ANS-C01 Network Design Practice Test 37 — 15 Questions

Question 1

A company is migrating its on-premises data center to AWS. The network team needs to design a hybrid connectivity solution that provides high availability with a bandwidth of at least 10 Gbps and low latency for real-time data replication. The company has two redundant on-premises routers connected to two separate internet service providers (ISPs). Which combination of AWS services should the company use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provision two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connect each on-premises router to one of them.. Provisioning two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connecting each on-premises router to one of them provides both high availability (via geographic and path redundancy) and the required 10 Gbps bandwidth with low latency for real-time data replication. This design eliminates single points of failure and meets the bandwidth requirement without relying on VPNs, which cannot guarantee consistent low latency or 10 Gbps throughput.

Answer

Use AWS Direct Connect Gateway to aggregate multiple VPN connections to achieve higher bandwidth.

Answer

Provision a single AWS Direct Connect connection with a 10 Gbps port and connect both on-premises routers to it via a single interface.

Answer

Set up two AWS Site-to-Site VPN tunnels from each on-premises router to two different AWS VPN endpoints in the same region.

Question 2

A company has a VPC with multiple subnets across two AZs. The VPC is connected to an on-premises data center via AWS Direct Connect. The company wants to ensure that traffic between the VPC and on-premises is load-balanced across two Direct Connect virtual interfaces (VIFs) for high availability. Which configuration should be used?

Accepted Answer

Configure two VIFs and use BGP to advertise the same prefixes with equal metrics to enable ECMP.. Configuring two Direct Connect virtual interfaces (VIFs) with BGP and advertising the same prefixes with equal metrics (e.g., equal MED or AS-path length) enables Equal-Cost Multi-Path (ECMP) routing. This allows the VPC and on-premises routers to load-balance traffic across both VIFs, providing high availability and active-active utilization of the Direct Connect connections.

Answer

Configure a VPN connection over each VIF and use equal-cost routes between the VPN tunnels.

Answer

Configure a single Direct Connect VIF with a 10 Gbps connection and a single BGP session.

Answer

Configure two VIFs with static routes pointing to different on-premises IPs.

Question 3

A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?

Accepted Answer

Public subnet for web servers, private subnets for application and database servers. It uses a public subnet with an Internet Gateway (IGW) for the web servers to receive inbound traffic from the internet, while placing the application and database servers in private subnets with no direct internet route. This design enforces the principle of least privilege by isolating sensitive tiers, using NAT Gateway or VPC endpoints for outbound traffic if needed, and relying on security groups and network ACLs for fine-grained access control.

Answer

A single subnet for all tiers with network ACLs to isolate traffic

Answer

Private subnets for all tiers

Answer

Public subnets for all tiers

Question 4

A company is using AWS Organizations to manage multiple accounts. The network team needs to allow a centralized inspection VPC to inspect all traffic between VPCs in different accounts. Which AWS service should be used to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub for inter-VPC and inter-account traffic, enabling you to attach VPCs from multiple AWS accounts (via AWS Organizations) and route traffic through a centralized inspection VPC. By using Transit Gateway route tables and a dedicated inspection VPC with appliances (e.g., firewall), you can enforce traffic inspection for all cross-account VPC communications without requiring individual peering connections.

Answer

VPC peering connections

Answer

AWS PrivateLink

Answer

AWS Site-to-Site VPN

Question 5

A company is deploying an application that must use IPv6 for internet-facing traffic. The VPC is currently using IPv4 only. What is the simplest way to enable IPv6?

Accepted Answer

Associate an IPv6 CIDR block with the VPC and subnets, and update route tables to route IPv6 traffic to an internet gateway.. The simplest way to enable IPv6 in an existing IPv4-only VPC is to associate an IPv6 CIDR block (e.g., an Amazon-provided /56) with the VPC and subnets, then update the route tables to direct IPv6 traffic (::/0) to an internet gateway. This requires no additional translation or complex infrastructure, as the internet gateway is already dual-stack capable and can handle both IPv4 and IPv6 traffic natively.

Answer

Use an egress-only internet gateway for IPv6 traffic.

Answer

Deploy a NAT64 device to translate IPv6 to IPv4.

Answer

Set up a VPN connection to an ISP that provides IPv6.

