ANS-C01 Network Design Practice Test 33 — 15 Questions

Question 1

A solutions architect is designing a VPC with public and private subnets. The application in the private subnet needs to download patches from the internet. Which TWO options allow outbound internet access while keeping the EC2 instance in the private subnet without a public IP address?

Accepted Answer

Create a VPC endpoint for Amazon S3 and update the route table.. Options A and D are correct. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. A VPC endpoint for S3 allows private access to S3 buckets. Option B (Internet Gateway) requires a public IP. Option C (Direct Connect) is for dedicated private connections. Option E (VPN) is for hybrid connectivity.

Answer

Attach an Internet Gateway to the VPC and assign a public IP to the instance.

Answer

Set up a Direct Connect connection to an on-premises data center.

Answer

Establish a VPN connection to a third-party proxy service.

Question 2

A company is migrating a legacy application to AWS. The application uses multicast for service discovery. Which THREE AWS services or features can be used to support multicast traffic within a VPC?

Accepted Answer

AWS Direct Connect with multicast. Options B, C, and D are correct. AWS Transit Gateway supports multicast domains for multicast traffic. VPC has limited multicast support via network interfaces, and AWS PrivateLink does not. Direct Connect can extend on-premises multicast. Option A is incorrect because Internet Gateway does not support multicast. Option E is incorrect because VPC Peering does not support multicast.

Answer

Internet Gateway (IGW)

Answer

VPC Peering

Question 3

An IAM policy attached to a user allows creating and deleting VPCs and subnets only in us-east-1. The user attempts to create a VPC in eu-west-1. What will happen?

Accepted Answer

The API call will be denied with an authorization error.. Option C is correct. The condition restricts actions to us-east-1 only, so the API call in eu-west-1 will be denied. Option A is wrong because the policy explicitly allows with a region condition. Option B is wrong because the condition is evaluated. Option D is wrong because no override exists.

Answer

The VPC will be created but the user will receive a warning.

Answer

The user can create the VPC because the condition is not applicable to VPC creation.

Answer

The VPC will be created successfully because the policy allows ec2:CreateVpc.

Question 4

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application experiences intermittent timeouts during peak hours. The network team suspects that the security group or network ACL is misconfigured. They enable VPC Flow Logs and notice that outbound traffic from the ALB to the EC2 instances on port 8080 shows 'ACCEPT' records, but the ALB returns 504 errors. The ALB health check is configured to hit the EC2 instances on port 8080/health. What is the most likely cause of the 504 errors?

Accepted Answer

The ALB idle timeout is set too low, and the application takes longer to respond.. Option C is correct. ALB requires idle timeout settings on both client and target sides; if the target response exceeds the ALB idle timeout, it returns 504. Option A is incorrect because flow logs show ACCEPT. Option B is incorrect because health checks failing would cause unhealthy targets, but the issue is intermittent. Option D is incorrect because security group rules are stateful and outbound traffic is allowed.

Answer

The network ACL for the private subnet is blocking inbound traffic from the ALB.

Answer

The security group for the EC2 instances is missing an outbound rule to allow traffic from the ALB.

Answer

The health check path is incorrectly configured, causing the ALB to mark all targets as unhealthy.

Question 5

A company has a global application deployed across multiple AWS Regions. They use an Amazon Route 53 latency-based routing policy to direct users to the closest region. Recently, users in Asia are experiencing high latency even though traffic is being directed to the nearest region. The network team reviews the latency measurements and notices that the Route 53 latency values are based on the region where the resources are hosted, but the actual application performance is poor. What is the most likely cause?

Accepted Answer

The application in the Asian region is overloaded, causing increased response times.. Option B is correct. Route 53 latency routing measures latency between the user and the region, not the actual application response time. If the application itself is slow, users still experience high latency. Option A is incorrect because Route 53 health checks can fail over but don't improve latency. Option C is incorrect because anycast routes to the nearest edge but doesn't affect application performance. Option D is incorrect because DNSSEC does not affect latency.

Answer

The Route 53 health checks are failing, causing traffic to be routed to a different region.

Answer

The company has not enabled DNSSEC, causing additional DNS resolution time.

Answer

The Route 53 latency routing policy is not using anycast, causing suboptimal routing.

Question 6

A company wants to connect its on-premises data center to AWS using AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that they can ping the Direct Connect public VIF IP but cannot access S3. The VPC has a private subnet with an S3 VPC endpoint. What is the most likely reason for the failure?

