ANS-C01 Network Design Practice Test 26 — 15 Questions

Question 1

Which TWO statements about AWS Transit Gateway are correct? (Choose two.)

Accepted Answer

It supports transitive routing between attached VPCs. AWS Transit Gateway (TGW) acts as a central hub that enables transitive routing between all attached VPCs. When you attach multiple VPCs to the same TGW, their route tables are configured to point to the TGW, allowing traffic to flow from one VPC to another through the hub without needing individual VPC peering connections. This transitive behavior is a core feature of TGW, simplifying network architecture and reducing the number of routing paths required.

Answer

It provides internet access for attached VPCs

Answer

It can replace AWS Direct Connect for on-premises connectivity

Answer

It only supports VPN attachments

Question 2

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency

Question 3

A company is designing a multi-region active-active architecture for a web application using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must provide low-latency access to users worldwide and automatically route traffic to healthy endpoints. Which design should be used?

Accepted Answer

Deploy Global Accelerator with endpoints in each region (ALBs) and configure health checks to route traffic to healthy endpoints.. Global Accelerator uses the AWS global network and Anycast IPs to direct traffic to the nearest healthy endpoint, providing low-latency access and automatic failover across regions. By configuring ALBs as endpoints in each region with health checks, Global Accelerator ensures traffic is routed only to healthy endpoints, meeting the active-active multi-region requirement.

Answer

Use Amazon CloudFront with multiple origins pointing to ALBs in each region and configure origin failover.

Answer

Use Amazon Route 53 latency-based routing with health checks to route traffic to ALBs in each region.

Answer

Deploy a single ALB with multiple target groups across regions using cross-zone load balancing.

Question 4

A company is migrating its on-premises data center to AWS. The network team needs to design a hybrid connectivity solution that provides high availability with a bandwidth of at least 10 Gbps and low latency for real-time data replication. The company has two redundant on-premises routers connected to two separate internet service providers (ISPs). Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Provision two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connect each on-premises router to one of them.. Provisioning two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connecting each on-premises router to one of them provides both high availability (via geographic and path redundancy) and the required 10 Gbps bandwidth with low latency for real-time data replication. This design eliminates single points of failure and meets the bandwidth requirement without relying on VPNs, which cannot guarantee consistent low latency or 10 Gbps throughput.

Answer

Use AWS Direct Connect Gateway to aggregate multiple VPN connections to achieve higher bandwidth.

Answer

Provision a single AWS Direct Connect connection with a 10 Gbps port and connect both on-premises routers to it via a single interface.

Answer

Set up two AWS Site-to-Site VPN tunnels from each on-premises router to two different AWS VPN endpoints in the same region.

Question 5

A company is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates but must not be directly accessible from the internet. Which AWS service should be used to provide internet access to instances in the private subnets?

Accepted Answer

NAT gateway. A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound traffic from the internet. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT), and it does not maintain state for inbound connections that were not initiated from within the VPC.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Transit gateway

Question 6

A company is deploying a critical application across multiple Availability Zones (AZs) in a single AWS region. The application requires a highly available network layer that can automatically detect and reroute traffic away from failed endpoints. Which AWS service should be used to meet this requirement?

Accepted Answer

Network Load Balancer (NLB). A Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is designed to handle millions of requests per second with extremely low latency. It performs health checks on targets (e.g., EC2 instances) in each Availability Zone and automatically reroutes traffic away from unhealthy endpoints, providing the required high availability and automatic failover across AZs.

Answer

AWS Global Accelerator

Answer

Application Load Balancer (ALB)

Answer

NAT gateway

Question 7

A company has a VPC with multiple subnets across two AZs. The VPC is connected to an on-premises data center via AWS Direct Connect. The company wants to ensure that traffic between the VPC and on-premises is load-balanced across two Direct Connect virtual interfaces (VIFs) for high availability. Which configuration should be used?

Accepted Answer

Configure two VIFs and use BGP to advertise the same prefixes with equal metrics to enable ECMP.. Configuring two Direct Connect virtual interfaces (VIFs) with BGP and advertising the same prefixes with equal metrics (e.g., equal MED or AS-path length) enables Equal-Cost Multi-Path (ECMP) routing. This allows the VPC and on-premises routers to load-balance traffic across both VIFs, providing high availability and active-active utilization of the Direct Connect connections.

Answer

Configure a VPN connection over each VIF and use equal-cost routes between the VPN tunnels.

Answer

Configure a single Direct Connect VIF with a 10 Gbps connection and a single BGP session.

Answer

Configure two VIFs with static routes pointing to different on-premises IPs.

Question 8

A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?

Accepted Answer

Public subnet for web servers, private subnets for application and database servers. It uses a public subnet with an Internet Gateway (IGW) for the web servers to receive inbound traffic from the internet, while placing the application and database servers in private subnets with no direct internet route. This design enforces the principle of least privilege by isolating sensitive tiers, using NAT Gateway or VPC endpoints for outbound traffic if needed, and relying on security groups and network ACLs for fine-grained access control.

