ANS-C01 Network Design Practice Test 24 — 15 Questions

Question 1

A media company is designing a VPC that will host a real-time video processing application. The application requires extremely low latency and high throughput between a cluster of EC2 instances that communicate with each other frequently. The instances are spread across multiple subnets within a single Availability Zone. The company wants to minimize network latency and jitter. Which TWO actions should the company take to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable enhanced networking with the Elastic Network Adapter (ENA) on all instances.. A cluster placement group places instances physically close within a single Availability Zone to minimize latency and maximize throughput. Enhanced networking with ENA increases bandwidth and reduces jitter by offloading network processing. Together, these actions provide the low-latency, high-throughput environment required for real-time video processing.

Answer

Attach an Elastic Fabric Adapter (EFA) to each instance and use it for all TCP/IP traffic.

Answer

Place the instances in a spread placement group across multiple Availability Zones.

Answer

Configure the instances to use a NAT gateway for all inter-instance communication.

Question 2

A company is deploying a microservices application on AWS. The application runs on Amazon ECS with the AWSVPC network mode. The services need to communicate with each other and with an on-premises database over a Site-to-Site VPN. The company wants to ensure that traffic between services is encrypted and that the on-premises database can be reached. Which solution meets these requirements?

Accepted Answer

Use AWS App Mesh with Envoy proxies to encrypt traffic between services, and configure the VPC route table to route on-premises traffic through the virtual private gateway.. AWS App Mesh with Envoy proxies enables mutual TLS for service-to-service encryption. Routing on-premises traffic through the virtual private gateway ensures connectivity to the database. The other options either do not provide encryption for inter-service traffic or are not suitable for on-premises database access.

Answer

Use AWS Cloud Map for service discovery, and configure a VPN connection with BGP for encryption.

Answer

Use AWS PrivateLink to expose the on-premises database as an endpoint service, and enable TLS on the ECS tasks.

Answer

Use AWS Transit Gateway to connect the VPC to on-premises, and enable ECS task networking with awsvpc mode for encryption.

Question 3

A company is designing a network architecture that requires high availability for a web application deployed on EC2 instances across multiple Availability Zones. The application must be accessible from the internet and provide SSL termination. The company wants to use an Application Load Balancer (ALB). Which TWO configurations are required to ensure the ALB can route traffic to the instances? (Choose two.)

Accepted Answer

The ALB must be associated with at least two public subnets in different Availability Zones.. For an internet-facing ALB to route traffic to EC2 instances, it must be associated with at least two public subnets in different Availability Zones for high availability, and its security group must allow inbound traffic on the necessary ports (80 and 443). These are the two fundamental configurations required for the ALB to receive and route traffic.

Answer

The ALB must have an Elastic IP address associated with each subnet.

Answer

The ALB must be configured with a target group that includes the EC2 instances and health checks enabled.

Answer

The ALB must be deployed in a single Availability Zone to reduce latency.

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. It needs to connect this VPC to an on-premises network with a CIDR of 10.0.0.0/8 using AWS Site-to-Site VPN. The company also plans to add a second VPC with CIDR 10.1.0.0/16 in the future. The network engineer must design the routing so that traffic from on-premises to the correct VPC is properly directed without overlapping routes. Which solution meets these requirements?

Accepted Answer

Use a transit gateway with a VPN attachment, and configure the on-premises router to advertise more specific routes for each VPC CIDR (10.0.0.0/16 and 10.1.0.0/16) instead of the summary 10.0.0.0/8.. The on-premises CIDR 10.0.0.0/8 overlaps with the VPC CIDR 10.0.0.0/16, which creates routing ambiguity. By using a transit gateway and advertising more specific routes for each VPC CIDR from on-premises, the overlap is avoided. This design also scales to future VPCs and centralizes connectivity.

Answer

Use a virtual private gateway on the VPC and configure static routes on the VPN connection for the on-premises CIDR. Advertise the VPC CIDR to on-premises using BGP.

Answer

Use AWS Direct Connect with a private virtual interface and a Direct Connect gateway, and configure the on-premises network to use the 10.0.0.0/8 summary route for all AWS traffic.

Answer

Use a virtual private gateway on each VPC and create two separate VPN connections, each with static routes for the on-premises CIDR. Advertise the on-premises CIDR to AWS using BGP.

Question 5

A company is designing a network for a three-tier web application in a single VPC. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The application servers need to make outbound calls to a third-party API. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Application Load Balancer, application servers in private subnets with a NAT gateway, and database servers in private subnets.. It places web servers in public subnets with an Application Load Balancer for inbound internet traffic, while application and database servers reside in private subnets without direct internet access. A NAT gateway in a public subnet enables the application servers to initiate outbound connections to a third-party API, with return traffic automatically routed back, meeting the requirement for outbound-only internet access.

