ANS-C01 Network Design Practice Test 31 — 15 Questions

Question 1

A company is designing a hybrid network architecture that connects its on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that if the Direct Connect connection fails, traffic automatically fails over to a VPN connection. Which configuration ensures this failover behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advertise the on-premises prefixes over Direct Connect with a lower MED value than over the VPN.. BGP uses the Multi-Exit Discriminator (MED) value to influence inbound path selection, where a lower MED is preferred. By advertising on-premises prefixes over Direct Connect with a lower MED than over the VPN, AWS will prefer the Direct Connect path under normal conditions. If the Direct Connect fails, the routes are withdrawn, and the VPN routes (with higher MED) become active, providing automatic failover.

Answer

Advertise the on-premises prefixes over Direct Connect with a higher AS path prepend than over the VPN.

Answer

Advertise the on-premises prefixes over Direct Connect with a specific BGP community to influence path selection.

Answer

Advertise the on-premises prefixes over Direct Connect with a higher local preference than over the VPN.

Question 2

A global company is deploying a multi-Region application on AWS. The application requires low-latency access to a shared dataset that is updated frequently in multiple Regions. The company wants to use Amazon Route 53 latency-based routing to direct users to the closest Region. Which data store provides the best combination of low-latency reads and cross-Region consistency for this use case?

Accepted Answer

Amazon ElastiCache for Redis Global Datastore. Amazon ElastiCache for Redis Global Datastore provides sub-millisecond read latency by serving data from in-memory caches, and it offers cross-Region consistency by replicating writes from a primary Region to read replicas in secondary Regions with minimal lag. This combination meets the requirement for low-latency access to a frequently updated shared dataset across multiple Regions, as it avoids the higher latency of disk-based storage and the eventual consistency delays of other options.

Answer

Amazon S3 with cross-Region replication

Answer

Amazon Aurora Global Database

Answer

Amazon DynamoDB global tables with eventually consistent reads

Question 3

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use private virtual interfaces (VIFs) to access multiple VPCs in the same AWS Region. Which AWS service should be used to simplify this connectivity?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway allows you to associate multiple virtual private gateways (VGWs) or transit gateways in the same or different AWS accounts, enabling a single private virtual interface to connect to multiple VPCs in the same AWS Region. This simplifies connectivity by eliminating the need for separate VIFs per VPC and reduces operational overhead.

Answer

Transit VPC solution with EC2-based VPN appliances

Answer

AWS Site-to-Site VPN

Answer

VPC peering connection

Question 4

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. The company wants to ensure that traffic from private subnets uses a single, highly available IP address for outbound traffic. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in a public subnet and route traffic from private subnets to it.. A NAT gateway provides managed, highly available outbound internet access for private subnets using a single elastic IP address. It is deployed in a public subnet and automatically handles failover within an Availability Zone, meeting the requirement for a single, highly available IP for outbound traffic.

Answer

Deploy a single EC2 instance configured as a NAT instance in a public subnet.

Answer

Configure a fleet of proxy servers in an Auto Scaling group with a Network Load Balancer.

Answer

Use a VPC endpoint for Amazon S3 to access software updates.

Question 5

A company wants to allow its employees to securely access internal applications hosted in a VPC without traversing the internet. The company also wants to be able to enforce security policies at the user level. Which AWS service should the company use?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows employees to securely access internal applications hosted in a VPC from any location without traversing the internet. It uses OpenVPN-based client software and integrates with AWS Identity and Access Management (IAM) and Active Directory to enforce security policies at the user level, such as group-based access controls and multi-factor authentication.

Answer

Bastion host in a public subnet

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 6

A company has a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to make API calls to Amazon S3. Which is the most secure way to provide this access without traffic leaving the AWS network?

Accepted Answer

Create a VPC gateway endpoint for Amazon S3 and attach it to the route table of the private subnet.. A VPC gateway endpoint for Amazon S3 allows resources in a private subnet to access S3 privately using the AWS network, without traversing the internet or requiring a NAT gateway. This is the most secure option because traffic stays within the AWS backbone and does not require public IPs or external connectivity.

