ANS-C01 Network Design Practice Test 24 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend connectivity to an on-premises data center that does not support BGP. What is the simplest way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Site-to-Site VPN with static routing to a Transit Gateway. The on-premises data center does not support BGP, so a static routing approach is required. AWS Site-to-Site VPN with static routing to a Transit Gateway allows you to extend connectivity from the existing Direct Connect VPC to the non-BGP data center by using the Transit Gateway as a central hub, which can route traffic between the Direct Connect VIF and the VPN connection without requiring BGP on the data center side.

Answer

Create a VPC peering connection between the VPC and the on-premises network

Answer

Create a Direct Connect Gateway and attach the VPC

Answer

Set up a VPN CloudHub with multiple VPN connections

Question 2

A company needs to allow a specific IP address range (203.0.113.0/24) to access an Amazon RDS database in a private subnet. The RDS instance is deployed in a VPC with no public access. Which configuration step is required?

Accepted Answer

Create an AWS Site-to-Site VPN connection and update route tables to route the on-premises CIDR to the virtual private gateway. The RDS instance is in a private subnet with no public access, so it cannot be reached directly from the internet. To allow an on-premises IP range (203.0.113.0/24) to access it, you need a private connection such as an AWS Site-to-Site VPN. This creates an encrypted tunnel over the internet, and the route tables must be updated to direct traffic for the on-premises CIDR to the virtual private gateway (VGW), enabling private IP communication.

Answer

Add a security group rule allowing inbound traffic from 203.0.113.0/24

Answer

Assign a public IP address to the RDS instance

Answer

Modify the network ACL of the private subnet to allow inbound traffic from 203.0.113.0/24

Question 3

A company has a VPC with multiple subnets. They want to monitor all network traffic to and from an EC2 instance for troubleshooting. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring all network traffic to and from an EC2 instance for troubleshooting purposes.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company has a hub-and-spoke VPC architecture using AWS Transit Gateway. The hub VPC contains shared services (e.g., Active Directory). Spoke VPCs need to resolve DNS names from the hub VPC. The hub VPC has an Amazon Route 53 Resolver inbound endpoint. What is the correct configuration for the spoke VPCs to use this endpoint?

Accepted Answer

Create an outbound endpoint in the spoke VPC and associate a resolver rule that forwards queries to the inbound endpoint in the hub VPC. It uses an outbound endpoint in the spoke VPC to forward DNS queries to the hub VPC's inbound endpoint via a Route 53 Resolver rule. This allows the spoke VPC to resolve private DNS names hosted in the hub VPC without requiring DHCP changes or additional inbound endpoints, leveraging the hub's existing DNS infrastructure.

Answer

Configure the spoke VPC's DHCP options set to use the hub VPC's CIDR as the domain name server

Answer

Create an inbound endpoint in each spoke VPC

Answer

Use VPC peering and configure the spoke VPC's route table to route DNS traffic to the hub VPC

Question 5

A company needs to connect two VPCs in the same AWS account and region. They want to use private IP addresses and avoid any single point of failure. Which solution should they use?

Accepted Answer

VPC peering connection. VPC peering is the correct solution because it allows direct connectivity between two VPCs using private IP addresses, with no single point of failure since traffic flows directly between the VPCs without any intermediate device or bandwidth bottleneck. AWS handles the underlying routing and redundancy, and there is no additional cost for data transfer within the same Availability Zone or region when using private IPs.

Answer

AWS Transit Gateway

Answer

Internet Gateway and public IPs

Answer

AWS Site-to-Site VPN between the VPCs

Question 6

A company is designing a network for a high-traffic web application that must be highly available across multiple AWS Regions. The application uses Application Load Balancers (ALBs) in each region. Which TWO actions should be taken to route traffic to the nearest healthy endpoint?

Accepted Answer

Use Amazon Route 53 latency-based routing with health checks. Route 53 latency-based routing directs traffic to the region with the lowest latency for the end user, and when combined with health checks, it ensures traffic is only sent to healthy ALBs. This meets the requirement of routing to the nearest healthy endpoint across multiple AWS Regions.

Answer

Use Amazon Route 53 weighted routing

Answer

Use Amazon Route 53 multi-value answer routing

Answer

Use Amazon Route 53 failover routing

Question 7

A company has a Direct Connect connection with a private VIF to a VPC. They want to extend connectivity to an on-premises data center that does not support BGP. What is the simplest way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A second Direct Connect connection from a different provider. The requirement specifies redundant connectivity using a second Direct Connect connection from a different provider. This ensures diverse physical paths and provider independence, which is essential for true high availability. A single provider or connection cannot provide the required fault isolation.

Answer

An AWS Site-to-Site VPN as a backup

Answer

A second private VIF on the same Direct Connect connection

Question 8

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. Which THREE steps are necessary?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) in the firewall VPC and register the firewall instances as targets. A Gateway Load Balancer (GWLB) is designed to transparently insert third-party firewall appliances into network traffic paths. By deploying a GWLB in the firewall VPC and registering the firewall instances as targets, traffic can be inspected at Layer 3/4 without modifying the source or destination IP addresses, enabling seamless integration with Transit Gateway routing.

Answer

Create a VPC peering connection between the VPCs to allow traffic flow

Answer

Configure a NAT Gateway in each VPC to route traffic through the firewall

Question 9

A company is designing a multi-Region application with an Application Load Balancer (ALB) in each Region fronting an Auto Scaling group of EC2 instances. The application must be accessible via a single DNS name, and traffic should be routed to the closest healthy Region using a latency-based routing policy. Which AWS service should be used as the DNS endpoint to achieve this?

