ANS-C01 Network Design Practice Test 43 — 15 Questions

Question 1

A company is expanding its AWS presence and needs to connect 50 VPCs across multiple AWS accounts to a central on-premises data center. They require a hub-and-spoke topology with transitive routing between VPCs and the data center. The solution must be scalable and minimize the number of connections. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway is designed for hub-and-spoke topologies, allowing you to connect many VPCs and on-premises networks through a central gateway. It supports transitive routing, so VPCs can communicate with each other and with the data center without full mesh peering. This scales efficiently and reduces management overhead compared to other options.

Answer

AWS Direct Connect gateway

Answer

VPC peering

Answer

AWS Site-to-Site VPN with dynamic routing

Question 2

A company is deploying a global application that uses Amazon Route 53 for DNS. The application is hosted in two AWS Regions, each with an Application Load Balancer. The company wants to route users to the Region that provides the lowest latency, but also wants to be able to shift traffic away from a Region during maintenance. The company needs the ability to control the proportion of traffic sent to each Region during the shift. Which Route 53 routing policy should be used?

Accepted Answer

Weighted routing with health checks, where weights are adjusted to shift traffic between Regions.. Weighted routing is the only Route 53 routing policy that lets you specify the proportion of traffic sent to each resource record set. By adjusting weights, you can shift traffic gradually between Regions, which is ideal for maintenance. Health checks can be added to automatically remove an unhealthy Region. Latency-based routing optimizes for latency but does not offer proportional control, while failover and geolocation routing do not support gradual traffic shifting.

Answer

Geolocation routing with a default record and health checks.

Answer

Failover routing with a primary and secondary record and health checks.

Answer

Latency-based routing with health checks and a failover record for each Region.

Question 3

A company is deploying a global application using AWS Global Accelerator. The application runs on Network Load Balancers (NLBs) in us-east-1 and eu-west-1. The company wants to route traffic to the endpoint group with the lowest latency for each user, but also wants to ensure that if the primary region becomes unhealthy, traffic fails over to the secondary region. The company has configured a Global Accelerator with two endpoint groups, one for each region. The health check for the NLBs is configured to use TCP port 80. However, the application actually listens on TCP port 443, and the NLBs are configured to forward traffic only on port 443. Users are experiencing connection failures when Global Accelerator routes traffic to the NLBs. What is the most likely cause of the issue?

Accepted Answer

The NLB health check is configured on port 80, but the NLB only forwards traffic on port 443, causing the health checks to fail and the endpoints to be marked unhealthy.. Global Accelerator uses the health check configuration of the endpoint (the NLB) to determine endpoint health. If the NLB health check is on port 80 but the NLB only forwards on port 443, the health check fails, the endpoint is marked unhealthy, and Global Accelerator stops routing traffic to it, causing connection failures. Correcting the health check port resolves the issue.

Answer

The Global Accelerator endpoint groups are not configured with the correct traffic dial percentages.

Answer

The Global Accelerator listener is not configured to accept traffic on port 443.

Answer

The NLBs are not configured with cross-zone load balancing enabled, so they cannot route traffic to targets in other Availability Zones.

Question 4

A company is deploying a new VPC and needs to allow instances in a private subnet to access an Amazon S3 bucket without traversing the public internet. The company wants to minimize cost and complexity. Which solution should be implemented?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and associate it with the private subnet's route table.. A gateway VPC endpoint for Amazon S3 enables private connectivity from a VPC to S3 without requiring an internet gateway or NAT device. It is free, simple to set up, and keeps traffic within the AWS network. This satisfies the requirements for private access, minimal cost, and low complexity.

Answer

Create an interface VPC endpoint for Amazon S3 in the VPC and update the private subnet's route table to use the endpoint.

Answer

Attach an internet gateway to the VPC and modify the private subnet's route table to point to the internet gateway.

Answer

Configure a NAT Gateway in a public subnet and update the private subnet's route table to point to the NAT Gateway.

Question 5

A company is deploying a web application in a VPC that must be accessible from the internet. The application runs on EC2 instances behind an Application Load Balancer (ALB). The company wants to protect the application from common web exploits such as SQL injection and cross-site scripting. The security team requires that all incoming traffic be inspected and filtered before reaching the ALB. Which AWS service should be integrated with the ALB to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is designed to protect web applications from application-layer attacks such as SQL injection and cross-site scripting. It integrates with Application Load Balancers, allowing you to create rules that inspect incoming HTTP/HTTPS requests and block malicious traffic before it reaches your application. This is the appropriate service for the stated security requirements.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Network Firewall

Question 6

A company is designing a VPC that will host a critical application. The security team requires that all traffic entering and leaving the VPC be inspected by a centralized firewall appliance. The appliance must be able to scale horizontally and maintain high availability across multiple Availability Zones. Which design should the company implement?

