ANS-C01 Network Design Practice Test 6 — 15 Questions

Question 1

A company has a VPC with public and private subnets. They want to implement a bastion host to allow secure SSH access to instances in private subnets. Which TWO components are required for this design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A bastion host deployed in a public subnet. Option A is correct because the bastion host must reside in a public subnet so it can have a route to the Internet Gateway and be reachable from the internet via SSH (port 22) for administrators. Option D is correct because the private instances' security groups must explicitly allow inbound SSH (TCP 22) from the bastion host's security group or private IP, since security groups are stateful and deny all inbound traffic by default. While an Internet Gateway (Option C) is needed for the public subnet to reach the internet, it is not one of the two components that specifically enable the bastion-to-private-instance SSH path, and the question asks for the bastion design components. Option B (NAT gateway) is unnecessary because NAT gateways only allow outbound-initiated traffic from private subnets and cannot accept inbound SSH connections. Option E (Site-to-Site VPN) is not required since the design uses SSH over the internet through the bastion, not a dedicated VPN tunnel.

Answer

A NAT gateway in the public subnet

Answer

An Internet Gateway attached to the VPC

Answer

A Site-to-Site VPN connection to the VPC

Question 2

A company is designing a hybrid network architecture that connects an on-premises data center to AWS via AWS Direct Connect. The on-premises network uses BGP to advertise routes to AWS. The company wants to ensure that the on-premises network can reach all VPCs in the AWS account using a single Direct Connect virtual interface. Which solution should the architect use?

Accepted Answer

Create a transit gateway and a Direct Connect gateway. Attach the VPCs to the transit gateway and associate the transit gateway with the Direct Connect gateway.. A transit gateway acts as a central hub for VPC-to-VPC and on-premises connectivity, and when associated with a Direct Connect gateway via a transit virtual interface, it allows a single Direct Connect connection to reach multiple VPCs. The Direct Connect gateway terminates the BGP session from on-premises and forwards traffic to the transit gateway, which then routes to the attached VPCs. This design scales to many VPCs without requiring multiple virtual interfaces or complex peering.

Answer

Create a Direct Connect gateway and associate all VPCs directly.

Answer

Create VPC peering connections between all VPCs and the on-premises network.

Answer

Create a virtual private gateway and attach all VPCs to it.

Question 3

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. The application must have the lowest possible latency for global users. Which design meets these requirements?

Accepted Answer

Use AWS Global Accelerator with endpoints in both regions and configure traffic dials to distribute traffic.. AWS Global Accelerator uses the Anycast static IP addresses to route traffic over the AWS global network to the optimal endpoint based on health, latency, and traffic dials. By configuring endpoints in both regions with traffic dials, you can distribute traffic actively across both regions, ensuring the lowest possible latency for global users by directing them to the nearest healthy endpoint.

Answer

Use Amazon CloudFront with multiple origins pointing to each ALB.

Answer

Use Amazon Route 53 with latency routing policy to route users to the closest ALB.

Answer

Use AWS Global Accelerator with a single endpoint in one region and failover to the other region.

Question 4

A company is designing a network for a three-tier web application. The web tier must be able to scale out and in automatically based on CPU utilization. The database tier must be highly available and use Multi-AZ deployment. Which combination of AWS services should the architect use?

Accepted Answer

Application Load Balancer, Auto Scaling group, Amazon RDS Multi-AZ. An Application Load Balancer (ALB) operates at Layer 7, which is ideal for distributing HTTP/HTTPS traffic to a web tier that scales out and in automatically via an Auto Scaling group based on CPU utilization. Amazon RDS Multi-AZ provides synchronous standby replication across Availability Zones, ensuring high availability for the database tier by automatically failing over to the standby in case of an outage.

Answer

Network Load Balancer, Auto Scaling group, Amazon RDS Multi-AZ

Answer

Application Load Balancer, Auto Scaling group, Amazon DynamoDB

Answer

Classic Load Balancer, Auto Scaling group, Amazon RDS Single-AZ

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to add a secondary CIDR block for additional subnets. Which CIDR block can be used?

