ANS-C01 Network Design Practice Test 33 — 15 Questions

Question 1

A company wants to provide its employees with secure access to internal applications hosted in a VPC. The employees work remotely and use personal laptops. The solution must authenticate users against the company's existing identity provider (IdP) and must support both Windows and macOS clients. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Client VPN. AWS Client VPN is a fully managed, cloud-based VPN solution that allows remote employees to securely access resources in a VPC using their personal laptops. It supports both Windows and macOS clients natively and can integrate with the company's existing identity provider (IdP) via SAML-based authentication, meeting all stated requirements.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Question 2

A company is designing a network architecture for a multi-tier web application. The application consists of web servers, application servers, and database servers. The web servers must be accessible from the internet. The application servers should only be accessible from the web servers. The database servers should only be accessible from the application servers. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Place the web servers in a public subnet and the application and database servers in private subnets. The correct answers are C and D. Option C: Placing web servers in a public subnet (with an internet gateway) enables internet access, while placing application and database servers in private subnets prevents direct internet access, ensuring they are only reachable from within the VPC. Option D: Security groups act as stateful firewalls at the instance level, allowing fine-grained control over traffic between tiers (e.g., allowing only HTTP from web to app servers, and only database port from app to database servers). Option A is incorrect because a NAT gateway provides outbound internet access for private instances, not inbound access for web servers. Option B is incorrect because network ACLs are stateless and less granular; while they can restrict traffic between subnets, security groups are the recommended approach for tier-to-tier access control. Option E is incorrect because placing all servers in public subnets exposes application and database servers to the internet unnecessarily, increasing security risk.

Answer

Use a NAT gateway to allow the web servers to access the internet

Answer

Use network ACLs to restrict traffic between the tiers

Answer

Place all servers in public subnets and use security groups to restrict traffic

Question 3

A company has a VPC with public and private subnets. The public subnet contains a NAT gateway and a bastion host. The private subnet contains application servers. The company wants to ensure that the application servers can download patches from the internet. Which TWO steps should be taken to allow this while maintaining security? (Choose two.)

Accepted Answer

Allow outbound HTTPS (port 443) traffic from the application servers in the security group. The application servers need to initiate outbound HTTPS connections (port 443) to download patches from the internet. By allowing outbound HTTPS traffic in the security group associated with the application servers, you permit the necessary traffic while maintaining stateful filtering and restricting other outbound traffic. This is a security best practice that follows the principle of least privilege.

Answer

Modify the network ACL of the private subnet to allow all outbound traffic

Answer

Add a route in the public subnet route table that points 0.0.0.0/0 to the NAT gateway

Answer

Associate an Elastic IP address with the NAT gateway

Question 4

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Accepted Answer

Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.. It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.

Answer

Use VPC Peering for all inter-VPC communication

Answer

Use AWS Site-to-Site VPN between each VPC and a central VPN hub

Answer

Use AWS Client VPN to connect development VPCs to the production VPC

Question 5

A company is deploying a web application across multiple Availability Zones in a single AWS Region. The application consists of an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group, and an Amazon RDS Multi-AZ database. The company needs to ensure that the application can survive the loss of an entire Availability Zone. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones. Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) still have healthy EC2 instances to serve traffic. This is a fundamental requirement for multi-AZ high availability, as the Auto Scaling group will automatically replace failed instances in the remaining AZs.

Answer

Use larger EC2 instance types to handle the load

Answer

Deploy a single NAT Gateway in one AZ for outbound traffic

Question 6

A company is designing a global application that will serve users across North America and Europe. The application consists of a static website hosted on Amazon S3, a REST API hosted on Amazon API Gateway, and a backend application running on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The company wants to minimize latency for users by serving content from the closest AWS region. They also want to ensure high availability and automatic failover if a region becomes unavailable. The company is considering using Amazon Route 53 with a latency-based routing policy. However, they are concerned about DNS caching and propagation delays during failover. Which additional service should they use to improve the failover experience and provide a single endpoint for users?

Accepted Answer

Use AWS Global Accelerator to provide a static IP address and route traffic to the ALB in the closest healthy region. AWS Global Accelerator uses the AWS global network to route traffic to the closest healthy endpoint via the Anycast static IP addresses, bypassing DNS caching and propagation delays. It provides a single fixed endpoint for users and integrates with the ALB in each region, automatically failing over to the next healthy region within seconds when health checks fail.

