ANS-C01 Network Design Practice Test 41 — 15 Questions

Question 1

A global retail company runs workloads in VPCs across us-east-1, eu-west-1, and ap-southeast-1. The network team needs a hub-and-spoke topology where all VPCs can communicate with each other and with an on-premises data center connected by AWS Direct Connect in us-east-1. The team wants to minimize the number of attachments and avoid managing a full mesh of VPC peering connections. Which AWS service should the team use as the hub?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway with inter-Region peering. AWS Transit Gateway provides a regional hub that simplifies connectivity, and inter-Region peering links transit gateways in different Regions so that all attached VPCs and the Direct Connect connection can communicate. This avoids a full mesh of peering connections and reduces the number of attachments the team must manage.

Answer

AWS Site-to-Site VPN connections between every pair of VPCs

Answer

AWS Global Accelerator with endpoint groups in each Region

Answer

AWS PrivateLink endpoints in each VPC for every service

Question 2

A network engineer is designing a VPC that must support both IPv4 and IPv6 clients. The VPC has a CIDR block of 10.0.0.0/16 and an associated IPv6 CIDR block of 2001:db8:1234::/56. The engineer needs to create subnets that can route IPv6 traffic to the internet and ensure that instances receive IPv6 addresses automatically. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Attach an internet gateway to the VPC and add a route for ::/0 to that internet gateway in the public subnet route table.. To support IPv6 clients reaching instances, the subnets need IPv6 CIDR blocks with auto-assign enabled, and the route table must have a ::/0 route to an internet gateway. An egress-only internet gateway would only permit outbound traffic, and NAT gateways and Elastic IP addresses do not support IPv6.

Answer

Create a NAT gateway and add a route for ::/0 to the NAT gateway in the subnet route table.

Answer

Assign an Elastic IP address to each instance to provide IPv6 connectivity.

Answer

Add a route in the subnet's route table for ::/0 pointing to an egress-only internet gateway.

Question 3

A healthcare company needs to connect its on-premises data center to a VPC using AWS Site-to-Site VPN. The company requires high availability and wants to avoid a single point of failure. The on-premises router supports BGP. Which configuration should be used to meet these requirements?

Accepted Answer

Create a single VPN connection with two tunnels, each terminating on a different AWS endpoint, and configure BGP on both tunnels.. A single Site-to-Site VPN connection already includes two tunnels for redundancy, each on a different AWS endpoint. Configuring BGP on both tunnels enables dynamic failover. This is the simplest and most effective way to achieve high availability for the VPN connection.

Answer

Create two VPN connections, each with one tunnel, and terminate both tunnels on the same AWS endpoint.

Answer

Create a single VPN connection with one tunnel and enable AWS Global Accelerator for failover.

Answer

Create two VPN connections, each with two tunnels, and terminate all tunnels on the same AWS endpoint.

Question 4

A media company runs a live-streaming ingest tier in a VPC that uses the CIDR block 10.20.0.0/16. The team needs a dedicated /24 for a new set of EC2 encoder instances, but the existing subnets were carved out of the VPC range and there is currently no contiguous /24 left. The team cannot re-IP any running workloads. Which action allows the team to obtain the required /24 and attach the encoder instances to it?

Accepted Answer

Associate a secondary IPv4 CIDR block with the VPC, then create a new subnet from that block.. Adding a secondary IPv4 CIDR block to a VPC is the supported way to expand address space when existing subnets cannot be re-IPed. The new block is independent of the original range and can be subdivided into subnets of any valid size. Subnet CIDRs are immutable, peering does not extend local addressing, and IPv6 does not replenish IPv4 space, so the secondary CIDR association is the only viable path.

Answer

Enable IPv6 on the VPC and assign IPv6 addresses to the encoder instances instead of IPv4.

Answer

Shrink an existing subnet's CIDR so the freed addresses can be reassigned to a new /24 subnet.

Answer

Create the new subnet in a different VPC and use VPC peering to connect it to the encoder VPC.

