ANS-C01 Network Design Practice Test 39 — 15 Questions

Question 1

A company is designing a network for a critical application that requires an SLA of 99.99% availability. The application runs on EC2 instances in an Auto Scaling group across three Availability Zones. The company needs to ensure that the network design meets the SLA. Which THREE components should the company include? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A NAT gateway in each Availability Zone for outbound internet access.. Option B is correct because deploying a NAT gateway in each Availability Zone provides highly available outbound internet access; if one AZ fails, the NAT gateways in the remaining AZs continue to serve their subnets, avoiding the single point of failure a single NAT gateway would create. Option D is correct because VPC endpoints (interface endpoints powered by AWS PrivateLink or gateway endpoints for S3/DynamoDB) let the instances reach AWS services privately without traversing the internet or a NAT device, removing dependency on internet connectivity and reducing failure domains for a 99.99% SLA. Option E is correct because an Application Load Balancer spans multiple Availability Zones and performs health checks, routing traffic only to healthy instances in all three AZs, which is essential for surviving an AZ outage and meeting the availability target. Option A is not appropriate because a single Direct Connect connection is a single point of failure (and Direct Connect alone does not provide the required redundancy without a second connection or VPN backup). Option C is not appropriate because a single Site-to-Site VPN connection is likewise a single point of failure and offers no HA guarantee for the stated SLA.

Answer

A single AWS Direct Connect connection for all inbound traffic.

Answer

A single AWS Site-to-Site VPN connection for administrative access.

Question 2

A company is migrating a legacy application to AWS. The application requires multicast traffic between EC2 instances in the same VPC. Which AWS service can support this requirement?

Accepted Answer

AWS Transit Gateway multicast domain. AWS Transit Gateway multicast domains are the only native AWS service that supports multicast traffic between EC2 instances within a VPC. AWS VPC Lattice does not support multicast; it provides service-to-service connectivity using HTTP/HTTPS and TCP. NLB, ALB, and GWLB are load balancers that distribute traffic but do not support multicast.

Answer

AWS VPC Lattice

Answer

Network Load Balancer (NLB)

Answer

Application Load Balancer (ALB)

Answer

Gateway Load Balancer (GWLB)

Question 3

A company has a VPC with public and private subnets. They launch an Amazon RDS for MySQL DB instance in a private subnet. The DB instance needs to be accessible from an on-premises application that connects via an AWS Site-to-Site VPN. What is the MOST secure way to allow the on-premises application to connect to the DB instance?

Accepted Answer

Place the DB instance in a private subnet and configure a security group to allow inbound traffic from the on-premises CIDR.. Placing the RDS DB instance in a private subnet ensures it has no public IP address, and configuring a security group to allow inbound traffic from the on-premises CIDR over the Site-to-Site VPN provides a secure, direct connection without exposing the database to the internet. Security groups act as a stateful firewall at the instance level, allowing only specified traffic from the on-premises network through the VPN tunnel.

Answer

Assign a public IP address to the DB instance and restrict access using a security group.

Answer

Place the DB instance in a private subnet and use a NAT gateway to allow inbound traffic.

Answer

Place the DB instance in a public subnet and configure a network ACL to allow traffic from the on-premises CIDR.

Question 4

A company is migrating its on-premises data center to AWS. The migration requires connectivity between the on-premises network and a VPC. The company needs a connection that supports multiple VLANs for separate environments (development, test, production) and provides consistent performance. The company also wants to avoid using the public internet. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet for consistent performance. It supports multiple VLANs (802.1Q) via Virtual LANs (VLANs) on a single Direct Connect circuit, allowing separate logical networks for development, test, and production environments. This meets the requirements for private connectivity, multi-VLAN support, and predictable performance.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 5

A company has a VPC with multiple subnets and an AWS Transit Gateway. They have a requirement to inspect traffic between subnets using a third-party firewall appliance that is deployed in a centralized inspection VPC. The firewall appliance must process all traffic between the VPC subnets, including traffic between subnets in the same Availability Zone. Which routing configuration achieves this?

Accepted Answer

None of the options are correct.. None of the provided routing configurations can achieve this requirement because the local route for the VPC CIDR in any VPC route table cannot be overridden. Therefore, intra-VPC traffic will always use the local route and will not be sent to the Transit Gateway. To inspect traffic between subnets within the same VPC, alternative architectures such as a Gateway Load Balancer or a Transit Gateway with VPC peering between different VPCs must be used.

Answer

Create a VPC route table that routes all traffic (0.0.0.0/0) to the Transit Gateway.

Answer

Create a VPC route table that routes the VPC CIDR to the Transit Gateway and associate it with each subnet.

Answer

Use the main route table and add a route for the VPC CIDR to the Transit Gateway.

