I85PREP
⌘ K
AWS Networking Specialty study materials
AWS Networking Specialty study resources

AWS Networking Specialty practice questions

One question at a time. Build your AWS Networking Specialty understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Design

A company needs a VPC subnet that can host resources requiring a static private IP address that persists across instance replacement, and the subnet must not auto-assign public IPv4 addresses. Which subnet configuration accomplishes this?

  1. Create a public subnet with auto-assign public IPv4 enabled and use a NAT gateway.
  2. Create a private subnet with auto-assign public IPv4 enabled and use an egress-only internet gateway.
  3. Create a private subnet with auto-assign public IPv4 disabled and assign a secondary private IP to each instance. Correct answer.
  4. Create a public subnet with auto-assign public IPv4 disabled and attach an internet gateway.

Explanation

Private subnets do not route to an internet gateway, so instances receive no public IPv4 address regardless of auto-assign settings. Assigning a secondary private IP or using an Elastic IP-like static private address keeps the address stable across instance replacement. Disabling auto-assign public IPv4 is a subnet-level attribute that prevents automatic public addressing.

Question 2Network Design

Which component determines whether traffic from a subnet is routed to an internet gateway, a NAT gateway, or a virtual private gateway?

  1. Route table Correct answer.
  2. Security group
  3. VPC endpoint policy
  4. Network ACL

Explanation

A route table contains routes that map destination CIDR blocks to targets such as internet gateways, NAT gateways, and virtual private gateways. Each subnet is associated with exactly one route table at a time, so the route table controls the subnet's egress path. Network ACLs and security groups filter traffic but do not select the next hop.

Question 3Network Design

A solutions architect is designing a VPC with public and private subnets across two Availability Zones. What is the minimum number of NAT gateways needed to avoid a single point of failure for outbound internet access from the private subnets?

  1. Two NAT gateways, one in each Availability Zone's public subnet Correct answer.
  2. One NAT gateway shared across both private subnets
  3. Four NAT gateways, one per subnet
  4. One NAT gateway in one public subnet

Explanation

A NAT gateway resides in a single Availability Zone, so a zone failure disables it. Deploying one NAT gateway per Availability Zone and routing each private subnet to the local NAT gateway removes the single point of failure. One NAT gateway is sufficient for connectivity but not for high availability.

Question 4Network Design

Which statement accurately describes the default behavior of a security group when it is first created?

  1. It allows all inbound traffic and denies all outbound traffic.
  2. It allows all inbound and all outbound traffic.
  3. It denies all inbound and all outbound traffic.
  4. It denies all inbound traffic and allows all outbound traffic. Correct answer.

Explanation

A newly created security group has no inbound rules, so all inbound traffic is denied by default. It includes an outbound rule that permits all traffic, which administrators typically tighten. Security groups are stateful, so return traffic for allowed connections is automatically permitted.

Question 5Network Design

A company wants instances in a private subnet to reach Amazon S3 without traversing the public internet or a NAT gateway. Which design meets this requirement?

  1. Attach an internet gateway to the private subnet's route table.
  2. Create an interface VPC endpoint in the public subnet and route all traffic through it.
  3. Use an egress-only internet gateway for the private subnet.
  4. Create a gateway VPC endpoint for S3 and add a route for the S3 prefix list to the private route table. Correct answer.

Explanation

A gateway VPC endpoint for S3 provides private connectivity by adding a route to the S3 prefix list in the subnet's route table. Traffic to S3 then stays within the AWS network and never uses the internet or a NAT gateway. Gateway endpoints are supported for S3 and DynamoDB.

Question 6Network Design

What is the primary purpose of a transit gateway in a multi-VPC network design?

  1. To assign public IP addresses to instances in private subnets.
  2. To provide a single hub that connects many VPCs and on-premises networks without full-mesh peering. Correct answer.
  3. To replace security groups with centralized firewall rules.
  4. To cache DNS responses for all VPCs in a Region.

Explanation

A transit gateway acts as a regional hub that attaches VPCs, VPN connections, and Direct Connect gateways. This hub-and-spoke model avoids the combinatorial growth of VPC peering connections in a full mesh. Route tables on the transit gateway control which attachments can reach each other.

Question 7Network Design

Which CIDR block is valid for an Amazon VPC?

