ANS-C01 Network Design Practice Test 30 — 15 Questions

Question 1

A company has a VPC with multiple subnets. They want to capture and analyze network traffic between EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the VPC, subnet, or network interface level, enabling detailed analysis of traffic between EC2 instances within the same VPC. This is the correct service because it provides the network-level visibility needed for troubleshooting traffic flows without requiring agents or changes to the instances.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon CloudWatch Metrics

Question 2

A company is designing a network for a real-time gaming application that requires extremely low latency between players. The application will be deployed on EC2 instances in multiple AWS regions. Which AWS service provides the best latency performance by using the AWS global network and anycast IPs?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network and anycast IPs to route traffic to the optimal edge location, then over the AWS backbone to the nearest healthy endpoint. This minimizes internet hops and latency, making it ideal for real-time gaming applications that require consistent low latency across multiple regions.

Answer

AWS Direct Connect

Answer

Amazon CloudFront

Answer

Amazon Route 53 Latency Routing

Question 3

A company needs to connect its on-premises data center to a VPC in AWS using a dedicated, private, and high-bandwidth connection. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center directly to AWS, bypassing the public internet. This meets the requirements for a private, low-latency, and consistent network path, unlike VPN-based solutions that traverse the internet.

Answer

AWS Client VPN

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 4

A company is designing a network for a critical application that requires maximum availability. The application will be deployed across multiple Availability Zones in a single region. Which THREE design choices improve network availability?

Accepted Answer

Use an Application Load Balancer with targets in multiple Availability Zones. Option A is correct because an Application Load Balancer is a regional, highly available service that distributes traffic across healthy targets in multiple Availability Zones, automatically routing around a failed AZ. Option B is correct because deploying EC2 instances in at least two Availability Zones removes a single point of failure, so the application keeps serving traffic if one AZ becomes unavailable. Option E is correct because creating a NAT gateway in each Availability Zone gives each AZ an independent egress path; if one AZ's NAT gateway fails, instances in other AZs still have outbound connectivity. Option C is incorrect because a single NAT gateway in one AZ is a single point of failure for outbound traffic and creates cross-AZ dependency. Option D is incorrect because using a single subnet per Availability Zone is normal and does not by itself improve availability; subnets are AZ-scoped, and redundancy comes from spanning multiple AZs, not from limiting subnets.

Answer

Use a single NAT gateway in one Availability Zone

Answer

Use a single subnet per Availability Zone

Question 5

A company has a VPC with public and private subnets. The private subnets need internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used?

Accepted Answer

NAT gateway. A NAT gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It resides in a public subnet with an Elastic IP and uses the internet gateway for outbound traffic, but it does not allow inbound traffic to reach the private instances directly.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC endpoint

Question 6

A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?

Accepted Answer

Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.. AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.

Answer

Create VPC peering connections between each VPC in different accounts.

Answer

Configure VPC endpoints in each account to communicate through the network account.

Answer

Set up AWS Direct Connect between accounts and route through the network account.

Question 7

A company wants to provide secure access to an S3 bucket from a VPC without using an internet gateway or NAT device. Which AWS feature should be used?

Accepted Answer

VPC endpoint (Gateway type) for S3. A VPC endpoint (Gateway type) for S3 allows instances within a VPC to access S3 buckets privately using the AWS network, without requiring an internet gateway or NAT device. This is achieved by adding an endpoint route in the VPC route table that directs S3 traffic through the AWS backbone, ensuring data never traverses the public internet.

Answer

Internet gateway

Answer

NAT gateway

Answer

AWS Site-to-Site VPN connection

Question 8

A company has an on-premises data center connected to AWS via a Site-to-Site VPN. The VPN connection uses BGP for dynamic routing. The company wants to add an additional VPN tunnel for redundancy. What must be configured?

Accepted Answer

Create a second VPN connection to a second customer gateway device.. To add an additional VPN tunnel for redundancy, you must create a second VPN connection that uses a second customer gateway device. This provides a second BGP session and a separate tunnel, ensuring failover if the primary tunnel or customer gateway fails. The existing virtual private gateway can support multiple VPN connections, so no replacement or additional VGW is needed.

Answer

Create a second virtual private gateway and attach it to the VPC.

