ANS-C01 Network Design Practice Test 4 — 15 Questions

Question 1

A company is designing a global application that will use Amazon CloudFront to serve content from an Application Load Balancer (ALB) in us-east-1. They want to restrict access to the ALB so that it only accepts traffic from CloudFront. Additionally, they want to ensure that if someone bypasses CloudFront and directly accesses the ALB, the request is denied. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure CloudFront to add a custom HTTP header (e.g., X-Origin-Verify) to requests forwarded to the ALB. Configure the ALB to only forward requests that contain that specific header to the target group.. It uses a custom HTTP header (e.g., X-Origin-Verify) that CloudFront adds to requests forwarded to the ALB, and the ALB is configured to only forward requests containing that specific header to the target group. This ensures that any request not originating from CloudFront (i.e., direct access to the ALB) lacks the header and is denied, providing a secure and scalable method to restrict access without relying on static IP lists.

Answer

Use CloudFront Origin Access Control (OAC) to restrict access to the ALB.

Answer

Configure the ALB security group to allow inbound traffic only from the CloudFront IP address ranges published in the AWS IP address ranges JSON file.

Answer

Use AWS WAF on the ALB with a rule that allows traffic only from CloudFront IP ranges.

Question 2

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in a VPC. They need to ensure that the application can handle a sudden increase in traffic and that the ALB can scale automatically. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure the target group's deregistration delay to a low value to quickly remove unhealthy targets.. Option A is correct because setting a low deregistration delay on the target group allows the ALB to quickly stop routing requests to targets that are being removed or are unhealthy, which speeds up scaling events and keeps traffic flowing to healthy targets during sudden traffic spikes. Option D is correct because enabling cross-zone load balancing lets the ALB distribute traffic evenly across targets in all enabled Availability Zones, preventing a single zone's targets from being overwhelmed and improving availability and scaling during traffic surges. Option B is not correct because an ALB requires at least two subnets in different Availability Zones for high availability, so a single subnet would be a single point of failure. Option C is not correct because the scenario specifically requires an ALB for HTTP/HTTPS layer-7 routing, and an NLB operates at layer 4 and does not provide the same application-aware features. Option E is not correct because deletion protection is a safety feature that prevents accidental deletion and has no role in automatic scaling or replacement of the ALB.

Answer

Use a single subnet for the ALB to reduce complexity.

Answer

Use a Network Load Balancer instead of an ALB to improve throughput.

Answer

Disable deletion protection on the ALB to allow automatic replacement.

Question 3

A company is designing a multi-region application with Amazon RDS for MySQL as the primary database. The application requires read-after-write consistency across regions. Which design should the company choose to meet this requirement?

Accepted Answer

Use Amazon Aurora Global Database with cluster endpoints in each region. Amazon Aurora Global Database is the correct choice because it provides dedicated cluster endpoints in each region that automatically route write traffic to the primary region and read traffic to local replicas, ensuring read-after-write consistency through its storage-layer replication with typical latency under 1 second. Unlike standard RDS cross-Region replication, Aurora Global Database uses a physical storage-based replication mechanism that guarantees global consistency without relying on MySQL binary logs, which can introduce replication lag and potential inconsistency.

Answer

Use Amazon RDS with cross-Region replication enabled using MySQL binary log

Answer

Use Amazon RDS Multi-AZ deployments in each region with read replicas

Answer

Use Amazon RDS with synchronous replication across regions

Question 4

A financial services company must meet PCI DSS compliance requirements. The company's VPC contains a web server in a public subnet and an application server in a private subnet. The application server must communicate with a third-party payment gateway over the internet, but the security team prohibits using an Elastic IP address or a NAT gateway due to auditing concerns. Which solution satisfies these requirements?

Accepted Answer

Use AWS PrivateLink to connect to the payment gateway via a VPC Endpoint Service. AWS PrivateLink allows the application server in the private subnet to connect to the third-party payment gateway via a VPC Endpoint Service without traversing the internet, using private IP addresses. This eliminates the need for an Elastic IP address or a NAT gateway, satisfying the security team's auditing concerns while meeting PCI DSS compliance requirements.

Answer

Deploy a NAT instance in the public subnet and route traffic through it

Answer

Configure a proxy server in the public subnet and have the application server use the proxy

Answer

Attach an Internet Gateway to the VPC and use a default route to 0.0.0.0/0 in the private subnet

Question 5

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect. The on-premises CIDR is 10.1.0.0/16. To enable communication between the VPC and on-premises, which component must be configured?

