ANS-C01 Network Design Practice Test 33 — 15 Questions

Question 1

A solutions architect is designing a VPC with public and private subnets. The application in the private subnet needs to download patches from the internet. Which TWO options allow outbound internet access while keeping the EC2 instance in the private subnet without a public IP address?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC endpoint for Amazon S3 and update the route table.. A VPC endpoint for Amazon S3 allows private subnet instances to access S3 buckets (where patches can be stored) without traversing the internet, using the AWS network backbone. This keeps the EC2 instance private (no public IP) while enabling outbound access to a specific AWS service. Option E is correct because a NAT Gateway in a public subnet provides source network address translation (SNAT) for private instances, translating their private IPs to the NAT Gateway's Elastic IP for outbound internet traffic, while the private instance itself remains without a public IP.

Answer

Attach an Internet Gateway to the VPC and assign a public IP to the instance.

Answer

Set up a Direct Connect connection to an on-premises data center.

Answer

Establish a VPN connection to a third-party proxy service.

Question 2

A company is migrating a legacy application to AWS. The application uses multicast for service discovery. Which AWS service or feature can be used to support multicast traffic within a VPC?

Accepted Answer

AWS Transit Gateway with multicast domain. AWS Transit Gateway multicast domains (option B) is the only service that natively supports multicast traffic within a VPC. The other listed options do not support multicast: Direct Connect requires additional on-premises configuration and does not provide VPC-native multicast, VPC multicast groups are not a supported feature, Internet Gateway only handles unicast, and VPC Peering also only supports unicast. Therefore, the correct answer is B.

Answer

AWS Direct Connect with multicast

Answer

VPC multicast groups using network interfaces

Answer

Internet Gateway (IGW)

Answer

VPC Peering

Question 3

An IAM policy attached to a user allows creating and deleting VPCs and subnets only in us-east-1. The user attempts to create a VPC in eu-west-1. What will happen?

Accepted Answer

The API call will be denied with an authorization error.. The IAM policy explicitly restricts the ec2:CreateVpc action to us-east-1 using a Condition element with ec2:Region. When the user attempts to create a VPC in eu-west-1, the condition is not satisfied, so the request is denied with an authorization error (HTTP 403). IAM policies are evaluated before any API call is executed, and if the condition fails, the action is blocked regardless of the resource-level permissions.

Answer

The VPC will be created but the user will receive a warning.

Answer

The user can create the VPC because the condition is not applicable to VPC creation.

Answer

The VPC will be created successfully because the policy allows ec2:CreateVpc.

Question 4

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application experiences intermittent timeouts during peak hours. The network team suspects that the security group or network ACL is misconfigured. They enable VPC Flow Logs and notice that outbound traffic from the ALB to the EC2 instances on port 8080 shows 'ACCEPT' records, but the ALB returns 504 errors. The ALB health check is configured to hit the EC2 instances on port 8080/health. What is the most likely cause of the 504 errors?

Accepted Answer

The ALB idle timeout is set too low, and the application takes longer to respond.. The ALB idle timeout is set too low. When the application takes longer than the idle timeout to respond, the ALB terminates the connection and returns a 504 error. Flow logs show ACCEPT for traffic from ALB to EC2 on port 8080, indicating no network ACL or security group blocking. Option A is incorrect because a blocking NACL would show REJECT records. Option B is incorrect because security groups are stateful; outbound rules on the EC2 instance are not needed for returning traffic to the ALB. Option C is incorrect because a misconfigured health check path would cause the ALB to mark targets as unhealthy, leading to 503 errors rather than intermittent 504s.

Answer

The network ACL for the private subnet is blocking inbound traffic from the ALB.

Answer

The security group for the EC2 instances is missing an outbound rule to allow traffic from the ALB.

Answer

The health check path is incorrectly configured, causing the ALB to mark all targets as unhealthy.

Question 5

A company has a global application deployed across multiple AWS Regions. They use an Amazon Route 53 latency-based routing policy to direct users to the closest region. Recently, users in Asia are experiencing high latency even though traffic is being directed to the nearest region. The network team reviews the latency measurements and notices that the Route 53 latency values are based on the region where the resources are hosted, but the actual application performance is poor. What is the most likely cause?

Accepted Answer

The application in the Asian region is overloaded, causing increased response times.. Route 53 latency-based routing measures the network latency between the user and the AWS region where the resources are hosted, not the application response time. If the application in the Asian region is overloaded, it will respond slowly, causing high latency for users even though traffic is correctly routed to the nearest region. Option A is incorrect because health checks would cause failover to another region, which would not explain high latency when traffic still goes to Asia. Option B is incorrect because DNSSEC adds minimal overhead and does not significantly impact latency. Option D is incorrect because anycast is used by Route 53 for DNS query resolution, not for the routing policy itself; the latency policy already directs users to the region with the lowest network latency.

Answer

The Route 53 health checks are failing, causing traffic to be routed to a different region.

Answer

The company has not enabled DNSSEC, causing additional DNS resolution time.

Answer

The Route 53 latency routing policy is not using anycast, causing suboptimal routing.

