ANS-C01 Network Design Practice Test 30 — 15 Questions

Question 1

Based on the output, which of the following is true?

Accepted Answer

The Direct Connect Gateway uses ASN 64512. The output shows the Direct Connect Gateway with ASN 64512, which is a private autonomous system number commonly used for Direct Connect Gateways. This ASN is assigned to the gateway and is visible in the output, confirming that option A is correct.

Answer

The Direct Connect Gateway is in a 'deleted' state

Answer

The Direct Connect Gateway is a virtual private gateway

Answer

The Direct Connect Gateway is owned by a different account

Question 2

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need to access the internet for software updates. Which configuration meets this requirement securely?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables to point 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway placed in a public subnet with an Elastic IP allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface, which translates source private IPs to the NAT Gateway's Elastic IP using SNAT (Source Network Address Translation). This meets the requirement securely by maintaining the private subnets' isolation from direct internet exposure.

Answer

Attach an Internet Gateway to the VPC and add a route to 0.0.0.0/0 in the private subnet route tables pointing to the Internet Gateway.

Answer

Create a VPC Peering connection to a second VPC that has an Internet Gateway and route all traffic through it.

Answer

Configure a Virtual Private Gateway and use an AWS Direct Connect connection to the internet.

Question 3

A company is designing a multi-account architecture using AWS Transit Gateway. They need to isolate development and production environments but allow shared services account access to both. What is the most scalable and secure design?

Accepted Answer

Create two Transit Gateways: one for development and one for production. Share the Transit Gateways with the shared services account via AWS Resource Access Manager.. Using two separate Transit Gateways (one for dev, one for prod) provides complete network isolation between environments at the routing layer, while AWS Resource Access Manager (RAM) allows the shared services account to attach its VPC to both Transit Gateways. This design is scalable as each environment can grow independently without route table conflicts, and secure because there is no transitive routing path between dev and prod. A single Transit Gateway with separate route tables (Option A) still shares the same data plane, introducing risk of misconfiguration or route leaks, whereas two Transit Gateways enforce hard isolation.

Answer

Use a single Transit Gateway and configure separate route tables for each environment, attaching VPCs from each account.

Answer

Use a single Transit Gateway with one route table for all environments and implement security groups to isolate traffic.

Answer

Use VPC Peering between each VPC and the shared services VPC, and set up Internet Gateway for each environment.

Question 4

A company is migrating to AWS and needs to connect its on-premises data center to multiple VPCs across several AWS regions. The on-premises network uses BGP and requires high availability with sub-second failover. The solution must be cost-effective and support traffic segmentation. Which design meets these requirements?

Accepted Answer

Order an AWS Direct Connect connection and create multiple virtual interfaces, each connecting to a different VPC in different regions. Use BGP with Bidirectional Forwarding Detection (BFD) for fast failover.. AWS Direct Connect with multiple virtual interfaces (VIFs) provides dedicated, low-latency connectivity to multiple VPCs across different regions. Using BGP with Bidirectional Forwarding Detection (BFD) enables sub-second failover detection (typically 150ms or less), meeting the high availability requirement. This design is cost-effective compared to multiple VPN connections and supports traffic segmentation through separate VIFs or VLANs.

Answer

Set up a Site-to-Site VPN connection between on-premises and each VPC using a VPN appliance on AWS.

Answer

Use AWS Transit Gateway with inter-region peering and attach VPN connections from on-premises to a central Transit Gateway.

Answer

Use a combination of Direct Connect and VPN as a backup, and route all traffic through a single VPC that acts as a transit hub.

Question 5

A company has a VPC with an application load balancer (ALB) in public subnets and web servers in private subnets. The web servers must be accessible only from the ALB. What is the most secure and efficient configuration?

Accepted Answer

Configure the web server security group to allow inbound HTTP from the ALB's security group.. Referencing the ALB's security group in the web server security group rule allows traffic only from the ALB, regardless of its IP addresses. This is the most secure and efficient configuration as it leverages AWS security group referencing, which automatically scales with the ALB's elastic network interfaces and avoids managing IP changes.

Answer

Configure the web server security group to allow inbound HTTP from 0.0.0.0/0.

Answer

Configure the web server security group to allow inbound HTTP from the ALB's private IP addresses.

Answer

Configure the web server security group to allow inbound HTTP from the VPC CIDR.

