CCNA Network Design Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because an internal ALB in a private subnet cannot receive traffic directly from the internet; a NAT gateway provides outbound internet access for private instances, not inbound, so the web tier would be unreachable. Option B is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot perform content-based routing or inspect application-layer protocols, making it unsuitable for a three-tier web application that typically requires HTTP/HTTPS path-based routing. Option D is wrong because an internet-facing ALB must be placed in a public subnet to have a public IP address and route traffic from the internet; placing it in a private subnet would prevent it from receiving internet traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling cross-zone load balancing on the ALB is irrelevant (ALBs do not have a cross-zone load balancing toggle; they always distribute across AZs based on the target group settings), and setting the idle timeout on the NLB does not address the ALB's fixed response timeout requirement. Option C is wrong because disabling cross-zone load balancing on the NLB would prevent even distribution of traffic across AZs, undermining high availability, and the ALB does not have a 'connection timeout' setting (it uses idle timeout). Option D is wrong because the ALB does not have a cross-zone load balancing setting to enable (it is inherent to its operation), and setting a 'connection timeout' on the NLB is not a valid configuration (NLBs use idle timeout, not connection timeout).

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the policy does not explicitly deny deletion; it allows all actions on VPN resources, including deletion. Option C is wrong because the policy uses a wildcard (`*vpn*`) that covers VPN connections, VPN gateways, and customer gateways, not just VPN connections. Option D is wrong because the policy grants full management actions (e.g., `CreateVpnConnection`, `DeleteVpnConnection`), not just read-only access like `DescribeVpnConnections`.

Why this answer

How to eliminate wrong answers

Option B is wrong because a NAT instance must be placed in a public subnet (not a private subnet) to have a route to an Internet Gateway; placing it in a private subnet would prevent it from reaching the internet. Option C is wrong because a VPC Gateway Endpoint for S3 only provides private connectivity to S3 and DynamoDB, not general internet access. Option D is wrong because a default route to an Internet Gateway in a private subnet would directly expose the instance to the internet (since the IGW allows bidirectional traffic), violating the security requirement of keeping the instance private.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a site-to-site VPN backup over the internet introduces higher latency, lower reliability, and additional operational overhead compared to a second Direct Connect connection, and it does not meet the requirement to minimize operational overhead. Option C is wrong because two VIFs on the same Direct Connect connection share the same physical link and AWS device, creating a single point of failure that violates high availability. Option D is wrong because two Direct Connect connections to the same location share the same facility and potential upstream failures, lacking the geographic diversity needed for true high availability.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling DNS resolution does not resolve CIDR overlap; DNS resolution only allows private DNS hostname resolution across peered VPCs, not address space conflicts. Option C is wrong because AWS Transit Gateway also requires non-overlapping CIDRs for direct routing between attached VPCs; it does not support overlapping CIDRs without additional NAT or translation mechanisms. Option D is wrong because a Direct Connect Gateway is used for connecting on-premises networks to multiple VPCs, not for VPC-to-VPC peering, and it does not ignore CIDR overlap—overlapping CIDRs still cause routing conflicts.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC peering requires non-overlapping CIDR blocks; overlapping CIDRs (10.0.0.0/16 on both sides) prevent VPC peering from being established. Option B is wrong because a Direct Connect Gateway does not resolve overlapping CIDR conflicts; it simply extends connectivity and would still cause routing ambiguity between the on-premises network and the VPC. Option D is wrong because creating a new VPC and migrating workloads is not cost-effective; it incurs significant operational overhead and downtime, whereas a Transit Gateway with route table separation provides a cheaper, less disruptive solution.

Why this answer

How to eliminate wrong answers

Option B is wrong because geolocation routing directs traffic based on the user's geographic location, not latency, and does not inherently support Active-Active failover across regions; it can still send traffic to an unhealthy endpoint if health checks are not properly associated, but the core issue is that it doesn't optimize for latency. Option C is wrong because weighted routing distributes traffic based on assigned weights, not latency, and while it can use health checks, it does not provide the latency-based optimization required for an Active-Active multi-region application. Option D is wrong because failover routing is designed for Active-Passive setups, where only one endpoint is active at a time; it does not support Active-Active traffic distribution across multiple regions.

