ANS-C01 Network Design Practice Test 5 — 15 Questions

Question 1

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to another VPC with CIDR 10.0.0.0/16 via VPC Peering. They encounter an error because of overlapping CIDRs. Which TWO actions can resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new VPC with a non-overlapping CIDR and peer with that. Option B is correct because VPC peering requires the two VPC CIDR blocks to be non-overlapping, so creating a new VPC with a distinct CIDR range (for example 10.1.0.0/16) and peering with that VPC eliminates the overlap and allows the peering connection to be established. Option D is correct because AWS Transit Gateway can interconnect multiple VPCs through a hub-and-spoke model with separate route tables, and it can route traffic between VPCs even when their CIDRs overlap, since each attachment is treated as a distinct routing domain rather than requiring direct non-overlapping peering. Option A is incorrect because VPC peering is a VPC-level construct; there is no subnet-level peering connection that bypasses the overlapping CIDR requirement. Option C is incorrect because you cannot modify the CIDR block of an existing VPC after creation (you can only add secondary CIDRs, which would not remove the original overlapping 10.0.0.0/16). Option E is incorrect because a NAT Gateway provides outbound internet access for private subnets and does not translate or route traffic between two VPCs with overlapping CIDRs.

Answer

Use a subnet-level peering connection

Answer

Modify the CIDR of one VPC to a non-overlapping range

Answer

Use a NAT Gateway to translate IPs

Question 2

The EC2 instance has a private IP 10.0.1.5. The first two hops are 10.0.1.1 (the subnet's default gateway) and 10.0.0.1. Based on the traceroute, what is the most likely configuration of the VPC?

Accepted Answer

The subnet is a private subnet with no route to an Internet Gateway, and the default route points to a NAT instance or is missing. The traceroute shows the first hop as 10.0.1.1 (the subnet's default gateway) and the second hop as 10.0.0.1 (the VPC router's IP for the main route table). The absence of a third hop to a public IP or NAT device indicates that the instance's traffic is not being forwarded beyond the VPC router. This is consistent with a private subnet that has no route to an Internet Gateway and either has no default route or a default route pointing to a NAT instance that is not responding or is missing, causing the traceroute to stop at the VPC router.

Answer

The subnet is a public subnet with a route to an Internet Gateway

Answer

The subnet is a private subnet with a route to a NAT Gateway

Answer

The subnet is connected to a VPN

Question 3

A network engineer deploys this CloudFormation template. After deployment, an EC2 instance launched in PublicSubnet1 cannot reach the internet. What is the most likely cause?

Accepted Answer

The subnet does not have a route to the Internet Gateway because the route table is not associated with the subnet.. The most likely cause is that the route table containing the default route (0.0.0.0/0) pointing to the Internet Gateway is not associated with PublicSubnet1. Without this association, traffic from the subnet has no path to the Internet Gateway, even if the IGW is attached to the VPC. CloudFormation templates often create separate route tables and subnets, and a missing subnet-to-route-table association is a common misconfiguration.

Answer

The Internet Gateway is not attached to the VPC.

Answer

The subnet does not have MapPublicIpOnLaunch set to true.

Answer

The security group is blocking outbound traffic.

Question 4

A company is designing a hybrid network with AWS Direct Connect and AWS Site-to-Site VPN as backup. The primary Direct Connect connection uses a private VIF to a VPC. If the Direct Connect fails, traffic should automatically fail over to the VPN connection. What is the MOST reliable way to achieve this failover?

Accepted Answer

Use BGP on both connections and prepend AS paths on the VPN routes to make them less preferred.. Using BGP on both connections allows for dynamic routing and automatic failover. By prepending AS paths on the VPN routes, you make the VPN path less preferred, ensuring that Direct Connect is the primary path. If Direct Connect fails, the BGP session drops and the VPN routes become active. This method provides symmetric failover in both directions and is recommended by AWS.

