ANS-C01 Network Design Practice Test 28 — 15 Questions

Question 1

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They need to centralize outbound internet traffic through a single VPC. Which architecture should be used?

Accepted Answer

Designate one VPC as an egress VPC with a NAT Gateway and Internet Gateway, and use Transit Gateway route tables to route 0.0.0.0/0 from other VPCs to the egress VPC.. It uses a dedicated egress VPC with a NAT Gateway and Internet Gateway, and leverages Transit Gateway route tables to direct 0.0.0.0/0 traffic from all other VPCs to this central point. This architecture centralizes outbound internet traffic, avoids overlapping NAT responsibilities, and maintains a clean hub-and-spoke design where only the egress VPC has direct internet access.

Answer

Attach a NAT Gateway to each VPC's private subnets.

Answer

Attach an Internet Gateway to each VPC and route 0.0.0.0/0 to the IGW.

Answer

Use a VPN connection to an on-premises data center for internet access.

Question 2

A company wants to ensure that traffic between EC2 instances in the same VPC but different subnets is encrypted. Which solution should be used?

Accepted Answer

Use IPsec VPN between the instances.. An IPsec VPN between EC2 instances creates an encrypted tunnel at Layer 3, ensuring that all traffic between the instances is encrypted regardless of the underlying network path. This is necessary because traffic within a VPC traversing different subnets is not encrypted by default, even though it stays within the AWS network.

Answer

Use security groups to allow traffic.

Answer

Use VPC Peering.

Answer

Use network ACLs to allow traffic.

Question 3

A company is designing a network for a critical application that requires high availability across multiple Availability Zones. Which TWO design choices ensure that the application remains available if an entire AZ fails?

Accepted Answer

Deploy resources in at least two Availability Zones.. Deploying resources in at least two Availability Zones (AZs) is a foundational design pattern for high availability. If an entire AZ fails, the application can continue serving traffic from the remaining AZ(s). This aligns with AWS best practices for fault isolation and is a core requirement for achieving an SLA-backed multi-AZ architecture.

Answer

Deploy resources in a single Availability Zone.

Answer

Use a Network Load Balancer in a single AZ.

Answer

Use a single EC2 instance with an Elastic IP address.

Question 4

A company has a VPC with a public subnet and a private subnet. The private subnet needs to access an S3 bucket for backups. Which TWO actions are required to provide private connectivity to S3 without using a NAT Gateway?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint provides private connectivity to S3 without traversing the internet or requiring a NAT Gateway. It uses AWS’s internal network to route traffic from the private subnet to S3, ensuring data never leaves the AWS backbone. This is the most cost-effective and secure method for private S3 access within a VPC.

Answer

Create a NAT Gateway in the public subnet.

Answer

Create a VPC Interface Endpoint for S3.

Answer

Create a VPC Peering connection to an S3 VPC.

Question 5

A company is designing a hybrid network using AWS Direct Connect. They need to ensure high availability and failover. Which THREE components should be deployed to meet these requirements?

Accepted Answer

Two Customer Gateways (CGWs).. To achieve high availability and failover with AWS Direct Connect, you need at least two Direct Connect connections (option D) to provide physical diversity and eliminate single points of failure. Additionally, you must deploy two Virtual Private Gateways (VGWs) (option C) to attach to separate Direct Connect Virtual Interfaces (VIFs) and enable active/active or active/passive routing. Finally, two Customer Gateways (CGWs) (option B) are required to terminate the BGP sessions from each Direct Connect connection, ensuring that if one CGW or connection fails, the other can take over traffic forwarding.

Answer

A single AWS Direct Connect connection.

Answer

An AWS Site-to-Site VPN connection as backup.

