ANS-C01 Network Design Practice Test 4 — 15 Questions

Question 1

A network engineer analyzes a VPC Flow Log entry showing an ACCEPT for a TCP connection from 203.0.113.50 (internet) to 10.0.1.5 on port 443. The security group for the instance allows inbound HTTPS only from 10.0.0.0/16, and the NACL for the subnet has the rules shown. Why was the traffic accepted?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The flow log entry represents outbound traffic from the instance (source 10.0.1.5:443 to destination 203.0.113.50:38000). The security group's default outbound rule allows all traffic, and the NACL outbound (not shown) also allows it, resulting in ACCEPT.. The VPC Flow Log entry shows an ACCEPT for traffic from 203.0.113.50:38000 to 10.0.1.5:443. Because flow logs record connection state, this entry actually represents the return traffic of an outbound connection initiated by the instance (10.0.1.5) to the internet host on port 443. The security group's default outbound rule allows all traffic, and the NACL outbound rules (not shown) also permit it, so the return ACCEPT is valid.

Answer

The NACL inbound rule #120 allows HTTPS from 10.0.0.0/16, but the source is 203.0.113.50, so it should be denied.

Answer

The NACL inbound rule #100 allows HTTP from anywhere, and the traffic is HTTP.

Answer

The security group allows inbound HTTPS from 10.0.0.0/16, but the flow log source is 203.0.113.50, so it should be denied. The ACCEPT must be an error.

Question 2

A company is designing a multi-Region architecture using AWS Transit Gateway and Direct Connect. They have VPCs in us-east-1 and eu-west-1, each with an attached Transit Gateway. The Direct Connect gateway is associated with the Transit Gateway in us-east-1. They need to enable communication between VPCs across Regions using the Direct Connect gateway. What is the correct design to achieve this?

Accepted Answer

Create a Transit Gateway peering attachment between the Transit Gateways in us-east-1 and eu-west-1, and route traffic over the Direct Connect gateway via the peering.. Transit Gateway peering attachments allow transitive routing between Transit Gateways in different AWS Regions. By establishing a peering attachment between the Transit Gateways in us-east-1 and eu-west-1, traffic from the VPC in eu-west-1 can be routed through its local Transit Gateway, across the peering attachment to the Transit Gateway in us-east-1, and then over the Direct Connect gateway to on-premises networks. This design enables cross-region VPC communication via Direct Connect without requiring a single Transit Gateway or direct VPC peering.

Answer

Create a single Transit Gateway that spans both Regions and attach VPCs in both Regions.

Answer

Use VPC peering between the VPCs and route Direct Connect traffic through the VPC peering connection.

Answer

Associate the Direct Connect gateway with both Transit Gateways in us-east-1 and eu-west-1.

Question 3

A company has a hub-and-spoke network topology using AWS Transit Gateway in us-east-1. The hub VPC hosts centralized inspection appliances from a third-party vendor. The spokes include VPCs with application workloads and a Direct Connect VIF attached to a Direct Connect gateway which is associated with the Transit Gateway. The company notices that traffic from the on-premises network to the spoke VPCs is not being inspected by the centralized appliances. They have verified that the Transit Gateway route tables are correctly configured with static routes pointing to the inspection VPC for all spoke CIDRs, and the inspection appliances are properly configured to forward traffic. What is the most likely cause of this issue?

Accepted Answer

The Transit Gateway route table associated with the Direct Connect gateway attachment does not have a route that sends traffic to the inspection VPC.. In a hub-and-spoke topology with AWS Transit Gateway, traffic from on-premises (via Direct Connect) to spoke VPCs must be routed through the inspection VPC. This requires the Transit Gateway route table associated with the Direct Connect gateway attachment to contain a static route pointing to the inspection VPC attachment for the spoke CIDRs. Without this route, traffic bypasses inspection entirely.

Answer

The Direct Connect gateway is not propagating routes to the Transit Gateway, causing the on-premises traffic to be dropped.

Answer

The inspection VPC is sending traffic back to the on-premises network via a different path, causing asymmetric routing that drops packets.

