ANS-C01 Practice Exam 55 — 20 Questions

Question 1

A network team is planning a migration of a legacy application to AWS. The application requires a static IP address for the on-premises firewall whitelist. Which THREE AWS services can provide a static IP address for outbound traffic from a VPC?

Accepted Answer

AWS Direct Connect with a public virtual interface.. Options A, B, and E are correct. NAT Gateway provides a static EIP, Direct Connect uses public VIF with static IP, and an internet-facing NLB can provide static IPs. Option C is wrong because VPC endpoints do not provide static IP. Option D is wrong because ALB does not have static IP by default.

Answer

VPC endpoint (gateway endpoint) for S3.

Answer

Application Load Balancer without a static IP.

Question 2

A company wants to implement a network monitoring solution that provides real-time traffic analysis and anomaly detection. Which THREE AWS services should be used together?

Accepted Answer

Amazon GuardDuty. The correct answers are A, B, and E. VPC Flow Logs capture traffic, CloudWatch provides metrics and alarms, and GuardDuty provides anomaly detection. Option C is wrong because CloudTrail is for API logs, not traffic analysis. Option D is wrong because AWS Config is for configuration tracking.

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

A company is experiencing intermittent SSH connection failures to their EC2 instances in a VPC. The instances are in a private subnet with a NAT gateway. The security group allows inbound SSH from the corporate CIDR. The network ACL is set to default allow all. The route table has a route to the NAT gateway for 0.0.0.0/0. What is the most likely cause of the intermittent failures?

Accepted Answer

The security group outbound rules are not allowing return traffic.. Option C is correct because security groups are stateful, but if the security group does not allow inbound ICMP or the specific ephemeral ports for SSH, connections may fail intermittently due to session tracking issues. However, the more common cause in such scenarios is the NAT gateway's IP address changing if it is not associated with an Elastic IP, or the security group outbound rule not allowing return traffic. Option A is plausible but less likely as NACLs are stateless and would not cause intermittent issues. Option B is incorrect because the NAT gateway does not use an Elastic IP if not configured. Option D is incorrect because a proxy is not typically needed.

Answer

The network ACL inbound rule is blocking ephemeral ports.

Answer

The instances are behind a proxy that is not configured.

Answer

The NAT gateway does not have an Elastic IP associated.

Question 4

A network engineer is configuring VPC Flow Logs to deliver to an S3 bucket in a different account. The bucket policy is shown. The flow logs are not being delivered. What is the most likely reason?

Accepted Answer

The aws:SourceArn condition restricts access to a specific account, but the flow logs are from a different account. Option C is correct because the bucket policy uses the log delivery service principal from account 123456789012, but the flow logs are from a different account. The policy needs to allow access for the source account's log delivery service. Option A is incorrect because the action is correct. Option B is incorrect because the resource includes the full path. Option D is incorrect because the Principal is correct for cross-account delivery.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject

Answer

The Principal must be the destination account's log delivery service

Answer

The Resource does not include the bucket ARN itself

Question 5

A company has multiple AWS accounts and wants to centralize VPC flow logs for analysis. The flow logs are published to Amazon S3 in each account. A central account needs to access these logs. Which solution meets the requirements with the least operational overhead?

Accepted Answer

Use S3 bucket policies in each account to grant the central account access. Option C is correct because cross-account bucket policies allow the central account to access logs without additional infrastructure. Option A is wrong because VPC peering does not grant S3 access. Option B is wrong because Transit Gateway does not provide S3 access. Option D is wrong because it adds complexity.

Answer

Set up AWS Glue jobs to copy logs to a central S3 bucket

Answer

Use AWS Transit Gateway to centralize network traffic and capture logs

Answer

Use VPC peering to connect the accounts and access the S3 buckets directly

Question 6

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The network engineer needs to capture all traffic between the VPC and the internet. Which THREE resources must have VPC Flow Logs enabled?

Accepted Answer

Internet gateway. Option B is correct because the internet gateway (igw) is the attachment point to the internet. Option D is correct because egress-only internet gateway handles IPv6 traffic. Option E is correct because the NAT gateway handles IPv4 traffic from private subnets. Option A is incorrect because VPC itself does not have flow logs; they are on network interfaces. Option C is incorrect because subnets do not have flow logs directly.

