ANS-C01 Network Design Practice Test 31 — 15 Questions

Question 1

A global company is deploying a multi-Region application on AWS. The application requires low-latency access to a shared dataset that is updated frequently in multiple Regions. The company wants to use Amazon Route 53 latency-based routing to direct users to the closest Region. Which data store provides the best combination of low-latency reads and cross-Region consistency for this use case?

Accepted Answer

Amazon ElastiCache for Redis Global Datastore. Option C is correct because Amazon ElastiCache for Redis offers sub-millisecond latency and can be used as a global datastore with cross-Region replication using Global Datastore. Option A is incorrect because DynamoDB global tables offer eventual consistency, but with higher latency for strongly consistent reads. Option B is incorrect because S3 is object storage and not suitable for frequently updated shared dataset requires sub-millisecond latency. Option D is incorrect because Aurora Global Database provides low-latency reads but with a lag of typically 1 second, not sub-millisecond.

Answer

Amazon S3 with cross-Region replication

Answer

Amazon Aurora Global Database

Answer

Amazon DynamoDB global tables with eventually consistent reads

Question 2

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. The company wants to use private virtual interfaces (VIFs) to access multiple VPCs in the same AWS Region. Which AWS service should be used to simplify this connectivity?

Accepted Answer

Direct Connect gateway. Option B is correct because a Direct Connect gateway allows a single private VIF to connect to multiple VPCs in the same or different Regions. Option A is incorrect because a transit VPC solution is more complex and not needed. Option C is incorrect because a VPN connection is not required. Option D is incorrect because VPC peering is not used with Direct Connect.

Answer

Transit VPC solution with EC2-based VPN appliances

Answer

AWS Site-to-Site VPN

Answer

VPC peering connection

Question 3

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. The company wants to ensure that traffic from private subnets uses a single, highly available IP address for outbound traffic. Which solution meets these requirements?

Accepted Answer

Create a NAT gateway in a public subnet and route traffic from private subnets to it.. Option D is correct because a NAT gateway provides highly available outbound internet access with a single Elastic IP address. Option A is incorrect because a NAT instance is not highly available. Option B is incorrect because a VPC endpoint is for specific AWS services, not general internet access. Option C is incorrect because a proxy fleet adds complexity and does not provide a single IP.

Answer

Deploy a single EC2 instance configured as a NAT instance in a public subnet.

Answer

Configure a fleet of proxy servers in an Auto Scaling group with a Network Load Balancer.

Answer

Use a VPC endpoint for Amazon S3 to access software updates.

Question 4

A company is designing a network for a real-time financial trading application. The application requires deterministic low-latency connectivity between two EC2 instances in different Availability Zones within the same VPC. Which placement group type and networking feature should the company use?

Accepted Answer

Cluster placement group and Elastic Fabric Adapter (EFA). Option B is correct because a cluster placement group provides the lowest latency and highest packet-per-second performance, and Elastic Fabric Adapter (EFA) provides low-latency networking for HPC. Option A is incorrect because a spread placement group is for fault isolation, not low latency. Option C is incorrect because a partition placement group is for large distributed systems. Option D is incorrect because TCP/IP networking has higher overhead than EFA.

Answer

Partition placement group and Elastic Network Adapter (ENA) with SR-IOV

Answer

Spread placement group and EC2 networking with jumbo frames

Answer

Cluster placement group and standard TCP/IP networking

Question 5

A company wants to allow its employees to securely access internal applications hosted in a VPC without traversing the internet. The company also wants to be able to enforce security policies at the user level. Which AWS service should the company use?

Accepted Answer

AWS Client VPN. Option C is correct because AWS Client VPN provides secure access to VPC resources with user-level authentication and authorization. Option A is incorrect because AWS Site-to-Site VPN is for site-to-site connectivity, not individual users. Option B is incorrect because Direct Connect is dedicated network connection, not for remote users. Option D is incorrect because a bastion host requires SSH/RDP and does not enforce user-level policies natively.

Answer

Bastion host in a public subnet

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 6

A company has a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to make API calls to Amazon S3. Which is the most secure way to provide this access without traffic leaving the AWS network?

Accepted Answer

Create a VPC gateway endpoint for Amazon S3 and attach it to the route table of the private subnet.. Option A is correct because a VPC gateway endpoint for S3 allows private connectivity to S3 without traversing the internet. Option B is incorrect because a NAT gateway would route traffic over the internet. Option C is incorrect because internet through an IGW is less secure. Option D is incorrect because a VPN connection is not needed.

