ANS-C01 Network Design Practice Test 3 — 15 Questions

Question 1

A company is deploying a critical application across three AWS Regions using an active-active architecture with Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) as the endpoint. The application health checks are configured to check the /health endpoint every 10 seconds. During a regional failure, some users experience timeouts while others are redirected correctly. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route 53 health checkers take multiple intervals to detect failure, and timeouts occur before failover completes.. Route 53 health checkers operate from multiple global locations and evaluate the /health endpoint every 10 seconds. However, to declare an endpoint unhealthy, Route 53 requires a configurable number of consecutive failures (default is 3), meaning it can take 30 seconds or more before the DNS record is updated to remove the failed region. During this detection window, some users whose DNS queries are answered by Route 53 before the failure is fully propagated may receive the IP of the failing ALB, leading to timeouts, while others who query after the failover complete successfully.

Answer

The ALB health check is misconfigured and returns a non-200 status code during normal operation.

Answer

The TTL on the Route 53 record is set too low, causing stale DNS responses.

Answer

Users have cached DNS records from the failed region, and Route 53 does not return healthy endpoints.

Question 2

A company is designing a hybrid network with an AWS Direct Connect connection. They have two virtual interfaces (VIFs): a private VIF to a VPC and a public VIF to access AWS public services. They want to ensure that traffic to Amazon S3 in the same region uses the Direct Connect connection and not the internet. Which configuration should be applied?

Accepted Answer

Advertise the S3 prefix via BGP on the public VIF and ensure the VPC route table has a more specific route for S3 pointing to the virtual private gateway.. To force on-premises traffic to Amazon S3 over Direct Connect, you must advertise the S3 IP prefix (e.g., 52.216.0.0/15) via BGP on the public VIF. The customer edge router learns this route from AWS and directs S3 traffic to the Direct Connect connection, bypassing the internet. No VPC route table changes are needed for on-premises traffic; the VPC route table reference in option A is a distractor.

Answer

Add a route in the VPC route table for S3 prefix with target as the internet gateway.

Answer

Create a VPC endpoint for S3 and attach it to the VPC route table.

Answer

Create a VPN connection to the VPC and route S3 traffic through the VPN.

Question 3

A company uses AWS Direct Connect to connect its on-premises network to a VPC. They have a private VIF attached to a virtual private gateway. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures automatic failover?

Accepted Answer

Use BGP on both the Direct Connect private VIF and the VPN connection, and advertise the same prefixes with a longer AS path for the VPN.. Using BGP on both the Direct Connect private VIF and the VPN connection allows you to manipulate route selection via AS path prepending. By advertising the same prefixes with a longer AS path on the VPN, the Direct Connect path is preferred, and if it fails, BGP withdraws the routes, causing traffic to automatically fail over to the VPN.

Answer

Attach the VPN connection to a separate virtual private gateway and use a transit gateway to combine them.

Answer

Use static routes on the Direct Connect private VIF and BGP on the VPN connection.

Answer

Create a second Direct Connect connection and use equal-cost multipath (ECMP) between the two.

Question 4

A company has an application that requires fixed IP addresses for whitelisting by third-party partners. The application is hosted on an Application Load Balancer (ALB) in a VPC. Which solution provides static IP addresses for the ALB?

Accepted Answer

Place an AWS Global Accelerator in front of the ALB.. AWS Global Accelerator provides two static IP addresses that act as fixed entry points for traffic. By placing it in front of an Application Load Balancer (ALB), you can whitelist these static IPs with third-party partners while the ALB itself remains dynamic. Global Accelerator uses the AWS global network to route traffic to the ALB, preserving the ALB's native HTTP/HTTPS features.

Answer

Use Amazon CloudFront with the ALB as origin.

Answer

Assign an Elastic IP to the ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB).

Question 5

A company is designing a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application (web, application, database) across two Availability Zones. They also need a /20 subnet for a future expansion. Which TWO subnet CIDR allocations are valid and efficient?