Question 5

A retail company wants instances in a newly created VPC to reach an Amazon S3 bucket in the same Region without traversing the public internet and without consuming NAT gateway capacity. The VPC has private subnets only and no internet gateway attached. Which action should the network engineer take?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and add a route for the endpoint prefix list to the private subnets' route tables.. Gateway VPC endpoints for Amazon S3 attach to route tables and route service traffic over the AWS network, so private subnets with no internet gateway can reach S3 without NAT. The prefix-list route in each subnet's route table is what actually directs the traffic, and this approach carries no hourly endpoint charges.

Answer

Create an interface VPC endpoint for Amazon S3 and attach a security group that permits HTTPS from the VPC CIDR.

Answer

Deploy a NAT gateway in a public subnet and add a default route from the private subnets to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a default route in the private subnet route tables so S3 traffic exits through the gateway.

Question 6

A retail company has a VPC with a CIDR of 10.0.0.0/16 and needs to add a second, non-overlapping IPv4 CIDR block to the same VPC so that new subnets can use addresses from 10.1.0.0/16. The company also wants to avoid recreating existing resources. What should the network engineer do?

Accepted Answer

Associate an additional IPv4 CIDR block of 10.1.0.0/16 with the existing VPC, then create new subnets from that block.. AWS allows a VPC to have multiple associated IPv4 CIDR blocks provided they do not overlap, and the additional blocks can be used for new subnets. Associating 10.1.0.0/16 with the existing VPC extends its address space without recreating resources, which is exactly what the company needs.

Answer

Modify the existing VPC CIDR from 10.0.0.0/16 to 10.1.0.0/16 in place using the VPC console.

Answer

Add a secondary CIDR block to each existing subnet so the subnets span 10.0.0.0/16 and 10.1.0.0/16.

Answer

Create a new VPC with the 10.1.0.0/16 CIDR and peer it with the existing VPC using VPC peering.

Question 7

A company runs a hybrid workload with on-premises servers that must reach an Amazon S3 bucket over a private, non-internet path. The company already has an AWS Site-to-Site VPN connection between its on-premises data center and a VPC. The VPC has an S3 gateway endpoint configured and associated with the route tables. However, on-premises servers cannot access S3 through the VPN. Which action should the network engineer take to enable this access?

Accepted Answer

Replace the S3 gateway endpoint with an S3 interface endpoint (AWS PrivateLink) and update on-premises routing to use the VPN to reach the endpoint ENIs.. Gateway endpoints for Amazon S3 are accessible only from within the VPC and do not support connectivity over VPN or Direct Connect. To provide private access from on-premises, an interface endpoint (powered by AWS PrivateLink) is required. It provisions elastic network interfaces in the VPC with private IP addresses that on-premises resources can reach over the VPN. The on-premises routing must then be updated to direct S3 traffic to those ENIs, ensuring private connectivity without internet exposure.

Answer

Attach an internet gateway to the VPC and route on-premises S3 traffic through the VPN to the internet gateway, then to S3.

Answer

Enable the "Private DNS" option on the S3 gateway endpoint and configure on-premises DNS to resolve the S3 bucket name to the endpoint's private IP addresses.

Answer

Add a route in the VPC route tables for the on-premises CIDR to the gateway endpoint.

Question 8

A company is deploying a multi-tier web application in a VPC. The web tier runs on EC2 instances in public subnets, and the database tier runs on Amazon RDS in private subnets. The company wants to ensure that the database tier is not accessible from the internet and that traffic between the web and database tiers is restricted to only the necessary ports. Which TWO actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Configure a security group on the RDS instances that allows inbound traffic only from the web tier's security group on the database port.. To isolate the database tier, place RDS instances in private subnets with no internet route, and use security group referencing to allow only the web tier to access the database on the required port. These two actions together ensure network isolation and least privilege access.

Answer

Enable public access on the RDS instances and use IAM database authentication to control access.

