ANS-C01 Network Design Practice Test 28 — 15 Questions

Question 1

A company is designing a hybrid network architecture that connects multiple VPCs in different AWS regions to an on-premises data center. The company wants to minimize the number of VPN tunnels and reduce management overhead. Which AWS service should be used to simplify this design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway with VPN attachments. AWS Transit Gateway with VPN attachments is correct because it acts as a central hub that connects multiple VPCs across different AWS regions and an on-premises data center through a single VPN connection. This minimizes the number of VPN tunnels by eliminating the need for individual VPN connections between each VPC and the on-premises network, and reduces management overhead through a single point of configuration and routing.

Answer

AWS Direct Connect with multiple virtual interfaces

Answer

AWS VPN CloudHub

Answer

VPC peering between each VPC and the on-premises network

Question 2

A company is designing a network architecture for a multi-tier web application. The application includes a public-facing Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an Amazon RDS database in a private subnet. The company requires that the database is not directly accessible from the application servers except through specific ports, and that traffic between the web servers and the database is encrypted. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable SSL/TLS encryption for connections between the web servers and the RDS database. Option C is correct because enabling SSL/TLS encryption on the RDS connection ensures that data in transit between the web servers and the database is encrypted, satisfying the requirement that traffic between them is encrypted; this is done by requiring SSL/TLS in the RDS parameter group and connecting with the RDS CA certificate. Option D is correct because configuring the RDS security group to allow inbound traffic only from the web servers' security group on the database port (for example, 3306 for MySQL or 5432 for PostgreSQL) enforces least-privilege access and ensures the database is reachable only through the specific database port by the application tier. Option A is incorrect because placing the RDS database in a public subnet exposes it to the internet and contradicts the requirement that it not be directly accessible except through specific ports from the application servers. Option B is incorrect because a VPC peering connection is unnecessary when the web servers and RDS are already in the same VPC, and it does not by itself restrict access to specific ports or encrypt traffic. Option E is incorrect because a network ACL is stateless and subnet-level, and restricting inbound traffic by the web servers' IP range is less precise and less secure than referencing the web servers' security group; it also does not provide encryption.

Answer

Place the RDS database in a public subnet with a security group that allows only the web servers' IP addresses

Answer

Establish a VPC peering connection between the web servers' VPC and the RDS VPC

Answer

Use a network ACL to restrict inbound traffic to the RDS subnet to only the web server's IP range

Question 3

A company wants to connect its on-premises data center to AWS using AWS Direct Connect and wants to use the same connection to access multiple VPCs in the same AWS region. The company also needs to maintain private IP connectivity between the VPCs. Which THREE components should the company use to meet these requirements? (Choose three.)

Accepted Answer

Transit Gateway VPC attachments. The company needs to reach multiple VPCs in the same region over a single Direct Connect connection, which is exactly what an AWS Direct Connect gateway (D) provides: it is a globally available resource that aggregates virtual interfaces and allows one private VIF to reach many VPCs across regions via virtual private gateways or transit gateways. To attach those VPCs to the Direct Connect gateway in a scalable hub-and-spoke design, an AWS Transit Gateway (E) is required, since it acts as a regional hub that the Direct Connect gateway associates with. Each VPC must then be connected to that Transit Gateway using Transit Gateway VPC attachments (A), which bind the VPC to the TGW and enable the private IP routing between VPCs and toward on-premises. VPC peering (B) is not appropriate because it is a one-to-one, non-transitive connection that does not integrate with a Direct Connect gateway for multi-VPC on-premises access. A Site-to-Site VPN (C) is unnecessary and would be a separate IPsec overlay rather than the requested Direct Connect private connectivity.

Answer

VPC peering connections between each VPC

Answer

AWS Site-to-Site VPN connection

Question 4

A company is designing a multi-region architecture for disaster recovery. They need to use Route 53 to route traffic to the nearest healthy endpoint. Which routing policy should they use?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks is the correct choice because it directs traffic to the endpoint with the lowest latency for the user, while health checks ensure that traffic is only sent to healthy endpoints. This combination meets the requirement to route to the nearest healthy endpoint in a multi-region disaster recovery setup, as it dynamically adapts to both network conditions and endpoint availability.