  1. 10.0.0.0/15
  2. 10.0.0.0/28 Correct answer.
  3. 172.16.0.0/8
  4. 10.0.0.0/29

Explanation

A VPC CIDR block must be between /16 and /28 in size. A /28 block provides 16 addresses and is the smallest permitted VPC size. Blocks larger than /16 or smaller than /28 are rejected.

Question 8Network Design

An application in one VPC must communicate with an application in another VPC in the same Region with low latency and no single point of failure. Which approach provides direct private connectivity between the two VPCs?

  1. A VPC peering connection between the two VPCs. Correct answer.
  2. An internet gateway in each VPC.
  3. A Site-to-Site VPN between the two VPCs.
  4. A NAT gateway in each VPC.

Explanation

VPC peering creates a direct private network route between two VPCs using their private IP addresses. Traffic stays on the AWS backbone and does not traverse the public internet. Peering supports cross-Region and cross-account connections when configured correctly.

Question 9Network Design

A company has a VPC with CIDR 10.0.0.0/16 and needs to add a second, non-overlapping CIDR block to support a new workload. Which action is required?

  1. Delete and recreate the VPC with both CIDR blocks.
  2. Add the new range as a subnet route in the main route table.
  3. Associate a secondary IPv4 CIDR block with the existing VPC. Correct answer.
  4. Create a new VPC and peer it to the existing VPC.

Explanation

A VPC can have multiple associated IPv4 CIDR blocks, including a primary block and secondary blocks. Secondary blocks must not overlap with existing VPC CIDRs or with routes already in use. After association, new subnets can be created from the secondary range.

Question 10Network Design

A subnet in a VPC has the CIDR 10.0.1.0/24. How many usable IP addresses are available for resources in that subnet after AWS reserves addresses?

  1. 254
  2. 251 Correct answer.
  3. 250
  4. 256

Explanation

A /24 subnet contains 256 total addresses. AWS reserves five addresses in each subnet for the network address, the VPC router, DNS, a future use address, and the broadcast address, leaving 251 usable addresses. The reservation applies to every subnet regardless of size.

Question 11Network Design

A company wants to allow instances in a private subnet to download software updates from the internet while preventing inbound connections from the internet. Which combination achieves this?

  1. A NAT gateway in a public subnet with a route from the private subnet to the NAT gateway. Correct answer.
  2. An egress-only internet gateway with an IPv4 route from the private subnet.
  3. An internet gateway with a security group that allows all inbound traffic.
  4. A virtual private gateway with a route from the private subnet to the gateway.

Explanation

A NAT gateway performs source network address translation so private instances can initiate outbound connections while remaining unreachable from the internet. The private subnet's route table sends 0.0.0.0/0 to the NAT gateway in a public subnet. The NAT gateway itself needs an internet gateway route to reach the internet.

Question 12Network Design

A security team wants to block a specific source IP range from reaching any instance in a subnet while still allowing other traffic. Which mechanism should be used?

  1. A VPC flow log filter
  2. A network ACL inbound deny rule Correct answer.
  3. A security group inbound deny rule
  4. A route table blackhole route for the source range

Explanation

Network ACLs support both allow and deny rules and are evaluated in order by rule number. A deny rule for the unwanted source range blocks that traffic at the subnet boundary. Security groups support only allow rules, so they cannot express an explicit deny.

Question 13Network Design

An architect is designing connectivity between an on-premises data center and AWS that must provide a dedicated private connection with consistent latency and not traverse the public internet. Which service meets these requirements?

  1. VPC peering
  2. AWS Site-to-Site VPN over the internet
  3. AWS Client VPN
  4. AWS Direct Connect Correct answer.

Explanation

AWS Direct Connect establishes a dedicated private network connection from an on-premises location to AWS. Traffic does not traverse the public internet, which provides more consistent latency and bandwidth. A Site-to-Site VPN uses encrypted tunnels over the internet and is subject to internet variability.

Question 14Network Design

A company uses a transit gateway to connect several VPCs. They want VPC A to reach VPC B but not VPC C. What controls this segmentation?

  1. Security groups attached to the transit gateway
  2. Transit gateway route tables and associations Correct answer.
  3. Network ACLs on the transit gateway attachments
  4. VPC flow logs on the transit gateway

Explanation

Transit gateway route tables determine which attachments can route to which destinations. By associating attachments with specific route tables and propagating routes selectively, administrators can segment traffic between VPCs. Security groups and network ACLs filter traffic but do not define transit gateway routing domains.