Accepted Answer

Attach a Virtual Private Gateway to the VPC and update route tables. To connect a VPC to an on-premises network over AWS Direct Connect, you must attach a Virtual Private Gateway (VGW) to the VPC. The VGW serves as the VPN concentrator on the AWS side, terminating the Direct Connect virtual interface (VIF) and enabling BGP peering for route exchange. You then update the VPC route tables to point the on-premises CIDR (10.1.0.0/16) to the VGW, allowing traffic to flow between the VPC and the on-premises network.

Answer

Attach an Internet Gateway to the VPC and configure a NAT gateway

Answer

Create a VPC peering connection between the VPC and the on-premises network

Answer

Create a Transit Gateway and attach the VPC and Direct Connect

Question 6

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that all packets from a given client session are sent to the same target instance for the duration of the session. Which feature should be enabled on the NLB to meet this requirement?

Accepted Answer

Enable stickiness using the source IP address. Enabling stickiness using the source IP address on a Network Load Balancer (NLB) ensures that all packets from a given client IP are routed to the same target instance for the duration of the session. This is achieved by the NLB hashing the source IP address (and optionally port and protocol) to consistently select the same target, which meets the requirement for session persistence without relying on application-layer cookies.

Answer

Enable proxy protocol v2

Answer

Enable cross-zone load balancing

Answer

Configure health checks to mark targets as healthy

Question 7

A company has an Amazon Route 53 private hosted zone associated with a VPC. The company wants to resolve custom domain names for resources within that VPC. Which configuration is required for EC2 instances in the VPC to resolve these private hosted zone records?

Accepted Answer

Ensure that the VPC has the enableDnsHostnames and enableDnsSupport attributes set to true. For EC2 instances in a VPC to resolve records in a Route 53 private hosted zone, the VPC must have both the `enableDnsHostnames` and `enableDnsSupport` attributes set to `true`. These settings enable the VPC's built-in DNS resolver (the Amazon-provided DNS server at the VPC's base CIDR +2 address) to query the private hosted zone and return the custom domain names to instances. Without these attributes, the VPC DNS resolver cannot perform resolution for private hosted zones, even if the zone is associated with the VPC.

Answer

Configure a Route 53 Resolver inbound endpoint in the VPC

Answer

Create a Route 53 Resolver outbound endpoint in the VPC

Answer

Establish a VPC peering connection with the Route 53 hosted zone

Question 8

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The application requires outbound internet access to download updates, but the company does not want to assign public IP addresses to the tasks. Which TWO actions should the company take to provide internet access to the tasks? (Choose two.)

Accepted Answer

Launch the tasks in private subnets that do not have a route to an Internet Gateway. Option B is correct because tasks without public IPs must run in private subnets that have no route to an Internet Gateway, ensuring they are not directly reachable from the internet while still allowing outbound traffic through a NAT device. Option C is correct because a NAT gateway placed in a public subnet, with the private task subnet route table directing 0.0.0.0/0 to that NAT gateway, provides the required outbound internet access for image pulls and update downloads without assigning public IPs. Option A is not sufficient by itself because a security group allowing outbound 0.0.0.0/0 does not create the network path to the internet; routing through a NAT gateway is still required. Option D is wrong because enabling auto-assign public IPs in public subnets directly exposes tasks to the internet, which the company explicitly wants to avoid. Option E is incorrect because a VPC Gateway Endpoint only provides private access to supported AWS services such as Amazon S3 and DynamoDB, not general outbound internet access for downloading updates.

Answer

Configure a security group that allows outbound traffic to 0.0.0.0/0

Answer

Launch the tasks in public subnets with auto-assign public IP enabled

Answer

Create a VPC Gateway Endpoint for Amazon ECR

Question 9

A network engineer is troubleshooting an issue where an AWS Lambda function cannot create an Elastic Network Interface (ENI) in a VPC. The function has the IAM policy shown in the exhibit. Which statement explains why the function is failing?

Accepted Answer

The policy is missing the ec2:CreateNetworkInterfacePermission action. AWS Lambda requires the `ec2:CreateNetworkInterfacePermission` action to allow the Lambda service to create and manage ENIs on your behalf. While the policy may not explicitly deny `ec2:CreateNetworkInterface`, it is missing this required permission action. Without `ec2:CreateNetworkInterfacePermission`, Lambda cannot delegate ENI creation, causing the failure.

