ANS-C01 Network Design Practice Test 29 — 15 Questions

Question 1

A company is designing a network for a three-tier web application that must be highly available across multiple Availability Zones. The application uses an Application Load Balancer (ALB) for the web tier, EC2 instances for the application tier, and an Amazon RDS Multi-AZ database for the database tier. Which TWO design choices improve availability and fault tolerance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Amazon RDS Multi-AZ with a standby instance in a different Availability Zone.. Option B is correct because Amazon RDS Multi-AZ maintains a synchronous standby replica in a different Availability Zone and automatically fails over to it if the primary instance or its AZ fails, which directly provides database-tier fault tolerance. Option D is correct because an Application Load Balancer must have nodes in at least two Availability Zones to be highly available; if the ALB is enabled in multiple AZs, it continues routing traffic to healthy targets even if one AZ becomes unavailable. Option A is incorrect because placing all EC2 instances in a single AZ creates a single point of failure for the application tier, which contradicts the multi-AZ high-availability requirement. Option C is incorrect because a single NAT gateway in one AZ is itself a single point of failure for outbound traffic; highly available designs use a NAT gateway per AZ. Option E is incorrect because VPC Gateway Endpoints for S3 are a cost and traffic-routing optimization, not a mechanism that improves availability or fault tolerance across Availability Zones.

Answer

Launch all EC2 instances in a single Availability Zone to reduce network latency.

Answer

Use a single NAT gateway in one Availability Zone for all outbound traffic.

Answer

Use VPC Gateway Endpoints for S3 to avoid NAT gateway costs.

Question 2

A company is planning to connect its on-premises data center to AWS using AWS Direct Connect. The company requires high availability and wants to ensure that if one Direct Connect connection fails, traffic automatically fails over to another. Which THREE design elements should be included?

Accepted Answer

Provision two Direct Connect connections at different AWS Direct Connect locations.. Option A is correct because provisioning two Direct Connect connections at different AWS Direct Connect locations provides physical path diversity, so a failure at one location or its equipment does not take down all connectivity, which is required for high availability. Option D is correct because Direct Connect uses BGP to exchange routes between the on-premises routers and AWS; BGP is what enables dynamic routing and automatic failover when a connection or path becomes unavailable. Option E is correct because advertising the same BGP prefixes from both on-premises routers ensures AWS has redundant paths to the same networks and can fail over to the alternate connection when one path is withdrawn or fails. Option B is not appropriate because a single customer router is a single point of failure, defeating the high-availability goal even if it connects to two locations. Option C is not one of the three required design elements here because a VPN backup is a separate hybrid connectivity option, not a Direct Connect high-availability design element, and the scenario specifically asks for failover between Direct Connect connections.

Answer

Use a single customer router with multiple connections to both Direct Connect locations.

Answer

Configure a VPN connection as a backup to Direct Connect.

Question 3

A company has a VPC with public and private subnets in three Availability Zones. They want to provide outbound internet access to instances in private subnets while preventing inbound traffic from the internet. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.. A NAT Gateway is a fully managed AWS service that provides outbound internet access for instances in private subnets while blocking unsolicited inbound connections. By placing the NAT Gateway in a public subnet and adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway, traffic from private instances is source NATed to the NAT Gateway's Elastic IP, ensuring inbound traffic from the internet cannot reach the private instances. This solution offers the least operational overhead as AWS handles scaling, patching, and availability, unlike a self-managed NAT instance.

Answer

Deploy a NAT instance in a public subnet and configure the private subnet route table to point to it.

Answer

Attach an Internet Gateway to the VPC and add a default route to it in the private subnet route table.

Answer

Create a VPC Gateway Endpoint for Amazon S3 and route outbound traffic through it.

Question 4

A global company is designing a multi-region architecture with an Active-Passive setup. They want to use Amazon Route 53 to route traffic to the active region and fail over to the passive region during an outage. They need to ensure that the failover is automatic based on health checks. Which routing policy should they use?

Accepted Answer

Failover routing policy. The Failover routing policy in Amazon Route 53 is specifically designed for active-passive configurations. It allows you to designate one record as primary (active) and another as secondary (passive), and Route 53 automatically routes traffic to the secondary record only when the health check associated with the primary record fails. This meets the requirement for automatic failover based on health checks without manual intervention.

