ANS-C01 Network Design Practice Test 32 — 15 Questions

Question 1

A company runs a critical application on Amazon EC2 instances in a VPC. The application receives data from an on-premises data center over an AWS Direct Connect connection. The company wants to add redundant connectivity using a VPN connection over the internet. They need to ensure that traffic from on-premises to AWS uses the Direct Connect connection when it is healthy, and only fails over to the VPN if Direct Connect fails. Which configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN, and set a higher MED value on the VPN routes.. Advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /20) over VPN, combined with a higher MED value on the VPN routes, ensures that the Direct Connect path is preferred when healthy. BGP selects the most specific prefix first, and if prefixes are identical, lower MED is preferred; here, the more specific prefix over Direct Connect wins, and the higher MED on VPN acts as a tie-breaker for any overlapping less specific routes, guaranteeing failover only when Direct Connect is unavailable.

Answer

Advertise the same prefix over both connections but prepend AS_PATH multiple times on the Direct Connect routes.

Answer

Set a higher BGP weight on the VPN routes.

Answer

Set a lower BGP local preference on the Direct Connect routes.

Question 2

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

Accepted Answer

Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.. Placing the RDS DB instance in a private subnet ensures it has no public IP address, and configuring a security group to allow inbound traffic from the on-premises CIDR over the Site-to-Site VPN provides a secure, direct connection without exposing the database to the internet. Security groups act as a stateful firewall at the instance level, allowing only specified traffic from the on-premises network through the VPN tunnel.

Answer

Assign a public IP address to the DB instance and restrict access using a security group.

Answer

Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.

Answer

Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.

Question 3

A company is migrating its on-premises data center to AWS. The migration requires connectivity between the on-premises network and a VPC. The company needs a connection that supports multiple VLANs for separate environments (development, test, production) and provides consistent performance. The company also wants to avoid using the public internet. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet for consistent performance. It supports multiple VLANs (802.1Q) via Virtual LANs (VLANs) on a single Direct Connect circuit, allowing separate logical networks for development, test, and production environments. This meets the requirements for private connectivity, multi-VLAN support, and predictable performance.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 4

A company has a VPC with multiple subnets and an AWS Transit Gateway. They have a requirement to inspect traffic between subnets using a third-party firewall appliance that is deployed in a centralized inspection VPC. The firewall appliance must process all traffic between the VPC subnets, including traffic between subnets in the same Availability Zone. Which routing configuration achieves this?

Accepted Answer

None of the options are correct.. None of the provided routing configurations can achieve this requirement because the local route for the VPC CIDR in any VPC route table cannot be overridden. Therefore, intra-VPC traffic will always use the local route and will not be sent to the Transit Gateway. To inspect traffic between subnets within the same VPC, alternative architectures such as a Gateway Load Balancer or a Transit Gateway with VPC peering between different VPCs must be used.

Answer

Create a VPC route table that routes all traffic (0.0.0.0/0) to the Transit Gateway.

Answer

Create a VPC route table that routes the VPC CIDR to the Transit Gateway and associate it with each subnet.

Answer

Use the main route table and add a route for the VPC CIDR to the Transit Gateway.

Question 5

A company is designing a VPC with both IPv4 and IPv6 workloads. The VPC has an internet gateway, and the company wants to allow outbound IPv6 traffic to the internet from instances in a private subnet while blocking inbound IPv6 traffic from the internet. Which configuration should be used?

Accepted Answer

Configure an egress-only internet gateway in the VPC and add a route for ::/0 to the egress-only internet gateway in the private subnet's route table.. An egress-only internet gateway (EIGW) is a horizontally scaled, redundant component that allows outbound IPv6 traffic from instances in a private subnet to the internet, but prevents the internet from initiating an inbound IPv6 connection to those instances. By adding a default route (::/0) pointing to the EIGW in the private subnet's route table, outbound IPv6 traffic is forwarded to the internet gateway, while the EIGW inherently drops any unsolicited inbound IPv6 traffic. This meets the requirement exactly, as security groups and network ACLs alone cannot fully block inbound IPv6 from the internet when a standard internet gateway is used.

Answer

Configure a security group that allows outbound traffic and denies inbound traffic.

Answer

Configure a virtual private gateway and route traffic through it.

Answer

Configure a NAT gateway in a public subnet.

Question 6

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing Amazon EC2 instances. The instances in the private subnet need to download patches from the internet. The NAT gateway is in the public subnet and has an Elastic IP address. The private subnet's route table has a default route pointing to the NAT gateway. However, the instances cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. The NAT gateway resides in the public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. The missing IGW route in the public subnet breaks the outbound path.

