Network Design practice questions

No additional configuration is needed; VPC peering traffic is automatically encrypted.

Why wrong: Incorrect. Same-region VPC peering traffic is not automatically encrypted. Only inter-region VPC peering is encrypted automatically by AWS.

Create a VPN connection between the two VPCs using the VPC peering connection.

Why wrong: Incorrect. You cannot create a VPN connection using a VPC peering connection; VPN requires a virtual private gateway or transit gateway.

Use AWS Transit Gateway with VPN attachments between the VPCs.

Why wrong: Transit Gateway does not natively encrypt traffic between VPCs attached to it within the same region; it acts as a routing hub. While VPNs can attach to a Transit Gateway, establishing VPN attachments *between VPCs* in the same region via Transit Gateway is an inefficient and non-standard approach for encrypting intra-region VPC-to-VPC communication. This option is tempting because Transit Gateway centralises connectivity and can integrate with VPNs for hybrid or cross-region encryption, making it suitable for complex network topologies or connecting to on-premises data centres.

Create a VPC endpoint for Direct Connect.

Why wrong: Incorrect. A VPC endpoint for Direct Connect is not a thing; Direct Connect uses a VGW, not an endpoint.

Deploy a NAT gateway in a public subnet.

Why wrong: Incorrect. A NAT gateway is used for outbound internet traffic from private subnets, but it does not affect routing for on-premises traffic.

Add a default route (0.0.0.0/0) pointing to the virtual private gateway.

Why wrong: Incorrect. Adding a default route to the VGW would send all traffic (including internet-bound) over Direct Connect, which is not desired.

The ALB health check is misconfigured and returns a non-200 status code during normal operation.

Why wrong: The ALB health check is separate from Route 53 health check.

The TTL on the Route 53 record is set too low, causing stale DNS responses.

Why wrong: Low TTL reduces caching, not timeouts.

Users have cached DNS records from the failed region, and Route 53 does not return healthy endpoints.

Why wrong: DNS caching can cause delays but not timeouts if failover is working.

Add a route in the VPC route table for S3 prefix with target as the internet gateway.

Why wrong: This would send traffic over the internet.

Create a VPC endpoint for S3 and attach it to the VPC route table.

Why wrong: VPC endpoints use private IPs, not the public VIF.

Create a VPN connection to the VPC and route S3 traffic through the VPN.

Why wrong: VPN adds complexity and cost; Direct Connect is preferred.

10.0.0.0/18

Why wrong: Overlaps with other subnets if used with A or D.

10.0.0.0/16

Why wrong: This is the entire VPC CIDR, not a subnet.

10.0.0.0/28

Why wrong: Too small and wasteful for expansion.

Provision a single private virtual interface and use both connections for link aggregation.

Why wrong: A single VIF is a single point of failure.

Configure static routes instead of BGP to simplify the design.

Why wrong: Static routes are less resilient and do not provide fast failover.

Use the same BGP ASN for both connections.

Why wrong: Using the same ASN is allowed and does not affect redundancy, but it's not a step for high availability.

Use a Site-to-Site VPN from each VPC to the on-premises network and route traffic through the corporate network.

Why wrong: Incorrect: Routing traffic through on-premises networks adds latency and complexity. Site-to-Site VPNs do not directly provide encrypted cross-region VPC connectivity without traversing the corporate network.

Use VPC Peering connections between the VPCs, which encrypts traffic automatically.

Why wrong: Incorrect: VPC Peering does not automatically encrypt traffic across regions. It relies on the underlying network, and encryption is not guaranteed unless additional measures like VPN are used.

Use AWS PrivateLink to connect the VPCs across regions.

Why wrong: Incorrect: AWS PrivateLink is used for accessing services across VPCs, not for connecting VPCs to each other. It does not provide cross-region VPC-to-VPC connectivity.

The security group on the EC2 instance blocks outbound traffic to DynamoDB.

Why wrong: Gateway endpoints do not use security groups.

The IAM role does not include the dynamodb:PutItem action.

Why wrong: IAM role is correct.

The route table does not have a route to the DynamoDB prefix list.

Why wrong: Route is present.

Use an AWS Direct Connect connection between the VPCs

Why wrong: Direct Connect is designed for dedicated on-premises connectivity, not VPC-to-VPC, and does not inherently encrypt traffic.

Use VPC endpoints with PrivateLink

Why wrong: PrivateLink allows access to services via VPC endpoints, but does not route traffic between entire VPCs and does not inherently encrypt all traffic.

Establish an AWS Site-to-Site VPN between the VPCs

Why wrong: Site-to-Site VPN traverses the public internet, adding latency that likely exceeds 5 ms, and it is not optimized for VPC-to-VPC connectivity.

Create a VPC Interface Endpoint for S3

Why wrong: VPC Interface Endpoints for S3 are supported via AWS PrivateLink, but they are more expensive and require additional configuration. Gateway Endpoints are the simpler and cost-effective choice for private S3 access from within a VPC.

Deploy a forward proxy server in a public subnet and configure the EC2 instances to use it

Why wrong: Using a forward proxy server would introduce an additional hop and potential latency, and still require the proxy to have internet access, which does not meet the requirement to avoid traversing the internet.

