ANS-C01 Network Design Practice Test 42 — 15 Questions

Question 1

A healthcare company must connect three VPCs (VPC-A, VPC-B, VPC-C) in the same AWS Region. Each VPC must be able to reach the others, and the company wants to minimize the number of connections to manage while keeping traffic within the AWS network. The VPCs are in different AWS accounts managed through AWS Organizations. Which solution meets these requirements with the fewest connections?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a transit gateway, share it with the other accounts using AWS Resource Access Manager, and attach each VPC to it.. A transit gateway provides a hub-and-spoke topology where each VPC attaches once and gains reachability to all other attached VPCs. Sharing it through AWS Resource Access Manager enables cross-account attachments without separate connections. Full mesh peering, VPN hairpinning, and PrivateLink do not deliver the required any-to-any connectivity with the fewest managed connections.

Answer

Create VPC peering connections between every pair of VPCs and update each VPC's route tables.

Answer

Use AWS PrivateLink to connect the VPCs and expose each VPC's services through endpoint services.

Answer

Create a single Site-to-Site VPN connection from VPC-A to VPC-B and route VPC-C traffic through VPC-A.

Question 2

A financial services company runs a two-tier web application in a VPC. The web tier is in public subnets behind an internet-facing Network Load Balancer (NLB). The database tier is in private subnets and must only accept traffic from the web tier on TCP port 3306. A network engineer notices that the database security group currently allows 0.0.0.0/0 on port 3306. The engineer wants to restrict access so that only the web tier can reach the database. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Modify the database security group inbound rule to reference the web tier's security group as the source on port 3306.. Referencing a security group as a source in another security group's inbound rule is the standard AWS pattern for tier-to-tier access control. It eliminates the need to track CIDR blocks or individual IP addresses, automatically applies to all current and future instances in the referenced group, and enforces least privilege. Network ACLs and Elastic IP management add unnecessary complexity and do not provide the same dynamic, identity-based control.

Answer

Move the database instances to the public subnets and use a security group that allows only the NLB's IP addresses.

Answer

Assign Elastic IP addresses to the web tier instances and add those IPs to the database security group inbound rules.

Answer

Create a network ACL on the database subnet that allows traffic from the web subnet CIDR on port 3306 and denies all other traffic.

Question 3

A media company runs a live video streaming platform with EC2 instances spread across three Availability Zones in a single VPC. The instances must communicate with each other using IP multicast for real-time stream distribution. The company wants to minimize latency and avoid managing additional infrastructure. Which AWS service or feature should they use to enable multicast communication?

Accepted Answer

AWS Transit Gateway multicast. AWS Transit Gateway multicast is the only native AWS service that provides managed multicast within and across VPCs. It eliminates the need for custom IGMP proxies or overlay networks, and it integrates with VPC attachments to deliver multicast traffic to participating instances. The other options either do not support multicast or are unrelated to VPC-internal communication.

Answer

VPC peering with IGMP proxy on each instance

Answer

Network Load Balancer with UDP listener

Answer

AWS Direct Connect with a public virtual interface

Question 4

A company is deploying a critical application across two AWS Regions: us-east-1 and eu-west-1. The application uses an Application Load Balancer (ALB) in each Region. The company wants to route user traffic to the Region closest to the user and provide automatic failover if one Region becomes unavailable. The solution must minimize latency and provide deterministic failover. Which service should be used?

Accepted Answer

AWS Global Accelerator with endpoint groups in both Regions and health checks.. AWS Global Accelerator uses the AWS global network to route traffic to the optimal endpoint based on health, geography, and latency. It provides two static anycast IP addresses, eliminating DNS caching issues and enabling fast, deterministic failover. It continuously performs health checks and automatically redirects traffic to a healthy endpoint within seconds. This makes it ideal for multi-Region active-active or active-passive architectures requiring low latency and high availability.

Answer

Amazon CloudFront with origin groups and failover configured.