Why this answer

How to eliminate wrong answers

Option A is wrong because a Classic Load Balancer (CLB) is a legacy option that lacks advanced Layer 7 features and does not provide static IP addresses for the application tier, making it unsuitable for modern multi-tier architectures. Option C is wrong because AWS Global Accelerator is designed for global traffic optimization and static IP assignment at the edge, not for distributing traffic across EC2 instances within a single Region's web tier; additionally, a Classic Load Balancer for the application tier does not provide static IP addresses. Option D is wrong because a Network Load Balancer for the web tier is unnecessary — it operates at Layer 4 and does not offer the Layer 7 features (e.g., path-based routing, host-based routing) typically required for a web tier, while an Application Load Balancer for the application tier does not provide static IP addresses, which is the explicit requirement.

Why this answer

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it is a network transit hub that interconnects VPCs and on-premises networks, but it does not provide the physical dedicated connection itself; it relies on an underlying transport like Direct Connect or VPN. Option C (AWS Client VPN) is wrong because it is a managed remote access VPN solution for individual clients, not a dedicated site-to-site connection, and it does not support multiple VLANs or offer a 99.99% SLA. Option D (AWS Site-to-Site VPN) is wrong because it uses the public internet and IPsec tunnels, which cannot guarantee a 99.99% SLA and does not provide a dedicated, private connection with consistent latency.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a single EC2 instance with an Elastic IP address in one Availability Zone is a single point of failure; if the instance or AZ fails, the application becomes unavailable, and it cannot scale horizontally. Option C is wrong because deploying EC2 instances in a single Availability Zone with Route 53 weighted routing does not provide fault tolerance; if that AZ fails, all instances are lost, and weighted routing cannot reroute traffic to other AZs. Option D is wrong because a Network Load Balancer with a single EC2 instance per AZ does not provide horizontal scalability; each AZ has only one instance, so you cannot scale out by adding more instances within an AZ, and the design lacks the elasticity of an Auto Scaling group.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because VPC Endpoints (Gateway or Interface endpoints) are used to privately connect a VPC to AWS services (like S3 or DynamoDB) or to other VPCs via PrivateLink, not to route traffic between two VPCs' CIDR blocks; they cannot replace a peering or transit routing function. Option C is wrong because AWS Transit Gateway provides centralized routing between VPCs but does not inherently encrypt traffic; it only routes traffic over the AWS backbone, and encryption would require an additional VPN attachment or IPsec configuration. Option D is wrong because an AWS Site-to-Site VPN connection is designed to connect an on-premises network to a VPC, not to connect two VPCs directly; using it for VPC-to-VPC connectivity would require complex, non-standard configurations and still relies on internet gateways or virtual private gateways, potentially exposing traffic to the public internet.

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC Peering connects separate VPCs, not subnets within the same VPC; subnets in the same VPC are already routable via the VPC's route tables. Option B is wrong because assigning a public IP to the database violates the requirement to not assign a public IP, and it exposes the database to the internet unnecessarily, increasing the attack surface. Option D is wrong because a VPN connection is used to connect on-premises networks or remote clients to a VPC, not to connect two instances within the same VPC, and it adds unnecessary complexity and latency.

Why this answer

How to eliminate wrong answers

Option A is wrong because using a single route table for all attachments would allow traffic to flow between development and production VPCs, and network ACLs are stateless, cumbersome to manage at scale, and cannot provide the same isolation as separate route tables. Option B is wrong because VPC peering creates a full mesh that does not scale (O(n²) connections) and does not natively support transitive routing, requiring a Direct Connect gateway for on-premises but still lacking isolation between VPCs without complex route table manipulation. Option C is wrong because establishing a VPN from each VPC to on-premises over Direct Connect adds unnecessary cost and complexity (per-VPN tunnel charges, BGP configuration), and does not provide a mechanism for VPC-to-VPC communication without additional transit or peering.