Answer

Use an AWS Site-to-Site VPN to connect to a remote network that has access to S3.

Answer

Set up a NAT gateway in the public subnet and route the web server's traffic through it.

Answer

Use an internet gateway and a public IP address on the web server.

Question 7

A company is designing a multi-account AWS environment using AWS Organizations. The company wants to centralize outbound internet traffic from all VPCs in all accounts through a single VPC in a shared services account. The shared services account has a VPC with a NAT gateway and an internet gateway. Which architecture meets this requirement?

Accepted Answer

Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.. Option B is correct because a transit gateway with a default route to the shared services VPC and a NAT gateway there provides centralized outbound internet access. Option A is incorrect because VPC peering does not support transitive routing. Option C is incorrect because a VPN connection is not needed. Option D is incorrect because VPC endpoints are for specific services, not general internet.

Answer

Create VPC gateway endpoints for all AWS services in each VPC.

Answer

Set up a VPN connection from each VPC to the shared services VPC and use the latter's internet gateway.

Answer

Peer each VPC to the shared services VPC and configure a default route pointing to the shared services VPC's NAT gateway.

Question 8

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

Accepted Answer

No instances in the VPC can resolve DNS records from the private hosted zone.. Option B is correct because when DNS support is disabled, instances in the VPC cannot use the DNS resolution provided by the VPC's Route 53 Resolver, including private hosted zones. Option A is incorrect because the VPC's DNS resolution affects all resources. Option C is incorrect because the private hosted zone is still associated but not resolvable. Option D is incorrect because the DHCP option set is separate.

Answer

Only instances in public subnets can resolve private hosted zone records.

Answer

The DHCP option set must be updated to provide DNS resolution.

Answer

The private hosted zone is automatically deleted.

Question 9

A company wants to connect multiple VPCs in different AWS Regions using AWS Transit Gateway. The company requires full mesh connectivity with centralized inspection of inter-Region traffic. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create Transit Gateway peering attachments between the Transit Gateways in each Region.. Options B and D are correct. B: Transit Gateway peering attachments allow inter-Region connectivity. D: Centralized inspection is achieved by routing traffic through a shared services VPC with a network appliance. Option A is incorrect because VPN attachments are not needed for inter-Region connectivity. Option C is incorrect because VPC peering does not scale. Option E is incorrect because cross-Region peering is supported.

Answer

Create VPN attachments between each Transit Gateway and the inspection VPC.

Answer

Use VPC peering connections between VPCs in different Regions.

Answer

Disable cross-Region peering on the Transit Gateway.

Question 10

A company is designing a network for a critical application that requires an SLA of 99.99% availability. The application runs on EC2 instances in an Auto Scaling group across three Availability Zones. The company needs to ensure that the network design meets the SLA. Which THREE components should the company include? (Choose THREE.)

Accepted Answer

A NAT gateway in each Availability Zone for outbound internet access.. Options A, B, and C are correct. A: Application Load Balancer distributes traffic across AZs. B: NAT gateways in each AZ provide highly available outbound access. C: VPC endpoints avoid internet dependency. Option D is incorrect because a single Direct Connect connection is a single point of failure. Option E is incorrect because a VPN connection alone is not highly available.

Answer

A single AWS Direct Connect connection for all inbound traffic.

Answer

A single AWS Site-to-Site VPN connection for administrative access.

Question 11

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances in the same VPC. Which TWO AWS services can support this requirement? (Choose TWO.)

Accepted Answer

AWS VPC Lattice. Options B and D are correct. B: VPC Lattice supports multicast. D: Transit Gateway with multicast domain supports multicast. Option A is incorrect because a Network Load Balancer does not support multicast. Option C is incorrect because a Gateway Load Balancer does not support multicast. Option E is incorrect because Application Load Balancer does not support multicast.

Answer

Network Load Balancer (NLB)

Answer

Application Load Balancer (ALB)

Answer

Gateway Load Balancer (GWLB)

Question 12

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in a VPC. The application experiences unpredictable traffic spikes. The company notices that during peak traffic, the ALB returns 503 errors. The network engineer checks the ALB's CloudWatch metrics and sees that the 'ActiveConnectionCount' is high but 'TargetResponseTime' is low. The ALB's target group is configured with a deregistration delay of 300 seconds. The ALB is internet-facing and uses an SSL/TLS certificate from AWS Certificate Manager. The security group for the ALB allows inbound HTTPS from 0.0.0.0/0. The target instances' security group allows inbound traffic from the ALB's security group. The VPC has a CIDR of 10.0.0.0/16 with public and private subnets. The ALB is in public subnets, and the instances are in private subnets. The route tables for private subnets have a default route to a NAT gateway in the public subnets. The company wants to resolve the 503 errors. What should the network engineer do?

