ANS-C01 Network Design Practice Test 26 — 15 Questions

Question 1

A company is designing a multi-region active-active architecture for a web application using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must provide low-latency access to users worldwide and automatically route traffic to healthy endpoints. Which design should be used?

Accepted Answer

Deploy Global Accelerator with endpoints in each region (ALBs) and configure health checks to route traffic to healthy endpoints.. Option B is correct because Global Accelerator uses anycast IPs and health checks to route traffic to the closest healthy endpoint. Option A is wrong because Route 53 latency routing with health checks can work but does not use anycast and may not provide the same performance. Option C is wrong because multiple ALBs in a single region would not provide multi-region failover. Option D is wrong because CloudFront with ALB origins can provide low latency but does not support active-active multi-region traffic routing by default.

Answer

Use Amazon CloudFront with multiple origins pointing to ALBs in each region and configure origin failover.

Answer

Use Amazon Route 53 latency-based routing with health checks to route traffic to ALBs in each region.

Answer

Deploy a single ALB with multiple target groups across regions using cross-zone load balancing.

Question 2

A company is migrating its on-premises data center to AWS. The network team needs to design a hybrid connectivity solution that provides high availability with a bandwidth of at least 10 Gbps and low latency for real-time data replication. The company has two redundant on-premises routers connected to two separate internet service providers (ISPs). Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Provision two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connect each on-premises router to one of them.. Option C is correct because AWS Direct Connect provides dedicated, low-latency, high-bandwidth connections. Using two Direct Connect locations with redundant connections ensures high availability. Option A is wrong because AWS VPN is limited to ~1.25 Gbps per tunnel and may not meet the 10 Gbps requirement. Option B is wrong because a single Direct Connect connection is a single point of failure. Option D is wrong because Direct Connect Gateway does not provide the connection itself.

Answer

Use AWS Direct Connect Gateway to aggregate multiple VPN connections to achieve higher bandwidth.

Answer

Provision a single AWS Direct Connect connection with a 10 Gbps port and connect both on-premises routers to it via a single interface.

Answer

Set up two AWS Site-to-Site VPN tunnels from each on-premises router to two different AWS VPN endpoints in the same region.

Question 3

A company is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates but must not be directly accessible from the internet. Which AWS service should be used to provide internet access to instances in the private subnets?

Accepted Answer

NAT gateway. Option B is correct because a NAT gateway allows instances in private subnets to initiate outbound traffic to the internet but prevents inbound traffic from the internet. Option A is wrong because an internet gateway is for public subnets and allows inbound connections. Option C is wrong because a transit gateway connects VPCs but does not provide internet access. Option D is wrong because a VPC endpoint is for accessing AWS services privately, not the internet.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Transit gateway

Question 4

A company is deploying a critical application across multiple Availability Zones (AZs) in a single AWS region. The application requires a highly available network layer that can automatically detect and reroute traffic away from failed endpoints. Which AWS service should be used to meet this requirement?

Accepted Answer

Network Load Balancer (NLB). Option A is correct because a Network Load Balancer (NLB) operates at Layer 4, provides high availability across AZs, and automatically reroutes traffic from unhealthy targets. Option B is wrong because an Application Load Balancer (ALB) is Layer 7 and may introduce unnecessary overhead. Option C is wrong because a NAT gateway provides outbound internet access, not load balancing. Option D is wrong because AWS Global Accelerator is for multi-region traffic, not intra-region.

Answer

AWS Global Accelerator

Answer

Application Load Balancer (ALB)

Answer

NAT gateway

Question 5

A company has a VPC with multiple subnets across two AZs. The VPC is connected to an on-premises data center via AWS Direct Connect. The company wants to ensure that traffic between the VPC and on-premises is load-balanced across two Direct Connect virtual interfaces (VIFs) for high availability. Which configuration should be used?

Accepted Answer

Configure two VIFs and use BGP to advertise the same prefixes with equal metrics to enable ECMP.. Option D is correct because using BGP routing with equal-cost multipath (ECMP) across two VIFs allows traffic to be load-balanced. Option A is wrong because a single VIF is a single point of failure. Option B is wrong because static routes do not provide load balancing; one route is typically preferred. Option C is wrong because a VPN over the VIFs adds overhead and does not provide native load balancing.

