ANS-C01 Network Design Practice Test 40 — 15 Questions

Question 1

A company wants to provide internet access to instances in a private subnet without using a NAT Gateway, due to cost constraints. They have a public subnet with a bastion host that has a public IP. They also have a VPC with an Internet Gateway. What is the most cost-effective way to allow outbound internet access for instances in the private subnet?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance.. Launch a NAT instance in the public subnet and configure the private subnet route table to point 0.0.0.0/0 to the NAT instance. A NAT instance is a cost-effective alternative to NAT Gateway, as it uses an EC2 instance with IP forwarding enabled and can be run on a low-cost instance type. It requires management but avoids NAT Gateway hourly charges. Option B is incorrect because a VPN connection to a third-party proxy introduces unnecessary complexity and cost. Option C is incorrect because VPC endpoints only provide access to specific AWS services (e.g., S3), not general internet access. Option D is incorrect because the bastion host is typically used for SSH access, and while it could be configured for NAT, it is not recommended for security reasons; a dedicated NAT instance in a public subnet is the proper approach.

Answer

Use a VPN connection to a third-party internet proxy.

Answer

Create a VPC endpoint for Amazon S3 and configure the private subnet to use it.

Answer

Configure the bastion host as a NAT instance by enabling IP forwarding.

Question 2

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic only from the ALB's security group. The application works correctly. However, the security team wants to add an additional layer of protection by using AWS WAF. What is the best way to integrate AWS WAF with the ALB to filter malicious requests?

Accepted Answer

Create a web ACL in AWS WAF and associate it with the ALB.. AWS WAF can be associated directly with an ALB to filter incoming requests before they reach the ALB. Option B is incorrect because WAF works at the application layer, not at CloudFront unless CloudFront is used. Option C is incorrect because WAF is not applied at the security group level. Option D is incorrect because WAF is not a Network Load Balancer feature.

Answer

Replace the ALB with a Network Load Balancer and use AWS WAF with it.

Answer

Configure the security group of the ALB to only allow traffic that passes AWS WAF inspection.

Answer

Use AWS WAF in front of Amazon CloudFront and then forward requests to the ALB.

Question 3

A company is designing a multi-region active-active application using Amazon Route 53 and Application Load Balancers (ALBs). The application must be highly available and route traffic to the closest healthy endpoint. Which TWO configurations should the company use? (Choose two.)

Accepted Answer

Configure Route 53 with latency-based routing. Latency-based routing (B) is correct because it directs users to the AWS Region that provides the lowest latency, which matches the requirement to route traffic to the closest healthy endpoint in a multi-region active-active design. Associating health checks with each Route 53 record (C) is correct because health checks let Route 53 remove unhealthy regional endpoints from DNS responses, ensuring traffic only goes to healthy ALBs and supporting high availability. Failover routing (A) is not appropriate here because it is designed for active-passive configurations with a primary and secondary endpoint, not active-active closest-endpoint routing. Weighted routing (D) distributes traffic by assigned proportions and does not inherently select the lowest-latency or closest healthy endpoint. Geoproximity routing (E) routes based on geographic location and bias, not actual measured latency, so it does not meet the closest healthy endpoint requirement.

Answer

Configure Route 53 with failover routing

Answer

Configure Route 53 with weighted routing

Answer

Configure Route 53 with geoproximity routing

Question 4

A financial services company is designing a VPC with multiple tiers: web, application, and database. The web tier must be accessible from the internet, but the application and database tiers must not have direct internet access. The company needs to allow the application tier to download patches from the internet. Which THREE components should be included in the design? (Choose three.)

Accepted Answer

Internet Gateway (IGW). The web tier must be reachable from the internet, so the design needs an Internet Gateway (C) attached to the VPC to provide that bidirectional internet path, and the web instances must live in a public subnet (E) whose route table points to the IGW. Because the application tier must not have direct inbound internet access yet still needs outbound access to download patches, a NAT Gateway (D) placed in a public subnet is required; it performs source NAT so private-subnet instances can initiate outbound traffic while remaining unreachable from the internet. A Direct Connect virtual interface (A) provides private dedicated connectivity to on-premises networks, not internet patch downloads, and a VPC Peering connection (B) only links two VPCs for private IP traffic, so neither satisfies the internet-access requirements here.

