ANS-C01 Network Design Practice Test 34 — 15 Questions

Question 1

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which configuration will allow this without exposing the instance to inbound internet traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet's route table to point default route to the NAT Gateway.. A NAT Gateway, deployed in a public subnet with an Internet Gateway, allows outbound IPv4 traffic from private subnets to the internet while preventing unsolicited inbound connections. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling the EC2 instance to download patches without being directly exposed.

Answer

Use VPC Gateway Endpoints for S3 and DynamoDB.

Answer

Attach an Internet Gateway to the VPC and assign a public IP to the instance.

Answer

Configure a VPN connection from the VPC to an on-premises network that has internet access.

Question 2

A company has multiple VPCs connected via a Transit Gateway. Each VPC has its own CIDR block. The company wants to isolate network traffic between specific VPCs. What is the most scalable way to achieve this?

Accepted Answer

Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.. Transit Gateway route tables allow you to isolate traffic between VPCs by controlling which VPC attachments can communicate with each other. By associating each VPC attachment with a specific route table and configuring route propagation appropriately, you can enforce isolation without additional appliances or complex routing. This approach scales seamlessly as you add more VPCs, because you simply create new route tables and associate attachments as needed.

Answer

Deploy AWS Network Firewall in each VPC.

Answer

Use Security Groups in each VPC to filter traffic.

Answer

Use VPC Peering connections and modify route tables.

Question 3

A company is designing a network for a critical application that requires low latency and high throughput between EC2 instances in the same AWS Region. Which network design should the company use?

Accepted Answer

Launch the instances in a Cluster Placement Group.. A Cluster Placement Group is the correct choice because it provides the lowest possible latency and highest throughput between EC2 instances by placing them in a single Availability Zone with non-blocking, high-bandwidth networking. This design is ideal for tightly coupled, high-performance computing (HPC) or latency-sensitive applications that require consistent, low-latency communication within the same AWS Region.

Answer

Launch the instances in a Spread Placement Group.

Answer

Launch the instances as larger instance types with enhanced networking.

Answer

Launch the instances in different Availability Zones.

Question 4

A company is designing a network for a multi-account AWS environment using AWS Organizations. The company must centralize internet egress for all accounts. Which TWO solutions should the company use? (Choose two.)

Accepted Answer

Use AWS Transit Gateway to route traffic from all VPCs to the egress VPC.. Option C is correct because AWS Transit Gateway acts as a regional hub that can attach VPCs from multiple accounts within an AWS Organization, allowing all spoke VPCs to route their default traffic to a centralized egress VPC without the complexity of full-mesh peering. Option E is correct because the centralized egress VPC must contain a NAT Gateway for outbound internet access from private subnets and an Internet Gateway to provide the actual path to the internet, which is the standard architecture for centralized egress. Option A is not ideal because VPC Peering is non-transitive and would require a full mesh of peering connections to the egress VPC, which does not scale well in a multi-account environment. Option B is incorrect because AWS Client VPN provides remote user access to AWS, not centralized internet egress for workloads. Option D is incorrect because attaching an Internet Gateway to each VPC and allowing direct internet access defeats the requirement to centralize egress.

Answer

Use VPC Peering to connect all VPCs to the egress VPC.

Answer

Deploy a AWS Client VPN endpoint in each VPC.

Answer

Attach an Internet Gateway to each VPC and allow direct internet access.

Question 5

A solutions architect needs to design a VPC with both IPv4 and IPv6 support. The VPC will have public and private subnets. Resources in private subnets need outbound IPv6 access to the internet. Which combination of resources should be used?

Accepted Answer

Internet gateway for public subnets and egress-only internet gateway for private subnets. An egress-only internet gateway (EIGW) is the AWS-managed service designed specifically to provide outbound-only IPv6 access from private subnets to the internet, while an internet gateway (IGW) handles both inbound and outbound IPv4/IPv6 traffic for public subnets. Unlike a NAT gateway, which only supports IPv4, the EIGW works with IPv6 and prevents any inbound IPv6 connections from the internet, meeting the requirement for outbound-only IPv6 access.

