ANS-C01 Network Design Practice Test 9 — 15 Questions

Question 1

A company is expanding its on-premises network to AWS using Direct Connect and VPN backup. They have two Direct Connect connections from different providers to two different Direct Connect locations in the same region. They have configured a private virtual interface (VIF) on each connection to a virtual private gateway (VGW) attached to a VPC. They have also configured a VPN connection as a backup. The company uses BGP to advertise the on-premises prefixes to AWS. They want to ensure that traffic is load-balanced across both Direct Connect connections under normal conditions and that the VPN is used only if both Direct Connect connections fail. They also want to minimize the cost of data transfer. Which BGP configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advertise the same prefixes over both Direct Connect connections with equal local preference, and prepend AS path on the VPN routes to make them less preferred. The correct configuration is to advertise the same prefixes over both Direct Connect connections with equal local preference, and prepend AS path on the VPN routes to make them less preferred. This ensures that under normal conditions, AWS sees two equally preferred paths via the Direct Connect connections, enabling load balancing (ECMP) across them. The AS path prepending on the VPN routes makes them less attractive, so the VPN is only used if both Direct Connect connections fail. This also minimizes data transfer costs because Direct Connect data transfer is cheaper than VPN data transfer over the internet.

Answer

Configure a single BGP session over both Direct Connect connections using the same virtual interface

Answer

Set a higher MED on one of the Direct Connect connections to make it the primary, and use the VPN as secondary

Answer

Advertise different on-premises prefixes over each Direct Connect connection and use the VPN for all traffic

Question 2

A company has a VPC with a CIDR block of 172.16.0.0/16. They have a public subnet (172.16.1.0/24) and a private subnet (172.16.2.0/24). They have an internet gateway attached to the public subnet. They launch an EC2 instance in the public subnet with a public IP address. The instance is running a web server on port 80. They also launch an EC2 instance in the private subnet that needs to download updates from the internet. The private subnet does not have a route to the internet. The company wants to provide internet access to the private instance in a secure and cost-effective manner. Which solution should they implement?

Accepted Answer

Create a NAT Gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT Gateway. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound connections to the internet (e.g., for downloading updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is secure because the NAT Gateway uses Elastic IPs and does not accept unsolicited inbound traffic, and it is cost-effective as it is a managed service with no maintenance overhead.

Answer

Create a VPC Gateway Endpoint for S3 and configure the private instance to use it

Answer

Create a forward proxy server in the public subnet and configure the private instance to use it

Answer

Create a NAT instance in the public subnet and configure the private instance to use it

Question 3

A company is designing a network for a real-time trading application that requires extremely low latency (sub-millisecond) between two EC2 instances located in the same AWS region. The instances are in different Availability Zones. The trading application uses a proprietary protocol over TCP. The company wants to minimize latency as much as possible. They are considering using a placement group. Which type of placement group should they use, and what network optimization should they apply?

Accepted Answer

Use a cluster placement group for both instances and enable enhanced networking (SR-IOV). A cluster placement group is the only placement group type that provides low-latency, high-bandwidth network performance by placing instances in a single Availability Zone within the same rack. Enhanced networking using SR-IOV (Single Root I/O Virtualization) bypasses the hypervisor's network stack, reducing per-packet processing latency and jitter, which is critical for sub-millisecond trading traffic over TCP.

Answer

Use a spread placement group and enable dedicated tenancy

Answer

Use a partition placement group and enable EBS-optimized instances

Answer

Use a cluster placement group but launch instances in different Availability Zones

Question 4

A network engineer is designing a hybrid network with AWS Direct Connect and VPN backup. The goal is to maximize availability and ensure automatic failover. Which TWO steps should be taken? (Choose two.)