Answer

Direct Connect virtual interface

Answer

VPC Peering connection

Question 5

A company is designing a network for a critical application that requires high availability across two AWS Regions (us-east-1 and us-west-2). The application uses an Application Load Balancer (ALB) in each region, with Auto Scaling groups behind them. The database is an Amazon Aurora Global Database with a primary cluster in us-east-1 and a secondary cluster in us-west-2. The company wants to use Amazon Route 53 to route traffic to the closest healthy ALB. They also need to ensure that if the primary database fails over to the secondary region, the application can still write to the database with minimal latency. Additionally, the application must be able to read from the local database in each region for read-intensive workloads. The network team has designed the following: Route 53 with latency-based routing and health checks for the ALBs. The application instances in each region are configured to connect to the local Aurora cluster endpoint. For writes, they use the global writer endpoint. What is the MOST significant design flaw?

Accepted Answer

The Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity. The most significant design flaw is that Route 53 health checks only monitor the ALB endpoint, not the overall application health including database connectivity. If the Aurora primary database fails over to us-west-2, the ALB in us-east-1 may still appear healthy even though the application there can no longer write to the database, causing Route 53 to continue routing traffic to an impaired region. Health checks should evaluate application-level health, including database connectivity, to trigger failover correctly.

Answer

The Auto Scaling groups are not configured with lifecycle hooks to drain connections during scale-in

Answer

The application instances in us-west-2 experience high latency for write operations due to cross-region traffic to the primary database

Answer

The Aurora Global Database does not support cross-region replication for read replicas

Question 6

A company runs a latency-sensitive trading platform on AWS. They have multiple VPCs in the same AWS Region, each hosting a separate environment (dev, test, prod). They need to connect all VPCs together with full mesh connectivity and want to minimize operational overhead. They also require the ability to route traffic between VPCs using a centralized inspection VPC for security. Which solution should a network engineer recommend?

Accepted Answer

Use AWS Transit Gateway with a transit gateway route table and attach all VPCs, then configure a separate route table for the inspection VPC.. AWS Transit Gateway is the recommended solution for connecting multiple VPCs with transitive routing and centralized inspection. It simplifies network management by acting as a hub, and route tables can direct traffic through a designated inspection VPC. VPC peering lacks transitivity, VPNs are not ideal for inter-VPC connectivity, and distributed firewalls increase complexity.

Answer

Deploy a third-party firewall appliance in each VPC and configure static routes between them.

Answer

Create a VPC peering connection between each pair of VPCs and configure route tables manually.

Answer

Set up an AWS Site-to-Site VPN between each VPC using virtual private gateways and enable dynamic routing with BGP.

Question 7

A media company operates a VPC with a CIDR block of 10.0.0.0/16 and a private subnet of 10.0.1.0/24. The company needs to connect this VPC to an on-premises data center that uses the 10.0.1.0/24 range for a legacy payroll system. The network engineer must design a solution that allows the VPC to communicate with the data center without IP address conflicts. Which approach meets these requirements?

Accepted Answer

Create a new VPC with a non-overlapping CIDR block, migrate the private subnet workloads, and connect the new VPC to the data center using AWS Site-to-Site VPN.. Overlapping CIDR blocks between a VPC and an on-premises network prevent direct routing because the same prefix exists in both environments. The only clean solution is to eliminate the overlap, either by renumbering one side or by creating a new VPC with a unique CIDR block and migrating workloads. Connecting the new VPC with a Site-to-Site VPN then provides the required connectivity without conflict.

Answer

Attach an internet gateway to the VPC and configure static routes for 10.0.1.0/24 to point to the on-premises public IP addresses.

Answer

Configure a NAT gateway in the VPC and use it to translate the VPC's 10.0.1.0/24 addresses to a different range when communicating with the data center.

Answer

Use AWS PrivateLink to create an interface VPC endpoint for the on-premises payroll system and route traffic through the endpoint.

Question 8

A media company runs a VPC with CIDR 10.20.0.0/16 in us-east-1. Its on-premises data center uses 10.20.5.0/24 and 10.20.6.0/24 for legacy storage arrays that must remain reachable at those addresses. The company wants to connect the data center to AWS with AWS Site-to-Site VPN and needs the on-premises storage to be reachable from instances in the VPC without renumbering. Which design meets these requirements?