Answer

Use an AWS Site-to-Site VPN to connect to a remote network that has access to S3.

Answer

Set up a NAT gateway in the public subnet and route the web server's traffic through it.

Answer

Use an internet gateway and a public IP address on the web server.

Question 7

A company is designing a multi-account AWS environment using AWS Organizations. The company wants to centralize outbound internet traffic from all VPCs in all accounts through a single VPC in a shared services account. The shared services account has a VPC with a NAT gateway and an internet gateway. Which architecture meets this requirement?

Accepted Answer

Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.. A transit gateway allows you to centrally route traffic from multiple VPCs across different AWS accounts to a shared services VPC. By attaching all VPCs to a transit gateway and configuring route tables appropriately, you can force all outbound internet traffic from the spoke VPCs to go through the shared services VPC's NAT gateway and internet gateway, centralizing egress traffic.

Answer

Create VPC gateway endpoints for all AWS services in each VPC.

Answer

Set up a VPN connection from each VPC to the shared services VPC and use the latter's internet gateway.

Answer

Peer each VPC to the shared services VPC and configure a default route pointing to the shared services VPC's NAT gateway.

Question 8

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

Accepted Answer

No instances in the VPC can resolve DNS records from the private hosted zone.. The AWS CLI command shown in the exhibit sets the `enableDnsHostnames` and `enableDnsSupport` attributes to `false` for the VPC. When `enableDnsSupport` is false, Amazon Route 53 private hosted zones cannot be resolved by instances within that VPC because the VPC's DNS resolution is disabled entirely. This means no instances in the VPC can query the Route 53 Resolver for private hosted zone records, making option A correct.

Answer

Only instances in public subnets can resolve private hosted zone records.

Answer

The DHCP option set must be updated to provide DNS resolution.

Answer

The private hosted zone is automatically deleted.

Question 9

A company wants to connect multiple VPCs in different AWS Regions using AWS Transit Gateway. The company requires full mesh connectivity with centralized inspection of inter-Region traffic. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create Transit Gateway peering attachments between the Transit Gateways in each Region.. AWS Transit Gateway supports inter-Region peering attachments, which allow you to connect Transit Gateways in different Regions and route traffic between them using the AWS global network. Option D is correct because you can centralize traffic inspection by routing inter-Region traffic through a dedicated inspection VPC attached to one Transit Gateway, using separate route tables to force traffic through that VPC before forwarding it to the destination Region.

Answer

Create VPN attachments between each Transit Gateway and the inspection VPC.

Answer

Use VPC peering connections between VPCs in different Regions.

Answer

Disable cross-Region peering on the Transit Gateway.

Question 10

A company is designing a network for a critical application that requires an SLA of 99.99% availability. The application runs on EC2 instances in an Auto Scaling group across three Availability Zones. The company needs to ensure that the network design meets the SLA. Which THREE components should the company include? (Choose THREE.)

Accepted Answer

A NAT gateway in each Availability Zone for outbound internet access.. A NAT gateway in each Availability Zone ensures that outbound internet traffic remains within the same AZ, preventing cross-AZ data transfer costs and avoiding a single point of failure. This design supports the 99.99% SLA by maintaining high availability for outbound connectivity, as each AZ can independently handle its own traffic without relying on a shared resource.

Answer

A single AWS Direct Connect connection for all inbound traffic.

Answer

A single AWS Site-to-Site VPN connection for administrative access.

Question 11

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances in the same VPC. Which AWS service can support this requirement?

Accepted Answer

AWS Transit Gateway multicast domain. AWS Transit Gateway multicast domains are the only native AWS service that supports multicast traffic between EC2 instances within a VPC. AWS VPC Lattice does not support multicast; it provides service-to-service connectivity using HTTP/HTTPS and TCP. NLB, ALB, and GWLB are load balancers that distribute traffic but do not support multicast.