Answer

Weighted routing policy

Answer

Latency routing policy

Answer

Geolocation routing policy

Question 5

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and receives traffic from clients. The company wants to improve security by adding an additional layer of protection against common web exploits like SQL injection and cross-site scripting. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF (Web Application Firewall) is the correct service because it is specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and apply customizable rules to block malicious traffic before it reaches the EC2 instances.

Answer

AWS Firewall Manager

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 6

A company has a VPC with CIDR 10.0.0.0/16. They have an on-premises network with CIDR 172.16.0.0/12 connected via AWS Site-to-Site VPN. The company also has a second VPC (VPC B) with CIDR 10.1.0.0/16 peered with the first VPC. They notice that instances in VPC B cannot reach the on-premises network. What is the most likely cause?

Accepted Answer

VPC peering does not support transitive routing.. VPC peering does not support transitive routing. This means that if VPC A is peered with VPC B and also connected to an on-premises network via VPN, traffic from VPC B cannot use VPC A as a transit point to reach the on-premises network. Each VPC must have its own direct connection to the on-premises network, or a transit gateway must be used to enable transitive routing.

Answer

Route propagation is disabled in VPC B.

Answer

The VPN connection is not compatible with VPC peering.

Answer

The VPN tunnel is down.

Question 7

A company is migrating an on-premises application to AWS. The application requires low-latency, high-throughput connectivity between the on-premises data center and the AWS VPC. The company wants a dedicated, private connection that bypasses the internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This ensures low-latency, high-throughput connectivity ideal for latency-sensitive or high-volume workloads, as it uses a physical cross-connect or hosted virtual interface over a private circuit.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 8

A company wants to use Amazon Route 53 to resolve DNS queries for a domain they own. They want to ensure that DNS queries are answered quickly and that there is no single point of failure. Which configuration should they use?

Accepted Answer

Create a hosted zone and let Route 53 automatically handle the DNS resolution.. When you create a hosted zone in Route 53, AWS automatically provisions four authoritative name servers (NS records) distributed across multiple globally redundant data centers. This design inherently provides high availability and low-latency DNS resolution without any additional configuration, as Route 53 uses Anycast routing to direct queries to the nearest healthy name server.

Answer

Deploy Route 53 in multiple AWS Regions.

Answer

Create multiple hosted zones in separate AWS accounts.

Answer

Create a single hosted zone and assign it to one Route 53 name server.

Question 9

A company is designing a VPC architecture with a public subnet and a private subnet. They want to allow instances in the private subnet to download software updates from the internet. Which TWO options satisfy this requirement? (Choose TWO.)

Accepted Answer

Set up a NAT Gateway in a public subnet and add a default route in the private subnet route table pointing to the NAT Gateway.. Options C and D are correct because both provide outbound-only internet access for private-subnet instances: a NAT Gateway placed in a public subnet (C) translates the private instances' source IPs to its own Elastic IP, and the private subnet's route table needs a 0.0.0.0/0 route targeting that NAT Gateway; similarly, a NAT instance in a public subnet (D) performs source NAT (with ip_forwarding enabled and its security group allowing outbound traffic), and the private route table's default route points to the instance's ENI. These satisfy the requirement to download software updates from the internet without exposing the private instances to inbound internet traffic. Option A is not a standard AWS-native solution and still requires the proxy host itself to have internet egress, so it does not by itself satisfy the requirement. Option B only provides private access to Amazon S3 via a gateway endpoint and cannot reach arbitrary internet update servers. Option E is invalid because an Internet Gateway attaches to a VPC, not a subnet, and a private subnet with a 0.0.0.0/0 route to an IGW would become public rather than remain private.

Answer

Configure a forward proxy in the private subnet and configure the instances to use it.

Answer

Create a VPC Gateway Endpoint for Amazon S3 and route traffic to it.

Answer

Attach an Internet Gateway to the private subnet and add a default route to it.

Question 10

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to centralize network management and enable VPC connectivity across accounts. Which THREE services should they consider? (Choose THREE.)