Accepted Answer

Renumber the VPC to a non-overlapping CIDR such as 10.30.0.0/16, then create the VPN attachment and route the on-premises prefixes over the tunnel.. A VPC always installs a local route for its own CIDR that cannot be overridden, so any on-premises prefix nested inside the VPC CIDR is unreachable across a VPN, Direct Connect, or transit gateway. The only reliable fix is to eliminate the overlap by renumbering the VPC (or the on-premises network) to a non-overlapping range, after which the on-premises prefixes can be routed normally over the encrypted tunnels.

Answer

Create the VPN attachment directly on the VPC and advertise 10.20.5.0/24 and 10.20.6.0/24 over BGP from the customer gateway.

Answer

Create the VPN attachment on a transit gateway, and add a static route for 10.20.5.0/24 and 10.20.6.0/24 pointing to the VPN attachment.

Answer

Keep the VPC CIDR and use AWS PrivateLink to expose the on-premises storage arrays as endpoint services inside the VPC.

Question 9

A company is deploying a web application in a VPC with a public subnet and a private subnet. The web servers in the public subnet must be reachable from the internet on ports 80 and 443, while the database servers in the private subnet must accept connections only from the web servers on port 3306. The company wants to use security groups and network ACLs to enforce these requirements. Which configuration should the network engineer implement?

Accepted Answer

Attach a security group to the web servers that allows inbound traffic on ports 80 and 443 from 0.0.0.0/0, and attach a security group to the database servers that allows inbound traffic on port 3306 from the web servers' security group.. Security groups are stateful and support referencing other security groups as sources, which makes them ideal for tiered application access. Allowing internet traffic to the web tier on 80 and 443 and restricting database access to the web servers' security group on 3306 satisfies both requirements. The default network ACL already permits all traffic, so no additional network ACL configuration is needed.

Answer

Attach a network ACL to the public subnet that allows inbound 80 and 443 from 0.0.0.0/0, and attach a network ACL to the private subnet that allows inbound 3306 from the web servers' private IP addresses.

Answer

Attach a security group to the web servers that allows inbound 80 and 443 from 0.0.0.0/0, and attach a network ACL to the private subnet that allows inbound 3306 from 0.0.0.0/0.

Answer

Attach a network ACL to the public subnet that allows inbound 80 and 443 from 0.0.0.0/0, and attach a security group to the database servers that allows inbound 3306 from 0.0.0.0/0.

Question 10

A company has a VPC with a CIDR block of 10.0.0.0/16 and a subnet of 10.0.1.0/24. The company wants to add a second CIDR block of 10.1.0.0/16 to the same VPC to accommodate additional workloads. After associating the new CIDR block, the network engineer creates a new subnet of 10.1.1.0/24 in an Availability Zone that already hosts a subnet from the original CIDR block. Which statement accurately describes the result?

Accepted Answer

The new subnet can be created, and instances in the new subnet can communicate with instances in the original subnet using private IP addresses.. Amazon VPC supports multiple CIDR blocks, and the local route in the route table automatically includes all associated blocks. Subnets created from a secondary CIDR block can communicate with subnets from the primary block using private IP addresses without any additional routing configuration. The only constraints are that subnets must not overlap and must fall within an associated CIDR block.

Answer

The new subnet can be created, but instances in the new subnet cannot communicate with instances in the original subnet unless a peering connection is established between the two CIDR blocks.

Answer

The new subnet cannot be created because AWS does not allow multiple CIDR blocks in a single VPC.

Answer

The new subnet can be created, but it must be in a different Availability Zone than any existing subnet to avoid overlapping routes.

Question 11

A company has an on-premises data center and a VPC connected via AWS Site-to-Site VPN. They want to ensure that traffic from the on-premises network to the VPC is encrypted and that the VPN connection uses dynamic routing. Which configuration should they use?

Accepted Answer

Configure the VPN connection with dynamic routing and enable BGP on both the customer gateway and the virtual private gateway.. For dynamic routing over a Site-to-Site VPN, you must configure the VPN connection to use BGP. This requires BGP configuration on both the customer gateway and the AWS side (virtual private gateway or transit gateway). Static routes cannot be combined with BGP on the same VPN connection. Using a virtual private gateway is sufficient; a transit gateway is not required.