Answer

Use BGP on Direct Connect and static routes on the VPN connection, with a higher metric for the VPN static route.

Answer

Configure static routes on the customer gateway device with a lower metric for the Direct Connect interface.

Answer

Use BGP on both connections and set a lower local preference on the Direct Connect routes.

Question 5

A financial services company must meet PCI DSS compliance for its VPC design. It requires that all traffic between application tiers be encrypted in transit and that no traffic can bypass the encryption. The architecture includes a public-facing Application Load Balancer (ALB), a web tier in public subnets, an app tier in private subnets, and a database tier in isolated subnets. Which design meets these requirements?

Accepted Answer

Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use TLS mutual authentication between web and app tier. Use TLS between app and database tier.. It ensures encryption in transit for all traffic between application tiers, meeting PCI DSS requirements. The ALB terminates TLS from clients, then uses HTTPS (TLS) to the web tier, mutual TLS between web and app tiers for strong authentication and encryption, and TLS between app and database tiers. This design prevents any unencrypted traffic from bypassing encryption, as every hop uses TLS.

Answer

Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.

Answer

Terminate TLS at the ALB. Use HTTP between ALB and web tier. Use HTTPS between web and app tier. Use TLS between app and database tier.

Answer

Terminate TLS at the ALB. Use HTTPS between ALB and web tier. Use HTTP between web and app tier. Use TLS between app and database tier.

Question 6

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. It needs to connect to an on-premises data center over AWS Direct Connect. The on-premises network uses the 10.0.0.0/8 address space. The company cannot change the on-premises addressing. Which solution will allow connectivity without overlapping IP addresses?

Accepted Answer

Assign IPv6 CIDR to the existing VPC, use IPv6 for all resources, and connect over Direct Connect using IPv6.. Assigning an IPv6 CIDR to the existing VPC and using IPv6 for all resources avoids the IPv4 address overlap with the on-premises 10.0.0.0/8 network. AWS Direct Connect supports both IPv4 and IPv6 traffic, so you can establish a BGP session over IPv6 and route IPv6 traffic between the VPC and on-premises, completely bypassing the conflicting IPv4 address space.

Answer

Use VPC peering between the existing VPC and a new VPC with a non-overlapping CIDR, then route traffic through the new VPC.

Answer

Create a new VPC with a non-overlapping CIDR such as 172.16.0.0/16 and migrate resources.

Answer

Use AWS Transit Gateway with a Network Address Translation (NAT) attachment to translate the VPC CIDR.

Question 7

A company is designing a Direct Connect solution with two connections to provide high availability. The company has two customer routers, each connected to a separate AWS Direct Connect location. The company uses BGP to advertise the same prefixes from both routers. What is the correct way to configure the BGP attributes to ensure that traffic uses both connections actively?

Accepted Answer

Advertise the same AS path length from both routers.. Advertising the same AS path length from both routers ensures that AWS Direct Connect routers see both paths as equally preferred under the BGP path selection process (which considers AS path length before MED, local preference, and IGP metric). With equal AS path length, traffic will be load-balanced across both Direct Connect connections, actively using both links for inbound traffic from AWS to the customer network.

Answer

Use AS path prepending on both routers to make the paths equally long.

Answer

Set a higher local preference on the primary router and lower on the secondary.

Answer

Advertise a shorter AS path on the primary router and a longer AS path on the secondary router.

Question 8

A company is using AWS CloudFormation to deploy a VPC with public and private subnets across multiple Availability Zones. The template includes a NAT gateway in each public subnet. The company wants to ensure that the private subnet route tables automatically update when the NAT gateway ID changes. Which feature should be used?

Accepted Answer

Use the 'Fn::GetAtt' intrinsic function to retrieve the NAT gateway ID and pass it to the route.. The `Fn::GetAtt` intrinsic function can retrieve the NAT gateway ID (e.g., `Fn::GetAtt: [NatGateway, NatGatewayId]`) and pass it as the `GatewayId` property of an `AWS::EC2::Route` resource. This ensures that when the NAT gateway is replaced (e.g., due to an update or failure), the route automatically updates to reference the new NAT gateway ID, maintaining connectivity for private subnets without manual intervention.

