20+ practice questions focused on Network Design — one of the most tested topics on the AWS Certified Advanced Networking Specialty ANS-C01 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Network Design PracticeA company is deploying a critical application on AWS and needs to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet the encryption requirement?
Explanation: For same-region VPC peering, AWS does not automatically encrypt traffic in transit. Traffic between VPCs in the same region over a peering connection is not encrypted by default. To meet the encryption requirement, you must configure IPsec on the EC2 instances to encrypt the traffic. Inter-region VPC peering automatically encrypts traffic, but that does not apply here.
A company has a VPC with multiple subnets and uses an AWS Direct Connect private VIF for connectivity to on-premises. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection, while internet traffic uses an internet gateway. Which configurations must be applied? (Choose TWO.)
Explanation: Adding a specific route for the on-premises CIDR block pointing to the virtual private gateway (VGW) ensures that traffic destined for the on-premises network is directed over the Direct Connect private VIF. Option E is correct because adding a default route (0.0.0.0/0) pointing to the internet gateway ensures that internet-bound traffic takes that path. Together, these routes ensure that on-premises traffic uses the Direct Connect connection and internet traffic uses the internet gateway, preventing asymmetric routing.
A company is deploying a critical application across three AWS Regions using an active-active architecture with Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) as the endpoint. The application health checks are configured to check the /health endpoint every 10 seconds. During a regional failure, some users experience timeouts while others are redirected correctly. What is the most likely cause?
Explanation: Route 53 health checkers operate from multiple global locations and evaluate the /health endpoint every 10 seconds. However, to declare an endpoint unhealthy, Route 53 requires a configurable number of consecutive failures (default is 3), meaning it can take 30 seconds or more before the DNS record is updated to remove the failed region. During this detection window, some users whose DNS queries are answered by Route 53 before the failure is fully propagated may receive the IP of the failing ALB, leading to timeouts, while others who query after the failover complete successfully.
A company is designing a hybrid network with an AWS Direct Connect connection. They have two virtual interfaces (VIFs): a private VIF to a VPC and a public VIF to access AWS public services. They want to ensure that traffic to Amazon S3 in the same region uses the Direct Connect connection and not the internet. Which configuration should be applied?
Explanation: To force on-premises traffic to Amazon S3 over Direct Connect, you must advertise the S3 IP prefix (e.g., 52.216.0.0/15) via BGP on the public VIF. The customer edge router learns this route from AWS and directs S3 traffic to the Direct Connect connection, bypassing the internet. No VPC route table changes are needed for on-premises traffic; the VPC route table reference in option A is a distractor.
A company is designing a VPC with a CIDR of 10.0.0.0/16. They need to create subnets for a three-tier application (web, application, database) across two Availability Zones. They also need a /20 subnet for a future expansion. Which TWO subnet CIDR allocations are valid and efficient?
Explanation: (10.0.0.0/20) is correct because it provides 4096 IP addresses and leaves contiguous space for other subnets, such as the /20 future expansion. Option D (10.0.16.0/20) is also correct, as it is a valid /20 subnet within the 10.0.0.0/16 VPC that can be used for future expansion without overlapping with the subnets for the three-tier application. Together, these two /20 subnets cover 10.0.0.0/19, which can be further subdivided for the application tiers across two Availability Zones.
+15 more Network Design questions available
Practice all Network Design questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Network Design. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Network Design questions on the ANS-C01 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Network Design is tested as part of the AWS Certified Advanced Networking Specialty ANS-C01 blueprint. Practicing with targeted Network Design questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free ANS-C01 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Network Design is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Network Design practice session with instant scoring and detailed explanations.
Start Network Design Practice →