Answer

Amazon Route 53 with latency-based routing and health checks.

Answer

Amazon Route 53 with geolocation routing and health checks.

Question 5

A healthcare company is deploying a new VPC for a patient portal. The VPC uses CIDR block 10.0.0.0/16. The company has an existing on-premises network using 10.0.0.0/8. A network engineer must establish connectivity between the VPC and on-premises without IP address conflicts, and must ensure that the on-premises network can reach specific services in the VPC. Which solution should the engineer implement?

Accepted Answer

Create a new VPC with a non-overlapping CIDR block, such as 172.16.0.0/16, and establish an AWS Site-to-Site VPN with static routing.. Overlapping CIDR blocks between a VPC and an on-premises network prevent proper routing because the same IP ranges exist in both locations. The only reliable solution is to ensure the VPC CIDR does not overlap with the on-premises CIDR. Creating a new VPC with a non-overlapping range, such as 172.16.0.0/16, and then establishing connectivity via VPN or Direct Connect resolves the conflict. Other options do not address the fundamental IP overlap issue.

Answer

Keep the existing VPC and use AWS PrivateLink to expose the services to the on-premises network.

Answer

Keep the existing VPC and configure a Transit Gateway with inter-Region peering to route traffic around the overlap.

Answer

Keep the existing VPC and use AWS Direct Connect with a private virtual interface and BGP to advertise the VPC CIDR.

Question 6

A financial services company needs to connect its on-premises data center to AWS using AWS Direct Connect. The company requires a highly available connection that can tolerate the failure of a single Direct Connect location or a single device. They have two Direct Connect locations available, each with a dedicated 10 Gbps connection. The company also wants to minimize costs. Which configuration should a network engineer recommend?

Accepted Answer

Order one dedicated 10 Gbps connection at each of the two Direct Connect locations and configure them as separate connections with BGP failover.. To tolerate the failure of a single Direct Connect location, the company must have at least one connection at each of two different Direct Connect locations. Using one dedicated connection at each location with BGP failover provides the required redundancy against location and device failures. Adding more connections at each location would increase cost without being necessary to meet the stated availability target.

Answer

Order two dedicated 10 Gbps connections at the same Direct Connect location and configure them as a link aggregation group (LAG).

Answer

Order two dedicated 10 Gbps connections at each of the two Direct Connect locations and configure them as a LAG at each location.

Answer

Order one dedicated 10 Gbps connection at one Direct Connect location and use a Site-to-Site VPN as a backup over the internet.

Question 7

A company runs a high-frequency trading platform on Amazon EC2 instances spread across three Availability Zones in a single VPC. The instances must exchange market data with extremely low latency and minimal jitter. The company wants to use a cluster placement group to achieve the lowest possible network latency. Which statement accurately describes the network performance characteristics of a cluster placement group?

Accepted Answer

Instances in a cluster placement group can communicate with a latency as low as single-digit microseconds, and the group provides a high-bandwidth, low-latency network with non-blocking inter-instance communication.. A cluster placement group places instances in a single Availability Zone and uses enhanced networking to deliver high bandwidth and single-digit microsecond latency. Inter-instance traffic is non-blocking, meaning all instances can communicate at full speed simultaneously. This makes it the correct choice for latency-sensitive, tightly coupled workloads such as high-frequency trading.

Answer

Instances in a cluster placement group are spread across multiple Availability Zones to provide high availability, and the network latency between instances is typically under 10 milliseconds.

Answer

Instances in a cluster placement group communicate over the public internet using AWS Global Accelerator, which reduces latency by routing traffic through the AWS global network.

Answer

Instances in a cluster placement group share a single network interface with a maximum throughput of 10 Gbps, and latency is reduced only when using jumbo frames.

Question 8

A startup is deploying a web application in a single VPC with public and private subnets. The application consists of an Application Load Balancer (ALB) in public subnets and EC2 instances in private subnets. The instances must be able to download security patches from the internet, but must not be directly accessible from the internet. The company wants a highly available and fully managed solution with minimal operational overhead. Which solution should a network engineer recommend?