Question 6

A company is designing a hybrid network using AWS Direct Connect with multiple VPCs in the same region. They need to ensure that traffic between on-premises and VPCs is encrypted and that VPC-to-VPC traffic does not traverse the internet. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway with an IPsec VPN over Direct Connect using a virtual private gateway on each VPC, and configure Transit Gateway route tables.. It uses AWS Transit Gateway to centrally route traffic between on-premises and multiple VPCs, and an IPsec VPN over Direct Connect provides encryption for traffic between on-premises and VPCs. The Transit Gateway route tables ensure VPC-to-VPC traffic stays within the AWS network without traversing the internet, meeting both requirements.

Answer

Use a single Direct Connect connection with multiple virtual interfaces and enable encryption on the physical connection.

Answer

Use AWS Transit Gateway with Direct Connect Gateway and enable encryption on the Transit Gateway attachments.

Answer

Set up a VPN connection over the internet between on-premises and each VPC, and use VPC Peering for VPC-to-VPC traffic.

Question 7

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their application. What is the simplest way to enable IPv6 communication for instances in the VPC?

Accepted Answer

Assign an Amazon-provided IPv6 CIDR block to the VPC and subnets, and create an Egress-Only Internet Gateway for outbound traffic.. The simplest way to enable IPv6 communication in a VPC is to associate an Amazon-provided IPv6 CIDR block (a /56 from the 2002::/25 range) to the VPC and its subnets, then create an Egress-Only Internet Gateway (EIGW) for outbound-only IPv6 traffic. This allows instances with IPv6 addresses to initiate outbound connections to the internet while preventing inbound connections, which is the default security model for IPv6 in AWS.

Answer

Create a VPN connection to an external IPv6 network.

Answer

Configure a NAT Gateway in a public subnet and assign IPv6 addresses to instances.

Answer

Use an Internet Gateway with NAT for IPv6 traffic.

Question 8

A company is using AWS Transit Gateway to connect multiple VPCs. They notice that traffic between two VPCs in different Availability Zones is taking a suboptimal path, resulting in cross-AZ data transfer costs. How can they optimize the path and reduce costs?

Accepted Answer

Use Availability Zone affinity by launching resources in the same AZ and using Transit Gateway to route within the same AZ.. Configuring resources in the same Availability Zone (AZ) and using Transit Gateway to route within that AZ eliminates cross-AZ data transfer costs. AWS Transit Gateway charges for cross-AZ traffic, so keeping traffic local to a single AZ avoids these charges while still leveraging Transit Gateway for centralized routing.

Answer

Replace Transit Gateway with VPC Peering between the VPCs.

Answer

Enable Transit Gateway multicast to replicate traffic across AZs.

Answer

Configure the Transit Gateway to use a single Availability Zone for all attachments.

Question 9

A company is designing a highly available network for a critical application that requires sub-second failover between two AWS regions. The application uses active-active traffic distribution. Which routing policy should they use in Amazon Route 53?

Accepted Answer

Latency routing with health checks. Latency routing with health checks is the correct choice because it directs traffic to the region that provides the lowest latency for each user, and when combined with health checks, Route 53 can automatically route traffic away from unhealthy endpoints. This enables sub-second failover between two active-active regions, as Route 53's DNS-based health checking and routing updates occur quickly (typically within a few seconds) without requiring manual intervention or a primary/secondary failover model.

Answer

Failover routing

Answer

Geolocation routing

Answer

Weighted routing

Question 10

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC that has CIDR 10.0.0.0/16. What is the issue and how can it be resolved?

Accepted Answer

The VPCs have overlapping CIDRs, so they cannot be directly peered. You must re-IP one VPC or use a NAT solution.. VPC peering requires non-overlapping CIDR blocks because the route tables in each VPC must have distinct destination prefixes to route traffic correctly. When both VPCs use 10.0.0.0/16, the routes are identical, causing ambiguity and preventing the peering connection from being established. The only resolution is to change the CIDR of one VPC or use a NAT-based solution to translate addresses.

Answer

The VPCs can be peered if you enable DNS resolution.

Answer

Use a Transit Gateway to connect the VPCs, which supports overlapping CIDRs.

Answer

Use a Direct Connect Gateway to connect the VPCs, which ignores CIDR overlap.

Question 11

A company is designing a network for a multi-tier application that must meet compliance requirements. The architecture includes a VPC with public, private, and database subnets. Which TWO actions should be taken to ensure the database subnets are not directly accessible from the internet? (Select TWO.)

Accepted Answer

Configure a network ACL on the database subnets to deny inbound traffic from 0.0.0.0/0.. A network ACL (NACL) is a stateless firewall that operates at the subnet level. By configuring a NACL rule to deny inbound traffic from 0.0.0.0/0, you explicitly block all internet-originated traffic from reaching the database subnets, regardless of any security group rules. Option E is correct because placing the database subnets in private subnets means they have no direct route to an Internet Gateway, making them inherently inaccessible from the internet.

