ANS-C01 Practice Test 50 — 15 Questions

Question 1

A network engineer is setting up a site-to-site VPN connection between an on-premises network and AWS. After configuring the customer gateway, virtual private gateway, and VPN tunnel, the tunnel status shows 'DOWN'. Which step should the engineer take FIRST to troubleshoot?

Accepted Answer

Check the on-premises VPN device configuration for mismatched parameters. Option D is correct because the first step is to check the VPN configuration on the on-premises device to ensure it matches AWS settings. Option A is incorrect because CloudWatch metrics may not show tunnel status. Option B is incorrect because the VPN is down, so connectivity tests will fail. Option C is incorrect because checking route propagation is secondary.

Answer

Verify that route propagation is enabled on the VPC route table

Answer

Enable detailed CloudWatch metrics on the VPN connection

Answer

Test connectivity by pinging an EC2 instance in the VPC

Question 2

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for compliance. The logs should be published to a central S3 bucket in the logging account. The logging account has an S3 bucket policy that allows cross-account writes. However, flow logs are not being delivered. What is the most likely missing configuration?

Accepted Answer

The source account lacks an IAM role that grants the Flow Logs service permission to write to the central S3 bucket.. For cross-account flow log delivery, the source account must have an IAM role that trusts the logging account and allows the flow logs service to assume it. The role must have permissions to write to the S3 bucket. Without this role, logs cannot be delivered.

Answer

The VPC Flow Logs service is not enabled in the source account.

Answer

The S3 bucket policy does not grant 's3:PutObject' to the source account.

Answer

The VPC Flow Logs destination is set to CloudWatch Logs instead of S3.

Question 3

A company uses a centralized inspection VPC for traffic inspection. All VPCs route traffic to the inspection VPC via Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by a network virtual appliance in the inspection VPC. Which Transit Gateway feature should be configured?

Accepted Answer

Transit Gateway flow logs. Option D is correct because Transit Gateway flow logs can be used to verify that traffic is flowing as expected. Option A is wrong because Transit Gateway peering is for connecting TGWs, not for inspection. Option B is wrong because Transit Gateway route tables are used for routing decisions, not for ensuring inspection. Option C is wrong because Transit Gateway multicast is for multicast traffic.

Answer

Transit Gateway multicast

Answer

Transit Gateway route tables

Answer

Transit Gateway peering

Question 4

A company has a Direct Connect connection with a public VIF to access AWS public services. The on-premises network team reports that they can reach S3 but not DynamoDB. The route table on the customer router shows a default route to the public VIF. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking outbound traffic to the DynamoDB IP ranges.. Option C is correct because DynamoDB uses a different set of public IP ranges than S3, and the on-premises firewall might block access to those ranges. Option A is wrong because the VPC does not affect public VIF traffic. Option B is wrong because the public VIF does not involve BGP; it uses public IPs. Option D is wrong because the Direct Connect connection is working for S3.

Answer

The Direct Connect connection is degraded and only supports S3 traffic.

Answer

The BGP session between the customer router and AWS is down.

Answer

The VPC route table does not have a route to the DynamoDB endpoint.

Question 5

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

Accepted Answer

AWS X-Ray. The correct answer is A because AWS X-Ray provides end-to-end tracing of requests and can identify network latency. Option B is wrong because VPC Flow Logs only capture metadata, not latency. Option C is wrong because CloudTrail records API calls, not network performance. Option D is wrong because AWS Config tracks configuration changes, not performance.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 6

Which TWO actions are recommended to troubleshoot asymmetric routing in a VPC with multiple NAT gateways?

Accepted Answer

Use a single NAT gateway per Availability Zone. Asymmetric routing occurs when traffic takes different paths. Using a single NAT gateway per AZ and ensuring route tables point to the NAT gateway in the same subnet's AZ can prevent this. Additionally, disabling source/destination check on instances that do not need it can help, but for NAT gateways, this is not configurable.

Answer

Enable source/destination check on all EC2 instances

Answer

Use a Network Load Balancer to distribute traffic

Answer

Disable VPC Flow Logs

Question 7

A global company is designing a multi-region Active-Active application using Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) fronting Auto Scaling groups. The application requires sticky sessions based on the user's source IP. The network team notices that users are frequently switched to a different region mid-session, causing errors. What should the team do to resolve this issue?

Accepted Answer

Use a custom origin header in the Route 53 latency policy to route based on the user's IP address and enable ALB stickiness. Option C is correct because Route 53 latency-based routing does not natively support sticky sessions; using a custom origin header with ALB stickiness ensures users stick to the correct regional endpoint. Option A is wrong because enabling ALB stickiness alone does not prevent Route 53 from switching regions. Option B is wrong because health checks do not affect routing decisions during a session. Option D is wrong because geolocation routing would not adapt to latency and may cause incorrect routing.

Answer

Configure Route 53 health checks with a low threshold to quickly detect failures

Answer

Enable stickiness on each ALB using a cookie generated by the ALB

Answer

Switch to geolocation routing policy with a bias to maintain sessions

Question 8

A company has a Direct Connect connection with a private VIF to a VPC. The network engineer needs to ensure that traffic from the on-premises network to the VPC uses the Direct Connect path, while internet-bound traffic from the VPC uses an Internet Gateway. Which TWO configurations are required? (Select TWO.)

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway (VGW). Options A and C are correct. A: The VPC route table must have a route to the on-premises CIDR via the virtual private gateway. C: The VPC route table must have a default route (0.0.0.0/0) to the Internet Gateway. Option B is wrong because the VPC does not need a route to the Direct Connect location. Option D is wrong because the on-premises router should not have a default route to the VPC. Option E is wrong because the VPC does not need a NAT gateway for internet access if using an Internet Gateway.

