ANS-C01 Network Design Practice Test 32 — 15 Questions

Question 1

A company runs a critical application on Amazon EC2 instances in a VPC. The application receives data from an on-premises data center over an AWS Direct Connect connection. The company wants to add redundant connectivity using a VPN connection over the internet. They need to ensure that traffic from on-premises to AWS uses the Direct Connect connection when it is healthy, and only fails over to the VPN if Direct Connect fails. Which configuration achieves this?

Accepted Answer

Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN, and set a higher MED value on the VPN routes.. Option A is correct. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /23) over VPN, BGP will prefer the more specific route. Additionally, setting a higher MED value on the VPN routes makes Direct Connect routes preferred. Option B is incorrect because longer AS_PATH in BGP makes a route less preferred. Option C is incorrect because a lower local preference makes a route less preferred. Option D is incorrect because a higher weight makes a route more preferred, which would prefer VPN.

Answer

Advertise the same prefix over both connections but prepend AS_PATH multiple times on the Direct Connect routes.

Answer

Set a higher BGP weight on the VPN routes.

Answer

Set a lower BGP local preference on the Direct Connect routes.

Question 2

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

Accepted Answer

Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.. Option C is correct. The most secure approach is to place the RDS instance in a private subnet with a security group that only allows inbound traffic from the on-premises network's CIDR range. Since the connection comes over the VPN (private network), it is not necessary to expose the database to the internet. Option A is incorrect because making the DB instance publicly accessible is a security risk. Option B is incorrect because a network ACL is stateless and less granular than a security group; also, allowing all traffic to the DB subnet is overly permissive. Option D is incorrect because a NAT gateway is for outbound traffic, not inbound.

Answer

Assign a public IP address to the DB instance and restrict access using a security group.

Answer

Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.

Answer

Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.

Question 3

A company is migrating its on-premises data center to AWS. The migration requires connectivity between the on-premises network and a VPC. The company needs a connection that supports multiple VLANs for separate environments (development, test, production) and provides consistent performance. The company also wants to avoid using the public internet. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. Option B is correct. AWS Direct Connect provides a private, dedicated connection from on-premises to AWS, supporting multiple VLANs via Virtual Local Area Networks (VLANs) on a single physical connection. This meets the requirements for isolation and consistent performance. Option A is incorrect because Site-to-Site VPN uses the public internet and does not support VLANs natively. Option C is incorrect because Client VPN is for individual user connections, not site-to-site. Option D is incorrect because Transit Gateway is a network transit hub, not a connectivity service; it can be used with Direct Connect or VPN but is not the connection itself.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 4

A company has a VPC with multiple subnets and an AWS Transit Gateway. They have a requirement to inspect traffic between subnets using a third-party firewall appliance that is deployed in a centralized inspection VPC. The firewall appliance must process all traffic between the VPC subnets, including traffic between subnets in the same Availability Zone. Which routing configuration achieves this?

Accepted Answer

Create a VPC route table that routes the VPC CIDR to the Transit Gateway and associate it with each subnet.. Option D is correct. To force all inter-subnet traffic through the Transit Gateway, you must create a VPC route table that routes traffic destined for other subnets (the VPC's CIDR) to the Transit Gateway. This ensures traffic leaves the VPC and goes through the Transit Gateway to the inspection VPC. Option A is incorrect because the default route for intra-VPC traffic is local, which would bypass the Transit Gateway. Option B is incorrect because the main route table still has the local route for the VPC CIDR, so traffic between subnets stays within the VPC. Option C is incorrect because subnet route tables are attached to subnets, but if the route tables have the local route for the VPC CIDR, traffic will not go to the Transit Gateway.

Answer

Create a VPC route table that routes all traffic (0.0.0.0/0) to the Transit Gateway.

Answer

Use the main route table and add a route for the VPC CIDR to the Transit Gateway.

Answer

Associate each subnet with a custom route table that has a route for the VPC CIDR to the Transit Gateway.

Question 5

A company is designing a VPC with both IPv4 and IPv6 workloads. The VPC has an internet gateway, and the company wants to allow outbound IPv6 traffic to the internet from instances in a private subnet while blocking inbound IPv6 traffic from the internet. Which configuration should be used?

Accepted Answer

Configure an egress-only internet gateway in the VPC and add a route for ::/0 to the egress-only internet gateway in the private subnet's route table.. Option B is correct. An egress-only internet gateway allows outbound IPv6 traffic from instances in a private subnet to the internet, but prevents the internet from initiating connections to those instances. It is the IPv6 equivalent of a NAT gateway for IPv4. Option A is incorrect because a NAT gateway only supports IPv4. Option C is incorrect because a virtual private gateway is for VPN connections, not internet access. Option D is incorrect because a security group can control traffic but cannot provide outbound-only internet access for IPv6.

Answer

Configure a security group that allows outbound traffic and denies inbound traffic.

Answer

Configure a virtual private gateway and route traffic through it.

Answer

Configure a NAT gateway in a public subnet.