Answer

Failover routing

Answer

Geolocation routing

Answer

Latency-based routing without health checks

Question 5

A company has a VPC with public and private subnets in three Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and a fleet of EC2 instances in the private subnets. The ALB needs to send traffic to the instances on port 443. What is the most secure way to configure the security groups?

Accepted Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on port 443.. It follows the principle of least privilege by restricting the ALB security group to only allow inbound traffic on port 443 from the internet (0.0.0.0/0) and the instance security group to only allow inbound traffic on port 443 from the ALB security group. This ensures that only the ALB can communicate with the instances on the required port, preventing direct access from other sources and reducing the attack surface.

Answer

ALB SG: inbound from 0.0.0.0/0 on all ports. Instance SG: inbound from ALB SG on all ports.

Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from 0.0.0.0/0 on port 443.

Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on all ports.

Question 6

A company wants to connect an on-premises data center to AWS using a dedicated private connection that does not traverse the internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This service uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a virtual private gateway or AWS Transit Gateway, ensuring low latency, consistent bandwidth, and compliance with data sovereignty requirements.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a network virtual appliance. Which architecture should they use?

Accepted Answer

Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.. It uses an inspection VPC as a central point for traffic inspection. By attaching the network virtual appliance to a dedicated inspection VPC and configuring Transit Gateway route tables to route inter-VPC traffic to that attachment, all traffic between VPCs is forced through the appliance for inspection. This leverages Transit Gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without complex peering or per-VPC appliance deployments.

Answer

Use a Network Load Balancer in each VPC to forward traffic to the appliance.

Answer

Attach the appliance directly to each VPC using VPC Peering.

Answer

Place the appliance in each VPC and configure VPC Peering.

Question 8

A company has a VPC with a CIDR of 172.16.0.0/16. They have a subnet 172.16.1.0/24 for web servers and another subnet 172.16.2.0/24 for database servers. The web servers need to access the database servers on port 3306. Which configuration is required?

Accepted Answer

Web SG: outbound to DB SG on port 3306. DB SG: inbound from web SG on port 3306.. Security groups are stateful and control traffic at the instance level. The web server security group needs an outbound rule allowing traffic to the database security group on port 3306, and the database security group needs an inbound rule allowing traffic from the web security group on port 3306. This ensures that only the web servers can initiate connections to the database servers on the required port.

Answer

Configure network ACLs to allow inbound on port 3306 from web subnet.

Answer

Web SG: inbound from 0.0.0.0/0 on port 3306. DB SG: outbound to web SG on port 3306.

Answer

Web SG: outbound to DB SG on all ports. DB SG: inbound from web SG on all ports.

Question 9

A company has a VPC with a public subnet and a private subnet. They have a NAT Gateway in the public subnet. Instances in the private subnet need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, instances cannot reach the internet. What is a possible cause?

Accepted Answer

The route table for the NAT Gateway's subnet does not have a route to an Internet Gateway.. For a NAT Gateway to route traffic to the internet, its subnet must have a route to an Internet Gateway (IGW). The NAT Gateway resides in the public subnet, and the public subnet's route table must include a default route (0.0.0.0/0) pointing to the IGW. Without this route, the NAT Gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT Gateway.

Answer

The NAT Gateway is in a private subnet.

Answer

The network ACL on the private subnet is blocking outbound traffic.

Answer

The NAT Gateway does not have a security group allowing outbound traffic.

Question 10

A company is setting up a Site-to-Site VPN connection between their on-premises network and AWS. Which THREE components are required for a VPN connection?

Accepted Answer

VPN Tunnel. A Site-to-Site VPN connection in AWS fundamentally requires three components: a Virtual Private Gateway (VGW) attached to the VPC on the AWS side, a Customer Gateway (CGW) representing the on-premises VPN device, and at least one VPN Tunnel that carries the encrypted traffic between them. Option D (Virtual Private Gateway) is correct because it is the AWS-side VPN concentrator that terminates the IPSec tunnels and must be attached to the target VPC. Option E (Customer Gateway) is correct because it is the AWS resource that holds the public IP address and BGP ASN of the on-premises router, which is necessary to establish the tunnels. Option A (VPN Tunnel) is correct because each Site-to-Site VPN connection consists of two IPSec tunnels for redundancy, and the tunnel is the actual encrypted path over which traffic flows. Option B (Transit Gateway) is not required because a VGW can be used directly for a single VPC VPN, and Transit Gateway is only needed when connecting multiple VPCs or using a hub-and-spoke topology. Option C (Internet Gateway) is not required because an Internet Gateway provides internet access for public subnets, not for VPN termination, and the VPN traffic is handled by the Virtual Private Gateway.