Why this answer

How to eliminate wrong answers

Option A is wrong because CloudFront with multiple origins and origin failover is designed for static and dynamic content delivery with failover, but it does not provide the low-latency, active-active traffic routing across regions that Global Accelerator offers; CloudFront's origin failover is primarily for origin redundancy, not real-time multi-region load balancing. Option B is wrong because Route 53 latency-based routing with health checks can route traffic to the region with the lowest latency, but it relies on DNS caching and TTLs, which can cause delayed failover and inconsistent routing, making it unsuitable for the sub-second failover and active-active requirements of this architecture. Option C is wrong because a single ALB cannot have target groups across different regions; cross-zone load balancing only distributes traffic across targets within the same region and Availability Zone, not across regions.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (AWS CloudTrail) is wrong because it records API calls and management events, not network traffic flows; it cannot capture the actual IP packets or metadata between EC2 instances. Option C (AWS Config) is wrong because it evaluates resource configurations and compliance rules, not network traffic; it tracks changes to resources like security groups but does not log traffic flows. Option D (Amazon CloudWatch Metrics) is wrong because it collects performance metrics (e.g., CPU, network throughput) but does not capture per-flow metadata such as source/destination IPs, ports, or protocols needed for traffic analysis.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because VPC endpoints and AWS PrivateLink are used for private connectivity to services over the AWS network, not for providing static IP addresses or accelerating traffic with Global Accelerator. Option C is wrong because Amazon CloudFront does not provide static IP addresses; it uses a distributed network of edge locations with dynamic IPs, and it does not preserve the original client IP by default without additional configuration like X-Forwarded-For headers, which are not sufficient for backend log preservation in this context. Option D is wrong because Application Load Balancers as endpoints in Global Accelerator do not preserve the client IP address; Global Accelerator terminates the original client connection and replaces the source IP with its own, and while X-Forwarded-For headers can carry the client IP, the requirement is for the actual source IP to be preserved in the packet, which ALBs cannot achieve with Global Accelerator.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing dev and prod in the same subnet and relying on security groups does not provide subnet-level isolation; security groups are stateful and applied per instance, so they cannot prevent traffic between instances in the same subnet that are not associated with the security group, and they do not filter traffic at the subnet boundary. Option B is wrong because using a single subnet with network ACLs is ineffective; network ACLs are applied at the subnet level, but if all instances are in the same subnet, the ACL applies equally to all traffic entering or leaving that subnet, so it cannot differentiate between dev and prod traffic within the same subnet. Option D is wrong because creating two VPCs with VPC peering is an over-engineered solution that adds complexity (e.g., route table entries, cross-account considerations) and does not meet the requirement of isolating environments within the same VPC; VPC peering also does not provide native filtering—you would still need separate ACLs or security groups to limit communication.

Why this answer

How to eliminate wrong answers

Option A is wrong because a NAT instance requires manual management (e.g., patching, scaling, failover) and introduces higher operational overhead compared to a managed NAT Gateway, contradicting the 'least operational overhead' requirement. Option B is wrong because attaching an Internet Gateway and adding a default route to it in the private subnet route table would directly expose private instances to the internet, allowing unsolicited inbound traffic and violating the requirement to prevent inbound traffic. Option D is wrong because a VPC Gateway Endpoint for Amazon S3 only provides private connectivity to S3, not general outbound internet access to other destinations (e.g., HTTP/HTTPS to the internet), so it does not meet the requirement for outbound internet access.

Why this answer

How to eliminate wrong answers

Option A is wrong because changing from static to dynamic routing (e.g., BGP) addresses routing protocol convergence and failover, not intermittent connectivity caused by MTU or fragmentation; the VPN is already up, so routing is functional. Option C is wrong because enabling BGP route propagation on the transit VPC's route tables would only affect route advertisement and learning, not packet-level issues like fragmentation; the routes are already in place since the VPN is established. Option D is wrong because deploying a new transit VPC in eu-west-1 would add complexity and cost without addressing the root cause; the existing transit VPC in us-east-1 can handle cross-region traffic, and the problem is likely MTU-related, not latency or regional proximity.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator uses Anycast IPs and the AWS global network to route traffic to the nearest healthy endpoint, but it does not use latency measurements to select the closest ALB; it relies on edge location proximity and endpoint health. Option C is wrong because Application Load Balancer cross-zone load balancing distributes traffic evenly across targets within a single region, not across regions. Option D is wrong because Amazon CloudFront is a content delivery network that caches content at edge locations and does not route traffic to the closest ALB based on latency; it uses DNS and edge caches to serve content, not dynamic latency-based routing to origin ALBs.

