ANS-C01 Practice Test 4 — 10 Questions

Question 1

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over a Direct Connect connection. The engineer has verified that the VPC route tables, Direct Connect virtual interface, and on-premises routing are correctly configured. Which tool should be used to verify the path MTU and identify fragmentation issues?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the ping command with the DF flag set to test MTU. The ping command with the Don't Fragment (DF) flag set (e.g., `ping -M do -s <size>` on Linux) is the correct tool to verify path MTU because it forces the packet not to be fragmented. If the packet size exceeds the MTU of any link along the path, the router will drop the packet and send an ICMP Fragmentation Needed message back, allowing the engineer to pinpoint the maximum supported MTU and identify fragmentation issues.

Answer

Use the netstat command

Answer

Use the nslookup command

Answer

Use the traceroute command

Question 2

A company is using AWS CloudFormation to deploy a stack that includes an S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. The stack fails to create, and the error indicates that the bucket policy contains an invalid principal. Which condition key should be used to restrict access to a VPC endpoint in the bucket policy?

Accepted Answer

The condition key aws:SourceVpce. To restrict access to a specific VPC endpoint in an S3 bucket policy, you must use the `aws:SourceVpce` condition key in the `Condition` element, not a principal. VPC endpoints cannot be specified as principals in policies. Option A correctly identifies the condition key. Option B (VPC ID) is incorrect because you need the VPC endpoint ID, not the VPC ID. Option C (ARN of the VPC endpoint) is incorrect because ARNs are not used in condition keys for this purpose. Option D (VPC endpoint service) is incorrect because the endpoint service is not used in this condition.

Answer

The VPC ID

Answer

The ARN of the VPC endpoint

Answer

The VPC endpoint service

Question 3

A network engineer needs to capture and analyze traffic crossing a VPC peering connection for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs for the peering connection.. VPC Flow Logs capture IP traffic information for network interfaces, including those attached to a VPC peering connection. They can be published to Amazon CloudWatch Logs or Amazon S3, and the logs contain fields such as source/destination IP, ports, protocol, and packet/byte counts, which are essential for troubleshooting traffic across the peering link. This is the correct service because it directly logs metadata about the traffic traversing the peering connection without requiring any changes to the network path.

Answer

AWS CloudTrail.

Answer

VPC Traffic Mirroring.

Answer

AWS Transit Gateway Network Manager.

Question 4

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

Accepted Answer

The instances are in different Availability Zones.. The primary cause of higher latency between EC2 instances in different Availability Zones is the physical distance and the additional network hops required to traverse the AZ boundary. Even within the same VPC, traffic between AZs must pass through AWS's regional network infrastructure, which introduces a baseline latency of 1-2 milliseconds, whereas instances in the same AZ can communicate with sub-millisecond latency. The question explicitly states the instances are in different AZs, making this the most likely source of the latency issue.

Answer

The instances are using jumbo frames.

Answer

The instances are in a cluster placement group.

Answer

The instances have Enhanced Networking enabled.

Question 5

A company is migrating a legacy on-premises application to AWS. The application requires multicast traffic between instances within a VPC. The network engineer must design a solution that supports multicast without modifying the application. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast domain.. AWS Transit Gateway supports multicast through the creation of a multicast domain, which allows multicast traffic to flow between instances in different subnets within the same VPC or across attached VPCs without modifying the application. This is the only native AWS service that provides multicast forwarding, making it the correct choice for this requirement.

Answer

VPC peering connections between all instance subnets.

Answer

Application Load Balancer with UDP listener.

Answer

AWS Site-to-Site VPN connections with multicast routing enabled.

Question 6

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for 172.16.0.0/16 pointing to the virtual private gateway.. The VPN status is 'available', which indicates that the VPN tunnels are established and the BGP sessions (if configured) are up. However, traffic still fails because the VPC route table lacks a route for the on-premises CIDR (172.16.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC does not know to send traffic destined for the on-premises network through the VPN connection, even though the tunnels themselves are operational.

Answer

The VPN tunnels are not in 'UP' state.

Answer

The tunnel inside CIDRs overlap with the VPC CIDR.

Answer

The BGP session is not established.

Question 7

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Accepted Answer

10.0.3.0/24. (10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Answer

10.0.1.128/25

Answer

10.1.0.0/16

Answer

10.0.2.64/26

Question 8

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and use it from the VPC.. A Gateway VPC Endpoint for S3 allows private access to S3 from within the VPC without traversing the internet or requiring public IPs. It avoids IP overlap because the endpoint uses prefix lists and route table entries within the VPC's 10.0.0.0/16 range, and does not involve the on-premises 10.0.0.0/8 network. The Direct Connect private VIF is not used for S3 traffic, so the overlapping CIDR is irrelevant.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it.

Answer

Use a public virtual interface and access S3 via public endpoints.

Answer

Add a route in the VPC route table pointing to the Direct Connect virtual interface for the S3 prefix list.

Question 9

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

Accepted Answer

Launch instances in a cluster placement group with Elastic Fabric Adapter (EFA) enabled.. Elastic Fabric Adapter (EFA) provides OS-bypass capabilities that enable HPC and machine learning workloads to achieve sub-millisecond latency by bypassing the operating system kernel for inter-instance communication. Combined with a cluster placement group, which ensures instances are in close physical proximity within a single Availability Zone, this configuration delivers the lowest possible latency for tightly coupled applications.

Answer

Launch instances in a cluster placement group with Enhanced Networking (ENA) enabled.

Answer

Launch instances in a spread placement group with SR-IOV enabled.

Answer

Launch instances in a spread placement group with Enhanced Networking (ENA) enabled.

Question 10

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route table for the private subnet. A VPC Gateway Endpoint for Amazon S3 allows instances in a private subnet to access S3 without traversing the internet or requiring a NAT gateway. This minimizes latency by routing traffic over the AWS internal network, and it avoids the cost and complexity of NAT devices. The route table for the private subnet must be updated with a route pointing to the gateway endpoint for the S3 prefix list.

Answer

Use S3 Transfer Acceleration and access the bucket via the public endpoint

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through a NAT instance

Answer

Set up a NAT gateway in the public subnet and route traffic to the S3 bucket through it