Answer

Transit Gateway

Answer

Internet Gateway

Question 11

A network engineer needs to create a set of IAM permissions for a DevOps team to monitor network resources. The policy above is proposed. What critical missing permission is required to allow the team to list and describe VPCs?

Accepted Answer

ec2:DescribeVpcs. The correct permission to list and describe VPCs is `ec2:DescribeVpcs`. This API call returns information about one or more VPCs, including their CIDR blocks, state, and tags. Without this specific permission, the DevOps team cannot retrieve VPC details, even if they have other EC2 describe permissions.

Answer

ec2:DescribeVpcPeeringConnections

Answer

ec2:DescribeSubnets

Answer

ec2:CreateVpc

Question 12

A company is deploying a multi-region Active-Active application using Amazon Route 53 latency-based routing. The application runs on EC2 instances behind Network Load Balancers (NLBs) in two AWS regions. The health checks are configured for the NLBs. What should the company do to ensure that traffic is sent only to healthy endpoints?

Accepted Answer

Use Route 53 latency-based routing and associate health checks.. Route 53 latency-based routing directs traffic to the region with the lowest latency for the user. By associating health checks with the latency records, Route 53 automatically excludes any endpoint that fails its health check (e.g., an unhealthy NLB) from DNS responses, ensuring traffic is sent only to healthy endpoints. This meets the requirement for an Active-Active multi-region setup where both regions serve traffic simultaneously.

Answer

Use Route 53 geolocation routing and associate health checks.

Answer

Use Route 53 weighted routing and associate health checks.

Answer

Use Route 53 failover routing with primary and secondary records.

Question 13

A company has a VPC with public and private subnets. The public subnet has a NAT gateway for outbound internet access from private subnets. The private subnets have EC2 instances that need to access an S3 bucket in the same region. The company wants to minimize data transfer costs and avoid traversing the internet. What is the MOST cost-effective solution?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach a policy allowing access from the private subnets.. A VPC Gateway Endpoint for S3 allows private subnet instances to access S3 over the AWS network without traversing the internet or a NAT gateway, eliminating data transfer costs for the NAT gateway and avoiding internet egress charges. This is the most cost-effective solution because gateway endpoints are free and use prefix lists in the route table to direct traffic to S3 via the AWS backbone.

Answer

Configure an S3 bucket policy that restricts access to the VPC's public IP addresses.

Answer

Route traffic to the NAT gateway and then to the S3 bucket using a VPC peering connection.

Answer

Create a VPC Interface Endpoint for S3 and associate with the private subnets.

Question 14

A company has a VPC with a public subnet and a private subnet. The private subnet contains Amazon RDS instances that should only be accessed by EC2 instances in the same VPC. The EC2 instances are in a security group named 'App-SG'. Which configuration will meet the requirement?

Accepted Answer

Configure a security group on the RDS instances to allow inbound traffic from the 'App-SG' security group.. Security groups are stateful and can reference other security groups as a source, allowing traffic from all instances associated with the source security group. By configuring the RDS security group to allow inbound traffic from 'App-SG', only EC2 instances in that group can access the RDS instances, meeting the requirement without exposing the database to the entire VPC CIDR.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the VPC CIDR.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

Answer

Configure a security group on the RDS instances to allow inbound traffic from the VPC CIDR.

Question 15

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to add an additional non-overlapping CIDR for new workloads. Which CIDR should be used?

Accepted Answer

10.1.0.0/16. (10.1.0.0/16) is correct because it provides a non-overlapping CIDR block that does not conflict with the existing VPC CIDR of 10.0.0.0/16. In AWS, when adding a secondary CIDR to a VPC, the new block must not overlap with the existing VPC CIDR or any of its subnets. The 10.1.0.0/16 range is entirely separate from 10.0.0.0/16, satisfying this requirement.

Answer

10.0.0.0/24

Answer

10.0.1.0/24

Answer

10.0.0.0/8