Accepted Answer

Use AWS Network Firewall with endpoints in multiple Availability Zones and a transit gateway for centralized routing.. AWS Network Firewall is a managed, highly available firewall service that can be deployed across multiple Availability Zones. When combined with AWS Transit Gateway, it enables centralized inspection of traffic between VPCs and to/from the internet. This satisfies the need for scalability, high availability, and centralized security enforcement without managing third-party appliances.

Answer

Deploy a third-party firewall appliance on EC2 instances in an auto scaling group behind a Network Load Balancer.

Answer

Enable VPC Flow Logs and use Amazon GuardDuty for traffic inspection.

Answer

Deploy a firewall appliance in a single public subnet and route all traffic through it using a NAT gateway.

Question 7

A retail company is deploying a new VPC with public and private subnets. The company wants EC2 instances in the private subnets to initiate outbound connections to a third-party payment gateway on the internet, but the instances must not be directly reachable from the internet. The company also wants to minimize management overhead. Which solution should the company implement?

Accepted Answer

Deploy a NAT gateway in a public subnet and update the private subnet route tables to send 0.0.0.0/0 to the NAT gateway. A NAT gateway deployed in a public subnet enables instances in private subnets to initiate outbound traffic to the internet while blocking unsolicited inbound traffic. Pointing the private subnet route tables to the NAT gateway provides the required connectivity with minimal operational effort, since NAT gateways are managed by AWS.

Answer

Attach an internet gateway to the VPC and assign public IP addresses to the private instances

Answer

Configure a VPC peering connection between the private subnets and the payment gateway's VPC

Answer

Create a transit gateway and attach the VPC to it, then route all traffic through the transit gateway

Question 8

A company has a VPC with a CIDR block of 10.0.0.0/16 and an on-premises network of 192.168.0.0/16, connected by an AWS Site-to-Site VPN. The company now wants to add a second VPC with a CIDR block of 10.1.0.0/16 in the same Region and allow instances in both VPCs to communicate with each other and with on-premises resources. The company wants to minimize the number of VPN tunnels and simplify routing. Which design should a network engineer implement?

Accepted Answer

Attach both VPCs to an AWS Transit Gateway, create a VPN attachment on the transit gateway, and associate the VPC and VPN attachments with the same transit gateway route table.. A transit gateway is a regional routing hub that lets multiple VPCs and a single VPN attachment share one route table. Attaching both VPCs and the VPN to the transit gateway and associating them with the same route table gives the VPCs connectivity to each other and to on-premises through one set of tunnels, which minimizes tunnels and simplifies routing as required.

Answer

Create a second Site-to-Site VPN connection from the on-premises customer gateway to the second VPC's virtual private gateway, and configure BGP between the two.

Answer

Replace the VPN with an AWS Direct Connect connection to the first VPC and use a transit gateway only for the second VPC's outbound internet access through a NAT gateway.

Answer

Create a VPC peering connection between the two VPCs and add a route in each VPC's route table pointing to the peering connection for the other VPC's CIDR block, while leaving the existing VPN attachment on the first VPC.

Question 9

A company is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to protect the application from common web exploits such as SQL injection and cross-site scripting. They also want to block traffic from specific IP addresses that are known to be malicious. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is designed to protect web applications from common exploits such as SQL injection and cross-site scripting. It integrates with ALBs and allows you to create rules that block traffic based on IP addresses, HTTP headers, and request bodies. By associating a web ACL with the ALB, you can filter incoming requests and block malicious traffic. This directly meets the requirements for both web exploit protection and IP blocking.

Answer

Amazon GuardDuty

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 10

A media company runs a live video streaming platform with origins in a single AWS Region. Viewers are globally distributed, and the company wants to reduce first-byte latency and improve availability without changing the origin architecture. The company needs a solution that uses AWS edge locations and supports failover between multiple origins. Which AWS service should be used?

Accepted Answer

Amazon CloudFront with multiple origin groups and origin failover. CloudFront is the AWS content delivery service that caches objects at edge locations and supports origin groups with automatic failover. For a global streaming platform, this combination reduces first-byte latency for viewers and maintains availability if an origin becomes unhealthy, without requiring changes to the origin architecture.

Answer

AWS Transit Gateway with inter-Region peering attachments

Answer

AWS Global Accelerator with endpoint groups in multiple Regions

Answer

Amazon Route 53 latency-based routing with health checks

Question 11

A media company runs a live-streaming ingest tier in a VPC that spans three Availability Zones. Each AZ has its own /24 subnet, and instances are launched by an Auto Scaling group behind a Network Load Balancer. The company wants every ingest instance to receive a predictable, fixed private IPv4 address that survives instance replacement, and it wants to keep ENI-level security group rules. Which combination of features should the network engineer use?

Accepted Answer

Assign a secondary private IPv4 address from the subnet to a specific elastic network interface, and attach the ENIs to instances launched in the Auto Scaling group.. A secondary private IPv4 address attached to a pre-created elastic network interface remains constant across instance replacements, so reattaching that ENI to a new instance preserves the address, the security group associations, and any upstream allow-list entries. Because the address lives on the ENI rather than the instance, this is the only approach that delivers a truly fixed private address while keeping ENI-scoped security groups.

