ANS-C01 Network Design Practice Test 27 — 15 Questions

Question 1

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity to the VPC and allow resources in a private subnet to access the internet via IPv6. Which design should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allocate an IPv6 CIDR block, create an egress-only Internet Gateway, and add a route to it from the private subnet.. An egress-only Internet Gateway (EIGW) is the correct AWS-managed service for enabling outbound-only IPv6 traffic from a VPC's private subnet to the internet, while preventing any unsolicited inbound connections. Unlike an Internet Gateway (IGW), which allows bidirectional traffic, an EIGW is specifically designed for IPv6 and ensures that resources in private subnets can initiate outbound connections without being directly reachable from the internet.

Answer

Allocate an IPv6 CIDR block and add a route to an Internet Gateway from the private subnet.

Answer

Use a NAT instance with IPv6 support in a public subnet.

Answer

Allocate an IPv6 CIDR block and use a NAT Gateway for IPv6 traffic.

Question 2

A company has multiple VPCs that need to communicate with each other and with an on-premises network. They want to minimize operational overhead and avoid peering mesh complexity. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway.. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, eliminating the need for a full mesh of VPC peering connections. It simplifies network management by providing transitive routing between all attached networks, which directly addresses the requirement to minimize operational overhead and avoid peering mesh complexity.

Answer

AWS PrivateLink.

Answer

AWS VPN CloudHub.

Answer

VPC Peering.

Question 3

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to establish a central inspection VPC for traffic inspection using a Gateway Load Balancer (GWLB). Traffic from all other VPCs should be routed through the inspection VPC before reaching the internet or on-premises. Which architecture should be used?

Accepted Answer

Use AWS Transit Gateway with a centralized inspection VPC that hosts a GWLB. Configure route tables on the Transit Gateway to send traffic to the GWLB endpoint.. AWS Transit Gateway enables centralized routing between multiple VPCs, and when combined with a Gateway Load Balancer (GWLB) in an inspection VPC, it allows traffic from all other VPCs to be forwarded to the GWLB for inspection before reaching the internet or on-premises. Transit Gateway route tables can be configured with static routes pointing to the GWLB endpoint (using Gateway Load Balancer Endpoint service), ensuring all inter-VPC and egress traffic is steered through the inspection VPC. This architecture scales efficiently across many VPCs in an AWS Organizations multi-account setup without requiring complex peering or direct connections.

Answer

Use VPC Peering to connect all VPCs to the inspection VPC and configure routes to the GWLB.

Answer

Use AWS Direct Connect Gateway to connect all VPCs and route traffic through the inspection VPC.

Answer

Use AWS Network Firewall in each VPC and route traffic to it.

Question 4

A company wants to monitor network traffic in their VPC for troubleshooting and security analysis. They need to capture IP traffic information, including source/destination IPs, ports, and protocol, but not the packet payload. Which AWS service should be used?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture metadata about IP traffic in a VPC, including source/destination IPs, ports, protocol, and packet counts, but never the payload. This meets the requirement for troubleshooting and security analysis without the overhead or privacy concerns of full packet capture.

Answer

Amazon CloudWatch Logs.

Answer

AWS Network Firewall.

Answer

AWS Traffic Mirroring.

Question 5

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to access an S3 bucket. Which configuration provides the most secure and efficient access without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and associate it with the private subnet route table.. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 directly over the AWS network without traversing the internet, using a route table entry that targets the endpoint's prefix list. This provides the most secure and efficient access by keeping traffic within the AWS backbone, avoiding NAT Gateway costs and internet exposure.

Answer

Establish a VPN connection to on-premises and route to S3 from there.

Answer

Use a NAT Gateway in the public subnet to route traffic to S3.

Answer

Configure a proxy server in the public subnet.

Question 6

A company has a VPC with public and private subnets in three Availability Zones. They have EC2 instances in private subnets that need to download patches from the internet. The company requires that all outbound traffic to the internet is logged and inspected. Which solution meets these requirements with the highest availability?