Question 6

A company is designing a multi-Region architecture with active-active failover for a web application. The application uses Application Load Balancers (ALBs) in two AWS Regions. Traffic must be routed to the closest healthy Region with automatic failover. Which AWS service should be used to route traffic?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Amazon Route 53 with latency-based routing and health checks is the correct choice because it directs traffic to the AWS Region with the lowest latency for each user, and health checks automatically fail over to the next best healthy Region if an ALB becomes unhealthy. This satisfies the active-active failover requirement without introducing additional caching or anycast complexities.

Answer

Network Load Balancer with cross-zone load balancing

Answer

Amazon CloudFront with multiple origins

Answer

AWS Global Accelerator

Question 7

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to connect their on-premises data center to AWS using AWS Direct Connect. The data center uses RFC 1918 addresses from the 10.0.0.0/8 range, overlapping with the VPC CIDR. The company cannot change the on-premises IP addresses. Which design allows connectivity without IP conflicts?

Accepted Answer

Deploy a Private NAT Gateway in the VPC and configure routes to send on-premises traffic through it. A Private NAT Gateway in the VPC allows the on-premises network to reach the VPC by translating overlapping IP addresses. Since the on-premises network uses the same 10.0.0.0/8 range as the VPC's 10.0.0.0/16 CIDR, traffic from the data center to the VPC must be source NATed to a non-overlapping IP range. The Private NAT Gateway performs this translation, enabling bidirectional communication without IP conflicts.

Answer

Configure Direct Connect Gateway with network address translation

Answer

Use AWS Transit Gateway with route table separation

Answer

Set up VPC Peering between the VPC and on-premises network over Direct Connect

Question 8

A company wants to connect an Amazon RDS for SQL Server database instance in a VPC to an on-premises application. The connection must be encrypted in transit and should traverse the AWS backbone network. Which solution meets these requirements?

Accepted Answer

Establish an AWS Site-to-Site VPN connection over AWS Direct Connect. An AWS Site-to-Site VPN connection over AWS Direct Connect provides an encrypted IPSec tunnel that traverses the AWS backbone network, ensuring encryption in transit and meeting the requirement to keep traffic off the public internet. Direct Connect provides a private physical connection to AWS, and the Site-to-Site VPN adds encryption over that link, which is ideal for connecting an on-premises application to an RDS for SQL Server instance in a VPC.

Answer

Set up an AWS Client VPN endpoint and connect the on-premises application

Answer

Create a VPC endpoint for RDS and connect on-premises to the endpoint

Answer

Configure ClassicLink to connect the on-premises network to the VPC

Question 9

A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that the instance cannot be directly initiated from the internet. Which design should be used?

Accepted Answer

Attach a NAT Gateway to the public subnet and add a route to the NAT Gateway in the private subnet's route table. A NAT Gateway in a public subnet allows outbound internet traffic from private subnets while preventing unsolicited inbound connections. Adding a route in the private subnet's route table pointing to the NAT Gateway enables the EC2 instance to download patches without being directly reachable from the internet.

Answer

Launch a NAT instance in the public subnet and add a route in the private subnet's route table

Answer

Use a VPC endpoint for Amazon S3 and route patch traffic through it

Answer

Add a route to the internet gateway in the private subnet's route table

Question 10

A company is deploying a multi-tier web application across multiple Availability Zones in a single Region. The web tier must be fault-tolerant and distribute traffic across EC2 instances. The application tier uses an Auto Scaling group of EC2 instances that need to be accessed by the web tier using a static IP address. Which combination of AWS services meets these requirements?

Accepted Answer

Application Load Balancer for the web tier and Network Load Balancer for the application tier. The web tier requires fault tolerance and traffic distribution across EC2 instances, which is best handled by an Application Load Balancer (ALB) operating at Layer 7 with path-based routing and health checks. The application tier needs a static IP address for the web tier to access it, which is a key feature of a Network Load Balancer (NLB) — it preserves the client IP and provides static IP addresses per Availability Zone, unlike ALBs which use dynamic IPs. This combination meets both requirements: ALB for web traffic distribution and NLB for static IP access to the application tier.

