ANS-C01 Network Design — Timed 20 Questions

Question 1

A company is deploying a critical application on AWS and needs to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet the encryption requirement?

20 minute time limit — choose an answer to begin.

Accepted Answer

Configure IPsec on the EC2 instances to encrypt traffic over the VPC peering connection.. For same-region VPC peering, AWS does not automatically encrypt traffic in transit. Traffic between VPCs in the same region over a peering connection is not encrypted by default. To meet the encryption requirement, you must configure IPsec on the EC2 instances to encrypt the traffic. Inter-region VPC peering automatically encrypts traffic, but that does not apply here.

Answer

No additional configuration is needed; VPC peering traffic is automatically encrypted.

Answer

Create a VPN connection between the two VPCs using the VPC peering connection.

Answer

Use AWS Transit Gateway with VPN attachments between the VPCs.

Question 2

A company has a VPC with multiple subnets and uses an AWS Direct Connect private VIF for connectivity to on-premises. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection, while internet traffic uses an internet gateway. Which configurations must be applied? (Choose TWO.)

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway.. Adding a specific route for the on-premises CIDR block pointing to the virtual private gateway (VGW) ensures that traffic destined for the on-premises network is directed over the Direct Connect private VIF. Option E is correct because adding a default route (0.0.0.0/0) pointing to the internet gateway ensures that internet-bound traffic takes that path. Together, these routes ensure that on-premises traffic uses the Direct Connect connection and internet traffic uses the internet gateway, preventing asymmetric routing.

Answer

Create a VPC endpoint for Direct Connect.

Answer

Deploy a NAT gateway in a public subnet.

Answer

Add a default route (0.0.0.0/0) pointing to the virtual private gateway.

Question 3

A company is deploying a critical application on AWS and needs to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet the encryption requirement?

20 minute time limit — choose an answer to begin.

Accepted Answer

Route 53 health checkers take multiple intervals to detect failure, and timeouts occur before failover completes.. Route 53 health checkers operate from multiple global locations and evaluate the /health endpoint every 10 seconds. However, to declare an endpoint unhealthy, Route 53 requires a configurable number of consecutive failures (default is 3), meaning it can take 30 seconds or more before the DNS record is updated to remove the failed region. During this detection window, some users whose DNS queries are answered by Route 53 before the failure is fully propagated may receive the IP of the failing ALB, leading to timeouts, while others who query after the failover complete successfully.

Answer

The ALB health check is misconfigured and returns a non-200 status code during normal operation.

Answer

The TTL on the Route 53 record is set too low, causing stale DNS responses.

Answer

Users have cached DNS records from the failed region, and Route 53 does not return healthy endpoints.

Question 4

A company is designing a hybrid network with an AWS Direct Connect connection. They have two virtual interfaces (VIFs): a private VIF to a VPC and a public VIF to access AWS public services. They want to ensure that traffic to Amazon S3 in the same region uses the Direct Connect connection and not the internet. Which configuration should be applied?

Accepted Answer

Advertise the S3 prefix via BGP on the public VIF and ensure the VPC route table has a more specific route for S3 pointing to the virtual private gateway.. To force on-premises traffic to Amazon S3 over Direct Connect, you must advertise the S3 IP prefix (e.g., 52.216.0.0/15) via BGP on the public VIF. The customer edge router learns this route from AWS and directs S3 traffic to the Direct Connect connection, bypassing the internet. No VPC route table changes are needed for on-premises traffic; the VPC route table reference in option A is a distractor.

Answer

Add a route in the VPC route table for S3 prefix with target as the internet gateway.

Answer

Create a VPC endpoint for S3 and attach it to the VPC route table.

Answer

Create a VPN connection to the VPC and route S3 traffic through the VPN.

Question 5

A company is designing a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application (web, application, database) across two Availability Zones. They also need a /20 subnet for a future expansion. Which TWO subnet CIDR allocations are valid and efficient?

Accepted Answer

10.0.0.0/20. (10.0.0.0/20) is correct because it provides 4096 IP addresses and leaves contiguous space for other subnets, such as the /20 future expansion. Option D (10.0.16.0/20) is also correct, as it is a valid /20 subnet within the 10.0.0.0/16 VPC that can be used for future expansion without overlapping with the subnets for the three-tier application. Together, these two /20 subnets cover 10.0.0.0/19, which can be further subdivided for the application tiers across two Availability Zones.

Answer

10.0.0.0/18

Answer

10.0.0.0/16

Answer

10.0.0.0/28

Question 6

A company is connecting its on-premises data center to AWS using AWS Direct Connect. The company has two Direct Connect connections and wants to ensure high availability. The on-premises network uses BGP to advertise routes to AWS. Which combination of steps should be taken to achieve the most resilient design? (Choose TWO.)