Answer

Web servers in public subnets, application and database servers in private subnets with an internet gateway for outbound traffic.

Answer

All servers in public subnets with security groups restricting access.

Answer

All servers in private subnets and a VPN connection to the internet.

Question 6

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs in the same AWS Region. The company wants to use AWS Transit Gateway to simplify connectivity between these VPCs and their on-premises network. Which steps are required to integrate the existing Direct Connect connection with Transit Gateway?

Accepted Answer

Create a Direct Connect gateway, associate the existing VIFs, and attach the Direct Connect gateway to the Transit Gateway.. AWS Direct Connect private VIFs cannot be attached directly to a Transit Gateway. Instead, you must create a Direct Connect Gateway, associate the existing private VIFs with it, and then attach the Direct Connect Gateway to the Transit Gateway. This architecture allows the Transit Gateway to route traffic between the on-premises network (via the Direct Connect connection) and the attached VPCs, while also enabling inter-VPC routing through the Transit Gateway.

Answer

Set up a VPN connection over the Direct Connect link and attach the VPN to the Transit Gateway.

Answer

Attach the existing private VIFs directly to the Transit Gateway.

Answer

Create a new private VIF on the Direct Connect connection and attach it to the Transit Gateway.

Question 7

A company is designing a multi-region architecture with VPCs in us-east-1 and eu-west-1. The company needs low-latency connectivity between the VPCs and wants to avoid traffic over the public internet. The VPCs have overlapping CIDR blocks (10.0.0.0/16). Which solution should the network engineer recommend?

Accepted Answer

Set up an AWS Transit Gateway in each region and connect them via Transit Gateway peering.. AWS Transit Gateway supports inter-region peering, which uses the AWS global backbone to provide low-latency, private connectivity between VPCs in different regions without traversing the public internet. This solution also handles overlapping CIDRs by using separate route tables per VPC attachment, ensuring isolation. Option B (Direct Connect) is used for on-premises connectivity, not inter-region. Option C (VPC peering) does not support overlapping CIDRs. Option D (single VPC) does not meet the multi-region requirement.

Answer

Use a Direct Connect connection between the regions.

Answer

Use VPC peering between the two VPCs.

Answer

Place all resources in a single VPC with multiple Availability Zones.

Question 8

A network engineer has configured an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer checks the VPN status and sees the output above. What is the MOST likely cause of Tunnel2 being down?

Accepted Answer

The IPsec encryption or integrity algorithms do not match between the AWS VPN endpoint and the on-premises device.. Tunnel2 is down while Tunnel1 is up, indicating a per-tunnel configuration mismatch. The most common cause is a mismatch in IPsec security parameters (encryption, integrity, or DH group) between the AWS VPN endpoint and the on-premises device for that specific tunnel. AWS uses separate pre-shared keys and IPsec settings per tunnel, so a mismatch in algorithms would affect only the misconfigured tunnel.

Answer

The BGP ASN on the on-premises device is misconfigured.

Answer

The route tables in the VPC do not have a route to the on-premises network.

Answer

The IKE pre-shared key used for Tunnel2 is incorrect.

Question 9

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer in the public subnets distributes traffic to EC2 instances in the private subnets. The security group for the EC2 instances allows inbound traffic from the ALB security group. Users report intermittent timeouts. What is the most likely cause?

Accepted Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.. Intermittent timeouts are often caused by network ACL rules that block ephemeral ports used for return traffic. The ALB initiates connections to EC2 instances on random ephemeral ports (1024-65535). If the private subnet's network ACL denies inbound traffic on these ports from the ALB subnets, connections will fail intermittently. In contrast, a missing inbound rule on the ALB security group would result in consistent failures, not intermittent ones.

Answer

The security group for the ALB does not allow inbound traffic from the internet.

Answer

The ALB is not associated with an internet gateway.

Answer

Cross-zone load balancing is disabled on the ALB.

Question 10

A solutions architect is designing a VPC with public and private subnets in two Availability Zones. The private subnets require outbound internet access for software updates, but inbound internet access must be blocked. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a default route to the NAT Gateway in the private subnet route tables.. A NAT Gateway, deployed in a public subnet with an Elastic IP and a route to an Internet Gateway, enables outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. The private subnet route table directs default traffic (0.0.0.0/0) to the NAT Gateway, which performs source network address translation (SNAT) on outbound packets, ensuring responses return to the NAT Gateway without exposing private instances directly.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

Answer

Launch an EC2 instance in a public subnet with a proxy software and route private subnet traffic through it.

Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route tables.

Question 11

A company's VPC has an internet gateway and a NAT Gateway in a public subnet. The private subnet route table has a default route pointing to the NAT Gateway. EC2 instances in the private subnet can access the internet, but cannot access an on-premises network connected via AWS Site-to-Site VPN. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route to the on-premises network via the virtual private gateway.. The private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway, which allows outbound internet traffic. However, traffic destined for the on-premises network must be routed via the Virtual Private Gateway (VGW) attached to the VPC. Since the route table lacks a specific route (e.g., 10.0.0.0/8) pointing to the VGW, packets to the on-premises CIDR are instead sent to the NAT Gateway, which drops them because it has no route or interface for the on-premises network.

Answer

The NAT Gateway is not configured to route traffic to the VPN.

Answer

The internet gateway is not attached to the VPC.

Answer

The VPN connection is not advertising the on-premises CIDR via BGP.

Question 12

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

Accepted Answer

Create VPC peering connections between each pair of VPCs.. VPC peering connections provide direct, private IP connectivity between VPCs using the AWS global network, with no bandwidth bottlenecks or single points of failure. It is the most cost-effective solution for a small number of VPCs (e.g., fewer than 10) as there are no hourly charges for the peering connection itself—only data transfer costs. This minimizes operational overhead compared to managing VPN tunnels or a Transit Gateway, as peering is a simple, one-to-one relationship that does not require additional appliances or complex routing policies.

Answer

Set up AWS Site-to-Site VPN connections between each VPC.

Answer

Use ClassicLink to connect the VPCs.

Answer

Create a Transit Gateway and attach all VPCs.

Question 13

A company has a VPC with an internet gateway and a NAT Gateway. The private subnet route table has a default route to the NAT Gateway. The company wants to enable instances in the private subnet to access an S3 bucket in the same region without traversing the internet. Which TWO actions should the company take?

Accepted Answer

Add a route to the S3 prefix list via the gateway endpoint in the private subnet route table.. Adding a route to the S3 prefix list via the gateway endpoint directs traffic destined for S3 through the VPC endpoint, keeping it within the AWS network. Option C is correct because a gateway VPC endpoint for S3 provides a private, scalable connection to S3 without requiring internet access or a NAT Gateway. Together, these actions allow private subnet instances to access S3 privately and efficiently.

Answer

Remove the default route to the NAT Gateway from the private subnet route table.

Answer

Add a route to the S3 prefix list via the NAT Gateway in the private subnet route table.

Answer

Create an interface VPC endpoint for S3.

Question 14

A company runs a multi-tier web application on AWS. The web servers in public subnets need to send traffic to the application servers in private subnets. The application servers must only accept traffic from the web servers. Both tiers are in the same VPC. Which design meets these requirements without introducing a single point of failure or unnecessary complexity?

Accepted Answer

Place the web servers in a public subnet with a security group that allows inbound from 0.0.0.0/0 on port 443. Place the app servers in a private subnet with a security group that allows inbound from the web server security group on the application port.. It uses security group referencing, which allows the app servers' security group to dynamically allow traffic from any instance associated with the web servers' security group, regardless of IP address changes. This design avoids a single point of failure by not introducing any load balancer or gateway, and it minimizes complexity by leveraging native VPC security group behavior within the same VPC.

Answer

Place the web servers and app servers in the same private subnet behind an internal Network Load Balancer. Route web traffic through the NLB.

Answer

Place the web servers in a public subnet with an Internet Gateway. Place the app servers in a private subnet with a NAT Gateway for outbound traffic. Use NACLs to allow inbound from the web subnet CIDR.

Answer

Place the web servers in a public subnet with a NACL allowing inbound on port 443. Place the app servers in a private subnet with a NACL allowing inbound from the web subnet CIDR on the application port.

Question 15

A company is designing a VPC with public and private subnets for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of route tables and security groups achieves this?

Accepted Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.. It uses an Internet Gateway (IGW) in the public subnet route table to enable inbound internet traffic to the web tier, and security groups (SGs) are referenced by logical ID (Web SG, App SG, DB SG) to enforce strict, stateful traffic flow: Web SG allows HTTPS from 0.0.0.0/0, App SG allows traffic only from Web SG, and DB SG allows traffic only from App SG. This layered SG approach ensures that each tier can only be reached from the preceding tier, meeting the access requirements without relying on network ACLs or routing.

Answer

Public subnet route table: 0.0.0.0/0 -> NAT Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.

Answer

Private subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from App SG.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway. Web SG: allow 0.0.0.0/0 on port 443. App SG: allow from Web SG. DB SG: allow from 0.0.0.0/0 on port 3306.