ANS-C01 Network Design Practice Test 8 — 15 Questions

Question 1

A company is designing a VPC with public and private subnets. The company needs to provide internet access to instances in the private subnets. Which TWO components are required? (Choose TWO.)

Accepted Answer

Internet Gateway attached to the VPC. An Internet Gateway (IGW) is required to provide a target in the VPC route tables for internet-bound traffic. For instances in private subnets, a NAT Gateway placed in a public subnet translates their private IP addresses to the public IP of the NAT Gateway, allowing outbound internet access while preventing unsolicited inbound connections. The private subnet's route table must point 0.0.0.0/0 to the NAT Gateway, and the public subnet's route table must point 0.0.0.0/0 to the IGW.

Answer

Transit Gateway

Answer

VPC Gateway Endpoint for S3

Answer

Virtual Private Gateway

Question 2

A company runs a multi-tier web application in a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier uses EC2 instances in private subnets. The database tier uses an RDS MySQL Multi-AZ instance in private subnets. The company has implemented a network ACL (NACL) on the private subnets to allow only traffic from the ALB security group. Recently, the application tier instances are unable to connect to the RDS database. The security group for RDS allows inbound traffic on port 3306 from the application tier security group. The network team has verified that the application tier instances can reach the internet through a NAT Gateway. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The NACL on the private subnets is blocking outbound traffic from the application tier to the RDS database.. The NACL on the private subnets is stateful only for inbound rules; outbound traffic is evaluated separately. Since the NACL allows only inbound traffic from the ALB security group but does not have an outbound rule permitting traffic from the application tier to the RDS database (port 3306), the outbound SYN packets from the application instances are dropped, preventing the TCP handshake from completing.

Answer

The application tier instances are in a different Availability Zone than the RDS primary instance.

Answer

The NAT Gateway is blocking traffic to the RDS endpoint.

Answer

The RDS security group is not allowing inbound traffic from the application tier security group.

Question 3

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an Amazon DynamoDB table. The company wants to avoid sending traffic over the internet. A VPC gateway endpoint for DynamoDB is created and attached to the route table of the private subnet. The EC2 instance has an IAM role that grants access to DynamoDB. However, the application running on the instance cannot connect to DynamoDB. The network team confirms that the route table has a route to the DynamoDB prefix list. What is the MOST likely cause?

Accepted Answer

The VPC does not have DNS resolution enabled, or the endpoint's private DNS option is disabled.. A VPC gateway endpoint for DynamoDB requires DNS resolution to resolve DynamoDB public hostnames to private IP addresses within the VPC. If DNS resolution is disabled in the VPC, the EC2 instance will resolve DynamoDB endpoints to public IPs, causing traffic to attempt internet routing rather than using the gateway endpoint. Note that gateway endpoints do not have a 'private DNS' option—that is for interface endpoints. The essential requirement is that the VPC's DNS resolution attribute (enableDnsSupport) is enabled.

Answer

The security group on the EC2 instance blocks outbound traffic to DynamoDB.

Answer

The IAM role does not include the dynamodb:PutItem action.

Answer

The route table does not have a route to the DynamoDB prefix list.

Question 4

A company is designing a hybrid network architecture that requires a dedicated, private, and consistent connection between its on-premises data center and AWS. The connection must support multiple VLANs and provide a service-level agreement (SLA) of 99.99% availability. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, and consistent network connection from an on-premises data center to AWS, bypassing the public internet. It supports multiple VLANs via 802.1Q tagging over a single physical connection, and offers a 99.99% service-level agreement (SLA) when configured with redundant connections at separate Direct Connect locations.

Answer

AWS Transit Gateway

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 5

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

Accepted Answer

Create the VPC endpoint. The IAM policy allows ec2:CreateVpcEndpoint, but the Resource is set to "*" which does not satisfy the resource requirement for this action. The ec2:CreateVpcEndpoint action requires the resource to be the VPC endpoint service (e.g., arn:aws:ec2:region:account-id:vpc-endpoint-service/*). Without a specific resource ARN, the policy does not grant permission to create the endpoint, so the action will be denied. In contrast, ec2:AttachNetworkInterface, ec2:DescribeVpcEndpoints, and ec2:ModifyVpcEndpoint are allowed by the policy with the wildcard resource.