Accepted Answer

Provision two private virtual interfaces, one over each Direct Connect connection.. Provisioning two private virtual interfaces, one over each Direct Connect connection, ensures that if one connection or virtual interface fails, BGP can continue to route traffic over the other. This design provides redundancy at both the physical layer (connections) and the logical layer (virtual interfaces), which is essential for high availability.

Answer

Provision a single private virtual interface and use both connections for link aggregation.

Answer

Configure static routes instead of BGP to simplify the design.

Answer

Use the same BGP ASN for both connections.

Question 7

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs in different regions is encrypted. Which solution should be used?

Accepted Answer

Use AWS Transit Gateway inter-region peering with a VPN attachment between the transit gateways.. AWS Transit Gateway inter-region peering inherently encrypts traffic as it traverses the AWS global network. No separate VPN attachment is required; the peering connection itself provides encryption. Although the option wording includes 'with a VPN attachment', the core solution of using inter-region peering is what meets the requirement. Options A, C, and D do not provide encrypted cross-region VPC connectivity without additional configurations.

Answer

Use a Site-to-Site VPN from each VPC to the on-premises network and route traffic through the corporate network.

Answer

Use VPC Peering connections between the VPCs, which encrypts traffic automatically.

Answer

Use AWS PrivateLink to connect the VPCs across regions.

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an Amazon DynamoDB table. The company wants to avoid sending traffic over the internet. A VPC gateway endpoint for DynamoDB is created and attached to the route table of the private subnet. The EC2 instance has an IAM role that grants access to DynamoDB. However, the application running on the instance cannot connect to DynamoDB. The network team confirms that the route table has a route to the DynamoDB prefix list. What is the MOST likely cause?

Accepted Answer

The VPC does not have DNS resolution enabled, or the endpoint's private DNS option is disabled.. A VPC gateway endpoint for DynamoDB requires DNS resolution to resolve DynamoDB public hostnames to private IP addresses within the VPC. If DNS resolution is disabled in the VPC, the EC2 instance will resolve DynamoDB endpoints to public IPs, causing traffic to attempt internet routing rather than using the gateway endpoint. Note that gateway endpoints do not have a 'private DNS' option—that is for interface endpoints. The essential requirement is that the VPC's DNS resolution attribute (enableDnsSupport) is enabled.

Answer

The security group on the EC2 instance blocks outbound traffic to DynamoDB.

Answer

The IAM role does not include the dynamodb:PutItem action.

Answer

The route table does not have a route to the DynamoDB prefix list.

Question 9

An enterprise is migrating a critical application to AWS. The application requires low latency (under 5 ms) between two EC2 instances that are in different VPCs in the same region. The company also needs to ensure that traffic is encrypted in transit and that the connection is highly available. Which design should be used?

Accepted Answer

Configure VPC Peering and use an AWS Transit Gateway with VPN attachments. The closest correct design because AWS Transit Gateway with VPN attachments provides encrypted IPsec tunnels between VPCs, ensuring confidentiality in transit. The VPN attachments are highly available with multiple tunnels, and traffic stays within the AWS backbone, meeting the sub-5 ms latency requirement within the same region. Although the option mentions VPC Peering, it is redundant—Transit Gateway alone connects the VPCs without needing peering. The core components (Transit Gateway + VPN) satisfy both latency and encryption. Option A (Direct Connect) is for on-premises connectivity, not VPC-to-VPC. Option C (PrivateLink) is for accessing services via endpoints, not for VPC-to-VPC routing. Option D (Site-to-Site VPN) traverses the internet, introducing latency that fails the 5 ms requirement.

Answer

Use an AWS Direct Connect connection between the VPCs

Answer

Use VPC endpoints with PrivateLink

Answer

Establish an AWS Site-to-Site VPN between the VPCs

Question 10

A company is deploying a multi-tier web application in a VPC. The architecture includes an internet-facing Application Load Balancer (ALB) in public subnets, a fleet of EC2 instances in private subnets, and an Amazon RDS database in a separate private subnet. The security team requires that the web application logs be stored in an Amazon S3 bucket for compliance. The EC2 instances have an instance profile that grants write access to the S3 bucket. The EC2 instances are in a private subnet that does not have a route to the internet. The company wants to ensure that the EC2 instances can upload logs to the S3 bucket without traversing the internet. Which solution should they implement?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and add a route in the private subnet's route table pointing to the endpoint. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 over the AWS network without traversing the internet. Since the instances have an instance profile granting write access, adding a route in the private subnet's route table pointing to the gateway endpoint enables direct, private connectivity to S3. This meets the security requirement of keeping traffic within the AWS backbone.