Question 6

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

Accepted Answer

Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.. Elastic Fabric Adapter (EFA) provides OS-bypass capabilities that enable HPC and machine learning workloads to achieve sub-millisecond latency by bypassing the operating system kernel for inter-instance communication. Combined with a cluster placement group, which ensures instances are in close physical proximity within a single Availability Zone, this configuration delivers the lowest possible latency for tightly coupled applications.

Answer

Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

Answer

Launch instances in a spread placement group with SR-IOV enabled.

Answer

Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.

Question 7

A company wants to connect its VPC to an on-premises data center using AWS Direct Connect. The company has two Direct Connect locations in the same AWS region. For high availability, they plan to establish two separate connections. Which configuration ensures that if one connection fails, traffic automatically fails over to the other?

Accepted Answer

Establish two Direct Connect connections from different Direct Connect locations to the same VPC, each with a private VIF attached to the same virtual private gateway.. It provides true high availability by using two Direct Connect connections from different geographic locations, each with a private virtual interface (VIF) attached to the same virtual private gateway (VGW). This configuration ensures that if one connection fails, BGP sessions automatically withdraw the affected routes, and traffic is rerouted over the remaining connection via the VGW's active/active or active/passive routing behavior.

Answer

Establish one Direct Connect connection and one AWS Site-to-Site VPN connection as backup.

Answer

Establish two Direct Connect connections from the same Direct Connect location to the same VPC.

Answer

Establish a single Direct Connect connection with two virtual interfaces (VIFs) to the same VPC.

Question 8

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their internet-facing Application Load Balancer. The VPC is already associated with an IPv6 CIDR block. What additional configuration is required? (Choose two.)

Accepted Answer

Add a route in the subnet's route table for ::/0 to the Internet Gateway.. Option B is correct because once the VPC has an IPv6 CIDR, the public subnet's route table must contain a route for ::/0 pointing to the Internet Gateway (igw-xxxxxxxx) to allow IPv6 traffic to and from the internet. Option C is correct because each subnet that will host IPv6 resources must itself be assigned an IPv6 CIDR block (a /64) from the VPC's IPv6 range; the VPC-level association alone does not give the subnet IPv6 capability. Option A is incorrect because NAT64/DNS64 is only needed for IPv4-only resources to reach IPv6 destinations, not for an internet-facing ALB that will have native IPv6. Option D is incorrect because you do not manually assign an IPv6 address to an ALB's network interface; the ALB is configured as dualstack and AWS manages its ENIs and addresses. Option E is incorrect because an Egress-Only Internet Gateway only permits outbound IPv6 traffic and does not support inbound internet-facing IPv6 connectivity required by a public ALB.

Answer

Configure NAT64 and DNS64 on the VPC.

Answer

Assign an IPv6 address to the ALB's network interface.

Answer

Create an Egress-Only Internet Gateway for the VPC.

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to communicate with an RDS database in subnet-B. Both subnets are in the same Availability Zone. What is the most efficient way to enable this communication?

Accepted Answer

No additional configuration is required. The instance and database can communicate within the same VPC.. Both the EC2 instance and the RDS database reside within the same VPC (10.0.0.0/16), and subnets within a VPC can communicate with each other by default using the VPC's local route. No additional configuration is needed, as the VPC's main route table or subnet route tables already include a local route for the VPC CIDR, enabling direct communication within the same Availability Zone.

Answer

Create a Transit Gateway and attach both subnets to it.

Answer

Place a NAT Gateway in subnet-A and configure route tables accordingly.

Answer

Create a VPC Peering connection between the two subnets.

Question 10

A company is deploying a multi-tier web application across three Availability Zones in a single AWS Region. The web tier must be fault-tolerant and scale horizontally. Which network design provides the highest availability and scalability?

Accepted Answer

Use an Application Load Balancer in front of an Auto Scaling group spanning three Availability Zones.. An Application Load Balancer (ALB) distributes incoming HTTP/HTTPS traffic across multiple targets, and when combined with an Auto Scaling group that spans three Availability Zones, it provides both horizontal scalability and fault tolerance. If one AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZs, ensuring high availability. This design meets the requirement for a multi-tier web application that must scale horizontally and tolerate failures.

Answer

Deploy a single EC2 instance in one Availability Zone with an Elastic IP address.

Answer

Deploy EC2 instances in a single Availability Zone and use Route 53 weighted routing.

Answer

Use a Network Load Balancer with a single EC2 instance in each AZ.