Question 15Network Design

A company needs DNS resolution between an on-premises network and a VPC using a hybrid DNS design. Which AWS feature forwards DNS queries between the on-premises resolver and Route 53 Resolver?

  1. Route 53 public hosted zones
  2. Route 53 Resolver inbound and outbound endpoints Correct answer.
  3. Route 53 private hosted zones
  4. VPC DHCP options sets

Explanation

Route 53 Resolver endpoints enable DNS query forwarding between on-premises networks and the VPC resolver. Inbound endpoints allow on-premises systems to resolve AWS names, while outbound endpoints forward VPC queries to on-premises DNS servers. Private hosted zones define records but do not by themselves forward queries across the hybrid boundary.

Question 16Network Design

Which AWS feature allows a VPC to reach an on-premises network over a private connection using a virtual private gateway and BGP?

  1. AWS Global Accelerator
  2. VPC peering
  3. AWS Site-to-Site VPN Correct answer.
  4. AWS Client VPN

Explanation

AWS Site-to-Site VPN creates encrypted tunnels between a customer gateway on-premises and a virtual private gateway or transit gateway in AWS. BGP is used to exchange routes across the tunnels. Client VPN serves remote users, while peering and Global Accelerator do not connect to on-premises networks.

Question 17Network Design

A company wants to restrict access to an S3 bucket so that requests must come through a specific VPC endpoint. Which combination should be used?

  1. A bucket policy that allows only requests from the endpoint's VPC endpoint ID. Correct answer.
  2. A security group on the S3 bucket that allows the VPC CIDR.
  3. A route table entry that points S3 traffic to the endpoint.
  4. A network ACL on the subnet that allows S3 traffic.

Explanation

A bucket policy can include a condition on the aws:sourceVpce value to allow only requests that arrive through a specific VPC endpoint. This restricts access to the private path while blocking requests from other sources. The endpoint must exist and be associated with the relevant route table.

Question 18Network Design

An architect needs to design a VPC that spans three Availability Zones with public and private subnets in each zone. What is the minimum number of route tables needed if public subnets share one route table and private subnets share another?

  1. One
  2. Six
  3. Three
  4. Two Correct answer.

Explanation

Subnets in different Availability Zones can share a route table if their routing requirements are identical. One route table can serve all public subnets and another can serve all private subnets. The number of Availability Zones does not force a matching number of route tables.

Question 19Network Design

A company is designing a multi-account environment and wants centralized egress to the internet through a shared VPC. Which design pattern supports this?

  1. Each account creates its own NAT gateway and internet gateway.
  2. Each workload VPC uses an egress-only internet gateway.
  3. A central networking account hosts the egress VPC, and workload VPCs route through a transit gateway to it. Correct answer.
  4. Each workload VPC peers directly with every other workload VPC.

Explanation

A centralized egress design places NAT gateways and internet gateways in a shared networking VPC. Workload VPCs attach to a transit gateway that routes internet-bound traffic to the egress VPC. This centralizes inspection and reduces the number of NAT gateways and public IP addresses.

Question 20Network Design

A VPC has a CIDR of 10.0.0.0/16, and a subnet has the CIDR 10.0.0.0/24. An instance in the subnet needs to reach an on-premises server at 192.168.1.10 through a virtual private gateway. Which route must exist in the subnet's route table?

  1. A route for 0.0.0.0/0 pointing to the virtual private gateway.
  2. A route for 192.168.1.10/32 pointing to the internet gateway.
  3. A route for 192.168.1.0/24 pointing to the virtual private gateway. Correct answer.
  4. A route for 10.0.0.0/16 pointing to the virtual private gateway.

Explanation

The route table must contain a route whose destination matches the on-premises network and whose target is the virtual private gateway. A route for 192.168.1.0/24 covers the server address and directs it over the private connection. Routes are evaluated by longest prefix match, so a more specific route can coexist with broader routes.

Question 21Network Design

A company needs to connect 40 VPCs across multiple accounts and Regions to a shared services VPC. Which design is most scalable?

  1. A full mesh of VPC peering connections between all VPCs.
  2. A Site-to-Site VPN from each VPC to the shared services VPC.
  3. A single VPC peering connection from each VPC to the shared services VPC.
  4. A transit gateway in each Region with inter-Region peering between transit gateways. Correct answer.

Explanation

Transit gateway peering connects transit gateways across Regions, and each VPC attaches to its regional transit gateway. This hub-and-spoke model scales linearly rather than combinatorially. Full-mesh peering would require hundreds of connections for 40 VPCs.