Question 6

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing Amazon EC2 instances. The instances in the private subnet need to download patches from the internet. The NAT gateway is in the public subnet and has an Elastic IP address. The private subnet's route table has a default route pointing to the NAT gateway. However, the instances cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. Option D is correct. For a NAT gateway to work, it must be in a public subnet with a route to an internet gateway. If the public subnet does not have a route to the internet gateway, the NAT gateway cannot forward traffic to the internet. Option A is incorrect because security groups for instances in private subnets should allow outbound traffic, but that is not the most likely cause. Option B is incorrect because the NAT gateway automatically replies to traffic; no route back is needed for responses. Option C is incorrect because the NAT gateway does not need a security group; it uses network ACLs and route tables.

Answer

The NAT gateway does not have a route back to the private subnet.

Answer

The NAT gateway is not associated with a security group that allows inbound internet traffic.

Answer

The security group attached to the EC2 instances does not allow outbound traffic to the internet.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: Subnet A (10.0.1.0/24) and Subnet B (10.0.2.0/24). They launch an EC2 instance in Subnet A and assign it a primary private IP address of 10.0.1.50. They then attach a second elastic network interface (ENI) to the instance with a primary private IP of 10.0.2.100. The instance needs to send traffic from the second ENI. However, when the instance sends traffic from the second ENI, it fails. What is the MOST likely cause?

Accepted Answer

The instance's operating system routing table does not have a route for the second ENI's subnet.. Option C is correct. When an EC2 instance has multiple ENIs, each ENI must be in a different subnet. However, the operating system's routing table sends traffic based on the source IP. If the default route is associated with the primary ENI, traffic sourced from the second ENI's IP will use the primary ENI's route, which may not allow it to leave through the correct subnet. The solution is to configure the OS to use the correct ENI for outbound traffic based on the source IP. Option A is incorrect because security groups are per-ENI and do not cause this issue. Option B is incorrect because there is no requirement for the ENIs to be in the same subnet. Option D is incorrect because the routing table in the subnet does not determine which ENI the instance uses.

Answer

The two ENIs are in different subnets, which is not allowed.

Answer

The security group for the second ENI does not allow outbound traffic.

Answer

The subnet route table does not have a route for the second ENI's IP address.

Question 8

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible from the internet. Which component must be attached to the VPC to allow internet traffic to reach the ALB?

Accepted Answer

Internet gateway. Option A is correct. An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between the VPC and the internet. It is required for internet-facing load balancers. Option B is incorrect because a NAT gateway is for outbound-only traffic from private subnets. Option C is incorrect because a virtual private gateway is for VPN connections. Option D is incorrect because a transit gateway is for connecting multiple VPCs and on-premises networks.

Answer

NAT gateway

Answer

Virtual private gateway

Answer

Transit gateway

Question 9

A company is designing a multi-VPC architecture in a single AWS Region. The company has three VPCs: Production, Development, and Shared Services. They want to enable transitive routing between all VPCs while minimizing operational overhead. Which TWO solutions meet these requirements?

Accepted Answer

Use AWS Transit Gateway to connect all VPCs.. Option A is correct: Transit Gateway provides transitive routing between multiple VPCs and supports hub-and-spoke architecture. Option D is correct: A centralized VPN to on-premises can provide transitive routing if all VPCs connect to the same VPN via Transit Gateway. Option B is incorrect because VPC peering is not transitive; each pair must be explicitly peered. Option C is incorrect because a VPN connection between two VPCs would require each pair to be connected. Option E is incorrect because Direct Connect alone does not provide transitive routing between VPCs.

Answer

Establish VPC peering connections between each pair of VPCs.

Answer

Configure a VPN connection between each VPC.

Answer

Configure AWS Direct Connect connections from each VPC to the same on-premises router.

Question 10

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have subnets in three Availability Zones. They need to add IPv6 connectivity to the VPC and allow instances in private subnets to initiate outbound IPv6 connections to the internet, but not allow inbound connections from the internet. Which TWO actions must be taken?

Accepted Answer

Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables.. Option A is correct: Allocate an IPv6 CIDR block to the VPC and associate it with subnets. Option D is correct: Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables. Option B is incorrect because a NAT gateway is for IPv4. Option C is incorrect because an internet gateway allows bidirectional IPv6 traffic, which would allow inbound connections. Option E is incorrect because a security group is used for fine-grained control but does not provide internet connectivity.

Answer

Create an internet gateway and add a route for ::/0 to it in the private subnet route tables.

Answer

Create a NAT gateway in a public subnet.

Answer

Configure a security group that allows outbound IPv6 traffic.

Question 11

A company wants to connect its on-premises network to AWS using AWS Direct Connect. The company has two data centers, each with a redundant connection to an AWS Direct Connect location. The company wants to ensure high availability and failover capability. Which THREE steps should be taken?