Answer

Add a transit gateway to replace the virtual private gateway.

Answer

Configure static routes instead of BGP.

Question 9

Which TWO of the following are valid methods to connect multiple VPCs in the same AWS region? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (A) is a valid method because it creates a direct, one-to-one private network connection between two VPCs in the same region (or across regions), allowing traffic to route between them using private IPv4/IPv6 addresses without traversing the public internet. A transit gateway (E) is also valid because it acts as a regional hub that multiple VPCs can attach to, enabling transitive routing between many VPCs in the same region through a single gateway. AWS Direct Connect (B) is not a VPC-to-VPC connection method; it links an on-premises network to AWS over a dedicated private circuit. VPC endpoints (C) only provide private connectivity from a VPC to supported AWS services or endpoint services, not VPC-to-VPC connectivity. Site-to-Site VPN (D) connects an on-premises network to a VPC over IPsec tunnels, not multiple VPCs to each other within a region.

Answer

AWS Direct Connect

Answer

VPC endpoints

Answer

Site-to-Site VPN

Question 10

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity for their internet-facing applications. The VPC currently has an internet gateway attached. What is the MOST efficient way to enable IPv6?

Accepted Answer

Assign an Amazon-provided IPv6 CIDR block to the VPC and subnets, and update route tables to use an internet gateway for IPv6. The most efficient way to enable IPv6 for an existing VPC with an internet gateway is to request an Amazon-provided IPv6 CIDR block (a /56 block) for the VPC, assign a /64 IPv6 CIDR to each subnet, and then update the route tables to direct ::/0 traffic to the internet gateway. The internet gateway is a dual-stack resource that inherently supports both IPv4 and IPv6 traffic, so no additional gateway is needed for outbound-only or inbound IPv6 connectivity.

Answer

Create a transit gateway and attach the VPC, then route IPv6 traffic through a VPN

Answer

Create a NAT Gateway in a public subnet and route IPv6 traffic through it

Answer

Assign an IPv6 CIDR to the VPC and subnets, and add an egress-only internet gateway

Question 11

A company needs to monitor network traffic to and from EC2 instances for security analysis. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring network traffic to and from EC2 instances for security analysis, as it provides detailed network-level logs without requiring any agent installation on the instances.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 12

A company wants to allow their employees to securely access resources in a VPC from their home offices. Which AWS service should they use?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows individual users to securely access AWS resources from remote locations, such as home offices, using a VPN client installed on their device. It supports OpenVPN-based connections and integrates with Active Directory for user authentication, making it ideal for remote employee access to a VPC without requiring dedicated hardware or complex site-to-site configurations.

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Answer

Amazon CloudFront

Question 13

Which TWO of the following are valid methods to connect a VPC to an on-premises network? (Choose 2.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel between a VPC and an on-premises network using IPsec. It uses a virtual private gateway or transit gateway on the AWS side and a customer gateway device on-premises, enabling secure communication over the public internet.

Answer

Internet gateway

Answer

NAT gateway

Answer

VPC peering

Question 14

Which THREE AWS services can be used to improve the availability of a web application across multiple AWS Regions? (Choose 3.)

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator improves availability across multiple AWS Regions by using the AWS global network to route user traffic to the optimal regional endpoint based on health, latency, and geography. It provides static anycast IP addresses and automatically reroutes traffic to healthy endpoints during a regional failure, thereby enhancing fault tolerance and performance for global web applications.

Answer

VPC peering

Answer

AWS Direct Connect

Question 15

Which TWO actions can be taken to reduce the attack surface of a VPC's public subnets? (Choose 2.)

Accepted Answer

Place web servers in private subnets and use a load balancer in a public subnet. Placing web servers in private subnets and using a load balancer in a public subnet reduces the attack surface by ensuring that the web servers have no direct internet-facing IP addresses. The load balancer acts as a single point of ingress, allowing security groups to tightly control traffic from the load balancer to the web servers, while the public subnet only exposes the load balancer's endpoints. This architecture follows AWS best practices for a multi-tier application, minimizing the number of resources directly accessible from the internet.

Answer

Allow all inbound traffic from the internet to the public subnets

Answer

Use a single subnet for all application tiers

Answer

Disable ICMP traffic on the network ACL