ANS-C01 Network Design Practice Test 6 — 15 Questions

Question 1

A company wants to monitor network traffic between two VPCs that are peered. Which AWS feature can capture IP traffic information for analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between peered VPCs. They log metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions, which can be published to CloudWatch Logs or Amazon S3 for analysis. This makes them the correct choice for monitoring network traffic between two peered VPCs.

Answer

AWS X-Ray

Answer

AWS Config

Answer

AWS CloudTrail

Question 2

A company has a VPC with multiple subnets. The security team requires that all outbound traffic from the VPC to the internet goes through a centralized firewall. Which design should be used?

Accepted Answer

Route all internet traffic through a centralized inspection VPC using Transit Gateway.. It uses a Transit Gateway to route all outbound internet traffic from the VPC to a centralized inspection VPC, where a firewall (e.g., AWS Network Firewall or a third-party appliance) inspects and forwards traffic to an Internet Gateway. This design meets the security requirement by enforcing a single egress point, ensuring all traffic is inspected before reaching the internet.

Answer

Attach an Internet Gateway to each VPC.

Answer

Use AWS Site-to-Site VPN to a third-party firewall.

Answer

Use VPC Endpoints for all services.

Question 3

Which TWO options are valid methods to connect multiple VPCs together in a hub-and-spoke topology? (Select TWO.)

Accepted Answer

VPC peering. VPC peering (A) is a valid method because it establishes a direct, one-to-one network connection between two VPCs using the AWS global backbone, enabling private IPv4 or IPv6 communication without gateways or VPNs. AWS Transit Gateway (E) is valid because it acts as a central hub that connects multiple VPCs and on-premises networks through a single, scalable gateway, simplifying the hub-and-spoke topology management.

Answer

AWS Direct Connect

Answer

VPC Endpoints

Answer

AWS Site-to-Site VPN

Question 4

Which THREE are benefits of using AWS Transit Gateway over VPC peering in a multi-VPC environment? (Select THREE.)

Accepted Answer

Centralized management of network policies. AWS Transit Gateway offers a hub-and-spoke architecture that provides three key benefits over VPC peering: (1) the ability to attach VPN connections and Direct Connect virtual interfaces, enabling hybrid connectivity; (2) centralized management of network policies such as routing, security, and access controls from a single point; and (3) transitive routing between all attached VPCs, eliminating the need for full mesh peering.

Answer

Higher bandwidth per connection

Answer

Simpler configuration for a few VPCs

Answer

Lower cost compared to VPC peering

Question 5

Which TWO AWS services can be used to provide inbound internet connectivity to resources in a VPC? (Select TWO.)

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that provides a target in VPC route tables for internet-routable traffic and performs network address translation (NAT) for instances with public IPs. It enables inbound internet connectivity by allowing traffic from the internet to reach resources in the VPC, provided the resources have public IPs and the route table directs 0.0.0.0/0 traffic to the IGW.

Answer

VPC Endpoint

Answer

Amazon CloudFront

Answer

NAT Gateway

Question 6

A network engineer configured VPC Flow Logs for a subnet to capture all traffic. After reviewing the logs in CloudWatch Logs, they notice that some logs show 'NODATA' for the log-status field. What does 'NODATA' indicate?

Accepted Answer

No network traffic was observed for the given capture period.. When VPC Flow Logs display 'NODATA' for the log-status field, it indicates that no network traffic was observed for the subnet during the aggregation interval (typically 10 minutes). This is a normal status meaning the capture window had zero packets flowing through the monitored interfaces, not an error or delivery issue.

Answer

The flow log record was skipped due to an internal error.

Answer

The log record was successfully delivered to CloudWatch.

Answer

The traffic was rejected by a network ACL or security group.

Question 7

An IAM policy is attached to a user who needs to manage VPC peering connections. The policy allows creating and accepting peering connections, but the user reports they cannot add routes to the route table of their VPC (vpc-11111111) for the peered connection. What is the most likely cause?

Accepted Answer

The condition in the policy restricts the VPC, but the route table is not associated with that VPC.. The IAM policy includes a condition that restricts the VPC (e.g., `ec2:Vpc` condition key set to `vpc-11111111`), but the route table the user is trying to modify is not associated with that VPC. Even though the user has permissions to create and accept peering connections, the condition on the route table modification action (like `ec2:CreateRoute`) limits the operation to route tables belonging to the specified VPC. Since the route table belongs to a different VPC or is not associated with `vpc-11111111`, the request fails.

Answer

The user does not have permission to create routes.

Answer

The user needs additional permissions for the peering connection.

Answer

The user needs to accept the peering connection first.

Question 8

A network administrator is troubleshooting connectivity to a web server in subnet with network ACL 'acl-12345678'. The web server is on port 443. The administrator finds that traffic from IP 10.0.1.5 is being denied. Why is the traffic being denied?

Accepted Answer

The network ACL rule 100 denies traffic from 10.0.0.0/8, which includes the IP 10.0.1.5.. Network ACLs are stateless and evaluated in ascending order by rule number. Rule 100 denies traffic from 10.0.0.0/8, which includes the source IP 10.0.1.5, so any traffic from that IP is denied regardless of later allow rules. Since network ACLs do not track connection state, the deny is applied immediately upon matching rule 100.

Answer

The subnet is not associated with this network ACL.

Answer

The security group attached to the web server is blocking the traffic.

Answer

The network ACL rule 100 allows traffic from 0.0.0.0/0, but rule 200 denies traffic from 10.0.0.0/8, and rule 200 is evaluated first.