Accepted Answer

Deploy a NAT gateway in each public subnet and update the private subnet route tables to point to the NAT gateway.. A NAT gateway is the recommended AWS-managed solution for enabling outbound internet access from private subnets. Deploying one per Availability Zone ensures high availability, and updating private route tables directs traffic through it. This allows instances to download patches while remaining inaccessible from the internet. NAT instances and Elastic IPs introduce management overhead and security risks, and an internet gateway alone does not provide outbound-only access for private instances.

Answer

Assign Elastic IP addresses to the EC2 instances and configure a security group to allow outbound traffic only.

Answer

Configure an internet gateway and update the private subnet route tables to point to it.

Answer

Deploy a NAT instance on a single EC2 instance in a public subnet and update the private route tables to point to it.

Question 9

A financial services company is building a hybrid network between its on-premises data center and AWS. The company requires encrypted connectivity that can automatically fail over between two redundant tunnels, and it must advertise on-premises routes into a VPC so that EC2 instances can reach internal servers without manually updating route tables. The company does not want to manage a third-party virtual appliance. Which TWO components should be included in the design? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN connection with dynamic routing using BGP over two tunnels. A Site-to-Site VPN provides two encrypted tunnels and supports BGP dynamic routing, which automatically advertises on-premises prefixes. Using a transit gateway with a VPN attachment centralizes hybrid connectivity and propagates learned routes into VPC route tables, eliminating manual route updates and avoiding self-managed appliances.

Answer

A software VPN appliance running on an EC2 instance in each VPC, configured with static routes

Answer

AWS Direct Connect with a public virtual interface and no VPN

Answer

VPC peering between the on-premises network and the VPC using a customer gateway

Question 10

A company runs a global web application behind a Network Load Balancer (NLB) in us-east-1. Users in Europe experience high latency. The company wants to improve performance and provide static IP addresses for clients. The application's backend instances are in a single VPC and must not be modified. Which solution should a network engineer recommend?

Accepted Answer

Deploy an AWS Global Accelerator accelerator with the NLB as an endpoint group in us-east-1, and associate the accelerator's static IP addresses with the application.. AWS Global Accelerator provides static anycast IP addresses and uses the AWS global network to route traffic to the optimal endpoint, reducing latency for global users. By using the existing NLB as an endpoint, the backend architecture remains unchanged. This meets both the performance and static IP requirements without modifying instances.

Answer

Set up an Amazon Route 53 latency-based routing policy with the NLB's DNS name as the target, and enable the static IP feature in Route 53.

Answer

Create an Amazon CloudFront distribution with the NLB as the origin, and enable static IP addresses on the distribution.

Answer

Create an Application Load Balancer in front of the NLB, and use AWS Global Accelerator to accelerate traffic to the ALB.

Question 11

A global e-commerce company runs its application in us-east-1 and eu-west-1. The application uses an Application Load Balancer (ALB) in each Region. The company wants to provide a single global endpoint to users, improve performance by routing to the closest healthy Region, and automatically fail over if a Region becomes unavailable. The company also requires static IP addresses for allow-listing by third-party partners. Which service should a network engineer implement?

Accepted Answer

AWS Global Accelerator with endpoint groups for each Region.. AWS Global Accelerator is designed for global applications requiring static IP addresses, fast regional failover, and optimal routing. It provides two static anycast IPs that can be allow-listed, and it directs users to the closest healthy endpoint based on TCP/UDP performance. It integrates with ALBs, NLBs, and EC2 instances. Route 53 lacks static IPs, CloudFront is for content delivery and also lacks static IPs, and Transit Gateway is for network connectivity, not application delivery.

Answer

Amazon Route 53 with latency-based routing and health checks.

Answer

Amazon CloudFront with origin groups and Lambda@Edge.

