ANS-C01 Network Design Practice Test 5 — 15 Questions

Question 1

A network engineer configured VPC Flow Logs for a subnet to capture all traffic. After reviewing the logs in CloudWatch Logs, they notice that some logs show 'NODATA' for the log-status field. What does 'NODATA' indicate?

Accepted Answer

No network traffic was observed for the given capture period.. When VPC Flow Logs display 'NODATA' for the log-status field, it indicates that no network traffic was observed for the subnet during the aggregation interval (typically 10 minutes). This is a normal status meaning the capture window had zero packets flowing through the monitored interfaces, not an error or delivery issue.

Answer

The flow log record was skipped due to an internal error.

Answer

The log record was successfully delivered to CloudWatch.

Answer

The traffic was rejected by a network ACL or security group.

Question 2

An IAM policy is attached to a user who needs to manage VPC peering connections. The policy allows creating and accepting peering connections, but the user reports they cannot add routes to the route table of their VPC (vpc-11111111) for the peered connection. What is the most likely cause?

Accepted Answer

The condition in the policy restricts the VPC, but the route table is not associated with that VPC.. Option A is correct because the IAM policy includes a condition that restricts the VPC (e.g., `ec2:Vpc` condition key set to `vpc-11111111`), but the route table the user is trying to modify is not associated with that VPC. Even though the user has permissions to create and accept peering connections, the condition on the route table modification action (like `ec2:CreateRoute`) limits the operation to route tables belonging to the specified VPC. Since the route table belongs to a different VPC or is not associated with `vpc-11111111`, the request fails.

Answer

The user does not have permission to create routes.

Answer

The user needs additional permissions for the peering connection.

Answer

The user needs to accept the peering connection first.

Question 3

A network administrator is troubleshooting connectivity to a web server in subnet with network ACL 'acl-12345678'. The web server is on port 443. The administrator finds that traffic from IP 10.0.1.5 is being denied. Why is the traffic being denied?

Accepted Answer

The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.. Option C is correct because network ACLs are stateless and evaluated in ascending order by rule number. Rule 100 denies traffic from 10.0.0.0/8, which includes the source IP 10.0.1.5, so any traffic from that IP is denied regardless of later allow rules. Since network ACLs do not track connection state, the deny is applied immediately upon matching rule 100.

Answer

The subnet is not associated with this network ACL.

Answer

The security group attached to the web server is blocking the traffic.

Answer

The network ACL rule 100 allows traffic from 0.0.0.0/0, but rule 200 denies traffic from 10.0.0.0/8, and rule 200 is evaluated first.

Question 4

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in us-east-1 and a Network Load Balancer (NLB) in eu-west-1. They need to route traffic from the ALB to the NLB using a fixed IP address. Which AWS service should be used to provide a static IP for the NLB and enable cross-region load balancing?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides two static anycast IP addresses that serve as a fixed entry point for traffic. It can route traffic from the ALB in us-east-1 to the NLB in eu-west-1 by using an endpoint group that includes the NLB's IP address, enabling cross-region load balancing with a static IP. This allows the ALB to forward traffic to the Global Accelerator's static IP, which then optimally routes to the NLB in the other region.

Answer

AWS WAF

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Question 5

A company is deploying a critical application across three AWS Regions using an active-active architecture with Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) as the endpoint. The application health checks are configured to check the /health endpoint every 10 seconds. During a regional failure, some users experience timeouts while others are redirected correctly. What is the most likely cause?

Accepted Answer

Route 53 health checkers take multiple intervals to detect failure, and timeouts occur before failover completes.. Route 53 health checkers operate from multiple global locations and evaluate the /health endpoint every 10 seconds. However, to declare an endpoint unhealthy, Route 53 requires a configurable number of consecutive failures (default is 3), meaning it can take 30 seconds or more before the DNS record is updated to remove the failed region. During this detection window, some users whose DNS queries are answered by Route 53 before the failure is fully propagated may receive the IP of the failing ALB, leading to timeouts, while others who query after the failover complete successfully.

