ANS-C01 Network Design Practice Test 25 — 15 Questions

Question 1

A company is designing a network for a VPC with a CIDR of 10.0.0.0/16. The VPC has three private subnets in three different Availability Zones. The company needs to provide internet access to instances in the private subnets for software updates. The architecture must be highly available and cost-effective. Which TWO actions should the network engineer take?

Accepted Answer

Configure each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone.. To achieve high availability, deploy a NAT Gateway in each AZ. Each private subnet's route table should point to the NAT Gateway in its own AZ. Option A is correct because multiple NAT Gateways provide fault tolerance. Option D is correct because routing to the NAT Gateway in the same AZ ensures traffic stays within the AZ. Option B is incorrect because a single NAT Gateway is a single point of failure. Option C is incorrect because NAT instances are not fully managed and less reliable. Option E is incorrect because a single route table would force all traffic through one NAT Gateway.

Answer

Use a NAT instance in an Auto Scaling group.

Answer

Use a single route table for all private subnets and route to one NAT Gateway.

Answer

Deploy a single NAT Gateway in one Availability Zone.

Question 2

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize internet egress for all VPCs through a single VPC that has a NAT Gateway and an internet gateway. Which TWO configurations are required to achieve this?

Accepted Answer

In the egress VPC, add a route for 0.0.0.0/0 to the internet gateway in the route table of the subnet containing the NAT Gateway.. To centralize internet egress, the NAT Gateway must be in the egress VPC. Other VPCs must route 0.0.0.0/0 to the Transit Gateway, which then forwards to the egress VPC. The egress VPC's route table must point 0.0.0.0/0 to the internet gateway. Option A is correct because the egress VPC needs a default route to the internet gateway. Option C is correct because other VPCs need a default route to the Transit Gateway. Option B is incorrect because the egress VPC should not route to the Transit Gateway for internet traffic. Option D is incorrect because you do not need a separate VPN. Option E is incorrect because you cannot delete the local route.

Answer

In the egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.

Answer

Create a VPN connection between each VPC and the Transit Gateway.

Answer

In each non-egress VPC, delete the local route.

Question 3

A company is designing a network architecture for a critical application that must be highly available across AWS Regions. The application uses an Application Load Balancer (ALB) in each Region, and the company wants to use a global DNS name that automatically routes traffic to the healthy Region with the lowest latency. The company also needs to be able to perform planned failover for maintenance. Which THREE components are required to meet these requirements?

Accepted Answer

Amazon Route 53 weighted routing policy for each ALB endpoint. Route 53 latency-based routing sends traffic to the Region with lowest latency. Health checks detect Region failures. Weighted records allow shifting traffic for maintenance. Option A is correct because latency routing is needed. Option B is correct because health checks enable failover. Option D is correct because weighted records allow manual traffic shifting. Option C is not required because failover routing is not used. Option E is not required because Geo proximity is not needed.

Answer

Amazon Route 53 geolocation routing policy

Answer

Amazon Route 53 failover routing policy

Question 4

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) in us-east-1 and eu-west-1, with Route 53 latency-based routing. Users report that after a failover, existing connections fail. What should the company implement to ensure seamless failover?

Accepted Answer

Enable sticky sessions (session affinity) on the ALBs with a cookie duration. Sticky sessions are required to maintain user sessions during failover. Route 53 latency routing alone does not preserve sessions. Option C is correct because ALB sticky sessions with a cookie duration keep users pinned to the same ALB. Option A is wrong because cross-Region VPC peering does not affect session persistence. Option B is wrong because client IP affinity is not supported across Regions. Option D is wrong because Global Accelerator does not provide session stickiness.

Answer

Use a Global Accelerator instead of Route 53

Answer

Enable client IP affinity on the ALBs

Answer

Use Amazon Route 53 geolocation routing instead of latency

Question 5

A company wants to connect its on-premises data center to AWS using a dedicated, high-bandwidth, low-latency connection. The data center is collocated with an AWS Direct Connect location. Which AWS service should be used to establish this connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private connection from on-premises to AWS. Option B is correct. Option A (VPN) uses the public internet. Option C (VPC peering) is for VPC-to-VPC. Option D (Transit Gateway) is a network transit hub but requires an underlying connection.

Answer

VPC peering

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Question 6

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates but must not be accessible from the internet. Which combination of resources meets these requirements with the least operational overhead?

Accepted Answer

A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway. A NAT Gateway in a public subnet provides outbound internet access for private instances while preventing inbound access. Option A is correct. Option B (NAT instance) requires management. Option C (VPC endpoint) is for specific AWS services, not general internet. Option D (Internet Gateway directly) would make instances publicly accessible.

Answer

A VPC endpoint for Amazon S3 in each private subnet

Answer

A NAT instance in each public subnet, with a route in the private route tables pointing to the NAT instance

Answer

An Internet Gateway attached to the VPC with a route in the private route tables pointing to the Internet Gateway

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. It needs to create a secondary CIDR block for additional subnets that must not overlap with the existing CIDR. Which CIDR block should be used?

Accepted Answer

10.1.0.0/16. VPC secondary CIDR blocks must not overlap with the primary CIDR. Option C (10.1.0.0/16) is in the 10.0.0.0/8 range but does not overlap with 10.0.0.0/16. Option A overlaps (10.0.0.0/8 includes 10.0.0.0/16). Option B overlaps (10.0.0.0/16 same). Option D (172.16.0.0/16) is valid but not in the 10.0.0.0/8 range; however, VPC can have any private CIDR, but the question implies a secondary CIDR that is not overlapping; Option C is correct because it is a common practice to use a different /16 within the 10.0.0.0/8.

Answer

172.16.0.0/16

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 8

A company needs to establish private connectivity between two VPCs in different AWS accounts. The VPCs are in the same Region. Which AWS feature should be used?

Accepted Answer

VPC peering. VPC peering is the correct choice because it establishes a direct, private network connection between two VPCs in the same AWS Region, even across different AWS accounts, using the AWS backbone without requiring a transit hub or external connectivity. It leverages the existing AWS infrastructure to route traffic between the VPCs via private IPv4 or IPv6 addresses, with no bandwidth bottlenecks or single points of failure inherent in the design.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 9

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to add a second VPC in the same AWS Region using the same Direct Connect connection. Which solution meets the requirements with the least operational effort?

Accepted Answer

Create a Direct Connect gateway and associate both VPCs, then associate the private VIF with the Direct Connect gateway. A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region, eliminating the need for multiple VIFs or complex routing. By associating both VPCs with the Direct Connect gateway and attaching the private VIF to it, you achieve the goal with minimal operational overhead, as the gateway handles the routing between the on-premises network and the VPCs.

Answer

Set up a VPN connection over the Direct Connect for the second VPC

Answer

Create a transit virtual interface and attach it to a transit gateway, then attach both VPCs

Answer

Create a second private virtual interface for the second VPC

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to connect to a partner's VPC with CIDR 10.0.0.0/16. The VPCs are in the same Region. What is the best solution?

Accepted Answer

Use an AWS Transit Gateway with a transit gateway attachment and configure NAT on the transit gateway to translate IPs. Since the CIDRs overlap, VPC peering cannot be used because overlapping CIDRs are not allowed for peering. The best solution is to use a transit gateway with network address translation (NAT) to handle the overlapping IPs. Option C is correct. Option A (VPC peering) is not possible. Option B (VPN) would also have overlapping issues. Option D (Direct Connect) does not solve overlapping.

Answer

Use an AWS Site-to-Site VPN connection

Answer

Establish VPC peering between the two VPCs

Answer

Use an AWS Direct Connect private virtual interface

Question 11

A company wants to improve the performance and availability of its application that is deployed on EC2 instances in a single Availability Zone. Which architecture should the company implement?

Accepted Answer

Deploy EC2 instances in multiple Availability Zones. Deploying instances across multiple Availability Zones improves availability. Option B is correct. Option A (larger instances) does not improve availability. Option C (Auto Scaling in one AZ) still has a single point of failure. Option D (more subnets in one AZ) does not help.

Answer

Add more subnets in the same Availability Zone

Answer

Use larger EC2 instances

Answer

Use Auto Scaling in the same Availability Zone

Question 12

A company has an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The ALB is configured with a target group that has a health check path of /health. Some instances are failing health checks and being marked unhealthy, but the application logs show the instances are healthy. What is the most likely cause?

Accepted Answer

The security group for the instances does not allow inbound traffic from the ALB's security group on the health check port. The health check is failing because the security group for the instances is not allowing traffic from the ALB. Option A is correct. Option B (health check path) is working as configured. Option C (slow start) does not cause health check failures. Option D (stickiness) does not affect health checks.

Answer

The health check path is incorrect

Answer

The target group's slow start duration is too long

Answer

The ALB's stickiness is preventing health checks

Question 13

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. Options A and C are correct. AWS Direct Connect is a dedicated private connection, and AWS Site-to-Site VPN is a VPN over the internet. VPC peering (B) is for VPC-to-VPC. Internet Gateway (D) is for internet access. VPC endpoint (E) is for private access to AWS services.

Answer

Internet Gateway

Answer

VPC endpoint

Answer

VPC peering

Question 14

Which TWO statements about AWS Transit Gateway are correct? (Choose two.)

Accepted Answer

It supports transitive routing between attached VPCs. Options B and C are correct. Transit Gateway supports transitive routing between attachments. It can be shared across accounts using AWS Resource Access Manager (RAM). Option A is wrong because it does not replace Direct Connect. Option D is wrong because it does not provide internet access. Option E is wrong because it supports both IPsec VPN and Direct Connect attachments.

Answer

It provides internet access for attached VPCs

Answer

It can replace AWS Direct Connect for on-premises connectivity

Answer

It only supports VPN attachments

Question 15

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Option A is correct because deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency