ANS-C01 Network Design Practice Test 31 — 15 Questions

Question 1

A company wants to connect multiple VPCs across different AWS Regions using AWS Transit Gateway. Which feature allows the VPCs to communicate with each other using private IP addresses without creating peering connections?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transit Gateway inter-Region peering. Transit Gateway inter-Region peering allows VPCs in different AWS Regions to communicate using private IP addresses through a central Transit Gateway, without requiring individual VPC peering connections. This feature uses the AWS global network to route traffic between peered Transit Gateways, enabling cross-region connectivity with a hub-and-spoke architecture.

Answer

AWS Direct Connect gateway

Answer

AWS PrivateLink

Answer

VPC Peering

Question 2

A network engineer is designing a hybrid network with multiple AWS accounts. The company wants to simplify management by using a single AWS Direct Connect connection shared among accounts. Which service should be used to achieve this?

Accepted Answer

Transit Gateway with Direct Connect Gateway. A Transit Gateway with a Direct Connect Gateway allows you to attach multiple VPCs from different AWS accounts to a single Direct Connect connection. The Direct Connect Gateway acts as a bridge between the on-premises network and the Transit Gateway, which then routes traffic to the appropriate VPCs across accounts. This setup simplifies management by centralizing the Direct Connect connection while supporting multi-account architectures.

Answer

VPC Peering

Answer

AWS PrivateLink

Answer

AWS VPN CloudHub

Question 3

A company is designing a VPC with both IPv4 and IPv6 CIDR blocks. The VPC must support internet-facing applications accessible via IPv6. Which resource must be configured as IPv6-enabled to allow internet traffic?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is the only resource that supports both IPv4 and IPv6 traffic and provides a target in the VPC route table for IPv6 default routes (::/0) to enable direct internet access for IPv6-enabled resources. Unlike IPv4, which often requires NAT for private addressing, IPv6 globally unique addresses allow direct communication through the IGW without translation.

Answer

VPC Peering connection

Answer

NAT Gateway

Answer

Transit Gateway

Question 4

A company has multiple VPCs connected via AWS Transit Gateway. One VPC contains a shared services endpoint (e.g., Amazon S3) using a VPC Gateway Endpoint. How can other VPCs access this endpoint?

Accepted Answer

Create Gateway Endpoints in each VPC that needs access. A VPC Gateway Endpoint is a regional service that uses route table entries to direct traffic to AWS services like S3 or DynamoDB without leaving the AWS network. Since Gateway Endpoints are not transitive across VPCs, each VPC that needs to access the shared S3 endpoint must have its own Gateway Endpoint created in that VPC, with the appropriate route table entries pointing to the endpoint. The Transit Gateway does not propagate Gateway Endpoint routes, so other VPCs cannot reach the endpoint through the Transit Gateway alone.

Answer

Use AWS PrivateLink to access the S3 endpoint

Answer

Configure Direct Connect to access the endpoint

Answer

Create a route in Transit Gateway pointing to the endpoint

Question 5

A company needs to connect its on-premises data center to AWS using a dedicated, low-latency connection. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, low-latency network connection from an on-premises data center directly to AWS, bypassing the public internet. This service uses industry-standard 802.1Q VLANs to create virtual interfaces, ensuring consistent performance and reduced latency for mission-critical workloads.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 6

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet must traverse a centralized inspection appliance for traffic inspection. Which architecture should be used?

Accepted Answer

Use Transit Gateway with VPC attached and route traffic through a shared services VPC containing the inspection appliance. A Transit Gateway with a shared services VPC architecture allows centralized inspection of all outbound internet traffic. By attaching the VPCs to a Transit Gateway and routing traffic through a shared services VPC that hosts the inspection appliance (e.g., a firewall or proxy), you can enforce security policies. The Transit Gateway acts as a hub, enabling transitive routing between VPCs while directing internet-bound traffic to the inspection appliance before it reaches an internet gateway or NAT gateway.

Answer

Use VPC Peering between all VPCs

Answer

Configure a NAT Gateway in each Availability Zone

Answer

Use AWS Direct Connect to route traffic on-premises

Question 7

A company has multiple VPCs connected via a Transit Gateway. They want to implement network segmentation so that only specific VPCs can communicate with each other. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Deploy AWS Network Firewall in a centralized inspection VPC. AWS Network Firewall can be deployed in a centralized inspection VPC to filter traffic between VPCs attached to a Transit Gateway. By routing inter-VPC traffic through the firewall appliance, you can enforce stateful inspection and allow or deny traffic based on source/destination VPCs, achieving network segmentation.

Answer

Assign instances to different security groups

Answer

Configure network ACLs on each subnet

Answer

Create separate VPC peering connections

Question 8

A company is designing a high-availability architecture for an application that will be deployed across multiple Availability Zones. Which THREE components are recommended for this design? (Choose three.)

Accepted Answer

Application Load Balancer across multiple AZs. Option B (Application Load Balancer across multiple AZs) is correct because an ALB is a regional, highly available load balancer that distributes traffic across targets in multiple Availability Zones, providing fault tolerance if one AZ fails. Option C (NAT Gateway in each AZ) is correct because a NAT Gateway is zonal; deploying one per AZ ensures outbound internet access for private subnets remains available even if a single AZ becomes unavailable, avoiding a single point of failure. Option D (Auto Scaling group with instances in multiple AZs) is correct because an ASG can span multiple AZs and automatically replace unhealthy instances and rebalance capacity across zones, maintaining application availability. Option A is not recommended because a single EC2 instance per AZ without an Auto Scaling group still leaves each instance as an unmanaged single point of failure and cannot self-heal. Option E is not recommended because a single NAT Gateway in one AZ creates a zonal single point of failure for outbound traffic if that AZ is lost.

Answer

One EC2 instance in each AZ

Answer

Single NAT Gateway in one AZ

Question 9

Refer to the exhibit. A route table shows routes for a VPC. What is the correct interpretation of this route table?

Accepted Answer

The VPC has CIDR 10.0.0.0/16, an internet gateway, and a VPC peering connection to a VPC with CIDR 192.168.0.0/16. The route table shows a local route for 10.0.0.0/16, which is the VPC's CIDR, a default route (0.0.0.0/0) pointing to an internet gateway (igw-xxx), and a specific route for 192.168.0.0/16 pointing to a VPC peering connection (pcx-xxx). This configuration allows traffic destined for the peered VPC's CIDR to be routed over the peering connection, while all other internet-bound traffic goes through the internet gateway.

Answer

The VPC has CIDR 10.0.0.0/16, a NAT gateway, and a VPN connection to 192.168.0.0/16

Answer

The VPC has CIDR 192.168.0.0/16, an internet gateway, and a VPC peering connection to 10.0.0.0/16

Answer

The VPC has CIDR 10.0.0.0/16, a virtual private gateway, and a peering connection

Question 10

Refer to the exhibit. A VPN connection has two tunnels. Which statement is correct about this VPN configuration?

Accepted Answer

The VPN provides high availability with two tunnels. The exhibit shows a VPN connection with two tunnels, which is the standard design for AWS Site-to-Site VPN to provide high availability. Each tunnel is on a separate device and path, so if one tunnel fails, traffic automatically fails over to the other tunnel. This ensures that the VPN connection remains operational even during maintenance or failure of a single tunnel.

Answer

The VPN uses BGP dynamic routing

Answer

The tunnel inside CIDRs are /24 networks

Answer

Both tunnels use the same inside CIDR

Question 11

A company is designing a multi-region architecture using AWS Global Accelerator and Application Load Balancers (ALBs) in two AWS Regions. They want to route traffic to the closest healthy endpoint and minimize latency. Which configuration best meets these requirements?