Answer

Create a VPC Interface Endpoint for S3

Answer

Deploy a forward proxy server in a public subnet and configure the EC2 instances to use it

Answer

Attach a NAT Gateway to the private subnet and configure a route to the NAT Gateway

Question 11

A network engineer is designing a hybrid network with AWS Direct Connect and VPN backup. The goal is to maximize availability and ensure automatic failover. Which TWO steps should be taken? (Choose two.)

Accepted Answer

Configure BGP community tags to influence route preference. The correct steps are C and D. Option C: Configure BGP community tags to influence route preference. AWS uses BGP community tags such as 7224:7100 for VPN and 7224:7300 for Direct Connect to set local preference, making Direct Connect routes preferred. Option D: Use the same BGP ASN for both Direct Connect connections. This allows AS path prepending on the backup connection (e.g., prepend the ASN multiple times) to make it less preferred, ensuring Direct Connect is the primary path. Option A is incorrect because setting the VPN BGP hold timer to a higher value would delay failure detection, not improve failover speed. Option B is incorrect because enabling BGP as-prepending on the Direct Connect virtual interface would make Direct Connect routes less preferred, which is the opposite of the goal. Option E is incorrect because advertising more specific prefixes over the VPN would make VPN routes more specific and thus preferred over Direct Connect, making Direct Connect the backup rather than the primary path. Note that the question asks for three steps, but only two correct options are provided among the choices; however, C and D are the correct ones.

Answer

Set VPN BGP hold timer to a higher value than Direct Connect

Answer

Enable BGP as-prepending on the Direct Connect virtual interface

Answer

Advertise more specific prefixes over the VPN than over Direct Connect

Question 12

A company has a VPC with a CIDR block of 172.16.0.0/16. They have two subnets: 172.16.1.0/24 (public) and 172.16.2.0/24 (private). They launch an EC2 instance in the private subnet and an Application Load Balancer (ALB) in the public subnet. The ALB needs to forward traffic to the EC2 instance on port 80. The security group for the EC2 instance allows inbound traffic on port 80 from the security group of the ALB. The ALB health checks are failing. What is the most likely cause?

Accepted Answer

The ALB cannot route traffic to a private subnet. The most likely cause is that the Application Load Balancer cannot route traffic to an instance in a private subnet. By default, an ALB can only target instances in public subnets that have a route to an internet gateway. The private subnet lacks such a route, so the ALB cannot reach the EC2 instance for health checks, causing them to fail.

Answer

The private subnet does not have a route to a NAT gateway

Answer

The ALB is in a different VPC than the EC2 instance

Answer

The security group for the EC2 instance does not allow inbound traffic from the ALB's security group

Question 13

A company wants to connect multiple VPCs in different AWS accounts to on-premises networks using AWS Transit Gateway. Each VPC must be able to communicate with on-premises resources over AWS Direct Connect. What is the MINIMUM number of Transit Gateway attachments required if the company has 5 VPCs and 2 Direct Connect connections from different locations?

Accepted Answer

6. Each VPC requires a Transit Gateway attachment, so 5 VPC attachments are needed. Both Direct Connect connections can be associated with a single Direct Connect Gateway, which then requires only one Transit Gateway attachment (a Direct Connect Gateway attachment) to the Transit Gateway. Therefore, the minimum total is 5 VPC attachments + 1 Direct Connect Gateway attachment = 6 attachments.

Answer

7

Answer

5

Answer

8

Question 14

A company is designing a global network with multiple AWS Regions. The company needs to connect VPCs in different Regions with low latency and high throughput. Which THREE services should the company consider? (Choose three.)

Accepted Answer

AWS Transit Gateway inter-Region peering. AWS Transit Gateway inter-Region peering allows connecting Transit Gateways across regions for a hub-and-spoke architecture. VPC Peering supports direct, one-to-one connections between VPCs in different Regions. AWS Direct Connect with Direct Connect Gateway provides private connectivity from on-premises to multiple VPCs across regions. AWS Global Accelerator improves traffic routing but does not connect VPCs. Amazon CloudFront is a CDN, not a VPC connectivity service.

Answer

AWS Global Accelerator

Answer

Amazon CloudFront

Question 15

A company is designing a VPC with a CIDR block of 10.0.0.0/16. The VPC will host multiple environments (dev, test, prod) and requires subnets in three Availability Zones. The network engineer must allocate subnets efficiently while reserving at least 25% of the address space for future growth. What is the minimum subnet size that should be used for each environment?

Accepted Answer

/18. The VPC CIDR is 10.0.0.0/16, providing 65,536 total IP addresses. Reserving 25% for future growth leaves 49,152 addresses for current use across 3 environments (dev, test, prod) and 3 Availability Zones, totaling 9 subnets. Each subnet therefore needs at least 49,152 / 9 ≈ 5,462 addresses. Among the options, /20 (4,096 addresses) is too small, /21 (2,048) and /22 (1,024) are also insufficient. The only option that provides enough addresses is /18 (16,384 addresses), making it the minimum subnet size from the given choices.

