ANS-C01 Network Design Practice Test 35 — 15 Questions

Question 1

A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which TWO entries must exist in the route table for the traffic to succeed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Destination: 10.0.0.0/16, Target: local. For traffic from an EC2 instance in a VPC to an on-premises server over a Direct Connect private VIF, the route table must include two entries: a local route for the VPC CIDR (10.0.0.0/16) which is automatically added and enables communication within the VPC (Option C), and a specific route to the on-premises network (192.168.1.0/24) pointing to the virtual private gateway (vgw-xxxxxxxx) so that traffic destined for 192.168.1.50 is directed over the Direct Connect (Option D). No other entries are required; the local route already covers all subnets, and there is no need for a default route to the internet.

Answer

Destination: 0.0.0.0/0, Target: igw-xxxxxxxx

Answer

Destination: 0.0.0.0/0, Target: nat-xxxxxxxx

Answer

Destination: 10.0.1.0/29, Target: local

Question 2

An engineer runs the command above for a subnet associated with this network ACL. The subnet's CIDR is 10.0.1.0/24. An EC2 instance in the subnet attempts to initiate an HTTPS connection to a server on the internet. What is the result?

Accepted Answer

The connection fails because the inbound HTTPS return traffic is denied by rule 200.. Based on the provided network ACL exhibit, inbound rule 200 denies all traffic (0.0.0.0/0, ALL traffic). Even though outbound HTTPS is allowed, the return traffic for the HTTPS connection (which is inbound) is evaluated against the inbound rules. Since rule 200 denies all inbound traffic, the return packets are dropped, causing the connection to fail. Network ACLs are stateless, so both inbound and outbound rules must explicitly allow the traffic.

Answer

The connection fails because the outbound rule does not allow HTTPS.

Answer

The connection succeeds because outbound traffic is allowed.

Answer

The connection succeeds because inbound rule 100 allows HTTPS from the subnet.

Question 3

A company is migrating its on-premises data center to AWS. The network team needs to extend the on-premises network to the cloud and support IP multicast traffic between environments. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast support. AWS Transit Gateway with multicast support is the correct choice because it is the only AWS service that natively supports IP multicast traffic between VPCs and on-premises networks. It allows you to create multicast domains and associate subnets, enabling multicast sources and receivers to communicate across attached networks, including on-premises via AWS Direct Connect or Site-to-Site VPN.

Answer

AWS Direct Connect with a private virtual interface

Answer

Site-to-Site VPN connection

Answer

VPC peering connection

Question 4

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company does not want to assign public IP addresses to the instance. Which combination of resources is required? (Choose TWO.)

Accepted Answer

NAT Gateway in a public subnet. Option B (NAT Gateway in a public subnet) is correct because a NAT Gateway performs source NAT, allowing instances in a private subnet to initiate outbound traffic to the internet while remaining unreachable from the internet and without needing a public IP. Option D (Internet Gateway attached to the VPC) is correct because the NAT Gateway itself requires an Internet Gateway attached to the VPC to route its translated traffic to the internet; without an IGW, no outbound internet path exists. Together, the private subnet routes 0.0.0.0/0 to the NAT Gateway, and the public subnet routes 0.0.0.0/0 to the Internet Gateway, enabling patch downloads. Option A (VPN connection to on-premises) is not required because the scenario is about internet access, not connectivity to a corporate data center. Option C (VPC endpoint for Amazon S3) is not required because S3 gateway endpoints only provide private access to S3, not general internet access for downloading patches from arbitrary repositories.

Answer

VPN connection to the on-premises data center

Answer

VPC endpoint for Amazon S3

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. It has two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). Both subnets have a route to an Internet Gateway. An EC2 instance in subnet A has a security group that allows inbound HTTP from 0.0.0.0/0. The instance's network ACL allows inbound HTTP from 0.0.0.0/0. Users report they cannot access the web server. What is the most likely cause?

Accepted Answer

The instance does not have a public IP address. The most likely cause is that the EC2 instance does not have a public IP address. Even though the security group and network ACL allow inbound HTTP from 0.0.0.0/0, and the subnet has a route to an Internet Gateway (IGW), the instance must have a public IPv4 address (or an Elastic IP) for the IGW to translate its private IP to a public IP and route traffic from the internet. Without a public IP, the IGW cannot forward inbound traffic to the instance, making it unreachable from the internet.