Accepted Answer

10.1.0.0/16. Options A (10.1.0.0/16), B (172.16.0.0/16), and C (192.168.0.0/16) are all valid secondary CIDR blocks for a VPC with a primary CIDR of 10.0.0.0/16. They are all RFC 1918 private IP ranges that do not overlap with the primary CIDR. AWS allows adding any non-overlapping private CIDR block as a secondary, regardless of whether it belongs to the same /8 range. Option D (10.0.0.0/16) is invalid because it overlaps exactly with the primary CIDR. Note: This question has multiple correct answers; you must select all that apply.

Answer

10.0.0.0/16

Question 6

A company is designing a network for a real-time gaming application that requires low latency and high throughput between game servers in multiple regions. The application uses UDP traffic. Which AWS service should be used to route traffic between regions?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the Anycast IP address and the AWS global network to route UDP traffic from users to the optimal regional endpoint, minimizing latency and jitter. It is designed for real-time applications like gaming that require low-latency and high-throughput UDP traffic between regions, as it bypasses the public internet and leverages AWS's internal backbone.

Answer

AWS Transit Gateway

Answer

Amazon CloudFront

Answer

Amazon Route 53

Question 7

Which THREE of the following are benefits of using AWS Global Accelerator over Amazon CloudFront for a global application that uses TCP traffic? (Select THREE.)

Accepted Answer

Provides static IP addresses that act as a fixed entry point.. Option B is correct because AWS Global Accelerator provisions two static Anycast IPv4 addresses (and optionally IPv6) that serve as a fixed entry point, so clients always connect to the same IPs even if you change or scale the backend endpoints. Option C is correct because Global Accelerator operates at Layer 4 and supports both TCP and UDP traffic, whereas CloudFront is primarily an HTTP/HTTPS (Layer 7) content delivery service. Option D is correct because Global Accelerator endpoint groups can target Application Load Balancers, Network Load Balancers, EC2 instances, or Elastic IP addresses, allowing TCP traffic to be routed to an ALB. Option A is not a benefit of Global Accelerator because content caching at edge locations is a CloudFront feature, not a Global Accelerator capability. Option E is not correct because automatic integration with AWS WAF and AWS Shield Advanced is associated with CloudFront, while Global Accelerator only provides built-in DDoS protection via AWS Shield Standard.

Answer

Provides content caching at edge locations.

Answer

Automatically integrates with AWS WAF and AWS Shield Advanced.

Question 8

Which TWO of the following are required to establish an AWS Site-to-Site VPN connection? (Select TWO.)

Accepted Answer

Virtual private gateway. A virtual private gateway (VGW) is required as the AWS-side endpoint for the VPN tunnel; it anchors the encrypted IPsec session and routes traffic from the VPC to the on-premises network. The customer gateway (CGW) represents the on-premises VPN device in AWS, providing the public IP and BGP ASN (for dynamic routing) or static route configuration needed to establish the tunnel. Both are mandatory components of an AWS Site-to-Site VPN connection.

Answer

Direct Connect gateway

Answer

Transit gateway

Answer

VPN connection

Question 9

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs in different AWS Regions is encrypted. Which solution should they use?

Accepted Answer

Transit Gateway inter-Region peering. Transit Gateway inter-Region peering is the correct solution because it provides encrypted traffic between VPCs in different AWS Regions natively, using the AWS global network infrastructure with automatic encryption at the transport layer. This feature supports transitive routing and does not require additional VPN tunnels or third-party appliances, making it the most efficient and scalable option for multi-region VPC connectivity.

Answer

Direct Connect gateway with VIFs

Answer

Transit Gateway VPN attachments

Answer

VPC peering with VPN encryption

Question 10

A financial services company must meet PCI DSS compliance requirements. They have a VPC with public and private subnets. The web servers in the public subnets must only accept traffic from the internet on ports 80 and 443. The application servers in the private subnets must only accept traffic from the web servers. Which network design ensures least-privilege access?

Accepted Answer

Use a Network ACL on the public subnet allowing inbound ports 80 and 443 from 0.0.0.0/0, and security groups on web and app servers with the app servers' security group referencing the web servers' security group. It uses security groups for stateful, least-privilege access control. The web servers' security group allows inbound ports 80 and 443 from 0.0.0.0/0, and the app servers' security group references the web servers' security group as the source, ensuring only traffic from the web servers is permitted. This design leverages security group chaining, which automatically handles return traffic and avoids the need for explicit CIDR management, aligning with PCI DSS least-privilege requirements.

Answer

Use security groups on web servers allowing 0.0.0.0/0 on ports 80/443, and on app servers allowing the web servers' CIDR block

Answer

Use a single Network ACL for both public and private subnets with allow rules for ports 80 and 443

Answer

Use a single Network ACL on the private subnet allowing inbound ports 80 and 443 from the public subnet CIDR

Question 11

A company is designing a hybrid network using AWS Direct Connect. They want to extend their on-premises network to multiple VPCs in the same AWS Region. Which resource should they use to achieve this?

Accepted Answer

Direct Connect gateway. A Direct Connect gateway is the correct resource because it allows you to associate up to 10 VPCs (or 20 with a quota increase) in the same or different AWS Regions with a single Direct Connect connection. It acts as a central hub, enabling connectivity from your on-premises network to multiple VPCs via a single private virtual interface (VIF) attached to the Direct Connect gateway, without needing separate VIFs per VPC.

Answer

Direct Connect transit virtual interface

Answer

Direct Connect private virtual interface (VIF)

Answer

Link Aggregation Group (LAG)

Question 12

A company is designing a network for a critical application that requires low latency between EC2 instances. The instances are in the same AWS Region but different Availability Zones. Which configuration will provide the lowest latency?

Accepted Answer

Launch instances in the same placement group within a single Availability Zone. Placing EC2 instances within the same placement group in a single Availability Zone ensures they are in close physical proximity, often on the same rack or within the same cluster, which minimizes network hops and achieves the lowest possible latency (typically under 1 ms). This configuration is specifically designed for low-latency, high-throughput workloads like HPC or real-time data processing.

Answer

Use an Application Load Balancer to distribute traffic

Answer

Use Direct Connect to connect the VPCs

Answer

Use VPC peering to connect the VPCs

Question 13

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises data centers. They want to centralize internet traffic through a single VPC that has an internet gateway. Which Transit Gateway feature should they enable?

Accepted Answer

Transit Gateway route tables. To centralize internet traffic through a single VPC with an internet gateway, you need to control the routing of traffic from other VPCs and on-premises networks. Transit Gateway route tables allow you to isolate or share routes between attachments, enabling you to create a default route (0.0.0.0/0) pointing to the centralized VPC's attachment. This ensures all outbound internet traffic from other VPCs is forwarded to the egress VPC, which then uses its internet gateway.

Answer

VPN attachments

Answer

Multicast support

Answer

IPsec acceleration

Question 14

A company has a VPC with a CIDR block of 172.16.0.0/20. They need to create subnets for three tiers: web, application, and database. The web tier must be public and support at least 1000 hosts. The application and database tiers must be private. Which subnet design meets the requirements?

Accepted Answer

Web: 172.16.0.0/22, App: 172.16.4.0/24, DB: 172.16.5.0/24. The web tier subnet 172.16.0.0/22 provides 2^(32-22) - 5 = 1024 - 5 = 1019 usable host addresses (AWS reserves 5 IPs per subnet), which meets the requirement of at least 1000 hosts. The application and database subnets use /24 masks, each offering 251 usable hosts, and are private. All subnets fall within the VPC CIDR 172.16.0.0/20 without overlap.

Answer

Web: 172.16.0.0/23, App: 172.16.2.0/23, DB: 172.16.4.0/23

Answer

Web: 172.16.0.0/20, App: 172.16.0.0/20, DB: 172.16.0.0/20

Answer

Web: 172.16.0.0/24, App: 172.16.1.0/24, DB: 172.16.2.0/24

Question 15

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs for an EC2 instance with IP 10.0.1.5. Based on the logs, which statement is true?

Accepted Answer

The instance is communicating with both internal and internet hosts. The VPC Flow Logs show the EC2 instance (10.0.1.5) communicating with both an internal IP (10.0.2.10) on port 443 and an external IP (203.0.113.50) on port 80, with ACCEPT records for both flows. This indicates successful bidirectional traffic to both internal and internet hosts, confirming option D is correct.

Answer

The instance is not communicating with the internet

Answer

The instance's security group is blocking traffic

Answer

The instance is only communicating with another instance in the same subnet