Answer

The Transit Gateway route table for the spoke VPC attachments does not have a route to the on-premises network via the Direct Connect gateway.

Question 4

A startup is launching a new web application on AWS and needs to design a highly available and secure network architecture. The application will run on EC2 instances in an Auto Scaling group across two Availability Zones in a single region. The application must be accessible from the internet over HTTPS. The company expects variable traffic and wants to reduce costs where possible. They also need to protect against common web exploits like SQL injection and cross-site scripting. Which combination of AWS services should be used for the network design?

Accepted Answer

Use an Application Load Balancer (ALB) in public subnets. Enable AWS WAF on the ALB. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.. An Application Load Balancer (ALB) in public subnets can terminate HTTPS and distribute traffic to EC2 instances in private subnets, which enhances security by removing direct internet access from the instances. Enabling AWS WAF on the ALB protects against common web exploits like SQL injection and cross-site scripting. A NAT gateway in public subnets provides outbound internet access for instances in private subnets, which is cost-effective for variable traffic as it scales automatically and incurs charges only when used.

Answer

Use an Application Load Balancer (ALB) in private subnets. Enable AWS WAF on the ALB. Place EC2 instances in public subnets with a VPC endpoint for outbound traffic.

Answer

Use an Application Load Balancer (ALB) in public subnets. Use a VPC endpoint for outbound traffic. Place EC2 instances in public subnets with Elastic IPs.

Answer

Use a Network Load Balancer (NLB) in public subnets. Enable AWS Shield Advanced for DDoS protection. Place EC2 instances in private subnets with a NAT gateway for outbound traffic.

Question 5

A financial services company is designing a hybrid network architecture using AWS Direct Connect. They have a Direct Connect connection with a public VIF and a private VIF. The private VIF is associated with a Direct Connect gateway that is attached to a Transit Gateway in us-east-1. The Transit Gateway has attachments to a production VPC and a shared services VPC. The company wants to ensure that all traffic from the on-premises network to the production VPC flows through a centralized inspection appliance in the shared services VPC for security compliance. Additionally, traffic from the production VPC to the internet must use a NAT gateway in the shared services VPC. The inspection appliance in the shared services VPC performs stateful inspection and must see both directions of traffic. The network engineer configured the following route tables: In the Transit Gateway route table associated with the Direct Connect gateway attachment, a static route for 0.0.0.0/0 points to the shared services VPC attachment. In the Transit Gateway route table associated with the production VPC attachment, a static route for the on-premises CIDR (10.0.0.0/8) points to the shared services VPC attachment. In the Transit Gateway route table associated with the shared services VPC attachment, a static route for the on-premises CIDR points to the Direct Connect gateway attachment, and a static route for 0.0.0.0/0 points to the Direct Connect gateway attachment (for outbound internet traffic, the shared services VPC has its own internet gateway and NAT gateway). The production VPC has a default route (0.0.0.0/0) pointing to the Transit Gateway. The shared services VPC has a default route pointing to the NAT gateway. However, traffic from on-premises to the production VPC is not being inspected; it goes directly to the production VPC. What is the most likely reason?

Accepted Answer

The Transit Gateway route table associated with the Direct Connect gateway attachment has propagation enabled, which installs a more specific route for the production VPC CIDR directly to the production VPC attachment, bypassing the shared services VPC.. When propagation is enabled on the Transit Gateway route table associated with the Direct Connect gateway attachment, the production VPC CIDR is automatically learned as a more specific route (e.g., 10.1.0.0/16) pointing directly to the production VPC attachment. This more specific route overrides the static 0.0.0.0/0 route that was intended to force traffic through the shared services VPC, causing on-premises traffic to bypass the inspection appliance.

Answer

The shared services VPC has a default route pointing to the NAT gateway, which is not a valid next hop for traffic coming from the Transit Gateway.

Answer

The production VPC route table has a default route pointing to the Transit Gateway, but the NAT gateway is in the shared services VPC, causing asymmetric routing.

Answer

The Transit Gateway route table associated with the shared services VPC attachment does not have a route for the production VPC CIDR pointing to the production VPC attachment, so return traffic cannot reach production.