Accepted Answer

Create a centralized egress VPC with a NAT Gateway in each AZ. Peer the application VPCs to the egress VPC and route 0.0.0.0/0 traffic through a firewall appliance in the egress VPC.. It meets the requirements for logging and inspecting all outbound internet traffic by routing it through a centralized firewall appliance in an egress VPC, while also providing high availability through NAT Gateways deployed in each Availability Zone. This architecture ensures that traffic is inspected before reaching the internet, and the use of multiple NAT Gateways eliminates single points of failure, achieving the highest availability compared to single-instance or single-gateway solutions.

Answer

Launch a NAT instance in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to the NAT instance.

Answer

Place a single NAT Gateway in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to that NAT Gateway.

Answer

Attach an internet gateway to the VPC and add a route in the private subnet route tables to send 0.0.0.0/0 to the internet gateway.

Question 7

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. They plan to use AWS Direct Connect with a private virtual interface. What should they do to resolve the overlapping CIDR conflict?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, and re-create the VPC with the new CIDR.. AWS does not support network address translation (NAT) for overlapping CIDRs on a Direct Connect private virtual interface. The only way to resolve the conflict is to change the VPC CIDR to a non-overlapping range (e.g., 172.16.0.0/16) and recreate the VPC, as the VPC CIDR cannot be modified after creation. This ensures that routes between the VPC and on-premises network do not conflict.

Answer

Create a VPN connection with dynamic routing and use BGP to advertise the VPC CIDR.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Answer

Use a NAT Gateway in the VPC to translate the on-premises IP addresses.

Question 8

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The application requires that user sessions are maintained (sticky sessions) and that the ALB can offload SSL/TLS termination. Which configuration should they use?

Accepted Answer

Create an Application Load Balancer with a target group that has stickiness enabled and an HTTPS listener that terminates SSL.. An Application Load Balancer (ALB) natively supports both sticky sessions (via a generated cookie or application-based cookie) and SSL/TLS termination at the HTTPS listener. This allows the ALB to decrypt traffic before forwarding it to targets over HTTP, reducing backend processing overhead while maintaining session affinity across multiple Availability Zones for high availability.

Answer

Create a Network Load Balancer with a target group that has stickiness enabled and an SSL listener.

Answer

Launch EC2 instances as reverse proxy servers in front of the application servers, configure SSL on the reverse proxy, and use an Application Load Balancer to distribute traffic to the reverse proxies.

Answer

Create a Classic Load Balancer with sticky sessions and SSL termination.

Question 9

A company is deploying a multi-tier application in a VPC. The web tier is in public subnets, and the application tier is in private subnets. The application tier needs to communicate with an on-premises database via an AWS Direct Connect connection. The company wants to minimize latency and maximize throughput. Which design should they use?

Accepted Answer

Place the application tier instances in a private subnet in the same VPC as the web tier. Attach a virtual private gateway to the VPC and connect it to the on-premises network via a Direct Connect private virtual interface.. A Direct Connect private virtual interface (VIF) connected to a virtual private gateway (VGW) provides a dedicated, low-latency, high-throughput connection from the VPC to on-premises. The application tier in the private subnet can route traffic directly to the on-premises database via the VGW without traversing the internet or a NAT device, minimizing latency and maximizing throughput.

Answer

Place the application tier in a private subnet and use a NAT Gateway to route traffic to the on-premises network.

Answer

Place the application tier in a separate VPC and peer it to the web tier VPC. Use a Direct Connect connection attached to the web tier VPC.

Answer

Place the application tier in a separate VPC and use a VPN connection over the internet to connect to on-premises.

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. They need to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the routing?

Accepted Answer

Create a Transit Gateway with separate route tables. Attach each VPC and the Direct Connect virtual interface to the Transit Gateway. In the route tables, propagate routes and add static routes to send inter-VPC traffic to the security appliance VPC.. AWS Transit Gateway supports separate route tables, allowing you to isolate traffic domains. By attaching each VPC and the Direct Connect virtual interface to the Transit Gateway, you can create a centralized inspection VPC. Static routes in the Transit Gateway route tables direct inter-VPC traffic to the security appliance VPC, ensuring all traffic between VPCs is inspected before reaching its destination.

Answer

Use Network ACLs on the subnets to restrict traffic and allow inspection.

Answer

Create VPC peering connections between all VPCs and route traffic through a security appliance in a central VPC.

Answer

Use security groups on the security appliance to inspect traffic.

