ANS-C01 Network Design Practice Test 22 — 15 Questions

Question 1

A Network Engineer is troubleshooting a cross-account VPC endpoint connection. The service provider account (123456789012) has the above IAM policy attached to the endpoint service. The consumer account (111111111111) has created a VPC endpoint (vpce-abc123) and is trying to accept the connection. The consumer receives an 'AccessDenied' error when calling ec2:AcceptVpcEndpointConnections. What is the MOST likely cause?

Accepted Answer

The consumer account does not have permission to accept the connection; only the service provider can accept.. Option D is correct. The policy allows the ec2:AcceptVpcEndpointConnections action, but that action is performed by the service provider, not the consumer. The consumer needs to create the endpoint, but the acceptance is done by the provider. The error likely occurs because the consumer does not have permission to call AcceptVpcEndpointConnections on the provider's endpoint service. The policy in the provider account allows the provider to accept connections from the specified consumer endpoint. However, the consumer is trying to accept the connection themselves, which is not allowed. The provider must accept the connection using the provider account. Alternatively, the consumer might be trying to modify the endpoint to auto-accept, but that requires permissions. The most likely cause is that the consumer is attempting to accept the connection, but only the provider can accept. So the answer is D: The consumer does not have the required permissions to accept the connection on the provider's endpoint service.

Answer

The policy action should be 'ec2:CreateVpcEndpoint' instead.

Answer

The policy condition 'aws:SourceArn' does not match the consumer's endpoint ARN.

Answer

The policy resource ARN is incorrect; it should be the endpoint service ARN.

Question 2

A company is designing a multi-region active-active architecture with Amazon Route 53. The application is deployed behind Application Load Balancers (ALBs) in us-east-1 and eu-west-1. The company wants to minimize latency for users and provide automatic failover. Which routing policy should be used?

Accepted Answer

Latency-based routing policy. Latency-based routing directs traffic to the region with the lowest latency for the end user. If one endpoint becomes unhealthy, Route 53 automatically routes to the other, providing failover. Weighted routing requires manual weight adjustments. Failover routing is active-passive. Geolocation routing is based on user location but does not provide automatic failover.

Answer

Failover routing policy

Answer

Geolocation routing policy

Answer

Weighted routing policy

Question 3

A financial services company must ensure that all traffic between its on-premises data center and VPC is encrypted in transit and does not traverse the public internet. The company has an AWS Direct Connect connection. Which solution meets these requirements?

Accepted Answer

Use a private virtual interface (VIF) over the Direct Connect connection and establish an IPsec VPN tunnel over the private VIF. A private VIF over Direct Connect provides a private connection that does not traverse the internet. When combined with IPsec VPN on top of the private VIF, traffic is encrypted. Direct Connect alone does not encrypt traffic. A transit VIF is for connecting to transit gateways, not for encryption. A public VIF accesses public AWS services and still does not encrypt traffic.

Answer

Use a private virtual interface (VIF) and rely on Direct Connect encryption

Answer

Use a public virtual interface (VIF) over the Direct Connect connection and configure an IPsec VPN tunnel over it

Answer

Use a transit virtual interface (VIF) over the Direct Connect connection and attach it to a transit gateway

Question 4

A company is migrating its on-premises data center to AWS. The network team needs to extend the on-premises network to the cloud and support IP multicast traffic between environments. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast support. AWS Transit Gateway supports multicast groups and allows multicast traffic between attached VPCs and VPN connections. VPC peering does not support multicast. AWS Direct Connect alone does not support multicast. A VPN connection alone does not support multicast.

Answer

AWS Direct Connect with a private virtual interface

Answer

Site-to-Site VPN connection

Answer

VPC peering connection

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company does not want to assign public IP addresses to the instance. Which combination of resources is required? (Choose TWO.)

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. An Internet Gateway is needed for the NAT Gateway to reach the internet, but the question asks for resources; the IGW is already implied. A VPC endpoint is for AWS services, not internet. A VPN connection is for on-premises connectivity.

Answer

VPN connection to the on-premises data center

Answer

VPC endpoint for Amazon S3

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. It has two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). Both subnets have a route to an Internet Gateway. An EC2 instance in subnet A has a security group that allows inbound HTTP from 0.0.0.0/0. The instance's network ACL allows inbound HTTP from 0.0.0.0/0. Users report they cannot access the web server. What is the most likely cause?

Accepted Answer

The instance does not have a public IP address. The instance does not have a public IP address, so it cannot be reached from the internet. Without a public IP or Elastic IP, traffic from the internet cannot be routed to the instance even if security groups and network ACLs allow it.

Answer

The network ACL inbound rule is incorrectly configured

Answer

The security group is not associated with the instance

Answer

The route table does not have a route to the Internet Gateway

Question 7

A company wants to connect multiple VPCs across different AWS accounts to a common on-premises network using AWS Transit Gateway. Which resource should be used to allow cross-account VPC attachments?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) allows sharing Transit Gateways across accounts. VPC peering does not attach to Transit Gateway. AWS Organizations is an organization management service but does not directly share Transit Gateways. AWS PrivateLink is for private connectivity to services.

Answer

AWS PrivateLink

Answer

VPC peering connection

Answer

AWS Organizations

Question 8

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

Accepted Answer

Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group. A bastion host in a public subnet with a security group that allows SSH only from the corporate IP range, and the database security group allowing MySQL access only from the bastion host's security group, provides defense in depth. Using the same security group for both is less secure. Allowing SSH from anywhere (0.0.0.0/0) is insecure. A VPN provides secure access but is not always the simplest for maintenance; the bastion approach is common and secure when properly restricted.