Accepted Answer

Order at least two Direct Connect connections from different providers or locations.. Option A is correct: Order two or more Direct Connect connections for redundancy. Option C is correct: Use Border Gateway Protocol (BGP) to exchange routes between on-premises and AWS. Option E is correct: Use a Direct Connect gateway to connect to multiple VPCs. Option B is incorrect because VPN is not required if Direct Connect is used, though it can be a backup. Option D is incorrect because multiple virtual interfaces can be established over a single connection, but that does not provide connection-level redundancy.

Answer

Configure a VPN connection as a backup in case Direct Connect fails.

Answer

Provision multiple virtual interfaces on a single Direct Connect connection.

Question 12

A company is running a multi-tier web application across two AWS Regions (us-east-1 and eu-west-1) for disaster recovery. The application uses an Application Load Balancer (ALB) in each Region. The company uses Amazon Route 53 with latency-based routing to direct traffic to the closest Region. Recently, during a regional failure in us-east-1, users experienced timeouts instead of being redirected to eu-west-1. The DNS TTL is set to 60 seconds. The Route 53 health checks for the us-east-1 ALB are configured to check the HTTP endpoint every 30 seconds with 3 consecutive failures required to mark it unhealthy. The eu-west-1 ALB is healthy. The company's network design includes a VPC in each Region with public and private subnets. The ALBs are internet-facing and have proper security groups. The Route 53 records are configured correctly. What is the MOST likely cause of the timeout?

Accepted Answer

The health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint.. Option A is correct. Health checks check the endpoint every 30 seconds, and require 3 consecutive failures to mark unhealthy. This means it takes 90 seconds (30s * 3) to detect failure. During that time, Route 53 continues to return the us-east-1 ALB IP, and users' DNS resolvers cache the IP for the TTL of 60 seconds. Therefore, even after the health check marks the endpoint unhealthy, some users may still have the cached IP and experience timeouts. Option B is incorrect because latency-based routing would automatically shift traffic to eu-west-1 when us-east-1 is unhealthy. Option C is incorrect because the ALB is internet-facing and should be accessible from other regions. Option D is incorrect because Route 53 health checks can check endpoints across regions.

Answer

The latency-based routing policy does not fail over to the other region when a health check fails.

Answer

The ALB in us-east-1 is not configured to be cross-zone load balancing, causing it to fail.

Answer

The Route 53 health check is not able to reach the ALB in us-east-1 from eu-west-1 due to network ACLs.

Question 13

A company has a VPC with a CIDR block of 10.0.0.0/16. They have three subnets: Subnet A (10.0.1.0/24) in us-east-1a, Subnet B (10.0.2.0/24) in us-east-1b, and Subnet C (10.0.3.0/24) in us-east-1c. The company has deployed a set of EC2 instances in Subnet A that need to access an Amazon S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet and remains within the AWS network. The VPC has a VPC endpoint for S3 (gateway type) created and associated with the route table for Subnet A. However, the instances are unable to access the S3 bucket. What is the MOST likely cause?

Accepted Answer

The route table for Subnet A does not have a route for the S3 prefix list pointing to the VPC endpoint.. Option B is correct. A gateway VPC endpoint for S3 is only accessible from the subnet whose route table has a route to the endpoint. The route table for Subnet A must have a route for the S3 prefix list pointing to the VPC endpoint. If that route is missing, traffic will not use the endpoint. Option A is incorrect because a VPC endpoint does not require an internet gateway. Option C is incorrect because a gateway endpoint does not use security groups; it uses endpoint policies. Option D is incorrect because the endpoint policy does not need to be explicitly attached to the bucket; the bucket policy must grant access to the VPC endpoint.

Answer

The VPC does not have an internet gateway attached.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The VPC endpoint is not associated with a security group that allows outbound traffic to S3.

Question 14

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. Option B is correct. The public subnet must have a route to an internet gateway for the NAT gateway to work. The NAT gateway resides in the public subnet, but if that subnet's route table does not have a route to an internet gateway, the NAT gateway cannot forward traffic to the internet. Option A is incorrect because the NAT gateway does not need a security group. Option C is incorrect because the private subnet's route table has a route to the NAT gateway. Option D is incorrect because the Elastic IP is needed for the NAT gateway, and if it is attached, it is not the cause.

Answer

The NAT gateway is not associated with a security group that allows outbound traffic.

Answer

The NAT gateway's Elastic IP address is not properly allocated.

Answer

The private subnet's route table does not have a route to the NAT gateway.

Question 15

A company is deploying a multi-tier web application across two AWS Regions with an active-passive failover architecture. The application uses Application Load Balancers (ALBs) in each Region, and traffic must be directed to the active Region using DNS. Which routing policy should be used for the Amazon Route 53 record set to achieve this?

Accepted Answer

Failover routing policy. Option B is correct because a failover routing policy is used for active-passive configurations where one resource is primary and the other is secondary, allowing Route 53 to direct traffic to the active region and fail over to the passive region if the primary becomes unhealthy. Option A (weighted) distributes traffic across multiple resources. Option C (latency) routes based on lowest latency. Option D (geolocation) routes based on user location.

Answer

Geolocation routing policy

Answer

Weighted routing policy

Answer

Latency routing policy