ANS-C01 Network Design Practice Test 38 — 15 Questions

Question 1

A company wants to connect two VPCs in the same AWS region using a hub-and-spoke model. Which AWS service should be used to route traffic between the VPCs through a central inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway is the correct choice because it acts as a central hub that connects multiple VPCs and on-premises networks in a hub-and-spoke topology. It allows you to route traffic between VPCs through a central inspection VPC for security or compliance purposes, using route tables to control traffic flow without requiring individual peering connections.

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub

Answer

VPC Peering

Question 2

A company is designing a multi-region architecture with an active-active setup. They need to route traffic to the nearest healthy endpoint. Which AWS service should they use?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS Region that provides the lowest latency for the end user, based on measurements between the user's DNS resolver and AWS endpoints. It also supports health checks, automatically excluding unhealthy endpoints from the routing pool, which enables an active-active multi-region architecture by routing each request to the nearest healthy endpoint. AWS Global Accelerator also routes to the nearest healthy endpoint but uses anycast IPs at the network layer, making it more suitable for optimizing TCP/UDP traffic rather than general DNS-level routing.

Answer

Application Load Balancer (ALB)

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Question 3

A company needs to ensure that all traffic between their VPC and on-premises network is encrypted. Which solution meets this requirement?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted IPsec tunnel between the VPC and on-premises network, ensuring all traffic is encrypted over the public internet. This meets the requirement for mandatory encryption, unlike unencrypted options such as Direct Connect or VPC Peering.

Answer

AWS Direct Connect with a private VIF

Answer

VPC Peering connection

Answer

AWS Internet Gateway

Question 4

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet and need it to access the internet. Which combination of components is required?

Accepted Answer

A NAT Gateway in a public subnet and a default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway. A NAT Gateway in a public subnet provides outbound-only internet access for instances in private subnets. A default route (0.0.0.0/0) in the private subnet's route table pointing to the NAT Gateway ensures traffic destined for the internet is forwarded to the NAT Gateway, which then translates the source IP to its own Elastic IP and sends the traffic through the Internet Gateway (IGW) attached to the public subnet. This combination allows the EC2 instance to initiate outbound connections (e.g., for software updates) while remaining unreachable from the internet.

Answer

A NAT instance in the private subnet with a route to an Internet Gateway

Answer

A VPC Gateway Endpoint for S3 in the private subnet

Answer

An Internet Gateway (IGW) attached to the VPC and a default route (0.0.0.0/0) in the private subnet's route table pointing to the IGW

Question 5

A company has multiple VPCs connected via AWS Transit Gateway. They need to inspect all inter-VPC traffic using a centralized firewall appliance. What is the most efficient way to achieve this?

Accepted Answer

Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance. Attaching the firewall appliance to the Transit Gateway and configuring Transit Gateway route tables to send traffic to the appliance is the most efficient method because it allows the Transit Gateway to act as a central hub, directing all inter-VPC traffic through the firewall for inspection without requiring complex peering or per-VPC routing changes. This leverages the Transit Gateway's route table capabilities to create a single inspection point, minimizing latency and administrative overhead.

Answer

Enable VPC Flow Logs and analyze traffic patterns

Answer

Create VPC Gateway Endpoints for each VPC and route traffic through them

Answer

Use a Network Load Balancer to distribute traffic to the firewall appliance

Question 6

A company wants to use AWS Direct Connect to connect their on-premises network to a VPC. They have two Direct Connect locations and want high availability. What is the minimum number of Direct Connect virtual interfaces needed?

Accepted Answer

Two private VIFs. For high availability across two Direct Connect locations, you need at least two private virtual interfaces (VIFs), one at each location, each connecting to the same VPC. This ensures that if one Direct Connect connection or location fails, traffic can still flow through the other private VIF. A single private VIF provides no redundancy, and public VIFs are used for accessing public AWS services, not VPC connectivity.