Answer

The ALB health check is misconfigured and returns a non-200 status code during normal operation.

Answer

The TTL on the Route 53 record is set too low, causing stale DNS responses.

Answer

Users have cached DNS records from the failed region, and Route 53 does not return healthy endpoints.

Question 6

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has an internet gateway attached to the VPC and a NAT gateway in a public subnet. Which route table configuration is required for the private subnets to access the internet?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the NAT gateway.. Option B is correct because private subnets require a default route (0.0.0.0/0) pointing to the NAT gateway to enable outbound internet access while preventing inbound traffic from the internet. The NAT gateway, residing in a public subnet with an associated Elastic IP, translates private IP addresses to the Elastic IP for internet-bound traffic. The internet gateway is used by public subnets, not private subnets, for direct internet access.

Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway.

Answer

Add a route in the public subnet route table with destination 0.0.0.0/0 and target the NAT gateway.

Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway, and associate an Elastic IP with the NAT gateway.

Question 7

A company is designing a hybrid network with an AWS Direct Connect connection. They have two virtual interfaces (VIFs): a private VIF to a VPC and a public VIF to access AWS public services. They want to ensure that traffic to Amazon S3 in the same region uses the Direct Connect connection and not the internet. Which configuration should be applied?

Accepted Answer

Advertise the S3 prefix via BGP on the public VIF and ensure the VPC route table has a more specific route for S3 pointing to the virtual private gateway.. To force traffic to Amazon S3 in the same region over the Direct Connect public VIF, you must advertise the S3 prefix (e.g., 52.216.0.0/15) via BGP on the public VIF. This makes the Direct Connect path the most specific route for S3 in the VPC route table when combined with a more specific route pointing to the virtual private gateway, overriding the default internet route.

Answer

Add a route in the VPC route table for S3 prefix with target as the internet gateway.

Answer

Create a VPC endpoint for S3 and attach it to the VPC route table.

Answer

Create a VPN connection to the VPC and route S3 traffic through the VPN.

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC with CIDR 10.0.0.0/16. They plan to use a transit gateway to connect the VPCs. What is the correct approach to handle the overlapping CIDR ranges?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs.. Transit gateways do not perform NAT or resolve overlapping CIDR conflicts between attached VPCs. When two VPCs have identical CIDR blocks (10.0.0.0/16), the transit gateway cannot route traffic correctly because it cannot distinguish between the two networks. The only viable solution is to create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs, eliminating the conflict at the network layer.

Answer

Create a VPC peering connection and use a smaller subnet CIDR for traffic filtering.

Answer

Use a transit gateway with network address translation (NAT) to translate one VPC CIDR to a non-overlapping range.

Answer

Configure the transit gateway with equal-cost multipath (ECMP) to load balance traffic between the overlapping CIDRs.

Question 9

A company wants to provide internet access to instances in a private subnet using a NAT gateway. The NAT gateway is deployed in a public subnet with an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, instances in the private subnet cannot access the internet. What is the most likely cause?

Accepted Answer

The public subnet route table does not have a route to the internet gateway.. The NAT gateway is deployed in a public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. This is the most likely cause because the NAT gateway itself needs internet access via the IGW to translate and forward traffic.

Answer

The security group assigned to the NAT gateway blocks outbound traffic.

Answer

The private subnet route table has a route to the internet gateway instead of the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP associated.

Question 10

A company uses AWS Direct Connect to connect its on-premises network to a VPC. They have a private VIF attached to a virtual private gateway. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures automatic failover?

Accepted Answer

Use BGP on both the Direct Connect private VIF and the VPN connection, and advertise the same prefixes with a longer AS path for the VPN.. Option C is correct because using BGP on both the Direct Connect private VIF and the VPN connection allows you to manipulate route selection via AS path prepending. By advertising the same prefixes with a longer AS path on the VPN, the Direct Connect path is preferred, and if it fails, BGP withdraws the routes, causing traffic to automatically fail over to the VPN.

