ANS-C01 Network Design Practice Test 6 — 15 Questions

Question 1

A company is designing a multi-Region Active-Active architecture using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application requires sticky sessions (session affinity) and must maintain session persistence even during failover. Which configuration should be used to achieve this?

Accepted Answer

Use a custom application cookie for stickiness that is consistent across all ALBs, and set the cookie domain to the Global Accelerator DNS name.. Option D is correct because AWS Global Accelerator does not natively support session affinity (sticky sessions). To maintain session persistence across multi-Region ALBs during failover, you must use a custom application cookie that is consistent across all ALBs and set the cookie domain to the Global Accelerator DNS name. This ensures the client's browser sends the same cookie to any healthy ALB in any Region, preserving the session even when traffic shifts due to a failover.

Answer

Enable stickiness on each ALB individually and use a single Regional endpoint group.

Answer

Configure Global Accelerator to use session affinity with the 'two-tuple' protocol.

Answer

Configure Route 53 with latency-based routing and enable stickiness on each ALB.

Question 2

A company is migrating a legacy on-premises application to AWS. The application uses a large number of short-lived TCP connections and requires low latency. The network team is considering using either a Network Load Balancer (NLB) or a Gateway Load Balancer (GWLB). Which of the following is a key advantage of using NLB over GWLB for this use case?

Accepted Answer

NLB preserves the client source IP, while GWLB does not by default.. For an application using a large number of short-lived TCP connections requiring low latency, NLB is the optimal choice because it operates at Layer 4 and preserves the client source IP address by default, which is critical for applications that need to log or process the original client IP. GWLB, by design, uses GENEVE encapsulation (UDP port 6081) to tunnel traffic to backend appliances, which replaces the client source IP with the NLB's private IP unless explicit configuration (e.g., proxy protocol) is used. This makes NLB the better fit for preserving source IP without additional overhead.

Answer

NLB can forward traffic to third-party virtual appliances.

Answer

NLB can handle higher throughput than GWLB.

Answer

NLB supports TLS termination, while GWLB does not.

Question 3

A company has a VPC with public and private subnets. The private subnets need outbound internet access for software updates. Which design will meet this requirement most securely?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route to it from the private subnets.. A NAT Gateway deployed in a public subnet with an Elastic IP allows private subnet instances to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway, which then forwards traffic to the Internet Gateway (IGW) in the public subnet. This design is the most secure because it avoids exposing private instances directly to the internet and uses a managed, highly available service.

Answer

Add a default route to the IGW from the private subnet route table.

Answer

Place the instances in a public subnet with a route to an Internet Gateway (IGW).

Answer

Deploy a NAT instance in a private subnet and configure routes to it.

Question 4

A company is connecting its on-premises data center to AWS using AWS Direct Connect. The company has two Direct Connect connections and wants to ensure high availability. The on-premises network uses BGP to advertise routes to AWS. Which combination of steps should be taken to achieve the most resilient design? (Choose TWO.)

Accepted Answer

Provision two private virtual interfaces, one over each Direct Connect connection.. Option B is correct because provisioning two private virtual interfaces, one over each Direct Connect connection, ensures that if one connection or virtual interface fails, BGP can continue to route traffic over the other. This design provides redundancy at both the physical layer (connections) and the logical layer (virtual interfaces), which is essential for high availability.

Answer

Provision a single private virtual interface and use both connections for link aggregation.

Answer

Configure static routes instead of BGP to simplify the design.

Answer

Use the same BGP ASN for both connections.

Question 5

A company has a VPC with multiple subnets across two Availability Zones. They are designing a highly available web application using an Application Load Balancer (ALB) and EC2 instances in an Auto Scaling group. Which of the following is the most resilient and cost-effective design for the network layer?

Accepted Answer

Deploy a single ALB with subnets in two AZs and enable cross-zone load balancing.. Option C is correct because deploying a single Application Load Balancer (ALB) with subnets in two Availability Zones (AZs) and enabling cross-zone load balancing provides high availability and fault tolerance at the network layer. The ALB automatically distributes incoming traffic across healthy targets in all enabled AZs, eliminating the need for multiple load balancers and reducing costs while maintaining resilience. This design leverages the ALB's native ability to handle AZ failures by routing traffic only to healthy AZs, making it both resilient and cost-effective.

Answer

Deploy a Network Load Balancer (NLB) in each AZ and associate them with a single ALB.

