ANS-C01 Network Design Practice Test 26 — 15 Questions

Question 1

A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway with centralized routing to the inspection VPC.. AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.

Answer

VPC peering between all VPCs and the inspection VPC.

Answer

AWS Network Firewall deployed in each VPC.

Answer

AWS Direct Connect Gateway with virtual interfaces.

Question 2

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The application team wants to allow internet traffic to an IPv6-enabled web server. Which resource must be configured?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is required to allow inbound and outbound IPv6 traffic between a VPC and the internet. Unlike IPv4, IPv6 addresses in AWS are globally unique by default, so no NAT is needed; the IGW directly routes traffic for both IPv4 and IPv6 when attached to the VPC and associated with the route table.

Answer

NAT64

Answer

Egress-Only Internet Gateway

Answer

NAT Gateway

Question 3

A company needs to resolve DNS names within a VPC using a custom domain. Which AWS service should be used?

Accepted Answer

Amazon Route 53 Resolver. Amazon Route 53 Resolver provides recursive DNS resolution for VPCs and supports custom domain names via inbound and outbound endpoints. It integrates with on-premises DNS through conditional forwarding, enabling resolution of custom private domains within the VPC without exposing them to the internet.

Answer

Elastic Load Balancing

Answer

Amazon CloudFront

Answer

AWS WAF

Question 4

A company wants to monitor network traffic between two VPCs that are peered. Which AWS feature can capture IP traffic information for analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between peered VPCs. They log metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions, which can be published to CloudWatch Logs or Amazon S3 for analysis. This makes them the correct choice for monitoring network traffic between two peered VPCs.

Answer

AWS X-Ray

Answer

AWS Config

Answer

AWS CloudTrail

Question 5

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet goes through a centralized firewall. Which design should be used?

Accepted Answer

Route all internet traffic through a centralized inspection VPC using Transit Gateway.. It uses a Transit Gateway to route all outbound internet traffic from the VPC to a centralized inspection VPC, where a firewall (e.g., AWS Network Firewall or a third-party appliance) inspects and forwards traffic to an Internet Gateway. This design meets the security requirement by enforcing a single egress point, ensuring all traffic is inspected before reaching the internet.

Answer

Attach an Internet Gateway to each VPC.

Answer

Use AWS Site-to-Site VPN to a third-party firewall.

Answer

Use VPC Endpoints for all services.

Question 6

Which TWO options are valid methods to connect multiple VPCs together in a hub-and-spoke topology? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (A) is a valid method because it creates a direct one-to-one private connection between two VPCs using AWS's internal network, and multiple peering connections can be arranged so that spoke VPCs each peer with a central hub VPC, forming a hub-and-spoke topology. AWS Transit Gateway (E) is also valid because it acts as a regional network hub to which VPCs, VPNs, and Direct Connect gateways attach, natively providing a scalable hub-and-spoke design where spokes route through the transit gateway. AWS Direct Connect (B) is a dedicated private physical network link between on-premises and AWS, not a mechanism for interconnecting VPCs to each other. VPC Endpoints (C) provide private connectivity to AWS services (Gateway or Interface endpoints) and do not connect VPCs together. AWS Site-to-Site VPN (D) connects on-premises networks to a VPC over IPsec tunnels, not VPC-to-VPC hub-and-spoke topologies.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

AWS Site-to-Site VPN

Question 7

Which TWO AWS services can be used to provide inbound internet connectivity to resources in a VPC? (Select TWO.)

Accepted Answer

Internet Gateway. An Internet Gateway (B) is the horizontally scaled, redundant VPC component that attaches directly to a VPC and enables bidirectional communication between resources in the VPC and the internet, so it is the canonical way to provide inbound internet connectivity to public subnets. An internet-facing Elastic Load Balancer (C) is deployed in public subnets with public IP addresses and accepts inbound traffic from the internet, then distributes it to backend targets in the VPC, thus providing inbound internet connectivity to those resources. VPC Endpoint (A) is used for private connectivity to AWS services or endpoint services without traversing the internet, so it does not provide inbound internet access. Amazon CloudFront (D) is a CDN that caches and serves content from edge locations but does not by itself give VPC resources inbound internet connectivity. NAT Gateway (E) is designed for outbound-only traffic from private subnets to the internet and explicitly does not allow inbound connections.

Answer

VPC Endpoint

Answer

Amazon CloudFront

Answer

NAT Gateway

Question 8

A network engineer configured VPC Flow Logs for a subnet to capture all traffic. After reviewing the logs in CloudWatch Logs, they notice that some logs show 'NODATA' for the log-status field. What does 'NODATA' indicate?

Accepted Answer

No network traffic was observed for the given capture period.. When VPC Flow Logs display 'NODATA' for the log-status field, it indicates that no network traffic was observed for the subnet during the aggregation interval (typically 10 minutes). This is a normal status meaning the capture window had zero packets flowing through the monitored interfaces, not an error or delivery issue.

Answer

The flow log record was skipped due to an internal error.

Answer

The log record was successfully delivered to CloudWatch.