Answer

Attach the ENI to the EC2 instance

Answer

Describe VPC endpoints

Answer

Modify the VPC endpoint

Question 6

A company wants to ensure that traffic between two VPCs in the same region is encrypted and does not traverse the public internet. Which solution meets these requirements?

Accepted Answer

Establish an AWS Site-to-Site VPN connection between the VPCs. A Site-to-Site VPN connection (Option D) is correct because it uses IPsec tunnels to encrypt traffic between VPCs, and the traffic stays within AWS's private network infrastructure, never traversing the public internet. VPC Peering (Option A) does not encrypt traffic; it only provides a private Layer 3 connection with no encryption. Transit Gateway (Option C) routes traffic but lacks built-in encryption without additional VPN attachments. VPC Endpoints (Option B) are used for accessing AWS services privately, not for inter-VPC routing.

Answer

Configure VPC Peering between the two VPCs

Answer

Create VPC Endpoints in each VPC for the other VPC's CIDR

Answer

Use an AWS Transit Gateway to route traffic between the VPCs

Question 7

An enterprise is migrating a critical application to AWS. The application requires low latency (under 5 ms) between two EC2 instances that are in different VPCs in the same region. The company also needs to ensure that traffic is encrypted in transit and that the connection is highly available. Which design should be used?

Accepted Answer

Configure VPC Peering and use an AWS Transit Gateway with VPN attachments. The closest correct design because AWS Transit Gateway with VPN attachments provides encrypted IPsec tunnels between VPCs, ensuring confidentiality in transit. The VPN attachments are highly available with multiple tunnels, and traffic stays within the AWS backbone, meeting the sub-5 ms latency requirement within the same region. Although the option mentions VPC Peering, it is redundant—Transit Gateway alone connects the VPCs without needing peering. The core components (Transit Gateway + VPN) satisfy both latency and encryption. Option A (Direct Connect) is for on-premises connectivity, not VPC-to-VPC. Option C (PrivateLink) is for accessing services via endpoints, not for VPC-to-VPC routing. Option D (Site-to-Site VPN) traverses the internet, introducing latency that fails the 5 ms requirement.

Answer

Use an AWS Direct Connect connection between the VPCs

Answer

Use VPC endpoints with PrivateLink

Answer

Establish an AWS Site-to-Site VPN between the VPCs

Question 8

A company is designing a hybrid network using AWS Direct Connect. The company wants to use the same Direct Connect connection to access both VPC resources and public AWS services (such as S3 and DynamoDB) from its on-premises network. Which THREE components are required to meet this goal? (Choose three.)

Accepted Answer

Private virtual interface (VIF). A private virtual interface (VIF) is required to connect your on-premises network to a VPC via Direct Connect. However, to also access public AWS services like S3 and DynamoDB over the same Direct Connect connection, you need a public VIF (Option E) for public endpoint connectivity and a Direct Connect Gateway (Option C) to enable transitive routing between the private VIF and multiple VPCs or to simplify the architecture. Together, these three components allow a single Direct Connect connection to serve both private VPC resources and public AWS services.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN connection

Question 9

A company has deployed a multi-tier application across three VPCs (VPC-A, VPC-B, VPC-C) in the us-east-1 region. Each VPC has its own CIDR block (10.0.0.0/16, 10.1.0.0/16, 10.2.0.0/16 respectively). All VPCs are attached to an AWS Transit Gateway. The web tier is in VPC-A, the application tier is in VPC-B, and the database tier is in VPC-C. The application servers in VPC-B need to connect to the database servers in VPC-C on TCP port 3306. The database servers are in a private subnet with a security group (sg-db) that allows inbound traffic from the application server security group (sg-app). The application servers have a security group (sg-app) that allows outbound traffic to the database servers. However, the application servers cannot connect to the database servers. The route tables in VPC-B and VPC-C have routes pointing to the Transit Gateway for the other VPC CIDRs. The Transit Gateway has attachments in all three VPCs and has a default route table with propagation enabled. What is the MOST likely cause of the connectivity failure?