Accepted Answer

Create a Global Accelerator with endpoint groups in each region, each pointing to the regional ALB.. AWS Global Accelerator uses the Anycast IP address to route traffic to the nearest edge location, then forwards it over the AWS global network to the closest healthy endpoint group. By configuring endpoint groups in each region, each pointing to the regional ALB, Global Accelerator provides both low-latency routing and automatic failover, meeting the requirement for multi-region traffic distribution to the closest healthy endpoint.

Answer

Deploy a single ALB in one region and use Route 53 geolocation routing to direct traffic.

Answer

Use Amazon Route 53 latency-based routing with ALBs in each region.

Answer

Use an Application Load Balancer in one region and a Network Load Balancer in another with cross-zone load balancing.

Question 12

A company is designing a hybrid network connecting an on-premises data center to AWS via AWS Direct Connect. The company requires high availability and wants to avoid a single point of failure. Which design meets these requirements?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Provisioning two Direct Connect connections at two different Direct Connect locations eliminates any single point of failure. This design ensures that if one connection or location fails, traffic can automatically fail over to the other connection, meeting the high availability requirement. A single Direct Connect connection, regardless of the number of VIFs or VLANs, remains a single point of failure.

Answer

Provision a single Direct Connect connection with multiple virtual interfaces (VIFs).

Answer

Provision one Direct Connect connection with two VLANs to separate production and non-production traffic.

Answer

Use a single Direct Connect connection and a VPN backup over the internet.

Question 13

A company is designing a VPC with subnets in multiple Availability Zones (AZs) for a web application. The application must be fault-tolerant and highly available. Which design should the network engineer implement?

Accepted Answer

Deploy application instances in two AZs behind an Application Load Balancer that spans both AZs.. Deploying application instances in two Availability Zones (AZs) behind an Application Load Balancer (ALB) that spans both AZs provides fault tolerance and high availability. If one AZ fails, the ALB automatically routes traffic to healthy instances in the remaining AZ, ensuring continuous service. This design leverages cross-zone load balancing, which is enabled by default for ALBs, to distribute traffic evenly across instances in multiple AZs.

Answer

Deploy all application instances in a single AZ behind an Application Load Balancer.

Answer

Place one instance in each of two AZs and use an internet gateway for load balancing.

Answer

Use a Network Load Balancer in a single AZ with instances in multiple AZs.

Question 14

A company is migrating a legacy application to AWS. The application requires a fixed IP address that must not change. The application will be deployed on Amazon EC2 instances behind an Application Load Balancer. Which solution meets the requirement for a static IP address?

Accepted Answer

Place the ALB behind AWS Global Accelerator, which provides static IP addresses.. AWS Global Accelerator provides two static Anycast IP addresses that serve as fixed entry points for traffic. Traffic is then routed over the AWS global network to the Application Load Balancer, preserving the static IP requirement while still allowing the ALB to handle HTTP/HTTPS traffic. This decouples the static IP from the underlying load balancer, ensuring the IP does not change even if the ALB is replaced or recreated.

Answer

Assign an Elastic IP address to the Application Load Balancer.

Answer

Replace the ALB with a Network Load Balancer and assign an Elastic IP to it.

Answer

Use an Elastic IP address on each EC2 instance and point a CNAME record to the ALB.

Question 15

A company wants to securely connect two VPCs in the same region. The VPCs must be able to communicate using private IP addresses, and connectivity should be highly available. Which solution meets these requirements?

Accepted Answer

Create a VPC peering connection between the two VPCs.. A VPC peering connection allows two VPCs in the same region to communicate using private IPv4 or IPv6 addresses as if they were on the same network, with no single point of failure. It is highly available by design since traffic flows directly between the VPCs using the AWS global network infrastructure, without any intermediate devices or bandwidth limits.

Answer

Set up a VPN connection between the two VPCs using virtual private gateways.

Answer

Create an inter-region VPC peering connection.

Answer

Use an AWS Transit Gateway to connect the two VPCs.