Answer

Rely on the Auto Scaling group's instance ID as the stable identifier and resolve it through Route 53 private hosted zone records updated by lifecycle hooks.

Answer

Configure the Auto Scaling group to use a launch template with a fixed primary private IPv4 address specified for each instance.

Answer

Create an Elastic IP address for each instance and associate it with the instance's primary network interface.

Question 12

A company is designing a new VPC for a web application that will be accessed by users from the internet. The application consists of web servers that must be publicly accessible and database servers that must not be accessible from the internet. The company wants to use a single VPC with two subnets: one public and one private. Which AWS resource should be used to allow the web servers in the public subnet to access the internet while preventing the database servers in the private subnet from being directly accessible from the internet?

Accepted Answer

An internet gateway attached to the VPC, with a route in the public subnet's route table pointing to the internet gateway, and a NAT gateway in the public subnet for the private subnet's outbound traffic.. The correct design uses an internet gateway for the public subnet to allow inbound and outbound internet access for web servers, and a NAT gateway in the public subnet for the private subnet to allow outbound internet access for database updates without exposing them to inbound internet traffic.

Answer

A NAT gateway in the public subnet, with routes in both subnets' route tables pointing to the NAT gateway.

Answer

A virtual private gateway attached to the VPC, with routes in both subnets' route tables pointing to the virtual private gateway.

Answer

An internet gateway attached to the VPC, with routes in both subnets' route tables pointing to the internet gateway.

Question 13

A company is deploying a microservices application on Amazon ECS using the AWS Fargate launch type. The services need to discover and communicate with each other dynamically. The company wants to use AWS Cloud Map for service discovery. The services are deployed in a VPC with private subnets. Which configuration is required to allow the ECS tasks to register themselves with AWS Cloud Map and for other services to discover them?

Accepted Answer

Configure the ECS service to use service discovery by specifying a namespace and service name, and ensure that the tasks have the necessary IAM permissions to register with AWS Cloud Map.. AWS Cloud Map is the native service discovery service for AWS. When you configure an ECS service to use service discovery, you specify a namespace and service name, and ECS automatically registers the tasks with Cloud Map. The tasks need IAM permissions to call Cloud Map APIs. This enables other services to discover the tasks via DNS or the Cloud Map API, providing dynamic service discovery.

Answer

Attach an Elastic Load Balancer to each ECS service and use the load balancer's DNS name for service-to-service communication.

Answer

Enable AWS App Mesh for the ECS services and use its virtual nodes for service discovery.

Answer

Create a private hosted zone in Amazon Route 53 and manually register each ECS task's IP address as an A record.

Question 14

A company runs a critical web application on Amazon EC2 instances in a single VPC. The application must be resilient to the failure of an entire Availability Zone. The company wants to ensure that if one AZ fails, the remaining instances can continue to serve traffic without manual intervention. The instances are behind an Application Load Balancer. Which design meets these requirements?

Accepted Answer

Deploy the EC2 instances in multiple subnets, each in a different Availability Zone, and register all instances with the ALB.. To survive an AZ failure, instances must be placed in multiple AZs. The ALB can distribute traffic across all healthy targets in those AZs. This eliminates a single point of failure and requires no manual intervention. Other options either rely on a single AZ, use an invalid subnet configuration, or restrict traffic to one AZ, all of which fail to meet the resilience requirement.

Answer

Deploy the EC2 instances in a single subnet that spans multiple Availability Zones, and attach them to the ALB.

Answer

Deploy the EC2 instances in multiple subnets across Availability Zones, but configure the ALB to route traffic only to instances in the primary AZ.

Answer

Deploy the EC2 instances in a single subnet within one Availability Zone, and use an Auto Scaling group to launch replacement instances in another AZ upon failure.

Question 15

A media company is deploying a real-time video processing application across multiple VPCs in the same AWS Region. The VPCs are in different AWS accounts and are managed by separate teams. The application requires high-throughput, low-latency communication between instances in these VPCs. The company wants to minimize management overhead and avoid complex peering meshes. They also need to ensure that traffic between VPCs does not traverse the public internet. Which solution should a network engineer recommend?

Accepted Answer

Use AWS Transit Gateway with a single transit gateway shared across accounts via AWS Resource Access Manager (RAM).. AWS Transit Gateway provides a hub-and-spoke topology that simplifies connectivity across many VPCs and accounts. Sharing the transit gateway via AWS RAM allows cross-account attachments without complex peering. Traffic remains on the AWS private network, ensuring it does not traverse the public internet. This reduces management overhead and scales well, unlike a full mesh of peering connections or third-party appliances.

Answer

Establish AWS Site-to-Site VPN connections between each pair of VPCs using virtual private gateways.

Answer

Deploy a third-party virtual appliance in each VPC and create a mesh of IPsec tunnels between them.

Answer

Create a full mesh of VPC peering connections between all VPCs and update route tables accordingly.