Answer

The traffic was rejected by a network ACL or security group.

Question 9

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has an internet gateway attached to the VPC and a NAT gateway in a public subnet. Which route table configuration is required for the private subnets to access the internet?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the NAT gateway.. Private subnets require a default route (0.0.0.0/0) pointing to the NAT gateway to enable outbound internet access while preventing inbound traffic from the internet. The NAT gateway, residing in a public subnet with an associated Elastic IP, translates private IP addresses to the Elastic IP for internet-bound traffic. The internet gateway is used by public subnets, not private subnets, for direct internet access.

Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway.

Answer

Add a route in the public subnet route table with destination 0.0.0.0/0 and target the NAT gateway.

Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway, and associate an Elastic IP with the NAT gateway.

Question 10

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC with CIDR 10.0.0.0/16. They plan to use a transit gateway to connect the VPCs. What is the correct approach to handle the overlapping CIDR ranges?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs.. Transit gateways do not perform NAT or resolve overlapping CIDR conflicts between attached VPCs. When two VPCs have identical CIDR blocks (10.0.0.0/16), the transit gateway cannot route traffic correctly because it cannot distinguish between the two networks. The only viable solution is to create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs, eliminating the conflict at the network layer.

Answer

Create a VPC peering connection and use a smaller subnet CIDR for traffic filtering.

Answer

Use a transit gateway with network address translation (NAT) to translate one VPC CIDR to a non-overlapping range.

Answer

Configure the transit gateway with equal-cost multipath (ECMP) to load balance traffic between the overlapping CIDRs.

Question 11

A company wants to provide internet access to instances in a private subnet using a NAT gateway. The NAT gateway is deployed in a public subnet with an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, instances in the private subnet cannot access the internet. What is the most likely cause?

Accepted Answer

The public subnet route table does not have a route to the internet gateway.. The NAT gateway is deployed in a public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. This is the most likely cause because the NAT gateway itself needs internet access via the IGW to translate and forward traffic.

Answer

The security group assigned to the NAT gateway blocks outbound traffic.

Answer

The private subnet route table has a route to the internet gateway instead of the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP associated.

Question 12

A company is designing a network for a multi-account architecture using AWS Resource Access Manager (RAM) to share VPC subnets across accounts. They want to ensure that instances in shared subnets can communicate with instances in the owner's VPC using private IP addresses. What is required?

Accepted Answer

No additional networking configuration is required; the shared subnet is part of the same VPC.. When you share a subnet using AWS Resource Access Manager (RAM), the shared subnet is part of the owner's VPC. Instances launched into that shared subnet reside in the same VPC as the owner's instances, so they can communicate using private IP addresses by default, with no additional networking configuration required. This is because VPC subnets are a logical subdivision of the VPC's CIDR block, and all instances within the same VPC can route to each other via the VPC's internal router.

Answer

Establish a VPC peering connection between the owner and participant accounts.

Answer

Configure a VPC endpoint for Amazon EC2 to allow cross-account private communication.

Answer

Create a transit gateway and attach both VPCs to it.

Question 13

A company is designing a multi-Region Active-Active architecture using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application requires sticky sessions (session affinity) and must maintain session persistence even during failover. Which configuration should be used to achieve this?

Accepted Answer

Use a custom application cookie for stickiness that is consistent across all ALBs, and set the cookie domain to the Global Accelerator DNS name.. AWS Global Accelerator does not natively support session affinity (sticky sessions). To maintain session persistence across multi-Region ALBs during failover, you must use a custom application cookie that is consistent across all ALBs and set the cookie domain to the Global Accelerator DNS name. This ensures the client's browser sends the same cookie to any healthy ALB in any Region, preserving the session even when traffic shifts due to a failover.

Answer

Enable stickiness on each ALB individually and use a single Regional endpoint group.

Answer

Configure Global Accelerator to use session affinity with the 'two-tuple' protocol.

Answer

Configure Route 53 with latency-based routing and enable stickiness on each ALB.

Question 14

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which design will meet this requirement most securely?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route to it from the private subnets.. A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then forwards traffic to the Internet Gateway (IGW) in the public subnet. This design is the most secure because it avoids exposing private instances directly to the internet and uses a managed, highly available service.

Answer

Add a default route to the IGW from the private subnet route table.

Answer

Place the instances in a public subnet with a route to an Internet Gateway (IGW).

Answer

Deploy a NAT instance in a private subnet and configure routes to it.

Question 15

A company is designing a network for a real-time gaming application that requires the lowest possible latency across AWS Regions. The application uses UDP traffic. Which AWS service should be used to optimize traffic routing?

Accepted Answer

AWS Global Accelerator.. AWS Global Accelerator uses the Anycast IP address concept to route UDP traffic over the AWS global network, minimizing latency by directing traffic to the nearest healthy endpoint. It is specifically designed for real-time applications like gaming that require low latency and jitter, and it supports UDP traffic natively.

Answer

AWS Direct Connect with multiple connections.

Answer

Amazon Route 53 with latency-based routing.

Answer

Amazon CloudFront with custom origins.