Question 22Network Design

An application requires a fixed, static public IP address that does not change when the underlying instance is replaced, and the traffic must be inspected by a third-party firewall appliance in the VPC. Which design meets these requirements?

  1. A Gateway Load Balancer endpoint with an internet gateway.
  2. An internet-facing Application Load Balancer with an Elastic IP address.
  3. An EC2 instance with an auto-assigned public IPv4 address.
  4. A Network Load Balancer with an Elastic IP address and a target group pointing to the firewall appliance. Correct answer.

Explanation

A Network Load Balancer supports Elastic IP addresses, giving a static public IP that survives instance replacement. Traffic can be directed to firewall appliances registered as targets for inspection. Application Load Balancers do not support static Elastic IP addresses.

Question 23Network Design

A company has overlapping CIDR blocks between two VPCs that must communicate. Which approach allows connectivity without renumbering?

  1. Create a Site-to-Site VPN between the two VPCs.
  2. Use AWS PrivateLink to expose the service from one VPC to the other. Correct answer.
  3. Attach both VPCs to the same transit gateway.
  4. Create a VPC peering connection between the two VPCs.

Explanation

AWS PrivateLink exposes a service through an interface endpoint without requiring non-overlapping CIDR blocks. The consumer connects to the endpoint's elastic network interface in its own VPC. VPC peering and transit gateway attachments require non-overlapping address ranges.

Question 24Network Design

A company wants to inspect all traffic entering and leaving a VPC using a centralized security VPC with third-party appliances, without changing the source or destination IP addresses. Which design accomplishes this?

  1. A Gateway Load Balancer with a Gateway Load Balancer endpoint in the spoke VPC. Correct answer.
  2. A VPC peering connection between the spoke and security VPCs.
  3. A Network Load Balancer with proxy protocol enabled.
  4. A NAT gateway in the security VPC.

Explanation

A Gateway Load Balancer uses GENEVE encapsulation to forward traffic transparently to appliance targets while preserving the original source and destination addresses. A Gateway Load Balancer endpoint in the spoke VPC provides the entry point for inspection. NAT gateways and peering do not provide transparent inspection.

Question 25Network Design

An architect is designing a VPC with subnets in three Availability Zones and needs to ensure that the failure of one Availability Zone does not affect the others. Which design consideration is most important?

  1. Using a single NAT gateway in one Availability Zone for all private subnets.
  2. Distributing resources across subnets in multiple Availability Zones and using zonal services independently per zone. Correct answer.
  3. Placing all resources in a single subnet to simplify routing.
  4. Relying on a single transit gateway attachment for all zones.

Explanation

Distributing resources across multiple Availability Zones and keeping zonal dependencies independent prevents a single zone failure from affecting the whole workload. Zonal services such as NAT gateways should be deployed per zone. A single shared zonal component creates a cross-zone dependency.

Question 26Network Design

Which AWS construct provides a logically isolated virtual network where you define IP address ranges and launch resources?

  1. Amazon Route 53 Resolver
  2. AWS Transit Gateway
  3. AWS Direct Connect gateway
  4. Amazon VPC Correct answer.

Explanation

An Amazon VPC is the foundational network boundary in AWS; you assign it a primary IPv4 CIDR block and carve subnets from it. Direct Connect gateway, Transit Gateway, and Route 53 Resolver are connectivity or DNS services that attach to VPCs rather than define the isolated network itself.

Question 27Network Design

In a VPC design, what is the purpose of an internet gateway?

  1. To cache frequently requested objects at the edge for lower latency
  2. To establish encrypted tunnels between a VPC and remote branch offices
  3. To provide a horizontally scaled target that lets resources with public IPv4 addresses reach and be reached from the internet Correct answer.
  4. To allocate static public IPv4 addresses to individual instances

Explanation

An internet gateway is a highly available, horizontally scaled VPC component that performs NAT for instances with public IPv4 addresses and routes traffic to and from the internet. Routing tables must still contain a route to the gateway for it to be used.

Question 28Network Design

Which statement correctly describes the relationship between a subnet and an Availability Zone in Amazon VPC?

  1. A subnet automatically spans every Availability Zone in the Region
  2. A subnet is confined to a single Availability Zone Correct answer.
  3. A subnet can span Availability Zones only when using a transit gateway
  4. A subnet spans exactly two Availability Zones for redundancy

Explanation

Each subnet is associated with exactly one Availability Zone at creation time, and that association cannot be changed afterward. To achieve zone redundancy, an architect creates multiple subnets with the same role in different Availability Zones.