Accepted Answer

Configure BGP community tags to influence route preference. Option C is correct because BGP community tags (such as the AWS-defined 7224:7300 for local preference) let the engineer influence route preference so that Direct Connect is preferred and the VPN is used only as a backup, which is essential for deterministic automatic failover. Option D is correct because using the same BGP ASN for both Direct Connect connections enables AWS to treat them as a single logical peer, supporting active/active or active/standby redundancy and consistent path selection across the hybrid links. Option A is wrong because a higher BGP hold timer on the VPN would slow failure detection, not improve automatic failover. Option B is wrong because AS-path prepending on the Direct Connect virtual interface would make Direct Connect less preferred, which is the opposite of the desired primary/backup design. Option E is wrong because advertising more specific prefixes over the VPN would attract traffic to the backup path instead of keeping Direct Connect primary.

Answer

Set VPN BGP hold timer to a higher value than Direct Connect

Answer

Enable BGP as-prepending on the Direct Connect virtual interface

Answer

Advertise more specific prefixes over the VPN than over Direct Connect

Question 5

A media company is designing a network for a new AWS environment. They have a VPC with public and private subnets in three Availability Zones. In the private subnets, they run a fleet of Amazon EC2 instances that process video files from an Amazon S3 bucket. The S3 bucket is in the same region. The company wants to ensure that all traffic to S3 stays within the AWS network and does not traverse the internet. They also need to allow the EC2 instances to access the internet for software updates, but only through a centralized NAT gateway. Currently, there is one NAT gateway in AZ1. The network engineer has created a VPC endpoint for S3 (Gateway type) and associated it with the route tables for the private subnets. However, the EC2 instances in AZ2 and AZ3 cannot reach the NAT gateway for internet access. What is the most likely cause?

Accepted Answer

The NAT gateway is only available in the AZ where it is deployed. The most likely cause is that the NAT gateway is only available in the AZ where it is deployed because the private subnets in AZ2 and AZ3 likely do not have a default route pointing to the NAT gateway. A NAT gateway is created in a specific AZ, and while it can be accessed from other AZs using cross-AZ routing, the route tables for those subnets must be explicitly configured with a 0.0.0.0/0 route to the NAT gateway. The S3 Gateway Endpoint adds a specific route for S3 traffic, which does not override the default route; therefore, adding the endpoint does not affect internet access. Option A is incorrect because the endpoint route is more specific for S3, not a default route. Options B and D are false because Gateway Endpoints are regional and do not require per-AZ creation, and NAT gateways can be used cross-AZ with proper routing.

Answer

The route table for private subnets now has a more specific route for S3 that overrides the default route to the NAT gateway

Answer

The VPC endpoint needs to be created in each Availability Zone

Answer

The S3 VPC endpoint is only accessible from the AZ where it was created

Question 6

A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?

Accepted Answer

The Transit Gateway route tables allow direct communication between application VPCs. The most likely reason east-west traffic is bypassing the Network Firewall is that the Transit Gateway route tables allow direct communication between application VPCs. For traffic to be inspected, it must be routed through the inspection VPC. If the application VPCs have routes in the same Transit Gateway route table that point directly to each other (e.g., a static route or a propagated route from the same VPC attachment), traffic will take that direct path and bypass the Network Firewall. Option B is incorrect because the inspection VPC can have subnets for east-west traffic; the issue is routing, not subnet design. Option C is incorrect because Network Firewall can inspect traffic between VPCs at high throughput. Option D is incorrect because Network Firewall is stateful and handles return traffic correctly.

Answer

The inspection VPC does not have a subnet for east-west traffic

Answer

Network Firewall cannot inspect traffic between VPCs at high throughput

Answer

Network Firewall is not stateful and cannot handle return traffic

Question 7

A startup wants to design a cost-effective network for a new application. They expect low traffic initially but need to handle sudden spikes. They plan to use Amazon EC2 instances behind an Application Load Balancer (ALB) in a single VPC. The application must be highly available within the region. The network engineer has proposed using two public subnets in two Availability Zones for the ALB, and two private subnets for the EC2 instances. The EC2 instances need to access the internet for updates. What is the MOST cost-effective and highly available design?