Answer

Create a network ACL that allows all inbound traffic to the private subnets and relies on security groups for protection.

Answer

Attach an internet gateway to the private subnets and use a network ACL to block all inbound traffic.

Question 9

A company is using AWS Global Accelerator to improve the performance of its global application. The application is hosted in us-east-1 and eu-west-1. The company wants to route traffic to the Region with the lowest latency for each user, and also wants to ensure that if one Region becomes unhealthy, traffic is automatically redirected to the healthy Region. The company has configured an accelerator with two endpoint groups, one for each Region. Each endpoint group has an Application Load Balancer (ALB) as an endpoint. Which configuration is required to meet these requirements?

Accepted Answer

Configure the accelerator with a traffic dial of 100 for both endpoint groups. Enable health checks on the ALBs. Global Accelerator will automatically route traffic to the lowest latency healthy endpoint.. Global Accelerator automatically routes user traffic to the endpoint with the lowest latency based on the client's location. When health checks are enabled on the ALBs, unhealthy endpoints are removed from consideration, and traffic is redirected to the next lowest latency healthy endpoint. A traffic dial of 100 ensures all traffic goes to the selected endpoint group. This provides both latency optimization and automatic failover.

Answer

Configure the accelerator with client affinity enabled. Set the traffic dial to 100 for both endpoint groups. Enable health checks on the ALBs. Global Accelerator will route traffic to the same endpoint for each client.

Answer

Configure the accelerator with a custom routing accelerator. Define a port mapping for each Region. Enable health checks on the ALBs. Global Accelerator will route traffic based on the port mapping.

Answer

Configure the accelerator with a traffic dial of 50 for both endpoint groups. Enable health checks on the ALBs. Global Accelerator will load balance traffic equally between the two Regions.

Question 10

A healthcare company is deploying a multi-VPC environment with a central transit gateway in us-east-1. The security team requires that traffic between the production VPC and the shared-services VPC be inspected by a third-party appliance VPC, while all VPCs must retain the ability to reach an on-premises network over a Site-to-Site VPN attached to the transit gateway. The company uses non-overlapping RFC 1918 CIDRs throughout. Which TWO design elements are required to meet these requirements? (Choose two.)

Accepted Answer

Enable appliance mode on the transit gateway attachment for the appliance VPC so that flow symmetry is maintained for traffic passing through the appliance.. Steering inter-VPC traffic through a third-party appliance requires transit gateway route tables and static routes that point the inspected VPC attachments at the appliance attachment, plus appliance mode so stateful inspection sees symmetric flows. Together these elements force traffic through the appliance and keep return packets on the same Availability Zone path.

Answer

Attach an internet gateway to the appliance VPC and route inspected traffic through the internet gateway to force symmetric return paths.

Answer

Configure a transit gateway Connect attachment using GRE and BGP between each VPC and the appliance VPC to carry inspected traffic.

Answer

Create a separate transit gateway in each VPC and peer the transit gateways together to isolate production traffic from shared services.

Question 11

A company is designing a VPC that requires a subnet to have a route to the internet for outbound traffic, but the instances in that subnet should not be directly reachable from the internet. Which AWS component should be used to meet these requirements?

Accepted Answer

NAT gateway. A NAT gateway enables instances in a private subnet to initiate outbound internet connections without allowing inbound connections from the internet. This is the standard solution for outbound-only internet access.

Answer

Transit gateway

Answer

Internet gateway

Answer

Virtual private gateway

Question 12

A company is deploying a latency-sensitive trading application across two AWS Regions: us-east-1 and eu-west-1. The application uses a Network Load Balancer (NLB) in each Region. The company wants to route users to the lowest-latency Region and also needs the ability to fail over between Regions if one becomes unavailable. The solution must minimize latency and provide automatic failover. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator with endpoint groups in both Regions and health checks.. AWS Global Accelerator is designed for latency-sensitive, multi-Region applications that require automatic failover. It uses the AWS global network to route traffic to the optimal endpoint, reducing latency and jitter. With endpoint groups in multiple Regions and health checks, it can fail over within seconds if an endpoint becomes unhealthy. NLBs are supported as endpoints, making it a natural fit for this scenario. Route 53 latency-based routing relies on DNS and is slower to fail over, while CloudFront and Direct Connect do not meet the low-latency, automatic failover requirements for this use case.

