ANS-C01 Network Design Practice Test 44 — 15 Questions

Question 1

A company is designing a hybrid network architecture that connects its on-premises data center to multiple VPCs in different AWS Regions. The company wants to use AWS Transit Gateway to simplify connectivity and reduce operational overhead. The on-premises network is connected to a Transit Gateway in us-east-1 via AWS Direct Connect. The company also has a Transit Gateway in eu-west-1. They need to enable communication between the VPCs attached to both Transit Gateways and the on-premises network. Which two actions must be taken to allow traffic to flow between the VPCs in different Regions and the on-premises network? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Transit Gateway peering attachment between the Transit Gateway in us-east-1 and the Transit Gateway in eu-west-1.. To enable communication between VPCs in different Regions and the on-premises network via Transit Gateway, you must create a Transit Gateway peering attachment between the Transit Gateways in each Region. Then, you must configure the Transit Gateway route tables to propagate routes between the peering attachment and the Direct Connect attachment so that traffic can be routed correctly.

Answer

Attach a virtual private gateway to each VPC and establish a VPN connection between the virtual private gateways.

Answer

Enable equal-cost multi-path (ECMP) routing on the Direct Connect connection to load balance traffic across multiple VPN tunnels.

Answer

Create a VPC peering connection between each VPC and the on-premises network.

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to add a new subnet that will host a large number of EC2 instances. The subnet must have a CIDR block of 10.0.1.0/24. Which step must be taken before creating this subnet?

Accepted Answer

Ensure the VPC has an available IPv4 CIDR block that can accommodate the new subnet.. The only prerequisite for creating a subnet with a specific CIDR block is that the VPC must have enough unallocated IP address space and the new CIDR must not overlap with existing subnets. The VPC's CIDR block is 10.0.0.0/16, and 10.0.1.0/24 is a valid subset. Other actions like attaching an internet gateway, associating route tables, or enabling DNS hostnames are not required for subnet creation.

Answer

Enable DNS hostnames for the VPC.

Answer

Create an internet gateway and attach it to the VPC.

Answer

Associate the VPC with a new route table.

Question 3

A company runs a three-tier web application in a VPC (10.0.0.0/16) with two private subnets and two public subnets. The database tier must be reachable only from the application tier. The security team requires that all traffic between the application tier and database tier be explicitly allowed at the subnet boundary, without relying solely on security groups. Which configuration should a network engineer implement to meet these requirements?

Accepted Answer

Attach a network ACL to the database subnets that allows inbound TCP 3306 from the application subnet CIDR and denies all other inbound traffic.. Network ACLs are the only VPC construct that enforces allow/deny rules at the subnet boundary. By allowing TCP 3306 from the application subnet CIDR and denying all other inbound traffic, the engineer creates an explicit, stateless boundary control that is independent of security group rules. Security groups, route tables, and Flow Logs operate at different layers and do not provide subnet-level explicit deny capability.

Answer

Enable VPC Flow Logs on the database subnets and create a CloudWatch alarm for unauthorized traffic.

Answer

Configure a route table for the database subnets that only includes routes to the application subnet CIDR.

Answer

Create a security group for the database instances that references the application tier security group as the source on port 3306.

Question 4

A company is deploying a critical application across two AWS Regions and wants to minimize latency for global users. They plan to use AWS Global Accelerator with endpoint groups in each Region. The application runs on Network Load Balancers (NLBs) in us-east-1 and eu-west-1. The company wants to ensure that if one Region becomes unavailable, traffic is automatically routed to the other Region without DNS changes. Which configuration should they use?

Accepted Answer

Configure Global Accelerator with an endpoint group in each Region, and rely on Global Accelerator's health checks to automatically route traffic to healthy endpoints.. Global Accelerator uses health checks to monitor endpoints in each Region. When an endpoint or Region becomes unhealthy, traffic is automatically routed to healthy endpoints in other Regions, ensuring high availability without DNS changes. This is the core benefit of Global Accelerator for multi-Region architectures. The traffic dial is for weighted traffic distribution, not failover.

