ANS-C01 Network Design Practice Test 27 — 15 Questions

Question 1

A company is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates, but must not be directly reachable from the internet. Which two components are required for this design? (Choose two.)

Accepted Answer

NAT Gateway in a public subnet. Options B and E are correct. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet, while the private subnets route 0.0.0.0/0 traffic to the NAT Gateway. Option A is wrong because an Internet Gateway alone does not provide outbound-only access; instances would need public IPs. Option C is wrong because Security Groups are firewalls, not for internet access. Option D is wrong because a VPN connection is for private connectivity, not internet access.

Answer

Security Group allowing outbound HTTPS

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 2

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their internet-facing Application Load Balancer. The VPC is already associated with an IPv6 CIDR block. What additional configuration is required? (Choose two.)

Accepted Answer

Add a route in the subnet's route table for ::/0 to the Internet Gateway.. Options A and C are correct. For an internet-facing ALB to serve IPv6 clients, the subnet must have an IPv6 CIDR and the route table must have a route for ::/0 to the internet gateway. Option B is wrong because the ALB itself does not require an IPv6 address; it uses the subnet's IPv6 CIDR. Option D is wrong because Egress-Only Internet Gateway is for outbound-only IPv6 traffic from private subnets. Option E is wrong because a NAT64/DNS64 is not needed; ALB can handle IPv6 natively.

Answer

Configure NAT64 and DNS64 on the VPC.

Answer

Assign an IPv6 address to the ALB's network interface.

Answer

Create an Egress-Only Internet Gateway for the VPC.

Question 3

A company is designing a multi-account AWS environment using AWS Transit Gateway. They have 10 VPCs in separate accounts that need to communicate with each other and with an on-premises network via Direct Connect. Which three components are required to enable this connectivity? (Choose three.)

Accepted Answer

AWS Resource Access Manager to share the Transit Gateway with other accounts. Options A, C, and E are correct. A Transit Gateway in the network account acts as a hub. Resource Access Manager (RAM) is used to share the Transit Gateway with other accounts. A Direct Connect Gateway allows connecting the Transit Gateway to the on-premises network via Direct Connect. Option B is wrong because VPC Peering is not needed when using Transit Gateway. Option D is wrong because a VPN Connection is not required if Direct Connect is used.

Answer

VPC Peering connections between each pair of VPCs

Answer

AWS Site-to-Site VPN connection from the Transit Gateway to the on-premises network

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to communicate with an RDS database in subnet-B. Both subnets are in the same Availability Zone. What is the most efficient way to enable this communication?

Accepted Answer

No additional configuration is required. The instance and database can communicate within the same VPC.. Option A is correct. By default, VPC subnets can communicate with each other; no additional configuration is needed if the security groups and network ACLs allow traffic. Option B is wrong because VPC Peering is for cross-VPC communication. Option C is wrong because a NAT Gateway is for outbound internet access. Option D is wrong because a Transit Gateway is for connecting multiple VPCs or networks.

Answer

Create a Transit Gateway and attach both subnets to it.

Answer

Place a NAT Gateway in subnet-A and configure route tables accordingly.

Answer

Create a VPC Peering connection between the two subnets.

Question 5

A company is designing a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. The database should not have direct internet access. Which architecture meets these requirements?

Accepted Answer

Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet with a route to a NAT Gateway in the public subnet for outbound access only.. Option B is correct. A NAT Gateway in the public subnet allows the web server (in the same public subnet) to access the internet via its public IP or via the NAT Gateway if it's actually in a private subnet. However, the web server is in a public subnet, so it can have a public IP and access the internet directly. The database in the private subnet can use the NAT Gateway for outbound access if needed, but the question says database should not have direct internet access, so it should not have a public IP. Option A is wrong because an Internet Gateway alone does not provide outbound access for private instances. Option C is wrong because a VPN is not needed. Option D is wrong because a NAT Instance is not recommended; NAT Gateway is managed.

Answer

Place the web server in the public subnet with an Internet Gateway, and the database in the private subnet without any internet access.

Answer

Place both instances in the public subnet and use security groups to restrict inbound access to the database.

Answer

Place the web server in the private subnet with a NAT Gateway, and the database in the public subnet with an Internet Gateway.

