ANS-C01 Network Design Practice Test 23 — 15 Questions

Question 1

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add additional IP address space for new subnets. The existing subnets use 10.0.0.0/17 and 10.0.128.0/17. Which CIDR block should be added as a secondary CIDR to the VPC to provide the most additional contiguous address space?

Accepted Answer

10.1.0.0/16. Option C is correct because 10.1.0.0/16 is a contiguous block that does not overlap with the existing CIDR and adds a full /16 of address space. Option A is wrong because 10.0.0.0/8 overlaps with the existing CIDR and is too large. Option B is wrong because 10.0.0.0/16 duplicates the existing CIDR. Option D is wrong because 10.0.0.0/0 is invalid.

Answer

10.0.0.0/0

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 2

A company has deployed a web application using an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The application experiences intermittent high latency. The network team suspects that the ALB is being overwhelmed by traffic. Which metrics should be analyzed in Amazon CloudWatch to determine if the ALB is the bottleneck?

Accepted Answer

SurgeQueueLength and SpilloverCount. Option B is correct because SurgeQueueLength and SpilloverCount indicate when the ALB is unable to handle incoming requests. SurgeQueueLength shows the number of requests queued, and SpilloverCount shows requests that were rejected. Option A is wrong because RequestCount and TargetResponseTime do not directly show ALB capacity issues. Option C is wrong because HealthyHostCount and UnhealthyHostCount indicate backend health, not ALB load. Option D is wrong because ActiveConnectionCount and NewConnectionCount are normal metrics.

Answer

ActiveConnectionCount and NewConnectionCount

Answer

RequestCount and TargetResponseTime

Answer

HealthyHostCount and UnhealthyHostCount

Question 3

A company has a VPC with a CIDR of 10.0.0.0/16. They have set up a VPC peering connection with another VPC (CIDR 172.16.0.0/16). The route tables are configured correctly. However, instances in the first VPC cannot communicate with instances in the peered VPC. The security groups and network ACLs are configured to allow all traffic. What is the most likely cause?

Accepted Answer

The DNS resolution settings for the VPC peering connection are not enabled.. Option B is correct because DNS resolution settings for VPC peering must be enabled for instances to resolve DNS hostnames across the peering connection. Option A is wrong because route tables are already configured correctly. Option C is wrong because the CIDRs are different and non-overlapping. Option D is wrong because ICMP is not required for basic connectivity.

Answer

The route tables in the VPCs are not propagated to the subnets.

Answer

The instances do not have ICMP traffic allowed.

Answer

The VPC CIDR ranges overlap.

Question 4

A company is designing a multi-region application with active-active configuration. They need a global DNS service that can route users to the nearest healthy endpoint and automatically failover to another region if an endpoint becomes unhealthy. Which AWS service should be used?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Option A is correct because Amazon Route 53 with latency-based routing can route to the region with the lowest latency, and health checks can failover. Option B is wrong because AWS Global Accelerator provides static IP addresses and improves performance, but it does not provide DNS-level routing with health-based failover. Option C is wrong because CloudFront is a CDN. Option D is wrong because ELB is regional.

Answer

Amazon CloudFront

Answer

Elastic Load Balancer

Answer

AWS Global Accelerator

Question 5

A company is setting up a new AWS Direct Connect connection. They have provisioned a 1 Gbps dedicated connection. They need to create a private virtual interface (VIF) to connect to their VPC. The VIF has been created and is in the 'available' state, but the BGP session is not coming up. What is the most likely cause?

Accepted Answer

The BGP authentication key does not match between the customer router and AWS.. Option B is correct because BGP authentication must match on both sides. Option A is wrong because VLAN ID must be unique per VIF but does not prevent BGP from coming up. Option C is wrong because the BGP timer can be adjusted but does not prevent session establishment. Option D is wrong because the interface state is already available.

Answer

The BGP hold timer is set too high on the customer router.

Answer

The VLAN ID assigned to the VIF is already in use on another VIF.

Answer

The Direct Connect interface is in the 'down' state.

Question 6

A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?

Accepted Answer

The source/destination check is enabled on the NAT instance.. Option C is correct because the NAT instance must have source/destination check disabled to forward traffic for other instances. Option A is wrong because the route table is already configured. Option B is wrong because the NAT instance itself can have its own route table for internet access. Option D is wrong because security groups can allow traffic; the issue is routing.

Answer

The NAT instance does not have a public IP address.

Answer

The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.

Answer

The security group of the NAT instance blocks outbound traffic.

Question 7

A company is designing a network architecture for a critical application that requires high availability across multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region. Which TWO services can provide global routing and failover between the two ALBs?

Accepted Answer

Amazon Route 53 with failover routing and health checks. Options A and D are correct. Amazon Route 53 with health checks can route DNS queries to healthy endpoints across regions. AWS Global Accelerator provides anycast IPs and can route traffic to healthy regional endpoints. Option B is wrong because CloudFront is a CDN and does not route to ALBs directly for failover. Option C is wrong because a Network Load Balancer is regional. Option E is wrong because AWS WAF is a web application firewall.

Answer

AWS WAF

Answer

Network Load Balancer (NLB)

Answer

Amazon CloudFront

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16. They have created a VPC peering connection with another VPC (CIDR 10.1.0.0/16). They want to enable DNS resolution between the VPCs. Which TWO actions must be taken?

Accepted Answer

The requester must accept the peering connection with the 'Enable DNS Resolution' option checked.. Options B and D are correct. To enable DNS resolution across a VPC peering connection, the requester must accept the peering connection with DNS resolution enabled, and the accepter must update the route tables. Option A is wrong because the VPCs must be in the same region? Actually, cross-region peering is allowed. Option C is wrong because the accepter does not need to modify the peering connection. Option E is wrong because DNS resolution settings are at the peering connection level, not the VPC level.