Answer

Attach the VPN connection to a separate virtual private gateway and use a transit gateway to combine them.

Answer

Use static routes on the Direct Connect private VIF and BGP on the VPN connection.

Answer

Create a second Direct Connect connection and use equal-cost multipath (ECMP) between the two.

Question 11

A company is designing a network for a multi-account architecture using AWS Resource Access Manager (RAM) to share VPC subnets across accounts. They want to ensure that instances in shared subnets can communicate with instances in the owner's VPC using private IP addresses. What is required?

Accepted Answer

No additional networking configuration is required; the shared subnet is part of the same VPC.. When you share a subnet using AWS Resource Access Manager (RAM), the shared subnet is part of the owner's VPC. Instances launched into that shared subnet reside in the same VPC as the owner's instances, so they can communicate using private IP addresses by default, with no additional networking configuration required. This is because VPC subnets are a logical subdivision of the VPC's CIDR block, and all instances within the same VPC can route to each other via the VPC's internal router.

Answer

Establish a VPC peering connection between the owner and participant accounts.

Answer

Configure a VPC endpoint for Amazon EC2 to allow cross-account private communication.

Answer

Create a transit gateway and attach both VPCs to it.

Question 12

A company has an application that requires fixed IP addresses for whitelisting by third-party partners. The application is hosted on an Application Load Balancer (ALB) in a VPC. Which solution provides static IP addresses for the ALB?

Accepted Answer

Place an AWS Global Accelerator in front of the ALB.. AWS Global Accelerator provides two static IP addresses that act as fixed entry points for traffic. By placing it in front of an Application Load Balancer (ALB), you can whitelist these static IPs with third-party partners while the ALB itself remains dynamic. Global Accelerator uses the AWS global network to route traffic to the ALB, preserving the ALB's native HTTP/HTTPS features.

Answer

Use Amazon CloudFront with the ALB as origin.

Answer

Assign an Elastic IP to the ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB).

Question 13

A company is designing a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application (web, application, database) across two Availability Zones. They also need a /20 subnet for a future expansion. Which TWO subnet CIDR allocations are valid and efficient?

Accepted Answer

10.0.0.0/20. Option A is correct because 10.0.0.0/20 is a valid subnet within the 10.0.0.0/16 VPC, providing 4096 IP addresses. It is an efficient allocation as it leaves contiguous space for the other required subnets (e.g., /20 for future expansion) without overlapping, and it aligns with the need for subnets across two Availability Zones.

Answer

10.0.0.0/18

Answer

10.0.0.0/16

Answer

10.0.0.0/28

Question 14

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. Both connections will terminate at the same Direct Connect gateway. Which TWO steps are required to enable BGP multipath (ECMP) across the two connections?

Accepted Answer

Ensure the same customer-side ASN is used on both virtual interfaces.. To enable BGP multipath (ECMP) across two Direct Connect connections terminating on the same Direct Connect gateway, you must use the same customer-side ASN on both virtual interfaces. This allows the Direct Connect gateway to treat both paths as equal-cost routes. Additionally, you must advertise the same BGP prefixes on both virtual interfaces so that the gateway sees identical routes from both paths and can load-balance traffic across them.

Answer

Use a different autonomous system number (ASN) on each virtual interface.

Answer

Advertise different BGP prefixes on each virtual interface.

Answer

Attach each virtual interface to a different VPC.

Question 15

A company wants to enable communication between two VPCs (VPC A and VPC B) in the same AWS account and region. They want to use private IP addresses and avoid using the internet. Which THREE options can achieve this?

Accepted Answer

VPC peering connection. VPC peering connection (Option A) allows direct, private IP connectivity between two VPCs using the AWS global network, with no internet gateway or VPN required. Traffic stays within AWS's internal infrastructure, meeting the requirement for private IP addresses and avoiding the internet.

Answer

Internet gateway attached to both VPCs

Answer

NAT gateway in each VPC