Answer

Configure Global Accelerator with an endpoint group in each Region, and set the traffic dial to 100 for both endpoint groups.

Answer

Configure Global Accelerator with a single endpoint group that includes NLBs from both Regions, and enable client IP preservation.

Answer

Configure Global Accelerator with an endpoint group in each Region, and set the traffic dial to 0 for the secondary Region.

Question 5

A startup is deploying a three-tier web application in a single VPC. The database tier runs on Amazon RDS in private subnets and must accept connections only from the application tier. The application tier runs on EC2 instances in separate private subnets. A security engineer needs to permit database access using the least operational overhead while allowing the application tier to scale automatically. Which approach should the engineer use?

Accepted Answer

Create a security group for the RDS instance and reference the application tier security group as the source in the inbound rule on the database port.. A security group inbound rule that references another security group authorizes traffic based on group membership rather than IP addresses. Because Auto Scaling replaces instances with new addresses, the group reference remains valid without edits, providing least-privilege access with minimal operational effort. Subnet-level ACLs and Elastic IP lists both require ongoing maintenance and grant broader or unintended access.

Answer

Place the RDS instance and the application instances in the same security group and rely on the default allow-all outbound behavior of that group.

Answer

Create a network ACL on the database subnet that allows inbound traffic from the application subnet CIDR on the database port and denies all other inbound traffic.

Answer

Assign Elastic IP addresses to the application tier instances and add those addresses to the database security group inbound rules.

Question 6

A company is designing a network for a latency-sensitive application that runs on EC2 instances in multiple VPCs within the same AWS Region. The application requires multicast communication between instances. Which AWS service or feature should be used to enable multicast?

Accepted Answer

AWS Transit Gateway with multicast support enabled.. AWS Transit Gateway is the only AWS service that natively supports multicast across VPCs. It allows you to create a multicast domain, associate VPC attachments, and register instances as sources or members. VPC peering, Direct Connect, and Site-to-Site VPN do not support multicast. Therefore, Transit Gateway with multicast enabled is the correct solution for latency-sensitive multicast applications spanning multiple VPCs.

Answer

VPC peering with multicast routing enabled.

Answer

AWS Direct Connect with a virtual interface configured for multicast.

Answer

AWS Site-to-Site VPN with multicast enabled on the tunnels.

Question 7

A network engineer is designing a hybrid architecture where an on-premises data center connects to a VPC using AWS Site-to-Site VPN over a single IPSec tunnel. The company requires that the on-premises routers run dynamic routing with AWS and that the tunnel fail over automatically if the primary path degrades. The on-premises router supports BGP. Which combination of configuration steps should the engineer take to meet these requirements?

Accepted Answer

Configure the customer gateway with BGP ASN 65000, enable route propagation on the VPC route table, and configure both tunnels of the VPN connection for redundancy.. AWS Site-to-Site VPN always creates two tunnels for redundancy. To achieve dynamic routing and automatic failover, the customer gateway must use BGP, and the VPC route table must have route propagation enabled so it can learn routes from both tunnels. BGP will then select the best path and fail over to the secondary tunnel if the primary degrades. Static routes or a single tunnel cannot meet the dynamic routing and automatic failover requirements.

Answer

Configure the customer gateway with BGP ASN 65000, disable route propagation, and manually add static routes for each tunnel.

Answer

Configure the customer gateway with BGP ASN 65000, enable route propagation, and use a single tunnel with BGP graceful restart.

Answer

Configure the customer gateway with static routes, enable route propagation, and use a single tunnel with Dead Peer Detection (DPD) enabled.

Question 8

A healthcare company is building a VPC for a patient portal and must produce evidence that no traffic can leave the VPC to the public internet, even if a misconfigured route or security group is later added. The VPC contains private subnets only, and all AWS API calls are made through interface VPC endpoints. Which design element most directly enforces the requirement that no public internet egress path can exist?