Answer

Use a Network Load Balancer in each region and configure Route 53 with failover routing

Answer

Use Amazon CloudFront with multiple origins pointing to the S3 bucket and the ALB in each region

Answer

Use Lambda@Edge to dynamically route traffic based on the user's location

Question 7

A company is deploying a multi-tier web application in a VPC. The architecture includes an internet-facing Application Load Balancer (ALB) in public subnets, a fleet of EC2 instances in private subnets, and an Amazon RDS database in a separate private subnet. The security team requires that the web application logs be stored in an Amazon S3 bucket for compliance. The EC2 instances have an instance profile that grants write access to the S3 bucket. The EC2 instances are in a private subnet that does not have a route to the internet. The company wants to ensure that the EC2 instances can upload logs to the S3 bucket without traversing the internet. Which solution should they implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet's route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 over the AWS network without traversing the internet. Since the instances have an instance profile granting write access, adding a route in the private subnet's route table pointing to the gateway endpoint enables direct, private connectivity to S3. This meets the security requirement of keeping traffic within the AWS backbone.

Answer

Create a VPC Interface Endpoint for S3

Answer

Deploy a forward proxy server in a public subnet and configure the EC2 instances to use it

Answer

Attach a NAT Gateway to the private subnet and configure a route to the NAT Gateway

Question 8

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). The public subnet has an internet gateway attached, and the private subnet has a NAT Gateway in the public subnet for outbound internet access. The company is deploying an Amazon RDS for MySQL database in a Multi-AZ configuration. The database should be accessible only from the application servers running in the private subnet. The company wants to ensure that the database is highly available and that failover does not require any changes to the application. Which networking configuration should they use?

Accepted Answer

Create a DB subnet group with subnets in two Availability Zones, launch the RDS instance with Multi-AZ enabled, and configure the application to connect to the RDS endpoint DNS name. Creating a DB subnet group with subnets in two Availability Zones and enabling Multi-AZ on the RDS instance ensures automatic failover to a standby in another AZ. The application connects to the RDS endpoint DNS name, which automatically points to the current primary instance, so no application changes are needed during failover. This satisfies the high availability and access requirements while keeping the database in private subnets.

Answer

Place the RDS instances behind an internal Network Load Balancer and configure the application to connect to the NLB's DNS name

Answer

Create the RDS instance in the public subnet and restrict access using a security group that allows traffic from the private subnet

Answer

Configure the application to use the IP address of the primary RDS instance and update the application when failover occurs

Question 9

A company is designing a network for a containerized microservices application running on Amazon ECS. The application consists of several microservices that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. They also want to ensure that traffic between services is encrypted in transit. The microservices are deployed across multiple Availability Zones. Which combination of services should the company use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh for encryption in transit. AWS Cloud Map provides service discovery by registering microservices with DNS names and health checks, allowing ECS tasks to resolve each other by name. AWS App Mesh uses Envoy sidecar proxies to enforce mutual TLS (mTLS) encryption between services, ensuring traffic is encrypted in transit without requiring changes to application code. This combination meets the requirements for name-based discovery and encrypted inter-service communication across multiple Availability Zones.

Answer

Use an Application Load Balancer for each service and configure HTTPS listeners

Answer

Use VPC peering between each service's VPC

Answer

Use Amazon Route 53 private hosted zones for service discovery and enable encryption at the application layer

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They have an internet gateway attached to the public subnet. They deploy a web server on an EC2 instance in the public subnet and a database on an EC2 instance in the private subnet. The database should only be accessible from the web server. The company wants to secure the database by not assigning a public IP address to it. Which configuration will allow the web server to connect to the database?

Accepted Answer

Keep the database instance in the private subnet with no public IP, and configure the security group of the database to allow inbound traffic from the web server's security group on the database port. Security groups in AWS can reference other security groups as a source, allowing traffic from any instance associated with the source security group. By configuring the database's security group to allow inbound traffic on the database port from the web server's security group, the web server can connect to the database without the database needing a public IP address. This leverages AWS's built-in security group chaining, which works across subnets within the same VPC.

