ANS-C01 Network Design Practice Test 8 — 15 Questions

Question 1

A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect. The on-premises CIDR is 10.1.0.0/16. To enable communication between the VPC and on-premises, which component must be configured?

Accepted Answer

Attach a Virtual Private Gateway to the VPC and update route tables. To connect a VPC to an on-premises network over AWS Direct Connect, you must attach a Virtual Private Gateway (VGW) to the VPC. The VGW serves as the VPN concentrator on the AWS side, terminating the Direct Connect virtual interface (VIF) and enabling BGP peering for route exchange. You then update the VPC route tables to point the on-premises CIDR (10.1.0.0/16) to the VGW, allowing traffic to flow between the VPC and the on-premises network.

Answer

Attach an Internet Gateway to the VPC and configure a NAT gateway

Answer

Create a VPC peering connection between the VPC and the on-premises network

Answer

Create a Transit Gateway and attach the VPC and Direct Connect

Question 2

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that all packets from a given client session are sent to the same target instance for the duration of the session. Which feature should be enabled on the NLB to meet this requirement?

Accepted Answer

Enable stickiness using the source IP address. Option C is correct because enabling stickiness using the source IP address on a Network Load Balancer (NLB) ensures that all packets from a given client IP are routed to the same target instance for the duration of the session. This is achieved by the NLB hashing the source IP address (and optionally port and protocol) to consistently select the same target, which meets the requirement for session persistence without relying on application-layer cookies.

Answer

Enable proxy protocol v2

Answer

Enable cross-zone load balancing

Answer

Configure health checks to mark targets as healthy

Question 3

A company is designing a hybrid network architecture that connects multiple VPCs in different AWS regions to an on-premises data center. The company wants to minimize the number of VPN tunnels and reduce management overhead. Which AWS service should be used to simplify this design?

Accepted Answer

AWS Transit Gateway with VPN attachments. AWS Transit Gateway with VPN attachments is correct because it acts as a central hub that connects multiple VPCs across different AWS regions and an on-premises data center through a single VPN connection. This minimizes the number of VPN tunnels by eliminating the need for individual VPN connections between each VPC and the on-premises network, and reduces management overhead through a single point of configuration and routing.

Answer

AWS Direct Connect with multiple virtual interfaces

Answer

AWS VPN CloudHub

Answer

VPC peering between each VPC and the on-premises network

Question 4

A company has an Amazon Route 53 private hosted zone associated with a VPC. The company wants to resolve custom domain names for resources within that VPC. Which configuration is required for EC2 instances in the VPC to resolve these private hosted zone records?

Accepted Answer

Ensure that the VPC has the enableDnsHostnames and enableDnsSupport attributes set to true. Option C is correct because for EC2 instances in a VPC to resolve records in a Route 53 private hosted zone, the VPC must have both the `enableDnsHostnames` and `enableDnsSupport` attributes set to `true`. These settings enable the VPC's built-in DNS resolver (the Amazon-provided DNS server at the VPC's base CIDR +2 address) to query the private hosted zone and return the custom domain names to instances. Without these attributes, the VPC DNS resolver cannot perform resolution for private hosted zones, even if the zone is associated with the VPC.

Answer

Configure a Route 53 Resolver inbound endpoint in the VPC

Answer

Create a Route 53 Resolver outbound endpoint in the VPC

Answer

Establish a VPC peering connection with the Route 53 hosted zone

Question 5

A company is designing a network architecture for a multi-tier web application. The application includes a public-facing Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an Amazon RDS database in a private subnet. The company requires that the database is not directly accessible from the application servers except through specific ports, and that traffic between the web servers and the database is encrypted. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable SSL/TLS encryption for connections between the web servers and the RDS database. Option C is correct because enabling SSL/TLS encryption for connections between the web servers and the RDS database ensures that data in transit is encrypted, meeting the requirement for encrypted traffic. Option D is correct because configuring a security group on the RDS instance that allows inbound traffic from the web servers' security group on the database port provides a stateful, instance-level firewall rule that restricts direct access to only the web servers, without exposing the database to the public subnet or relying on IP-based rules.