Accepted Answer

10.0.0.0/20. Options A (10.0.0.0/20) and D (10.0.16.0/20) are correct because both are valid /20 subnets that fall within the VPC CIDR 10.0.0.0/16 and do not overlap: 10.0.0.0/20 spans 10.0.0.0–10.0.15.255, while 10.0.16.0/20 spans 10.0.16.0–10.0.31.255, giving the required /20 expansion block plus room for the three-tier subnets across two AZs. A /20 provides 4,096 addresses (4,091 usable in AWS after reserving 5 per subnet), which is efficient for a future expansion subnet without wasting the entire VPC. Option B (10.0.0.0/18) is a valid CIDR within the VPC but is too large for the stated need and would consume a quarter of the /16, reducing efficiency. Option C (10.0.0.0/16) is the entire VPC CIDR and cannot be used as a subnet. Option E (10.0.0.0/28) is a valid subnet size but only provides 16 addresses (11 usable), far too small for the expansion requirement and inefficient for the scenario.

Answer

10.0.0.0/18

Answer

10.0.0.0/16

Answer

10.0.0.0/28

Question 6

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. Both connections will terminate at the same Direct Connect gateway. Which TWO steps are required to enable BGP multipath (ECMP) across the two connections?

Accepted Answer

Ensure the same customer-side ASN is used on both virtual interfaces.. Option A is correct because BGP multipath (ECMP) requires the routes learned over both virtual interfaces to be considered equal, and using the same customer-side ASN on both VIFs ensures the AS_PATH attributes match so the routes are eligible for load sharing. Option D is correct because ECMP only works when both connections advertise the same BGP prefixes (routes); identical prefix advertisements let the Direct Connect gateway install multiple equal-cost paths to the same destinations. Option B is incorrect because different ASNs on each VIF would make the AS_PATHs differ, preventing the routes from being treated as equal-cost and thus blocking ECMP. Option C is incorrect because advertising different prefixes on each VIF would not create multiple equal-cost paths for the same destination, so no ECMP would occur. Option E is incorrect because attaching each VIF to a different VPC is unrelated to ECMP across the two connections; both VIFs must terminate at the same Direct Connect gateway and target the same VPC for redundancy.

Answer

Use a different autonomous system number (ASN) on each virtual interface.

Answer

Advertise different BGP prefixes on each virtual interface.

Answer

Attach each virtual interface to a different VPC.

Question 7

A company wants to enable communication between two VPCs (VPC A and VPC B) in the same AWS account and region. They want to use private IP addresses and avoid using the internet. Which THREE options can achieve this?

Accepted Answer

VPC peering connection. VPC peering connection (A) is correct because it directly connects two VPCs in the same account and region, allowing resources to communicate using private IPv4/IPv6 addresses without traversing the internet. AWS Site-to-Site VPN connection between VPCs (B) is correct because you can attach a Virtual Private Gateway (VGW) to one VPC and a Customer Gateway (CGW) to the other, establishing an IPsec VPN tunnel over the AWS private network for private IP communication. AWS Transit Gateway (D) is correct because it acts as a regional hub that attaches multiple VPCs and routes traffic between them over private IP addresses without internet exposure. Internet gateway attached to both VPCs (C) is incorrect because an IGW provides internet connectivity, not private VPC-to-VPC routing, and VPCs cannot route to each other through IGWs. NAT gateway in each VPC (E) is incorrect because a NAT gateway only enables outbound internet access for private subnets and does not provide VPC-to-VPC communication.

Answer

Internet gateway attached to both VPCs

Answer

NAT gateway in each VPC

Question 8

A company is migrating a legacy on-premises application to AWS. The application uses a large number of short-lived TCP connections and requires low latency. The network team is considering using either a Network Load Balancer (NLB) or a Gateway Load Balancer (GWLB). Which of the following is a key advantage of using NLB over GWLB for this use case?

Accepted Answer

NLB preserves the client source IP, while GWLB does not by default.. For an application using a large number of short-lived TCP connections requiring low latency, NLB is the optimal choice because it operates at Layer 4 and preserves the client source IP address by default, which is critical for applications that need to log or process the original client IP. GWLB, by design, uses GENEVE encapsulation (UDP port 6081) to tunnel traffic to backend appliances, which replaces the client source IP with the NLB's private IP unless explicit configuration (e.g., proxy protocol) is used. This makes NLB the better fit for preserving source IP without additional overhead.