Answer

One public VIF and one private VIF

Answer

Four private VIFs

Answer

One private VIF

Question 7

A company is designing a network for a multi-tier application. The web tier must be accessible from the internet, and the application tier must only be accessible from the web tier. Which architecture should they use?

Accepted Answer

Web servers in public subnets with an Internet Gateway, and application servers in private subnets with security groups allowing traffic only from the web tier. It places the web servers in public subnets with an Internet Gateway (IGW) to allow direct inbound traffic from the internet, while the application servers reside in private subnets with security groups that explicitly permit traffic only from the web tier's security group. This ensures the application tier is not directly reachable from the internet, adhering to the principle of least privilege and defense in depth.

Answer

Web servers in private subnets with a NAT Gateway for outbound traffic, and application servers in public subnets

Answer

All servers in a single VPC with VPC Peering to another VPC

Answer

Web servers and application servers in public subnets, each with their own security group

Question 8

A company is designing a hybrid network using AWS Direct Connect. They want to ensure high availability and minimize downtime. Which TWO actions should they take?

Accepted Answer

Set up a site-to-site VPN as a backup for the Direct Connect connection. Option A is correct because a site-to-site VPN over the internet provides a redundant, encrypted backup path that can automatically take over if the Direct Connect connection fails, ensuring continuity and minimizing downtime. Option D is correct because provisioning Direct Connect connections at two different Direct Connect locations provides physical path diversity, so a failure at one location (or its equipment) does not take down all connectivity. Option B is incorrect because a single customer router is a single point of failure, which undermines high availability. Option C is incorrect because a single Direct Connect connection with two virtual interfaces still relies on one physical connection and one location, so it does not provide the required redundancy. Option E is incorrect because using the same BGP ASN on both connections is not a high-availability measure and can complicate routing; diverse connections should be designed with proper BGP configuration, not merely duplicated ASNs.

Answer

Use a single customer router for both connections

Answer

Provision a single Direct Connect connection with two virtual interfaces

Answer

Use the same BGP ASN on both Direct Connect connections

Question 9

A company is deploying a web application in a VPC. They need to ensure that the web servers can be accessed from the internet and that traffic is encrypted. Which TWO services should they use?

Accepted Answer

Application Load Balancer (ALB). The Application Load Balancer (ALB) is correct because it operates at Layer 7 and can be configured as internet-facing within a public subnet, distributing incoming HTTP/HTTPS traffic from the internet to the backend web servers in the VPC. AWS Certificate Manager (ACM) is correct because it provisions and manages the TLS/SSL certificates that the ALB uses to terminate HTTPS connections, thereby encrypting traffic between clients and the load balancer. Together, the ALB provides the public entry point and ACM supplies the certificate enabling encrypted HTTPS access. AWS WAF is a Layer 7 firewall for filtering malicious requests but does not by itself provide internet access or encryption. NAT Gateway only enables outbound internet access for private subnets and does not accept inbound traffic. Amazon CloudFront is a CDN that can front an application, but it is not required to make the web servers reachable or to encrypt traffic to them.

Answer

AWS WAF

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 10

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need to access the internet for software updates. Which configuration meets this requirement securely?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update the private subnet route tables to point 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway placed in a public subnet with an Elastic IP allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface, which translates source private IPs to the NAT Gateway's Elastic IP using SNAT (Source Network Address Translation). This meets the requirement securely by maintaining the private subnets' isolation from direct internet exposure.

Answer

Attach an Internet Gateway to the VPC and add a route to 0.0.0.0/0 in the private subnet route tables pointing to the Internet Gateway.

Answer

Create a VPC Peering connection to a second VPC that has an Internet Gateway and route all traffic through it.

Answer

Configure a Virtual Private Gateway and use an AWS Direct Connect connection to the internet.

Question 11

A company has a VPC with an application load balancer (ALB) in public subnets and web servers in private subnets. The web servers must be accessible only from the ALB. What is the most secure and efficient configuration?