Question 6

A company is deploying a critical application that requires low latency between EC2 instances in the same AWS region but across multiple Availability Zones. The instances are part of an Auto Scaling group behind a Network Load Balancer. Which network design provides the lowest latency while maintaining high availability?

Accepted Answer

Do not use a placement group; enable Enhanced Networking (ENA) on all instances.. Option C is correct. A placement group with a partition strategy spreads instances across logical partitions but within a single AZ, which does not provide multi-AZ HA. For low latency across AZs, a cluster placement group is not possible because it is limited to a single AZ. Therefore, the best practice is to place instances in the same VPC and subnet in the same AZ for lowest latency, but that sacrifices AZ-level HA. Actually, the question asks for low latency across multiple AZs, so the best option is to use a cluster placement group in a single AZ (which is not across AZs). The correct answer is to use a cluster placement group in a single AZ, but the option that mentions that is D? Let me review: Option D says 'Cluster placement group across two AZs' which is not possible. Option C says 'Partition placement group across two AZs' which provides low latency? Actually, partition placement groups are not designed for low latency; they are for large distributed workloads. The correct answer is that cluster placement groups are limited to one AZ, so for low latency across AZs, you cannot use placement groups. The question might be tricky. The best answer is B: 'Use a spread placement group across two AZs' but spread placement groups increase latency. I think the intended answer is D: 'Cluster placement group across two AZs' is not possible, so that's wrong. Option A: 'No placement group, use Enhanced Networking' is the correct approach because placement groups cannot be used across AZs for low latency. Actually, Enhanced Networking (ENA) provides low latency regardless. So correct answer is A.

Answer

Use a cluster placement group across two Availability Zones.

Answer

Use a spread placement group across two Availability Zones.

Answer

Use a partition placement group across two Availability Zones.

Question 7

A company is deploying a multi-tier web application across three Availability Zones in a single AWS Region. The web tier must be fault-tolerant and scale horizontally. Which network design provides the highest availability and scalability?

Accepted Answer

Use an Application Load Balancer in front of an Auto Scaling group spanning three Availability Zones.. Option B is correct because an Application Load Balancer distributes traffic across multiple AZs and instances, providing high availability and scalability. Option A is wrong because a single instance in one AZ is not fault-tolerant. Option C is wrong because Network Load Balancer operates at layer 4 and does not support path-based routing for web applications. Option D is wrong because using only one AZ reduces fault tolerance.

Answer

Deploy a single EC2 instance in one Availability Zone with an Elastic IP address.

Answer

Deploy EC2 instances in a single Availability Zone and use Route 53 weighted routing.

Answer

Use a Network Load Balancer with a single EC2 instance in each AZ.

Question 8

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network via AWS Direct Connect. The on-premises network uses 10.0.0.0/16. Which solution allows connectivity without IP overlap?

Accepted Answer

Create a new VPC with a non-overlapping CIDR, connect both VPCs via Transit Gateway, and use NAT on the Transit Gateway attachment to the on-premises network.. Option D is correct because creating a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) and using Transit Gateway with network address translation (NAT) on the attachment resolves overlap. Option A is wrong because overlapping CIDRs cannot be directly peered or connected via VPN. Option B is wrong because Direct Connect does not change IP addresses. Option C is wrong because a single NAT instance cannot handle all traffic for overlapping CIDRs.

Answer

Establish a VPC peering connection between the VPC and on-premises network.

Answer

Use AWS Direct Connect with a private VIF and static routes to route traffic.

Answer

Deploy a NAT instance in the VPC to translate on-premises IPs.

Question 9

A company wants to allow its VPC to access an S3 bucket securely without traversing the internet. Which AWS resource enables private connectivity between a VPC and S3?

Accepted Answer

VPC Gateway Endpoint. Option C is correct because a VPC Gateway Endpoint provides private access to S3 without using the internet. Option A is wrong because NAT Gateway is for outbound internet access, not for S3 access. Option B is wrong because Internet Gateway allows internet traffic, not private access. Option D is wrong because a VPN connection is for on-premises connectivity, not for S3 access.

Answer

Internet Gateway

Answer

AWS Site-to-Site VPN

Answer

NAT Gateway

Question 10

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to minimize cost and management overhead. Which solution should be used?