Question 6

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing Amazon EC2 instances. The instances in the private subnet need to download patches from the internet. The NAT gateway is in the public subnet and has an Elastic IP address. The private subnet's route table has a default route pointing to the NAT gateway. However, the instances cannot reach the internet. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. The NAT gateway resides in the public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. The missing IGW route in the public subnet breaks the outbound path.

Answer

The NAT gateway does not have a route back to the private subnet.

Answer

The NAT gateway is not associated with a security group that allows inbound internet traffic.

Answer

The security group attached to the EC2 instances does not allow outbound traffic to the internet.

Question 7

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible from the internet. Which component must be attached to the VPC to allow internet traffic to reach the ALB?

Accepted Answer

Internet gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant component that allows communication between a VPC and the internet. For an Application Load Balancer (ALB) to receive traffic from the internet, the ALB must be deployed in public subnets, and those subnets must have a route table entry pointing 0.0.0.0/0 to an IGW. Without the IGW, the ALB cannot accept inbound connections from the internet.

Answer

NAT gateway

Answer

Virtual private gateway

Answer

Transit gateway

Question 8

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have subnets in three Availability Zones. They need to add IPv6 connectivity to the VPC and allow instances in private subnets to initiate outbound IPv6 connections to the internet, but not allow inbound connections from the internet. Which TWO actions must be taken?

Accepted Answer

Create an egress-only internet gateway and add a route for ::/0 to it in the private subnet route tables.. Option C is correct because before any IPv6 addressing or routing can exist in the VPC, you must associate an Amazon-provided or BYOIP IPv6 CIDR block with the VPC (and then assign IPv6 CIDR blocks to the subnets), which is the prerequisite for IPv6 connectivity. Option A is correct because an egress-only internet gateway is the AWS component purpose-built for IPv6-only outbound access: it is stateful and allows instances to initiate outbound IPv6 traffic to the internet while preventing the internet from initiating inbound IPv6 connections, and a ::/0 route in the private subnet route table pointing to that egress-only internet gateway enables the outbound path. Option B is not correct because an internet gateway provides bidirectional IPv6 connectivity, so routing ::/0 to it would allow inbound internet-initiated connections, violating the requirement. Option D is not correct because a NAT gateway only translates IPv4 traffic and does not provide IPv6 connectivity. Option E is not correct because security groups are stateful and, by default, allow all outbound traffic; a security group rule is not the mechanism that enables or restricts internet-initiated inbound IPv6 connectivity, and it is not a required action to add IPv6 egress.

Answer

Create an internet gateway and add a route for ::/0 to it in the private subnet route tables.

Answer

Create a NAT gateway in a public subnet.

Answer

Configure a security group that allows outbound IPv6 traffic.

Question 9

A company is running a multi-tier web application across two AWS Regions (us-east-1 and eu-west-1) for disaster recovery. The application uses an Application Load Balancer (ALB) in each Region. The company uses Amazon Route 53 with latency-based routing to direct traffic to the closest Region. Recently, during a regional failure in us-east-1, users experienced timeouts instead of being redirected to eu-west-1. The DNS TTL is set to 60 seconds. The Route 53 health checks for the us-east-1 ALB are configured to check the HTTP endpoint every 30 seconds with 3 consecutive failures required to mark it unhealthy. The eu-west-1 ALB is healthy. The company's network design includes a VPC in each Region with public and private subnets. The ALBs are internet-facing and have proper security groups. The Route 53 records are configured correctly. What is the MOST likely cause of the timeout?

Accepted Answer

The health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint.. The most likely cause of the timeout is that the health check interval and failure threshold cause a delay in detecting the failure, and DNS caching causes clients to still resolve to the unhealthy endpoint. With a 30-second interval and 3 consecutive failures, it takes up to 90 seconds to mark the ALB unhealthy. During this time, Route 53 continues to return the unhealthy IP, and clients with cached DNS (TTL 60 seconds) may still attempt connections, leading to timeouts.

Answer

The latency-based routing policy does not fail over to the other region when a health check fails.

Answer

The ALB in us-east-1 is not configured to be cross-zone load balancing, causing it to fail.

Answer

The Route 53 health check is not able to reach the ALB in us-east-1 from eu-west-1 due to network ACLs.

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16. They have three subnets: Subnet A (10.0.1.0/24) in us-east-1a, Subnet B (10.0.2.0/24) in us-east-1b, and Subnet C (10.0.3.0/24) in us-east-1c. The company has deployed a set of EC2 instances in Subnet A that need to access an Amazon S3 bucket. The company wants to ensure that traffic to S3 does not traverse the internet and remains within the AWS network. The VPC has a VPC endpoint for S3 (gateway type) created and associated with the route table for Subnet A. However, the instances are unable to access the S3 bucket. What is the MOST likely cause?

Accepted Answer

The route table for Subnet A does not have a route for the S3 prefix list pointing to the VPC endpoint.. A gateway VPC endpoint for S3 works by injecting a route into the subnet's route table that points the S3 prefix list (pl-xxxxxxxx) to the endpoint (vpce-xxxxxxxx). Even though the endpoint was created and associated with the route table, the actual route entry must exist for traffic to be redirected. Without that route, instances fall back to the default route (typically a NAT gateway or IGW), which either fails or sends traffic over the internet — violating the requirement.