Answer

AWS VPC Lattice

Answer

Network Load Balancer (NLB)

Answer

Application Load Balancer (ALB)

Answer

Gateway Load Balancer (GWLB)

Question 12

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in a VPC. The application experiences unpredictable traffic spikes. The company notices that during peak traffic, the ALB returns 503 errors. The network engineer checks the ALB's CloudWatch metrics and sees that the 'ActiveConnectionCount' is high but 'TargetResponseTime' is low. The ALB's target group is configured with a deregistration delay of 300 seconds. The ALB is internet-facing and uses an SSL/TLS certificate from AWS Certificate Manager. The security group for the ALB allows inbound HTTPS from 0.0.0.0/0. The target instances' security group allows inbound traffic from the ALB's security group. The VPC has a CIDR of 10.0.0.0/16 with public and private subnets. The ALB is in public subnets, and the instances are in private subnets. The route tables for private subnets have a default route to a NAT gateway in the public subnets. The company wants to resolve the 503 errors. What should the network engineer do?

Accepted Answer

Increase the idle timeout setting on the ALB to a higher value.. The 503 errors are likely caused by the ALB reaching its connection limit (e.g., 50,000 concurrent connections). Increasing the idle timeout would keep connections open longer, increasing concurrent connections and worsening the issue. Decreasing the idle timeout would close idle connections faster, reducing concurrency. Alternatively, scaling out the target group or adding more ALBs can distribute the load. None of the provided options are correct; the correct action is to reduce the idle timeout or increase the number of targets.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay to 600 seconds.

Answer

Move the ALB to private subnets and use a NAT gateway for internet access.

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16. It has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The company hosts a web application on EC2 instances in the private subnets behind an Application Load Balancer (ALB) in the public subnets. The ALB is internet-facing. The company wants to add a second ALB in the same VPC for a different application but using the same public subnets. The new ALB also needs to be internet-facing. However, when the company tries to create the new ALB, they receive an error: 'The subnet 'subnet-xxxxxxxx' does not have enough free IP addresses to satisfy the request.' The network engineer checks the subnets and finds that the public subnets have only 2 free IP addresses each. The private subnets have plenty of free IP addresses. The company wants to resolve this error without changing the architecture of the existing applications. What should the network engineer do?

Accepted Answer

Create new public subnets with larger CIDR blocks (e.g., /23) and associate them with the same route table.. The error indicates insufficient free IP addresses in the public subnets. Creating new public subnets with larger CIDR blocks (e.g., /23) provides more IP addresses without affecting the existing subnets or architecture. Option B is incorrect because private subnets cannot host an internet-facing ALB (they lack direct internet access and cannot assign public IPs). Option C would reduce available IPs and disrupt existing resources. Option D does not free up IP addresses in the subnets.

Answer

Use the private subnets for the new ALB and add a NAT gateway for internet access.

Answer

Reduce the size of the existing public subnets by modifying their CIDR blocks.

Answer

Launch a NAT gateway in one public subnet to free up IP addresses.

Question 14

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?

Accepted Answer

The route table for the private subnet does not have a route to the NAT gateway.. The scenario states that a route pointing 0.0.0.0/0 to the NAT gateway was added to the private subnet's route table, but if that route table is not properly associated with the private subnet, or if the route was added but the target is incorrect (e.g., pointing to the wrong NAT gateway ID), the EC2 instance will not be able to send traffic through the NAT gateway. The verification that the route exists might have been insufficient. Option C points out that the route table for the private subnet does not have a route to the NAT gateway, which would directly cause the issue. The other options are contradicted by the verification steps performed by the engineer.

Answer

The security group for the EC2 instance does not allow outbound traffic.

Answer

The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Question 15

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. They require that traffic from a specific client IP address is always routed to the same AWS Region for session persistence. Which Global Accelerator feature should be used?

Accepted Answer

Enable client IP address affinity (sticky sessions).. Global Accelerator's client IP address affinity (sticky sessions) ensures that traffic from a specific client IP is consistently routed to the same endpoint (in this case, the same AWS Region) for the duration of the session. This feature uses a hash of the client IP to maintain stickiness, which is essential for session persistence in an active-active multi-Region setup.

Answer

Configure health checks on the endpoints.

Answer

Assign endpoint weights to each ALB.

Answer

Set traffic dials to 100% for both Regions.