ANS-C01 Network Design Practice Test 28 — 15 Questions

Question 1

A company is designing a network for a critical application that requires high availability across multiple Availability Zones. Which TWO design choices ensure that the application remains available if an entire AZ fails?

Accepted Answer

Deploy resources in at least two Availability Zones.. Options B and D are correct. Deploying resources across at least two AZs (B) ensures that if one AZ fails, the other continues to operate. Using an Application Load Balancer (D) distributes traffic across healthy targets in multiple AZs, automatically rerouting traffic away from failed AZs. Option A is wrong because a single AZ is a single point of failure. Option C is wrong because a Network Load Balancer can also provide high availability, but the question asks for TWO choices; B and D are the most common design. Option E is wrong because a single EC2 instance cannot provide high availability.

Answer

Deploy resources in a single Availability Zone.

Answer

Use a Network Load Balancer in a single AZ.

Answer

Use a single EC2 instance with an Elastic IP address.

Question 2

A company has a VPC with a public subnet and a private subnet. The private subnet needs to access an S3 bucket for backups. Which TWO actions are required to provide private connectivity to S3 without using a NAT Gateway?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Options B and D are correct. A VPC Gateway Endpoint (B) provides private access to S3. The route table for the private subnet must have a route to the gateway endpoint (D) to direct S3 traffic through it. Option A is wrong because a NAT Gateway is not used. Option C is wrong because a VPC Interface Endpoint is for other services, not S3. Option E is wrong because a VPC Peering connection is not needed.

Answer

Create a NAT Gateway in the public subnet.

Answer

Create a VPC Interface Endpoint for S3.

Answer

Create a VPC Peering connection to an S3 VPC.

Question 3

A company is designing a hybrid network using AWS Direct Connect. They need to ensure high availability and failover. Which THREE components should be deployed to meet these requirements?

Accepted Answer

Two Customer Gateways (CGWs).. Options A, C, and D are correct. Two Direct Connect connections (A) provide redundancy. Two Customer Gateways (C) ensure redundant on-premises termination. Two Virtual Private Gateways (D) provide redundant AWS-side termination. Option B is wrong because a single connection is a single point of failure. Option E is wrong because a VPN connection is not required if Direct Connect is used.

Answer

A single AWS Direct Connect connection.

Answer

An AWS Site-to-Site VPN connection as backup.

Question 4

A company is designing a multi-Region architecture with active-active failover for a web application. The application uses Application Load Balancers (ALBs) in two AWS Regions. Traffic must be routed to the closest healthy Region with automatic failover. Which AWS service should be used to route traffic?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Option C is correct because Amazon Route 53 latency-based routing routes traffic to the Region with the lowest latency, and health checks enable automatic failover. Option A is wrong because Global Accelerator uses anycast IPs and does not provide latency-based routing with health checks in the same way. Option B is wrong because CloudFront is a CDN, not for active-active load balancing across Regions. Option D is wrong because Network Load Balancer operates within a single Region.

Answer

Network Load Balancer with cross-zone load balancing

Answer

Amazon CloudFront with multiple origins

Answer

AWS Global Accelerator

Question 5

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to connect their on-premises data center to AWS using AWS Direct Connect. The data center uses RFC 1918 addresses from the 10.0.0.0/8 range, overlapping with the VPC CIDR. The company cannot change the on-premises IP addresses. Which design allows connectivity without IP conflicts?

Accepted Answer

Deploy a Private NAT Gateway in the VPC and configure routes to send on-premises traffic through it. Option B is correct because Private NAT Gateway can translate overlapping VPC IPs to a different CIDR for communication with on-premises. Option A is wrong because VPC Peering does not support overlapping CIDRs. Option C is wrong because Transit Gateway also cannot handle overlapping CIDRs without NAT. Option D is wrong because Direct Connect Gateway alone does not resolve overlapping IPs.

Answer

Configure Direct Connect Gateway with network address translation

Answer

Use AWS Transit Gateway with route table separation

Answer

Set up VPC Peering between the VPC and on-premises network over Direct Connect

Question 6

A company wants to connect an Amazon RDS for SQL Server database instance in a VPC to an on-premises application. The connection must be encrypted in transit and should traverse the AWS backbone network. Which solution meets these requirements?

