ANS-C01 Network Design Practice Test 29 — 15 Questions

Question 1

A company is designing a network architecture for a critical application that requires high availability and fault tolerance. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones. The instances must be able to communicate with each other across AZs. Which TWO design decisions improve the fault tolerance of the application? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Auto Scaling group to launch instances in multiple Availability Zones. Launching instances in multiple Availability Zones (AZs) ensures that if one AZ fails, the Auto Scaling group can still maintain capacity from the remaining AZs, providing fault tolerance. This design leverages the isolation boundaries of AZs within a region, which are physically separate data centers with independent power and networking.

Answer

Use a single NAT Gateway in one Availability Zone for internet access

Answer

Use VPC endpoints for Amazon S3 to reduce internet dependency

Answer

Use a single Network Load Balancer in one Availability Zone

Question 2

A company wants to connect two VPCs in the same AWS region using a hub-and-spoke model. Which AWS service should be used to route traffic between the VPCs through a central inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway is the correct choice because it acts as a central hub that connects multiple VPCs and on-premises networks in a hub-and-spoke topology. It allows you to route traffic between VPCs through a central inspection VPC for security or compliance purposes, using route tables to control traffic flow without requiring individual peering connections.

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub

Answer

VPC Peering

Question 3

A company is designing a multi-region architecture with an active-active setup. They need to route traffic to the nearest healthy endpoint. Which AWS service should they use?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS Region that provides the lowest latency for the end user, based on measurements between the user's DNS resolver and AWS endpoints. It also supports health checks, automatically excluding unhealthy endpoints from the routing pool, which enables an active-active multi-region architecture by routing each request to the nearest healthy endpoint. AWS Global Accelerator also routes to the nearest healthy endpoint but uses anycast IPs at the network layer, making it more suitable for optimizing TCP/UDP traffic rather than general DNS-level routing.

Answer

Application Load Balancer (ALB)

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Question 4

A company uses AWS Direct Connect with a private VIF to access a VPC. They also have a site-to-site VPN as backup. They notice that during Direct Connect maintenance, the VPN does not take over traffic as expected. All routes are advertised over BGP. What is the most likely reason?

Accepted Answer

The VPN BGP advertisements have a longer AS PATH than the Direct Connect advertisements, making them less preferred.. BGP path selection prefers routes with the shortest AS_PATH. During normal operation, the Direct Connect private VIF advertises routes with a shorter AS_PATH than the VPN backup. When the Direct Connect physical link goes down, the BGP session over the private VIF also goes down, and the VPN routes should take over. However, if the VPN BGP advertisements have a longer AS_PATH, they remain less preferred in the BGP routing table, and the router may still try to use the now-unreachable Direct Connect routes until they are withdrawn, causing traffic to drop instead of failing over to the VPN.

Answer

The Direct Connect virtual interface is still in the 'available' state even though the physical link is down.

Answer

The VPN tunnel is using a different BGP ASN than the Direct Connect.

Answer

The VPN is configured with a higher local preference than Direct Connect.

Question 5

A company needs to ensure that all traffic between their VPC and on-premises network is encrypted. Which solution meets this requirement?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted IPsec tunnel between the VPC and on-premises network, ensuring all traffic is encrypted over the public internet. This meets the requirement for mandatory encryption, unlike unencrypted options such as Direct Connect or VPC Peering.

Answer

AWS Direct Connect with a private VIF

Answer

VPC Peering connection

Answer

AWS Internet Gateway

Question 6

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet and need it to access the internet. Which combination of components is required?

Accepted Answer

A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway. A NAT Gateway in a public subnet provides outbound-only internet access for instances in private subnets. A default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway ensures traffic destined for the internet is forwarded to the NAT Gateway, which then translates the source IP to its own Elastic IP and sends the traffic through the Internet Gateway (IGW) attached to the public subnet. This combination allows the EC2 instance to initiate outbound connections (e.g., for software updates) while remaining unreachable from the internet.

Answer

A NAT instance in the private subnet with a route to an Internet Gateway

Answer

A VPC Gateway Endpoint for S3 in the private subnet

Answer

An Internet Gateway (IGW) attached to the VPC and a default route (0.0.0.0/0) in the private subnet's route table pointing to the IGW

Question 7

A company has multiple VPCs connected via AWS Transit Gateway. They need to inspect all inter-VPC traffic using a centralized firewall appliance. What is the most efficient way to achieve this?

Accepted Answer

Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance. Attaching the firewall appliance to the Transit Gateway and configuring Transit Gateway route tables to send traffic to the appliance is the most efficient method because it allows the Transit Gateway to act as a central hub, directing all inter-VPC traffic through the firewall for inspection without requiring complex peering or per-VPC routing changes. This leverages the Transit Gateway's route table capabilities to create a single inspection point, minimizing latency and administrative overhead.

Answer

Enable VPC Flow Logs and analyze traffic patterns

Answer

Create VPC Gateway Endpoints for each VPC and route traffic through them

Answer

Use a Network Load Balancer to distribute traffic to the firewall appliance

Question 8

A company wants to use AWS Direct Connect to connect their on-premises network to a VPC. They have two Direct Connect locations and want high availability. What is the minimum number of Direct Connect virtual interfaces needed?

