ANS-C01 Network Design Practice Test 23 — 15 Questions

Question 1

A company is deploying a multi-tier web application across multiple AWS accounts. They want to centralize network security by using a shared services VPC with a Transit Gateway. All application VPCs will be attached to the Transit Gateway. The security team needs to inspect and filter traffic between application VPCs. Which solution should be used to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a Transit Gateway and attach a central inspection VPC with a firewall appliance. Configure route tables to send inter-VPC traffic through the inspection VPC.. A Transit Gateway with a central inspection VPC allows you to route all inter-VPC traffic through a firewall appliance for inspection. By configuring route tables on the Transit Gateway, you can force traffic between application VPCs to traverse the inspection VPC, enabling centralized security filtering without requiring point-to-point peering or per-VPC rules.

Answer

Create VPC Peering connections between each pair of application VPCs and apply security groups to the peer connections.

Answer

Use security groups in each application VPC to control traffic between VPCs.

Answer

Use network ACLs in each application VPC to filter traffic between VPCs.

Question 2

A company is designing a hybrid network with multiple AWS Direct Connect connections to multiple on-premises data centers. They want to maximize availability and use all available bandwidth. They have two Direct Connect connections terminated at two different Direct Connect locations. They plan to use a single Virtual Private Gateway (VGW) for each VPC. Which configuration should be used to meet these requirements?

Accepted Answer

Create a Direct Connect Gateway. Attach both Direct Connect connections to the Direct Connect Gateway. Associate the Direct Connect Gateway with the VGW. Configure the on-premises routers to use BGP with equal-cost multipath (ECMP).. It uses a Direct Connect Gateway to aggregate multiple Direct Connect connections into a single logical endpoint, allowing both connections to be associated with a single VGW. By configuring BGP with ECMP on the on-premises routers, traffic is load-balanced across both connections, maximizing bandwidth utilization while providing high availability through redundant paths.

Answer

Create two VGWs and attach each to a separate Direct Connect connection. Use a Transit Gateway to connect the VGWs to the VPC.

Answer

Create two Virtual Private Gateways, one for each Direct Connect connection. Attach each VGW to the VPC. Configure BGP on both connections for active-active.

Answer

Create a single virtual interface and associate it with both Direct Connect connections. Attach the virtual interface to the VGW.

Question 3

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add additional IP address space for new subnets. The existing subnets use 10.0.0.0/17 and 10.0.128.0/17. Which CIDR block should be added as a secondary CIDR to the VPC to provide the most additional contiguous address space?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because the VPC already uses the entire 10.0.0.0/16 range (split into 10.0.0.0/17 and 10.0.128.0/17). To add contiguous address space, you must use a different /16 block that is adjacent in the private IPv4 address space, such as 10.1.0.0/16. AWS VPCs support secondary CIDRs that must not overlap with existing CIDRs, and 10.1.0.0/16 provides a non-overlapping, contiguous block.

Answer

10.0.0.0/0

Answer

10.0.0.0/8

Answer

10.0.0.0/16

Question 4

A company has deployed a web application using an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. The application experiences intermittent high latency. The network team suspects that the ALB is being overwhelmed by traffic. Which metrics should be analyzed in Amazon CloudWatch to determine if the ALB is the bottleneck?

Accepted Answer

SurgeQueueLength and SpilloverCount. SurgeQueueLength and SpilloverCount are the correct metrics to analyze because they directly indicate whether the ALB is overwhelmed. SurgeQueueLength measures the number of requests waiting to be routed to a target, and SpilloverCount tracks requests that were rejected because the queue was full. If these metrics are consistently high or non-zero, the ALB is the bottleneck, as it cannot keep up with incoming traffic.

Answer

ActiveConnectionCount and NewConnectionCount

Answer

RequestCount and TargetResponseTime

Answer

HealthyHostCount and UnhealthyHostCount

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16. They have set up a VPC peering connection with another VPC (CIDR 172.16.0.0/16). The route tables are configured correctly. However, instances in the first VPC cannot communicate with instances in the peered VPC. The security groups and network ACLs are configured to allow all traffic. What is the most likely cause?