Accepted Answer

AWS Resource Access Manager. AWS Resource Access Manager (RAM) is correct because it enables you to share centrally managed resources, such as Transit Gateways and VPC subnets, across multiple AWS accounts within an AWS Organization. This eliminates the need to create duplicate resources in each account and allows for centralized network management without requiring cross-account IAM roles or complex peering configurations.

Answer

VPC Peering

Answer

AWS Direct Connect

Question 11

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. The company currently has two Direct Connect connections from different providers terminating at two different AWS Direct Connect locations. Which solution provides the most resilient and high-performance connectivity?

Accepted Answer

Use two Direct Connect connections from different providers at different locations with a VPN backup.. Using two Direct Connect connections from different providers at different locations ensures physical and provider diversity, eliminating single points of failure. Adding a VPN backup provides an additional failover path over the internet, which is essential for maintaining connectivity if both Direct Connect links fail. This design meets the requirements for high availability and low latency by leveraging active/active or active/passive traffic engineering with BGP routing and AS path prepending.

Answer

Use a single Direct Connect connection with multiple VLANs.

Answer

Use Site-to-Site VPN over the internet as the primary connection.

Answer

Use two Direct Connect connections from the same provider at the same location.

Question 12

A company is planning to connect multiple VPCs in different AWS accounts using AWS Transit Gateway. The VPCs must be able to communicate with each other, but the company wants to centralize egress traffic to the internet through a single VPC that has a NAT gateway. Which configuration meets these requirements?

Accepted Answer

Attach all VPCs to a Transit Gateway, create a central egress VPC with a NAT gateway, and configure Transit Gateway route tables to send default traffic to the central VPC.. AWS Transit Gateway allows you to attach multiple VPCs from different accounts and centrally manage routing. By configuring the Transit Gateway route tables to send default traffic (0.0.0.0/0) to a central egress VPC that contains a NAT gateway, all other VPCs can route internet-bound traffic through that single NAT gateway, centralizing egress while maintaining inter-VPC communication.

Answer

Use AWS Site-to-Site VPN to connect the VPCs and route traffic through a central VPN endpoint.

Answer

Use VPC peering to connect all VPCs and configure a NAT gateway in one VPC.

Answer

Attach each VPC to a Transit Gateway and configure a NAT gateway in each VPC.

Question 13

A company is designing a network for a three-tier web application that must be highly available across multiple Availability Zones. The application uses an Application Load Balancer (ALB) for the web tier, EC2 instances for the application tier, and an Amazon RDS Multi-AZ database for the database tier. Which TWO design choices improve availability and fault tolerance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create public subnets for web tier and private subnets for app and database tiers. Use security groups to allow traffic from web to app and app to database.. It uses separate public subnets for the web tier (with an Internet Gateway for inbound traffic) and private subnets for the application and database tiers, which have no direct route to the internet. Security groups act as stateful virtual firewalls at the instance level, allowing you to precisely control traffic flows: the web tier security group allows inbound HTTP/HTTPS from the internet, the application tier security group allows inbound traffic only from the web tier security group, and the database tier security group allows inbound traffic only from the application tier security group. This layered approach enforces least-privilege access and minimizes the attack surface.

Answer

Create a single public subnet and use security groups to restrict traffic between instances.

Answer

Place all instances in public subnets but assign private IP addresses only.

Answer

Use network ACLs on subnets to restrict traffic instead of security groups.

Question 14

A company needs to provide internet access to instances in a private subnet. The instances must not be directly accessible from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses source network address translation (SNAT) to translate the private IPs of the instances to the gateway's public IP, ensuring the instances remain inaccessible from the outside.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 15

A company is deploying a global application with users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. To reduce latency, the company wants to route users to the nearest region and provide automatic failover. Which combination of AWS services should be used?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks.. Amazon Route 53 latency-based routing directs users to the region with the lowest latency, automatically routing traffic to the nearest region. Combined with health checks, if an endpoint fails, Route 53 automatically fails over to the next lowest-latency healthy endpoint, meeting both the latency reduction and automatic failover requirements.

Answer

Amazon CloudFront with origins in each region.

Answer

AWS Global Accelerator with endpoint groups in each region.

Answer

Amazon Route 53 with geolocation routing and health checks.