ANS-C01 Network Design Practice Test 27 — 15 Questions

Question 1

A company is designing a network for a large-scale e-commerce platform that must handle sudden traffic spikes. The architecture uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances across multiple Availability Zones. The ALB is internet-facing. To protect against DDoS attacks, which AWS services should be used at the network edge?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Subscribe to AWS Shield Advanced and deploy AWS WAF on the ALB.. AWS Shield Advanced provides enhanced DDoS protection for internet-facing resources like ALBs, including cost protection and access to the DDoS Response Team (DRT). Deploying AWS WAF on the ALB allows you to create custom rules to filter malicious traffic, such as SQL injection or cross-site scripting attempts, and rate-limit requests to mitigate application-layer DDoS attacks. Together, they form a layered defense at the network edge, addressing both infrastructure (Layer 3/4) and application (Layer 7) threats.

Answer

Configure network ACLs to allow only known IP ranges.

Answer

Enable AWS Shield Standard and configure security groups to block traffic from suspicious sources.

Answer

Use Amazon Route 53 with DNS-based failover to redirect traffic away from the ALB during an attack.

Question 2

A company wants to connect its VPC to an on-premises data center using AWS Direct Connect. The company has two Direct Connect locations in the same AWS region. For high availability, they plan to establish two separate connections. Which configuration ensures that if one connection fails, traffic automatically fails over to the other?

Accepted Answer

Establish two Direct Connect connections from different Direct Connect locations to the same VPC, each with a private VIF attached to the same virtual private gateway.. It provides true high availability by using two Direct Connect connections from different geographic locations, each with a private virtual interface (VIF) attached to the same virtual private gateway (VGW). This configuration ensures that if one connection fails, BGP sessions automatically withdraw the affected routes, and traffic is rerouted over the remaining connection via the VGW's active/active or active/passive routing behavior.

Answer

Establish one Direct Connect connection and one AWS Site-to-Site VPN connection as backup.

Answer

Establish two Direct Connect connections from the same Direct Connect location to the same VPC.

Answer

Establish a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.

Question 3

A company is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates, but must not be directly reachable from the internet. Which two components are required for this design? (Choose two.)

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway in a public subnet (A) provides outbound internet access for instances in private subnets while preventing inbound connections from the internet. A route table for the private subnets with a 0.0.0.0/0 route pointing to the NAT Gateway (E) directs outbound traffic to the NAT Gateway. Option B (Security Group allowing outbound HTTPS) is not a component; security groups control traffic but don't provide routing or internet access. Option C (Internet Gateway attached to the VPC) is required for public subnets but alone does not enable private subnet outbound access. Option D (Site-to-Site VPN) is for hybrid connectivity, not internet access.

Answer

Security Group allowing outbound HTTPS

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 4

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their internet-facing Application Load Balancer. The VPC is already associated with an IPv6 CIDR block. What additional configuration is required? (Choose two.)

Accepted Answer

Add a route in the subnet's route table for ::/0 to the Internet Gateway.. Options B and C are correct. To support IPv6 clients on an internet-facing ALB, the subnet where the ALB is deployed must have an IPv6 CIDR block associated (C), and the subnet's route table must include a route for ::/0 to the internet gateway (B). Option A is incorrect because NAT64/DNS64 is not needed; the ALB natively supports IPv6. Option D is incorrect because the ALB uses the subnet's IPv6 CIDR, not an assigned IPv6 address on its network interface. Option E is incorrect because an Egress-Only Internet Gateway is used for outbound-only IPv6 traffic from private subnets, not for internet-facing ALBs.

Answer

Configure NAT64 and DNS64 on the VPC.

Answer

Assign an IPv6 address to the ALB's network interface.

Answer

Create an Egress-Only Internet Gateway for the VPC.

Question 5

A company is designing a multi-account AWS environment using AWS Transit Gateway. They have 10 VPCs in separate accounts that need to communicate with each other and with an on-premises network via Direct Connect. Which three components are required to enable this connectivity? (Choose three.)

