ANS-C01 Practice Exam 51 — 20 Questions

Question 1

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure high availability by using two tunnels. Which two components must be configured to achieve this? (Choose TWO.)

Accepted Answer

Two customer gateways, each with a unique public IP address. Options A and D are correct. Two customer gateways are needed for two tunnels (one per tunnel endpoint), and the virtual private gateway must have two BGP sessions, one per tunnel. Option B is wrong because one VPN connection can have two tunnels. Option C is wrong because a Transit Gateway is not required. Option E is wrong because one customer gateway is insufficient.

Answer

A single customer gateway with two IP addresses

Answer

An AWS Transit Gateway

Answer

Two VPN connections

Question 2

A company wants to centralize VPC flow log management from multiple accounts into a single S3 bucket in the management account. Which combination of AWS services should be used?

Accepted Answer

AWS Organizations and Amazon S3 bucket policy. AWS Organizations with SCP can allow cross-account S3 bucket policies. AWS CloudTrail is not needed for flow logs. Option D is correct. Options A, B, and C either miss key services or include unnecessary ones.

Answer

AWS CloudTrail and Amazon S3

Answer

AWS Lambda and Amazon S3

Answer

Amazon Kinesis Data Firehose and Amazon S3

Question 3

A financial company has a multi-account AWS environment using AWS Organizations. They have deployed a centralized inspection VPC with a third-party firewall appliance. All VPCs are attached to a Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by the firewall. The firewall is deployed in an Auto Scaling group behind a Network Load Balancer (NLB). What is the BEST way to route traffic to the firewall?

Accepted Answer

Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.. Option A is correct because Transit Gateway supports equal-cost multi-path (ECMP) routing, allowing traffic to be distributed across multiple firewall instances via the NLB. Option B is incorrect because VPC peering bypasses the Transit Gateway. Option C is incorrect because the firewall should be in the inspection VPC, not in each VPC. Option D is incorrect because the GWLB is not used here; the NLB is the correct choice.

Answer

Use a Gateway Load Balancer (GWLB) endpoint in each VPC to route traffic to the firewall.

Answer

Use VPC peering between each VPC and the inspection VPC.

Answer

Deploy a firewall appliance in each VPC and route traffic locally.

Question 4

A solutions architect is designing a hybrid network using AWS Transit Gateway with multiple VPN attachments. The on-premises network uses BGP dynamic routing. What is the best practice to achieve high availability and fast failover?

Accepted Answer

Create two VPN connections from two different customer gateways to two different AWS VPN endpoints, and enable BGP on both.. AWS VPN supports BGP dynamic routing, which provides automatic failover and route propagation. Using two VPN tunnels from the same customer gateway to two different AWS endpoints (e.g., two VPN connections to different Availability Zones) ensures high availability and fast failover if one tunnel goes down.

Answer

Use a single VPN connection with static routes.

Answer

Configure the VPN connection with a single tunnel and use static routes with a higher metric for backup.

Answer

Use only one VPN tunnel with BGP enabled.

Question 5

A network engineer is troubleshooting high latency to an application hosted in Amazon EC2. The application uses an Application Load Balancer. Which metrics in Amazon CloudWatch should be examined to identify if the load balancer is causing latency?

Accepted Answer

TargetResponseTime. Option C is correct because TargetResponseTime measures the time taken by the target to respond, which directly indicates backend latency. Option A is wrong because RequestCount is a count, not latency. Option B is wrong because ActiveConnectionCount is about concurrent connections. Option D is wrong because HTTP 5XX count indicates errors, not latency.

Answer

HTTP 5XX Count

Answer

ActiveConnectionCount

Answer

RequestCount

Question 6

A network engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs.. Option B is correct because VPC Flow Logs capture IP traffic information for network interfaces and can be used to analyze traffic between instances. Option A is wrong because CloudTrail logs API calls. Option C is wrong because AWS Config monitors configuration. Option D is wrong because CloudWatch Metrics provide performance metrics, not packet-level details.

Answer

AWS CloudTrail.

Answer

Amazon CloudWatch Metrics.

Answer

AWS Config.

Question 7

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

Accepted Answer

Amazon CloudWatch and Amazon CloudWatch Alarms. The correct answer is B because CloudWatch publishes Direct Connect metrics such as latency, and CloudWatch Alarms can trigger alerts. Option A is wrong because CloudTrail does not provide performance metrics. Option C is wrong because VPC Flow Logs do not provide latency metrics. Option D is wrong because AWS Trusted Advisor provides best-practice checks, not real-time latency monitoring.