Question 11

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with CIDR 10.0.0.0/16 and an on-premises network with CIDR 192.168.0.0/16. They want to establish a Direct Connect private virtual interface with a virtual private gateway. Which THREE steps are required to complete the connectivity? (Choose three.)

Accepted Answer

Create a virtual private gateway and attach it to the VPC.. Option B is correct because a Direct Connect private virtual interface must terminate on a virtual private gateway (or Direct Connect gateway) attached to the VPC, so creating and attaching the VGW to the VPC is a required step. Option C is correct because after the VGW is attached, the VPC route table must have a route for the on-premises CIDR 192.168.0.0/16 pointing to the virtual private gateway so return traffic can reach the on-premises network. Option D is correct because the private VIF is the actual Layer 2/3 connection over the Direct Connect link, and it must be configured and associated with the VGW to carry traffic for the VPC. Option A is not required because a Transit Gateway is only needed when centralizing multiple VPCs/VPNs or using a Direct Connect gateway in a hub-and-spoke design; a single VPC with a VGW works without it. Option E is not required because a customer gateway object is used for Site-to-Site VPN or for the AWS side of a VPN terminating on a VGW, not for a Direct Connect private VIF.

Answer

Create a Transit Gateway and attach the VPC to it.

Answer

Create a customer gateway object in the AWS account.

Question 12

A company is designing a network for a critical application that requires low-latency communication between EC2 instances in the same AWS Region. They want to maximize network throughput and minimize latency. Which TWO design choices should they make? (Choose two.)

Accepted Answer

Enable enhanced networking (ENA) on the EC2 instances.. Option B is correct because enabling enhanced networking with the Elastic Network Adapter (ENA) provides higher bandwidth, higher packet-per-second performance, and lower latency than the default virtual network interface, which directly supports the goal of maximizing throughput and minimizing latency. Option E is correct because a cluster placement group packs instances close together within a single Availability Zone, providing low-latency, high-throughput networking (up to 10 Gbps or more with supported instance types) ideal for tightly coupled, latency-sensitive applications. Option A is incorrect because an internet gateway is only for routing traffic to and from the internet and does not reduce inter-instance latency or increase throughput. Option C is incorrect because a VPN connection adds encryption overhead and traverses the public internet, increasing latency rather than minimizing it. Option D is incorrect because a spread placement group distributes instances across distinct hardware to reduce correlated failures, which increases network distance and latency rather than optimizing throughput.

Answer

Attach an internet gateway to the VPC and route traffic through it.

Answer

Use a VPN connection to route traffic between instances.

Answer

Use a spread placement group for the EC2 instances.

Question 13

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Answer

Use S3 Transfer Acceleration and access the bucket via the public endpoint

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

Answer

Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it

Question 14

A solutions architect needs to design a highly available web application that uses an Application Load Balancer (ALB) and spans multiple Availability Zones (AZs) in a single region. The application must be able to handle a sudden increase in traffic without manual intervention. Which feature should the architect enable on the ALB to meet this requirement?

Accepted Answer

Enable cross-zone load balancing. Cross-zone load balancing distributes incoming traffic evenly across all registered targets in all enabled Availability Zones, rather than sending traffic only to targets in the same AZ as the load balancer node. This ensures that if one AZ receives more traffic than another, the ALB can still balance the load across all healthy instances, allowing the application to handle sudden traffic spikes without manual scaling intervention.

Answer

Enable connection draining

Answer

Enable sticky sessions

Answer

Enable deletion protection

Question 15

A company is migrating a legacy application to AWS. The application requires a fixed IP address for outbound traffic to a partner's firewall. The application will run on Amazon EC2 instances in a private subnet. Which design meets the requirement without exposing the instances to inbound internet traffic?

Accepted Answer

Deploy a NAT gateway with an Elastic IP and route outbound traffic through it. A NAT gateway with an Elastic IP provides a fixed public IP address for outbound traffic from instances in a private subnet while preventing any unsolicited inbound connections from the internet. The NAT gateway translates the private source IPs of the instances to its own Elastic IP, meeting the partner firewall's requirement for a fixed source IP without exposing the EC2 instances directly.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to the instances

Answer

Place the instances behind an Application Load Balancer

Answer

Create a VPC Gateway Endpoint for the partner's service