Answer

Deploy an ALB in one AZ and EC2 instances in the same AZ.

Answer

Deploy an ALB in each AZ and use Route 53 weighted routing.

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs in different regions is encrypted. Which solution should be used?

Accepted Answer

Use AWS Transit Gateway inter-region peering with a VPN attachment between the transit gateways.. Option B is correct because AWS Transit Gateway inter-region peering provides encrypted transit between VPCs in different regions by establishing a VPN attachment between the transit gateways. This leverages IPsec VPN tunnels to encrypt traffic as it traverses the AWS global network, meeting the requirement for cross-region encryption without routing through on-premises infrastructure.

Answer

Use a Site-to-Site VPN from each VPC to the on-premises network and route traffic through the corporate network.

Answer

Use VPC Peering connections between the VPCs, which encrypts traffic automatically.

Answer

Use AWS PrivateLink to connect the VPCs across regions.

Question 7

A company is designing a network for a real-time gaming application that requires the lowest possible latency across AWS Regions. The application uses UDP traffic. Which AWS service should be used to optimize traffic routing?

Accepted Answer

AWS Global Accelerator.. AWS Global Accelerator uses the Anycast IP address concept to route UDP traffic over the AWS global network, minimizing latency by directing traffic to the nearest healthy endpoint. It is specifically designed for real-time applications like gaming that require low latency and jitter, and it supports UDP traffic natively.

Answer

AWS Direct Connect with multiple connections.

Answer

Amazon Route 53 with latency-based routing.

Answer

Amazon CloudFront with custom origins.

Question 8

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add IPv6 connectivity to the VPC and allow resources in a private subnet to access the internet via IPv6. Which design should be used?

Accepted Answer

Allocate an IPv6 CIDR block, create an egress-only Internet Gateway, and add a route to it from the private subnet.. An egress-only Internet Gateway (EIGW) is the correct AWS-managed service for enabling outbound-only IPv6 traffic from a VPC's private subnet to the internet, while preventing any unsolicited inbound connections. Unlike an Internet Gateway (IGW), which allows bidirectional traffic, an EIGW is specifically designed for IPv6 and ensures that resources in private subnets can initiate outbound connections without being directly reachable from the internet.

Answer

Allocate an IPv6 CIDR block and add a route to an Internet Gateway from the private subnet.

Answer

Use a NAT instance with IPv6 support in a public subnet.

Answer

Allocate an IPv6 CIDR block and use a NAT Gateway for IPv6 traffic.

Question 9

A company is designing a hybrid network using AWS Direct Connect and AWS Site-to-Site VPN as backup. They want to ensure that traffic from on-premises to AWS uses Direct Connect when available and fails over to VPN automatically. Which BGP configuration should be used?

Accepted Answer

Prepend AS path on the VPN connection to make it less preferred.. Option B is correct because prepending the AS path on the VPN connection increases the AS path length, making the VPN route less preferred compared to the Direct Connect route. BGP selects the path with the shortest AS path length by default, so the Direct Connect path will be chosen as the primary path. When Direct Connect fails, the VPN route becomes the only available path and traffic automatically fails over.

Answer

Set a higher BGP local preference on the VPN connection.

Answer

Use the same BGP attributes for both connections and let ECMP handle load balancing.

Answer

Set a higher Multi-Exit Discriminator (MED) on the Direct Connect connection.

Question 10

A company has multiple VPCs that need to communicate with each other and with an on-premises network. They want to minimize operational overhead and avoid peering mesh complexity. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway.. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks using a single gateway, eliminating the need for a full mesh of VPC peering connections. It simplifies network management by providing transitive routing between all attached networks, which directly addresses the requirement to minimize operational overhead and avoid peering mesh complexity.

Answer

AWS PrivateLink.

Answer

AWS VPN CloudHub.

Answer

VPC Peering.

Question 11

A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to establish a central inspection VPC for traffic inspection using a Gateway Load Balancer (GWLB). Traffic from all other VPCs should be routed through the inspection VPC before reaching the internet or on-premises. Which architecture should be used?

Accepted Answer

Use AWS Transit Gateway with a centralized inspection VPC that hosts a GWLB. Configure route tables on the Transit Gateway to send traffic to the GWLB endpoint.. Option C is correct because AWS Transit Gateway enables centralized routing between multiple VPCs, and when combined with a Gateway Load Balancer (GWLB) in an inspection VPC, it allows traffic from all other VPCs to be forwarded to the GWLB for inspection before reaching the internet or on-premises. Transit Gateway route tables can be configured with static routes pointing to the GWLB endpoint (using Gateway Load Balancer Endpoint service), ensuring all inter-VPC and egress traffic is steered through the inspection VPC. This architecture scales efficiently across many VPCs in an AWS Organizations multi-account setup without requiring complex peering or direct connections.