Answer

Subnet

Answer

VPC

Question 7

Refer to the exhibit. The IAM policy above is attached to a user in account A (123456789012). The user needs to create a VPC peering connection with account B and accept it. The user in account A can create the peering request, but the accept fails with an 'UnauthorizedOperation' error. What is the MOST likely reason?

Accepted Answer

The user does not have permission to accept the peering connection from the other account. Option C is correct because the 'AcceptVpcPeeringConnection' action is allowed on all resources ('*'), but the specific ARN for the peering connection is not granted for the accept action. The second statement allows actions only on peering connections in account A, but the accept action is performed on the requester's side? Actually, the accept is done by the accepter (account B). The user in account A is trying to accept? The scenario says 'the user in account A can create the peering request, but the accept fails'. Actually, the accept is done by account B. So the user in account A cannot accept a peering connection that belongs to account B. The policy allows accept on 'ec2:AcceptVpcPeeringConnection' with resource '*', but the accept action is performed on the resource in the accepter account. The second statement restricts to peering connections in account A. The accept action is not covered by the second statement because it's not in the action list of the second statement. Wait, the first statement allows accept on all resources. So why would it fail? The issue is that the accept action is called on the peering connection resource in the accepter account, which is not in account A. The policy does not have permissions for resources in other accounts. The correct answer is that the user does not have permission to accept the peering connection because the resource ARN in the second statement only covers peering connections in account A. But the first statement allows accept on all resources. However, the 'ec2:AcceptVpcPeeringConnection' action requires permission on the resource of the peering connection in the accepter account. Since the user is in account A, they cannot accept a peering connection that is owned by account B. The most likely reason is that the user lacks permissions to accept the peering connection in the other account. Option C captures this.

Answer

The user does not have permission to create routes in the VPC

Answer

The 'ec2:CreateVpcPeeringConnection' action requires a specific VPC ARN

Answer

The 'ec2:AcceptVpcPeeringConnection' action is not allowed in the policy

Question 8

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a VPC and an on-premises data center over a Direct Connect virtual interface. The engineer notices that the BGP session is flapping. Which configuration should the engineer verify first?

Accepted Answer

Verify that the BGP hold timer and keepalive interval are consistent between the on-premises router and the AWS side.. Option B is correct because BGP timers mismatch is a common cause of BGP session flapping. Option A is wrong because MTU mismatch typically causes packet loss, not BGP flap. Option C is wrong because VIF state being active is required for BGP but flapping suggests a configuration issue. Option D is wrong because route propagation is about route distribution, not BGP session stability.

Answer

Verify that the MTU setting on the Direct Connect virtual interface matches the on-premises router.

Answer

Verify that the on-premises router is advertising the correct prefix to AWS.

Answer

Verify that the Direct Connect virtual interface is in the 'available' state.

Question 9

A company uses AWS CloudFormation to manage its network infrastructure. After a recent update, the stack fails to update, with an error indicating that a security group rule conflicts with an existing rule. What is the most likely cause?

Accepted Answer

The template attempts to add a security group rule that already exists.. Option B is correct because a duplicate security group rule (same protocol, port, and source) causes a conflict. Option A is wrong because IAM permissions cause a different error. Option C is wrong because it would not cause a conflict error. Option D is wrong because security groups are typically referenced by ID, not name.

Answer

The CIDR block in the rule is not in the same VPC.

Answer

The referenced security group was deleted outside of CloudFormation.

Answer

The stack update exceeded the service quota for security groups.

Question 10

A company is migrating from a legacy MPLS network to AWS using Direct Connect. The network team wants to ensure high availability with a backup connection. They have two Direct Connect connections from different providers, both terminating at the same AWS Direct Connect location. Which configuration provides the most resilient setup?

Accepted Answer

Use both connections with separate virtual interfaces, each terminating on different customer routers.. Option D is correct. Using two different devices and separate virtual interfaces provides redundancy at both the physical and logical level. Option A is wrong because a single device is a single point of failure. Option B is wrong because a single VIF is a single point of failure. Option C is wrong because using the same provider reduces diversity.

Answer

Use both connections but from the same provider to simplify management.

Answer

Use one connection with two virtual interfaces for redundancy.

Answer

Use both connections with a single virtual interface on each, but terminate on the same router.

Question 11

A network engineer is troubleshooting SSH connectivity to an EC2 instance in subnet subnet-0abcd1234efgh5678, which is associated with the network ACL shown. The security group allows inbound SSH. Why can't the engineer SSH to the instance?

