ANS-C01 Network Design Practice Test 23 — 15 Questions

Question 1

A logistics company runs a centralized inspection VPC that all spoke VPCs connect to through a transit gateway. Security policy requires that traffic between any two spokes be inspected by a fleet of third-party firewall appliances running as EC2 instances behind a Gateway Load Balancer endpoint in the inspection VPC. The network engineer must ensure spoke-to-spoke traffic is redirected through the appliance fleet. Which two actions are required to meet this requirement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate the inspection VPC with a route table on the transit gateway that has a default route pointing to the Gateway Load Balancer endpoint attachment.. Traffic between spokes traverses the transit gateway, so the spoke attachments must be associated with a route table whose default route targets the inspection VPC attachment, and the inspection VPC's own route table must send traffic to the Gateway Load Balancer endpoint. Enabling appliance mode on the inspection attachment keeps each flow pinned to one firewall instance so stateful inspection works correctly in both directions.

Answer

Replace the Gateway Load Balancer endpoint with a Network Load Balancer and register the firewall instances as targets in each Availability Zone.

Answer

Attach an internet gateway to the inspection VPC and route all spoke traffic through it so the appliances can inspect packets in transit.

Answer

Configure each spoke VPC route table with a route to the Gateway Load Balancer endpoint using the appliance VPC CIDR as the destination.

Question 2

A company runs a three-tier web application in a VPC that spans three Availability Zones. The database tier must remain private, the application tier must reach an on-premises Oracle database over a 1 Gbps AWS Direct Connect connection with a private virtual interface, and the web tier must be reachable from the internet through a Network Load Balancer. The company wants to minimize data transfer charges while keeping the database tier isolated from the public internet. Which combination of VPC components should the network engineer implement?

Accepted Answer

Deploy the database tier in private subnets with no internet route, the application tier in private subnets with a route to the Direct Connect private virtual interface, and the web tier in public subnets behind the Network Load Balancer.. The database tier must stay isolated, so it belongs in private subnets with no internet route. The application tier needs private connectivity to on-premises, which a Direct Connect private virtual interface provides without traversing the internet. The web tier must be internet-facing and is served by public subnets behind the Network Load Balancer. Combining these placements satisfies isolation, private connectivity, and public reachability while minimizing data transfer charges.

Answer

Deploy the database tier in public subnets with security groups restricting access, the application tier in private subnets with a NAT gateway, and the web tier behind an Application Load Balancer.

Answer

Deploy all three tiers in private subnets, use a transit gateway to connect to the on-premises network, and attach an internet gateway to the VPC for the web tier.

Answer

Deploy the database tier in private subnets with a NAT gateway for outbound traffic, the application tier in public subnets, and the web tier behind an internet gateway.

Question 3

A retail company is deploying a new VPC for a web application. The application must be reachable from the internet on HTTP and HTTPS, and the company wants the application instances to remain in private subnets with no public IP addresses. A network engineer needs to design the ingress path. Which combination of components is required to meet these requirements?

Accepted Answer

An internet gateway attached to the VPC, public subnets in at least two Availability Zones, a NAT gateway in each public subnet, and an Application Load Balancer in the public subnets.. Internet-facing ingress to private application instances requires a load balancer in public subnets that route to an internet gateway, and the instances themselves stay in private subnets. NAT gateways in the public subnets give the private instances outbound internet access for updates. The other designs either expose the instances, use an inappropriate gateway, or omit the public path.

Answer

An internet gateway attached to the VPC, public subnets in one Availability Zone, an Application Load Balancer in those public subnets, and application instances in the same public subnets with public IP addresses.

Answer

A virtual private gateway attached to the VPC, public subnets in at least two Availability Zones, and an Application Load Balancer with an Elastic IP address in the private subnets.

Answer

An internet gateway attached to the VPC, private subnets in at least two Availability Zones, and a Network Load Balancer in the private subnets with a public IP address assigned to each instance.

Question 4

A network engineer is designing a hub-and-spoke topology in a single AWS Region using AWS Transit Gateway. There are 40 VPC attachments across production, development, and shared services accounts. Production VPCs must communicate only with shared services VPCs, development VPCs must communicate only with each other, and shared services VPCs must communicate with all VPCs. The engineer wants to enforce these requirements with the fewest transit gateway route tables. Which configuration should the engineer use?