Answer

Ensure both VPCs are in the same AWS region.

Answer

The accepter must modify the peering connection to enable DNS resolution from their side.

Answer

The route tables must include a route for the peered VPC's CIDR.

Question 9

A company is deploying a VPC with public and private subnets. They need to provide internet access to instances in the private subnets for software updates. Which THREE components are required to achieve this?

Accepted Answer

Route table in the private subnet with a default route pointing to the NAT Gateway. Options B, C, and E are correct. A NAT Gateway (or NAT instance) in a public subnet, an Internet Gateway attached to the VPC, and a route table in the private subnet pointing to the NAT Gateway are required. Option A is wrong because a VPN connection is not needed. Option D is wrong because a Direct Connect connection is not needed.

Answer

AWS Site-to-Site VPN connection

Answer

AWS Direct Connect connection

Question 10

A company is designing a multi-region application with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route traffic to the nearest region using latency-based routing. Which AWS service should they use to achieve this?

Accepted Answer

Amazon Route 53 with latency routing policy. Amazon Route 53 latency-based routing directs traffic to the region with the lowest latency for the end user. AWS Global Accelerator provides static IP and traffic management but not latency-based routing to specific load balancers in multiple regions. CloudFront is a CDN, not for routing to ALBs. Direct Connect is for dedicated network connections. Transit Gateway is for VPC connectivity.

Answer

AWS Global Accelerator

Answer

AWS Transit Gateway

Answer

Amazon CloudFront with multiple origins

Question 11

A company has a VPC with public and private subnets. They want to provide outbound internet access to instances in private subnets while preventing inbound internet traffic. The solution must be highly available and scale automatically. Which combination of services should be used?

Accepted Answer

NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway. A NAT Gateway in each AZ provides high availability and scales automatically. Route tables direct private subnet traffic to the NAT Gateway. An Internet Gateway is needed for the NAT Gateway to reach the internet. A NAT instance is single point of failure and requires manual scaling. VPC endpoint is for accessing AWS services privately, not for general internet. Egress-Only Internet Gateway is for IPv6 only.

Answer

NAT instances in each Availability Zone

Answer

VPC endpoint for S3 and DynamoDB

Answer

Internet Gateway attached to the VPC with route tables pointing to the Internet Gateway

Question 12

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). They have added routes in both route tables. However, instances in VPC A cannot ping instances in VPC B. The security groups and network ACLs allow ICMP. What is the most likely cause?

Accepted Answer

The route tables in VPC A do not have a route to VPC B CIDR pointing to the peering connection. VPC peering does not support transitive routing. If VPC A tries to reach VPC B via a CIDR that is not directly peered, traffic will not be forwarded. The route tables must have specific routes for the peered VPC CIDR. The issue likely is that the route tables are missing the route to the peer, or the route is pointing to an incorrect target.

Answer

The security groups in VPC B do not allow inbound ICMP from VPC A CIDR

Answer

The VPC peering connection is not in the 'active' state

Answer

The instances are in different Availability Zones

Question 13

A company is deploying a critical application across multiple Availability Zones in a single AWS Region. They need a network design that provides the lowest possible latency between application tiers and supports automatic failover if an AZ becomes unavailable. Which design meets these requirements?

Accepted Answer

Deploy an internal NLB per Availability Zone, with each NLB only registering targets in its own AZ, and an internet-facing Application Load Balancer (ALB) with targets in all AZs. Using an internal Network Load Balancer (NLB) in each AZ with cross-zone load balancing disabled ensures traffic stays within the AZ for lowest latency, and using an Application Load Balancer (ALB) for the front end with targets in each AZ provides failover. A single NLB across AZs adds cross-AZ latency. Classic Load Balancer is legacy. Route 53 weighted routing is not automatic failover.

Answer

Use Amazon Route 53 weighted routing to distribute traffic to each AZ

Answer

Use a single internal Classic Load Balancer across all AZs

Answer

Deploy an internal Network Load Balancer (NLB) in a single AZ and route traffic from other AZs through it

Question 14

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend connectivity to an on-premises data center that does not support BGP. What is the simplest way to achieve this?

Accepted Answer

Use AWS Site-to-Site VPN with static routing to a Transit Gateway. A Transit Gateway with a VPN attachment can connect to the on-premises network over the internet using static routes if BGP is not supported. Direct Connect Gateway only works with BGP. VPC peering is not for on-premises. VPN CloudHub requires multiple VPN connections. The simplest is to use a VPN connection to the Transit Gateway with static routing.

Answer

Create a VPC peering connection between the VPC and the on-premises network

Answer

Create a Direct Connect Gateway and attach the VPC

Answer

Set up a VPN CloudHub with multiple VPN connections

Question 15

A company needs to allow a specific IP address range (203.0.113.0/24) to access an Amazon RDS database in a private subnet. The RDS instance is deployed in a VPC with no public access. Which configuration step is required?

Accepted Answer

Create an AWS Site-to-Site VPN connection and update route tables to route the on-premises CIDR to the virtual private gateway. RDS instances in a private subnet are not directly accessible from the internet. To allow access from an on-premises network, a VPN or Direct Connect connection is needed. The security group must allow inbound traffic from the on-premises CIDR, and the route tables must route traffic to the VPN/Direct Connect. Simply adding a security group rule does not provide connectivity; a network path is required.

Answer

Add a security group rule allowing inbound traffic from 203.0.113.0/24

Answer

Assign a public IP address to the RDS instance

Answer

Modify the network ACL of the private subnet to allow inbound traffic from 203.0.113.0/24