Accepted Answer

AWS Resource Access Manager to share the Transit Gateway with other accounts. Options A, B, and C are correct. AWS Transit Gateway (C) in a central network account acts as a hub for inter-VPC and on-premises connectivity. AWS Resource Access Manager (A) is required to share the Transit Gateway with other accounts so that VPCs in those accounts can attach to it. A Direct Connect Gateway (B) attached to the Transit Gateway provides connectivity to the on-premises network via Direct Connect. Option D is incorrect because VPC Peering is unnecessary when using Transit Gateway. Option E is incorrect because a Site-to-Site VPN is not required when Direct Connect is already used for on-premises connectivity.

Answer

VPC Peering connections between each pair of VPCs

Answer

AWS Site-to-Site VPN connection from the Transit Gateway to the on-premises network

Question 6

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to communicate with an RDS database in subnet-B. Both subnets are in the same Availability Zone. What is the most efficient way to enable this communication?

Accepted Answer

No additional configuration is required. The instance and database can communicate within the same VPC.. Both the EC2 instance and the RDS database reside within the same VPC (10.0.0.0/16), and subnets within a VPC can communicate with each other by default using the VPC's local route. No additional configuration is needed, as the VPC's main route table or subnet route tables already include a local route for the VPC CIDR, enabling direct communication within the same Availability Zone.

Answer

Create a Transit Gateway and attach both subnets to it.

Answer

Place a NAT Gateway in subnet-A and configure route tables accordingly.

Answer

Create a VPC Peering connection between the two subnets.

Question 7

A company is designing a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. The database should not have direct internet access. Which architecture meets these requirements?

Accepted Answer

Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.. It places the web server in a public subnet with a route to an Internet Gateway (IGW) for direct outbound internet access to download patches, while the database resides in a private subnet with a route to a NAT Gateway in the public subnet. The NAT Gateway enables outbound-only internet access for the database (e.g., for license validation or updates) without exposing it to unsolicited inbound connections, meeting the requirement that the database should not have direct internet access.

Answer

Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet without any internet access.

Answer

Place both instances in the public subnet and use security groups to restrict inbound access to the database.

Answer

Place the web server in the private subnet with a NAT Gateway, and the database in the public subnet with an Internet Gateway.

Question 8

A company is deploying a critical application that requires low latency between EC2 instances in the same AWS region but across multiple Availability Zones. The instances are part of an Auto Scaling group behind a Network Load Balancer. Which network design provides the lowest latency while maintaining high availability?

Accepted Answer

Do not use a placement group; enable Enhanced Networking (ENA) on all instances.. Enhanced Networking (ENA) provides the highest possible packet-per-second performance and lowest latency by offloading network processing to dedicated hardware on the instance. Since the application requires low latency across multiple Availability Zones, a placement group is not suitable because cluster placement groups cannot span multiple AZs, and spread/partition placement groups do not improve latency — they only control instance placement for fault isolation. ENA alone, combined with a Network Load Balancer, delivers the lowest latency while maintaining high availability across AZs.

Answer

Use a cluster placement group across two Availability Zones.

Answer

Use a spread placement group across two Availability Zones.

Answer

Use a partition placement group across two Availability Zones.

Question 9

A company is deploying a multi-tier web application across three Availability Zones in a single AWS Region. The web tier must be fault-tolerant and scale horizontally. Which network design provides the highest availability and scalability?

Accepted Answer

Use an Application Load Balancer in front of an Auto Scaling group spanning three Availability Zones.. An Application Load Balancer (ALB) distributes incoming HTTP/HTTPS traffic across multiple targets, and when combined with an Auto Scaling group that spans three Availability Zones, it provides both horizontal scalability and fault tolerance. If one AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZs, ensuring high availability. This design meets the requirement for a multi-tier web application that must scale horizontally and tolerate failures.

Answer

Deploy a single EC2 instance in one Availability Zone with an Elastic IP address.

Answer

Deploy EC2 instances in a single Availability Zone and use Route 53 weighted routing.

Answer

Use a Network Load Balancer with a single EC2 instance in each AZ.

Question 10

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network via AWS Direct Connect. The on-premises network uses 10.0.0.0/16. Which solution allows connectivity without IP overlap?