Answer

Add a route in the VPC route table for the Direct Connect location prefix

Answer

Deploy a NAT Gateway in the VPC for internet access

Answer

Configure the on-premises router to send all internet traffic to the VPC

Question 9

A company has a Direct Connect connection with a private VIF and a public VIF. The private VIF is used to access VPC resources, and the public VIF is used to access AWS public services. Recently, the company enabled AWS Global Accelerator for its application. The network team notices that traffic to the application via Global Accelerator is not using the Direct Connect connection but is going over the internet. What should the team do to ensure traffic uses the Direct Connect public VIF?

Accepted Answer

Configure a VPN connection over the Direct Connect public VIF to route Global Accelerator traffic. Option A is correct because Global Accelerator uses anycast IPs that are advertised over the public internet; to route traffic via Direct Connect, the on-premises routes must point to the public VIF. Option B is wrong because private VIF is for VPC access, not public services. Option C is wrong because the Direct Connect gateway is for private VIFs. Option D is wrong because VPN is not required.

Answer

Advertise the Global Accelerator IP addresses on the on-premises router to route traffic via the public VIF

Answer

Attach a Direct Connect gateway to the Global Accelerator

Answer

Create a private VIF for Global Accelerator traffic

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?

Accepted Answer

Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway. Option B is correct because the NAT Gateway's Elastic IP must be associated and the route table of the private subnet must point to the NAT Gateway. Option A is wrong because the NAT Gateway is in the public subnet. Option C is wrong because an Internet Gateway is attached to the VPC, not the subnet. Option D is wrong because the NAT Gateway is not in a public subnet if it has an EIP and route to IGW.

Answer

Move the NAT Gateway to a private subnet

Answer

Verify that the NAT Gateway is in the same subnet as the EC2 instance

Answer

Attach an Internet Gateway to the private subnet

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance is associated with an Elastic IP address. The route table for the private subnet has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in the public subnet and has an Elastic IP. Despite this, the instance cannot reach the internet. The security groups and NACLs are properly configured. What is the likely cause?

Accepted Answer

The NAT gateway's Elastic IP is not associated with the NAT gateway. If an instance has a public IP (Elastic IP) and is in a private subnet, the route to the internet must go through a NAT gateway or Internet Gateway. The private subnet's route table points to NAT, which is correct. However, the NAT gateway itself must have a route to the internet via an Internet Gateway. Option C is correct. Options A, B, and D are common misconfigurations but not the most likely given the setup.

Answer

The NAT gateway is not in a public subnet

Answer

The private subnet's network ACL is blocking outbound traffic

Answer

The EC2 instance does not have a route to the internet

Question 12

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway for outbound internet access. The security team wants to audit all traffic from the private subnets to the internet. Which TWO steps should be taken to capture this traffic?

Accepted Answer

Create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface.. Option A is correct because VPC Flow Logs capture traffic for the NAT gateway interface. Option D is correct because enabling flow logs on the NAT gateway captures traffic sent through it. Option B is incorrect because the internet gateway does not see traffic from private subnets. Option C is incorrect because CloudTrail does not capture network traffic. Option E is incorrect because VPN is not used here.

Answer

Enable VPC Flow Logs on the internet gateway.

Answer

Set up an AWS Site-to-Site VPN to route traffic through a third-party logging appliance.

Answer

Enable AWS CloudTrail for the NAT gateway.

Question 13

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The issue occurs only during peak business hours. CloudWatch metrics show increased latency and packet loss at the Direct Connect virtual interface. What is the MOST likely cause?

Accepted Answer

Insufficient bandwidth on the Direct Connect connection. Option A is correct because insufficient bandwidth leads to congestion during peak hours, causing latency and packet loss. Option B is incorrect because asymmetric routing would cause persistent issues, not intermittent. Option C is incorrect because BGP peering issues would cause complete loss, not just latency/packet loss. Option D is incorrect because VPN over Direct Connect is not a common configuration and would not cause these symptoms.

Answer

VPN tunnel misconfiguration over Direct Connect

Answer

Asymmetric routing between on-premises and AWS

Answer

BGP peering session flapping

Question 14

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over AWS Site-to-Site VPN. The VPN tunnel status is UP, and BGP is established. The engineer can ping the on-premises server's private IP from the EC2 instance, but TCP connections to a specific port (e.g., 443) are timing out. What is the most likely cause?

Accepted Answer

Security group or network ACL blocking inbound TCP port 443 on the EC2 instance. Option B is correct because security groups or network ACLs can block specific ports while allowing ICMP. Option A is wrong because MTU mismatch would affect all traffic. Option C is wrong because the VPN tunnel is UP, so routing issues would affect all traffic. Option D is wrong because BGP is established, indicating proper route exchange.

Answer

Incorrect route table entries on the on-premises router for the VPC CIDR

Answer

MTU mismatch on the VPN tunnel causing packet fragmentation for TCP

Answer

BGP prefix limits exceeded causing route table incompleteness

Question 15

A company is using AWS Global Accelerator to improve performance for a global application. The application uses an Application Load Balancer (ALB) in each region. The network team wants to ensure that traffic is distributed evenly across regions and that failover happens quickly. Which THREE steps should the team take? (Select THREE.)

Accepted Answer

Configure multiple endpoint groups, one per region, and set traffic dials to distribute load. Options A, C, and D are correct. A: Multiple endpoint groups with traffic dials allow distributing traffic across regions. C: Health checks on endpoints ensure quick failover. D: Adjusting traffic dials can fine-tune distribution. Option B is wrong because weighted routing is not a Global Accelerator feature; it uses proximity. Option E is wrong because client IP preservation is not related to traffic distribution.

Answer

Enable client IP address preservation on the Global Accelerator

Answer

Use Route 53 weighted routing in front of Global Accelerator