Answer

NLB can forward traffic to third-party virtual appliances.

Answer

NLB can handle higher throughput than GWLB.

Answer

NLB supports TLS termination, while GWLB does not.

Question 9

A company is connecting its on-premises data center to AWS using AWS Direct Connect. The company has two Direct Connect connections and wants to ensure high availability. The on-premises network uses BGP to advertise routes to AWS. Which combination of steps should be taken to achieve the most resilient design? (Choose TWO.)

Accepted Answer

Provision two private virtual interfaces, one over each Direct Connect connection.. Option B is correct because provisioning two private virtual interfaces, one over each Direct Connect connection, provides redundant Layer 3 paths to AWS; if one connection or its virtual interface fails, BGP can reconverge over the other, which is essential for a highly available Direct Connect design. Option E is correct because advertising the same prefixes from both connections with different BGP communities allows the on-premises network to influence AWS inbound traffic preferences and supports deterministic failover/load-sharing across the redundant links. Option A is not appropriate because a single private virtual interface cannot span both connections for link aggregation, and Direct Connect does not support LAG across separate connections in that way. Option C is not appropriate because replacing BGP with static routes removes dynamic failover and path selection, reducing resilience. Option D is not appropriate because using the same BGP ASN on both connections is not the mechanism that creates high availability and can complicate routing policy; the resilient design depends on redundant virtual interfaces and BGP path control.

Answer

Provision a single private virtual interface and use both connections for link aggregation.

Answer

Configure static routes instead of BGP to simplify the design.

Answer

Use the same BGP ASN for both connections.

Question 10

A company has a VPC with multiple subnets across two Availability Zones. They are designing a highly available web application using an Application Load Balancer (ALB) and EC2 instances in an Auto Scaling group. Which of the following is the most resilient and cost-effective design for the network layer?

Accepted Answer

Deploy a single ALB with subnets in two AZs and enable cross-zone load balancing.. Deploying a single Application Load Balancer (ALB) with subnets in two Availability Zones (AZs) and enabling cross-zone load balancing provides high availability and fault tolerance at the network layer. The ALB automatically distributes incoming traffic across healthy targets in all enabled AZs, eliminating the need for multiple load balancers and reducing costs while maintaining resilience. This design leverages the ALB's native ability to handle AZ failures by routing traffic only to healthy AZs, making it both resilient and cost-effective.

Answer

Deploy a Network Load Balancer (NLB) in each AZ and associate them with a single ALB.

Answer

Deploy an ALB in one AZ and EC2 instances in the same AZ.

Answer

Deploy an ALB in each AZ and use Route 53 weighted routing.

Question 11

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs in different regions is encrypted. Which solution should be used?

Accepted Answer

Use AWS Transit Gateway inter-region peering with a VPN attachment between the transit gateways.. AWS Transit Gateway inter-region peering inherently encrypts traffic as it traverses the AWS global network. No separate VPN attachment is required; the peering connection itself provides encryption. Although the option wording includes 'with a VPN attachment', the core solution of using inter-region peering is what meets the requirement. Options A, C, and D do not provide encrypted cross-region VPC connectivity without additional configurations.

Answer

Use a Site-to-Site VPN from each VPC to the on-premises network and route traffic through the corporate network.

Answer

Use VPC Peering connections between the VPCs, which encrypts traffic automatically.

Answer

Use AWS PrivateLink to connect the VPCs across regions.

Question 12

A company is designing a hybrid network using AWS Direct Connect and AWS Site-to-Site VPN as backup. They want to ensure that traffic from on-premises to AWS uses Direct Connect when available and fails over to VPN automatically. Which BGP configuration should be used?

Accepted Answer

Prepend AS path on the VPN connection to make it less preferred.. Prepending the AS path on the VPN connection increases the AS path length, making the VPN route less preferred compared to the Direct Connect route. BGP selects the path with the shortest AS path length by default, so the Direct Connect path will be chosen as the primary path. When Direct Connect fails, the VPN route becomes the only available path and traffic automatically fails over.

Answer

Set a higher BGP local preference on the VPN connection.

