ANS-C01 Network Design Practice Test 22 — 15 Questions

Question 1

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 2

A company is designing a VPC architecture for a web application that must be highly available across multiple Availability Zones. Which TWO components should be deployed in at least two Availability Zones to meet this requirement?

Accepted Answer

NAT Gateway. A NAT Gateway is a regional resource that is deployed within a specific Availability Zone, but to achieve high availability across multiple AZs, you must deploy a NAT Gateway in each AZ used by your application. This ensures that if one AZ fails, instances in other AZs can still access the internet or other AWS services through their local NAT Gateway, preventing a single point of failure.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPN connection

Question 3

A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which TWO entries must exist in the route table for the traffic to succeed?

Accepted Answer

Destination: 10.0.0.0/16, Target: local. For traffic from an EC2 instance in a VPC to an on-premises server over a Direct Connect private VIF, the route table must include two entries: a local route for the VPC CIDR (10.0.0.0/16) which is automatically added and enables communication within the VPC (Option C), and a specific route to the on-premises network (192.168.1.0/24) pointing to the virtual private gateway (vgw-xxxxxxxx) so that traffic destined for 192.168.1.50 is directed over the Direct Connect (Option D). No other entries are required; the local route already covers all subnets, and there is no need for a default route to the internet.

Answer

Destination: 0.0.0.0/0, Target: igw-xxxxxxxx

Answer

Destination: 0.0.0.0/0, Target: nat-xxxxxxxx

Answer

Destination: 10.0.1.0/29, Target: local

Question 4

A Network Engineer is troubleshooting a cross-account VPC endpoint connection. The service provider account (123456789012) has the above IAM policy attached to the endpoint service. The consumer account (111111111111) has created a VPC endpoint (vpce-abc123) and is trying to accept the connection. The consumer receives an 'AccessDenied' error when calling ec2:AcceptVpcEndpointConnections. What is the MOST likely cause?

Accepted Answer

The consumer account does not have permission to accept the connection; only the service provider can accept.. The 'AccessDenied' error occurs because the consumer account (111111111111) is attempting to call ec2:AcceptVpcEndpointConnections, which is an API action that only the service provider account (123456789012) can perform. The IAM policy shown is attached to the endpoint service in the provider account, but the consumer does not have permission to accept its own connection; instead, the provider must accept the endpoint connection request. This is a fundamental AWS VPC endpoint service behavior where the provider controls acceptance, not the consumer.

Answer

The policy action should be 'ec2:CreateVpcEndpoint' instead.

Answer

The policy condition 'aws:SourceArn' does not match the consumer's endpoint ARN.

Answer

The policy resource ARN is incorrect; it should be the endpoint service ARN.

Question 5

A company is designing a multi-region active-active architecture with Amazon Route 53. The application is deployed behind Application Load Balancers (ALBs) in us-east-1 and eu-west-1. The company wants to minimize latency for users and provide automatic failover. Which routing policy should be used?

Accepted Answer

Latency-based routing policy. Latency-based routing policy is the correct choice because it directs traffic to the AWS region that provides the lowest latency for the end user, which aligns with the requirement to minimize latency. Additionally, Route 53 automatically performs health checks on the ALBs; if one region's ALB becomes unhealthy, Route 53 routes traffic to the healthy region, providing automatic failover in an active-active architecture.

Answer

Failover routing policy

Answer

Geolocation routing policy

Answer

Weighted routing policy

Question 6

A financial services company must ensure that all traffic between its on-premises data center and VPC is encrypted in transit and does not traverse the public internet. The company has an AWS Direct Connect connection. Which solution meets these requirements?

Accepted Answer

Use a private virtual interface (VIF) over the Direct Connect connection and establish an IPsec VPN tunnel over the private VIF. A private virtual interface (VIF) provides private, non-internet-routed connectivity between the on-premises data center and the VPC over AWS Direct Connect. However, Direct Connect itself does not natively encrypt traffic; by establishing an IPsec VPN tunnel over the private VIF, you add end-to-end encryption (e.g., using AES-256) while keeping all traffic off the public internet, meeting both requirements.

Answer

Use a private virtual interface (VIF) and rely on Direct Connect encryption

Answer

Use a public virtual interface (VIF) over the Direct Connect connection and configure an IPsec VPN tunnel over it

Answer

Use a transit virtual interface (VIF) over the Direct Connect connection and attach it to a transit gateway

Question 7

A company is migrating its on-premises data center to AWS. The network team needs to extend the on-premises network to the cloud and support IP multicast traffic between environments. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast support. AWS Transit Gateway with multicast support is the correct choice because it is the only AWS service that natively supports IP multicast traffic between VPCs and on-premises networks. It allows you to create multicast domains and associate subnets, enabling multicast sources and receivers to communicate across attached networks, including on-premises via AWS Direct Connect or Site-to-Site VPN.

Answer

AWS Direct Connect with a private virtual interface

Answer

Site-to-Site VPN connection

Answer

VPC peering connection

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company does not want to assign public IP addresses to the instance. Which combination of resources is required? (Choose TWO.)