Answer

Attach an Internet Gateway to the database subnets.

Answer

Create a NAT Gateway in the database subnets.

Answer

Associate a security group that denies inbound traffic from 0.0.0.0/0.

Question 12

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. They want to ensure high availability and failover. Which TWO configurations should they implement? (Select TWO.)

Accepted Answer

Configure a Site-to-Site VPN connection as a backup.. A Site-to-Site VPN over the internet provides a cost-effective, diverse backup path if the Direct Connect connection fails. This ensures high availability by using a different physical medium and network path, allowing traffic to failover automatically via BGP route propagation when the Direct Connect link goes down.

Answer

Create a Direct Connect Gateway and attach multiple VPCs.

Answer

Use a single Direct Connect connection with two virtual interfaces.

Answer

Use the same Direct Connect connection with multiple VLANs.

Question 13

A company is designing a network for a global application that requires low latency between users and application servers. They plan to use multiple AWS regions and want to route users to the nearest healthy endpoint. Which THREE services should they use together? (Select THREE.)

Accepted Answer

Amazon CloudFront. Amazon CloudFront is correct because it provides a global content delivery network (CDN) that caches static and dynamic content at edge locations, reducing latency by serving users from the nearest edge. It integrates with AWS origins (like ALBs) and can route requests to the closest healthy origin, supporting low-latency delivery for global applications.

Answer

AWS WAF

Answer

Application Load Balancer in each region

Question 14

A company has deployed a multi-tier web application in a single AWS region. The architecture includes a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier runs on EC2 instances in the private subnets. The database tier uses an Amazon RDS Multi-AZ deployment in the database subnets. The company is experiencing intermittent connectivity issues between the application tier and the database tier. The application logs show connection timeouts. The network engineer has verified that the security groups and network ACLs are correctly configured. The RDS instance is reachable from the application tier via a telnet test from one specific instance, but not consistently from all instances. What is the most likely cause of the intermittent connectivity?

Accepted Answer

The RDS Multi-AZ failover is causing the primary instance to change, and the application is not reconnecting to the new endpoint.. The most likely cause is that the RDS Multi-AZ failover is causing the primary instance to change, and the application is not reconnecting to the new endpoint. In a Multi-AZ deployment, if a failover occurs, the DNS endpoint updates to point to the new primary, but if the application caches the resolved IP address or uses stale connections, it may experience intermittent timeouts. This explains why connectivity works from some instances (those with fresh DNS entries) but not others. Option C is incorrect because within a single VPC, the local route automatically enables routing between all subnets; missing routes would cause consistent failure, not intermittent. Option B is incorrect because network ACLs, if correctly configured, would not cause intermittent issues. Option D is incorrect because a security group misconfiguration would likely cause consistent failure from all instances, not intermittent connectivity.

Answer

The network ACLs on the database subnets are blocking ephemeral ports used by the application.

Answer

The database subnets are in different Availability Zones than the application subnets, and the route tables in the application subnets do not have routes to the database subnet CIDRs.

Answer

The security group for the database is allowing traffic only from the application tier's security group, but the application tier instances are using a different security group.

Question 15

A company is expanding its on-premises data center to AWS using a hybrid cloud architecture. They have established an AWS Direct Connect connection with a private virtual interface to a VPC. The on-premises network uses BGP to exchange routes with the VPC. The network engineer notices that the on-premises network can reach some EC2 instances in the VPC but not others. All EC2 instances are in the same subnet (10.0.1.0/24) and have private IP addresses. The Direct Connect virtual interface is configured with the VPC CIDR (10.0.0.0/16) advertised to on-premises. The on-premises firewall logs show that traffic to the unreachable instances is being dropped. What is the most likely cause?

Accepted Answer

The security group attached to the unreachable instances is not allowing inbound traffic from the on-premises network.. Security groups are stateful and control inbound traffic; if the security group does not allow inbound traffic from on-premises, it will be dropped. Option A is wrong because the subnet route table has a route to the virtual private gateway, which is correct. Option B is wrong because the VPC CIDR is advertised. Option C is wrong because network ACLs are stateless and need both inbound and outbound rules; but if they were misconfigured, all instances would be affected.

Answer

The subnet route table does not have a route to the on-premises network.

Answer

The BGP session is not advertising the on-premises routes to the VPC.

Answer

The network ACL on the subnet is blocking inbound traffic from on-premises.