Answer

Classic Load Balancer for the web tier and Application Load Balancer for the application tier

Answer

AWS Global Accelerator for the web tier and Classic Load Balancer for the application tier

Answer

Network Load Balancer for the web tier and Application Load Balancer for the application tier

Question 11

A company has a VPC with a CIDR of 10.0.0.0/16. They want to connect this VPC to a second VPC with CIDR 10.1.0.0/16 using VPC Peering. The VPCs are in the same account and Region. What is the minimum number of route table entries needed in each VPC to enable full bidirectional communication?

Accepted Answer

One route in each VPC's route table. VPC peering requires a route in each VPC's route table pointing to the CIDR of the peer VPC, using the peering connection as the target. The local VPC's CIDR is automatically added to the route table by default, so only one additional route per VPC is needed for full bidirectional communication.

Answer

Two routes in each VPC's route table: one for the local CIDR and one for the peer CIDR

Answer

No routes are needed because VPC Peering automatically enables communication

Answer

One route in only one VPC's route table

Question 12

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to communicate with an on-premises server using an IPsec VPN. The company has set up a Virtual Private Gateway (VGW) and a Customer Gateway (CGW) with a Site-to-Site VPN connection. The VPN tunnel is established. However, the EC2 instance cannot ping the on-premises server. The security groups and network ACLs allow all traffic. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route for the on-premises CIDR pointing to the VGW. The most likely cause is that the private subnet's route table lacks a route for the on-premises CIDR pointing to the Virtual Private Gateway (VGW). Even though the VPN tunnel is established, traffic from the EC2 instance in the private subnet will be dropped at the subnet level if there is no explicit route directing the on-premises destination to the VGW. Security groups and network ACLs are permissive, so the issue is routing, not filtering.

Answer

The VGW is not configured with the correct BGP ASN

Answer

The VGW is not attached to the VPC

Answer

The VPN tunnel is not in the UP state

Question 13

A company wants to ensure that traffic between Amazon EC2 instances in the same VPC but different subnets is inspected by a network security appliance. The appliance is deployed in a separate security VPC. Which AWS service should be used to route traffic through the security VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a hub-and-spoke router that can interconnect multiple VPCs, including a security VPC, and centrally route traffic between them. By attaching both the workload VPC and the security VPC to a Transit Gateway, you can configure route tables to force all inter-subnet traffic (or inter-VPC traffic) through the network security appliance in the security VPC. This enables inspection without requiring a full mesh of VPC peering connections or complex routing.

Answer

VPC Peering

Answer

VPC Endpoint

Answer

Network Load Balancer

Question 14

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The company needs to ensure that traffic from the VPC to the on-premises network uses the Direct Connect connection and that traffic does not traverse the internet. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Create a private virtual interface (VIF) on the Direct Connect connection. A private virtual interface (VIF) is required to connect your VPC to an on-premises network over Direct Connect. It allows traffic to traverse the Direct Connect connection privately, bypassing the internet. Without a private VIF, you cannot route traffic from the VPC to the on-premises network over the Direct Connect link.

Answer

Attach the VPC to an AWS Transit Gateway

Answer

Create a public virtual interface (VIF) on the Direct Connect connection

Answer

Create a Direct Connect Gateway to connect the VPC to the on-premises network

Question 15

A company has a VPC with multiple subnets across three Availability Zones. They deploy an Amazon RDS for MySQL Multi-AZ DB instance. The application tier consists of EC2 instances in private subnets. To improve read performance, the company wants to add read replicas. Which THREE design considerations are important for network connectivity? (Choose THREE.)

Accepted Answer

Read replicas can be placed in different Availability Zones than the primary DB instance. Amazon RDS read replicas can be placed in different Availability Zones than the primary DB instance. This improves read performance by distributing read traffic across multiple AZs and provides fault isolation, as replicas remain in the same Region but can be in a different AZ for better availability.

Answer

Read replicas must be in public subnets with public IP addresses

Answer

Read replicas must be in the same Region as the primary DB instance