Question 6

A company wants to connect its on-premises data center to AWS using AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that they can ping the Direct Connect public VIF IP but cannot access S3. The VPC has a private subnet with an S3 VPC endpoint. What is the most likely reason for the failure?

Accepted Answer

The on-premises network is not routing traffic to S3 through the Direct Connect public VIF; instead, it is attempting to use the internet.. To access S3 via a Direct Connect public VIF, traffic must be routed through the public VIF, not through the internet. On-premises traffic destined for S3 will use the public VIF only if the on-premises routing directs it appropriately. If the on-premises network does not have specific routes pointing S3 traffic to the Direct Connect public VIF, it may attempt to use the internet, which can be blocked or not intended. Option A is incorrect because Direct Connect does support access to S3 via public VIF. Option B is incorrect because the S3 VPC endpoint is for instances within the VPC, not for on-premises traffic. Option D is incorrect because security groups do not apply to traffic that traverses Direct Connect; they apply to VPC traffic.

Answer

Direct Connect does not support access to Amazon S3; you must use VPN.

Answer

The S3 endpoint is configured in the VPC, but the on-premises traffic is not using the endpoint.

Answer

A security group is blocking traffic from the on-premises network to S3.

Question 7

A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Both VPCs have subnets with EC2 instances. The security groups allow all traffic between the instances. The instances in VPC A can ping the instances in VPC B, but cannot initiate TCP connections to a web server running on port 443 in VPC B. What is the most likely cause?

Accepted Answer

The security group for the web server in VPC B does not allow inbound traffic from VPC A on TCP port 443.. The security group for the web server in VPC B must explicitly allow inbound traffic from VPC A on TCP port 443. Even though ICMP (ping) works because security groups by default allow all outbound traffic and ICMP may be permitted, TCP connections require an explicit inbound rule. Option A is incorrect because VPC peering supports TCP traffic. Option B is incorrect because DNS resolution settings are not required for direct TCP connections over VPC peering. Option D is incorrect because network ACLs are stateless and would block both ICMP and TCP if misconfigured; since ping works, a NACL issue is unlikely.

Answer

The VPC peering connection does not support TCP traffic.

Answer

The DNS resolution settings for the VPC peering are not enabled.

Answer

The network ACL in VPC B is blocking inbound TCP traffic on port 443.

Question 8

A company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The on-premises router advertises a specific route for a subnet (192.168.1.0/24) to the VPC via BGP. However, instances in the VPC cannot reach the 192.168.1.0/24 subnet. The VPC route table shows the route as 'active' and 'propagated' from the Direct Connect virtual interface. What is the most likely cause?

Accepted Answer

The VPC route table does not have a route to the 192.168.1.0/24 subnet pointing to the virtual private gateway.. Even though the VPC route table shows the route as 'active' and 'propagated', this might be the main route table. If the instance's subnet is associated with a different route table that does not have a route to 192.168.1.0/24 pointing to the virtual private gateway, traffic will not be directed properly. The most likely cause is that the subnet's route table lacks this specific route. Option A is incorrect because security groups do not affect outbound traffic initiated by instances, and the issue is routing, not security. Option B is incorrect because overlapping CIDR would cause the route to not appear as active or propagated, contradicting the scenario. Option C is incorrect because BGP communities are not used for route propagation in Direct Connect private VIFs.

Answer

The security group for the VPC instances is blocking inbound traffic from the on-premises network.

Answer

The VPC has overlapping CIDR with the on-premises network.

Answer

The on-premises router is not advertising the correct BGP community.

Question 9

A company wants to provide internet access to instances in a private subnet without using a NAT Gateway, due to cost constraints. They have a public subnet with a bastion host that has a public IP. They also have a VPC with an Internet Gateway. What is the most cost-effective way to allow outbound internet access for instances in the private subnet?

Accepted Answer

Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance.. Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance. A NAT instance is a cost-effective alternative to NAT Gateway, as it uses an EC2 instance with IP forwarding enabled and can be run on a low-cost instance type. It requires management but avoids NAT Gateway hourly charges. Option B is incorrect because a VPN connection to a third-party proxy introduces unnecessary complexity and cost. Option C is incorrect because VPC endpoints only provide access to specific AWS services (e.g., S3), not general internet access. Option D is incorrect because the bastion host is typically used for SSH access, and while it could be configured for NAT, it is not recommended for security reasons; a dedicated NAT instance in a public subnet is the proper approach.

Answer

Use a VPN connection to a third-party internet proxy.

Answer

Create a VPC endpoint for Amazon S3 and configure the private subnet to use it.

Answer

Configure the bastion host as a NAT instance by enabling IP forwarding.

Question 10

A company has a multi-VPC architecture connected via AWS Transit Gateway. They have VPCs in different AWS accounts. The network team wants to centralize internet traffic through a single egress VPC that has a NAT Gateway and an Internet Gateway. All other VPCs should route outbound internet traffic through the Transit Gateway to the egress VPC. They have configured route tables accordingly, but instances in non-egress VPCs cannot reach the internet. What is the most likely missing configuration?