Question 6

A large e-commerce company operates a multi-tier application across multiple AWS accounts. The web tier is in a VPC (10.0.0.0/16) in Account A, and the application tier is in a separate VPC (10.1.0.0/16) in Account B. Both VPCs are connected via a VPC peering connection. The application tier uses an NLB to distribute traffic to EC2 instances in private subnets. The web tier sends traffic to the NLB's private IP address. Recently, the company migrated the application tier to use AWS PrivateLink instead of the VPC peering connection, creating a VPC endpoint service in Account B and an interface VPC endpoint in Account A. After the migration, the web tier cannot connect to the application tier. The security groups and NACLs allow the traffic. Which of the following is the MOST likely cause of the connectivity issue?

Accepted Answer

The web tier instances are using the private IP address of the Network Load Balancer instead of the VPC endpoint DNS name or private IP addresses.. After migrating from VPC peering to AWS PrivateLink, the web tier instances must use the VPC endpoint's DNS name or its private IP addresses to connect to the application tier. The VPC endpoint provides a different set of IP addresses (from the subnet in Account A) than the NLB's private IP, which remains in Account B. Since the web tier continues to send traffic to the NLB's private IP, the packets are not routed through the VPC endpoint, causing connectivity failure because the VPC peering connection is no longer available.

Answer

The route tables in Account A's VPC do not have a route to the VPC endpoint service in Account B.

Answer

The VPC endpoint in Account A requires an Internet Gateway (IGW) to route traffic to the VPC endpoint service in Account B.

Answer

The Network Load Balancer in Account B is not configured to support TCP traffic.

Question 7

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs:

Accepted Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments to VPCs. Step 3: Associate attachments with a transit gateway route table. Step 4: Update VPC route tables to point to the transit gateway. Step 5: Test connectivity.. First create the transit gateway, then create attachments, associate them with a route table, update VPC routes, and test connectivity.

Answer

Step 1: Create transit gateway attachments to VPCs. Step 2: Create the transit gateway. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Update VPC route tables. Step 3: Create transit gateway attachments. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Question 8

Arrange the steps to configure VPC Flow Logs for a VPC and publish logs to CloudWatch Logs:

Accepted Answer

1. Create a CloudWatch Logs log group. 2. Create an IAM role with permissions to write to CloudWatch Logs. 3. Create the VPC Flow Log, specifying the log group and IAM role. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.. First create the log group, then the IAM role, then the flow log, then verify, then analyze.

Answer

1. Create an IAM role with permissions to write to CloudWatch Logs. 2. Create a CloudWatch Logs log group. 3. Create the VPC Flow Log, specifying the log group and IAM role. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Answer

1. Create the VPC Flow Log, specifying a log group and IAM role. 2. Create a CloudWatch Logs log group. 3. Create an IAM role with permissions to write to CloudWatch Logs. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Answer

1. Create a CloudWatch Logs log group. 2. Create the VPC Flow Log, specifying the log group but without an IAM role. 3. Create an IAM role with permissions to write to CloudWatch Logs. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Question 9

Match each AWS Direct Connect term to its definition.

Accepted Answer

Virtual Interface (VIF): A logical connection over a Direct Connect line that connects to a VPC or other AWS services.. Correct matches: VIF is a logical connection; Direct Connect Gateway interconnects VPCs and on-premises. Common confusions: LAG is a bundle of physical connections, not a VPN endpoint; VGW is a VPN endpoint, not a bundle.

Answer

Link Aggregation Group (LAG): The AWS VPN endpoint that provides connectivity to on-premises networks over IPsec.

Answer

Virtual Private Gateway (VGW): A bundle of multiple physical connections aggregated to increase bandwidth and provide redundancy.

Question 10

Match each AWS networking feature to its use case for hybrid connectivity.

Accepted Answer

AWS Transit Gateway: Central hub to interconnect VPCs and on-premises networks.. Correct matches: Direct Connect = dedicated private connection; Site-to-Site VPN = encrypted internet tunnel; Transit Gateway = central hub. Common confusions include swapping the encryption and dedicated nature of Direct Connect and VPN.