Answer

The NAT gateway does not have a route back to the private subnet.

Answer

The NAT gateway is not associated with a security group that allows inbound internet traffic.

Answer

The security group attached to the EC2 instances does not allow outbound traffic to the internet.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: Subnet A (10.0.1.0/24) and Subnet B (10.0.2.0/24). They launch an EC2 instance in Subnet A and assign it a primary private IP address of 10.0.1.50. They then attach a second elastic network interface (ENI) to the instance with a primary private IP of 10.0.2.100. The instance needs to send traffic from the second ENI. However, when the instance sends traffic from the second ENI, it fails. What is the MOST likely cause?

Accepted Answer

The instance's operating system routing table does not have a route for the second ENI's subnet.. When an EC2 instance has multiple ENIs, the operating system's routing table must have explicit routes for each ENI's subnet to ensure traffic leaves via the correct interface. By default, the OS only adds a route for the primary ENI's subnet, so traffic from the second ENI (10.0.2.100) fails because the OS tries to send it out the primary ENI, which is in a different subnet. This is a common cause of asymmetric routing or connectivity failure.

Answer

The two ENIs are in different subnets, which is not allowed.

Answer

The security group for the second ENI does not allow outbound traffic.

Answer

The subnet route table does not have a route for the second ENI's IP address.

Question 8

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible from the internet. Which component must be attached to the VPC to allow internet traffic to reach the ALB?

Accepted Answer

Internet gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For an Application Load Balancer (ALB) to receive traffic from the internet, the ALB must be deployed in public subnets, and those subnets must have a route table entry pointing 0.0.0.0/0 to an IGW. Without the IGW, the ALB cannot accept inbound connections from the internet.

Answer

NAT gateway

Answer

Virtual private gateway

Answer

Transit gateway

Question 9

A company is designing a multi-VPC architecture in a single AWS Region. The company has three VPCs: Production, Development, and Shared Services. They want to enable transitive routing between all VPCs while minimizing operational overhead. Which TWO solutions meet these requirements?

Accepted Answer

Use AWS Transit Gateway to connect all VPCs.. AWS Transit Gateway (Option C) serves as a central hub for transitive routing between all connected VPCs, eliminating the need for full-mesh peering. It automatically handles route propagation and attachment management, significantly reducing operational overhead. Option E also uses AWS Transit Gateway as the core, but connects VPCs via VPN attachments to an on-premises router that performs the inter-VPC routing. While this adds some overhead due to the on-premises component, it still provides transitive routing without requiring a full mesh of VPC-to-VPC connections, thus meeting the requirements. Options A and B require full meshes or many point-to-point connections, increasing overhead. Option D introduces an on-premises router but lacks a central hub for VPC-to-VPC routing without additional configuration.

Answer

Establish VPC peering connections between each pair of VPCs.

Answer

Configure a VPN connection between each VPC.

Answer

Configure AWS Direct Connect connections from each VPC to the same on-premises router.

Question 10

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have subnets in three Availability Zones. They need to add IPv6 connectivity to the VPC and allow instances in private subnets to initiate outbound IPv6 connections to the internet, but not allow inbound connections from the internet. Which TWO actions must be taken?

Accepted Answer

Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables.. An egress-only internet gateway (EIGW) is a horizontally scaled, redundant component that allows outbound IPv6 traffic from instances in private subnets to the internet, while preventing inbound connections initiated from the internet. Adding a route for ::/0 to the EIGW in the private subnet route tables enables this outbound-only IPv6 connectivity. Option C is correct because the VPC must have an associated IPv6 CIDR block (allocated from Amazon's pool or a BYOIP range) before any IPv6 routing or gateway functionality can be used.

Answer

Create an internet gateway and add a route for ::/0 to it in the private subnet route tables.

Answer

Create a NAT gateway in a public subnet.

Answer

Configure a security group that allows outbound IPv6 traffic.

Question 11

A company wants to connect its on-premises network to AWS using AWS Direct Connect. The company has two data centers, each with a redundant connection to an AWS Direct Connect location. The company wants to ensure high availability and failover capability. Which THREE steps should be taken?

Accepted Answer

Order at least two Direct Connect connections from different providers or locations.. Ordering at least two Direct Connect connections from different providers or locations ensures physical diversity, eliminating single points of failure. This aligns with AWS best practices for high availability, as a single connection or provider can fail due to outages or maintenance. Redundant connections from separate providers or locations provide independent failure domains.

Answer

Configure a VPN connection as a backup in case Direct Connect fails.

Answer

Provision multiple virtual interfaces on a single Direct Connect connection.