Answer

Use VPC Peering to connect all VPCs to the inspection VPC and configure routes to the GWLB.

Answer

Use AWS Direct Connect Gateway to connect all VPCs and route traffic through the inspection VPC.

Answer

Use AWS Network Firewall in each VPC and route traffic to it.

Question 12

A company wants to monitor network traffic in their VPC for troubleshooting and security analysis. They need to capture IP traffic information, including source/destination IPs, ports, and protocol, but not the packet payload. Which AWS service should be used?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture metadata about IP traffic in a VPC, including source/destination IPs, ports, protocol, and packet counts, but never the payload. This meets the requirement for troubleshooting and security analysis without the overhead or privacy concerns of full packet capture.

Answer

Amazon CloudWatch Logs.

Answer

AWS Network Firewall.

Answer

AWS Traffic Mirroring.

Question 13

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to access an S3 bucket. Which configuration provides the most secure and efficient access without traversing the internet?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and associate it with the private subnet route table.. Option C is correct because a VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 directly over the AWS network without traversing the internet, using a route table entry that targets the endpoint's prefix list. This provides the most secure and efficient access by keeping traffic within the AWS backbone, avoiding NAT Gateway costs and internet exposure.

Answer

Establish a VPN connection to on-premises and route to S3 from there.

Answer

Use a NAT Gateway in the public subnet to route traffic to S3.

Answer

Configure a proxy server in the public subnet.

Question 14

A company is designing a multi-Region Active-Active architecture with an Application Load Balancer (ALB) in us-east-1 and us-west-2. They want to route users to the nearest healthy endpoint using a custom domain name. Which AWS service should they use to accomplish this with the lowest latency and minimal operational overhead?

Accepted Answer

Use Amazon Route 53 latency-based routing with health checks.. Amazon Route 53 latency-based routing directs user traffic to the AWS region that provides the lowest latency for the end user, based on latency measurements between DNS resolvers and AWS endpoints. Combined with health checks, it automatically routes users away from unhealthy ALBs, meeting the requirement for nearest healthy endpoint with minimal operational overhead since it is a fully managed DNS service with no additional infrastructure to deploy.

Answer

Use Amazon Route 53 geolocation routing policy.

Answer

Use AWS Global Accelerator with endpoint groups in each region.

Answer

Use Amazon Route 53 weighted routing policy.

Question 15

A company is deploying a VPC with a public and private subnet in each of three Availability Zones. They need to provide internet access to instances in the private subnets while ensuring that all outbound traffic is logged and that traffic to a particular on-premises CIDR (10.0.0.0/8) is routed via an AWS Direct Connect Virtual Private Gateway. The company has a VPN connection as a backup. Which design should they use?

Accepted Answer

Create a centralized egress VPC with NAT Gateways in each AZ. Peer the application VPCs to the egress VPC. Configure route tables in the application VPCs to send 0.0.0.0/0 to the egress VPC and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.. Option A is correct because it uses a centralized egress VPC with NAT Gateways in each AZ to provide internet access to private subnets while logging all outbound traffic. By peering the application VPCs to the egress VPC, the route tables can direct 0.0.0.0/0 traffic to the egress VPC for NAT, and 10.0.0.0/8 traffic to the Direct Connect Virtual Private Gateway, ensuring on-premises traffic uses the dedicated connection with VPN backup. This design meets all requirements: internet access, logging, and specific routing for on-premises CIDR.

Answer

Place a NAT Gateway in each AZ in the application VPC. Configure route tables to send 0.0.0.0/0 to the NAT Gateway. Use a VPN connection for on-premises traffic.

Answer

Use a Transit Gateway to connect all VPCs and on-premises. Attach a NAT Gateway in one AZ to the Transit Gateway. Configure route tables to send 0.0.0.0/0 to the NAT Gateway and 10.0.0.0/8 to the Direct Connect Virtual Private Gateway.

Answer

Create a NAT instance in each private subnet and configure each instance's route table to send 0.0.0.0/0 to the NAT instance. For on-premises traffic, use a VPC peering connection to an on-premises network.