Question 29Network Design

Which AWS resource controls whether traffic is allowed to enter or leave a subnet?

  1. VPC flow log
  2. Route table
  3. Network ACL Correct answer.
  4. Security group

Explanation

A network ACL is a stateless, ordered allow/deny filter applied at the subnet boundary and evaluated for each direction separately. Security groups act at the resource level, route tables choose paths, and flow logs only record metadata.

Question 30Network Design

What does a VPC peering connection require to function between two VPCs?

  1. A shared security group across both VPCs
  2. Non-overlapping CIDR blocks and routes in both VPCs pointing at the peering connection Correct answer.
  3. A transit gateway attached to both VPCs
  4. An internet gateway in each VPC

Explanation

Peering operates at layer 3 between two VPCs and depends on non-overlapping address ranges plus explicit route entries in each VPC's route tables. Security groups must also be updated, but each VPC keeps its own groups rather than sharing one.

Question 31Network Design

Which CIDR block can be used as the primary IPv4 CIDR for a new VPC?

  1. 10.0.0.0/30
  2. 10.0.0.0/14
  3. 10.0.0.0/16 Correct answer.
  4. 10.0.0.0/29

Explanation

A VPC IPv4 CIDR block must be between /16 and /28 in size, so /16 is valid. Prefixes larger than /16 and smaller than /28 are rejected by the service.

Question 32Network Design

Which service lets you reserve a static public IPv4 address that can be remapped to another instance?

  1. Carrier-grade NAT address
  2. Elastic IP address Correct answer.
  3. Public IPv4 address assigned at launch
  4. Interface VPC endpoint address

Explanation

An Elastic IP address is a static public address allocated to your account that you can associate with an instance or network interface and reassociate later. Addresses assigned at launch are released when the resource is terminated.

Question 33Network Design

Which component must exist in a route table for a private subnet to send internet-bound traffic through a NAT gateway?

  1. A route with destination 0.0.0.0/0 whose target is the NAT gateway Correct answer.
  2. A route with destination 10.0.0.0/8 whose target is the NAT gateway
  3. A route with destination 0.0.0.0/0 whose target is a virtual private gateway
  4. A route with destination 0.0.0.0/0 whose target is the internet gateway

Explanation

A NAT gateway performs source NAT for private instances, so the private subnet's route table needs a default route pointing to the NAT gateway in a public subnet. The NAT gateway itself then uses the public subnet's default route to the internet gateway.

Question 34Network Design

A company needs a managed DNS service that resolves public domain names for its internet-facing application and supports health checks with failover. Which AWS service should the architect choose?

  1. Amazon Route 53 Resolver
  2. Amazon VPC DHCP options sets
  3. Amazon Route 53 Correct answer.
  4. AWS Cloud Map

Explanation

Route 53 is the authoritative public DNS service that supports record types, health checks, and routing policies such as failover and weighted routing. Resolver handles hybrid DNS forwarding, Cloud Map handles service discovery, and DHCP options sets configure resolver addresses for a VPC.

Question 35Network Design

An architect must design a subnet for a fleet of web servers that need public addresses and must be reachable from the internet on port 443. Which combination is required?

  1. A route to a virtual private gateway and a security group allowing inbound 443
  2. A route to an internet gateway and a security group allowing inbound 443 Correct answer.
  3. A route to a NAT gateway and a network ACL allowing inbound 443
  4. A route to a transit gateway and a network ACL allowing inbound 443

Explanation

Public reachability requires the subnet's route table to send 0.0.0.0/0 to an internet gateway and the resource to permit inbound 443 in its security group. The instance also needs a public IPv4 address or Elastic IP address, which is implied by the public subnet design.

Question 36Network Design

A company wants all outbound internet traffic from many private subnets to share one set of public IP addresses and to survive the loss of a single Availability Zone. Which design meets these goals?

  1. Deploy a NAT gateway in each Availability Zone and route each subnet to the NAT gateway in its own zone Correct answer.
  2. Deploy one NAT gateway in a single Availability Zone and route all subnets to it
  3. Deploy an internet gateway in each private subnet
  4. Deploy NAT instances in each subnet with source/destination check disabled

Explanation

A NAT gateway is tied to one Availability Zone, so zone-resilient egress requires one NAT gateway per zone with each subnet routed to the local one. Each NAT gateway receives an Elastic IP address, giving a predictable set of egress addresses.