Answer

The policy denies the ec2:CreateVpc action which is required to create an ENI

Answer

The policy allows ec2:DescribeInstances which conflicts with ENI creation

Answer

The policy denies the ec2:CreateNetworkInterface action

Question 10

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Accepted Answer

Private DNS is not enabled for the endpoint. The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Answer

The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

Answer

The endpoint is not in the 'available' state

Answer

The endpoint type should be Gateway, not Interface

Question 11

A network engineer is troubleshooting connectivity between a VPC (10.0.0.0/16) and a peered VPC (10.1.0.0/16). The route table shown is associated with subnet-aaa. An EC2 instance in subnet-aaa cannot reach an instance in the peered VPC. What is the issue?

Accepted Answer

The VPC peering connection is not in the 'active' state. A VPC peering connection must be in the 'active' state for traffic to flow between the VPCs. If the peering connection is in any other state (e.g., 'pending-acceptance', 'expired', 'failed', or 'deleted'), the route to the peered VPC's CIDR will be considered a black hole, and the EC2 instance in subnet-aaa will be unable to reach the instance in the peered VPC. The route table shown includes a route for 10.1.0.0/16 pointing to the peering connection, but the connection's state must be verified as 'active' for the route to be effective.

Answer

The route to the peered VPC's CIDR is missing

Answer

The route table does not have a route to an Internet Gateway

Answer

The route table is not associated with the correct subnet

Question 12

A company has a VPC with a CIDR of 10.0.0.0/16. They want to create a subnet that can host at least 2000 EC2 instances. Which subnet size should they choose?

Accepted Answer

/21. A /21 subnet provides 2,048 usable IP addresses (2^(32-21) - 5 = 2,048 - 5 = 2,043 for AWS, but the key is that 2,048 total addresses minus the 5 reserved by AWS yields 2,043, which exceeds the requirement of 2,000 EC2 instances). AWS reserves 5 IP addresses per subnet (network, VPC router, DNS, future use, broadcast), so the usable count is total addresses minus 5. A /21 is the smallest subnet that meets the 2,000-instance requirement.

Answer

/22

Answer

/24

Answer

/20

Question 13

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They launch an EC2 instance in subnet A and another in subnet B. The security groups for both instances allow all traffic from the other instance's private IP. However, the instances cannot communicate. What is the most likely cause?

Accepted Answer

The network ACLs are blocking the traffic. The most likely cause is that the network ACLs (NACLs) are blocking the traffic. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit inbound and outbound rules for both directions. By default, custom NACLs deny all traffic, so even though the security groups permit communication, the NACLs on subnets A and B must allow the traffic. The correct answer is B.

Answer

The instances are in different Availability Zones

Answer

The security groups are stateful and block return traffic

Answer

The route tables do not have a local route

Question 14

A company needs to resolve DNS names for their EC2 instances using custom domain names like "app.example.com". Which AWS service should they use?

Accepted Answer

Amazon Route 53. Amazon Route 53 is a scalable DNS web service that can resolve custom domain names like 'app.example.com' to EC2 instance IP addresses. It supports private hosted zones for VPCs, enabling DNS resolution for internal resources without exposing them to the internet, and integrates with EC2 via alias records or health checks.

Answer

AWS Cloud Map

Answer

AWS Directory Service

Answer

Amazon Cognito

Question 15

A company is designing a VPC with multiple subnets. They want to ensure that EC2 instances in a private subnet can access S3 buckets without going through a NAT Gateway or Internet Gateway. Which TWO methods can accomplish this?

Accepted Answer

Create a Gateway VPC Endpoint for S3. Option B is correct because a Gateway VPC Endpoint for S3 is a route-table target that lets instances in a private subnet reach S3 over the AWS private network without a NAT Gateway or Internet Gateway. Option D is also correct because an Interface VPC Endpoint (powered by AWS PrivateLink) creates an elastic network interface with a private IP in the subnet, allowing private connectivity to S3 without traversing a NAT or Internet Gateway. Option A is incorrect because a VPN connection to S3 is not a supported mechanism for private S3 access and would still require internet or public endpoints. Option C is incorrect because AWS Direct Connect provides private connectivity to AWS services from on-premises, not from EC2 instances inside a VPC to S3. Option E is incorrect because attaching an Internet Gateway and using a NAT Gateway is exactly the public-path approach the company wants to avoid.

Answer

Set up a VPN connection to S3

Answer

Use AWS Direct Connect to access S3

Answer

Attach an Internet Gateway and use a NAT Gateway