AWS Certified Advanced Networking – Specialty (ANS-C01)Network ImplementationHard
A company is deploying a new service in a VPC with a CIDR block of 10.0.0.0/20. They need to create three private subnets of equal size and one public subnet for NAT Gateways, also of equal size. Each subnet must support at least 1000 usable IP addresses. Which subnet CIDR blocks should the network engineer use to meet these requirements?
- APublic: 10.0.0.0/24, Private1: 10.0.1.0/24, Private2: 10.0.2.0/24, Private3: 10.0.3.0/24
- BPublic: 10.0.0.0/23, Private1: 10.0.2.0/23, Private2: 10.0.4.0/23, Private3: 10.0.6.0/23
- CPublic: 10.0.0.0/21, Private1: 10.0.8.0/21, Private2: 10.0.16.0/21, Private3: 10.0.24.0/21
- DPublic: 10.0.0.0/22, Private1: 10.0.4.0/22, Private2: 10.0.8.0/22, Private3: 10.0.12.0/22
Show answer & explanationAnswer & explanation
Correct answer: D. Public: 10.0.0.0/22, Private1: 10.0.4.0/22, Private2: 10.0.8.0/22, Private3: 10.0.12.0/22
A /22 CIDR block provides 2^(32-22) = 2^10 = 1024 IP addresses. After AWS reserves 5 addresses, this leaves 1019 usable IPs, meeting the 'at least 1000 usable IPs' requirement. The VPC CIDR is 10.0.0.0/20, which covers 10.0.0.0 to 10.0.15.255. Four /22 subnets (10.0.0.0/22, 10.0.4.0/22, 10.0.8.0/22, 10.0.12.0/22) fit perfectly within this /20 range and provide the necessary IP count.
Why the other options are wrong
- A. A /24 subnet provides 256 IPs (251 usable), which is far less than the required 1000 usable IPs.
- B. A /23 subnet provides 512 IPs (507 usable), which is less than the required 1000 usable IPs.
- C. A /21 subnet provides 2048 IPs, which is more than needed and less efficient given the /20 VPC. Also, 4 x /21 subnets would extend beyond a /20 VPC (4 * 8 = 32, so 10.0.0.0/21, 10.0.8.0/21, 10.0.16.0/21, 10.0.24.0/21 would require a /19 VPC).
VPC Subnet Sizing (CIDR)
The process of dividing a VPC's CIDR block into smaller CIDR blocks for subnets, ensuring each subnet has enough IP addresses for resources and fits within the VPC's range.
- AWS reserves 5 IP addresses in each subnet
- Number of IPs = 2^(32-CIDR_mask)
- Subnet CIDR block must be a subset of VPC CIDR block
- Careful planning avoids IP exhaustion and overlap
Memory trick: Count IPs by 2 to the power of (32 minus the mask).