Question 37Network Design

A solutions architect is planning IP space for a VPC that will host 12 subnets, each needing at least 500 usable addresses. Which VPC CIDR provides sufficient space with the least waste?

  1. 10.0.0.0/24
  2. 10.0.0.0/21 Correct answer.
  3. 10.0.0.0/16
  4. 10.0.0.0/28

Explanation

Each subnet needs 500 usable addresses, which requires a /23 because AWS reserves five addresses per subnet. Twelve /23 subnets need 24 total bits of host space, so a /21 (2048 addresses) is the smallest block that fits and minimizes waste.

Question 38Network Design

A company has two VPCs in the same Region that must exchange data privately, and neither VPC should be able to reach the other's subnets beyond a specific application subnet. Which design element enforces that restriction?

  1. A network ACL that denies all traffic on the peering connection
  2. A security group that allows all traffic from the peer VPC CIDR
  3. An internet gateway shared between the two VPCs
  4. Route tables that advertise only the specific application subnet's CIDR across the peering connection Correct answer.

Explanation

Routing is the primary lever for limiting reachability across a peering connection; advertising only the intended subnet means other subnets have no path. Security groups and network ACLs add defense in depth but do not replace selective routing.

Question 39Network Design

Which AWS feature allows DNS queries for a private hosted zone in one VPC to be resolved from a second VPC without a peering connection?

  1. Adding a Route 53 Resolver outbound endpoint rule
  2. Enabling DNS hostnames on the second VPC
  3. Associating the private hosted zone with both VPCs in Route 53 Correct answer.
  4. Creating a public hosted zone with the same name

Explanation

A Route 53 private hosted zone can be associated with multiple VPCs, letting resources in each resolve the same private records regardless of network path. Peering is not required for the association itself, though reachability to the resolved address is a separate concern.

Question 40Network Design

An architect is designing a hub-and-spoke topology where 30 VPCs across several accounts must reach a shared services VPC and an on-premises network. Which approach scales best with the fewest attachments to manage?

  1. Route all traffic through a single NAT gateway shared by all VPCs
  2. Attach each VPC to a separate virtual private gateway
  3. Attach every VPC to a transit gateway and connect the on-premises network to the same transit gateway Correct answer.
  4. Create a full mesh of VPC peering connections among all 30 VPCs

Explanation

A transit gateway acts as a regional hub, so each VPC needs only one attachment and route propagation replaces a mesh of pairwise connections. A full mesh of peering would require hundreds of connections and route entries.

Question 41Network Design

A company must give a partner access to a single application endpoint in its VPC without exposing the whole VPC or requiring the partner to build a VPN. Which AWS feature is designed for this?

  1. AWS PrivateLink endpoint service Correct answer.
  2. An internet-facing Network Load Balancer with open security groups
  3. VPC peering with the partner account
  4. A transit gateway shared through AWS Resource Access Manager

Explanation

PrivateLink exposes a specific service behind a Network Load Balancer to consumer VPCs through interface endpoints, keeping traffic on the AWS network. The provider does not need to expose its broader VPC address space.

Question 42Network Design

Which design consideration makes a VPC endpoint for Amazon S3 preferable to a NAT gateway for large volumes of private-subnet S3 traffic?

  1. Gateway endpoints replace the need for any route table entries
  2. Gateway endpoints require an internet gateway to function
  3. Gateway endpoints encrypt all traffic with customer-managed keys
  4. Gateway endpoints keep S3 traffic on the AWS private network and avoid NAT gateway data processing charges Correct answer.

Explanation

A gateway endpoint is added as a route table target for the S3 prefix list, so traffic stays private and bypasses NAT data processing charges. This is both a cost and a security improvement for high-volume S3 access.

Question 43Network Design

A company runs workloads in two Regions and needs private, low-latency connectivity between VPCs in each Region without traversing the public internet. Which design is appropriate?

  1. A virtual private gateway in each VPC with no cross-Region link
  2. A single internet gateway shared across both Regions
  3. A NAT gateway in one Region serving both VPCs
  4. VPC peering between the two Regional VPCs, or transit gateways peered across Regions Correct answer.

Explanation

Inter-Region VPC peering carries traffic over the AWS backbone, and transit gateway peering provides the same benefit at hub scale. Both avoid the public internet and are supported across Regions.