Answer

Use the 'DependsOn' attribute to ensure the route is created after the NAT gateway.

Answer

Use the 'AWS::EC2::Route' resource with a 'GatewayId' property that references the NAT gateway using 'Ref'.

Answer

Use an AWS Lambda custom resource to update the route table when the NAT gateway changes.

Question 9

A company has a VPC with a public subnet and a private subnet. The private subnet hosts Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which TWO actions should be taken?

Accepted Answer

Remove the route to an internet gateway from the private subnet's route table.. Option C is correct because a subnet is only considered private when its route table has no route to an Internet Gateway (0.0.0.0/0 → igw-xxxx); removing that route ensures traffic cannot be routed to or from the internet, which is the defining characteristic of a private subnet. Option D is correct because RDS instances placed in a private subnet without a public IP address cannot be reached directly from the internet, and this is the standard AWS recommendation for isolating database instances. Option A is not among the marked correct answers, and while disabling 'Publicly accessible' is good practice, it alone does not guarantee isolation if the subnet still has an IGW route. Option B is incorrect because a network ACL denying all inbound 0.0.0.0/0 would also block legitimate internal traffic and is not the recommended mechanism for this scenario. Option E is incorrect because security groups are stateful allow-lists and cannot be configured with explicit deny rules.

Answer

Disable the 'Publicly accessible' option for the RDS instances.

Answer

Create a network ACL that denies all inbound traffic from 0.0.0.0/0.

Answer

Configure the security group for the RDS instances to deny all inbound traffic.

Question 10

A company is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect. The company wants to ensure high availability and avoid a single point of failure. The on-premises router connects to two separate AWS Direct Connect locations. Which configuration should be used to meet these requirements?

Accepted Answer

Create two Direct Connect connections, each with a private VIF, and connect them to a Direct Connect gateway that is associated with a Transit VPC.. It uses two separate Direct Connect connections, each with a private VIF, both attached to a Direct Connect gateway. This eliminates a single point of failure at the connection level and, when combined with a Transit VPC, provides redundant, highly available connectivity from the on-premises data center to multiple VPCs. The Direct Connect gateway aggregates the private VIFs and allows traffic to be forwarded to the Transit VPC, which then routes to the attached VPCs, ensuring no single component failure disrupts the hybrid network.

Answer

Create two private VIFs on the same Direct Connect connection and connect each to a different VPC.

Answer

Create a single private virtual interface (VIF) on one Direct Connect connection and connect it to a single VPC.

Answer

Create a Direct Connect gateway and attach a single private VIF from one connection.

Question 11

A company is designing a network for a three-tier web application in AWS. The web tier must be accessible from the internet, but the application and database tiers must be private. The company wants to use a single AWS Region and ensure high availability across multiple Availability Zones. What is the MOST cost-effective network design that meets these requirements?

Accepted Answer

Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use a NAT Gateway in each AZ for outbound traffic.. It places web servers in public subnets across three Availability Zones (AZs) for internet-facing access and high availability, while application and database servers reside in private subnets across three AZs for isolation. A NAT Gateway in each AZ provides cost-effective outbound internet connectivity for private instances without exposing them to inbound traffic, and using one NAT Gateway per AZ avoids cross-AZ data transfer charges, which would increase costs if a single NAT Gateway were shared across AZs.

Answer

Place web servers in public subnets across three AZs. Place application and database servers in private subnets across three AZs. Use NAT instances in each AZ behind an Auto Scaling group.

Answer

Place web servers in public subnets and application/database servers in private subnets in one AZ. Use a single NAT Gateway in the public subnet for outbound traffic.