Accepted Answer

The Transit Gateway attachments are not associated with the same route table. The most likely cause is that the Transit Gateway attachments are not associated with the same route table. In AWS Transit Gateway, for traffic to flow between VPCs, the attachments must be associated with a route table that contains routes for the destination VPC CIDRs. Even though propagation is enabled on the default route table, if the attachments are associated with different route tables (or the default route table is not shared), transitive routing will fail. Without a common route table association, the Transit Gateway cannot forward traffic between VPC-B and VPC-C.

Answer

The network ACLs in VPC-B or VPC-C are blocking the traffic

Answer

The Transit Gateway does not support transitive routing between VPCs

Answer

The security group sg-app does not allow outbound traffic to the database server's security group

Question 10

A company is setting up a new AWS environment for a project. The network architect decides to use a hub-and-spoke model with a central inspection VPC for east-west traffic inspection. The inspection VPC (VPC-Hub) contains a firewall appliance that inspects traffic between spoke VPCs. All VPCs are attached to an AWS Transit Gateway. The architect creates a route table in the Transit Gateway for the inspection VPC and another route table for the spoke VPCs. The inspection VPC route table has a default route (0.0.0.0/0) pointing to the firewall appliance. The spoke VPCs have route tables that point to the inspection VPC for traffic to other spoke VPCs. The firewall appliance is configured to forward traffic after inspection. However, traffic between spoke VPCs is not being routed through the inspection VPC. Which configuration change should the architect make to ensure traffic between spoke VPCs is inspected?

Accepted Answer

Enable route propagation on the inspection VPC attachment for the inspection route table. The inspection VPC route table needs to learn the spoke VPC CIDRs dynamically via route propagation from the Transit Gateway attachment. Without propagation, the inspection VPC route table only has a default route pointing to the firewall appliance, but no specific routes for the spoke VPCs. When the firewall appliance forwards traffic after inspection, it needs to know how to reach the destination spoke VPC; enabling route propagation on the inspection VPC attachment for the inspection route table allows the Transit Gateway to inject the spoke VPC routes into that route table, enabling proper return traffic flow.

Answer

Use VPC Peering between the spoke VPCs instead of Transit Gateway

Answer

Create a static route in the inspection VPC route table for each spoke VPC CIDR

Answer

Remove the default route from the spoke VPC route tables

Question 11

A company has an existing VPC with a public subnet and a private subnet. The company launches an EC2 instance in the private subnet. The instance needs to access an S3 bucket to download software updates. The company does not want the instance to have a public IP address. The company creates a VPC endpoint for S3 (Gateway type) in the VPC, and associates it with the private subnet route table by adding a route for the S3 prefix list. However, the instance still cannot access the S3 bucket. The security group for the instance allows all outbound traffic. The network ACL for the private subnet allows all inbound and outbound traffic. What is the MOST likely reason for the connectivity failure?

Accepted Answer

The VPC endpoint policy does not grant access to the S3 bucket. The most likely reason is that the VPC endpoint policy does not grant access to the S3 bucket. Even though the Gateway VPC Endpoint is created and associated with the private subnet route table, the endpoint's policy controls which S3 buckets and actions are allowed. If the policy is too restrictive (e.g., default deny or does not explicitly allow access to the specific bucket), traffic will be dropped at the endpoint, preventing the instance from downloading updates. The security group and network ACL are already permissive, and internet access is not required because the Gateway endpoint uses AWS's private network.

Answer

The network ACL is blocking the traffic

Answer

The security group does not allow outbound HTTPS traffic

Answer

The instance does not have a route to the internet

Question 12

A company is designing a hybrid network with AWS Direct Connect and a VPN backup. They have two on-premises sites connected via MPLS. They want to ensure that if the Direct Connect fails, traffic automatically fails over to the VPN without manual intervention. Which routing configuration should they use?