Accepted Answer

Establish an AWS Site-to-Site VPN connection over AWS Direct Connect. Option C is correct because an AWS Site-to-Site VPN over Direct Connect provides encrypted connectivity over the AWS backbone. Option A is wrong because RDS does not support VPC endpoints. Option B is wrong because Client VPN is for individual devices, not site-to-site. Option D is wrong because ClassicLink is legacy and does not encrypt traffic.

Answer

Set up an AWS Client VPN endpoint and connect the on-premises application

Answer

Create a VPC endpoint for RDS and connect on-premises to the endpoint

Answer

Configure ClassicLink to connect the on-premises network to the VPC

Question 7

A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that the instance cannot be directly initiated from the internet. Which design should be used?

Accepted Answer

Attach a NAT Gateway to the public subnet and add a route to the NAT Gateway in the private subnet's route table. Option D is correct because a NAT Gateway in a public subnet allows outbound internet access from private subnets while preventing inbound connections from the internet. Option A is wrong because an Internet Gateway alone does not provide outbound-only access; it requires public IPs. Option B is wrong because a NAT Instance also works but is less managed; however, the question asks for a design, and NAT Gateway is the recommended AWS managed service. Option C is wrong because a VPC endpoint for S3 is for accessing S3, not general internet patches.

Answer

Launch a NAT instance in the public subnet and add a route in the private subnet's route table

Answer

Use a VPC endpoint for Amazon S3 and route patch traffic through it

Answer

Add a route to the internet gateway in the private subnet's route table

Question 8

A company is deploying a multi-tier web application across multiple Availability Zones in a single Region. The web tier must be fault-tolerant and distribute traffic across EC2 instances. The application tier uses an Auto Scaling group of EC2 instances that need to be accessed by the web tier using a static IP address. Which combination of AWS services meets these requirements?

Accepted Answer

Application Load Balancer for the web tier and Network Load Balancer for the application tier. Option B is correct because an ALB distributes traffic to web tier instances, and an NLB provides a static IP for the application tier. Option A is wrong because NLB does not support path-based routing needed for web tier. Option C is wrong because Global Accelerator is for multi-Region traffic. Option D is wrong because CLB is legacy and does not support advanced features.

Answer

Classic Load Balancer for the web tier and Application Load Balancer for the application tier

Answer

AWS Global Accelerator for the web tier and Classic Load Balancer for the application tier

Answer

Network Load Balancer for the web tier and Application Load Balancer for the application tier

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16. They want to connect this VPC to a second VPC with CIDR 10.1.0.0/16 using VPC Peering. The VPCs are in the same account and Region. What is the minimum number of route table entries needed in each VPC to enable full bidirectional communication?

Accepted Answer

One route in each VPC's route table. Option A is correct because each VPC needs one route pointing to the peering connection for the other VPC's CIDR. Option B is wrong because each VPC does not need a route for its own CIDR. Option C is wrong because there is only one peering connection. Option D is wrong because explicit routes are required.

Answer

Two routes in each VPC's route table: one for the local CIDR and one for the peer CIDR

Answer

No routes are needed because VPC Peering automatically enables communication

Answer

One route in only one VPC's route table

Question 10

A company needs to provide secure access to an Amazon S3 bucket for a third-party partner. The partner has their own AWS account. The company wants to avoid exposing the bucket to the public internet. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for S3 in your VPC and allow the partner to access the bucket through a VPC peering connection. Option D is correct because an S3 VPC Gateway Endpoint allows access from a VPC, and the partner can connect to that VPC via VPC Peering or Direct Connect. Option A is wrong because bucket policies with Principal set to partner's account allow access from anywhere, not just from a specific VPC. Option B is wrong because Pre-signed URLs expire and are not a permanent solution. Option C is wrong because CloudFront requires public internet access to the origin.