Accepted Answer

Increase the idle timeout setting on the ALB to a higher value.. Option C is correct. The 503 errors are likely due to the ALB's connection limit or insufficient target capacity. Since target response time is low, the targets are not overloaded. The deregistration delay of 300 seconds may cause connections to drain slowly, but the main issue is that the ALB may be hitting its connection limit. Increasing the ALB's idle timeout will allow connections to stay open longer, reducing the rate of new connections. Option A is incorrect because increasing the deregistration delay would make the problem worse. Option B is incorrect because the ALB is already in public subnets. Option D is incorrect because disabling cross-zone load balancing would reduce capacity.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay to 600 seconds.

Answer

Move the ALB to private subnets and use a NAT gateway for internet access.

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16. It has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The company hosts a web application on EC2 instances in the private subnets behind an Application Load Balancer (ALB) in the public subnets. The ALB is internet-facing. The company wants to add a second ALB in the same VPC for a different application but using the same public subnets. The new ALB also needs to be internet-facing. However, when the company tries to create the new ALB, they receive an error: 'The subnet 'subnet-xxxxxxxx' does not have enough free IP addresses to satisfy the request.' The network engineer checks the subnets and finds that the public subnets have only 2 free IP addresses each. The private subnets have plenty of free IP addresses. The company wants to resolve this error without changing the architecture of the existing applications. What should the network engineer do?

Accepted Answer

Create new public subnets with larger CIDR blocks (e.g., /23) and associate them with the same route table.. Option B is correct. The public subnets are running out of IP addresses. Adding new public subnets with larger CIDR blocks (e.g., /23) will provide more IP addresses without affecting the existing subnets. Option A is incorrect because the private subnets cannot be used for internet-facing ALBs. Option C is incorrect because shrinking existing subnets would disrupt running resources. Option D is incorrect because launching a NAT gateway does not add IP addresses to subnets.

Answer

Use the private subnets for the new ALB and add a NAT gateway for internet access.

Answer

Reduce the size of the existing public subnets by modifying their CIDR blocks.

Answer

Launch a NAT gateway in one public subnet to free up IP addresses.

Question 14

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has created a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. However, the EC2 instance cannot reach the internet. The network engineer verifies that the NAT gateway has an Elastic IP address, the security group and network ACLs allow outbound traffic, and the route table for the public subnet has a route to an internet gateway. What is the most likely cause of the issue?

Accepted Answer

The route table associated with the NAT gateway's subnet does not have a route to an internet gateway.. Option D is correct. The NAT gateway must be in a public subnet with a route to an internet gateway. The question states the public subnet has that route, so that's fine. However, the NAT gateway itself needs to be associated with a route table that has a route to the internet gateway. The most likely cause is that the NAT gateway's route table does not have a default route to the internet gateway. Option A is incorrect because the NAT gateway has an Elastic IP. Option B is incorrect because the security group is not the issue. Option C is incorrect because the private subnet's route is correct.

Answer

The security group for the EC2 instance does not allow outbound traffic.

Answer

The route table for the private subnet does not have a route to the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Question 15

A company is designing a multi-Region active-active application using Application Load Balancers (ALBs) behind AWS Global Accelerator. They require that traffic from a specific client IP address is always routed to the same AWS Region for session persistence. Which Global Accelerator feature should be used?

Accepted Answer

Enable client IP address affinity (sticky sessions).. Option B is correct because Global Accelerator's sticky sessions (client IP address affinity) ensure that traffic from a given client IP is routed to the same endpoint for a set duration. Option A is incorrect because health checks determine endpoint health but do not enforce stickiness. Option C is incorrect because traffic dials control traffic distribution percentages but cannot pin a client to one endpoint. Option D is incorrect because endpoint weights distribute traffic proportionally but do not guarantee stickiness.

Answer

Configure health checks on the endpoints.

Answer

Assign endpoint weights to each ALB.

Answer

Set traffic dials to 100% for both Regions.