Accepted Answer

Deploy a single NAT Gateway in one public subnet and configure route tables to route 0.0.0.0/0 traffic to it.. Option A is correct because a single NAT Gateway in one AZ provides internet access for all private subnets with low cost. Option B is wrong because using a NAT Gateway per AZ increases cost unnecessarily. Option C is wrong because an Internet Gateway alone does not provide private subnet access; it requires a NAT device. Option D is wrong because a NAT instance requires management and is less reliable.

Answer

Deploy a NAT Gateway in each Availability Zone for high availability.

Answer

Launch a NAT instance in a public subnet and configure routing.

Answer

Attach an Internet Gateway to the VPC and add a default route pointing to the IGW in private subnets.

Question 11

A company has a large VPC with multiple workloads. They need to isolate development and production environments within the same VPC, but allow limited communication between them via specific ports. Which approach meets these requirements?

Accepted Answer

Create separate subnets for dev and prod, use network ACLs to allow only specific ports between them.. Option B is correct because network ACLs are stateless and can be used to allow specific traffic between subnets while keeping subnets in separate networks. Option A is wrong because separate VPCs require peering or other connections, adding complexity. Option C is wrong because security groups are stateful and cannot be used to block return traffic easily. Option D is wrong because NACLs on the same subnet cannot isolate environments within the same subnet.

Answer

Place dev and prod in the same subnet and use security groups to filter traffic.

Answer

Use a single subnet and rely on network ACLs to separate traffic.

Answer

Create two VPCs and use VPC peering to allow communication.

Question 12

A company wants to improve disaster recovery by replicating data between two AWS Regions. Which AWS service provides a managed solution for cross-Region network connectivity?

Accepted Answer

AWS Global Accelerator. Option D is correct because AWS Global Accelerator uses the AWS global network to route traffic to optimal endpoints, improving performance and availability for cross-Region replication. Option A is wrong because VPC Peering does not support cross-Region. Option B is wrong because Direct Connect is for on-premises connections. Option C is wrong because AWS VPN is not managed for cross-Region replication.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to add a second CIDR block of 10.1.0.0/16 for additional subnets. After adding the CIDR, the existing subnets cannot communicate with the new subnets. What is the most likely cause?

Accepted Answer

Route tables for the existing subnets do not have routes to the new CIDR.. Option C is correct because route tables must be updated to include routes for the new CIDR block. Option A is wrong because adding a CIDR does not require a new VPC. Option B is wrong because security groups are not the cause of connectivity issues between subnets. Option D is wrong because NACLs are not the issue unless they are blocking traffic.

Answer

Security groups are blocking traffic between the old and new subnets.

Answer

The VPC CIDR cannot be extended; a new VPC must be created.

Answer

Network ACLs are blocking traffic by default.

Question 14

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They need to centralize outbound internet traffic through a single VPC. Which architecture should be used?

Accepted Answer

Designate one VPC as an egress VPC with a NAT Gateway and Internet Gateway, and use Transit Gateway route tables to route 0.0.0.0/0 from other VPCs to the egress VPC.. Option D is correct because an egress VPC with a NAT Gateway and Internet Gateway can centralize outbound traffic via Transit Gateway route tables. Option A is wrong because each VPC with its own NAT Gateway does not centralize. Option B is wrong because a VPN does not provide internet access. Option C is wrong because an Internet Gateway in each VPC does not centralize.

Answer

Attach a NAT Gateway to each VPC's private subnets.

Answer

Attach an Internet Gateway to each VPC and route 0.0.0.0/0 to the IGW.

Answer

Use a VPN connection to an on-premises data center for internet access.

Question 15

A company wants to ensure that traffic between EC2 instances in the same VPC but different subnets is encrypted. Which solution should be used?

Accepted Answer

Use IPsec VPN between the instances.. Option C is correct because IPsec VPN between instances provides encryption. Option A is wrong because security groups do not encrypt traffic. Option B is wrong because NACLs do not encrypt. Option D is wrong because VPC Peering does not encrypt traffic.

Answer

Use security groups to allow traffic.

Answer

Use VPC Peering.

Answer

Use network ACLs to allow traffic.