Answer

Place the RDS database in a public subnet with a security group that allows only the web servers' IP addresses

Answer

Establish a VPC peering connection between the web servers' VPC and the RDS VPC

Answer

Use a network ACL to restrict inbound traffic to the RDS subnet to only the web server's IP range

Question 6

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The application requires outbound internet access to download updates, but the company does not want to assign public IP addresses to the tasks. Which TWO actions should the company take to provide internet access to the tasks? (Choose two.)

Accepted Answer

Launch the tasks in private subnets that do not have a route to an Internet Gateway. Option B is correct because tasks in private subnets without a route to an Internet Gateway cannot directly access the internet, which is the desired behavior to avoid public IP addresses. Option C is correct because a NAT gateway in a public subnet provides outbound internet access for tasks in private subnets by translating their private IP addresses to the NAT gateway's public IP, allowing them to reach the internet without assigning public IPs to the tasks.

Answer

Configure a security group that allows outbound traffic to 0.0.0.0/0

Answer

Launch the tasks in public subnets with auto-assign public IP enabled

Answer

Create a VPC Gateway Endpoint for Amazon ECR

Question 7

A company wants to connect its on-premises data center to AWS using AWS Direct Connect and wants to use the same connection to access multiple VPCs in the same AWS region. The company also needs to maintain private IP connectivity between the VPCs. Which THREE components should the company use to meet these requirements? (Choose three.)

Accepted Answer

Transit Gateway VPC attachments. Transit Gateway VPC attachments allow multiple VPCs to connect to a central transit gateway, enabling private IP connectivity between them. When combined with an AWS Direct Connect gateway, the on-premises data center can use a single Direct Connect connection to reach all attached VPCs via the transit gateway, meeting both requirements efficiently.

Answer

VPC peering connections between each VPC

Answer

AWS Site-to-Site VPN connection

Question 8

A network engineer is troubleshooting an issue where an AWS Lambda function cannot create an Elastic Network Interface (ENI) in a VPC. The function has the IAM policy shown in the exhibit. Which statement explains why the function is failing?

Accepted Answer

The policy is missing the ec2:CreateNetworkInterfacePermission action. The correct answer is D because creating an Elastic Network Interface (ENI) in a VPC requires the `ec2:CreateNetworkInterfacePermission` action in addition to `ec2:CreateNetworkInterface`. The IAM policy shown in the exhibit explicitly denies `ec2:CreateNetworkInterface`, but even if that denial were removed, the Lambda function would still fail without the permission action, as it is necessary for cross-account or service-linked ENI creation scenarios. AWS Lambda uses this permission to allow the Lambda service to attach the ENI to the VPC on your behalf.

Answer

The policy denies the ec2:CreateVpc action which is required to create an ENI

Answer

The policy allows ec2:DescribeInstances which conflicts with ENI creation

Answer

The policy denies the ec2:CreateNetworkInterface action

Question 9

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Accepted Answer

Private DNS is not enabled for the endpoint. The most likely cause is that Private DNS is not enabled for the VPC Interface Endpoint. When Private DNS is enabled, the endpoint automatically associates a Route 53 private hosted zone with the VPC, allowing the default private DNS name (e.g., *.dkr.ecr.us-east-1.amazonaws.com) to resolve to the endpoint's elastic network interface IP addresses. Without this, the EC2 instance will resolve the private DNS name to the public IP of the ECR service, bypassing the endpoint and failing authentication due to network path issues.

Answer

The endpoint service name is incorrect; it should be com.amazonaws.us-east-1.ecr.api

Answer

The endpoint is not in the 'available' state

Answer

The endpoint type should be Gateway, not Interface

Question 10

A network engineer is troubleshooting connectivity between a VPC (10.0.0.0/16) and a peered VPC (10.1.0.0/16). The route table shown is associated with subnet-aaa. An EC2 instance in subnet-aaa cannot reach an instance in the peered VPC. What is the issue?