Answer

Internet gateway for public subnets and VPC gateway endpoints for private subnets

Answer

Internet gateway for public subnets and NAT gateway for private subnets

Answer

Internet gateway for both public and private subnets using route tables

Question 6

An application running on EC2 instances in a private subnet needs to download patches from the internet. The VPC has an internet gateway and public subnets. Which resource should be used to provide outbound internet access to the instances?

Accepted Answer

NAT gateway in a public subnet. A NAT gateway in a public subnet provides outbound-only internet access to instances in private subnets by translating their private IP addresses to the NAT gateway's Elastic IP address. This allows the EC2 instances to download patches from the internet while preventing any unsolicited inbound connections from the internet, which is the standard design for secure outbound internet access in a VPC.

Answer

VPC gateway endpoint for S3

Answer

AWS Site-to-Site VPN connection

Answer

Internet gateway in the private subnet

Question 7

A company is designing a VPC for a web application that requires high availability. The application will be deployed across multiple Availability Zones. Which THREE components are essential for a highly available network design? (Choose THREE.)

Accepted Answer

Subnets in at least two Availability Zones. Option A is correct because high availability requires the application to be spread across multiple Availability Zones, and each subnet in a VPC is tied to exactly one AZ, so you need subnets in at least two AZs to place resources redundantly. Option C is correct because a NAT gateway is AZ-scoped; to keep private-subnet instances able to reach the internet for updates without a single point of failure, you must deploy a NAT gateway in each AZ where private subnets exist. Option E is correct because an internet gateway is the horizontally scaled, redundant VPC component that enables communication between the VPC and the internet, and it must be attached to the VPC for public-facing web traffic to flow. Option B is not essential because a single VPN connection is itself a single point of failure and is not required for a highly available VPC design. Option D is not essential because VPC peering with a backup VPC is a connectivity choice, not a requirement for multi-AZ high availability within the VPC.

Answer

A single VPN connection to on-premises

Answer

VPC peering with a backup VPC

Question 8

A company is designing a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which THREE design elements are required? (Choose THREE.)

Accepted Answer

A public subnet for the web tier with an internet gateway. The web tier requires direct internet accessibility, which is achieved by placing it in a public subnet associated with an internet gateway. The internet gateway provides a target for the subnet's route table to allow inbound traffic from the internet and outbound responses, enabling users to reach the web application.

Answer

A NAT gateway in the public subnet for outbound traffic from private subnets

Answer

A VPN connection to on-premises

Question 9

A network engineer is designing a hybrid network using AWS Transit Gateway with multiple VPCs and an on-premises data center connected via AWS Direct Connect. The VPCs need to communicate with each other and with on-premises, but must isolate development VPCs from production VPCs. What is the MOST scalable and cost-effective approach?

Accepted Answer

Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.. A single Transit Gateway with separate route tables allows you to isolate development and production VPCs from each other while sharing a common route table for the Direct Connect attachment to reach on-premises. This design is highly scalable (no mesh of peering connections) and cost-effective (no per-VPN-tunnel charges), leveraging Transit Gateway’s native segmentation and centralized routing.

Answer

Use a single Transit Gateway with one route table for all VPCs and on-premises, and use network ACLs for isolation.

Answer

Create VPC peering connections between all VPCs and a Direct Connect gateway for on-premises connectivity.

Answer

Use a VPN connection from each VPC to on-premises over Direct Connect, and allow VPC communication via VPN.

Question 10

A company uses AWS Direct Connect with a private VIF to connect its data center to a VPC. The VPC has multiple subnets. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot connect to an EC2 instance's port 443. The EC2 instance's security group allows HTTPS from the on-premises CIDR. What should the engineer check NEXT?

Accepted Answer

Check the EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) to see if port 443 is blocked.. Since the on-premises team can ping the EC2 instance (ICMP works) but cannot connect to port 443 (HTTPS), the network path is functional at Layer 3. The security group already allows HTTPS from the on-premises CIDR, so the next logical step is to check the EC2 instance's OS-level firewall (e.g., iptables, Windows Firewall), which operates at Layer 4 and can independently block TCP port 443 even when the security group permits it.

Answer

Check the security group's inbound rules for port 443.

Answer

Confirm that the Direct Connect virtual interface is in the 'up' state.

Answer

Verify that the route tables in the VPC have a route back to the on-premises CIDR.