Answer

A single subnet for all tiers with network ACLs to isolate traffic

Answer

Private subnets for all tiers

Answer

Public subnets for all tiers

Question 9

A company is using AWS Organizations to manage multiple accounts. The network team needs to allow a centralized inspection VPC to inspect all traffic between VPCs in different accounts. Which AWS service should be used to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub for inter-VPC and inter-account traffic, enabling you to attach VPCs from multiple AWS accounts (via AWS Organizations) and route traffic through a centralized inspection VPC. By using Transit Gateway route tables and a dedicated inspection VPC with appliances (e.g., firewall), you can enforce traffic inspection for all cross-account VPC communications without requiring individual peering connections.

Answer

VPC peering connections

Answer

AWS PrivateLink

Answer

AWS Site-to-Site VPN

Question 10

A company is designing a hybrid network with a Direct Connect connection. The VPC has multiple subnets that need to communicate with on-premises. The company wants to use a single VIF for both private and public traffic. Which type of VIF should be used?

Accepted Answer

A single VIF cannot carry both private and public traffic. A single Virtual Interface (VIF) on an AWS Direct Connect connection is designed to carry either private traffic (VPC-to-on-premises via private IPs) or public traffic (to AWS public services like S3, DynamoDB via public IPs), but not both simultaneously. This is because a Private VIF uses BGP to exchange routes over private IP addresses within a VPC, while a Public VIF uses BGP to exchange routes for AWS public IP prefixes. The two traffic types require separate BGP sessions and separate VLANs, making it impossible to combine them into one VIF.

Answer

Public VIF

Answer

Hosted VIF

Answer

Private VIF

Question 11

A company is deploying an application that must use IPv6 for internet-facing traffic. The VPC is currently using IPv4 only. What is the simplest way to enable IPv6?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and subnets, and update route tables to route IPv6 traffic to an internet gateway.. The simplest way to enable IPv6 in an existing IPv4-only VPC is to associate an IPv6 CIDR block (e.g., an Amazon-provided /56) with the VPC and subnets, then update the route tables to direct IPv6 traffic (::/0) to an internet gateway. This requires no additional translation or complex infrastructure, as the internet gateway is already dual-stack capable and can handle both IPv4 and IPv6 traffic natively.

Answer

Use an egress-only internet gateway for IPv6 traffic.

Answer

Deploy a NAT64 device to translate IPv6 to IPv4.

Answer

Set up a VPN connection to an ISP that provides IPv6.

Question 12

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing with health checks. The application is deployed in us-east-1 and eu-west-1. During a load test, users in South America experience high latency despite the Route 53 configuration. What is the most likely cause?

Accepted Answer

The health check for one region is failing, causing all traffic to be routed to the remaining healthy region.. Latency-based routing directs traffic to the region with the lowest latency for the user. If a health check fails, Route 53 treats that region as unhealthy and stops routing traffic to it, even if it would otherwise provide lower latency. In this scenario, users in South America likely experience high latency because the eu-west-1 region (which might have lower latency for them) is marked unhealthy, forcing all traffic to us-east-1, which is farther away.

Answer

The company should use geolocation routing instead of latency-based routing.

Answer

The latency records are not refreshed frequently enough, causing stale routing decisions.

Answer

The Route 53 health check is configured to use CloudWatch alarms, which introduced additional latency.

Question 13

A company is deploying a hybrid network with AWS Direct Connect and a VPN backup. The Direct Connect virtual interface is configured for private VIF with BGP. The VPN uses IPsec tunnels over the internet. What is the best practice to ensure symmetric routing and failover?

Accepted Answer

Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.. Using the same BGP ASN for both Direct Connect and VPN, and setting a higher MED on the VPN routes, ensures symmetric routing by making the Direct Connect path more preferred. AWS uses the BGP AS_PATH length as a tie-breaker; with the same ASN, the paths are equal in AS_PATH length, so MED is evaluated. A higher MED on the VPN routes causes AWS to prefer the Direct Connect path, and if Direct Connect fails, the VPN routes (with higher MED) become active, providing failover.

Answer

Configure ASN prepending on the VPN BGP advertisements to make them less preferred.

Answer

Use different BGP ASNs for Direct Connect and VPN to allow AWS to prefer the Direct Connect path.

Answer

Disable BGP on the Direct Connect private VIF and use static routes to force traffic through Direct Connect.

Question 14

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

Accepted Answer

Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.. Elastic Fabric Adapter (EFA) provides OS-bypass capabilities that enable HPC and machine learning workloads to achieve sub-millisecond latency by bypassing the operating system kernel for inter-instance communication. Combined with a cluster placement group, which ensures instances are in close physical proximity within a single Availability Zone, this configuration delivers the lowest possible latency for tightly coupled applications.

Answer

Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

Answer

Launch instances in a spread placement group with SR-IOV enabled.

Answer

Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.

Question 15

A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The tunnel status is up, but traffic from on-premises cannot reach an EC2 instance in the VPC. The instance's security group allows inbound traffic from the on-premises CIDR. Which configuration should be checked first?

Accepted Answer

Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.. For traffic from on-premises to reach an EC2 instance in a VPC via a Site-to-Site VPN, the VPC route table must contain a route pointing the on-premises CIDR to the VPN gateway (virtual private gateway or transit gateway). Without this route, the VPC has no path to send return traffic back to on-premises, causing asymmetric routing and connectivity failure even if the tunnel is up.

Answer

Ensure the VPN connection is attached to a transit gateway instead of a virtual private gateway.

Answer

Check the network ACL associated with the EC2 instance's subnet to ensure it allows inbound traffic from on-premises.

Answer

Confirm that BGP session is established and exchanging routes.