Answer

Place all tiers in public subnets and use security groups to restrict inbound traffic to the web tier only.

Question 12

A company has a VPC with multiple subnets. They have an Amazon RDS for MySQL database in a private subnet. The application team needs to access the database for maintenance from a bastion host in a public subnet. The security group for the database allows inbound traffic from the security group of the bastion host on port 3306. However, the application team cannot connect. What is the most likely cause?

Accepted Answer

The network ACL on the private subnet is blocking inbound traffic on port 3306.. The most likely cause is that the network ACL (NACL) on the private subnet is blocking inbound traffic on port 3306. Even though the security group on the RDS instance allows traffic from the bastion host's security group, NACLs are stateless and must explicitly allow both inbound and outbound traffic. By default, custom NACLs deny all inbound traffic, so unless an inbound rule for port 3306 (MySQL) is added, the connection will be dropped at the subnet boundary.

Answer

The database does not have a route to the internet.

Answer

The security group rule for the database is incorrectly configured.

Answer

The bastion host does not have a route to the database subnet.

Question 13

A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). An EC2 instance in subnet A needs to communicate with an RDS database in subnet B. Both subnets have network ACLs that allow all inbound and outbound traffic. However, the instance cannot connect to the database. Which TWO configuration changes could solve this issue? (Choose TWO.)

Accepted Answer

Ensure that the route tables associated with both subnets have a local route for the VPC CIDR.. Option B is correct because communication between subnets within the same VPC relies on the route table's local route for the VPC CIDR (10.0.0.0/16); if that local route is missing or the subnets are associated with a custom route table that lacks it, traffic between subnet A and subnet B will fail. Option D is correct because RDS security groups act as stateful virtual firewalls, and the database's security group must explicitly allow inbound traffic on the database port (3306 for MySQL/Aurora) from the EC2 instance's security group; even with NACLs allowing all traffic, a restrictive security group will block the connection. Option A is not needed because an Internet Gateway only enables internet connectivity, not intra-VPC subnet-to-subnet traffic. Option C is not needed because VPC peering connects separate VPCs, whereas both subnets are already in the same VPC. Option E is not needed because a NAT Gateway provides outbound internet access for private subnets, not internal VPC communication.

Answer

Attach an Internet Gateway to the VPC.

Answer

Create a VPC peering connection between the subnets.

Answer

Add a NAT Gateway in a public subnet and route traffic through it.

Question 14

A company has a multi-VPC architecture with VPCs in the same region. They need to ensure that traffic between VPCs never traverses the public internet and is encrypted in transit. Which solution meets these requirements with the lowest operational overhead?

Accepted Answer

Use AWS PrivateLink to connect VPCs via Network Load Balancers.. AWS PrivateLink allows you to connect VPCs privately using VPC endpoints and Network Load Balancers. Traffic stays within the AWS network and never traverses the public internet. When the application uses TLS/HTTPS, the traffic is encrypted end-to-end. This solution has low operational overhead because PrivateLink is fully managed and requires no VPN tunnels or third-party appliances.

Answer

Use AWS Transit Gateway with IPsec VPN attachments between VPCs.

Answer

Use VPC peering connections between all VPCs.

Answer

Use AWS Transit Gateway with VPC attachments and enable multicast.

Question 15

A company is designing a multi-region active-active application. They need to ensure that traffic is routed to the closest healthy region and that failover happens automatically. Which TWO services should be used together to achieve this?

Accepted Answer

AWS Global Accelerator with endpoint groups. AWS Global Accelerator (C) uses Anycast IPs to direct traffic to the closest healthy endpoint group, automatically rerouting traffic if a region becomes unhealthy. This provides fast regional failover and low-latency routing without DNS caching delays, making it ideal for active-active multi-region applications.

Answer

AWS Transit Gateway with inter-region peering

Answer

Amazon CloudFront with multiple origins

Answer

AWS Direct Connect with multiple locations