Accepted Answer

The DNS resolution settings for the VPC peering connection are not enabled.. The most likely cause is that the VPC peering connection's DNS resolution settings are not enabled. While basic IP connectivity does not require DNS, if instances are using private DNS hostnames (a common default), DNS queries for the peered VPC will fail unless this setting is enabled. Since the route tables are correctly configured, security groups allow all traffic, and CIDR ranges do not overlap, the DNS resolution setting is the only remaining plausible cause from the options.

Answer

The route tables in the VPCs are not propagated to the subnets.

Answer

The instances do not have ICMP traffic allowed.

Answer

The VPC CIDR ranges overlap.

Question 6

A company is designing a multi-region application with active-active configuration. They need a global DNS service that can route users to the nearest healthy endpoint and automatically failover to another region if an endpoint becomes unhealthy. Which AWS service should be used?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Amazon Route 53 with latency-based routing and health checks is the correct choice because it provides global DNS resolution that directs users to the endpoint with the lowest latency, while health checks automatically detect endpoint failures and trigger failover to a healthy region. This satisfies the active-active multi-region requirement by distributing traffic across multiple regions and ensuring automatic failover without manual intervention.

Answer

Amazon CloudFront

Answer

Elastic Load Balancer

Answer

AWS Global Accelerator

Question 7

A company is setting up a new AWS Direct Connect connection. They have provisioned a 1 Gbps dedicated connection. They need to create a private virtual interface (VIF) to connect to their VPC. The VIF has been created and is in the 'available' state, but the BGP session is not coming up. What is the most likely cause?

Accepted Answer

The BGP authentication key does not match between the customer router and AWS.. The most likely cause is a BGP authentication key mismatch. When the BGP session fails to establish but the virtual interface is in the 'available' state, it indicates the Layer 2 (VLAN) and Layer 1 (physical) connectivity are working. BGP authentication uses MD5 (per RFC 2385), and if the pre-shared key configured on the customer router does not exactly match the key specified in the AWS Direct Connect console for the private VIF, the TCP MD5 signature will fail, preventing the BGP session from coming up.

Answer

The BGP hold timer is set too high on the customer router.

Answer

The VLAN ID assigned to the VIF is already in use on another VIF.

Answer

The Direct Connect interface is in the 'down' state.

Question 8

A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?

Accepted Answer

The source/destination check is enabled on the NAT instance.. The source/destination check is a security feature on EC2 instances that prevents them from forwarding traffic unless the instance is the source or destination of the packet. Since a NAT instance must forward traffic that it did not originate (e.g., from private instances to the internet), this check must be disabled. When enabled, the NAT instance drops packets that are not addressed to itself, breaking the routing of outbound traffic through it.

Answer

The NAT instance does not have a public IP address.

Answer

The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.

Answer

The security group of the NAT instance blocks outbound traffic.

Question 9

A company is designing a network architecture for a critical application that requires high availability across multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region. Which TWO services can provide global routing and failover between the two ALBs?

Accepted Answer

Amazon Route 53 with failover routing and health checks. Amazon Route 53 with failover routing policy and health checks can route traffic to the primary ALB and automatically fail over to the secondary ALB in another region when the primary health check fails. This provides global DNS-based routing and failover across regions, meeting the high-availability requirement.

Answer

AWS WAF

Answer

Network Load Balancer (NLB)

Answer

Amazon CloudFront

Question 10

A company has a VPC with a CIDR of 10.0.0.0/16. They have created a VPC peering connection with another VPC (CIDR 10.1.0.0/16). They want to enable DNS resolution between the VPCs. Which TWO actions must be taken?

Accepted Answer

Both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings.. To enable DNS resolution across a VPC peering connection, two conditions must be met. First, both VPCs must have the 'Enable DNS Resolution' attribute set to true in their VPC settings, which requires both EnableDnsHostnames and EnableDnsSupport to be enabled (Option B). Second, the VPC peering connection itself must have DNS resolution enabled. This can be done by the accepter when accepting the peering connection or later by modifying the peering connection (Option D). Option A is incorrect because the requester does not accept the peering connection; the accepter does. Option C is not required for DNS resolution. Option E (route table entries) is necessary for connectivity but not specifically for DNS resolution.