Answer

Set up Amazon CloudFront with an origin access identity (OAI)

Answer

Use pre-signed URLs generated by AWS Lambda

Answer

Configure an S3 bucket policy that grants access to the partner's AWS account

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to communicate with an on-premises server using an IPsec VPN. The company has set up a Virtual Private Gateway (VGW) and a Customer Gateway (CGW) with a Site-to-Site VPN connection. The VPN tunnel is established. However, the EC2 instance cannot ping the on-premises server. The security groups and network ACLs allow all traffic. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route for the on-premises CIDR pointing to the VGW. Option B is correct because the private subnet route table must include a route for the on-premises CIDR pointing to the VGW. Option A is wrong because the VGW is attached and the VPN is established. Option C is wrong because the VPN is up. Option D is wrong because the VPN is established.

Answer

The VGW is not configured with the correct BGP ASN

Answer

The VGW is not attached to the VPC

Answer

The VPN tunnel is not in the UP state

Question 12

A company wants to ensure that traffic between Amazon EC2 instances in the same VPC but different subnets is inspected by a network security appliance. The appliance is deployed in a separate security VPC. Which AWS service should be used to route traffic through the security VPC?

Accepted Answer

AWS Transit Gateway. Option B is correct because Transit Gateway with route tables allows inter-VPC traffic to be forwarded to the security VPC. Option A is wrong because VPC Peering does not support transitive routing. Option C is wrong because an NLB is a load balancer, not a routing device. Option D is wrong because VPC endpoints are for accessing AWS services.

Answer

VPC Peering

Answer

VPC Endpoint

Answer

Network Load Balancer

Question 13

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The company needs to ensure that traffic from the VPC to the on-premises network uses the Direct Connect connection and that traffic does not traverse the internet. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Create a private virtual interface (VIF) on the Direct Connect connection. Options B and D are correct. Option B is correct because a Private VIF is required for private IP communication. Option D is correct because static routes or BGP advertise the on-premises CIDR over the VIF. Option A is wrong because a Public VIF is for internet-routable IPs. Option C is wrong because a Direct Connect Gateway is not required for a single VPC. Option E is wrong because Transit Gateway is not required.

Answer

Attach the VPC to an AWS Transit Gateway

Answer

Create a public virtual interface (VIF) on the Direct Connect connection

Answer

Create a Direct Connect Gateway to connect the VPC to the on-premises network

Question 14

A company has a VPC with multiple subnets across three Availability Zones. They deploy an Amazon RDS for MySQL Multi-AZ DB instance. The application tier consists of EC2 instances in private subnets. To improve read performance, the company wants to add read replicas. Which THREE design considerations are important for network connectivity? (Choose THREE.)

Accepted Answer

Read replicas can be placed in different Availability Zones than the primary DB instance. Options B, C, and D are correct. Option B is correct because EC2 instances must be in the same VPC to connect via private IP. Option C is correct because read replicas can be in different AZs for high availability. Option D is correct because a security group for the RDS must allow inbound MySQL traffic from the application tier. Option A is wrong because read replicas do not require public IPs. Option E is wrong because read replicas can be in the same or different Regions.

Answer

Read replicas must be in public subnets with public IP addresses

Answer

Read replicas must be in the same Region as the primary DB instance

Question 15

A company is designing a network architecture for a critical application that requires high availability and fault tolerance. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones. The instances must be able to communicate with each other across AZs. Which TWO design decisions improve the fault tolerance of the application? (Choose TWO.)

Accepted Answer

Configure the Auto Scaling group to launch instances in multiple Availability Zones. Options B and D are correct. Option B is correct because distributing instances across three AZs ensures that the application survives an AZ failure. Option D is correct because Auto Scaling across AZs automatically replaces failed instances. Option A is wrong because a single NAT Gateway is a single point of failure. Option C is wrong because a single NLB in one AZ is a single point of failure. Option E is wrong because VPC endpoints do not improve fault tolerance for inter-instance communication.

Answer

Use a single NAT Gateway in one Availability Zone for internet access

Answer

Use VPC endpoints for Amazon S3 to reduce internet dependency

Answer

Use a single Network Load Balancer in one Availability Zone