Answer

The network ACL inbound rule is incorrectly configured

Answer

The security group is not associated with the instance

Answer

The route table does not have a route to the Internet Gateway

Question 6

A company wants to connect multiple VPCs across different AWS accounts to a common on-premises network using AWS Transit Gateway. Which resource should be used to allow cross-account VPC attachments?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) enables you to share a Transit Gateway with other AWS accounts within your organization or externally. Once shared, the recipient account can attach its VPCs to the shared Transit Gateway, allowing cross-account VPC attachments to a common on-premises network.

Answer

AWS PrivateLink

Answer

VPC peering connection

Answer

AWS Organizations

Question 7

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which architecture meets these requirements?

Accepted Answer

Place each tier in a separate subnet and use security groups to allow traffic between tiers. Security groups act as a stateful virtual firewall at the instance level, allowing you to specify inbound and outbound rules based on source/destination security group IDs. By placing each tier in a separate subnet and referencing the web tier's security group as the source for the application tier's inbound rule, and the application tier's security group as the source for the database tier's inbound rule, you achieve the required least-privilege access without exposing the application or database tiers to the internet.

Answer

Place each tier in a separate subnet and use network ACLs to allow traffic between tiers

Answer

Place all tiers in the same subnet and use security groups to control traffic

Answer

Place all tiers in a public subnet and use a NAT gateway for the application and database tiers

Question 8

A company has an AWS Direct Connect connection and wants to use it to access Amazon S3 buckets without traversing the public internet. Which virtual interface type should be used?

Accepted Answer

Public virtual interface. A public virtual interface is the correct choice because it allows access to AWS public services, such as Amazon S3, over a Direct Connect connection without traversing the public internet. It uses the same BGP peering and routing policies as private virtual interfaces but directs traffic to the public IP address space of AWS services, ensuring traffic stays within the AWS global network.

Answer

Transit virtual interface

Answer

Hosted virtual interface

Answer

Private virtual interface

Question 9

A company is deploying a multi-tier web application across multiple AWS accounts. They want to centralize network security by using a shared services VPC with a Transit Gateway. All application VPCs will be attached to the Transit Gateway. The security team needs to inspect and filter traffic between application VPCs. Which solution should be used to meet this requirement?

Accepted Answer

Deploy a Transit Gateway and attach a central inspection VPC with a firewall appliance. Configure route tables to send inter-VPC traffic through the inspection VPC.. A Transit Gateway with a central inspection VPC allows you to route all inter-VPC traffic through a firewall appliance for inspection. By configuring route tables on the Transit Gateway, you can force traffic between application VPCs to traverse the inspection VPC, enabling centralized security filtering without requiring point-to-point peering or per-VPC rules.

Answer

Create VPC Peering connections between each pair of application VPCs and apply security groups to the peer connections.

Answer

Use security groups in each application VPC to control traffic between VPCs.

Answer

Use network ACLs in each application VPC to filter traffic between VPCs.

Question 10

A company is designing a hybrid network with multiple AWS Direct Connect connections to multiple on-premises data centers. They want to maximize availability and use all available bandwidth. They have two Direct Connect connections terminated at two different Direct Connect locations. They plan to use a single Virtual Private Gateway (VGW) for each VPC. Which configuration should be used to meet these requirements?

Accepted Answer

Create a Direct Connect Gateway. Attach both Direct Connect connections to the Direct Connect Gateway. Associate the Direct Connect Gateway with the VGW. Configure the on-premises routers to use BGP with equal-cost multipath (ECMP).. It uses a Direct Connect Gateway to aggregate multiple Direct Connect connections into a single logical endpoint, allowing both connections to be associated with a single VGW. By configuring BGP with ECMP on the on-premises routers, traffic is load-balanced across both connections, maximizing bandwidth utilization while providing high availability through redundant paths.

Answer

Create two VGWs and attach each to a separate Direct Connect connection. Use a Transit Gateway to connect the VGWs to the VPC.

Answer

Create two Virtual Private Gateways, one for each Direct Connect connection. Attach each VGW to the VPC. Configure BGP on both connections for active-active.

Answer

Create a single virtual interface and associate it with both Direct Connect connections. Attach the virtual interface to the VGW.

Question 11

A company is designing a multi-region application with active-active configuration. They need a global DNS service that can route users to the nearest healthy endpoint and automatically failover to another region if an endpoint becomes unhealthy. Which AWS service should be used?

