ANS-C01 Network Design Practice Test 25 — 15 Questions

Question 1

A company has a VPC with a CIDR of 10.0.0.0/16. It has two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to use AWS Site-to-Site VPN to connect to an on-premises network with a CIDR of 192.168.0.0/16. The VPN connection uses a virtual private gateway (VGW) attached to the VPC. The on-premises network has a VPN appliance that supports BGP. The company also wants to use static routes for the VPN. Which configuration is required to enable communication between the VPC and on-premises network?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a route in the VPC route table for 192.168.0.0/16 with target the virtual private gateway.. For a Site-to-Site VPN using a virtual private gateway (VGW), you must add a route in the VPC route table for the on-premises CIDR (192.168.0.0/16) with the VGW as the target. This directs traffic destined for the on-premises network through the VPN tunnel. Even though BGP is supported, the company explicitly wants to use static routes, so manual route entries are required in the VPC route table.

Answer

Add a route in the on-premises route table for 10.0.0.0/16 pointing to the VPN appliance.

Answer

Create a NAT gateway in the public subnet and route traffic through it.

Answer

Add a route in the VPC route table for 192.168.0.0/16 with target the internet gateway.

Question 2

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers must be in private subnets except the web tier. Which combination of AWS services and routing should be used to meet these requirements?

Accepted Answer

Use an internet gateway attached to the VPC, public subnet for web tier, private subnets for app and database tiers, and security groups to restrict traffic between tiers.. It uses an internet gateway attached to the VPC to provide internet access to the web tier in a public subnet, while the application and database tiers are placed in private subnets. Security groups are stateful and can restrict traffic between tiers by allowing inbound traffic only from the specific security group of the preceding tier (e.g., app tier SG allows traffic only from web tier SG), which meets the requirement without exposing private tiers to the internet. Network ACLs are stateless and less suitable for this granular, stateful filtering between tiers.

Answer

Use a NAT gateway in the public subnet for web tier, and route all traffic through it.

Answer

Use a VPN connection to the internet gateway and route traffic through a virtual private gateway.

Answer

Use an internet gateway, public subnet for web tier, private subnets for app and database, and network ACLs to filter traffic between tiers.

Question 3

A company is designing a network for a VPC with a CIDR of 10.0.0.0/16. The VPC has three private subnets in three different Availability Zones. The company needs to provide internet access to instances in the private subnets for software updates. The architecture must be highly available and cost-effective. Which TWO actions should the network engineer take?

Accepted Answer

Configure each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone.. Configuring each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in the same Availability Zone ensures that traffic from instances in that subnet uses a NAT Gateway that is in the same AZ, avoiding cross-AZ data transfer costs and maintaining high availability. Option C is correct because deploying a NAT Gateway in each Availability Zone provides redundancy; if one AZ fails, the other NAT Gateways continue to provide internet access, meeting the high availability requirement while remaining cost-effective compared to using NAT instances with Auto Scaling.

Answer

Use a NAT instance in an Auto Scaling group.

Answer

Use a single route table for all private subnets and route to one NAT Gateway.

Answer

Deploy a single NAT Gateway in one Availability Zone.

Question 4

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize internet egress for all VPCs through a single VPC that has a NAT Gateway and an internet gateway. Which TWO configurations are required to achieve this?

Accepted Answer

In the egress VPC, add a route for 0.0.0.0/0 to the internet gateway in the route table of the subnet containing the NAT Gateway.. The egress VPC must route traffic from the NAT Gateway to the internet gateway for internet-bound traffic. The NAT Gateway resides in a public subnet with a route table that directs 0.0.0.0/0 to the internet gateway, enabling outbound connectivity. This allows the NAT Gateway to translate private IPs from other VPCs and forward traffic to the internet.

Answer

In the egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.

Answer

Create a VPN connection between each VPC and the Transit Gateway.

Answer

In each non-egress VPC, delete the local route.

Question 5

A company is designing a network architecture for a critical application that must be highly available across AWS Regions. The application uses an Application Load Balancer (ALB) in each Region, and the company wants to use a global DNS name that automatically routes traffic to the healthy Region with the lowest latency. The company also needs to be able to perform planned failover for maintenance. Which THREE components are required to meet these requirements?

Accepted Answer

Amazon Route 53 weighted routing policy for each ALB endpoint. The correct components are a latency-based routing policy to automatically route to the lowest latency healthy region, health checks to determine endpoint health, and a weighted routing policy to enable planned failover by adjusting weights. While latency and weighted routing policies cannot be used simultaneously on the same record set, the question tests the knowledge of the required policies: latency for automatic routing, health checks for failover, and weighted for manual traffic shifting during maintenance. In practice, you would implement latency-based routing with health checks, and for planned maintenance, you would temporarily change the routing policy to weighted or use a separate record.

Answer

Amazon Route 53 geolocation routing policy

Answer

Amazon Route 53 failover routing policy

Question 6

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) in us-east-1 and eu-west-1, with Route 53 latency-based routing. Users report that after a failover, existing connections fail. What should the company implement to ensure seamless failover?

Accepted Answer

Use a Global Accelerator instead of Route 53. AWS Global Accelerator provides a static anycast IP address that remains constant during failover. Clients connect to the same IP, and the accelerator directs traffic to the healthy regional endpoint without breaking existing connections. Route 53 latency-based routing relies on DNS, which changes the resolved IP on failover, causing existing TCP connections to fail. Sticky sessions (session affinity) on ALBs only persist within a single ALB and do not help when traffic is redirected to a different region. Therefore, Global Accelerator ensures seamless failover for existing connections.