Why this answer

How to eliminate wrong answers

Option B is wrong because the NAT Gateway is a Layer 3 device that forwards traffic based on route tables; it does not perform routing decisions or have a configuration to 'route traffic to the VPN' — the route table controls where traffic goes. Option C is wrong because the internet gateway is correctly attached (the private instances can access the internet), so its attachment status is not the issue. Option D is wrong because even if the VPN connection is not advertising the on-premises CIDR via BGP, the VPC route table must still have a static or propagated route to the VGW; the absence of BGP advertisement would prevent route propagation, but the core problem is the missing route in the private subnet route table.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an Internet Gateway (IGW) and NAT gateway are used for internet-bound traffic, not for private connectivity to on-premises networks via Direct Connect. Option B is wrong because VPC peering connects two VPCs within AWS, not a VPC to an on-premises network; it cannot extend beyond the AWS cloud. Option D is wrong because while a Transit Gateway can simplify multi-VPC and Direct Connect attachments, it is not strictly required for a single VPC connection; the question asks for the component that must be configured, and a VGW is the mandatory component for Direct Connect private VIF connectivity.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations and does not provide DNS-level routing or health-check-based failover for arbitrary endpoints; it is designed for static and dynamic content acceleration, not for global DNS routing with active-active failover. Option B is wrong because Elastic Load Balancer (ELB) operates within a single AWS region and cannot route traffic globally across multiple regions or perform DNS-based latency routing; it distributes traffic only within a single VPC or set of targets in one region. Option D is wrong because AWS Global Accelerator uses Anycast IP addresses and the AWS global network to improve performance, but it does not provide DNS-level routing policies like latency-based routing; it relies on static IP addresses and health checks for endpoint failover, but the question specifically asks for a global DNS service, which is Route 53's domain.

Why this answer

How to eliminate wrong answers

Option B is wrong because VPC peering connections cannot extend connectivity to on-premises networks; they only connect VPCs within AWS and do not support VPN or Direct Connect attachments. Option C is wrong because creating a Direct Connect Gateway and attaching the VPC does not solve the problem of the on-premises data center lacking BGP support; a Direct Connect Gateway still requires BGP for routing between the on-premises network and AWS. Option D is wrong because VPN CloudHub is designed for connecting multiple remote networks (e.g., branch offices) using dynamic BGP routing, not for extending a single Direct Connect VPC to a non-BGP data center, and it does not integrate with the existing Direct Connect connection.

Why this answer

How to eliminate wrong answers

Option A is wrong because the destination port is 80, not 443; the flow log shows 'dstport=80'. Option B is wrong because the protocol is TCP (protocol number 6), not UDP; UDP is protocol 17. Option C is wrong because the source IP address is 10.0.2.10, not 10.0.2.10; the flow log shows 'srcaddr=10.0.2.10', which matches the option, but the question asks for the correct statement, and Option D is the only fully accurate description of the traffic flow.

Why this answer

How to eliminate wrong answers

Option A is wrong because 10.0.0.0/24 is a subnet of the existing 10.0.0.0/16 CIDR, which would cause an overlap and is not allowed when adding a secondary CIDR to a VPC. Option C is wrong because 10.0.1.0/24 is also a subnet within the existing 10.0.0.0/16 range, resulting in an overlap. Option D is wrong because 10.0.0.0/8 is a supernet that contains the existing 10.0.0.0/16 CIDR, causing an overlap and violating the non-overlapping requirement for VPC CIDR blocks.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating two VGWs and connecting them via a Transit Gateway adds unnecessary complexity and does not allow both Direct Connect connections to be used with a single VGW as required; it also introduces additional latency and cost. Option C is wrong because a single VPC cannot have two VGWs attached simultaneously; each VPC supports only one VGW, making this configuration invalid. Option D is wrong because a single virtual interface cannot be associated with two separate Direct Connect connections; each virtual interface is tied to one physical connection, and this setup would not provide redundancy or load balancing.

Why this answer

How to eliminate wrong answers

Option A is wrong because ActiveConnectionCount and NewConnectionCount show traffic volume but do not reveal whether the ALB is overwhelmed; they are normal operational metrics. Option C is wrong because RequestCount and TargetResponseTime measure load and backend performance, not ALB capacity; high TargetResponseTime could indicate slow targets, not an overloaded ALB. Option D is wrong because HealthyHostCount and UnhealthyHostCount track target health, not ALB internal queuing or rejection; they would not show if the ALB itself is saturated.