Answer

Configure a VPN connection over each VIF and use equal-cost routes between the VPN tunnels.

Answer

Configure a single Direct Connect VIF with a 10 Gbps connection and a single BGP session.

Answer

Configure two VIFs with static routes pointing to different on-premises IPs.

Question 6

A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?

Accepted Answer

Public subnet for web servers, private subnets for application and database servers. Option A is correct because a public subnet for web servers allows internet access, while private subnets for application and database servers provide isolation. Option B is wrong because placing all servers in public subnets exposes them to the internet. Option C is wrong because placing all servers in private subnets would block internet access to web servers. Option D is wrong because a single subnet for all tiers does not provide isolation.

Answer

A single subnet for all tiers with network ACLs to isolate traffic

Answer

Private subnets for all tiers

Answer

Public subnets for all tiers

Question 7

A company is using AWS Organizations to manage multiple accounts. The network team needs to allow a centralized inspection VPC to inspect all traffic between VPCs in different accounts. Which AWS service should be used to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. Option C is correct because a Transit Gateway with route tables can route traffic between VPCs and send it to a network appliance in the inspection VPC. Option A is wrong because VPC peering is a simple point-to-point connection and does not support transitive routing. Option B is wrong because a VPN is for hybrid connectivity, not inter-VPC routing. Option D is wrong because PrivateLink is for accessing services privately, not for routing traffic.

Answer

VPC peering connections

Answer

AWS PrivateLink

Answer

AWS Site-to-Site VPN

Question 8

A company is designing a hybrid network with a Direct Connect connection. The VPC has multiple subnets that need to communicate with on-premises. The company wants to use a single VIF for both private and public traffic. Which type of VIF should be used?

Accepted Answer

A single VIF cannot carry both private and public traffic. Option D is correct because a private VIF allows access to VPCs via private IP addresses. A public VIF is for accessing public AWS services. Option A is wrong because a private VIF is for VPC access, but the question asks for both private and public traffic. Option B is wrong because a public VIF only provides access to public AWS services, not VPCs. Option C is wrong because a hosted VIF is a type of private VIF but still only private.

Answer

Public VIF

Answer

Hosted VIF

Answer

Private VIF

Question 9

A company is deploying an application that must use IPv6 for internet-facing traffic. The VPC is currently using IPv4 only. What is the simplest way to enable IPv6?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and subnets, and update route tables to route IPv6 traffic to an internet gateway.. Option A is correct because you can assign an IPv6 CIDR block to the VPC and subnets, and then update route tables. Option B is wrong because a NAT device is for IPv4. Option C is wrong because an egress-only internet gateway is for outbound-only IPv6. Option D is wrong because a VPN does not provide IPv6 internet access.

Answer

Use an egress-only internet gateway for IPv6 traffic.

Answer

Deploy a NAT64 device to translate IPv6 to IPv4.

Answer

Set up a VPN connection to an ISP that provides IPv6.

Question 10

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing with health checks. The application is deployed in us-east-1 and eu-west-1. During a load test, users in South America experience high latency despite the Route 53 configuration. What is the most likely cause?

Accepted Answer

The health check for one region is failing, causing all traffic to be routed to the remaining healthy region.. Option D is correct because latency-based routing selects the region with the lowest latency for the user, but if the health check fails for one region, Route 53 routes traffic to the other region regardless of latency. Option A is wrong because latency-based routing does not require geolocation routing. Option B is wrong because health checks use Route 53 health checkers, not CloudWatch. Option C is wrong because latency records are evaluated per query and do not cause all traffic to go to one region.

Answer

The company should use geolocation routing instead of latency-based routing.

Answer

The latency records are not refreshed frequently enough, causing stale routing decisions.

Answer

The Route 53 health check is configured to use CloudWatch alarms, which introduced additional latency.

Question 11

A company is deploying a hybrid network with AWS Direct Connect and a VPN backup. The Direct Connect virtual interface is configured for private VIF with BGP. The VPN uses IPsec tunnels over the internet. What is the best practice to ensure symmetric routing and failover?