Accepted Answer

Create two transit gateway route tables: associate production and shared services VPCs with one table, and development VPCs with the other. Propagate shared services routes into the development table and development routes into the shared services table.. Two transit gateway route tables satisfy the topology: one table associated with production and shared services VPCs, and a second table associated with development VPCs. Propagating shared services routes into the development table gives development VPCs access to shared services, and development VPCs share a table so they can reach each other. Shared services routes are also present in the production table through association, while production routes never reach development, enforcing the required isolation with the fewest route tables.

Answer

Create two transit gateway route tables: associate production and development VPCs with one table, and shared services VPCs with the other. Propagate all routes between the two tables.

Answer

Create three transit gateway route tables: one for production, one for development, and one for shared services. Associate each VPC with its corresponding route table and propagate shared services routes into production and development tables.

Answer

Create one transit gateway route table, associate all VPC attachments with it, and use transit gateway route table propagations to control which routes are visible.

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16 and wants to add a secondary CIDR block of 100.64.0.0/16 to support additional workloads. The network engineer needs to ensure that instances in the new CIDR range can communicate with existing instances and with on-premises resources reachable over a Direct Connect private virtual interface. Which statement describes the correct approach?

Accepted Answer

Associate the secondary CIDR block with the VPC, create subnets from it, and update route tables and the virtual private gateway to advertise and route the new range.. A VPC can have a primary CIDR block plus additional IPv4 CIDR blocks associated to it. After associating the secondary CIDR, the engineer creates subnets from the new range, adds routes for the new CIDR in the appropriate route tables, and ensures the virtual private gateway advertises the new range to on-premises. This allows new workloads to communicate with existing instances and with on-premises resources over the Direct Connect private virtual interface.

Answer

Modify the existing VPC CIDR block from 10.0.0.0/16 to 100.64.0.0/16 and recreate the subnets with the new range.

Answer

Create a new VPC with the 100.64.0.0/16 CIDR block and peer it with the existing VPC, then advertise the new range over the Direct Connect connection.

Answer

Add the 100.64.0.0/16 range as a prefix list in the route table and associate it with the existing subnets without creating new subnets.

Question 6

A company runs a latency-sensitive trading platform in a single VPC. The platform uses an Application Load Balancer (ALB) to distribute traffic to a target group of Amazon EC2 instances. The company wants to ensure that the ALB distributes incoming connections across all targets in the target group while preserving source IP addresses for logging and security analysis. The security team requires that the ALB does not terminate TLS and that the client IP is preserved. Which configuration should the company use?

Accepted Answer

Use a Network Load Balancer (NLB) with a TCP listener and preserve client IP addresses by enabling proxy protocol v2.. A Network Load Balancer (NLB) is the correct choice because it operates at Layer 4, preserves the client IP address by default, and supports proxy protocol v2 to pass the original client IP to targets. This meets the requirements of preserving source IP addresses and not terminating TLS. ALBs are Layer 7 and terminate TLS, while GWLB is for traffic inspection. The NLB also provides low latency, suitable for a trading platform.

Answer

Use an Application Load Balancer (ALB) with an HTTPS listener and enable the X-Forwarded-For header to preserve client IP addresses.

Answer

Use a Gateway Load Balancer (GWLB) with a Geneve listener and enable client IP preservation in the target group.

Answer

Use an Application Load Balancer (ALB) with a TCP listener and enable client IP preservation in the target group attributes.

Question 7

A company is designing a hybrid network that uses AWS Site-to-Site VPN over a Direct Connect private virtual interface for encryption in transit. The company wants to ensure that traffic to on-premises is encrypted and that the VPN remains highly available. The network engineer must configure the necessary components on the AWS side. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Create a transit gateway, attach the VPC to it, and create a Site-to-Site VPN attachment on the transit gateway.. To run a Site-to-Site VPN over a Direct Connect private virtual interface, the engineer creates a transit gateway, attaches the VPC and a VPN attachment, associates the transit gateway with a Direct Connect gateway, and creates a private virtual interface to that gateway. The VPN attachment provides encryption, and the private virtual interface provides the underlay path. Multiple VPN tunnels on the transit gateway support high availability.

Answer

Enable accelerated Site-to-Site VPN on the VPN connection to route traffic over the AWS global network.

Answer

Configure a customer gateway with the public IP address of the on-premises VPN device and use dynamic BGP routing over the VPN tunnels.

Answer

Create a virtual private gateway and attach it to the VPC, then create a Site-to-Site VPN connection that uses the virtual private gateway as the target gateway.