Why this answer

How to eliminate wrong answers

Option B is wrong because VPC peering connections do not support transitive routing; each pair of VPCs requires a separate peering connection, which does not scale well and complicates IP address management for multiple accounts. Option C is wrong because VPC endpoints (Gateway Endpoints or Interface Endpoints) are designed for private connectivity to AWS services (e.g., S3, DynamoDB) and do not provide inter-VPC routing or communication between VPCs in different accounts. Option D is wrong because AWS Direct Connect provides dedicated private connectivity from on-premises to AWS, not between VPCs in different accounts; routing through the network account would require additional complex configurations and does not inherently enable secure VPC-to-VPC communication.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a NAT instance, while functional, is a single point of failure and requires manual management (e.g., disabling Source/Destination Check), whereas a NAT Gateway is a managed service with higher availability and bandwidth. Option C is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for downloading patches from arbitrary internet sources. Option D is wrong because adding a route to the internet gateway in the private subnet's route table would allow direct outbound traffic but also expose the instance to inbound traffic from the internet, violating the requirement that the instance cannot be directly initiated from the internet.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect with a private virtual interface provides a dedicated network connection but does not natively support IP multicast; multicast traffic is not forwarded over Direct Connect without additional overlay solutions. Option B is wrong because Site-to-Site VPN uses IPsec tunnels which are unicast-only and cannot transport multicast traffic natively; multicast would require additional encapsulation like GRE. Option D is wrong because VPC peering does not support multicast traffic; it only allows unicast communication between VPCs and has no multicast forwarding capability.

Why this answer

How to eliminate wrong answers

Option B is wrong because a VPC Peering connection only enables private routing between two VPCs and does not provide internet access; it cannot route traffic to or from the internet. Option C is wrong because a NAT Gateway is designed only for IPv4 traffic to allow private IPv4 instances to initiate outbound internet connections, and it does not support IPv6 at all. Option D is wrong because a Transit Gateway is a central hub for inter-VPC and on-premises connectivity, but it does not natively provide internet access; it requires an IGW attached to a VPC to reach the internet.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a NAT gateway does not require a route back to the private subnet; it implicitly knows how to return traffic to the subnet that sent it via the VPC's internal routing. Option C is wrong because NAT gateways do not use security groups; they are controlled by route tables and network ACLs, not security groups. Option D is wrong because the default security group for EC2 instances allows all outbound traffic, and the question does not indicate any custom outbound restriction; the issue is at the network layer, not the instance security group.

Why this answer

How to eliminate wrong answers

Option B is wrong because the shared services VPC's default route pointing to the NAT gateway is correct for outbound internet traffic from the shared services VPC itself; it does not affect traffic arriving from the Transit Gateway, as the Transit Gateway handles routing independently. Option C is wrong because the production VPC's default route pointing to the Transit Gateway is appropriate for sending traffic to the Transit Gateway; asymmetric routing is not caused by this route but rather by the Transit Gateway route table misconfiguration described in Option A. Option D is wrong because the Transit Gateway route table associated with the shared services VPC attachment does not need a route for the production VPC CIDR pointing to the production VPC attachment; return traffic from the shared services VPC to the production VPC is handled by the Transit Gateway's default behavior of using the most specific route, and the issue is about forward traffic bypassing inspection, not return traffic.

Why this answer

How to eliminate wrong answers

Option B is wrong because a Transit VPC solution with EC2-based VPN appliances introduces unnecessary complexity, latency, and single points of failure, whereas a Direct Connect gateway provides a native, managed, and scalable solution. Option C is wrong because AWS Site-to-Site VPN operates over the public internet and does not leverage the private, low-latency benefits of Direct Connect; it is a separate connectivity option, not a simplification for Direct Connect. Option D is wrong because VPC peering connections are used for direct VPC-to-VPC connectivity and do not integrate with Direct Connect private VIFs; they cannot simplify the attachment of multiple VPCs to a single Direct Connect connection.