Accepted Answer

The network ACL is not associated with the subnet. Option C is correct because network ACLs are evaluated in order of rule number; rule 100 allows SSH, but rule 200 denies SSH (same port, but deny overrides allow because it is evaluated later? Actually, in NACLs, rules are evaluated from lowest to highest, and the first matching rule determines the action. Since rule 100 allows, rule 200 is never reached. However, rule 300 denies all traffic. Since rule 300 has a higher number, it will not override earlier allow rules. Wait: The correct behavior: NACL rules are processed in order; the first rule that matches the traffic determines the action. Since rule 100 matches SSH traffic and allows it, rule 200 and 300 are not evaluated for that traffic. So SSH should be allowed. But the question says can't SSH. Let me re-check: The exhibit shows rule 100 allows SSH, rule 200 denies SSH (same criterion), rule 300 denies all traffic. Since rule 100 matches first, SSH should be allowed. So maybe the issue is that the subnet is not associated with this NACL? Or maybe the security group is blocking? But the security group allows SSH. The most likely cause is that the NACL's inbound rule 100 allows SSH, but the outbound rules might be blocking. However, the exhibit only shows inbound entries. Option A is incorrect because rule 300 is a deny-all, but it is evaluated after rule 100. Option B is incorrect because rule 200 is a deny, but it is not evaluated. Option D is incorrect because security groups are stateful. Actually, the correct answer might be that the NACL's outbound rules are causing the issue, but the exhibit does not show outbound rules. However, since the question asks about the exhibit, we need to pick the best answer. The exhibit shows only inbound rules; maybe the outbound default deny is blocking return traffic? But NACLs are stateless, so return traffic must be allowed by outbound rules. The exhibit does not show outbound rules. The default outbound rule is deny all. So that could be the issue. But among the options, none mention outbound. Let me re-read the options. Option A: 'The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule.' This is incorrect because rule 100 is processed first. Option B: 'The network ACL rule 200 denies SSH traffic, overriding rule 100.' Incorrect because rule 100 is processed first. Option C: 'The network ACL is not associated with the subnet.' This could be the reason. Option D: 'The security group is blocking SSH traffic.' But the scenario says security group allows SSH. So most likely, the NACL is not associated. Therefore, option C is correct.

Answer

The security group is blocking SSH traffic

Answer

The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule

Answer

The network ACL rule 200 denies SSH traffic, overriding rule 100

Question 12

A network engineer is configuring an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer creates a customer gateway, VPN connection, and virtual private gateway. The VPN tunnel status shows 'down'. Which configuration step is most likely missing?

Accepted Answer

Configure the on-premises router with the correct pre-shared key and tunnel IP addresses. Option C is correct because the on-premises router must have the correct tunnel interface configuration matching AWS parameters. Option A is wrong because route propagation is for dynamic routing, not tunnel establishment. Option B is wrong because the VPN connection includes the tunnel configuration. Option D is wrong because propagation is not required for tunnel status.

Answer

Attach the VPN connection to the virtual private gateway

Answer

Enable route propagation on the virtual private gateway

Answer

Add a static route to the VPN connection in the route table

Question 13

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team notices increased latency and packet loss during peak hours. The Direct Connect virtual interface (VIF) is configured as a private VIF to a VPC. What is the MOST likely cause of the issue?

Accepted Answer

The VIF bandwidth is insufficient for the traffic volume.. Option C is correct because bursty traffic can exceed the VIF bandwidth and cause congestion, leading to latency and packet loss. Option A is incorrect because BGP timers affect routing convergence, not bandwidth. Option B is incorrect because jumbo frames would improve throughput, not cause packet loss. Option D is incorrect because the issue is during peak hours, not a persistent MTU mismatch.

Answer

Jumbo frames are not enabled on the VIF.

Answer

The BGP keepalive timer is set too low.

Answer

The MTU size of the VIF is set to 1500 bytes.

Question 14

A network engineer needs to monitor network performance between two EC2 instances in different Availability Zones. Which THREE metrics from Amazon CloudWatch should the engineer use?

Accepted Answer

NetworkPacketsIn. Options B, D, and E are correct for network performance monitoring. Option A is a metric for EBS volumes. Option C is not a standard metric.

Answer

VolumeQueueLength

Answer

NetworkPacketsDropped

Question 15

A network engineer troubleshoots a VPN connection that shows 'available' state but traffic is not passing. The on-premises firewall logs show that the tunnel is established, but no traffic. The engineer checks the VPN configuration. Based on the exhibit, what is the MOST likely cause of the problem?

