the Direct Connect connection. To ensure availability if the primary link fails, provision a second Direct Connect connection at a different location. Together, these actions address both the encryption and redundancy requirements while leveraging the Direct Connect gateway for multi-Region VPC connectivity.

Answer

Use AWS Transit Gateway to connect the Direct Connect gateway to multiple VPCs

Answer

Enable MACsec on the Direct Connect connection

Answer

Configure BGP with a higher local preference on the backup connection

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to create a subnet that can host up to 500 EC2 instances. Which subnet CIDR block should they use to meet this requirement while minimizing wasted IP addresses?

Accepted Answer

10.0.0.0/23. A /23 subnet provides 512 total IP addresses, and after AWS reserves 5, 507 are usable, which meets the requirement of 500 instances with minimal waste. A /24 is too small, while /22 and /25 are either larger than needed or insufficient. Thus, the /23 is the optimal choice.

Answer

10.0.0.0/24

Answer

10.0.0.0/25

Answer

10.0.0.0/22

Question 15

A company is deploying a global application that uses Amazon Route 53 for DNS. The application is hosted in two AWS Regions: us-east-1 and eu-west-1. The company wants to route users to the Region with the lowest latency, but also needs the ability to shift all traffic to one Region during a maintenance window. Which Route 53 routing policy should the network engineer use to meet both requirements?

Accepted Answer

Latency-based routing with health checks, and use a Route 53 traffic flow policy with a manual override to shift traffic.. Latency-based routing is designed to route users to the Region with the lowest latency. Route 53 traffic flow policies can combine latency-based routing with a manual override, allowing the engineer to shift all traffic to one Region during maintenance. This provides both the performance benefit and the operational control required. Other routing policies either do not optimize for latency or lack a simple maintenance override.

Answer

Geolocation routing with a default record that points to the primary Region.

Answer

Weighted routing with weights set to 100 and 0, and adjust weights during maintenance.

Answer

Latency-based routing with health checks and a failover record for maintenance.