Accepted Answer

Amazon Route 53 with latency-based routing and health checks. Amazon Route 53 with latency-based routing and health checks is the correct choice because it provides global DNS resolution that directs users to the endpoint with the lowest latency, while health checks automatically detect endpoint failures and trigger failover to a healthy region. This satisfies the active-active multi-region requirement by distributing traffic across multiple regions and ensuring automatic failover without manual intervention.

Answer

Amazon CloudFront

Answer

Elastic Load Balancer

Answer

AWS Global Accelerator

Question 12

A company is setting up a new AWS Direct Connect connection. They have provisioned a 1 Gbps dedicated connection. They need to create a private virtual interface (VIF) to connect to their VPC. The VIF has been created and is in the 'available' state, but the BGP session is not coming up. What is the most likely cause?

Accepted Answer

The BGP authentication key does not match between the customer router and AWS.. The most likely cause is a BGP authentication key mismatch. When the BGP session fails to establish but the virtual interface is in the 'available' state, it indicates the Layer 2 (VLAN) and Layer 1 (physical) connectivity are working. BGP authentication uses MD5 (per RFC 2385), and if the pre-shared key configured on the customer router does not exactly match the key specified in the AWS Direct Connect console for the private VIF, the TCP MD5 signature will fail, preventing the BGP session from coming up.

Answer

The BGP hold timer is set too high on the customer router.

Answer

The VLAN ID assigned to the VIF is already in use on another VIF.

Answer

The Direct Connect interface is in the 'down' state.

Question 13

A company has a VPC with multiple subnets. They want to ensure that all outbound traffic from EC2 instances in the VPC goes through a centralized NAT device for inspection. They have deployed a NAT instance in a public subnet and configured the route tables for private subnets to point to the NAT instance. However, traffic is not being routed through the NAT instance. What is the most likely cause?

Accepted Answer

The source/destination check is enabled on the NAT instance.. The source/destination check is a security feature on EC2 instances that prevents them from forwarding traffic unless the instance is the source or destination of the packet. Since a NAT instance must forward traffic that it did not originate (e.g., from private instances to the internet), this check must be disabled. When enabled, the NAT instance drops packets that are not addressed to itself, breaking the routing of outbound traffic through it.

Answer

The NAT instance does not have a public IP address.

Answer

The route table for the private subnets does not have a default route (0.0.0.0/0) pointing to the NAT instance.

Answer

The security group of the NAT instance blocks outbound traffic.

Question 14

A company is designing a network architecture for a critical application that requires high availability across multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region. Which TWO services can provide global routing and failover between the two ALBs?

Accepted Answer

Amazon Route 53 with failover routing and health checks. Option A is correct because Amazon Route 53 failover routing policies let you define a primary and secondary record, and Route 53 health checks monitor each regional ALB so that DNS queries are automatically answered with the healthy region's ALB when the primary fails, providing global DNS-based failover. Option E is correct because AWS Global Accelerator provides two static anycast IP addresses and routes user traffic over the AWS global network to the optimal regional endpoint, with endpoint groups and health checks that automatically fail over traffic to the healthy ALB in the other region. Option B (AWS WAF) is a web application firewall for filtering HTTP/S requests, not a global routing or failover service. Option C (Network Load Balancer) is a regional Layer 4 load balancer and cannot route across regions or fail over between regional ALBs. Option D (Amazon CloudFront) is a content delivery network that caches and distributes content at edge locations; it does not itself perform health-check-based failover between two regional ALBs.

Answer

AWS WAF

Answer

Network Load Balancer (NLB)

Answer

Amazon CloudFront

Question 15

A company is deploying a VPC with public and private subnets. They need to provide internet access to instances in the private subnets for software updates. Which THREE components are required to achieve this?

Accepted Answer

Route table in the private subnet with a default route pointing to the NAT Gateway. Option C is correct because the NAT Gateway must reside in a public subnet so it can have a route to the Internet Gateway and perform source NAT for private instances' outbound traffic. Option D is correct because an Internet Gateway attached to the VPC is required to give the public subnet (and thus the NAT Gateway) connectivity to the internet. Option A is correct because the private subnet's route table needs a default route (0.0.0.0/0) pointing to the NAT Gateway so instances in that subnet can send internet-bound traffic through it. Option B is not needed because a Site-to-Site VPN connects on-premises networks to AWS, not private subnets to the public internet. Option E is not needed because Direct Connect is a dedicated private link to AWS, not an internet-access mechanism for private subnet instances.

Answer

AWS Site-to-Site VPN connection

Answer

AWS Direct Connect connection