Answer

Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

Answer

Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

Answer

Connect to the database directly using a Site-to-Site VPN without a bastion host

Question 9

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?

Accepted Answer

Place each tier in a separate subnet and use security groups to allow traffic between tiers. Placing each tier in separate subnets and using security groups to control inbound traffic between tiers is the standard approach. Using network ACLs is less granular and not stateful. VPC endpoints are for AWS services, not for tier-to-tier communication. A single subnet with NAT would not isolate tiers.

Answer

Place each tier in a separate subnet and use network ACLs to allow traffic between tiers

Answer

Place all tiers in the same subnet and use security groups to control traffic

Answer

Place all tiers in a public subnet and use a NAT gateway for the application and database tiers

Question 10

A company has an AWS Direct Connect connection and wants to use it to access Amazon S3 buckets without traversing the public internet. Which virtual interface type should be used?

Accepted Answer

Public virtual interface. A public virtual interface (VIF) allows access to public AWS services, including S3, over Direct Connect. A private VIF is for accessing resources in a VPC. A transit VIF is for connecting to a transit gateway. A hosted VIF is provided by an AWS partner.

Answer

Transit virtual interface

Answer

Hosted virtual interface

Answer

Private virtual interface

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16. It has a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows private subnet instances to access S3 without internet. A NAT Gateway uses the internet. An Interface Endpoint is for other AWS services, not S3. Direct Connect is not necessary for S3 access within the same region.

Answer

Create a VPC Interface Endpoint for S3 and associate it with the private subnet

Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway

Answer

Set up an AWS Direct Connect connection and use a private virtual interface

Question 12

A company has a VPC with two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an EC2 instance in subnet B. The instances are in the same VPC. What is the default behavior?

Accepted Answer

Communication is allowed by default because they are in the same VPC. By default, instances within the same VPC can communicate with each other regardless of subnet, as long as security groups and network ACLs allow traffic. No additional configuration is needed.

Answer

Communication is not allowed by default; a VPC peering connection is required

Answer

Communication is allowed only if they are in the same subnet

Answer

Communication is allowed only if a transit gateway is attached

Question 13

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host databases that must be accessible only from the application servers in the public subnets. Which VPC feature should be used to allow the application servers to access the databases while preventing direct internet access to the databases?

Accepted Answer

Attach a NAT Gateway in a public subnet and update the route table of the private subnets to point to the NAT Gateway for outbound traffic.. Option B is correct because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet, but it does not allow inbound traffic from the internet, which aligns with the requirement. Option A is wrong because an Internet Gateway would allow inbound traffic from the internet. Option C is wrong because a VPC Peering connection is used for connecting VPCs. Option D is wrong because a Virtual Private Gateway is used for VPN connections.

Answer

Create a VPC Peering connection between the public and private subnets.

Answer

Attach an Internet Gateway to the VPC and update the route table of the private subnets to point to the Internet Gateway.

Answer

Attach a Virtual Private Gateway to the VPC and update the route table of the private subnets.

Question 14

A company is deploying a multi-tier web application across multiple AWS accounts. They want to centralize network security by using a shared services VPC with a Transit Gateway. All application VPCs will be attached to the Transit Gateway. The security team needs to inspect and filter traffic between application VPCs. Which solution should be used to meet this requirement?

Accepted Answer

Deploy a Transit Gateway and attach a central inspection VPC with a firewall appliance. Configure route tables to send inter-VPC traffic through the inspection VPC.. Option C is correct because a Transit Gateway with a central inspection VPC containing a firewall appliance (like Palo Alto Networks or AWS Network Firewall) allows traffic to be routed through the inspection point for filtering. Option A is wrong because Network ACLs are stateless and applied at the subnet level, not between VPCs. Option B is wrong because security groups are stateful and applied at the instance level, not for traffic between VPCs. Option D is wrong because VPC Peering does not support centralized inspection by default.

Answer

Create VPC Peering connections between each pair of application VPCs and apply security groups to the peer connections.

Answer

Use security groups in each application VPC to control traffic between VPCs.

Answer

Use network ACLs in each application VPC to filter traffic between VPCs.

Question 15

A company is designing a hybrid network with multiple AWS Direct Connect connections to multiple on-premises data centers. They want to maximize availability and use all available bandwidth. They have two Direct Connect connections terminated at two different Direct Connect locations. They plan to use a single Virtual Private Gateway (VGW) for each VPC. Which configuration should be used to meet these requirements?

Accepted Answer

Create a Direct Connect Gateway. Attach both Direct Connect connections to the Direct Connect Gateway. Associate the Direct Connect Gateway with the VGW. Configure the on-premises routers to use BGP with equal-cost multipath (ECMP).. Option A is correct because using a Direct Connect Gateway with multiple virtual interfaces (VIFs) to the same VGW enables active-active traffic and failover across the two connections. Option B is wrong because two separate VGWs cannot be associated with the same VPC. Option C is wrong because a single VIF cannot use multiple connections. Option D is wrong because two separate VGWs are not supported for a single VPC.

Answer

Create two VGWs and attach each to a separate Direct Connect connection. Use a Transit Gateway to connect the VGWs to the VPC.

Answer

Create two Virtual Private Gateways, one for each Direct Connect connection. Attach each VGW to the VPC. Configure BGP on both connections for active-active.

Answer

Create a single virtual interface and associate it with both Direct Connect connections. Attach the virtual interface to the VGW.

ANS-C01 Network Design Practice Test 22 — 15 Questions

Exhibit

ANS-C01 Network Design Practice Test 22 — 15 Questions

Exhibit