ANS-C01 Network Design Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. A developer created this CloudFormation template to create a public subnet. However, instances in the subnet cannot access the internet. What is the MOST likely cause?

Accepted Answer

The subnet does not have auto-assign public IP enabled. The CloudFormation template creates a public subnet but does not set the 'MapPublicIpOnLaunch' property to 'true'. Without this setting, EC2 instances launched in the subnet do not automatically receive a public IPv4 address, which is required for internet-bound traffic to be routed through the Internet Gateway (IGW). Even if the route table has a default route (0.0.0.0/0) pointing to the IGW, the instance lacks a public IP, so the IGW cannot perform source NAT for outbound traffic, making internet access impossible.

Answer

The route to the internet gateway is missing

Answer

The route table is not associated with the subnet

Answer

The internet gateway is not attached to the VPC

Question 2

Refer to the exhibit. A network architect is reviewing an IAM policy for a junior engineer. What is the security concern with this policy?

Accepted Answer

The policy allows deletion of VPCs and subnets, which could lead to resource loss. The IAM policy grants `ec2:DeleteVpc` and `ec2:DeleteSubnet` permissions, which allow the junior engineer to delete VPCs and subnets. This could lead to irreversible resource loss, including all associated resources like route tables, security groups, and network interfaces, disrupting network connectivity and services.

Answer

The policy does not include a condition to restrict the actions to specific VPCs

Answer

The policy allows creation of VPCs and subnets, which could cause resource exhaustion

Answer

The policy allows read-only actions that could expose sensitive network configurations

Question 3

A company is deploying a web application in a VPC with public and private subnets. The web servers in public subnets must be protected from direct internet access, but they need to receive traffic from an Application Load Balancer (ALB). Which architecture should be used?

Accepted Answer

Internet-facing ALB in public subnets, and internal ALB in private subnets pointing to web servers. It uses an internet-facing ALB in public subnets to receive traffic from the internet, then forwards it to an internal ALB in private subnets, which distributes traffic to web servers in private subnets. This ensures the web servers are not directly accessible from the internet, meeting the security requirement while still allowing traffic from the ALB. The internal ALB uses private IP addresses, keeping the web servers isolated from direct internet access.

Answer

Internet-facing ALB in public subnets with web servers also in public subnets

Answer

Internal Network Load Balancer in private subnets with web servers

Answer

Amazon CloudFront with origin pointing to web servers in public subnets

Question 4

A company is designing a multi-region active-active architecture with an Application Load Balancer in each region. Which service can route traffic to the closest ALB based on latency?

Accepted Answer

Amazon Route 53 latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS region that provides the lowest latency for the end user, based on historical latency measurements between the user's ISP and each region. This makes it the correct choice for routing users to the closest Application Load Balancer in a multi-region active-active architecture.

Answer

AWS Global Accelerator

Answer

Application Load Balancer cross-zone load balancing

Answer

Amazon CloudFront

Question 5

A company wants to provide its employees with secure access to internal applications running on AWS without using a VPN. Which AWS service can be used?

Accepted Answer

AWS Client VPN. AWS Client VPN is a managed, cloud-based VPN solution that allows employees to securely access AWS resources and internal applications from their devices using OpenVPN or IKEv2 protocols, without requiring a traditional site-to-site VPN or dedicated hardware. It provides per-user authentication via Active Directory, SAML, or mutual authentication, making it ideal for remote user access to internal applications without a VPN appliance on-premises.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 6

A company is designing a VPC with a public subnet and a private subnet. The private subnet instances need to access the internet for software updates. Which TWO options allow outbound internet access while preventing inbound connections? (Choose two.)

Accepted Answer

NAT Gateway in the public subnet. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The NAT Gateway translates the private IP addresses of the instances to its own Elastic IP address, and because it does not maintain state for inbound traffic that was not initiated from within the VPC, it blocks all inbound connection attempts.

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection to on-premises

Answer

VPC Peering connection to a VPC with internet access

Question 7

Refer to the exhibit. A bucket policy allows access to an S3 bucket. What is the intended effect?

Accepted Answer

Denies all requests because the IP condition uses a private IP range. The bucket policy includes a condition that denies requests unless the source IP is within the private IP range 10.0.0.0/16. Since private IP addresses are not routable over the public internet, any request originating from outside the VPC (i.e., from the internet) will not have a source IP in that range, causing the Deny statement to block the request. This effectively denies all requests because the only allowed IP range is a private CIDR that cannot be the source of a public internet request.

Answer

Allows requests from any public IP address

Answer

Allows any request to the bucket

Answer

Allows requests only from a VPC with CIDR 10.0.0.0/16

Question 8

A network engineer is designing a VPC with public and private subnets. The private subnets must have outbound internet access for software updates but must not be directly reachable from the internet. The company wants to minimize cost and operational overhead. Which solution meets these requirements?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway, deployed in a public subnet with an associated Elastic IP, enables instances in private subnets to initiate outbound IPv4 connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. Adding a default route (0.0.0.0/0) in the private subnet route table pointing to the NAT Gateway satisfies the requirement for outbound-only internet access with minimal cost and operational overhead, as NAT Gateway is a managed service that scales automatically.

Answer

Use an egress-only internet gateway and route 0.0.0.0/0 to it from the private subnets.

Answer

Create a VPC peering connection to a VPC with internet access and route 0.0.0.0/0 through the peering connection.

Answer

Attach an internet gateway to the VPC and add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

Question 9

An e-commerce company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. During a flash sale, the application experiences high latency. The network team notices that the ALB is receiving more traffic than expected. What is the most likely cause?

Accepted Answer

The ALB is not protected by AWS WAF, allowing a DDoS attack or excessive traffic to reach the backend.. The sudden spike in traffic reaching the ALB beyond expected levels, combined with high latency, strongly indicates that the ALB is being overwhelmed by malicious or excessive traffic. Without AWS WAF protection, the ALB cannot filter out DDoS attacks or unwanted requests at Layer 7, so all traffic passes through to the backend instances, causing resource exhaustion and latency. AWS WAF integrates directly with ALBs to inspect and block malicious traffic before it reaches the application.

Answer

The ALB is configured to terminate HTTPS, which increases CPU load on the ALB.

Answer

The Auto Scaling group's scaling policies are too aggressive, causing frequent instance launches.

Answer

The ALB health checks are too frequent, consuming resources.

Question 10

A company runs a critical application on EC2 instances in a VPC with a single private subnet (10.0.1.0/24) in us-east-1a. The instances need to download security updates from the internet. The company currently uses a NAT Gateway in a public subnet (10.0.0.0/24) in us-east-1a. Recently, an Availability Zone failure caused us-east-1a to become unavailable, and the application could not reach the internet. The company wants to redesign the network to be highly available across multiple AZs for internet access. The application must continue to use private IP addresses for outbound traffic. The company has a limited budget and wants to minimize costs while meeting high availability. Which solution should the company implement?

Accepted Answer

Deploy a NAT Gateway in each of two AZs (us-east-1a and us-east-1b) in public subnets. Create private subnets in both AZs with separate route tables pointing to the local NAT Gateway.. It ensures high availability for outbound internet traffic by deploying a NAT Gateway in each of two Availability Zones (us-east-1a and us-east-1b) with separate private subnets and route tables. This design eliminates the single point of failure; if one AZ fails, the other NAT Gateway continues to route traffic. The application retains private IP addresses for outbound traffic, and the cost is minimized by using only two NAT Gateways (one per AZ) rather than a more expensive multi-AZ architecture like a transit gateway or VPN.

Answer

Deploy one NAT Gateway in a new public subnet in us-east-1b and update the private subnet route table to use it.

Answer

Remove the NAT Gateway and attach an internet gateway to the VPC. Add a route in the private subnet route table pointing 0.0.0.0/0 to the internet gateway.

Answer

Replace the NAT Gateway with a NAT instance in a public subnet in us-east-1a and configure a secondary ENI in us-east-1b for failover.

Question 11

A company is designing a multi-Region application using Amazon Route 53 latency-based routing. The application must be highly available and failover automatically if an AWS Region becomes unavailable. What should the company do to meet these requirements?

Accepted Answer

Configure active-passive failover with latency-based routing and associate health checks with each record.. It combines latency-based routing with health checks and active-passive failover, which allows Route 53 to route traffic to the region with the lowest latency under normal conditions and automatically fail over to the passive region if the active region's health check fails. This meets the high availability and automatic failover requirements by leveraging Route 53's DNS failover mechanism, which updates DNS responses based on health check status.

Answer

Configure latency-based routing with health checks and enable DNS failover.

Answer

Configure geolocation routing policies and associate health checks.

Answer

Configure weighted routing policies with equal weights for all regions.

Question 12

A company is designing a network for a critical application that requires high availability across three Availability Zones in a single AWS Region. The application uses Network Load Balancers (NLBs) and Application Load Balancers (ALBs). The company must ensure that cross-zone load balancing is enabled for the NLBs and that the ALBs have a fixed response timeout. Which combination of settings meets these requirements?

Accepted Answer

Enable cross-zone load balancing on the NLB (default) and set the idle timeout on the ALB to a fixed value.. Cross-zone load balancing is enabled by default on Network Load Balancers (NLBs) and ensures traffic is distributed evenly across targets in all Availability Zones, which is critical for high availability across three AZs. The idle timeout on an Application Load Balancer (ALB) is a fixed value (default 60 seconds, configurable from 1 to 4000 seconds) that controls how long the ALB keeps a connection open without data transfer, meeting the requirement for a fixed response timeout. This combination satisfies both requirements without conflicting settings.

Answer

Disable cross-zone load balancing on the ALB and set the idle timeout on the NLB.

Answer

Disable cross-zone load balancing on the NLB and set the connection timeout on the ALB.

Answer

Enable cross-zone load balancing on the ALB and set the connection timeout on the NLB.

Question 13

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The VPN is configured with a server certificate and mutual authentication. Some users report that they cannot connect to the VPN. What should the administrator check FIRST?

Accepted Answer

Verify that each user has a valid client certificate installed on their device.. The question states that mutual authentication is configured, which requires both a server certificate and a valid client certificate on each user's device. Since some users cannot connect while others presumably can, the most likely issue is that the affected users lack a valid client certificate. The administrator should first verify that each user has a valid client certificate installed, as this is a common point of failure in mutual TLS authentication.

Answer

Check the security group associated with the VPN endpoint.

Answer

Verify that the server certificate is uploaded to AWS Certificate Manager (ACM).

Answer

Confirm that the VPN endpoint is associated with all subnets in the VPC.

Question 14

A company is designing a hybrid network using AWS Direct Connect and VPN backup. The company wants to ensure that traffic always uses Direct Connect when it is available. Which TWO configurations should be implemented? (Choose TWO.)

Accepted Answer

Use AS_PATH prepending on the VPN BGP session to make the VPN path less preferred.. AS_PATH prepending on the VPN BGP session increases the AS_PATH length for routes advertised over the VPN, making them less preferred compared to the same routes learned over Direct Connect with a shorter AS_PATH. BGP selects the path with the shortest AS_PATH length, so traffic will use Direct Connect when it is available. This is a standard technique for influencing outbound traffic path selection in a hybrid network.

Answer

Disable BGP on the VPN connection to force traffic to Direct Connect.

Answer

Set a lower MED value on the Direct Connect BGP session.

Answer

Advertise the same prefixes over both connections with the same AS_PATH length.

Question 15

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Accepted Answer

Create a Transit Gateway in the central account and attach the central VPC.. A Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.

Answer

Create a VPC peering connection between each spoke VPC and the central VPC.

Answer

Deploy a firewall appliance in each spoke VPC.