Why this answer

How to eliminate wrong answers

Option A is wrong because Site-to-Site VPN connections over the internet cannot guarantee sub-second failover due to variable latency and packet loss, and using a VPN appliance on AWS adds unnecessary cost and complexity without meeting the high availability requirement. Option C is wrong because AWS Transit Gateway with inter-region peering does not inherently provide sub-second failover for the on-premises connection; the VPN attachment from on-premises to the Transit Gateway still relies on internet-based VPN, which cannot achieve sub-second failover reliably. Option D is wrong because routing all traffic through a single VPC as a transit hub creates a single point of failure and bandwidth bottleneck, and the combination of Direct Connect and VPN as backup does not guarantee sub-second failover unless BFD is properly configured on the Direct Connect path, but the design still lacks native support for multiple VPCs across regions without additional complexity.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because NAT64 is used to translate IPv6 traffic to IPv4 for communication with IPv4-only endpoints, not to allow direct internet access to an IPv6-enabled web server. Option B is wrong because an Egress-Only Internet Gateway only supports outbound IPv6 traffic from the VPC to the internet and does not allow inbound internet traffic to reach the web server. Option C is wrong because a NAT Gateway is designed for outbound IPv4 traffic from private subnets and does not support IPv6 traffic at all.

Why this answer

How to eliminate wrong answers

Option A is wrong because configuring the spoke VPC's DHCP options set to use the hub VPC's CIDR as the domain name server would point DNS queries to an IP range, not a specific DNS resolver IP, and the hub VPC's inbound endpoint IP must be explicitly specified; also, DHCP options sets cannot reference CIDR blocks. Option B is wrong because creating an inbound endpoint in each spoke VPC is unnecessary and defeats the purpose of a centralized hub-and-spoke design; inbound endpoints are for on-premises to AWS DNS resolution, not for spoke-to-hub forwarding. Option C is wrong because VPC peering does not natively route DNS traffic; DNS queries use UDP/TCP port 53 and are not forwarded by route tables alone—Route 53 Resolver endpoints are required to intercept and forward DNS traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because a security group is stateful; allowing outbound traffic automatically permits the return traffic for that session, but it does not block unsolicited inbound traffic from the internet—it only controls traffic based on rules, and a deny rule is not supported (security groups use allow rules only). Option B is wrong because a virtual private gateway is used for VPN or Direct Connect connections to on-premises networks, not for internet-bound traffic; routing IPv6 traffic through it would not provide internet access and would instead send traffic to a private network. Option D is wrong because a NAT gateway is designed for IPv4 traffic only (it translates private IPv4 addresses to a public IPv4 address) and does not support IPv6; IPv6 traffic cannot be routed through a NAT gateway.

Why this answer

How to eliminate wrong answers

Option A is wrong because an Internet Gateway enables internet-bound traffic from a VPC, which would route S3 traffic over the public internet, violating the requirement for private connectivity. Option B is wrong because AWS Site-to-Site VPN creates an encrypted tunnel over the internet to an on-premises network, not to AWS services like S3, and still involves internet transit. Option D is wrong because a NAT Gateway allows outbound internet traffic from private subnets but does not provide private connectivity to S3; it still routes traffic through the internet gateway and over the public internet.

Why this answer

How to eliminate wrong answers

Option B is wrong because the user does have permission to create routes (the policy allows managing VPC peering connections, which typically includes `ec2:CreateRoute` for the peered VPC), but the condition on the VPC is the actual blocker. Option C is wrong because the user already has the necessary permissions for the peering connection (create and accept), and the issue is not about additional peering permissions but about the route table's VPC association. Option D is wrong because accepting the peering connection is a separate step that the user can already perform (the policy allows it), and the route cannot be added until the peering connection is in the 'active' state, but the error reported is about adding routes, not about the peering state.