Answer

Amazon CloudFront with origin groups and origin failover.

Answer

Amazon Route 53 latency-based routing with health checks and failover.

Answer

AWS Direct Connect with a virtual private gateway in each Region.

Question 13

A company operates a VPC with CIDR 10.50.0.0/16 and has an AWS Site-to-Site VPN to its data center. The data center advertises 192.168.10.0/24 and 192.168.20.0/24 over BGP. The company needs instances in the VPC to reach both prefixes, but the VPN tunnel should carry only the 192.168.10.0/24 traffic while 192.168.20.0/24 must be dropped. Which configuration achieves this?

Accepted Answer

Create a route in the VPC route table for 192.168.10.0/24 pointing to the virtual private gateway, and do not create a route for 192.168.20.0/24.. VPC route tables are explicit: a destination prefix is reachable only when a route for it points to a target such as a virtual private gateway. Adding a route for 192.168.10.0/24 to the virtual private gateway carries that prefix over the VPN, while omitting a route for 192.168.20.0/24 drops traffic to it. This gives deterministic, per-prefix control without touching BGP.

Answer

Add a network ACL rule to the subnet that permits 192.168.10.0/24 and denies 192.168.20.0/24 on both inbound and outbound traffic.

Answer

Configure an outbound security group rule that denies traffic to 192.168.20.0/24 while allowing 192.168.10.0/24.

Answer

Enable route propagation from the virtual private gateway and rely on the BGP advertisement to install both prefixes automatically.

Question 14

A company is deploying a global application that uses Amazon Route 53 for DNS. The application runs in multiple AWS Regions and uses latency-based routing. The company wants to ensure that if all endpoints in a Region become unhealthy, traffic is automatically routed to the next best Region. Which Route 53 configuration should be used to achieve this?

Accepted Answer

Create latency records for each Region and associate health checks with each record. Enable Evaluate Target Health for the records.. Latency-based routing with health checks and Evaluate Target Health allows Route 53 to direct users to the lowest-latency healthy endpoint. If a Region becomes unhealthy, its records are removed from consideration, and traffic goes to the next best healthy Region.

Answer

Create weighted records for each Region with equal weights and associate health checks with each record.

Answer

Create geolocation records for each Region and associate health checks with each record.

Answer

Create failover records with a primary record for one Region and a secondary record for another Region.

Question 15

A software company runs a two-tier web application in a VPC. The web tier is in public subnets behind an Application Load Balancer, and the database tier is in private subnets. A security review finds that database instances can initiate outbound connections to the internet through a NAT gateway, which violates policy. The company still needs the database instances to receive software updates from an Amazon S3 bucket and to be administered from a bastion host in a public subnet. Which change should the engineer make?

Accepted Answer

Remove the NAT gateway route from the database subnet route tables and add a gateway endpoint for Amazon S3, while allowing SSH from the bastion security group in the database security group.. Removing the NAT gateway route from the database subnets stops outbound internet initiation, while a gateway endpoint for Amazon S3 preserves private access for updates. Allowing SSH from the bastion's security group keeps administration working without exposing the database tier, satisfying both the security policy and operational needs.

Answer

Move the database instances into the public subnets and rely on security groups to prevent inbound internet access, removing the NAT gateway.

Answer

Keep the NAT gateway route but attach a network ACL to the database subnets that denies outbound traffic to 0.0.0.0/0 except for the S3 prefix list.

Answer

Replace the NAT gateway with an internet gateway and add a route from the database subnets to the internet gateway, restricting access with security groups.