ANS-C01 Network Design Practice Test 36 — 15 Questions

Question 1

A company is designing a multi-region application with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route traffic to the nearest region using latency-based routing. Which AWS service should they use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Route 53 with latency routing policy. Route 53's latency routing policy directs traffic to the region with the lowest network latency for the end user, based on measurements between AWS regions and the client's DNS resolver. This directly meets the requirement to route traffic to the nearest region without adding any additional infrastructure or cost beyond DNS queries.

Answer

AWS Global Accelerator

Answer

AWS Transit Gateway

Answer

Amazon CloudFront with multiple origins

Question 2

A company has a VPC with public and private subnets. They want to provide outbound internet access to instances in private subnets while preventing inbound internet traffic. The solution must be highly available and scale automatically. Which combination of services should be used?

Accepted Answer

NAT Gateway in each Availability Zone with route tables pointing to the NAT Gateway. D is correct because a NAT Gateway in each Availability Zone provides highly available, automatically scaling outbound internet access for private subnets while blocking unsolicited inbound traffic. NAT Gateways are managed by AWS, scale up to 45 Gbps, and are redundant per AZ, meeting the requirements for high availability and automatic scaling without manual intervention.

Answer

NAT instances in each Availability Zone

Answer

VPC endpoint for S3 and DynamoDB

Answer

Internet Gateway attached to the VPC with route tables pointing to the Internet Gateway

Question 3

A company has a VPC with multiple subnets. They want to monitor all network traffic to and from an EC2 instance for troubleshooting. Which AWS service should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. This makes it the correct service for monitoring all network traffic to and from an EC2 instance for troubleshooting purposes.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company is designing a network for a high-traffic web application that must be highly available across multiple AWS Regions. The application uses Application Load Balancers (ALBs) in each region. Which TWO actions should be taken to route traffic to the nearest healthy endpoint?

Accepted Answer

Use Amazon Route 53 latency-based routing with health checks. Option B is correct because Route 53 latency-based routing directs each user to the AWS Region that provides the lowest network latency, and associating health checks with the records ensures traffic is only sent to healthy ALB endpoints, which is exactly what is needed for a multi-Region highly available web app. Option D is correct because AWS Global Accelerator provides static anycast IP addresses and routes users over the AWS global network to the optimal healthy endpoint group in each Region, improving availability and performance for multi-Region ALB deployments. Option A is not correct because weighted routing distributes traffic by assigned proportions rather than by proximity or latency, so it does not route users to the nearest healthy endpoint. Option C is not correct because multi-value answer routing returns multiple healthy records for client-side selection and does not optimize for the nearest Region. Option E is not correct because failover routing is designed for active-passive disaster recovery, sending traffic to a secondary endpoint only when the primary is unhealthy, not for choosing the nearest healthy endpoint.

Answer

Use Amazon Route 53 weighted routing

Answer

Use Amazon Route 53 multi-value answer routing

Answer

Use Amazon Route 53 failover routing

Question 5

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. Which THREE steps are necessary?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) in the firewall VPC and register the firewall instances as targets. Option B is correct because a Gateway Load Balancer (GWLB) is the AWS service designed to distribute traffic to third-party virtual firewall appliances, using GENEVE encapsulation on port 6081, and its endpoint is what the Transit Gateway routes traffic to for inspection. Option C is correct because Transit Gateway route tables must be configured so that traffic between the VPC attachments is directed to the firewall VPC attachment (specifically to the GWLB endpoint), enabling the inspection path rather than direct VPC-to-VPC routing. Option E is correct because the VPC hosting the firewall appliances must itself be attached to the Transit Gateway so the GWLB endpoint can receive and return traffic from the other VPC attachments. Option A is incorrect because VPC peering bypasses the Transit Gateway entirely and would not route traffic through the firewall appliance. Option D is incorrect because a NAT Gateway provides outbound internet access for private subnets and has nothing to do with inspecting inter-VPC traffic via a third-party firewall.