Accepted Answer

Amazon Route 53. Amazon Route 53 is the correct choice because it supports latency-based routing policies, which direct traffic to the AWS Region that provides the lowest latency for the end user. By configuring a single DNS name with latency records pointing to the ALB endpoints in each Region, Route 53 can automatically route requests to the closest healthy Region, meeting the requirement for a single DNS name and latency-based routing.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

AWS Network Load Balancer

Question 10

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to use a single NAT Gateway for all private subnets to reduce costs, but the NAT Gateway is in a single Availability Zone (AZ). The network architect is concerned about single points of failure. Which design best addresses high availability while still using the minimum number of NAT Gateways?

Accepted Answer

Deploy one NAT Gateway in each AZ that contains private subnets, and update the route tables accordingly.. Deploying one NAT Gateway per Availability Zone (AZ) that contains private subnets ensures that if an AZ fails, the private subnets in other AZs still have internet access via their local NAT Gateway. This design provides high availability while using the minimum number of NAT Gateways necessary to cover all AZs with private subnets, avoiding a single point of failure without over-provisioning.

Answer

Deploy a single NAT Gateway in one AZ and use a VPN to an on-premises internet gateway as backup.

Answer

Use a NAT instance in an Auto Scaling group across multiple AZs instead of a NAT Gateway.

Answer

Create a second VPC with a NAT Gateway and peer the VPCs to share the NAT Gateway.

Question 11

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center via AWS Direct Connect. The on-premises network uses 10.0.0.0/8. Which action should the network engineer take to avoid IP address overlap?

Accepted Answer

Create a new VPC with a non-overlapping CIDR block, such as 172.16.0.0/16, and migrate resources.. The VPC CIDR 10.0.0.0/16 is a subset of the on-premises 10.0.0.0/8, creating an overlap that prevents Direct Connect routing. AWS does not support overlapping IP spaces across a Direct Connect virtual interface; the only viable solution is to use a non-overlapping CIDR (e.g., 172.16.0.0/16) for the VPC and migrate resources to it.

Answer

Use a NAT gateway to translate the VPC addresses when connecting to on-premises.

Answer

Use AWS Direct Connect gateway to automatically handle overlapping IPs.

Answer

Add a secondary CIDR block to the VPC and use it for resources that need to connect to on-premises.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. It has six subnets: three public (10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24) and three private (10.0.4.0/24, 10.0.5.0/24, 10.0.6.0/24). The company wants to launch an RDS instance in a private subnet. Which subnet should the RDS instance be placed in to maximize high availability and follow best practices?

Accepted Answer

Place the RDS instance in two private subnets that are in different Availability Zones.. Amazon RDS Multi-AZ deployments require the RDS instance to be placed in at least two subnets that reside in different Availability Zones (AZs) within the same VPC. This configuration enables synchronous standby replication across AZs, providing automatic failover and high availability. The subnets must be private to ensure the database is not directly exposed to the internet, aligning with security best practices.

Answer

Place the RDS instance in a public subnet and use security groups to restrict access.

Answer

Place the RDS instance in all three private subnets to maximize availability.

Answer

Place the RDS instance in a single private subnet with a large CIDR for future scaling.

Question 13

A company is deploying a web application across multiple AWS Regions using an Application Load Balancer (ALB) in each Region. The company wants to use AWS Global Accelerator to provide a static IP address and accelerate traffic. The application requires that client IP addresses be preserved in the backend logs. Which configuration should the network engineer use?

Accepted Answer

Use Network Load Balancers as endpoints in Global Accelerator.. AWS Global Accelerator preserves the client IP address when using a Network Load Balancer (NLB) as an endpoint. Global Accelerator uses the Proxy Protocol v2 to pass the original client IP to the NLB, which then forwards it to the backend targets. This meets the requirement for client IP preservation in backend logs.

Answer

Use VPC endpoints and AWS PrivateLink to route traffic through the Global Accelerator.

Answer

Use Amazon CloudFront in front of the ALBs with origin protocol policy set to HTTPS.

Answer

Use Application Load Balancers as endpoints and enable X-Forwarded-For header logging.

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to two on-premises locations via AWS Direct Connect. Each Direct Connect connection uses a private VIF. The company wants to use BGP to exchange routes. The on-premises routers advertise the same prefix 10.0.0.0/8 for both connections. How should the network engineer configure the VPC route tables to ensure traffic is load balanced across both Direct Connect connections?

Accepted Answer

Allow BGP to install both routes; AWS will automatically load balance across them using ECMP.. AWS Direct Connect private VIFs support BGP route exchange, and when two separate connections advertise the same prefix (10.0.0.0/8), BGP installs both routes in the VPC route table. AWS automatically performs Equal-Cost Multi-Path (ECMP) routing across the two Direct Connect connections, load-balancing traffic without additional configuration. This behavior is inherent to how AWS handles multiple BGP-learned routes with identical prefixes and metrics.

Answer

Create a VPN connection over the Direct Connect and use BGP with different metrics.

Answer

Create two separate route tables and associate each with half the subnets.

Answer

Use AWS Transit Gateway with equal cost multipath routing.

Question 15

A company wants to design a highly available architecture for a web application that runs on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application must be able to handle sudden traffic spikes. Which load balancing solution provides the best combination of high availability, automatic scaling, and SSL offloading?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) is the correct choice because it operates at Layer 7, supports content-based routing, integrates natively with Auto Scaling groups for automatic scaling, and provides SSL offloading (TLS termination) at the load balancer. This combination ensures high availability across multiple Availability Zones while handling sudden traffic spikes through elastic scaling of both the ALB and the backend EC2 instances.

Answer

Amazon CloudFront with an origin pointing to the Auto Scaling group

Answer

Network Load Balancer

Answer

Classic Load Balancer