Attach a NAT Gateway to the private subnet and configure a route to the NAT Gateway

Why wrong: A NAT Gateway provides internet access to private subnets, but it uses the internet to reach S3, which violates the requirement to avoid traversing the internet.

Set VPN BGP hold timer to a higher value than Direct Connect

Why wrong: Setting the VPN BGP hold timer to a higher value than Direct Connect would cause the VPN to take longer to detect a failure, delaying failover and making it less effective.

Enable BGP as-prepending on the Direct Connect virtual interface

Why wrong: BGP as-prepending on the Direct Connect virtual interface would make Direct Connect routes less preferred (longer AS path), which would favor the VPN instead, contrary to the design goal.

Advertise more specific prefixes over the VPN than over Direct Connect

Why wrong: Advertising more specific prefixes over VPN would make VPN routes more specific and thus preferred over Direct Connect. For the goal of Direct Connect being primary, you should advertise the same prefixes or more specific prefixes over Direct Connect, not VPN.

The private subnet does not have a route to a NAT gateway

Why wrong: Incorrect. A NAT gateway is used for outbound internet access from private subnets and is not required for ALB health checks.

The ALB is in a different VPC than the EC2 instance

Why wrong: Incorrect. The stem states that the ALB and EC2 instance are in the same VPC.

The security group for the EC2 instance does not allow inbound traffic from the ALB's security group

Why wrong: Incorrect. The stem explicitly states that the security group allows inbound traffic on port 80 from the ALB's security group, so a security group misconfiguration is not the issue.

7

Why wrong: Incorrect. This would be the count if each Direct Connect connection required its own attachment, but they can share one Direct Connect Gateway attachment.

5

Why wrong: Incorrect. This misses the Direct Connect Gateway attachment entirely.

8

Why wrong: Incorrect. This overcounts attachments, possibly assuming multiple Direct Connect Gateway attachments or extra VPC attachments.

AWS Global Accelerator

Why wrong: Incorrect. AWS Global Accelerator improves availability and performance of applications by directing traffic over the AWS global network, but it does not establish direct connectivity between VPCs.

Amazon CloudFront

Why wrong: Incorrect. Amazon CloudFront is a content delivery network (CDN) for distributing content to end users, not for interconnecting VPCs.

/20

Why wrong: Incorrect. A /20 subnet provides only 4,096 addresses, which is less than the required ~5,462 per subnet.

/22

Why wrong: Incorrect. A /22 subnet provides only 1,024 addresses, far too few.

/21

Why wrong: Incorrect. A /21 subnet provides only 2,048 addresses, also insufficient.

Set up a VPC peering connection and configure VPN encryption using a virtual private gateway in each VPC.

Why wrong: Incorrect. VPC peering does not support VPN encryption via virtual private gateways; this configuration is not valid.

Attach both VPCs to an AWS Direct Connect connection.

Why wrong: Incorrect. AWS Direct Connect does not encrypt traffic by default; additional VPN configurations are needed, increasing overhead.

Establish a VPC peering connection between the VPCs.

Why wrong: Incorrect. VPC peering alone does not encrypt traffic; it only provides private routing.

Make the ALB internal and use a NAT gateway to provide internet access.

Why wrong: Internal ALB is not reachable from on-premises without a VPN/Direct Connect.

Deploy a CloudFront distribution with an origin access identity pointing to the ALB.

Why wrong: CloudFront does not replace VPN for on-premises-only access.

Keep the ALB internet-facing but restrict access using a security group that allows only the corporate public IP range.

Why wrong: Security groups allow IP ranges, but this still exposes the ALB to the internet and is not secure if IPs change.

Provision two Direct Connect connections at the same Direct Connect location.

Why wrong: Same location shares physical infrastructure.

Provision a single Direct Connect connection and use link aggregation (LAG).

Why wrong: LAG uses multiple fibers within the same connection, not diverse physical paths.

Use a single Direct Connect connection with a VPN backup.

Why wrong: VPN backup provides logical diversity but not physical path diversity.

The connection fails because the outbound rule does not allow HTTPS.

Why wrong: Outbound rule allows ephemeral ports; HTTPS outbound is allowed by default outbound allow (since no outbound deny).

The connection succeeds because outbound traffic is allowed.

Why wrong: Outbound traffic is allowed, but inbound return traffic is blocked.

The connection succeeds because inbound rule 100 allows HTTPS from the subnet.

Why wrong: Rule 100 allows HTTPS from subnet CIDR as source, but return traffic comes from internet, not subnet.

Create a VPC Peering connection between the public and private subnets.

Why wrong: A VPC Peering connection establishes routing between separate VPCs, not between subnets within the same VPC, so it cannot restrict traffic between the public and private subnets described in the single VPC. This option is tempting because VPC Peering is commonly used to connect isolated networks securely, and it would be correct for linking databases in a separate VPC to application servers in another VPC, but here the subnets share the same VPC route table, making peering irrelevant.

Attach an Internet Gateway to the VPC and update the route table of the private subnets to point to the Internet Gateway.

Why wrong: An Internet Gateway allows inbound and outbound internet access, which would expose the databases to the internet.

Attach a Virtual Private Gateway to the VPC and update the route table of the private subnets.

Why wrong: A Virtual Private Gateway is used for VPN connections to on-premises networks, not for internet access.