Question 11

A company wants to allow its VPC to access an S3 bucket securely without traversing the internet. Which AWS resource enables private connectivity between a VPC and S3?

Accepted Answer

VPC Gateway Endpoint. A VPC Gateway Endpoint (C) is the correct choice because it provides private, direct connectivity between a VPC and S3 without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, using prefix lists in the VPC route table to direct S3 traffic to the endpoint, ensuring data never leaves the AWS backbone.

Answer

Internet Gateway

Answer

AWS Site-to-Site VPN

Answer

NAT Gateway

Question 12

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They need to centralize outbound internet traffic through a single VPC. Which architecture should be used?

Accepted Answer

Designate one VPC as an egress VPC with a NAT Gateway and Internet Gateway, and use Transit Gateway route tables to route 0.0.0.0/0 from other VPCs to the egress VPC.. It uses a dedicated egress VPC with a NAT Gateway and Internet Gateway, and leverages Transit Gateway route tables to direct 0.0.0.0/0 traffic from all other VPCs to this central point. This architecture centralizes outbound internet traffic, avoids overlapping NAT responsibilities, and maintains a clean hub-and-spoke design where only the egress VPC has direct internet access.

Answer

Attach a NAT Gateway to each VPC's private subnets.

Answer

Attach an Internet Gateway to each VPC and route 0.0.0.0/0 to the IGW.

Answer

Use a VPN connection to an on-premises data center for internet access.

Question 13

A company is designing a network for a critical application that requires high availability across multiple Availability Zones. Which TWO design choices ensure that the application remains available if an entire AZ fails?

Accepted Answer

Deploy resources in at least two Availability Zones.. Option B is correct because deploying resources in at least two Availability Zones provides redundancy, so if one AZ fails, the application can continue serving traffic from the surviving AZ. Option D is correct because an Application Load Balancer is a regional, highly available service that spans multiple AZs by design, automatically routing traffic to healthy targets in other AZs when one AZ becomes unavailable. Option A is wrong because a single AZ is a single point of failure with no redundancy. Option C is wrong because a Network Load Balancer confined to a single AZ cannot survive the loss of that AZ. Option E is wrong because a single EC2 instance, even with an Elastic IP, is a single point of failure and the Elastic IP does not provide cross-AZ failover.

Answer

Deploy resources in a single Availability Zone.

Answer

Use a Network Load Balancer in a single AZ.

Answer

Use a single EC2 instance with an Elastic IP address.

Question 14

A company is deploying a multi-tier web application across multiple Availability Zones in a single Region. The web tier must be fault-tolerant and distribute traffic across EC2 instances. The application tier uses an Auto Scaling group of EC2 instances that need to be accessed by the web tier using a static IP address. Which combination of AWS services meets these requirements?

Accepted Answer

Application Load Balancer for the web tier and Network Load Balancer for the application tier. The web tier requires fault tolerance and traffic distribution across EC2 instances, which is best handled by an Application Load Balancer (ALB) operating at Layer 7 with path-based routing and health checks. The application tier needs a static IP address for the web tier to access it, which is a key feature of a Network Load Balancer (NLB) — it preserves the client IP and provides static IP addresses per Availability Zone, unlike ALBs which use dynamic IPs. This combination meets both requirements: ALB for web traffic distribution and NLB for static IP access to the application tier.

Answer

Classic Load Balancer for the web tier and Application Load Balancer for the application tier

Answer

AWS Global Accelerator for the web tier and Classic Load Balancer for the application tier

Answer

Network Load Balancer for the web tier and Application Load Balancer for the application tier

Question 15

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to communicate with an on-premises server using an IPsec VPN. The company has set up a Virtual Private Gateway (VGW) and a Customer Gateway (CGW) with a Site-to-Site VPN connection. The VPN tunnel is established. However, the EC2 instance cannot ping the on-premises server. The security groups and network ACLs allow all traffic. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route for the on-premises CIDR pointing to the VGW. The most likely cause is that the private subnet's route table lacks a route for the on-premises CIDR pointing to the Virtual Private Gateway (VGW). Even though the VPN tunnel is established, traffic from the EC2 instance in the private subnet will be dropped at the subnet level if there is no explicit route directing the on-premises destination to the VGW. Security groups and network ACLs are permissive, so the issue is routing, not filtering.

Answer

The VGW is not configured with the correct BGP ASN

Answer

The VGW is not attached to the VPC

Answer

The VPN tunnel is not in the UP state