Answer

Create a VPC peering connection between the VPCs to allow traffic flow

Answer

Configure a NAT Gateway in each VPC to route traffic through the firewall

Question 6

A company is designing a multi-Region application with an Application Load Balancer (ALB) in each Region fronting an Auto Scaling group of EC2 instances. The application must be accessible via a single DNS name, and traffic should be routed to the closest healthy Region using a latency-based routing policy. Which AWS service should be used as the DNS endpoint to achieve this?

Accepted Answer

Amazon Route 53. Amazon Route 53 is the correct choice because it supports latency-based routing policies, which direct traffic to the AWS Region that provides the lowest latency for the end user. By configuring a single DNS name with latency records pointing to the ALB endpoints in each Region, Route 53 can automatically route requests to the closest healthy Region, meeting the requirement for a single DNS name and latency-based routing.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

AWS Network Load Balancer

Question 7

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company wants to use a single NAT Gateway for all private subnets to reduce costs, but the NAT Gateway is in a single Availability Zone (AZ). The network architect is concerned about single points of failure. Which design best addresses high availability while still using the minimum number of NAT Gateways?

Accepted Answer

Deploy one NAT Gateway in each AZ that contains private subnets, and update the route tables accordingly.. Deploying one NAT Gateway per Availability Zone (AZ) that contains private subnets ensures that if an AZ fails, the private subnets in other AZs still have internet access via their local NAT Gateway. This design provides high availability while using the minimum number of NAT Gateways necessary to cover all AZs with private subnets, avoiding a single point of failure without over-provisioning.

Answer

Deploy a single NAT Gateway in one AZ and use a VPN to an on-premises internet gateway as backup.

Answer

Use a NAT instance in an Auto Scaling group across multiple AZs instead of a NAT Gateway.

Answer

Create a second VPC with a NAT Gateway and peer the VPCs to share the NAT Gateway.

Question 8

A company wants to connect its on-premises data center to AWS using a dedicated, high-bandwidth, low-latency connection. The data center is collocated with an AWS Direct Connect location. Which AWS service should be used to establish this connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, high-bandwidth, low-latency connection from an on-premises data center to AWS. Since the data center is collocated with an AWS Direct Connect location, the company can establish a physical cross-connect directly to the AWS Direct Connect router, bypassing the public internet entirely.

Answer

VPC peering

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Question 9

A company needs to establish private connectivity between two VPCs in different AWS accounts. The VPCs are in the same Region. Which AWS feature should be used?

Accepted Answer

VPC peering. VPC peering is the correct choice because it establishes a direct, private network connection between two VPCs in the same AWS Region, even across different AWS accounts, using the AWS backbone without requiring a transit hub or external connectivity. It leverages the existing AWS infrastructure to route traffic between the VPCs via private IPv4 or IPv6 addresses, with no bandwidth bottlenecks or single points of failure inherent in the design.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 10

A company wants to improve the performance and availability of its application that is deployed on EC2 instances in a single Availability Zone. Which architecture should the company implement?

Accepted Answer

Deploy EC2 instances in multiple Availability Zones. Deploying EC2 instances across multiple Availability Zones (AZs) improves both performance and availability by eliminating a single point of failure. If one AZ experiences an outage, traffic can be routed to healthy instances in another AZ using an Elastic Load Balancer or Route 53 DNS failover. This architecture also distributes the load, reducing latency for users in different geographic regions.

Answer

Add more subnets in the same Availability Zone

Answer

Use larger EC2 instances

Answer

Use Auto Scaling in the same Availability Zone

Question 11

A company has an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The ALB is configured with a target group that has a health check path of /health. Some instances are failing health checks and being marked unhealthy, but the application logs show the instances are healthy. What is the most likely cause?

Accepted Answer

The security group for the instances does not allow inbound traffic from the ALB's security group on the health check port. The most likely cause is that the security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port. ALB health checks originate from the ALB's private IP addresses, and if the instance security group lacks an inbound rule permitting traffic from the ALB's security group (or its CIDR) on the health check port, the health check requests are dropped, causing the target to be marked unhealthy even though the application itself is running fine.