Answer

AWS Transit Gateway with inter-Region peering and equal-cost multi-path routing.

Question 12

A company is deploying a three-tier web application in a single VPC. The database tier resides in private subnets and must be reachable only from the application tier, never from the internet. A network engineer needs to control which sources can initiate connections to the database instances at the instance level. Which AWS feature should the engineer use to meet this requirement?

Accepted Answer

A security group on the database instances that allows inbound traffic on the database port from the application tier's security group.. Security groups operate at the instance level and are stateful, so a rule that references the application tier's security group as its source allows only instances carrying that group to connect. This provides precise, maintainable source control without resorting to subnet-level filtering or additional services, and it satisfies the requirement that the database never be reachable from the internet.

Answer

A route table entry on the database subnet that removes the route to the internet gateway, forcing all traffic to remain local.

Answer

An AWS PrivateLink endpoint service in front of the database instances, with a VPC endpoint policy that restricts access to the application tier.

Answer

A network ACL on the database subnet that allows inbound traffic only from the application subnet CIDR range.

Question 13

A startup is building a two-tier web application in a single VPC. The web tier runs in a public subnet and must be reachable from the internet on ports 80 and 443. The database tier runs in a private subnet and must accept connections only from the web tier on port 3306. The company wants to minimize cost and operational overhead. Which combination of AWS networking components should be used to meet these requirements?

Accepted Answer

An internet gateway attached to the VPC, a public route table with a route to the internet gateway, and a security group on the database tier that allows port 3306 from the web tier's security group.. The web tier needs inbound internet access, which requires an internet gateway and a route table with a default route to it. The database tier should only accept connections from the web tier, which is best achieved by referencing the web tier's security group as the source in the database security group. This avoids hardcoding IP addresses and follows the principle of least privilege. NAT gateways, egress-only internet gateways, and virtual private gateways do not provide the required inbound internet connectivity.

Answer

An egress-only internet gateway, a public route table with a route to the egress-only internet gateway, and a security group on the database tier that allows port 3306 from 0.0.0.0/0.

Answer

A virtual private gateway, a public route table with a route to the virtual private gateway, and a security group on the database tier that allows port 3306 from the VPC CIDR.

Answer

A NAT gateway in the public subnet, a private route table with a route to the NAT gateway, and a network ACL that allows port 3306 from the internet.

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a secondary CIDR block to the VPC to support a new application that requires a separate IP range. The new range must not overlap with any existing subnets or routes. The company also uses AWS Direct Connect to connect to on-premises networks with a CIDR of 10.1.0.0/16. Which secondary CIDR block can be added to the VPC without causing routing conflicts?

Accepted Answer

100.64.0.0/16. The secondary CIDR must not overlap with the existing VPC CIDR or the on-premises network. 100.64.0.0/16 is part of the shared address space defined in RFC 6598, which AWS permits for VPC secondary CIDRs. It avoids overlap with both 10.0.0.0/16 and 10.1.0.0/16, ensuring no routing conflicts. This makes it the correct choice.

Answer

10.0.0.0/24

Answer

172.16.0.0/12

Answer

10.1.0.0/16

Question 15

A company is deploying a multi-tier web application in a VPC. The web tier runs in public subnets and must be accessible from the internet over HTTPS. The application tier runs in private subnets and must initiate outbound connections to an external payment gateway over the internet, but must not be directly reachable from the internet. The company wants to minimize management overhead and cost. Which TWO components are required to meet these requirements? (Choose two.)

Accepted Answer

An internet gateway attached to the VPC. An internet gateway is needed for the public subnets to allow inbound HTTPS traffic to the web tier. A NAT gateway in a public subnet enables the private application tier to initiate outbound connections to the payment gateway without being directly accessible from the internet. Together, they meet the connectivity and security requirements with minimal management overhead.

Answer

A VPC endpoint for the payment gateway

Answer

A virtual private gateway attached to the VPC

Answer

An AWS Direct Connect gateway