Accepted Answer

The VPN is configured for BGP (StaticRoutesOnly: false), but only a static route is added.. Option A is correct because the VPN connection has StaticRoutesOnly set to false, meaning dynamic routing (BGP) is expected, but the route shown is a static route, which would not be used because the VPN is configured for BGP. Option B is incorrect because the VPN state is available. Option C is incorrect because the inside IP addresses are present. Option D is incorrect because the outside IP addresses are routable.

Answer

The VPN connection is not in 'available' state.

Answer

The outside IP addresses are not routable over the internet.

Answer

The inside IP addresses for the tunnels are missing.

Question 16

Refer to the exhibit. A Direct Connect private virtual interface is in the 'available' state, and the BGP session is up. However, the on-premises network cannot reach any resources in the VPC attached to the Direct Connect gateway. What is the MOST likely cause?

Accepted Answer

The Direct Connect gateway is not associated with the virtual private gateway or route propagation is not enabled. Option B is correct because even though the BGP session is up, the on-premises router may not be learning the VPC routes. The Direct Connect gateway must be associated with the virtual private gateway and route propagation must be enabled. Option A is incorrect because the BGP session is up. Option C is incorrect because the VLAN is configured. Option D is incorrect because the ASN is valid.

Answer

The BGP ASN is private and not allowed

Answer

The VLAN ID is incorrect

Answer

The BGP session is not established

Question 17

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet.. Option C is correct because the NAT gateway must be in a public subnet with an internet gateway to route traffic. Option A is wrong because security groups are stateful and allow outbound traffic by default. Option B is wrong because a public IP is not needed for outbound traffic through NAT. Option D is wrong because network ACLs are stateless and need explicit rules, but the default allows outbound traffic.

Answer

The instance does not have a public IP address assigned.

Answer

The security group attached to the instance does not allow outbound HTTPS traffic.

Answer

The network ACL on the private subnet blocks outbound HTTP traffic.

Question 18

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its data center to a VPC. The network team needs to ensure high availability and failover in case the primary connection fails. Which solution provides the most cost-effective high availability?

Accepted Answer

Provision a second Direct Connect connection at a different AWS Direct Connect location and configure BGP with AS_PATH prepending. Option C is correct because using a second Direct Connect connection to a different AWS Direct Connect location provides geographic redundancy. Option A is wrong because it's a single point of failure. Option B is wrong because VPN over the same Direct Connect relies on the same physical connection. Option D is wrong because adding a VPN over the internet provides a backup but is not as reliable as a second Direct Connect.

Answer

Use a VPN connection over the internet as a backup

Answer

Use a VPN connection over the same Direct Connect connection as backup

Answer

Provision a second private virtual interface on the same Direct Connect connection

Question 19

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They want to centralize outbound internet traffic through a single VPC with a NAT gateway. The security team requires that all traffic to the internet must be logged. Which solution is MOST operationally efficient?

Accepted Answer

Enable VPC Flow Logs on the central VPC and publish to Amazon CloudWatch Logs. Option C is correct because VPC Flow Logs capture all IP traffic and can be published to CloudWatch Logs for analysis. Option A is incorrect because it only captures traffic through the NAT gateway, not all internet-bound traffic. Option B is incorrect because AWS CloudTrail logs API calls, not network traffic. Option D is incorrect because it adds complexity and is not necessary.

Answer

Enable VPC Flow Logs on the NAT gateway's subnet and publish to Amazon S3

Answer

Deploy a third-party firewall appliance in the central VPC and enable logging

Answer

Enable AWS CloudTrail to log all network events

Question 20

A company is using AWS Client VPN to provide remote access to employees. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a subnet, and authorization rules are configured. What is the most likely cause?

Accepted Answer

The Client VPN endpoint's security group does not allow inbound traffic from the client IP pool.. The Client VPN endpoint must be associated with a subnet, but the subnet must have a route to the target network (e.g., the VPC CIDR). If the route table for the subnet does not have a route back to the VPC CIDR via the VPN endpoint, traffic will not be forwarded. Alternatively, the security group on the VPN endpoint must allow inbound traffic from the client CIDR.

Answer

The VPC's network ACLs are blocking traffic.

Answer

The authorization rules are not associated with the correct groups.

Answer

The subnet association is missing.