Accepted Answer

Create a new VPC with a non-overlapping CIDR, connect both VPCs via Transit Gateway, and use NAT on the Transit Gateway attachment to the on-premises network.. When both the VPC and on-premises network use the same 10.0.0.0/16 CIDR, direct connectivity is impossible due to overlapping IP ranges. By creating a new VPC with a non-overlapping CIDR, connecting both VPCs via Transit Gateway, and applying NAT on the Transit Gateway attachment to the on-premises network, traffic from the original VPC can be source-NATed to the new VPC's range before being forwarded to on-premises, resolving the overlap. This allows the on-premises network to receive traffic with unique IPs, avoiding routing conflicts.

Answer

Establish a VPC peering connection between the VPC and on-premises network.

Answer

Use AWS Direct Connect with a private VIF and static routes to route traffic.

Answer

Deploy a NAT instance in the VPC to translate on-premises IPs.

Question 11

A company wants to allow its VPC to access an S3 bucket securely without traversing the internet. Which AWS resource enables private connectivity between a VPC and S3?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint (C) is the correct choice because it provides private, direct connectivity between a VPC and S3 without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, using prefix lists in the VPC route table to direct S3 traffic to the endpoint, ensuring data never leaves the AWS backbone.

Answer

Internet Gateway

Answer

AWS Site-to-Site VPN

Answer

NAT Gateway

Question 12

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to minimize cost and management overhead. Which solution should be used?

Accepted Answer

Deploy a single NAT Gateway in one public subnet and configure route tables to route 0.0.0.0/0 traffic to it.. A single NAT Gateway in one public subnet provides outbound internet access for private subnets with lower cost and management overhead than multiple NAT Gateways or NAT instances. NAT Gateway is a managed AWS service that automatically handles failover within its Availability Zone, and routing private subnet traffic to it via a 0.0.0.0/0 route allows instances to reach the internet for software updates while remaining unreachable from the internet.

Answer

Deploy a NAT Gateway in each Availability Zone for high availability.

Answer

Launch a NAT instance in a public subnet and configure routing.

Answer

Attach an Internet Gateway to the VPC and add a default route pointing to the IGW in private subnets.

Question 13

A company has a large VPC with multiple workloads. They need to isolate development and production environments within the same VPC, but allow limited communication between them via specific ports. Which approach meets these requirements?

Accepted Answer

Create separate subnets for dev and prod, use network ACLs to allow only specific ports between them.. Placing development and production workloads in separate subnets allows you to apply stateless network ACLs at the subnet boundary. Network ACLs can explicitly allow only specific ports (e.g., TCP 443) between the subnets while blocking all other traffic, providing a clear isolation boundary within the same VPC. Security groups alone cannot enforce inter-subnet filtering because they are stateful and applied at the instance level, not at the subnet edge.

Answer

Place dev and prod in the same subnet and use security groups to filter traffic.

Answer

Use a single subnet and rely on network ACLs to separate traffic.

Answer

Create two VPCs and use VPC peering to allow communication.

Question 14

A company wants to improve disaster recovery by replicating data between two AWS Regions. Which AWS service provides a managed solution for cross-Region network connectivity?

Accepted Answer

VPC Peering. VPC Peering supports cross-Region connections, enabling direct network connectivity between VPCs in different AWS Regions. This allows data replication without traversing the public internet, providing low-latency, private connectivity. AWS Global Accelerator is for traffic optimization and failover, not for direct connectivity for data replication.

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Answer

AWS Global Accelerator

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to add a second CIDR block of 10.1.0.0/16 for additional subnets. After adding the CIDR, the existing subnets cannot communicate with the new subnets. What is the most likely cause?

Accepted Answer

Route tables for the existing subnets do not have routes to the new CIDR.. When adding a secondary CIDR to a VPC, route tables for existing subnets must be updated to include routes to the new CIDR block; otherwise, traffic destined for the new subnets will not be routed correctly. Option A is wrong because security groups are stateful and automatically allow return traffic; they are not the cause of connectivity loss when adding a new CIDR. Option B is wrong because you can add a secondary CIDR to an existing VPC without creating a new VPC. Option D is wrong because Network ACLs are stateless but are not the primary issue; the problem is the missing routes in the route tables.

Answer

Security groups are blocking traffic between the old and new subnets.

Answer

The VPC CIDR cannot be extended; a new VPC must be created.

Answer

Network ACLs are blocking traffic by default.