Accepted Answer

Two private VIFs. For high availability across two Direct Connect locations, you need at least two private virtual interfaces (VIFs), one at each location, each connecting to the same VPC. This ensures that if one Direct Connect connection or location fails, traffic can still flow through the other private VIF. A single private VIF provides no redundancy, and public VIFs are used for accessing public AWS services, not VPC connectivity.

Answer

One public VIF and one private VIF

Answer

Four private VIFs

Answer

One private VIF

Question 9

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, and the application tier must only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web servers in public subnets with an Internet Gateway, and application servers in private subnets with security groups allowing traffic only from the web tier. It places the web servers in public subnets with an Internet Gateway (IGW) to allow direct inbound traffic from the internet, while the application servers reside in private subnets with security groups that explicitly permit traffic only from the web tier's security group. This ensures the application tier is not directly reachable from the internet, adhering to the principle of least privilege and defense in depth.

Answer

Web servers in private subnets with a NAT Gateway for outbound traffic, and application servers in public subnets

Answer

All servers in a single VPC with VPC Peering to another VPC

Answer

Web servers and application servers in public subnets, each with their own security group

Question 10

A company has a VPC with a CIDR of 10.0.0.0/16. They need to peer with another VPC that has a CIDR of 10.0.0.0/24. What will happen?

Accepted Answer

The peering connection will fail because the CIDRs overlap.. AWS VPC peering requires that the CIDR blocks of the two VPCs do not overlap. When both VPCs use the same IP range (10.0.0.0/16 and 10.0.0.0/24), the peering connection request will fail because overlapping CIDRs create routing ambiguity and are not supported by the VPC peering service. This is a hard limit enforced at the time of peering creation, not during route table configuration.

Answer

The peering connection will be established, but only the first VPC's CIDR will be used.

Answer

The peering connection will be established, but routes with overlapping CIDRs will not be added automatically.

Answer

The peering connection will be established, and the overlapping CIDRs will be ignored.

Question 11

A company is designing a hybrid network using AWS Direct Connect. They want to ensure high availability and minimize downtime. Which TWO actions should they take?

Accepted Answer

Set up a site-to-site VPN as a backup for the Direct Connect connection. A site-to-site VPN provides a cost-effective, encrypted backup path over the internet if the Direct Connect connection fails. This ensures high availability by maintaining connectivity through an alternate path, which is a best practice for hybrid network designs.

Answer

Use a single customer router for both connections

Answer

Provision a single Direct Connect connection with two virtual interfaces

Answer

Use the same BGP ASN on both Direct Connect connections

Question 12

A company wants to use AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to centrally manage and enforce security policies. Which THREE components are required?

Accepted Answer

Transit Gateway route tables. Transit Gateway route tables (A) are required to control the routing of traffic between attached VPCs, VPNs, and Direct Connect connections. They allow you to isolate or share networks by defining which attachments can communicate with each other, enabling centralized policy enforcement.

Answer

VPC Gateway Endpoints

Answer

AWS Direct Connect Gateway

Question 13

A company is deploying a web application in a VPC. They need to ensure that the web servers can be accessed from the internet and that traffic is encrypted. Which TWO services should they use?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) is correct because it can terminate TLS connections, offloading encryption from the web servers, and it distributes incoming internet traffic across multiple targets in a VPC. Combined with AWS Certificate Manager (ACM), the ALB can use a managed SSL/TLS certificate to encrypt traffic between clients and the load balancer, meeting the requirement for encrypted internet access.

Answer

AWS WAF

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 14

Based on the following VPC Flow Logs entry, which of the following statements is correct?
- source IP: 10.0.2.10
- source port: 443
- destination IP: 10.0.1.20
- destination port: 80
- protocol: TCP

Accepted Answer

The traffic originated from a web server (port 443) and was sent to a client (port 80). Based on the VPC Flow Logs entry (which shows source IP 10.0.2.10, source port 443, destination IP 10.0.1.20, destination port 80, protocol TCP), the traffic originated from a web server (listening on port 443) and was sent to a client (listening on port 80). The direction is from the source (10.0.2.10) to the destination (10.0.1.20). Therefore, option D is correct.

Answer

The destination port is 443

Answer

The protocol used is UDP

Answer

The source IP address is 10.0.2.10

Question 15

Based on the route table, which of the following is true?

Accepted Answer

The subnet has a VPN connection to a network with CIDR 172.31.0.0/16. The route table includes a route for destination 172.31.0.0/16 pointing to a virtual private gateway (vgw-xxxx), which is used for a VPN connection. This indicates that the subnet associated with this route table has a VPN connection to a network with CIDR 172.31.0.0/16, as the route directs traffic for that CIDR to the VPN gateway.

Answer

The route table is the main route table for the VPC

Answer

The subnet is connected to a Transit Gateway

Answer

The subnet is a private subnet with no internet access