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. An Internet Gateway is needed for the NAT Gateway to reach the internet, but the question asks for resources; the IGW is already implied. A VPC endpoint is for AWS services, not internet. A VPN connection is for on-premises connectivity.

Answer

VPN connection to the on-premises data center

Answer

VPC endpoint for Amazon S3

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. It has two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). Both subnets have a route to an Internet Gateway. An EC2 instance in subnet A has a security group that allows inbound HTTP from 0.0.0.0/0. The instance's network ACL allows inbound HTTP from 0.0.0.0/0. Users report they cannot access the web server. What is the most likely cause?

Accepted Answer

The instance does not have a public IP address. The most likely cause is that the EC2 instance does not have a public IP address. Even though the security group and network ACL allow inbound HTTP from 0.0.0.0/0, and the subnet has a route to an Internet Gateway (IGW), the instance must have a public IPv4 address (or an Elastic IP) for the IGW to translate its private IP to a public IP and route traffic from the internet. Without a public IP, the IGW cannot forward inbound traffic to the instance, making it unreachable from the internet.

Answer

The network ACL inbound rule is incorrectly configured

Answer

The security group is not associated with the instance

Answer

The route table does not have a route to the Internet Gateway

Question 10

A company wants to connect multiple VPCs across different AWS accounts to a common on-premises network using AWS Transit Gateway. Which resource should be used to allow cross-account VPC attachments?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) enables you to share a Transit Gateway with other AWS accounts within your organization or externally. Once shared, the recipient account can attach its VPCs to the shared Transit Gateway, allowing cross-account VPC attachments to a common on-premises network.

Answer

AWS PrivateLink

Answer

VPC peering connection

Answer

AWS Organizations

Question 11

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

Accepted Answer

Bastion host in a public subnet with a security group allowing SSH from the corporate IP range, and database security group allowing MySQL from the bastion host's security group. The most secure architecture because it restricts SSH access to the bastion host from only the corporate IP range, and the database security group allows MySQL (port 3306) traffic solely from the bastion host's security group. This ensures the database is never directly exposed to the internet and only accepts connections from the bastion, which itself is locked down to authorized corporate IPs. The use of security group referencing (instead of IP-based rules) provides dynamic, scalable access control that automatically applies to any instances with the bastion's security group.

Answer

Bastion host in a public subnet with the same security group as the database, allowing SSH from the corporate IP range and MySQL from the bastion

Answer

Bastion host in a public subnet with a security group allowing SSH from 0.0.0.0/0, and database security group allowing MySQL from the bastion host's security group

Answer

Connect to the database directly using a Site-to-Site VPN without a bastion host

Question 12

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?

Accepted Answer

Place each tier in a separate subnet and use security groups to allow traffic between tiers. Security groups act as a stateful virtual firewall at the instance level, allowing you to specify inbound and outbound rules based on source/destination security group IDs. By placing each tier in a separate subnet and referencing the web tier's security group as the source for the application tier's inbound rule, and the application tier's security group as the source for the database tier's inbound rule, you achieve the required least-privilege access without exposing the application or database tiers to the internet.

Answer

Place each tier in a separate subnet and use network ACLs to allow traffic between tiers

Answer

Place all tiers in the same subnet and use security groups to control traffic

Answer

Place all tiers in a public subnet and use a NAT gateway for the application and database tiers

Question 13

A company has an AWS Direct Connect connection and wants to use it to access Amazon S3 buckets without traversing the public internet. Which virtual interface type should be used?

Accepted Answer

Public virtual interface. A public virtual interface is the correct choice because it allows access to AWS public services, such as Amazon S3, over a Direct Connect connection without traversing the public internet. It uses the same BGP peering and routing policies as private virtual interfaces but directs traffic to the public IP address space of AWS services, ensuring traffic stays within the AWS global network.

Answer

Transit virtual interface

Answer

Hosted virtual interface

Answer

Private virtual interface

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16. It has a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without traversing the internet, using AWS's internal network. By adding a route in the private subnet's route table pointing to the gateway endpoint (prefix list for S3), traffic destined for S3 stays within the AWS network, meeting the requirement to avoid internet transit.

Answer

Create a VPC Interface Endpoint for S3 and associate it with the private subnet

Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet route table pointing to the NAT Gateway

Answer

Set up an AWS Direct Connect connection and use a private virtual interface

Question 15

A company has a VPC with two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an EC2 instance in subnet B. The instances are in the same VPC. What is the default behavior?

Accepted Answer

Communication is allowed by default because they are in the same VPC. By default, all instances within the same VPC can communicate with each other regardless of which subnet they reside in, as long as the VPC's main route table and network ACLs allow the traffic. The VPC's implicit router provides connectivity between all subnets, and the default security group allows inbound traffic from other members of the same security group. Therefore, an EC2 instance in subnet A can communicate with an instance in subnet B without any additional configuration.

Answer

Communication is not allowed by default; a VPC peering connection is required

Answer

Communication is allowed only if they are in the same subnet

Answer

Communication is allowed only if a transit gateway is attached