Answer

Use the same BGP attributes for both connections and let ECMP handle load balancing.

Answer

Set a higher Multi-Exit Discriminator (MED) on the Direct Connect connection.

Question 13

A company is designing a multi-Region Active-Active architecture with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route users to the nearest healthy endpoint using a custom domain name. Which AWS service should they use to accomplish this with the lowest latency and minimal operational overhead?

Accepted Answer

Use Amazon Route 53 latency-based routing with health checks.. Amazon Route 53 latency-based routing directs user traffic to the AWS region that provides the lowest latency for the end user, based on latency measurements between DNS resolvers and AWS endpoints. Combined with health checks, it automatically routes users away from unhealthy ALBs, meeting the requirement for nearest healthy endpoint with minimal operational overhead since it is a fully managed DNS service with no additional infrastructure to deploy.

Answer

Use Amazon Route 53 geolocation routing policy.

Answer

Use AWS Global Accelerator with endpoint groups in each region.

Answer

Use Amazon Route 53 weighted routing policy.

Question 14

A company is deploying a VPC with a public and private subnet in each of three Availability Zones. They need to provide internet access to instances in the private subnets while ensuring that all outbound traffic is logged and that traffic to a particular on-premises CIDR (10.0.0.0/8) is routed via an AWS Direct Connect Virtual Private Gateway. The company has a VPN connection as a backup. Which design should they use?

Accepted Answer

Create a centralized egress VPC with NAT Gateways in each AZ. Peer the application VPCs to the egress VPC. Configure route tables in the application VPCs to send 0.0.0.0/0 to the egress VPC and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.. It uses a centralized egress VPC with NAT Gateways in each AZ to provide internet access to private subnets while logging all outbound traffic. By peering the application VPCs to the egress VPC, the route tables can direct 0.0.0.0/0 traffic to the egress VPC for NAT, and 10.0.0.0/8 traffic to the Direct Connect Virtual Private Gateway, ensuring on-premises traffic uses the dedicated connection with VPN backup. This design meets all requirements: internet access, logging, and specific routing for on-premises CIDR.

Answer

Place a NAT Gateway in each AZ in the application VPC. Configure route tables to send 0.0.0.0/0 to the NAT Gateway. Use a VPN connection for on-premises traffic.

Answer

Use a Transit Gateway to connect all VPCs and on-premises. Attach a NAT Gateway in one AZ to the Transit Gateway. Configure route tables to send 0.0.0.0/0 to the NAT Gateway and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.

Answer

Create a NAT instance in each private subnet and configure each instance's route table to send 0.0.0.0/0 to the NAT instance. For on-premises traffic, use a VPC peering connection to an on-premises network.

Question 15

A company is designing a hybrid network where an Amazon VPC is connected to an on-premises data center via AWS Direct Connect and a VPN backup. They have a VPC with CIDR 10.0.0.0/16 and on-premises CIDR 192.168.0.0/16. They want to ensure that all traffic between the VPC and on-premises uses the Direct Connect connection when it is available, and automatically fails over to the VPN if Direct Connect fails. What should they do?

Accepted Answer

Create a virtual private gateway attached to the VPC. Establish a Direct Connect private virtual interface and a VPN connection to the virtual private gateway. Configure BGP on both connections and use a shorter AS path for the Direct Connect routes.. It uses a virtual private gateway (VGW) for both the Direct Connect private virtual interface and the VPN connection, and configures BGP on both. By advertising a shorter AS path (e.g., prepending fewer AS numbers) for the Direct Connect routes, the VPC and on-premises routers prefer the Direct Connect path when available. If Direct Connect fails, the BGP session drops, and the VPN routes (with a longer AS path) become active, providing automatic failover.

Answer

Create a virtual private gateway with a Direct Connect private virtual interface. Additionally, create a separate VPN connection directly to the VPC. Set longer AS path for the Direct Connect routes.

Answer

Create a virtual private gateway and establish both a Direct Connect private virtual interface and a VPN connection. Use BGP with equal AS path lengths to enable ECMP.

Answer

Create a virtual private gateway and attach a Direct Connect private virtual interface. For failover, add a static route in the VPC route table pointing to the VPN connection.