Answer

The VPC does not have an internet gateway attached.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The VPC endpoint is not associated with a security group that allows outbound traffic to S3.

Question 11

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an EC2 instance in the private subnet that needs to download software updates from the internet. The company configures a NAT gateway in the public subnet and adds a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The NAT gateway is assigned an Elastic IP address. However, the EC2 instance cannot reach the internet. The security group for the EC2 instance allows all outbound traffic. What is the MOST likely cause?

Accepted Answer

The public subnet's route table does not have a route to an internet gateway.. For a NAT gateway to provide internet access, the public subnet hosting it must have a route to an Internet Gateway (IGW). The NAT gateway itself resides in the public subnet and uses the IGW to reach the internet. If the public subnet's route table lacks a 0.0.0.0/0 route to the IGW, the NAT gateway cannot forward traffic, so the private instance cannot reach the internet.

Answer

The NAT gateway is not associated with a security group that allows outbound traffic.

Answer

The NAT gateway's Elastic IP address is not properly allocated.

Answer

The private subnet's route table does not have a route to the NAT gateway.

Question 12

A company is deploying a multi-tier web application across two AWS Regions with an active-passive failover architecture. The application uses Application Load Balancers (ALBs) in each Region, and traffic must be directed to the active Region using DNS. Which routing policy should be used for the Amazon Route 53 record set to achieve this?

Accepted Answer

Failover routing policy. The failover routing policy in Amazon Route 53 is designed specifically for active-passive failover architectures. It uses health checks to monitor the primary endpoint (active Region) and automatically routes traffic to the secondary endpoint (passive Region) only when the primary health check fails. This matches the requirement of directing traffic to the active Region using DNS.

Answer

Geolocation routing policy

Answer

Weighted routing policy

Answer

Latency routing policy

Question 13

An IAM policy attached to a user allows creating and deleting VPCs and subnets only in us-east-1. The user attempts to create a VPC in eu-west-1. What will happen?

Accepted Answer

The API call will be denied with an authorization error.. The IAM policy explicitly restricts the ec2:CreateVpc action to us-east-1 using a Condition element with ec2:Region. When the user attempts to create a VPC in eu-west-1, the condition is not satisfied, so the request is denied with an authorization error (HTTP 403). IAM policies are evaluated before any API call is executed, and if the condition fails, the action is blocked regardless of the resource-level permissions.

Answer

The VPC will be created but the user will receive a warning.

Answer

The user can create the VPC because the condition is not applicable to VPC creation.

Answer

The VPC will be created successfully because the policy allows ec2:CreateVpc.

Question 14

A company has a global application deployed across multiple AWS Regions. They use an Amazon Route 53 latency-based routing policy to direct users to the closest region. Recently, users in Asia are experiencing high latency even though traffic is being directed to the nearest region. The network team reviews the latency measurements and notices that the Route 53 latency values are based on the region where the resources are hosted, but the actual application performance is poor. What is the most likely cause?

Accepted Answer

The application in the Asian region is overloaded, causing increased response times.. Route 53 latency-based routing directs users to the region with the lowest latency based on AWS's network measurements, but it does not account for application-level performance or server load. If the Asian region's application is overloaded, response times will be high even though the network latency to that region is low. The most likely cause is that the application in the Asian region is overloaded, causing increased response times despite optimal routing.

Answer

The Route 53 health checks are failing, causing traffic to be routed to a different region.

Answer

The company has not enabled DNSSEC, causing additional DNS resolution time.

Answer

The Route 53 latency routing policy is not using anycast, causing suboptimal routing.

Question 15

A company wants to connect its on-premises data center to AWS using AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that they can ping the Direct Connect public VIF IP but cannot access S3. The VPC has a private subnet with an S3 VPC endpoint. What is the most likely reason for the failure?

Accepted Answer

The on-premises network is not routing traffic to S3 through the Direct Connect public VIF; instead, it is attempting to use the internet.. The most likely reason is that the on-premises network is not routing S3-bound traffic through the Direct Connect public VIF. A public VIF provides access to AWS public services like S3 using AWS-assigned public IP addresses, but the on-premises router must have specific routes (BGP advertisements from AWS) pointing S3 prefixes to the Direct Connect connection. If the router instead sends S3 traffic to its default internet gateway, the traffic never traverses the Direct Connect link, and the S3 VPC endpoint in the VPC is irrelevant because on-premises traffic does not use VPC endpoints.

Answer

Direct Connect does not support access to Amazon S3; you must use VPN.

Answer

The S3 endpoint is configured in the VPC, but the on-premises traffic is not using the endpoint.

Answer

A security group is blocking traffic from the on-premises network to S3.