Accepted Answer

Create a VPC with no internet gateway and no NAT gateway attached, and use only interface VPC endpoints for AWS service access.. The structural way to guarantee that a VPC can never reach the public internet is to omit the components that provide that capability. Without an internet gateway or a NAT gateway attached, no route table entry can resolve to a working egress path, so the isolation survives later route or security group changes. Interface VPC endpoints supply private connectivity to AWS APIs without an internet path.

Answer

Use security groups that reference only other security groups as sources and never allow outbound rules to 0.0.0.0/0.

Answer

Apply a network ACL on each subnet that denies all outbound traffic to 0.0.0.0/0 while allowing return traffic on ephemeral ports.

Answer

Attach an internet gateway to the VPC but do not add any route to it in the subnet route tables.

Question 9

A media company is building a hybrid architecture. On-premises editors must mount an NFS file system that is hosted on Amazon EFS in a VPC. The on-premises network connects to the VPC through a 10 Gbps AWS Direct Connect dedicated connection. Editors report that mount attempts time out, and a network engineer confirms that the Direct Connect virtual interface is up and BGP routes are being advertised. Which configuration change will allow the NFS mounts to succeed?

Accepted Answer

Add a route in the VPC route tables that points the on-premises CIDR to the Direct Connect virtual private gateway or transit gateway, and add a return route on-premises for the VPC CIDR.. The mount times out because the on-premises clients lack a route to the EFS mount target private IPs inside the VPC. The fix requires a route on the VPC side toward the on-premises CIDR and a corresponding route on-premises toward the VPC CIDR, using the existing Direct Connect virtual private gateway or transit gateway. DNS and public interface changes do not create that private path.

Answer

Create a public virtual interface on the Direct Connect connection and advertise the EFS mount target IP addresses.

Answer

Attach an internet gateway to the VPC and configure the on-premises firewall to allow outbound TCP port 2049 to the mount target public IP addresses.

Answer

Enable DNS resolution and DNS hostnames on the VPC and configure the on-premises DNS server to forward efs.us-east-1.amazonaws.com to the Amazon Route 53 Resolver.

Question 10

A global retailer runs an order-processing API on EC2 instances behind a Network Load Balancer in us-east-1. The company is opening a second Region in eu-west-1 and wants active-active failover with deterministic, low-latency routing for users in Europe and North America. The solution must preserve the client source IP address at the application and must not rely on DNS caching behavior. Which design should a network engineer implement?

Accepted Answer

Deploy AWS Global Accelerator with an endpoint group in each Region containing the respective Network Load Balancer, and enable client IP preservation on the load balancers.. AWS Global Accelerator uses anycast static IP addresses to onboard client traffic at the nearest AWS edge and then carries it over the AWS global network to healthy Regional endpoints. Failover is health-check driven and independent of DNS caching, and because the target is a Network Load Balancer with client IP preservation enabled, the backend application still receives the original client address.

Answer

Create a Transit Gateway peering attachment between the two Regions and route client traffic through the nearest Region using BGP communities.

Answer

Create an Amazon CloudFront distribution with both Network Load Balancers as custom origins and set the origin protocol policy to match viewer.

Answer

Create a latency-based Route 53 record with health checks that points to both Network Load Balancers, and enable client IP preservation on both load balancers.

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a private subnet with CIDR 10.0.1.0/24 that contains EC2 instances. The instances need to access an Amazon S3 bucket to download objects. The company wants to ensure that traffic to S3 does not traverse the public internet. Which solution should they implement?

Accepted Answer

Create a VPC endpoint for Amazon S3 and update the route table for the private subnet.. To access S3 without using the public internet, use a VPC endpoint for S3. A gateway endpoint is a target for a route in the route table. When you associate the endpoint with the private subnet's route table, traffic to S3 is routed through the endpoint and stays within the AWS network. This is the recommended and most secure method. Other options either use the public internet or are not applicable.

Answer

Configure an internet gateway and route S3 traffic through it.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it.

Answer

Set up an AWS Site-to-Site VPN connection to the S3 service.

Question 12

A company is deploying a multi-tier application in a VPC. The web tier runs in a public subnet and must be accessible from the internet. The application tier runs in a private subnet and must initiate outbound connections to the internet for software updates, but must not be directly accessible from the internet. The company wants to minimize cost and management overhead. Which solution meets these requirements?

Accepted Answer

Attach an internet gateway to the VPC, place the web tier in a public subnet with a route to the internet gateway, and place the application tier in a private subnet with a route to a NAT gateway. The standard design uses an internet gateway for the public subnet and a NAT gateway for the private subnet. This allows the web tier to be internet-facing and the application tier to initiate outbound connections without inbound internet access. A NAT gateway is managed by AWS, reducing operational overhead compared to a NAT instance.

Answer

Use an internet gateway for both subnets and assign Elastic IP addresses to the application tier instances

Answer

Use AWS PrivateLink to provide outbound internet access for the application tier

Answer

Use a NAT instance instead of a NAT gateway for the application tier to reduce cost

Question 13

A healthcare company must connect its on-premises network to a VPC using AWS Site-to-Site VPN over a single internet connection. The security team requires that traffic be encrypted and that the on-premises router use a dynamic routing protocol to learn VPC routes automatically. The network engineer has created a virtual private gateway and a customer gateway. Which additional configuration is required to bring the tunnel up and exchange routes dynamically?

Accepted Answer

Create a VPN connection, download the configuration file, and configure the customer gateway device with the pre-shared keys and BGP settings from the file.. After creating the virtual private gateway and customer gateway, the engineer must create the VPN connection, which generates the tunnel IP addresses, pre-shared keys, and BGP configuration. Applying the downloaded vendor configuration to the on-premises device completes IKE and IPsec negotiation and starts BGP peering, which is what enables automatic route learning between the VPC and the on-premises network.

Answer

Attach an internet gateway to the VPC and create a static route in the VPC route table pointing to the customer gateway public IP address.

Answer

Create a Direct Connect gateway and associate it with the virtual private gateway, then enable route propagation on the VPC route tables.

Answer

Enable accelerated site-to-site VPN on the virtual private gateway and configure the on-premises router to use static routes for each VPC CIDR.

Question 14

A company is deploying a web application in a VPC. The application runs on Amazon EC2 instances in an Auto Scaling group across three private subnets. The company wants to distribute incoming HTTP and HTTPS traffic to the instances and needs the ability to route traffic based on URL path and host header. The company also wants to offload TLS termination to the load balancer. Which AWS service should the network engineer use?

Accepted Answer

Application Load Balancer. The application requires Layer 7 routing based on URL path and host header, as well as TLS termination. Application Load Balancers provide these features natively, including support for multiple listener rules and integration with AWS Certificate Manager. Network Load Balancers and Gateway Load Balancers operate at lower layers and lack HTTP routing, while Classic Load Balancers do not support path-based routing.

Answer

Classic Load Balancer

Answer

Gateway Load Balancer

Answer

Network Load Balancer

Question 15

A company is deploying a global web application that will be accessed by users in North America, Europe, and Asia. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company wants to provide a single global anycast IP address that routes users to the closest healthy endpoint based on latency, and must ensure that if an entire Region becomes unavailable, traffic is automatically redirected to the next closest Region. The solution must also support WebSocket connections. Which AWS service should the network engineer use to meet these requirements?

Accepted Answer

AWS Global Accelerator with a standard accelerator and endpoint groups in each Region.. AWS Global Accelerator provides static anycast IP addresses that act as a fixed entry point for global applications. It uses the AWS global network to route traffic to the optimal endpoint based on latency, and it performs health checks to automatically fail over to healthy endpoints in other Regions within seconds. It supports TCP and UDP, including WebSocket, making it the correct choice for this requirement.

Answer

AWS Transit Gateway with inter-Region peering and equal-cost multi-path routing.

Answer

Amazon CloudFront with a custom origin and Lambda@Edge for failover.

Answer

Amazon Route 53 with latency-based routing and health checks.