Accepted Answer

The on-premises network is not routing traffic to S3 through the Direct Connect public VIF; instead, it is attempting to use the internet.. Option A is correct. To access S3 via public VIF, traffic must go through the internet route; the VPC endpoint is only for instances within the VPC. Option B is incorrect because public VIF uses public IPs, not private IPs. Option C is incorrect because Direct Connect can access public services. Option D is incorrect because security groups don't apply to on-premises traffic via Direct Connect.

Answer

Direct Connect does not support access to Amazon S3; you must use VPN.

Answer

The S3 endpoint is configured in the VPC, but the on-premises traffic is not using the endpoint.

Answer

A security group is blocking traffic from the on-premises network to S3.

Question 7

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have subnets with EC2 instances. The security groups allow all traffic between the instances. The instances in VPC A can ping the instances in VPC B, but cannot initiate TCP connections to a web server running on port 443 in VPC B. What is the most likely cause?

Accepted Answer

The security group for the web server in VPC B does not allow inbound traffic from VPC A on TCP port 443.. Option D is correct. VPC peering does not support transitive routing, so if there is a NACL or security group rule that allows ICMP but not TCP, or if the web server's security group only allows traffic from specific sources, the issue could be security group rules. However, the most common cause is that the security group for the web server in VPC B does not allow inbound TCP 443 from VPC A CIDR. Option A is incorrect because VPC peering supports TCP. Option B is incorrect because DNS resolution is not required for TCP. Option C is incorrect because NACLs are stateless and would affect both ICMP and TCP if misconfigured.

Answer

The VPC peering connection does not support TCP traffic.

Answer

The DNS resolution settings for the VPC peering are not enabled.

Answer

The network ACL in VPC B is blocking inbound TCP traffic on port 443.

Question 8

A company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The on-premises router advertises a specific route for a subnet (192.168.1.0/24) to the VPC via BGP. However, instances in the VPC cannot reach the 192.168.1.0/24 subnet. The VPC route table shows the route as 'active' and 'propagated' from the Direct Connect virtual interface. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route to the 192.168.1.0/24 subnet pointing to the virtual private gateway.. Option B is correct. Even if the route is propagated, the VPC subnet route table must have a route pointing to the virtual private gateway for that CIDR. If the route is not explicitly added (or not propagated due to route table association), traffic will not be directed. Option A is incorrect because BGP is used, so AS_PATH does not affect reachability inside VPC. Option C is incorrect because security groups don't apply to on-premises traffic via Direct Connect. Option D is incorrect because the VPC route table shows the route as active, so the prefix is known.

Answer

The security group for the VPC instances is blocking inbound traffic from the on-premises network.

Answer

The VPC has overlapping CIDR with the on-premises network.

Answer

The on-premises router is not advertising the correct BGP community.

Question 9

A company wants to provide internet access to instances in a private subnet without using a NAT Gateway, due to cost constraints. They have a public subnet with a bastion host that has a public IP. They also have a VPC with an Internet Gateway. What is the most cost-effective way to allow outbound internet access for instances in the private subnet?

Accepted Answer

Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance.. Option B is correct. A NAT instance (Amazon Linux AMI with IP forwarding) in a public subnet can be used as a cheaper alternative to NAT Gateway, though it requires management. Option A is incorrect because bastion host is for SSH, not NAT. Option C is incorrect because VPC endpoints are for specific services, not general internet. Option D is incorrect because VPN is costly and not for internet access.

Answer

Use a VPN connection to a third-party internet proxy.

Answer

Create a VPC endpoint for Amazon S3 and configure the private subnet to use it.

Answer

Configure the bastion host as a NAT instance by enabling IP forwarding.

Question 10

A company has a multi-VPC architecture connected via AWS Transit Gateway. They have VPCs in different AWS accounts. The network team wants to centralize internet traffic through a single egress VPC that has a NAT Gateway and an Internet Gateway. All other VPCs should route outbound internet traffic through the Transit Gateway to the egress VPC. They have configured route tables accordingly, but instances in non-egress VPCs cannot reach the internet. What is the most likely missing configuration?