Answer

Create a VPC Peering connection between the public and private subnets

Answer

Assign a public IP address to the database instance and configure the security group to allow inbound traffic from the web server's public IP

Answer

Set up a VPN connection between the web server and the database

Question 11

A company has a VPC with a CIDR block of 192.168.0.0/16. They have two subnets: Subnet A (192.168.1.0/24) and Subnet B (192.168.2.0/24). They launch an EC2 instance in Subnet A and another EC2 instance in Subnet B. They want to ensure that both instances can communicate with each other. The instances are in the same VPC. What is the simplest way to enable communication between these instances?

Accepted Answer

No additional configuration is needed; instances in the same VPC can communicate by default. By default, all instances within the same VPC can communicate with each other using private IP addresses, regardless of which subnet they reside in. The VPC's implicit router enables this layer-3 connectivity as long as the subnets' route tables do not explicitly block traffic and the instances' security groups or network ACLs permit the traffic. Since both subnets are within the same VPC (192.168.0.0/16), no additional configuration is required for basic IP-level communication.

Answer

Create a VPC Peering connection between Subnet A and Subnet B

Answer

Create a NAT Gateway in each subnet

Answer

Attach an internet gateway to the VPC

Question 12

A company wants to design a multi-region active-active architecture with Amazon Route 53 latency-based routing and failover using health checks. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Configure a latency alias record for each region's resource. Latency-based routing in Route 53 uses alias records to route traffic based on the lowest latency for the end user. Configuring a latency alias record for each regional resource (e.g., an Application Load Balancer) allows Route 53 to respond with the IP of the resource that provides the best latency. Option D is correct because health checks must be associated with each latency record to enable failover; if a resource fails its health check, Route 53 removes it from the pool of healthy endpoints, ensuring traffic is only routed to healthy regions.

Answer

Use geolocation routing to direct users to the nearest region

Answer

Assign a weight to each record for traffic distribution

Answer

Set the failover record type to 'Active-Active'

Question 13

A company is designing a network for a new VPC. They want to ensure that the VPC can connect to an on-premises data center via a site-to-site VPN. The on-premises network uses a CIDR block of 10.0.0.0/8. The VPC will use a CIDR block of 10.0.0.0/16. The network engineer is concerned about overlapping IP addresses. What is the best way to avoid IP address overlap?

Accepted Answer

Use a different RFC 1918 CIDR block for the VPC. Using a different RFC 1918 CIDR block (e.g., 172.16.0.0/12 or 192.168.0.0/16) for the VPC completely avoids IP address overlap with the on-premises 10.0.0.0/8 network. Overlapping CIDR blocks (both using 10.0.0.0/8) would prevent successful route propagation and cause asymmetric routing or connectivity failures in the site-to-site VPN. NAT can mitigate overlap but adds complexity and is not the 'best' design choice when a non-overlapping private range is available.

Answer

Use the same CIDR block and rely on NAT

Answer

Use a smaller subnet within the same 10.0.0.0/8 range

Answer

Use a public IP range for the VPC

Question 14

A company is designing a hybrid network connecting on-premises data centers to AWS via AWS Direct Connect. The company requires high availability with multiple connections. Which design ensures that a failure of a single Direct Connect location does not impact connectivity?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Deploying two Direct Connect connections at two different Direct Connect locations ensures that a single location failure (e.g., power outage, fiber cut, or facility issue) does not affect connectivity. This design provides geographic redundancy, meeting the high availability requirement by eliminating a single point of failure at the Direct Connect location level.

Answer

Provision a single Direct Connect connection with a large bandwidth.

Answer

Provision two Direct Connect connections at the same AWS Direct Connect location.

Answer

Provision one Direct Connect connection and one AWS Site-to-Site VPN as backup.

Question 15

A company wants to connect multiple VPCs in different AWS accounts to on-premises networks using AWS Transit Gateway. Each VPC must be able to communicate with on-premises resources over AWS Direct Connect. What is the MINIMUM number of Transit Gateway attachments required if the company has 5 VPCs and 2 Direct Connect connections from different locations?

Accepted Answer

6. Each VPC requires a Transit Gateway attachment, so 5 VPC attachments are needed. Both Direct Connect connections can be associated with a single Direct Connect Gateway, which then requires only one Transit Gateway attachment (a Direct Connect Gateway attachment) to the Transit Gateway. Therefore, the minimum total is 5 VPC attachments + 1 Direct Connect Gateway attachment = 6 attachments.

Answer

7

Answer

5

Answer

8