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Trusted Advisor and Amazon SES

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Question 8

A company is using AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon VPC with public and private subnets, NAT gateways, and route tables. After deployment, the EC2 instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet with an Internet Gateway attached. What is the most likely cause?

Accepted Answer

The route table of the private subnet does not have a default route pointing to the NAT Gateway. Option D is correct because the route table associated with the private subnet must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Option A is wrong because security groups can be checked separately. Option B is wrong because NACLs are stateless and would block all traffic if misconfigured. Option C is wrong because Internet Gateway is not needed in the private subnet route; only the NAT Gateway route is needed.

Answer

The Internet Gateway is not attached to the VPC

Answer

The security group of the EC2 instances blocks outbound traffic to the internet

Answer

The network ACL of the private subnet blocks outbound traffic

Question 9

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that traffic between two VPCs in different regions is being dropped intermittently. What is the most likely cause?

Accepted Answer

Transit Gateway cannot route traffic between VPCs in different regions without inter-region peering. Option B is correct because Transit Gateway is a regional resource and does not support inter-region peering natively; traffic between VPCs in different regions must go through a VPN or Direct Connect, or use Transit Gateway inter-region peering (which must be explicitly configured). Option A is incorrect because security groups are stateful and would not drop traffic intermittently. Option C is incorrect because route propagation does not cause intermittent drops. Option D is incorrect because NAT Gateway is used for outbound traffic to the internet, not for inter-VPC traffic.

Answer

Security groups in the source VPC are blocking traffic

Answer

Route tables in the Transit Gateway are not propagating routes correctly

Answer

NAT Gateway in the source VPC is causing asymmetric routing

Question 10

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?

Accepted Answer

The NAT Gateway is in a private subnet. Option B is correct because the NAT Gateway must be in a public subnet with an internet gateway route to function. Option A is wrong because the NAT Gateway itself does not have a route; the route table of the subnet where it resides needs a route to the internet gateway. Option C is wrong because security groups are for instances, not NAT Gateways. Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.

Answer

The NAT Gateway does not have a route to the internet gateway

Answer

The VPC does not have a VPC endpoint for the software update service

Answer

The security group attached to the NAT Gateway is blocking traffic

Question 11

A network engineer needs to capture TCP traffic between an EC2 instance (eni-abc123) and an RDS instance (eni-def456) in the same VPC for troubleshooting. Which AWS service should be used to capture the traffic and store it in S3?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information at the network interface level and can publish logs to S3. Option C is correct. Options A, B, and D are not designed for packet capture or do not capture traffic between two specific ENIs.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

A company needs to centrally manage network security policies across multiple VPCs and on-premises networks. Which AWS service provides a centralized dashboard for managing firewall rules?

Accepted Answer

AWS Network Firewall. Option C is correct because AWS Network Firewall provides a centralized firewall management service. Option A is incorrect because AWS WAF is for web application firewall, not network-level policies. Option B is incorrect because NACLs are per-subnet and not centralized. Option D is incorrect because Security Groups are per-ENI and not centralized.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF

Question 13

A company is designing a highly available Direct Connect connection. Which THREE components should be deployed to meet this requirement? (Select THREE.)

Accepted Answer

Two Direct Connect connections to two different AWS Direct Connect locations.. For high availability, you need at least two Direct Connect connections (preferably to different AWS locations), two customer routers (or one router with two interfaces), and two virtual interfaces (VIFs) to provide redundancy. Using BGP with multiple sessions ensures automatic failover.

Answer

A single BGP session over one of the virtual interfaces.

Answer

A VPN connection as a backup to Direct Connect.

Question 14

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. After adding a new VPC attachment, traffic from the on-premises network cannot reach the new VPC. The on-premises BGP route table shows the prefixes of the new VPC as received. What should the engineer check?

Accepted Answer

Verify that the new VPC attachment is associated with the Transit Gateway route table that has the on-premises routes.. Option B is correct because Transit Gateway route tables control inter-VPC and on-premises connectivity; the new VPC attachment must be associated with the correct route table. Option A is wrong because the on-premises already has the routes. Option C is wrong because there is no implied propagation. Option D is wrong because subdomain is irrelevant.

Answer

Verify that the on-premises router is advertising the correct prefix to AWS.