Accepted Answer

Use a NAT gateway in each public subnet (one per AZ). A NAT gateway in each public subnet (one per AZ) provides high availability and eliminates the single point of failure. If one AZ fails, the NAT gateway in the other AZ continues to serve the private subnet instances. NAT gateways are managed, scalable, and handle sudden traffic spikes automatically, making them the most cost-effective and highly available choice for this design.

Answer

Use a single NAT instance in one public subnet

Answer

Use a NAT instance in each public subnet (one per AZ)

Answer

Use a single NAT gateway in one public subnet

Question 8

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an Amazon RDS for MySQL DB instance in the private subnet. The DB instance needs to be accessed by an EC2 instance in the public subnet. The security group for the DB instance allows inbound traffic on port 3306 from the security group of the EC2 instance. However, the EC2 instance cannot connect to the DB instance. What is the most likely cause?

Accepted Answer

The network ACL for the private subnet is blocking inbound traffic. The most likely cause is that the network ACL (NACL) for the private subnet is blocking inbound traffic on port 3306. In Amazon VPC, each subnet has a default NACL that allows all inbound and outbound traffic by default, but if the NACL has been modified to block inbound traffic on port 3306, the connection from the EC2 instance will be denied. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit rules for both inbound and outbound traffic. The private subnet's route table automatically includes a local route to the entire VPC CIDR (10.0.0.0/16), which cannot be deleted, so a missing route is not a possible cause. The DB instance does not need a public IP for VPC internal communication, and the EC2 security group likely allows all outbound traffic by default.

Answer

The private subnet does not have a route to the public subnet

Answer

The security group for the EC2 instance does not allow outbound traffic

Answer

The DB instance does not have a public IP address

Question 9

A large e-commerce company is designing a network for a new microservices architecture. They have hundreds of microservices running on Amazon ECS with Fargate launch type. The services need to communicate with each other and with external APIs. The company wants to minimize network latency and maximize security. They also need to ensure that traffic between services does not leave the VPC. The network engineer is considering using AWS PrivateLink to allow services to communicate via VPC endpoints. However, they are concerned about the cost of creating an endpoint for each service. Which design should the network engineer recommend?

Accepted Answer

Use AWS App Mesh to enable service-to-service communication within the VPC. AWS App Mesh provides a service mesh that enables secure, low-latency communication between microservices within the same VPC using Envoy sidecar proxies. It handles service discovery, traffic routing, and encryption (mTLS) without requiring VPC endpoints or public IPs, keeping all traffic within the VPC and minimizing cost. This directly addresses the requirement for hundreds of services to communicate privately and efficiently.

Answer

Use a Transit Gateway to connect all services

Answer

Assign public IP addresses to the Fargate tasks and use security groups

Answer

Create a VPC endpoint for each microservice and use PrivateLink

Question 10

A company has a VPC with a CIDR block of 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private). They launch an EC2 instance in the private subnet and an Application Load Balancer (ALB) in the public subnet. The ALB needs to forward traffic to the EC2 instance on port 80. The security group for the EC2 instance allows inbound traffic on port 80 from the security group of the ALB. The ALB health checks are failing. What is the most likely cause?

Accepted Answer

The ALB cannot route traffic to a private subnet. The most likely cause is that the Application Load Balancer cannot route traffic to an instance in a private subnet. By default, an ALB can only target instances in public subnets that have a route to an internet gateway. The private subnet lacks such a route, so the ALB cannot reach the EC2 instance for health checks, causing them to fail.

Answer

The private subnet does not have a route to a NAT gateway

Answer

The ALB is in a different VPC than the EC2 instance

Answer

The security group for the EC2 instance does not allow inbound traffic from the ALB's security group

Question 11

A company is deploying an internet-facing application in AWS. The application must only accept traffic from specific IP addresses of business partners. Which AWS service should be used to enforce this restriction?