Question 8

A company has a VPC with CIDR block 10.0.0.0/16. They need to create a subnet that can accommodate at least 500 EC2 instances and must not overlap with an existing subnet in the same VPC that uses 10.0.0.0/24. Which subnet CIDR block should they use?

Accepted Answer

10.0.4.0/22. The correct subnet must not overlap with the existing 10.0.0.0/22 subnet and must provide at least 1000 usable IP addresses. 10.0.4.0/22 is the only option that avoids overlap and offers 1019 usable addresses. The other options either overlap with the existing subnet or provide too few addresses. AWS reserves five IP addresses per subnet, so a /22 yields 1019 usable, satisfying the requirement.

Answer

10.0.1.0/23

Answer

10.0.3.0/23

Answer

10.0.4.0/23

Question 9

A company is deploying a global web application that uses Amazon Route 53 for DNS. The application is hosted in two AWS Regions: us-east-1 and eu-west-1. Each Region has an Application Load Balancer (ALB) and a set of EC2 instances. The company wants to route users to the closest Region based on latency and also wants to implement automatic failover if a Region becomes unavailable. Which two configurations should be implemented to meet these requirements? (Choose two.)

Accepted Answer

Create a latency-based routing policy for each Region's ALB DNS name.. To route users to the closest Region based on latency, latency-based routing records are required. To provide automatic failover if a Region becomes unavailable, failover routing with health checks must be configured. The combination of latency-based routing and failover routing meets both requirements. Geolocation, multivalue, and weighted routing do not provide the needed latency-based routing or failover capabilities in this scenario.

Answer

Create a multivalue answer routing policy with health checks for each ALB.

Answer

Create a geolocation routing policy to route users based on their geographic location.

Answer

Create a weighted routing policy with weights assigned based on Region latency.

Question 10

A company is designing a hybrid network architecture using AWS Direct Connect and AWS Site-to-Site VPN. They require high availability and encryption for data in transit between on-premises and AWS. The company wants to ensure that traffic is encrypted end-to-end and that failover occurs automatically if the primary connection fails. Which two configurations should be implemented? (Choose two.)

Accepted Answer

Configure a Site-to-Site VPN over the Direct Connect connection using a transit virtual interface (VIF) and a transit gateway.. To achieve encrypted end-to-end connectivity and automatic failover, combine a Direct Connect connection with a private VIF and MACsec for link encryption, and run a Site-to-Site VPN over the Direct Connect connection using a transit VIF and transit gateway. The VPN provides IPsec encryption and BGP can handle failover. MACsec adds an extra layer of encryption on the Direct Connect link. Together, they meet the requirements for high availability and encryption.

Answer

Use two Direct Connect connections from different providers to the same AWS Region and enable BGP for failover.

Answer

Deploy a third-party firewall appliance in the VPC and create IPsec tunnels to on-premises over the internet, using BGP for failover.

Answer

Use a Direct Connect connection with a public virtual interface (VIF) to access AWS public services, and a Site-to-Site VPN over the internet for encrypted backup.

Question 11

A company runs a Hybrid cloud with an AWS Direct Connect connection using a private virtual interface (VIF) and a Transit Gateway in us-east-1. The on-premises network advertises 10.0.0.0/8 via BGP to the Direct Connect gateway. The company wants to add a second Direct Connect connection in us-west-2 for redundancy and needs the on-premises routers to prefer the us-east-1 connection for all traffic to AWS while keeping the us-west-2 connection as a standby. Which configuration achieves this requirement with the least administrative overhead?

Accepted Answer

Configure BGP AS_PATH prepending on the us-west-2 connection so that the on-premises routers see a longer AS path and prefer the us-east-1 connection.. BGP AS_PATH prepending is the correct method to make one Direct Connect connection less preferred for inbound traffic from AWS to on-premises. By prepending the AS path on the us-west-2 connection, the on-premises routers will prefer the us-east-1 connection. This approach requires no changes to AWS-side configurations and is a standard, low-overhead solution for active-standby Direct Connect setups.

Answer

Create a new Direct Connect gateway in us-west-2 and associate it with the existing Transit Gateway in us-east-1, then advertise the same prefixes with a higher local preference on the us-west-2 connection.

Answer

Configure the us-west-2 connection with a lower BGP local preference on the on-premises routers, and set the us-east-1 connection with a higher local preference.

Answer

Use AWS Resource Access Manager (RAM) to share the Transit Gateway with the us-west-2 account, then enable equal-cost multipath (ECMP) on the on-premises routers.

