ANS-C01 Network Design Practice Test 5 — 15 Questions

Question 1

A company is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company requires high availability and uses BGP for dynamic routing. The on-premises router supports BGP multipath. Which configuration ensures the highest availability for the Direct Connect connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provision two Direct Connect connections to two different Direct Connect locations and configure BGP multipath.. Provisioning two Direct Connect connections to two different Direct Connect locations eliminates single points of failure at the physical layer and the facility level. BGP multipath allows the on-premises router to load-balance traffic across both connections, maximizing availability by ensuring that if one connection or location fails, traffic continues over the other without relying on a slower failover mechanism like VPN.

Answer

Provision a single Direct Connect connection and a Site-to-Site VPN as a backup.

Answer

Provision a single Direct Connect connection with two virtual interfaces.

Answer

Provision a single Direct Connect connection with multiple VLANs.

Question 2

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and use it from the VPC.. A Gateway VPC Endpoint for S3 allows private access to S3 from within the VPC without traversing the internet or requiring public IPs. It avoids IP overlap because the endpoint uses prefix lists and route table entries within the VPC's 10.0.0.0/16 range, and does not involve the on-premises 10.0.0.0/8 network. The Direct Connect private VIF is not used for S3 traffic, so the overlapping CIDR is irrelevant.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it.

Answer

Use a public virtual interface and access S3 via public endpoints.

Answer

Add a route in the VPC route table pointing to the Direct Connect virtual interface for the S3 prefix list.

Question 3

A company is designing a network for a three-tier web application. The web tier must be accessible from the internet, while the application and database tiers must be in private subnets. The company wants to minimize the number of load balancers. Which design should be used?

Accepted Answer

Place an internet-facing Application Load Balancer in a public subnet, web tier instances in public subnets, and app/database instances in private subnets.. An internet-facing Application Load Balancer (ALB) in a public subnet can receive internet traffic and forward it to web tier instances in public subnets, while the application and database tiers remain in private subnets with no direct internet access. This design uses a single load balancer to handle all external traffic, minimizing the number of load balancers while maintaining security boundaries.

Answer

Place an internal Application Load Balancer in a private subnet and use a NAT gateway for internet access.

Answer

Place an internet-facing Network Load Balancer in a public subnet and use it for all tiers.

Answer

Place an internet-facing Application Load Balancer in a private subnet.

Question 4

A company is designing a VPC with the following requirements: (1) Ability to connect to on-premises via AWS Direct Connect with BGP, (2) Ability to route traffic between multiple VPCs, (3) Centralized inspection of traffic between VPCs. Which AWS services should the company use? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (C) is correct because it acts as a central hub to interconnect multiple VPCs and on-premises networks, enabling transitive routing between all attached networks. It supports centralized traffic inspection by routing VPC-to-VPC traffic through a shared inspection VPC (e.g., with a firewall appliance) using route tables and attachments.

Answer

VPC peering connections

Answer

VPC endpoints

Answer

AWS Site-to-Site VPN

Question 5

A company is designing a global network with multiple VPCs connected via AWS Transit Gateway. The company wants to route traffic between VPCs through a centralized inspection VPC that hosts firewalls. Which configurations are required? (Choose THREE.)

Accepted Answer

Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.. Configuring a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment forces all inter-VPC traffic that does not match a more specific route to be sent to the inspection VPC for firewall inspection. This is a common pattern for centralized inspection, where the inspection VPC acts as a next hop for all traffic between VPCs.

Answer

Create VPC endpoints for the inspection services.

Answer

Establish VPC peering connections between each VPC and the inspection VPC.

Question 6

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for 172.16.0.0/16 pointing to the virtual private gateway.. The VPN status is 'available', which indicates that the VPN tunnels are established and the BGP sessions (if configured) are up. However, traffic still fails because the VPC route table lacks a route for the on-premises CIDR (172.16.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC does not know to send traffic destined for the on-premises network through the VPN connection, even though the tunnels themselves are operational.

Answer

The VPN tunnels are not in 'UP' state.

Answer

The tunnel inside CIDRs overlap with the VPC CIDR.

Answer

The BGP session is not established.

Question 7

A network engineer is creating an IAM policy for a DevOps team. The team needs to manage VPN connections. What is the effect of this policy?

Accepted Answer

Allows full management of VPN connections and associated resources.. The IAM policy grants the `ec2:*` action on VPN-related resources (`*vpn*`), which includes all VPN connection operations (create, modify, delete, describe) and associated resources like VPN gateways and customer gateways. This full wildcard on VPN resources enables complete lifecycle management, making option B correct.