Answer

/20

Answer

/22

Answer

/21

Question 16

A financial services company requires that all traffic between two VPCs in the same region be encrypted in transit. The VPCs are in separate AWS accounts and use non-overlapping CIDR blocks. Which solution meets the requirement with the least operational overhead?

Accepted Answer

Use VPC endpoints to connect the VPCs via AWS PrivateLink.. AWS PrivateLink (VPC endpoints) allows you to connect VPCs privately using AWS's internal network. Traffic between VPC endpoints and services is encrypted using TLS/SSL by default, meeting the encryption-in-transit requirement with minimal operational overhead. No additional VPN configurations or third-party appliances are needed, making it the simplest solution.

Answer

Set up a VPC peering connection and configure VPN encryption using a virtual private gateway in each VPC.

Answer

Attach both VPCs to an AWS Direct Connect connection.

Answer

Establish a VPC peering connection between the VPCs.

Question 17

A company wants to provide its employees with access to a set of internal web applications hosted in a VPC. The applications are accessed via an internet-facing ALB. Security requirements mandate that employees connect only from the corporate network (on-premises) and not from the public internet. Which solution meets these requirements?

Accepted Answer

Set up an AWS Client VPN endpoint in the VPC and make the ALB internal. Employees connect via the VPN.. Making the ALB internal ensures it is only reachable from within the VPC, and using an AWS Client VPN endpoint provides a secure, authenticated tunnel from the corporate network. This enforces the requirement that employees connect only from on-premises, as traffic must traverse the VPN and cannot originate from the public internet.

Answer

Make the ALB internal and use a NAT gateway to provide internet access.

Answer

Deploy a CloudFront distribution with an origin access identity pointing to the ALB.

Answer

Keep the ALB internet-facing but restrict access using a security group that allows only the corporate public IP range.

Question 18

A company is designing a Direct Connect solution for high availability. Which TWO actions meet the requirement for diverse physical paths?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Provisioning two Direct Connect connections at two different Direct Connect locations ensures physical path diversity, eliminating a single point of failure. Option C is correct because using a Transit Gateway with attachments to multiple Direct Connect gateways allows traffic to be routed over separate connections; when these connections are established at different Direct Connect locations, they provide the required diverse physical paths. (Note: The diversity comes from the connections being at different locations, not just from the use of Transit Gateway or multiple gateways.)

Answer

Provision two Direct Connect connections at the same Direct Connect location.

Answer

Provision a single Direct Connect connection and use link aggregation (LAG).

Answer

Use a single Direct Connect connection with a VPN backup.

Question 19

An engineer runs the command above for a subnet associated with this network ACL. The subnet's CIDR is 10.0.1.0/24. An EC2 instance in the subnet attempts to initiate an HTTPS connection to a server on the internet. What is the result?

Accepted Answer

The connection fails because the inbound HTTPS return traffic is denied by rule 200.. Based on the provided network ACL exhibit, inbound rule 200 denies all traffic (0.0.0.0/0, ALL traffic). Even though outbound HTTPS is allowed, the return traffic for the HTTPS connection (which is inbound) is evaluated against the inbound rules. Since rule 200 denies all inbound traffic, the return packets are dropped, causing the connection to fail. Network ACLs are stateless, so both inbound and outbound rules must explicitly allow the traffic.

Answer

The connection fails because the outbound rule does not allow HTTPS.

Answer

The connection succeeds because outbound traffic is allowed.

Answer

The connection succeeds because inbound rule 100 allows HTTPS from the subnet.

Question 20

A company is designing a VPC with public and private subnets in two Availability Zones. The private subnets host databases that must be accessible only from the application servers in the public subnets. Which VPC feature should be used to allow the application servers to access the databases while preventing direct internet access to the databases?

Accepted Answer

Attach a NAT Gateway in a public subnet and update the route table of the private subnets to point to the NAT Gateway for outbound traffic.. Although application servers in public subnets can reach databases in private subnets using private IPs within the VPC, a NAT Gateway enables instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while blocking inbound traffic from the internet. This meets the requirement to prevent direct internet access to the databases. The private subnet route table is updated to direct 0.0.0.0/0 traffic to the NAT Gateway, and because there is no route to an Internet Gateway, the databases remain inaccessible from the internet.

Answer

Create a VPC Peering connection between the public and private subnets.

Answer

Attach an Internet Gateway to the VPC and update the route table of the private subnets to point to the Internet Gateway.

Answer

Attach a Virtual Private Gateway to the VPC and update the route table of the private subnets.