Accepted Answer

The Transit Gateway route table does not have a route to the non-egress VPC attachments for the return traffic.. Option D is correct. For Transit Gateway to forward traffic from one VPC to another, attachment routes must be propagated and route tables must allow transitive routing. Also, the egress VPC must have a route to the Transit Gateway for return traffic. Option A is incorrect because security groups are stateful. Option B is incorrect because NAT Gateway does not need routes back to Transit Gateway; it sends traffic to IGW. Option C is incorrect because VPC endpoints are not for general internet.

Answer

The security group for the NAT Gateway in the egress VPC is blocking inbound traffic from other VPCs.

Answer

The egress VPC's route table does not have a route to the Transit Gateway for the return traffic from the internet.

Answer

The non-egress VPCs are using VPC endpoints instead of the Transit Gateway for internet access.

Question 11

An application running on EC2 instances in a VPC needs to access an Amazon S3 bucket to read configuration files. The VPC has an S3 VPC endpoint configured. The instances are in a private subnet and have a security group that allows all outbound traffic. The bucket policy allows access from the VPC endpoint. However, the application fails to access the S3 bucket. What is the most likely cause?

Accepted Answer

The VPC endpoint's route table does not include the subnet's route table, so traffic to S3 is not routed through the endpoint.. Option A is correct. The VPC endpoint must be associated with a route table that includes the subnet's route table. If not, traffic from the subnet to S3 will not use the endpoint. Option B is incorrect because security group outbound is all traffic. Option C is incorrect because the bucket policy allows access from the endpoint. Option D is incorrect because there is no NACL mentioned, and if NACL blocks, it would block all traffic.

Answer

The network ACL for the private subnet is blocking outbound HTTPS traffic.

Answer

The security group for the EC2 instances has an outbound rule that blocks HTTPS traffic to S3.

Answer

The S3 bucket policy does not grant access to the VPC endpoint's ID.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create a subnet for a new application that requires at least 2000 usable IP addresses. Which subnet size should they choose?

Accepted Answer

/20 (4096 IPs). Option C is correct. A /20 subnet provides 4096 total IPs, with 4091 usable (AWS reserves 5). For 2000 usable, /20 is sufficient. Option A (/24) provides 251 usable. Option B (/22) provides 1023 usable. Option D (/19) provides 8191 usable, which is more than needed but acceptable, though /20 is the smallest sufficient.

Answer

/24 (256 IPs)

Answer

/22 (1024 IPs)

Answer

/19 (8192 IPs)

Question 13

A company uses AWS Direct Connect with a private VIF and a virtual private gateway (VGW) to connect its on-premises data center to a VPC. The on-premises network uses BGP to advertise routes to AWS. The VPC has multiple subnets. The company wants to ensure that only traffic destined for the VPC CIDR (10.0.0.0/16) is sent over Direct Connect, and all other traffic uses the internet. However, after configuration, on-premises users can access the internet through the Direct Connect link, which is unintended. What change should be made to restrict traffic?

Accepted Answer

Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.. Option B is correct. On-premises routers should only advertise the VPC CIDR (10.0.0.0/16) to AWS, and AWS should not advertise a default route to on-premises. By default, Direct Connect private VIF can propagate a default route if configured. To prevent on-premises from using Direct Connect for internet, ensure that the on-premises router does not accept a default route from AWS or that AWS does not advertise one. Option A is incorrect because removing the VGW disconnects the VPC. Option C is incorrect because adding a static route would not fix the issue. Option D is incorrect because disabling route propagation for the specific subnet does not affect BGP advertisements.

Answer

Add a static route in the VPC route table to send all traffic to the internet gateway.

Answer

Disable route propagation for the private subnet route table.

Answer

Remove the virtual private gateway and use a VPN connection instead.

Question 14

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?

Accepted Answer

Create a web ACL in AWS WAF and associate it with the ALB.. Option A is correct. AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level. Option D is incorrect because WAF is not a Network Load Balancer feature.

Answer

Replace the ALB with a Network Load Balancer and use AWS WAF with it.

Answer

Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.

Answer

Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.

Question 15

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Accepted Answer

Configure Route 53 with latency-based routing. Latency-based routing directs traffic to the region with the lowest latency, supporting active-active. Health checks ensure traffic is not sent to unhealthy endpoints. Failover routing is active-passive, not active-active. Geoproximity is for location-based, not latency. Weighted routing distributes traffic by weight, not based on health or latency for active-active.

Answer

Configure Route 53 with failover routing

Answer

Configure Route 53 with weighted routing

Answer

Configure Route 53 with geoproximity routing