Answer

Configure the VPN connection with a static route and use a virtual private gateway with route propagation enabled.

Answer

Configure the VPN connection with dynamic routing and use a transit gateway instead of a virtual private gateway.

Answer

Configure the VPN connection with a static route and enable BGP on the customer gateway.

Question 12

A company has a VPC with a CIDR block of 172.31.0.0/16 and an on-premises network with 192.168.0.0/16. They have established an AWS Site-to-Site VPN connection with dynamic routing using BGP. The on-premises firewall blocks all traffic except that which originates from the AWS-side tunnel IP addresses. After a VPN tunnel rekey, some on-premises applications lose connectivity to AWS resources. What is the MOST likely cause?

Accepted Answer

The AWS Site-to-Site VPN tunnel IP addresses changed after the rekey, and the on-premises firewall rules were not updated to allow the new addresses.. AWS Site-to-Site VPN tunnels have AWS-side public IP addresses that can change when a tunnel is rekeyed or recreated. If the on-premises firewall permits traffic only from specific AWS tunnel IPs, those rules must be updated whenever the addresses change. The other options describe issues that would either prevent initial connectivity or cause different symptoms.

Answer

The VPC route table lacks a route for the on-premises CIDR, so return traffic is dropped after the rekey.

Answer

The BGP hold time expired, causing the tunnel to flap and the on-premises firewall to drop the new tunnel IP addresses.

Answer

The on-premises customer gateway device is using an outdated IKE version that is not compatible with the rekeyed tunnel.

Question 13

A company is deploying a microservices application on Amazon ECS. The services need to communicate with each other using service discovery. The company wants to minimize operational overhead and ensure that service discovery works across multiple VPCs in the same Region. Which solution should they use?

Accepted Answer

Use AWS Cloud Map with a private DNS namespace and associate it with the VPCs that need to discover services.. AWS Cloud Map with a private DNS namespace is the recommended solution for service discovery across multiple VPCs. It supports automatic registration and deregistration of services, and private DNS namespaces can be shared across VPCs using AWS Resource Access Manager or by associating the namespace with multiple VPCs. This minimizes operational overhead and keeps traffic private.

Answer

Use Amazon Route 53 private hosted zones and manually create DNS records for each ECS task.

Answer

Use AWS App Mesh with virtual nodes and virtual services to handle service discovery.

Answer

Use AWS Cloud Map with a public DNS namespace and register services with public IP addresses.

Question 14

A startup is deploying a two-tier web application in a single VPC. The web tier runs in public subnets behind an Application Load Balancer, and the database tier runs in private subnets. The security team requires that the database instances never have a route to the internet, even indirectly. Which VPC component should the engineer verify is absent from the private subnet route tables?

Accepted Answer

A route to a NAT gateway. The only listed component that provides outbound internet access from a private subnet is a NAT gateway. Removing or omitting the NAT gateway route from the private subnet route tables ensures the database instances cannot reach the internet directly or indirectly, which is the security team's requirement.

Answer

A route to an interface VPC endpoint

Answer

A route to a transit gateway

Answer

A route to a VPC peering connection

Question 15

A company is deploying a new VPC with a CIDR block of 10.0.0.0/16. They need to create subnets for a three-tier application: a public subnet for web servers, a private subnet for application servers, and a private subnet for database servers. The company wants to minimize the number of subnets while ensuring that each tier is isolated. Which subnetting scheme should they use?

Accepted Answer

One public subnet (10.0.0.0/24), one private subnet for application servers (10.0.1.0/24), and one private subnet for database servers (10.0.2.0/24).. The correct scheme uses one public subnet for web servers and two separate private subnets for application and database servers. This achieves isolation between tiers while using the minimum number of subnets required (three). Each subnet is sized appropriately with a /24 CIDR block, which provides 256 addresses, sufficient for typical three-tier deployments.

Answer

One public subnet (10.0.0.0/24) and one private subnet (10.0.1.0/24) shared by application and database servers.

Answer

Two public subnets (10.0.0.0/24 and 10.0.1.0/24) and one private subnet (10.0.2.0/24) for all servers.

Answer

One public subnet (10.0.0.0/20) and two private subnets (10.0.16.0/20 and 10.0.32.0/20).