Question 9

A company is designing a multi-region architecture with an Application Load Balancer (ALB) in us-east-1 and a Network Load Balancer (NLB) in eu-west-1. They need to route traffic from the ALB to the NLB using a fixed IP address. Which AWS service should be used to provide a static IP for the NLB and enable cross-region load balancing?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator provides two static anycast IP addresses that serve as a fixed entry point for traffic. It can route traffic from the ALB in us-east-1 to the NLB in eu-west-1 by using an endpoint group that includes the NLB's IP address, enabling cross-region load balancing with a static IP. This allows the ALB to forward traffic to the Global Accelerator's static IP, which then optimally routes to the NLB in the other region.

Answer

AWS WAF

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Question 10

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has an internet gateway attached to the VPC and a NAT gateway in a public subnet. Which route table configuration is required for the private subnets to access the internet?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the NAT gateway.. Private subnets require a default route (0.0.0.0/0) pointing to the NAT gateway to enable outbound internet access while preventing inbound traffic from the internet. The NAT gateway, residing in a public subnet with an associated Elastic IP, translates private IP addresses to the Elastic IP for internet-bound traffic. The internet gateway is used by public subnets, not private subnets, for direct internet access.

Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway.

Answer

Add a route in the public subnet route table with destination 0.0.0.0/0 and target the NAT gateway.

Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 and target the internet gateway, and associate an Elastic IP with the NAT gateway.

Question 11

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to peer with another VPC with CIDR 10.0.0.0/16. They plan to use a transit gateway to connect the VPCs. What is the correct approach to handle the overlapping CIDR ranges?

Accepted Answer

Create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs.. Transit gateways do not perform NAT or resolve overlapping CIDR conflicts between attached VPCs. When two VPCs have identical CIDR blocks (10.0.0.0/16), the transit gateway cannot route traffic correctly because it cannot distinguish between the two networks. The only viable solution is to create a new VPC with a non-overlapping CIDR and migrate resources from one of the existing VPCs, eliminating the conflict at the network layer.

Answer

Create a VPC peering connection and use a smaller subnet CIDR for traffic filtering.

Answer

Use a transit gateway with network address translation (NAT) to translate one VPC CIDR to a non-overlapping range.

Answer

Configure the transit gateway with equal-cost multipath (ECMP) to load balance traffic between the overlapping CIDRs.

Question 12

A company wants to provide internet access to instances in a private subnet using a NAT gateway. The NAT gateway is deployed in a public subnet with an Elastic IP. The private subnet route table has a default route pointing to the NAT gateway. However, instances in the private subnet cannot access the internet. What is the most likely cause?

Accepted Answer

The public subnet route table does not have a route to the internet gateway.. The NAT gateway is deployed in a public subnet, but for it to route traffic to the internet, the public subnet's route table must have a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, even though the private subnet's route table correctly points to the NAT gateway. This is the most likely cause because the NAT gateway itself needs internet access via the IGW to translate and forward traffic.

Answer

The security group assigned to the NAT gateway blocks outbound traffic.

Answer

The private subnet route table has a route to the internet gateway instead of the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP associated.

Question 13

A company uses AWS Direct Connect to connect its on-premises network to a VPC. They have a private VIF attached to a virtual private gateway. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures automatic failover?

Accepted Answer

Use BGP on both the Direct Connect private VIF and the VPN connection, and advertise the same prefixes with a longer AS path for the VPN.. Using BGP on both the Direct Connect private VIF and the VPN connection allows you to manipulate route selection via AS path prepending. By advertising the same prefixes with a longer AS path on the VPN, the Direct Connect path is preferred, and if it fails, BGP withdraws the routes, causing traffic to automatically fail over to the VPN.

Answer

Attach the VPN connection to a separate virtual private gateway and use a transit gateway to combine them.

Answer

Use static routes on the Direct Connect private VIF and BGP on the VPN connection.

Answer

Create a second Direct Connect connection and use equal-cost multipath (ECMP) between the two.

Question 14

A company is designing a network for a multi-account architecture using AWS Resource Access Manager (RAM) to share VPC subnets across accounts. They want to ensure that instances in shared subnets can communicate with instances in the owner's VPC using private IP addresses. What is required?

Accepted Answer

No additional networking configuration is required; the shared subnet is part of the same VPC.. When you share a subnet using AWS Resource Access Manager (RAM), the shared subnet is part of the owner's VPC. Instances launched into that shared subnet reside in the same VPC as the owner's instances, so they can communicate using private IP addresses by default, with no additional networking configuration required. This is because VPC subnets are a logical subdivision of the VPC's CIDR block, and all instances within the same VPC can route to each other via the VPC's internal router.

Answer

Establish a VPC peering connection between the owner and participant accounts.

Answer

Configure a VPC endpoint for Amazon EC2 to allow cross-account private communication.

Answer

Create a transit gateway and attach both VPCs to it.

Question 15

A company has an application that requires fixed IP addresses for whitelisting by third-party partners. The application is hosted on an Application Load Balancer (ALB) in a VPC. Which solution provides static IP addresses for the ALB?

Accepted Answer

Place an AWS Global Accelerator in front of the ALB.. AWS Global Accelerator provides two static IP addresses that act as fixed entry points for traffic. By placing it in front of an Application Load Balancer (ALB), you can whitelist these static IPs with third-party partners while the ALB itself remains dynamic. Global Accelerator uses the AWS global network to route traffic to the ALB, preserving the ALB's native HTTP/HTTPS features.

Answer

Use Amazon CloudFront with the ALB as origin.

Answer

Assign an Elastic IP to the ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB).