ANS-C01 Network Design Practice Test 7 — 15 Questions

Question 1

A company is designing a hybrid network where an Amazon VPC is connected to an on-premises data center via AWS Direct Connect and a VPN backup. They have a VPC with CIDR 10.0.0.0/16 and on-premises CIDR 192.168.0.0/16. They want to ensure that all traffic between the VPC and on-premises uses the Direct Connect connection when it is available, and automatically fails over to the VPN if Direct Connect fails. What should they do?

Accepted Answer

Create a virtual private gateway attached to the VPC. Establish a Direct Connect private virtual interface and a VPN connection to the virtual private gateway. Configure BGP on both connections and use a shorter AS path for the Direct Connect routes.. Option D is correct because it uses a virtual private gateway (VGW) for both the Direct Connect private virtual interface and the VPN connection, and configures BGP on both. By advertising a shorter AS path (e.g., prepending fewer AS numbers) for the Direct Connect routes, the VPC and on-premises routers prefer the Direct Connect path when available. If Direct Connect fails, the BGP session drops, and the VPN routes (with a longer AS path) become active, providing automatic failover.

Answer

Create a virtual private gateway with a Direct Connect private virtual interface. Additionally, create a separate VPN connection directly to the VPC. Set longer AS path for the Direct Connect routes.

Answer

Create a virtual private gateway and establish both a Direct Connect private virtual interface and a VPN connection. Use BGP with equal AS path lengths to enable ECMP.

Answer

Create a virtual private gateway and attach a Direct Connect private virtual interface. For failover, add a static route in the VPC route table pointing to the VPN connection.

Question 2

A company has a VPC with public and private subnets in three Availability Zones. They have EC2 instances in private subnets that need to download patches from the internet. The company requires that all outbound traffic to the internet is logged and inspected. Which solution meets these requirements with the highest availability?

Accepted Answer

Create a centralized egress VPC with a NAT Gateway in each AZ. Peer the application VPCs to the egress VPC and route 0.0.0.0/0 traffic through a firewall appliance in the egress VPC.. Option D is correct because it meets the requirements for logging and inspecting all outbound internet traffic by routing it through a centralized firewall appliance in an egress VPC, while also providing high availability through NAT Gateways deployed in each Availability Zone. This architecture ensures that traffic is inspected before reaching the internet, and the use of multiple NAT Gateways eliminates single points of failure, achieving the highest availability compared to single-instance or single-gateway solutions.

Answer

Launch a NAT instance in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to the NAT instance.

Answer

Place a single NAT Gateway in one public subnet and configure all private subnet route tables to send 0.0.0.0/0 to that NAT Gateway.

Answer

Attach an internet gateway to the VPC and add a route in the private subnet route tables to send 0.0.0.0/0 to the internet gateway.

Question 3

A company is designing a global application that will use Amazon CloudFront to serve content from an Application Load Balancer (ALB) in us-east-1. They want to restrict access to the ALB so that it only accepts traffic from CloudFront. Additionally, they want to ensure that if someone bypasses CloudFront and directly accesses the ALB, the request is denied. Which solution should they implement?

Accepted Answer

Configure CloudFront to add a custom HTTP header (e.g., X-Origin-Verify) to requests forwarded to the ALB. Configure the ALB to only forward requests that contain that specific header to the target group.. Option D is correct because it uses a custom HTTP header (e.g., X-Origin-Verify) that CloudFront adds to requests forwarded to the ALB, and the ALB is configured to only forward requests containing that specific header to the target group. This ensures that any request not originating from CloudFront (i.e., direct access to the ALB) lacks the header and is denied, providing a secure and scalable method to restrict access without relying on static IP lists.

Answer

Use CloudFront Origin Access Control (OAC) to restrict access to the ALB.

Answer

Configure the ALB security group to allow inbound traffic only from the CloudFront IP address ranges published in the AWS IP address ranges JSON file.

Answer

Use AWS WAF on the ALB with a rule that allows traffic only from CloudFront IP ranges.

Question 4

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network with CIDR 10.0.0.0/8. They plan to use AWS Direct Connect with a private virtual interface. What should they do to resolve the overlapping CIDR conflict?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 172.16.0.0/16, and re-create the VPC with the new CIDR.. Option C is correct because AWS does not support network address translation (NAT) for overlapping CIDRs on a Direct Connect private virtual interface. The only way to resolve the conflict is to change the VPC CIDR to a non-overlapping range (e.g., 172.16.0.0/16) and recreate the VPC, as the VPC CIDR cannot be modified after creation. This ensures that routes between the VPC and on-premises network do not conflict.

Answer

Create a VPN connection with dynamic routing and use BGP to advertise the VPC CIDR.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Answer

Use a NAT Gateway in the VPC to translate the on-premises IP addresses.

Question 5

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. The application requires that user sessions are maintained (sticky sessions) and that the ALB can offload SSL/TLS termination. Which configuration should they use?

Accepted Answer

Create an Application Load Balancer with a target group that has stickiness enabled and an HTTPS listener that terminates SSL.. Option D is correct because an Application Load Balancer (ALB) natively supports both sticky sessions (via a generated cookie or application-based cookie) and SSL/TLS termination at the HTTPS listener. This allows the ALB to decrypt traffic before forwarding it to targets over HTTP, reducing backend processing overhead while maintaining session affinity across multiple Availability Zones for high availability.

Answer

Create a Network Load Balancer with a target group that has stickiness enabled and an SSL listener.

Answer

Launch EC2 instances as reverse proxy servers in front of the application servers, configure SSL on the reverse proxy, and use an Application Load Balancer to distribute traffic to the reverse proxies.

Answer

Create a Classic Load Balancer with sticky sessions and SSL termination.

Question 6

A company is deploying a multi-tier application in a VPC. The web tier is in public subnets, and the application tier is in private subnets. The application tier needs to communicate with an on-premises database via an AWS Direct Connect connection. The company wants to minimize latency and maximize throughput. Which design should they use?

Accepted Answer

Place the application tier instances in a private subnet in the same VPC as the web tier. Attach a virtual private gateway to the VPC and connect it to the on-premises network via a Direct Connect private virtual interface.. Option A is correct because a Direct Connect private virtual interface (VIF) connected to a virtual private gateway (VGW) provides a dedicated, low-latency, high-throughput connection from the VPC to on-premises. The application tier in the private subnet can route traffic directly to the on-premises database via the VGW without traversing the internet or a NAT device, minimizing latency and maximizing throughput.

Answer

Place the application tier in a private subnet and use a NAT Gateway to route traffic to the on-premises network.

Answer

Place the application tier in a separate VPC and peer it to the web tier VPC. Use a Direct Connect connection attached to the web tier VPC.

Answer

Place the application tier in a separate VPC and use a VPN connection over the internet to connect to on-premises.

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. They need to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the routing?

Accepted Answer

Create a Transit Gateway with separate route tables. Attach each VPC and the Direct Connect virtual interface to the Transit Gateway. In the route tables, propagate routes and add static routes to send inter-VPC traffic to the security appliance VPC.. Option D is correct because AWS Transit Gateway supports separate route tables, allowing you to isolate traffic domains. By attaching each VPC and the Direct Connect virtual interface to the Transit Gateway, you can create a centralized inspection VPC. Static routes in the Transit Gateway route tables direct inter-VPC traffic to the security appliance VPC, ensuring all traffic between VPCs is inspected before reaching its destination.

Answer

Use Network ACLs on the subnets to restrict traffic and allow inspection.

Answer

Create VPC peering connections between all VPCs and route traffic through a security appliance in a central VPC.

Answer

Use security groups on the security appliance to inspect traffic.

Question 8

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) in a VPC. They need to ensure that the application can handle a sudden increase in traffic and that the ALB can scale automatically. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure the target group's deregistration delay to a low value to quickly remove unhealthy targets.. Option A is correct because configuring a low deregistration delay on the target group allows the ALB to quickly stop sending traffic to unhealthy targets, reducing the risk of failed requests during traffic spikes. This setting controls how long the ALB waits for in-flight requests to complete before deregistering a target, and a lower value accelerates the removal of unhealthy instances to maintain application responsiveness. Option D is correct because enabling cross-zone load balancing distributes incoming traffic evenly across all healthy targets in all Availability Zones, maximizing resource utilization and ensuring the ALB can scale automatically by leveraging capacity from multiple zones.

Answer

Use a single subnet for the ALB to reduce complexity.

Answer

Use a Network Load Balancer instead of an ALB to improve throughput.

Answer

Disable deletion protection on the ALB to allow automatic replacement.

Question 9

A company is designing a hybrid network using AWS Direct Connect. They have a VPC with CIDR 10.0.0.0/16 and an on-premises network with CIDR 192.168.0.0/16. They want to establish a Direct Connect private virtual interface with a virtual private gateway. Which THREE steps are required to complete the connectivity? (Choose three.)

Accepted Answer

Create a virtual private gateway and attach it to the VPC.. Option B is correct because a virtual private gateway (VGW) is the required AWS-side endpoint for a Direct Connect private virtual interface (VIF) to terminate on a single VPC. The VGW must be created and attached to the VPC before the private VIF can be associated with it, enabling private connectivity between the on-premises network and the VPC.

Answer

Create a Transit Gateway and attach the VPC to it.

Answer

Create a customer gateway object in the AWS account.

Question 10

A company is designing a network for a critical application that requires low-latency communication between EC2 instances in the same AWS Region. They want to maximize network throughput and minimize latency. Which TWO design choices should they make? (Choose two.)

Accepted Answer

Enable enhanced networking (ENA) on the EC2 instances.. Option B is correct because enabling Enhanced Networking (ENA) on EC2 instances provides higher bandwidth, higher packet-per-second (PPS) performance, and consistently lower inter-instance latencies by using a modern network interface driver that offloads network processing to dedicated hardware. This is essential for critical applications requiring maximum throughput and minimal latency within the same AWS Region.

Answer

Attach an internet gateway to the VPC and route traffic through it.

Answer

Use a VPN connection to route traffic between instances.

Answer

Use a spread placement group for the EC2 instances.

Question 11

A company is designing a multi-region application with Amazon RDS for MySQL as the primary database. The application requires read-after-write consistency across regions. Which design should the company choose to meet this requirement?

Accepted Answer

Use Amazon Aurora Global Database with cluster endpoints in each region. Amazon Aurora Global Database is the correct choice because it provides dedicated cluster endpoints in each region that automatically route write traffic to the primary region and read traffic to local replicas, ensuring read-after-write consistency through its storage-layer replication with typical latency under 1 second. Unlike standard RDS cross-Region replication, Aurora Global Database uses a physical storage-based replication mechanism that guarantees global consistency without relying on MySQL binary logs, which can introduce replication lag and potential inconsistency.

Answer

Use Amazon RDS with cross-Region replication enabled using MySQL binary log

Answer

Use Amazon RDS Multi-AZ deployments in each region with read replicas

Answer

Use Amazon RDS with synchronous replication across regions

Question 12

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Answer

Use S3 Transfer Acceleration and access the bucket via the public endpoint

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

Answer

Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it

Question 13

A solutions architect needs to design a highly available web application that uses an Application Load Balancer (ALB) and spans multiple Availability Zones (AZs) in a single region. The application must be able to handle a sudden increase in traffic without manual intervention. Which feature should the architect enable on the ALB to meet this requirement?

Accepted Answer

Enable cross-zone load balancing. Cross-zone load balancing distributes incoming traffic evenly across all registered targets in all enabled Availability Zones, rather than sending traffic only to targets in the same AZ as the load balancer node. This ensures that if one AZ receives more traffic than another, the ALB can still balance the load across all healthy instances, allowing the application to handle sudden traffic spikes without manual scaling intervention.

Answer

Enable connection draining

Answer

Enable sticky sessions

Answer

Enable deletion protection

Question 14

A financial services company must meet PCI DSS compliance requirements. The company's VPC contains a web server in a public subnet and an application server in a private subnet. The application server must communicate with a third-party payment gateway over the internet, but the security team prohibits using an Elastic IP address or a NAT gateway due to auditing concerns. Which solution satisfies these requirements?

Accepted Answer

Use AWS PrivateLink to connect to the payment gateway via a VPC Endpoint Service. AWS PrivateLink allows the application server in the private subnet to connect to the third-party payment gateway via a VPC Endpoint Service without traversing the internet, using private IP addresses. This eliminates the need for an Elastic IP address or a NAT gateway, satisfying the security team's auditing concerns while meeting PCI DSS compliance requirements.

Answer

Deploy a NAT instance in the public subnet and route traffic through it

Answer

Configure a proxy server in the public subnet and have the application server use the proxy

Answer

Attach an Internet Gateway to the VPC and use a default route to 0.0.0.0/0 in the private subnet

Question 15

A company is migrating a legacy application to AWS. The application requires a fixed IP address for outbound traffic to a partner's firewall. The application will run on Amazon EC2 instances in a private subnet. Which design meets the requirement without exposing the instances to inbound internet traffic?

Accepted Answer

Deploy a NAT gateway with an Elastic IP and route outbound traffic through it. A NAT gateway with an Elastic IP provides a fixed public IP address for outbound traffic from instances in a private subnet while preventing any unsolicited inbound connections from the internet. The NAT gateway translates the private source IPs of the instances to its own Elastic IP, meeting the partner firewall's requirement for a fixed source IP without exposing the EC2 instances directly.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to the instances

Answer

Place the instances behind an Application Load Balancer

Answer

Create a VPC Gateway Endpoint for the partner's service