Answer

Enable client IP affinity on the ALBs

Answer

Use Amazon Route 53 geolocation routing instead of latency

Answer

Enable sticky sessions (session affinity) on the ALBs with a cookie duration

Question 7

A company wants to connect its on-premises data center to AWS using a dedicated, high-bandwidth, low-latency connection. The data center is collocated with an AWS Direct Connect location. Which AWS service should be used to establish this connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth, low-latency connection from an on-premises data center to AWS. Since the data center is collocated with an AWS Direct Connect location, the company can establish a physical cross-connect directly to the AWS Direct Connect router, bypassing the public internet entirely.

Answer

VPC peering

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Question 8

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates but must not be accessible from the internet. Which combination of resources meets these requirements with the least operational overhead?

Accepted Answer

A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway. A NAT Gateway in each public subnet provides outbound-only internet access for instances in private subnets, with no inbound accessibility from the internet. This solution requires minimal operational overhead because NAT Gateways are fully managed by AWS, automatically handle failover across Availability Zones, and scale up to 45 Gbps without manual intervention. The private route table simply needs a default route (0.0.0.0/0) pointing to the NAT Gateway, which forwards traffic to the Internet Gateway attached to the VPC.

Answer

A VPC endpoint for Amazon S3 in each private subnet

Answer

A NAT instance in each public subnet, with a route in the private route tables pointing to the NAT instance

Answer

An Internet Gateway attached to the VPC with a route in the private route tables pointing to the Internet Gateway

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. It needs to create a secondary CIDR block for additional subnets that must not overlap with the existing CIDR. Which CIDR block should be used?

Accepted Answer

172.16.0.0/16. Both A (172.16.0.0/16) and D (10.1.0.0/16) are correct because they are private, non-overlapping secondary CIDRs. The primary CIDR is 10.0.0.0/16; any non-overlapping CIDR is valid, regardless of RFC 1918 class. Options B and C overlap with the primary and therefore cannot be used.

Answer

10.0.0.0/16

Answer

10.0.0.0/8

Question 10

A company needs to establish private connectivity between two VPCs in different AWS accounts. The VPCs are in the same Region. Which AWS feature should be used?

Accepted Answer

VPC peering. VPC peering is the correct choice because it establishes a direct, private network connection between two VPCs in the same AWS Region, even across different AWS accounts, using the AWS backbone without requiring a transit hub or external connectivity. It leverages the existing AWS infrastructure to route traffic between the VPCs via private IPv4 or IPv6 addresses, with no bandwidth bottlenecks or single points of failure inherent in the design.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 11

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to add a second VPC in the same AWS Region using the same Direct Connect connection. Which solution meets the requirements with the least operational effort?

Accepted Answer

Create a Direct Connect gateway and associate both VPCs, then associate the private VIF with the Direct Connect gateway. A Direct Connect gateway allows a single private virtual interface (VIF) to connect to multiple VPCs in the same AWS Region, eliminating the need for multiple VIFs or complex routing. By associating both VPCs with the Direct Connect gateway and attaching the private VIF to it, you achieve the goal with minimal operational overhead, as the gateway handles the routing between the on-premises network and the VPCs.

Answer

Set up a VPN connection over the Direct Connect for the second VPC

Answer

Create a transit virtual interface and attach it to a transit gateway, then attach both VPCs

Answer

Create a second private virtual interface for the second VPC

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16 and needs to connect to a partner's VPC with CIDR 10.0.0.0/16. The VPCs are in the same Region. What is the best solution?

Accepted Answer

Use an AWS Transit Gateway with a transit gateway attachment and configure NAT on the transit gateway to translate IPs. When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), VPC peering and Direct Connect cannot resolve the IP conflict, as they require non-overlapping address spaces. An AWS Transit Gateway with NAT attachments can translate IP addresses at the transit gateway level, allowing traffic to flow between overlapping VPCs by mapping source/destination IPs to non-conflicting ranges. This solution provides a scalable, managed way to handle overlapping CIDRs without complex manual routing.

Answer

Use an AWS Site-to-Site VPN connection

Answer

Establish VPC peering between the two VPCs

Answer

Use an AWS Direct Connect private virtual interface

Question 13

A company wants to improve the performance and availability of its application that is deployed on EC2 instances in a single Availability Zone. Which architecture should the company implement?

Accepted Answer

Deploy EC2 instances in multiple Availability Zones. Deploying EC2 instances across multiple Availability Zones (AZs) improves both performance and availability by eliminating a single point of failure. If one AZ experiences an outage, traffic can be routed to healthy instances in another AZ using an Elastic Load Balancer or Route 53 DNS failover. This architecture also distributes the load, reducing latency for users in different geographic regions.

Answer

Add more subnets in the same Availability Zone

Answer

Use larger EC2 instances

Answer

Use Auto Scaling in the same Availability Zone

Question 14

A company has an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The ALB is configured with a target group that has a health check path of /health. Some instances are failing health checks and being marked unhealthy, but the application logs show the instances are healthy. What is the most likely cause?

Accepted Answer

The security group for the instances does not allow inbound traffic from the ALB's security group on the health check port. The most likely cause is that the security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health check requests are dropped, causing the target to be marked unhealthy even though the application itself is running fine.

Answer

The health check path is incorrect

Answer

The target group's slow start duration is too long

Answer

The ALB's stickiness is preventing health checks

Question 15

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel between a virtual private gateway or transit gateway in your VPC and a customer gateway device in your on-premises network. It uses IPsec (IKEv1 or IKEv2) to secure traffic over the public internet, making it a valid and common method for hybrid connectivity.

Answer

Internet Gateway

Answer

VPC endpoint

Answer

VPC peering