Answer

Denies deletion of VPN connections.

Answer

Restricts access to only VPN connections.

Answer

Allows read-only access to VPN configurations.

Question 8

A network engineer is troubleshooting a Direct Connect private VIF. The VIF is in 'available' state but traffic is not flowing to the VPC. The VGW is attached to the VPC. What is the most likely cause?

Accepted Answer

The VPC route table lacks a route to the on-premises network pointing to the VGW.. When a Direct Connect private VIF is in the 'available' state, the physical and logical layer 2 connectivity is established, and BGP sessions are typically up. However, traffic still cannot flow to the VPC unless the VPC route table contains a route that directs traffic destined for the on-premises network to the Virtual Private Gateway (VGW). Without this route, the VPC has no path to send traffic over the Direct Connect connection, even though the VIF and BGP are operational.

Answer

The route filter prefix for the VPC CIDR is misconfigured.

Answer

BGP is not established between the on-premises router and the VGW.

Answer

The VIF state is not 'available'.

Question 9

A company wants to connect its on-premises data center to AWS using a dedicated, private network connection. Which AWS service should be used to establish a 1 Gbps dedicated connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service for establishing a dedicated, private network connection from an on-premises data center to AWS. It provides a 1 Gbps (or higher) physical Ethernet link that bypasses the public internet, delivering consistent network performance and reduced bandwidth costs for high-volume data transfer.

Answer

AWS Transit Gateway

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 10

A company has multiple VPCs across different AWS Regions and wants to enable communication between them using AWS's global network backbone. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Transit Gateway with inter-Region peering.. AWS Transit Gateway with inter-Region peering is correct because it allows you to connect multiple VPCs across different AWS Regions using AWS's global network backbone, providing a hub-and-spoke architecture that scales easily. This solution minimizes operational overhead by centralizing routing and eliminating the need to manage individual connections between each VPC, as Transit Gateway automatically handles route propagation and traffic distribution across peered transit gateways.

Answer

Set up AWS Direct Connect connections to each VPC.

Answer

Create VPC peering connections between each pair of VPCs.

Answer

Use AWS Site-to-Site VPN between VPCs.

Question 11

A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?

Accepted Answer

AWS Transit Gateway with centralized routing to the inspection VPC.. AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.

Answer

VPC peering between all VPCs and the inspection VPC.

Answer

AWS Network Firewall deployed in each VPC.

Answer

AWS Direct Connect Gateway with virtual interfaces.

Question 12

A company needs to provide internet access to instances in a private subnet while preventing inbound connections from the internet. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It achieves this by translating the private source IP addresses of the instances to the NAT Gateway's Elastic IP address, and by default it does not allow inbound traffic unless an explicit inbound rule is added to the associated route table, which is not recommended for this use case.

Answer

Internet Gateway

Answer

AWS Direct Connect

Answer

VPC Endpoint

Question 13

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The application team wants to allow internet traffic to an IPv6-enabled web server. Which resource must be configured?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is required to allow inbound and outbound IPv6 traffic between a VPC and the internet. Unlike IPv4, IPv6 addresses in AWS are globally unique by default, so no NAT is needed; the IGW directly routes traffic for both IPv4 and IPv6 when attached to the VPC and associated with the route table.

Answer

NAT64

Answer

Egress-Only Internet Gateway

Answer

NAT Gateway

Question 14

A company is designing a hybrid network with AWS Direct Connect. They have multiple VPCs in the same Region and want to use a single Direct Connect connection to access all VPCs. Which AWS resource should be used?

Accepted Answer

Direct Connect Gateway. A Direct Connect Gateway allows you to associate up to 10 Virtual Private Gateways (VGWs) or Transit Gateways in the same or different AWS accounts, enabling a single Direct Connect connection to reach multiple VPCs in the same Region. This is the correct resource because it acts as a hub that terminates the Direct Connect virtual interfaces (VIFs) and propagates routes to the associated VPCs via their VGWs or Transit Gateways.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

Virtual Private Gateway

Question 15

A company needs to resolve DNS names within a VPC using a custom domain. Which AWS service should be used?

Accepted Answer

Amazon Route 53 Resolver. Amazon Route 53 Resolver provides recursive DNS resolution for VPCs and supports custom domain names via inbound and outbound endpoints. It integrates with on-premises DNS through conditional forwarding, enabling resolution of custom private domains within the VPC without exposing them to the internet.

Answer

Elastic Load Balancing

Answer

Amazon CloudFront

Answer

AWS WAF