Question 12

A company runs a two-tier web application in a single VPC. The web tier resides in public subnets behind an Application Load Balancer, and the database tier runs on Amazon RDS in private subnets. A security audit reveals that an engineer can still reach the RDS instances from the internet through an Elastic IP associated with a database EC2 instance. The company wants to guarantee that no resource in the database subnets can ever have a route to an internet gateway, while still allowing the database tier to download OS patches. Which design meets these requirements?

Accepted Answer

Configure the database subnets as private subnets with a route table that has no route to an internet gateway, and use a NAT gateway in a public subnet for outbound patching traffic.. The only design that structurally prevents any database subnet resource from having a route to an internet gateway is to keep the database subnets private with a route table that lacks an internet gateway route. Outbound patching is then provided by a NAT gateway in a public subnet, which allows outbound-only traffic. This satisfies both the security guarantee and the operational need.

Answer

Place the database instances in private subnets and attach an internet gateway directly to the VPC, then use network ACLs to block inbound traffic to the database subnet CIDR.

Answer

Keep the database subnets public but attach a security group that denies all inbound traffic from 0.0.0.0/0 and allows outbound HTTPS.

Answer

Use AWS PrivateLink to expose the RDS instances to the web tier, and configure the database subnets with a route to a virtual private gateway for patching.

Question 13

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect this VPC to an on-premises network that uses the CIDR 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN for the connection. Which solution allows the VPC to communicate with the on-premises network without IP address conflicts?

Accepted Answer

Set up a Site-to-Site VPN with a transit gateway, and configure NAT instances in the VPC to translate the overlapping IP addresses.. When CIDR blocks overlap between a VPC and on-premises, direct routing fails. Using NAT instances in the VPC to translate addresses allows communication. A transit gateway can aggregate the VPN connection, and NAT instances handle the address translation. This avoids re-creating the VPC and is a practical workaround for overlapping CIDRs, though it adds complexity and potential performance overhead.

Answer

Use AWS PrivateLink to create an endpoint for the on-premises services and access them via the VPC endpoint.

Answer

Re-create the VPC with a different CIDR block that does not overlap with the on-premises network, and then establish the Site-to-Site VPN.

Answer

Configure the Site-to-Site VPN with a virtual private gateway and enable NAT-Traversal (NAT-T) on the VPN connection.

Question 14

A financial services company is deploying a hybrid architecture connecting its on-premises data center to AWS using AWS Direct Connect. The company requires that traffic from its on-premises network to a specific VPC be encrypted in transit, and it also needs a backup path that automatically takes over if the Direct Connect connection fails. The backup path must also be encrypted. Which combination of AWS services should the company implement to meet these requirements?

Accepted Answer

Use a private virtual interface with a Direct Connect gateway to reach the VPC, and configure a Site-to-Site VPN over the internet as a backup, with IPsec encryption on both the VPN and the Direct Connect path using a VPN over the private virtual interface.. A private virtual interface provides private connectivity to a VPC, and a Site-to-Site VPN over the internet serves as an encrypted backup. To encrypt the Direct Connect path, you can establish an IPsec VPN over the private virtual interface. This dual-path design with encryption on both paths meets the financial services company's requirements for confidentiality and resiliency.

Answer

Use a transit virtual interface to connect to a transit gateway, and rely on MACsec encryption on the Direct Connect connection for the primary path, with a Site-to-Site VPN as backup without encryption.

Answer

Use a hosted connection with a private virtual interface to the VPC, and use AWS Client VPN as the backup path, with encryption enabled on both the Direct Connect and Client VPN connections.

Answer

Use a public virtual interface on the Direct Connect connection with a Site-to-Site VPN over the internet as backup, and enable encryption on both paths using IPsec.

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. They want to add a new subnet that will host a large number of EC2 instances. The subnet must have a CIDR block of 10.0.1.0/24. Which statement is true regarding the number of available IP addresses in this subnet?

Accepted Answer

The subnet will have 251 available IP addresses for EC2 instances.. In an AWS VPC, each subnet reserves five IP addresses: the network address, the VPC router, the DNS server, a future use address, and the broadcast address. For a /24 subnet with 256 total addresses, subtracting these five leaves 251 usable addresses for EC2 instances.

Answer

The subnet will have 254 available IP addresses for EC2 instances.

Answer

The subnet will have 250 available IP addresses for EC2 instances.

Answer

The subnet will have 256 available IP addresses for EC2 instances.