Accepted Answer

The Transit Gateway route table does not have a route to the non-egress VPC attachments for the return traffic.. For traffic from non-egress VPCs to reach the internet, the Transit Gateway must have a route table that includes a route to the non-egress VPC attachments for the return traffic. Without this route, return traffic from the internet (via the egress VPC's NAT Gateway) cannot be forwarded back to the originating VPC through the Transit Gateway. The other options are incorrect: B is false because security groups are stateful, so inbound rules do not affect return traffic; C is false because the egress VPC needs a route to the Transit Gateway for outbound traffic, not return traffic; D is false because VPC endpoints are not used for general internet access.

Answer

The security group for the NAT Gateway in the egress VPC is blocking inbound traffic from other VPCs.

Answer

The egress VPC's route table does not have a route to the Transit Gateway for the return traffic from the internet.

Answer

The non-egress VPCs are using VPC endpoints instead of the Transit Gateway for internet access.

Question 11

An application running on EC2 instances in a VPC needs to access an Amazon S3 bucket to read configuration files. The VPC has an S3 VPC endpoint configured. The instances are in a private subnet and have a security group that allows all outbound traffic. The bucket policy allows access from the VPC endpoint. However, the application fails to access the S3 bucket. What is the most likely cause?

Accepted Answer

The VPC endpoint's route table does not include the subnet's route table, so traffic to S3 is not routed through the endpoint.. The most likely cause is that the VPC endpoint's route table does not include the subnet's route table, meaning traffic from the private subnet to S3 is not routed through the endpoint. Option B is correct because if the subnet's route table lacks a route for the S3 prefix list pointing to the VPC endpoint, traffic will go via a NAT gateway or internet gateway (if configured) or fail if no such connectivity exists. Option A is incorrect because network ACLs are not mentioned and typically allow outbound HTTPS. Option C is incorrect since the security group allows all outbound traffic. Option D is incorrect because the bucket policy already permits access from the VPC endpoint.

Answer

The network ACL for the private subnet is blocking outbound HTTPS traffic.

Answer

The security group for the EC2 instances has an outbound rule that blocks HTTPS traffic to S3.

Answer

The S3 bucket policy does not grant access to the VPC endpoint's ID.

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They need to create a subnet for a new application that requires at least 2000 usable IP addresses. Which subnet size should they choose?

Accepted Answer

/20 (4096 IPs). A /20 subnet provides 4096 total IP addresses, with 4091 usable (AWS reserves 5). This meets the requirement of at least 2000 usable IP addresses. Option A (/24) provides 251 usable. Option B (/22) provides 1023 usable. Option C (/19) provides 8191 usable, which is more than needed, but /20 is the smallest sufficient subnet.

Answer

/24 (256 IPs)

Answer

/22 (1024 IPs)

Answer

/19 (8192 IPs)

Question 13

A company uses AWS Direct Connect with a private VIF and a virtual private gateway (VGW) to connect its on-premises data center to a VPC. The on-premises network uses BGP to advertise routes to AWS. The VPC has multiple subnets. The company wants to ensure that only traffic destined for the VPC CIDR (10.0.0.0/16) is sent over Direct Connect, and all other traffic uses the internet. However, after configuration, on-premises users can access the internet through the Direct Connect link, which is unintended. What change should be made to restrict traffic?

Accepted Answer

Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.. The issue arises because AWS is advertising a default route (0.0.0.0/0) to the on-premises router over BGP via Direct Connect, causing on-premises users to use Direct Connect for internet traffic. To restrict traffic, the on-premises router should be configured to accept only the VPC CIDR (10.0.0.0/16) from AWS and reject any default route. Option C is correct. Option A is incorrect because adding a static route in the VPC route table does not affect BGP advertisements to on-premises. Option B is incorrect because disabling route propagation affects VPC subnet routing, not the BGP session. Option D is incorrect because removing the virtual private gateway would disconnect the VPC, not solve the issue.

Answer

Add a static route in the VPC route table to send all traffic to the internet gateway.

Answer

Disable route propagation for the private subnet route table.

Answer

Remove the virtual private gateway and use a VPN connection instead.

Question 14

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?

Accepted Answer

Create a web ACL in AWS WAF and associate it with the ALB.. AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level. Option D is incorrect because WAF is not a Network Load Balancer feature.

Answer

Replace the ALB with a Network Load Balancer and use AWS WAF with it.

Answer

Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.

Answer

Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.

Question 15

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Accepted Answer

Configure Route 53 with latency-based routing. Latency-based routing (Option B) directs traffic to the AWS region that provides the lowest latency for each user, which aligns with the requirement to route to the closest healthy endpoint. Health checks (Option C) must be associated with each Route 53 record to mark endpoints as healthy or unhealthy, ensuring traffic is only sent to available ALBs. Together, these configurations enable an active-active multi-region design with automatic failover to the next-lowest-latency healthy region.

Answer

Configure Route 53 with failover routing

Answer

Configure Route 53 with weighted routing

Answer

Configure Route 53 with geoproximity routing