Accepted Answer

Use BGP and set a higher local preference for routes learned via Direct Connect, and enable BGP graceful shutdown on the Direct Connect router. Using BGP with a higher local preference for routes learned via Direct Connect ensures that the Direct Connect path is preferred over the VPN backup. If the Direct Connect fails, the BGP session goes down, the routes are withdrawn, and traffic automatically fails over to the VPN without manual intervention. BGP graceful shutdown is not required for failover but can be used to gracefully drain traffic before maintenance.

Answer

Configure static routes with equal cost pointing to Direct Connect and VPN

Answer

Use BGP and advertise the same prefixes with a lower MED on the VPN connection

Answer

Create a VPC peering connection between the VPC and on-premises network

Question 13

A company is designing a network for a real-time data analytics platform that ingests data from thousands of IoT devices. The devices send data via UDP to a UDP-based collector service running on EC2 instances. The collector service must be highly available and scalable. The data is then processed by a stream processing application. The company wants to minimize latency and jitter. Which TWO architectural choices should they make?

Accepted Answer

Use AWS Global Accelerator to provide a static anycast IP address and route traffic to the NLB endpoints. AWS Global Accelerator provides static anycast IP addresses that route traffic over the AWS global network to the optimal NLB endpoint, reducing latency and jitter by avoiding public internet hops and using the AWS backbone. This is ideal for UDP-based real-time analytics where consistent performance is critical.

Answer

Use an Application Load Balancer (ALB) with a TCP listener and configure the collector to receive TCP

Answer

Use AWS Global Accelerator with EC2 instances as endpoints directly

Answer

Deploy an internet-facing NLB with Elastic IP addresses in each Availability Zone

Question 14

Refer to the exhibit. An AWS administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile is associated with an IAM role that has the above trust policy. The S3 bucket policy allows s3:GetObject only for the role's ARN. What is the most likely cause of the access failure?

Accepted Answer

The instance profile is not attached to the EC2 instance. The instance profile must be attached to the EC2 instance for the IAM role's credentials to be available to the instance. Without this attachment, the EC2 instance cannot assume the role or use its permissions to access the S3 bucket, even if the trust policy and bucket policy are correctly configured.

Answer

The VPC does not have an S3 VPC endpoint

Answer

The S3 bucket policy does not allow s3:ListBucket

Answer

The trust policy does not allow the S3 service to assume the role

Question 15

A large financial services company is migrating its on-premises data center to AWS. The network design must meet strict low-latency requirements for trading applications that communicate with external exchanges. The company has two AWS Direct Connect connections from two different providers to two different AWS Direct Connect locations in the same region. They have a VPC with multiple subnets across three Availability Zones. The trading applications are deployed on EC2 instances in private subnets and need to communicate with external exchanges over the Direct Connect connections. The company also requires high availability and automatic failover if one Direct Connect connection fails. The network team has configured two virtual interfaces (VIFs) for private connectivity to the VPC, one on each Direct Connect connection, and has set up BGP sessions. However, during a failover test, traffic does not fail over as expected. The team notices that the VPC route tables have static routes pointing to the virtual private gateway (VGW) with the same prefix, but no BGP routes are propagated. What is the most likely cause of the failover issue, and what should be done to resolve it?

Accepted Answer

The VPC route tables have static routes that are overriding the BGP routes. Remove the static routes and rely on BGP routes propagated through the VGW.. The failover issue occurs because static routes in the VPC route tables take precedence over BGP-propagated routes, even when the BGP session goes down. Since the static routes point to the virtual private gateway (VGW) with the same prefix, traffic continues to use the failed Direct Connect connection instead of failing over to the active one. Removing the static routes and enabling route propagation allows BGP to dynamically update the route tables based on the availability of the Direct Connect connections.

Answer

The VPC route tables do not have route propagation enabled for the VGW. Enable route propagation in the route tables.

Answer

The BGP timers are set too high, causing slow convergence. Reduce the BGP keepalive and hold timers.

Answer

The BGP configuration on the on-premises router is using AS_PATH prepending, making the backup path less preferred. Remove AS_PATH prepending.