Answer

AWS Direct Connect: Encrypted connection over the internet to connect on-premises to AWS.

Answer

AWS Site-to-Site VPN: Dedicated private connection from on-premises to AWS.

Question 11

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application servers are in private subnets behind Network Load Balancers (NLBs). The company needs to ensure that traffic from a client is consistently routed to the same ALB endpoint for the duration of a session. Which configuration should be used?

Accepted Answer

Enable client IP address preservation on the Global Accelerator endpoint groups and configure stickiness on the ALB based on the client IP.. Global Accelerator preserves the client IP address when client IP address preservation is enabled on the endpoint group, allowing the ALB to see the original client IP. Configuring stickiness on the ALB based on the client IP ensures that all requests from the same client IP are routed to the same ALB endpoint for the duration of the session, which is essential for session persistence in an active-active multi-region architecture.

Answer

Configure cross-zone load balancing on the NLBs and enable stickiness on the target groups.

Answer

Enable proxy protocol on the NLB target groups and configure stickiness on the NLB.

Answer

Enable stickiness on the ALB target groups with a duration of 1 second.

Question 12

A company is migrating a legacy on-premises application to AWS. The application requires multicast traffic between instances within a VPC. The network engineer must design a solution that supports multicast without modifying the application. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast domain.. AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows multicast traffic to flow between instances in different subnets within the same VPC or across attached VPCs without modifying the application. This is the only native AWS service that provides multicast forwarding, making it the correct choice for this requirement.

Answer

VPC peering connections between all instance subnets.

Answer

Application Load Balancer with UDP listener.

Answer

AWS Site-to-Site VPN connections with multicast routing enabled.

Question 13

A company has a VPC with public and private subnets in three Availability Zones. The company hosts a web application on Amazon EC2 instances in the private subnets. The instances need to download security patches from the internet but must not be directly accessible from the internet. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Deploy a NAT gateway in each public subnet and configure the private subnet route tables to point to the respective NAT gateway.. A NAT gateway is a fully managed AWS service that provides outbound internet connectivity for instances in private subnets while preventing inbound internet access. Deploying a NAT gateway in each public subnet across three Availability Zones ensures high availability and fault tolerance, and configuring private subnet route tables with a default route (0.0.0.0/0) pointing to the respective NAT gateway meets the requirement with minimal operational overhead, as AWS handles patching and scaling.

Answer

Deploy a NAT instance in a public subnet and configure the private subnet route tables to point to the NAT instance.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

Answer

Create a VPC endpoint for Amazon S3 and configure the instances to use the endpoint.

Question 14

A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The company wants to use the same Direct Connect connection to access multiple VPCs in the same AWS Region. Which solution should the company implement?

Accepted Answer

Create a transit virtual interface on the Direct Connect connection and associate it with a Direct Connect gateway.. A transit virtual interface (VIF) on a Direct Connect connection can be associated with a Direct Connect gateway, which enables connectivity to multiple VPCs in the same AWS Region. The Direct Connect gateway acts as a hub, allowing the single physical connection to route traffic to multiple VPCs via the transit VIF, without needing separate private VIFs for each VPC.

Answer

Use a public virtual interface and route traffic through the internet.

Answer

Request a hosted virtual interface from an AWS Direct Connect partner.

Answer

Create additional private virtual interfaces for each VPC.

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to peer with another VPC that has a CIDR block of 10.0.0.0/16. What should the network engineer do to enable connectivity between the two VPCs?

Accepted Answer

Use an AWS Transit Gateway with Network Address Translation (NAT) to resolve overlapping CIDRs.. When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), a standard VPC peering connection cannot be established due to route table conflicts. An AWS Transit Gateway can be used with Network Address Translation (NAT) to translate the overlapping IP addresses, enabling connectivity between the VPCs by allowing traffic to be routed through the Transit Gateway with NAT applied to resolve the address conflict.

Answer

Use an internet gateway to route traffic between the VPCs.

Answer

Create a VPC peering connection and add routes in both route tables.

Answer

Create a VPC peering connection and use a network address translation (NAT) device.