Question 12

A company is running a multi-tier web application across two AWS Regions (us-east-1 and eu-west-1) for disaster recovery. The application uses an Application Load Balancer (ALB) in each Region. The company uses Amazon Route 53 with latency-based routing to direct traffic to the closest Region. Recently, during a regional failure in us-east-1, users experienced timeouts instead of being redirected to eu-west-1. The DNS TTL is set to 60 seconds. The Route 53 health checks for the us-east-1 ALB are configured to check the HTTP endpoint every 30 seconds with 3 consecutive failures required to mark it unhealthy. The eu-west-1 ALB is healthy. The company's network design includes a VPC in each Region with public and private subnets. The ALBs are internet-facing and have proper security groups. The Route 53 records are configured correctly. What is the MOST likely cause of the timeout?

Accepted Answer

The health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint.. The most likely cause is that the health check interval and failure threshold create a delay in detection, and DNS caching causes clients to still resolve to the unhealthy endpoint. Route 53 health checks check the endpoint every 30 seconds and require 3 consecutive failures to mark it unhealthy, resulting in up to 90 seconds (3 * 30s) before the health check fails. Additionally, DNS resolvers cache the resolved IP address for the TTL of 60 seconds. Therefore, even after the health check marks the endpoint unhealthy, some clients may still have the cached IP and attempt to connect to the failed us-east-1 ALB, causing timeouts. Option A is incorrect because latency-based routing does fail over when health checks fail; the issue is the delay. Option B is incorrect because cross-zone load balancing is irrelevant to multi-region failover. Option D is incorrect because Route 53 health checks are global and can reach any region.

Answer

The latency-based routing policy does not fail over to the other region when a health check fails.

Answer

The ALB in us-east-1 is not configured to be cross-zone load balancing, causing it to fail.

Answer

The Route 53 health check is not able to reach the ALB in us-east-1 from eu-west-1 due to network ACLs.

Question 13

A company has a VPC with a CIDR block of 10.0.0.0/16. They have three subnets: Subnet A (10.0.1.0/24) in us-east-1a, Subnet B (10.0.2.0/24) in us-east-1b, and Subnet C (10.0.3.0/24) in us-east-1c. The company has deployed a set of EC2 instances in Subnet A that need to access an Amazon S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet and remains within the AWS network. The VPC has a VPC endpoint for S3 (gateway type) created and associated with the route table for Subnet A. However, the instances are unable to access the S3 bucket. What is the MOST likely cause?

Accepted Answer

The route table for Subnet A does not have a route for the S3 prefix list pointing to the VPC endpoint.. A gateway VPC endpoint for S3 is only accessible from the subnet whose route table has a route to the endpoint. The route table for Subnet A must have a route for the S3 prefix list pointing to the VPC endpoint. If that route is missing, traffic will not use the endpoint. Option A is incorrect because a VPC endpoint does not require an internet gateway. Option C is incorrect because a gateway endpoint does not use security groups; it uses endpoint policies. Option D is incorrect because the endpoint policy does not need to be explicitly attached to the bucket; the bucket policy must grant access to the VPC endpoint.

Answer

The VPC does not have an internet gateway attached.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The VPC endpoint is not associated with a security group that allows outbound traffic to S3.

Question 14

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. The NAT gateway is in the public subnet, but the public subnet's route table must have a route to an internet gateway (0.0.0.0/0 -> IGW) for the NAT gateway to forward traffic to the internet. Without that route, the NAT gateway cannot communicate with the internet. Option A is incorrect because NAT gateways do not use security groups. Option B is incorrect because the NAT gateway has an Elastic IP and is properly allocated; the issue is not with the Elastic IP. Option D is incorrect because the private subnet's route table already has a route to the NAT gateway (0.0.0.0/0 -> NAT), which is correctly configured.

Answer

The NAT gateway is not associated with a security group that allows outbound traffic.

Answer

The NAT gateway's Elastic IP address is not properly allocated.

Answer

The private subnet's route table does not have a route to the NAT gateway.

Question 15

A company is deploying a multi-tier web application across two AWS Regions with an active-passive failover architecture. The application uses Application Load Balancers (ALBs) in each Region, and traffic must be directed to the active Region using DNS. Which routing policy should be used for the Amazon Route 53 record set to achieve this?

Accepted Answer

Failover routing policy. The failover routing policy in Amazon Route 53 is designed specifically for active-passive failover architectures. It uses health checks to monitor the primary endpoint (active Region) and automatically routes traffic to the secondary endpoint (passive Region) only when the primary health check fails. This matches the requirement of directing traffic to the active Region using DNS.

Answer

Geolocation routing policy

Answer

Weighted routing policy

Answer

Latency routing policy