Why this answer

How to eliminate wrong answers

Option B (Failover routing) is wrong because it is designed for active-passive configurations, where one region is primary and the other is standby; it does not support active-active traffic distribution and would not provide sub-second failover for an active-active design. Option C (Geolocation routing) is wrong because it routes traffic based on the geographic location of the user, not on real-time endpoint health or latency, and it cannot dynamically shift traffic between regions for sub-second failover. Option D (Weighted routing) is wrong because it distributes traffic based on fixed weights assigned to records, and while it can be combined with health checks, it does not inherently optimize for latency or provide the automatic, sub-second failover behavior required for an active-active architecture.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing all servers in private subnets and using a load balancer in a public subnet would make the web servers inaccessible from the internet unless the load balancer is configured as an internet-facing load balancer and the web servers are in private subnets with a route to the load balancer; however, the description 'all servers in private subnets' implies the web servers themselves are not directly internet-accessible, which contradicts the requirement that web servers must be accessible from the internet. Option B is wrong because placing application servers in public subnets with an Internet Gateway would expose them directly to the internet, violating the requirement that they must only be accessible from the web servers. Option C is wrong because placing all servers in public subnets with an Internet Gateway would expose both web and application servers to the internet, and while Security Groups can restrict traffic, the application servers would still have public IP addresses and be reachable from the internet if the Security Group rules are misconfigured or if a user accidentally allows broader access; the requirement demands that application servers must only be accessible from the web servers, which is best achieved by placing them in private subnets with no direct internet path.

Why this answer

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply at the subnet level, not the instance level; allowing inbound traffic from the VPC CIDR would permit any resource in the VPC (including unauthorized instances) to access the RDS instances, and would also require explicit outbound rules for return traffic. Option B is wrong because allowing inbound traffic from the public subnet CIDR is overly permissive and does not restrict access to only the EC2 instances in 'App-SG'; it would also allow any instance in the public subnet, not just those in the security group. Option D is wrong because allowing inbound traffic from the VPC CIDR via a security group would permit any resource in the VPC (including unauthorized instances or services) to access the RDS instances, violating the requirement for access only by EC2 instances in 'App-SG'.

Why this answer

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer operates at Layer 4 and does not provide cross-Region routing or DNS-based latency steering; cross-zone load balancing only distributes traffic within a single Region. Option B is wrong because Amazon CloudFront is a content delivery network that caches content at edge locations; it does not natively route traffic to the closest healthy ALB based on latency for dynamic workloads without custom origin failover configurations, and it is not designed for active-active DNS failover. Option D is wrong because AWS Global Accelerator uses anycast IPs to direct traffic to the nearest edge location, but it then forwards traffic to a single regional endpoint or a weighted set; it does not provide latency-based DNS routing with automatic failover between two independent ALBs in different Regions in the same way Route 53 does.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection with multiple virtual interfaces (VIFs) still relies on a single physical link and single Direct Connect location; if that connection fails, all VIFs go down, so it does not avoid a single point of failure. Option B is wrong because using one Direct Connect connection with two VLANs only separates traffic logically on the same physical link; it does not provide physical redundancy, so a failure of the single connection takes down both VLANs. Option C is wrong because while a VPN backup over the internet provides a failover path, the primary single Direct Connect connection is still a single point of failure; the design does not meet the requirement to avoid a single point of failure for the primary connection, and the VPN backup may have lower performance and higher latency.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because 'NODATA' is not caused by an internal error; internal errors are reported as 'SKIPDATA' in the log-status field. Option C is wrong because a successful delivery to CloudWatch is indicated by 'OK' in the log-status field, not 'NODATA'. Option D is wrong because traffic rejected by a network ACL or security group is still captured and logged with an 'ACCEPT' or 'REJECT' action in the flow log record, not as 'NODATA'.

Why this answer

How to eliminate wrong answers

Option B is wrong because attaching an Internet Gateway and assigning public IPs to the instances would expose them to inbound internet traffic, violating the requirement to keep instances private. Option C is wrong because an Application Load Balancer operates at Layer 7 and does not provide a fixed source IP for outbound traffic; it distributes inbound traffic to targets, not outbound. Option D is wrong because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for routing general outbound traffic to an external partner's firewall.

Why this answer

How to eliminate wrong answers

Option B is wrong because network ACLs are stateless and, by default, allow all inbound and outbound traffic unless explicitly modified; the question does not indicate any custom NACL rules blocking traffic, so this is unlikely. Option C is wrong because the security group for the EC2 instance does not need to allow outbound traffic to the DB instance; security groups are stateful, so if the EC2 instance initiates the connection, the return traffic is automatically allowed regardless of outbound rules. Option D is wrong because the DB instance does not need a public IP address; it is in a private subnet and can be accessed from the public subnet via private IP routing, provided the route tables are correctly configured.