Question 11

A company is building a serverless application using API Gateway, Lambda, and DynamoDB. The API must be accessible from the internet and be resilient to Regional failures. Which design provides the HIGHEST availability?

Accepted Answer

Deploy in two Regions with API Gateway, Lambda, and DynamoDB global tables. Use Route 53 failover routing with health checks.. It combines multi-Region deployment with Route 53 failover routing and health checks, ensuring that if one Region becomes unavailable, traffic is automatically redirected to the healthy Region. API Gateway, Lambda, and DynamoDB global tables provide the necessary cross-Region replication and stateless compute to maintain full functionality during a Regional outage, offering the highest availability.

Answer

Deploy API Gateway, Lambda, and DynamoDB in a single Region with multi-AZ.

Answer

Deploy API Gateway in two Regions behind a Global Accelerator accelerator.

Answer

Use a single API Gateway with CloudFront distribution in front, and Lambda@Edge for compute.

Question 12

A company has a global application that uses Amazon Route 53 for DNS. The application is deployed in us-east-1 and eu-west-1. The company wants to route users to the Region with the lowest latency, but also provide failover if one Region becomes unhealthy. Which Route 53 routing policy should be used?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks is correct because it directs users to the Region that provides the lowest latency for each individual request, while health checks automatically remove unhealthy endpoints from the routing pool. This combination meets both the latency optimization and failover requirements without requiring a static primary/secondary configuration.

Answer

Weighted routing with equal weights

Answer

Failover routing with primary in us-east-1

Answer

Geoproximity routing

Question 13

A company is designing a network for a three-tier application that must be PCI DSS compliant. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. All tiers are in the same VPC. What is the MOST secure way to implement this?

Accepted Answer

Place web tier in public subnets, application and database tiers in private subnets. Use security groups to allow only necessary traffic between tiers.. Placing the web tier in public subnets and the application and database tiers in private subnets follows the principle of least privilege and network segmentation, which is required for PCI DSS compliance. Security groups act as stateful firewalls at the instance level, allowing precise control over traffic between tiers. This design ensures that the database tier is not directly accessible from the internet and only accepts traffic from the application tier.

Answer

Use a VPN between the web and application tiers and between application and database tiers.

Answer

Place all tiers in the same private subnet and use security groups for isolation.

Answer

Place all tiers in public subnets and use network ACLs to restrict traffic.

Question 14

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. It needs to connect to two other VPCs: VPC B (10.1.0.0/16) and VPC C (10.2.0.0/16). The company wants to use AWS Transit Gateway. Which THREE configurations are required to enable full mesh connectivity between all three VPCs?

Accepted Answer

Associate each VPC attachment with the Transit Gateway route table.. Associating each VPC attachment with the Transit Gateway route table is necessary for the Transit Gateway to know which attachments can communicate. Without this association, the Transit Gateway would not forward traffic between the VPCs, even if routes are present in the route table.

Answer

Create separate Transit Gateway route tables for each VPC to isolate traffic.

Answer

Create a VPN attachment to each VPC for encrypted communication.

Question 15

A company is designing a VPC architecture for a web application that must be highly available across multiple Availability Zones. Which TWO components should be deployed in at least two Availability Zones to meet this requirement?

Accepted Answer

NAT Gateway. Option C (NAT Gateway) is correct because a NAT Gateway is created in a specific subnet within a single Availability Zone, so to keep outbound internet access highly available for private-subnet instances, you must deploy a NAT Gateway in at least two AZs (one per AZ) and route each AZ's traffic to its local NAT Gateway. Option D (Application Load Balancer with subnets in multiple AZs) is correct because an ALB requires you to enable at least two subnets in different Availability Zones, and it distributes incoming traffic across those AZs to provide high availability for the web application. Option A (Transit Gateway) is not AZ-specific in this way; it is a regional, highly available hub that does not need to be deployed per-AZ to meet the requirement. Option B (Internet Gateway) is a horizontally scaled, redundant, and highly available VPC component that attaches at the VPC level, not per-AZ. Option E (VPN connection) is a site-to-site connection to on-premises and is not an AZ-scoped component that must be duplicated across AZs for this design.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPN connection