Accepted Answer

AWS WAF with an IP set rule. AWS WAF with an IP set rule is the correct choice because it operates at the application layer (Layer 7) and can inspect HTTP/HTTPS requests to allow or block traffic based on source IP addresses. This service is specifically designed to filter web traffic to internet-facing applications, making it ideal for enforcing IP-based restrictions from business partners. Network ACLs and Security Groups operate at the network and instance levels, respectively, and cannot provide the granular, application-layer control required for this use case.

Answer

Network ACLs with inbound allow rules

Answer

Security Groups with inbound allow rules

Answer

Amazon Route 53 geoproximity routing

Question 12

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which architecture meets these requirements?

Accepted Answer

Web servers in public subnets with an Internet Gateway; application servers in private subnets with a route to the NAT Gateway.. It places web servers in public subnets with an Internet Gateway (IGW) for direct internet access, while application servers reside in private subnets that lack a direct route to the IGW. The private subnets have a route to a NAT Gateway, allowing the application servers to initiate outbound internet connections (e.g., for updates) without being reachable from the internet. Security Groups on the application servers can further restrict inbound traffic to only the web servers' security group, ensuring the application tier is isolated.

Answer

All servers in private subnets; use a load balancer in a public subnet.

Answer

Web servers in private subnets; application servers in public subnets with an Internet Gateway.

Answer

All servers in public subnets; use Security Groups to restrict access.

Question 13

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The company wants to connect to multiple VPCs in the same AWS Region. What is the MOST cost-effective and scalable design?

Accepted Answer

Create a Transit Gateway, attach it to the Direct Connect Gateway using a Transit VIF, and attach each VPC to the Transit Gateway.. It uses a Transit Gateway (TGW) to interconnect multiple VPCs and a Direct Connect Gateway (DXGW) via a Transit VIF, which is the most cost-effective and scalable design. The Transit VIF allows a single Direct Connect connection to be shared across many VPCs through the TGW, avoiding the need for multiple private VIFs or complex peering arrangements. This design scales to hundreds of VPCs and reduces operational overhead by centralizing routing.

Answer

Provision multiple private VIFs, each connected to a different VPC.

Answer

Create a Direct Connect Gateway and associate each VPC's Virtual Private Gateway to it using a private VIF.

Answer

Use a private VIF to connect to a Virtual Private Gateway in one VPC and use VPC Peering to reach other VPCs.

Question 14

A company wants to ensure that all traffic to and from its VPC is inspected by a security appliance. The appliance must be able to inspect traffic between subnets within the VPC. Which architecture should the company use?

Accepted Answer

Use a Gateway Load Balancer with security appliances in a separate inspection VPC and configure route tables to send traffic to the GWLB endpoint.. A Gateway Load Balancer (GWLB) with security appliances in a separate inspection VPC allows you to centrally inspect all traffic, including east-west traffic between subnets within the same VPC. By configuring route tables to send traffic to the GWLB endpoint, you can enforce stateful inspection for all inbound, outbound, and inter-subnet traffic without introducing a single point of failure or complex routing.

Answer

Deploy a NAT Gateway and route all internet traffic through it.

Answer

Create a VPC Peering connection to a centralized VPC with security appliances.

Answer

Attach an Internet Gateway and use Security Groups to log traffic.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. The company needs to add a new subnet for a container cluster that requires at least 2000 IP addresses. Which TWO subnet CIDR blocks meet this requirement? (Choose two.)

Accepted Answer

10.0.0.0/20. Option C (10.0.0.0/20) is correct because a /20 subnet contains 2^(32-20) = 4096 total IP addresses, which exceeds the 2000-address requirement. Option D (10.0.0.0/21) is correct because a /21 subnet contains 2^(32-21) = 2048 total IP addresses, which also satisfies the minimum of 2000 addresses. Both CIDR blocks also fall within the VPC range of 10.0.0.0/16. Options A (10.0.0.0/24) and B (10.0.0.0/25) provide only 256 and 128 addresses respectively, far below the requirement, and option E (10.0.0.0/26) provides only 64 addresses, so none of these smaller subnets qualify.

Answer

10.0.0.0/24

Answer

10.0.0.0/25

Answer

10.0.0.0/26