Why this answer

How to eliminate wrong answers

Option A is wrong because a bastion host in a public subnet provides only SSH/RDP access to instances, not application-level access, and cannot enforce user-level security policies for internal applications. Option B is wrong because AWS Direct Connect establishes a dedicated private network connection from on-premises to AWS, but it does not inherently enforce user-level policies; it is a network transport layer, not a user-authentication or policy-enforcement service. Option C is wrong because AWS Site-to-Site VPN creates an encrypted tunnel between an on-premises network and a VPC, but it is a network-to-network connection that does not support per-user authentication or granular policy enforcement; it treats all traffic from the on-premises side as a single entity.

Why this answer

How to eliminate wrong answers

Option B is wrong because geolocation routing routes based on the user's geographic location, not on network latency; it would not necessarily improve latency for South American users and could even worsen it if the nearest region is unhealthy. Option C is wrong because latency records are recalculated in real time based on current network conditions; there is no refresh interval that causes stale routing decisions. Option D is wrong because CloudWatch alarms are not used directly in Route 53 health checks; health checks can be based on endpoint status, calculated health checks, or CloudWatch metrics, but the alarm itself does not introduce additional latency into the routing decision.

Why this answer

How to eliminate wrong answers

Option A is wrong because the NACL inbound rule #120 allows HTTPS from 10.0.0.0/16, but the source IP is 203.0.113.50, so it would deny the traffic if this were an inbound connection; however, the traffic is actually outbound, so inbound NACL rules are irrelevant. Option B is wrong because the traffic is HTTPS (port 443), not HTTP (port 80), and rule #100 allows HTTP from anywhere, which does not apply to port 443. Option C is wrong because the security group's inbound rule restricts HTTPS to 10.0.0.0/16, but this is return traffic for an outbound connection, so inbound security group rules are not evaluated; the ACCEPT is not an error.

Why this answer

How to eliminate wrong answers

Option B is wrong because Direct Connect does not provide native encryption for data in transit; it relies on physical security of the fiber, but the traffic is not encrypted, so it fails the 'encrypted in transit' requirement. Option C is wrong because a public VIF connects to AWS public services (e.g., S3, DynamoDB) over the internet-routable path, which can traverse the public internet, violating the 'does not traverse the public internet' requirement. Option D is wrong because a transit VIF is used to connect a Direct Connect gateway to a transit gateway for multi-VPC routing, but it does not inherently provide encryption; it still requires an IPsec VPN or similar overlay to encrypt traffic.

Why this answer

How to eliminate wrong answers

Option B is wrong because attaching an Internet Gateway to each VPC creates direct internet access, bypassing the centralized firewall and violating the security requirement. Option C is wrong because AWS Site-to-Site VPN connects to an on-premises firewall, not a centralized firewall within AWS, and does not inherently route all VPC outbound traffic through it without additional routing complexity. Option D is wrong because VPC Endpoints provide private connectivity to AWS services only, not general internet access, and thus cannot handle all outbound internet traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing all instances in a single public subnet exposes the application and database tiers to the internet, even if security groups restrict traffic; the instances still have public IP addresses and are reachable from the internet, violating the requirement that only the web tier be internet-accessible. Option B is wrong because assigning private IP addresses only does not prevent instances in public subnets from being assigned public IPs via an Internet Gateway or NAT device; moreover, public subnets are defined by having a route to an Internet Gateway, so all instances would still be directly reachable from the internet, breaking the isolation requirements. Option D is wrong because network ACLs are stateless and operate at the subnet level, requiring explicit inbound and outbound rules for ephemeral ports, which complicates management and can inadvertently allow or block traffic; security groups are stateful and provide finer-grained, instance-level control, making them more secure and easier to manage for this use case.

Why this answer

How to eliminate wrong answers

Option A is wrong because deploying AWS Network Firewall in each VPC introduces unnecessary cost, complexity, and a single point of failure per VPC, and it does not natively scale to many VPCs without manual configuration of routing and firewall policies. Option C is wrong because Security Groups are stateful firewalls that filter traffic at the instance level, not at the network edge, and they cannot isolate traffic between VPCs at the Transit Gateway level; they also require explicit rules for every instance pair, which does not scale. Option D is wrong because VPC Peering connections create a full mesh of point-to-point links, which does not scale beyond a few VPCs due to the quadratic increase in peering connections and the need to manually update route tables in every VPC.