Accepted Answer

The VPC peering connection is not in the 'active' state. Option D is correct because a VPC peering connection must be in the 'active' state for traffic to flow between the VPCs. If the peering connection is in any other state (e.g., 'pending-acceptance', 'expired', 'failed', or 'deleted'), the route to the peered VPC's CIDR will be considered a black hole, and the EC2 instance in subnet-aaa will be unable to reach the instance in the peered VPC. The route table shown includes a route for 10.1.0.0/16 pointing to the peering connection, but the connection's state must be verified as 'active' for the route to be effective.

Answer

The route to the peered VPC's CIDR is missing

Answer

The route table does not have a route to an Internet Gateway

Answer

The route table is not associated with the correct subnet

Question 11

A company is designing a multi-region architecture for disaster recovery. They need to use Route 53 to route traffic to the nearest healthy endpoint. Which routing policy should they use?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks is the correct choice because it directs traffic to the endpoint with the lowest latency for the user, while health checks ensure that traffic is only sent to healthy endpoints. This combination meets the requirement to route to the nearest healthy endpoint in a multi-region disaster recovery setup, as it dynamically adapts to both network conditions and endpoint availability.

Answer

Failover routing

Answer

Geolocation routing

Answer

Latency-based routing without health checks

Question 12

A company has a VPC with public and private subnets in three Availability Zones. They have an Application Load Balancer (ALB) in the public subnets and a fleet of EC2 instances in the private subnets. The ALB needs to send traffic to the instances on port 443. What is the most secure way to configure the security groups?

Accepted Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on port 443.. Option C is correct because it follows the principle of least privilege by restricting the ALB security group to only allow inbound traffic on port 443 from the internet (0.0.0.0/0) and the instance security group to only allow inbound traffic on port 443 from the ALB security group. This ensures that only the ALB can communicate with the instances on the required port, preventing direct access from other sources and reducing the attack surface.

Answer

ALB SG: inbound from 0.0.0.0/0 on all ports. Instance SG: inbound from ALB SG on all ports.

Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from 0.0.0.0/0 on port 443.

Answer

ALB SG: inbound from 0.0.0.0/0 on port 443. Instance SG: inbound from ALB SG on all ports.

Question 13

A company wants to connect an on-premises data center to AWS using a dedicated private connection that does not traverse the internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This service uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a virtual private gateway or AWS Transit Gateway, ensuring low latency, consistent bandwidth, and compliance with data sovereignty requirements.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16. They want to create a subnet that can host at least 2000 EC2 instances. Which subnet size should they choose?

Accepted Answer

/21. A /21 subnet provides 2,048 usable IP addresses (2^(32-21) - 5 = 2,048 - 5 = 2,043 for AWS, but the key is that 2,048 total addresses minus the 5 reserved by AWS yields 2,043, which exceeds the requirement of 2,000 EC2 instances). AWS reserves 5 IP addresses per subnet (network, VPC router, DNS, future use, broadcast), so the usable count is total addresses minus 5. A /21 is the smallest subnet that meets the 2,000-instance requirement.

Answer

/22

Answer

/24

Answer

/20

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They launch an EC2 instance in subnet A and another in subnet B. The security groups for both instances allow all traffic from the other instance's private IP. However, the instances cannot communicate. What is the most likely cause?

Accepted Answer

The network ACLs are blocking the traffic. The most likely cause is that the network ACLs (NACLs) are blocking the traffic. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit inbound and outbound rules for both directions. By default, custom NACLs deny all traffic, so even though the security groups permit communication, the NACLs on subnets A and B must allow the traffic. The correct answer is B.

Answer

The instances are in different Availability Zones

Answer

The security groups are stateful and block return traffic

Answer

The route tables do not have a local route