Accepted Answer

Configure the web server security group to allow inbound HTTP from the ALB's security group.. Referencing the ALB's security group in the web server security group rule allows traffic only from the ALB, regardless of its IP addresses. This is the most secure and efficient configuration as it leverages AWS security group referencing, which automatically scales with the ALB's elastic network interfaces and avoids managing IP changes.

Answer

Configure the web server security group to allow inbound HTTP from 0.0.0.0/0.

Answer

Configure the web server security group to allow inbound HTTP from the ALB's private IP addresses.

Answer

Configure the web server security group to allow inbound HTTP from the VPC CIDR.

Question 12

A company is using AWS Direct Connect to connect its on-premises data center to a VPC. They want to ensure high availability and failover. Which TWO configurations should they implement? (Select TWO.)

Accepted Answer

Configure a Site-to-Site VPN connection as a backup.. Option A is correct because a Site-to-Site VPN over the internet provides a redundant, encrypted IPSec backup path that automatically takes over if the Direct Connect connection fails, ensuring high availability and failover for the VPC. Option D is correct because provisioning a second Direct Connect connection at a different Direct Connect location provides physical path diversity and redundancy, so a failure at one location or device does not take down connectivity. Option B is incorrect because a Direct Connect Gateway only enables connectivity from one Direct Connect connection to multiple VPCs across regions; it does not by itself provide redundancy or failover. Option C is incorrect because two virtual interfaces on a single Direct Connect connection still share the same physical link and device, so they do not protect against a connection or location failure. Option E is incorrect because multiple VLANs on the same connection are logical separations, not redundant paths, and cannot provide failover if the underlying connection fails.

Answer

Create a Direct Connect Gateway and attach multiple VPCs.

Answer

Use a single Direct Connect connection with two virtual interfaces.

Answer

Use the same Direct Connect connection with multiple VLANs.

Question 13

A company is designing a network for a real-time financial trading application. The application requires deterministic low-latency connectivity between two EC2 instances in different Availability Zones within the same VPC. Which placement group type and networking feature should the company use?

Accepted Answer

Cluster placement group and Elastic Fabric Adapter (EFA). For deterministic low-latency, high-throughput networking between EC2 instances, use a cluster placement group with Elastic Fabric Adapter (EFA). Cluster placement groups pack instances close together in a single AZ, providing low-latency networking. EFA adds OS-bypass and reliable transport for HPC and latency-sensitive workloads. Spread placement groups are for reducing correlated failures, not latency, and jumbo frames alone do not provide deterministic low latency.

Answer

Partition placement group and Elastic Network Adapter (ENA) with SR-IOV

Answer

Spread placement group and EC2 networking with jumbo frames

Answer

Cluster placement group and standard TCP/IP networking

Question 14

A company wants to allow its employees to securely access internal applications hosted in a VPC without traversing the internet. The company also wants to be able to enforce security policies at the user level. Which AWS service should the company use?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN service that allows employees to securely access internal applications hosted in a VPC from any location without traversing the internet. It uses OpenVPN-based client software and integrates with AWS Identity and Access Management (IAM) and Active Directory to enforce security policies at the user level, such as group-based access controls and multi-factor authentication.

Answer

Bastion host in a public subnet

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 15

A company is designing a multi-account AWS environment using AWS Organizations. The company wants to centralize outbound internet traffic from all VPCs in all accounts through a single VPC in a shared services account. The shared services account has a VPC with a NAT gateway and an internet gateway. Which architecture meets this requirement?

Accepted Answer

Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.. A transit gateway allows you to centrally route traffic from multiple VPCs across different AWS accounts to a shared services VPC. By attaching all VPCs to a transit gateway and configuring route tables appropriately, you can force all outbound internet traffic from the spoke VPCs to go through the shared services VPC's NAT gateway and internet gateway, centralizing egress traffic.

Answer

Create VPC gateway endpoints for all AWS services in each VPC.

Answer

Set up a VPN connection from each VPC to the shared services VPC and use the latter's internet gateway.

Answer

Peer each VPC to the shared services VPC and configure a default route pointing to the shared services VPC's NAT gateway.