Question 44Network Design

An architect needs to ensure that a fleet of instances in a private subnet can resolve on-premises DNS names while still resolving AWS service names. Which design element is required?

  1. Disabling the Amazon-provided DNS in the VPC
  2. A public hosted zone containing the on-premises records
  3. A Route 53 Resolver outbound endpoint with forwarding rules for the on-premises domain Correct answer.
  4. An inbound endpoint only, with no forwarding rules

Explanation

Outbound endpoints send queries from the VPC to on-premises resolvers, and forwarding rules scope which domains are sent there. Other names continue to resolve through the VPC resolver, preserving AWS service resolution.

Question 45Network Design

A security team requires that no resource in a VPC can reach a specific external CIDR range, even if a security group allows it. Which control enforces this at the subnet level?

  1. A VPC flow log with an alert on the CIDR range
  2. A route table entry with a blackhole target for the CIDR range
  3. A security group rule that denies the CIDR range
  4. A network ACL rule with a lower rule number that denies the CIDR range Correct answer.

Explanation

Network ACLs evaluate rules in order by rule number and support explicit deny entries, so a low-numbered deny blocks the range before any allow. Security groups support only allow rules, and blackhole routes only apply if traffic is routed that way.

Question 46Network Design

An application in a private subnet must access an Amazon S3 bucket, and the security policy forbids any path through the public internet. Which combination satisfies this requirement?

  1. A NAT gateway plus a restrictive bucket policy
  2. A gateway VPC endpoint for S3 plus a route table entry for the S3 prefix list Correct answer.
  3. A transit gateway attachment plus a public S3 endpoint
  4. An internet gateway plus an S3 bucket policy limited to the VPC CIDR

Explanation

Gateway endpoints attach to route tables and direct S3 traffic over the AWS private network, so no internet path is used. A bucket policy can further restrict access to the endpoint.

Question 47Network Design

A company is designing a VPC that must support 5,000 instances each needing a distinct private IP address, with room to double in two years. Which VPC CIDR and subnet plan is most appropriate?

  1. A /16 VPC with multiple /20 subnets spread across Availability Zones Correct answer.
  2. A /24 VPC with four /26 subnets
  3. A /28 VPC with two /28 subnets
  4. A /20 VPC with a single /20 subnet

Explanation

A /16 provides 65,536 addresses, which comfortably covers 5,000 instances and future doubling while allowing multiple /20 subnets per zone. AWS reserves five addresses per subnet, so headroom matters.

Question 48Network Design

An architect must connect a VPC to an on-premises network and ensure that traffic fails over automatically between a Direct Connect connection and a Site-to-Site VPN. Which design achieves deterministic failover?

  1. Use static routes with equal metrics on both paths
  2. Advertise the on-premises routes over both paths and use BGP attributes or AS path prepending so the Direct Connect path is preferred Correct answer.
  3. Rely on DNS failover between two application endpoints
  4. Advertise the on-premises routes only over the VPN and leave the Direct Connect connection passive

Explanation

Dynamic BGP advertisements over both the Direct Connect connection and the VPN allow the router to prefer one path and converge to the other on failure. AS path prepending or local preference makes the preference deterministic rather than relying on chance.

Question 49Network Design

A company uses a transit gateway with multiple route tables to segment environments. Traffic from the production VPC must reach the shared services VPC but must not reach the development VPC. Which mechanism enforces this?

  1. Disabling route propagation on the development VPC's route table only
  2. Associating the production attachment with a transit gateway route table that contains only the shared services route Correct answer.
  3. Using a network ACL on the production subnet that denies the development CIDR
  4. Attaching a security group to the transit gateway that denies the development CIDR

Explanation

Transit gateway route tables control which attachments can reach which prefixes, so segmenting by association and propagation is the correct enforcement point. Security groups and network ACLs can add defense in depth but do not replace transit gateway routing segmentation.

Question 50Network Design

A global application must route users to the closest healthy Regional endpoint while supporting automatic failover. Which Route 53 design meets this requirement?

  1. A multivalue answer record set with no health checks
  2. A single weighted record with weight 100 in one Region
  3. Latency-based routing records with health checks and a failover target in a backup Region Correct answer.
  4. A private hosted zone associated with all Regions

Explanation

Latency-based routing directs each user to the Region with the lowest measured latency, and health checks remove unhealthy endpoints from answers. A backup target provides continuity when a Region fails.