Answer

Verify that the new VPC has a route to the Transit Gateway in its route table.

Answer

Verify that the new VPC's DNS resolution is enabled.

Question 15

A network engineer is configuring an AWS Site-to-Site VPN with dynamic routing (BGP). The customer gateway device is a Cisco router. The VPN tunnel is established, but BGP is not forming. Which configuration on the Cisco router is most likely missing?

Accepted Answer

The BGP neighbor statement with the correct Amazon ASN (64512).. Option C is correct. The BGP neighbor must have the correct ASN; a mismatch prevents session formation. Option A is wrong because the tunnel is already established, so IKE is fine. Option B is wrong because the tunnel interface is up. Option D is wrong because it's a routing protocol, not a VPN parameter.

Answer

The VPN connection's local IP address.

Answer

The correct IP address for the tunnel interface.

Answer

The pre-shared key for IKE phase 1.

Question 16

A company wants to monitor network traffic between VPCs in the same AWS Region that are connected via VPC Peering. Which AWS service can provide visibility into the traffic?

Accepted Answer

VPC Flow Logs. The correct answer is A because VPC Flow Logs can be enabled on the peering connection to capture traffic. Option B is wrong because CloudTrail does not capture network traffic. Option C is wrong because AWS Config does not provide traffic logs. Option D is wrong because Direct Connect is for on-premises, not VPC Peering.

Answer

AWS Config

Answer

AWS Direct Connect

Answer

AWS CloudTrail

Question 17

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs. The company wants to use the same Direct Connect connection for both VPCs, but the on-premises router only has one physical port. The network engineer configures a single BGP session over a VLAN-tagged interface. After configuration, only one VPC is reachable. What is the most likely reason?

Accepted Answer

Each private VIF requires a separate BGP session, and only one session was configured. Option C is correct because each private VIF requires a unique BGP session and VLAN ID. Using a single BGP session cannot serve two VIFs because the VIFs are logically separate. Option A is wrong because the same BGP ASN can be used on both VIFs if the Direct Connect gateway is used. Option B is wrong because there is no requirement to use the same VLAN. Option D is wrong because the BGP session can be established with different peer IPs.

Answer

The on-premises router is using the same BGP ASN for both VIFs, which is not allowed

Answer

The BGP peer IP addresses must be in the same subnet for both VIFs

Answer

The VLAN ID must be the same for both VIFs to work over a single physical port

Question 18

A network engineer is troubleshooting high latency on an AWS Direct Connect connection. The engineer checks the CloudWatch metrics for the virtual interface and sees that 'ConnectionBpsEgress' and 'ConnectionBpsIngress' are both below 50% of the provisioned bandwidth. Which additional metric should be examined to identify potential bufferbloat?

Accepted Answer

PauseFrames (802.3x flow control frames). Option A is correct because 'PauseFrames' indicates that the link is being flow-controlled due to congestion, which can cause bufferbloat. Option B is incorrect because CRAM is a security protocol. Option C is incorrect because CRC errors indicate physical layer issues. Option D is incorrect because latency metrics are not available for Direct Connect at the virtual interface level.

Answer

CRAM (Challenge-Response Authentication Mechanism) handshake failures

Answer

Latency metrics from Amazon CloudWatch

Answer

CRC errors on the physical connection

Question 19

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Accepted Answer

Direct Connect private virtual interface. Options A, C, and D are correct. A Direct Connect gateway is needed to connect the Direct Connect connection to the Transit Gateway. A Transit Gateway is the central hub. A Direct Connect virtual interface is the connection from on-premises to AWS. Option B is wrong because a VPN connection is not required. Option E is wrong because a VPC peering connection is not used with Transit Gateway.

Answer

VPC peering connection

Answer

AWS Site-to-Site VPN connection

Question 20

A network engineer needs to monitor the number of packets dropped by a VPC flow log for a specific network interface. Which Amazon CloudWatch metric should be used?

Accepted Answer

FlowLogsBytesDropped. VPC Flow Logs publish metrics to CloudWatch only if using the 'publish to CloudWatch Logs' option. However, the question asks about 'packets dropped' - the metric 'FlowLogsBytesDropped' is available. Option B is correct. Options A, C, and D are not actual metrics for this purpose.

Answer

NetworkPacketsDropped

Answer

VPCFlowLogsDroppedPackets

Answer

ENIDroppedPackets