Answer

The requester must accept the peering connection with the 'Enable DNS Resolution' option checked.

Answer

Ensure both VPCs are in the same AWS region.

Answer

The route tables must include a route for the peered VPC's CIDR.

Question 11

A company is deploying a VPC with public and private subnets. They need to provide internet access to instances in the private subnets for software updates. Which THREE components are required to achieve this?

Accepted Answer

Route table in the private subnet with a default route pointing to the NAT Gateway. A route table in the private subnet with a default route (0.0.0.0/0) pointing to a NAT Gateway ensures that outbound traffic from private instances destined for the internet is forwarded to the NAT Gateway. This allows instances in private subnets to initiate outbound connections for software updates while preventing any unsolicited inbound traffic from the internet.

Answer

AWS Site-to-Site VPN connection

Answer

AWS Direct Connect connection

Question 12

A company is designing a multi-region application with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route traffic to the nearest region using latency-based routing. Which AWS service should they use to achieve this?

Accepted Answer

Amazon Route 53 with latency routing policy. Route 53's latency routing policy directs traffic to the region with the lowest network latency for the end user, based on measurements between AWS regions and the client's DNS resolver. This directly meets the requirement to route traffic to the nearest region without adding any additional infrastructure or cost beyond DNS queries.

Answer

AWS Global Accelerator

Answer

AWS Transit Gateway

Answer

Amazon CloudFront with multiple origins

Question 13

A company has a VPC with public and private subnets. They want to provide outbound internet access to instances in private subnets while preventing inbound internet traffic. The solution must be highly available and scale automatically. Which combination of services should be used?

Accepted Answer

NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway. D is correct because a NAT Gateway in each Availability Zone provides highly available, automatically scaling outbound internet access for private subnets while blocking unsolicited inbound traffic. NAT Gateways are managed by AWS, scale up to 45 Gbps, and are redundant per AZ, meeting the requirements for high availability and automatic scaling without manual intervention.

Answer

NAT instances in each Availability Zone

Answer

VPC endpoint for S3 and DynamoDB

Answer

Internet Gateway attached to the VPC with route tables pointing to the Internet Gateway

Question 14

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). They have added routes in both route tables. However, instances in VPC A cannot ping instances in VPC B. The security groups and network ACLs allow ICMP. What is the most likely cause?

Accepted Answer

The route tables in VPC A do not have a route to VPC B CIDR pointing to the peering connection. The question states that routes have been added in both route tables, but the most likely cause is that the route in VPC A's route table does not point to the VPC peering connection as the target. Without a specific route for VPC B's CIDR (10.1.0.0/16) with the peering connection ID as the target, traffic from VPC A to VPC B will not be forwarded over the peering link, even if security groups and NACLs permit ICMP.

Answer

The security groups in VPC B do not allow inbound ICMP from VPC A CIDR

Answer

The VPC peering connection is not in the 'active' state

Answer

The instances are in different Availability Zones

Question 15

A company is deploying a critical application across multiple Availability Zones in a single AWS Region. They need a network design that provides the lowest possible latency between application tiers and supports automatic failover if an AZ becomes unavailable. Which design meets these requirements?

Accepted Answer

Deploy an internal NLB per Availability Zone, with each NLB only registering targets in its own AZ, and an internet-facing Application Load Balancer (ALB) with targets in all AZs. Deploying an internal NLB per Availability Zone ensures cross-zone traffic is minimized, reducing latency between application tiers, while the internet-facing ALB provides automatic failover by distributing incoming traffic across healthy targets in all AZs. The NLB's per-AZ design keeps traffic within the same AZ for internal communication, and the ALB's health checks enable automatic rerouting if an AZ becomes unavailable.

Answer

Use Amazon Route 53 weighted routing to distribute traffic to each AZ

Answer

Use a single internal Classic Load Balancer across all AZs

Answer

Deploy an internal Network Load Balancer (NLB) in a single AZ and route traffic from other AZs through it