Accepted Answer

Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.. Option B is correct. Using the same BGP ASN on the VPN side ensures that AWS treats both paths as equal, and with BGP attributes you can control active/passive behavior. Option A is wrong because ASN prepending is used to influence path selection, not to ensure symmetry. Option C is wrong because you cannot disable BGP on Direct Connect private VIF; it requires BGP. Option D is wrong because using different ASNs would make AWS treat them as separate paths and might cause asymmetric routing.

Answer

Configure ASN prepending on the VPN BGP advertisements to make them less preferred.

Answer

Use different BGP ASNs for Direct Connect and VPN to allow AWS to prefer the Direct Connect path.

Answer

Disable BGP on the Direct Connect private VIF and use static routes to force traffic through Direct Connect.

Question 12

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

Accepted Answer

Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.. Option C is correct. A placement group with a cluster strategy places instances in a low-latency group within a single AZ, and Elastic Fabric Adapter (EFA) provides high-throughput, low-latency networking for HPC and ML workloads. Option A is wrong because Enhanced Networking alone does not guarantee sub-millisecond latency; EFA is needed. Option B is wrong because Spread placement group spreads instances across hardware, increasing latency. Option D is wrong because a spread placement group with SR-IOV is not as low-latency as cluster placement with EFA.

Answer

Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

Answer

Launch instances in a spread placement group with SR-IOV enabled.

Answer

Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.

Question 13

A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The tunnel status is up, but traffic from on-premises cannot reach an EC2 instance in the VPC. The instance's security group allows inbound traffic from the on-premises CIDR. Which configuration should be checked first?

Accepted Answer

Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.. Option A is correct. The VPC's route table must have a route pointing to the VPN gateway for the on-premises CIDR. If missing, traffic will not be forwarded to the VPN tunnel. Option B is wrong because network ACLs are stateless and need both inbound and outbound rules; but first check routing. Option C is wrong because the VPN connection uses a virtual private gateway, not a transit gateway, unless specifically designed. Option D is wrong because the VPN tunnel being up indicates BGP is working; the issue is likely routing.

Answer

Ensure the VPN connection is attached to a transit gateway instead of a virtual private gateway.

Answer

Check the network ACL associated with the EC2 instance's subnet to ensure it allows inbound traffic from on-premises.

Answer

Confirm that BGP session is established and exchanging routes.

Question 14

A company is designing a network for a large-scale e-commerce platform that must handle sudden traffic spikes. The architecture uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances across multiple Availability Zones. The ALB is internet-facing. To protect against DDoS attacks, which AWS services should be used at the network edge?

Accepted Answer

Subscribe to AWS Shield Advanced and deploy AWS WAF on the ALB.. Option D is correct. AWS Shield Advanced provides enhanced protection against DDoS attacks, and AWS WAF can be integrated with ALB to filter malicious traffic. Option A is wrong because Network ACLs are not at the edge; they are subnet-level. Option B is wrong because AWS Shield Standard is included automatically but does not provide advanced protection. Option C is wrong because Route 53 is for DNS, not DDoS mitigation at the network edge.

Answer

Configure network ACLs to allow only known IP ranges.

Answer

Enable AWS Shield Standard and configure security groups to block traffic from suspicious sources.

Answer

Use Amazon Route 53 with DNS-based failover to redirect traffic away from the ALB during an attack.

Question 15

A company wants to connect its VPC to an on-premises data center using AWS Direct Connect. The company has two Direct Connect locations in the same AWS region. For high availability, they plan to establish two separate connections. Which configuration ensures that if one connection fails, traffic automatically fails over to the other?

Accepted Answer

Establish two Direct Connect connections from different Direct Connect locations to the same VPC, each with a private VIF attached to the same virtual private gateway.. Option C is correct. Two Direct Connect connections from different locations to the same VPC, each with a private VIF attached to the same virtual private gateway, and using BGP with ASN prepending on one path to make it less preferred, provides automatic failover. Option A is wrong because a single connection cannot provide failover. Option B is wrong because two connections to the same DX location are not fully diverse. Option D is wrong because VPN backup is not required; two DX connections can provide HA.

Answer

Establish one Direct Connect connection and one AWS Site-to-Site VPN connection as backup.

Answer

Establish two Direct Connect connections from the same Direct Connect location to the same VPC.

Answer

Establish a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.