Answer

The health check path is incorrect

Answer

The target group's slow start duration is too long

Answer

The ALB's stickiness is preventing health checks

Question 12

Which TWO options are valid methods to connect a VPC to an on-premises network? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (A) is correct because it creates an IPsec VPN tunnel over the public internet between an on-premises customer gateway and an AWS virtual private gateway or transit gateway, securely connecting the VPC to the on-premises network. AWS Direct Connect (C) is correct because it provides a dedicated private physical network connection from an on-premises location to AWS, which can be attached to a virtual private gateway or Direct Connect gateway to reach the VPC. An Internet Gateway (B) only enables internet connectivity for resources in a VPC and does not link to an on-premises network. A VPC endpoint (D) privately connects a VPC to supported AWS services (or to endpoint services via PrivateLink), not to an on-premises network. VPC peering (E) connects two VPCs to each other and does not provide on-premises connectivity.

Answer

Internet Gateway

Answer

VPC endpoint

Answer

VPC peering

Question 13

Which TWO statements about AWS Transit Gateway are correct? (Choose two.)

Accepted Answer

It supports transitive routing between attached VPCs. Option B is correct because AWS Transit Gateway acts as a regional hub that supports transitive routing, meaning a VPC attached to the transit gateway can reach other attached VPCs without needing a full mesh of VPC peering connections. Option C is correct because Transit Gateway supports cross-account sharing through AWS Resource Access Manager (RAM), allowing an owner account to share a transit gateway with other accounts or an AWS Organization. Option A is not correct because a Transit Gateway does not itself provide internet access; internet egress requires an attached VPC with an internet gateway or a NAT gateway, or a separate egress VPC architecture. Option D is not correct because Direct Connect is a dedicated physical network connection to AWS, while Transit Gateway is a routing hub that can attach to Direct Connect gateways but does not replace the Direct Connect service. Option E is not correct because Transit Gateway supports multiple attachment types, including VPC attachments, VPN attachments, Direct Connect gateway attachments, and peering attachments, not only VPN attachments.

Answer

It provides internet access for attached VPCs

Answer

It can replace AWS Direct Connect for on-premises connectivity

Answer

It only supports VPN attachments

Question 14

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Option A is correct because high availability in a VPC requires spreading resources across at least two Availability Zones, so that a failure of one AZ does not take down the entire multi-tier application. Option C is correct because using separate subnets for the web, application, and database tiers enables tier-specific security controls such as security groups and NACLs, and limits lateral movement between tiers. Option E is correct because NAT Gateways placed in public subnets allow instances in private subnets to initiate outbound internet traffic (for patching, updates, or external API calls) without exposing them to inbound internet access. Option B is not appropriate because assigning public IP addresses to all instances, especially application and database tiers, unnecessarily exposes them to the internet and violates least-privilege network design. Option D is not appropriate because using a single Availability Zone reduces latency only marginally while eliminating fault tolerance, which contradicts the high availability requirement.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency

Question 15

A company is designing a multi-region active-active architecture for a web application using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must provide low-latency access to users worldwide and automatically route traffic to healthy endpoints. Which design should be used?

Accepted Answer

Deploy Global Accelerator with endpoints in each region (ALBs) and configure health checks to route traffic to healthy endpoints.. Global Accelerator uses the AWS global network and Anycast IPs to direct traffic to the nearest healthy endpoint, providing low-latency access and automatic failover across regions. By configuring ALBs as endpoints in each region with health checks, Global Accelerator ensures traffic is routed only to healthy endpoints, meeting the active-active multi-region requirement.

Answer

Use Amazon CloudFront with multiple origins pointing to ALBs in each region and configure origin failover.

Answer

Use Amazon Route 53 latency-based routing with health checks to route traffic to ALBs in each region.

Answer

Deploy a single ALB with multiple target groups across regions using cross-zone load balancing.