ANS-C01 Practice Exam 56 — 20 Questions

Question 1

A company uses AWS Direct Connect and VPN as backup. The network team notices that during a VPN failover, traffic drops for several minutes. The VPN tunnels are configured with BGP dynamic routing. Which configuration change would MOST likely reduce failover time?

Accepted Answer

Enable BFD on the VPN BGP sessions. Option B is correct because BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions, reducing failover time. Option A is wrong because increasing the keepalive interval and decreasing the hold timer can help but may not be as fast as BFD. Option C is wrong because decreasing the keepalive interval and increasing the hold timer would slow down failure detection. Option D is wrong because static routes do not dynamically adapt to failures.

Answer

Configure static routes over the VPN instead of BGP

Answer

Increase the BGP keepalive interval and decrease the hold timer

Answer

Decrease the BGP keepalive interval and increase the hold timer

Question 2

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while blocking inbound internet traffic. Which TWO components are required? (Select TWO.)

Accepted Answer

A NAT Gateway in a public subnet.. Option A is correct because a NAT Gateway provides outbound internet access to instances in private subnets. Option D is correct because the private subnet's route table must have a route to the NAT Gateway for internet-bound traffic. Option B is wrong because an Internet Gateway is used for public subnets, not private. Option C is wrong because a Virtual Private Gateway is for VPN connections. Option E is wrong because a VPC Peering connection connects VPCs, not to the internet.

Answer

A Virtual Private Gateway.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Peering connection.

Question 3

A company has a Direct Connect connection with a private virtual interface. The on-premises network team reports that they cannot reach EC2 instances in a VPC. The VPC has a virtual private gateway attached. The route table in the VPC has a route to the on-premises CIDR via the virtual private gateway. What should the network engineer verify?

Accepted Answer

Verify that the VPC route table has a route to the on-premises CIDR pointing to the virtual private gateway.. Option B is correct because the VPC route table needs a route to the on-premises CIDR pointing to the virtual private gateway. Option A is wrong because the virtual interface must be up. Option C is wrong because BGP sessions must be established. Option D is wrong because the on-premises router must advertise routes.

Answer

Verify that the Direct Connect virtual interface is in the 'available' state.

Answer

Verify that the BGP session between the on-premises router and the VGW is established.

Answer

Verify that the on-premises router is advertising the VPC CIDR.

Question 4

A network engineer is monitoring network performance between an EC2 instance and an on-premises server using AWS VPN. The engineer notices intermittent packet loss. Which AWS service can provide detailed network metrics and path visualization to troubleshoot?

Accepted Answer

AWS Transit Gateway Network Manager. AWS X-Ray is for application tracing, not network path. VPC Flow Logs provide packet metadata but not path visualization. Amazon CloudWatch can monitor VPN tunnels but not path. AWS Transit Gateway Network Manager provides network topology and path visualization.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS X-Ray

Question 5

Which TWO are valid methods to monitor and troubleshoot AWS Direct Connect connections?

Accepted Answer

Enable Direct Connect Connection and Virtual Interface metrics in CloudWatch.. Options A and B are correct. Option C is incorrect because VPC Flow Logs do not capture Direct Connect traffic. Option D is incorrect because CloudFront is not related to Direct Connect monitoring. Option E is incorrect because CloudTrail does not provide real-time connection monitoring.

Answer

Use CloudFront to monitor Direct Connect utilization.

Answer

Enable AWS CloudTrail to log Direct Connect API calls.

Answer

Enable VPC Flow Logs on the VIF.

Question 6

A company has deployed a multi-VPC architecture with AWS Transit Gateway. The network team notices that traffic between two VPCs is intermittently dropped. Both VPCs are attached to the same transit gateway. Which action should the network engineer take to troubleshoot the issue?

Accepted Answer

Enable VPC Flow Logs on the subnets of the VPCs.. Option B is correct because enabling VPC Flow Logs captures IP traffic information, which helps identify dropped packets. Option A is wrong because CloudWatch metrics do not provide packet-level details. Option C is wrong because Transit Gateway Network Manager provides topology visualization, not packet drops. Option D is wrong because Direct Connect is unrelated to inter-VPC traffic.

Answer

Configure AWS Direct Connect to route traffic between the VPCs.

Answer

Use Transit Gateway Network Manager to view the network topology.

Answer

Enable CloudWatch metrics for the transit gateway attachments.

Question 7

A network engineer is troubleshooting connectivity issues between two VPCs that are connected via VPC peering. The VPCs are in the same region and have overlapping CIDR blocks. The engineer can ping the private IP of an instance in the peered VPC from an instance in the first VPC. However, traffic on TCP port 443 (HTTPS) fails. Which is the most likely cause?

Accepted Answer

The security group of the target instance does not allow inbound HTTPS traffic from the source. Option A is correct because the security group of the target instance must allow inbound HTTPS traffic from the source instance's security group or CIDR. Option B is wrong because ICMP works. Option C is wrong because the route table has a route to the peering connection. Option D is wrong because NACLs are stateless and would block ICMP too if misconfigured.

Answer

The network ACL in the target subnet is blocking inbound HTTPS traffic

Answer

The VPC peering connection is not in the 'active' state

Answer

The route tables in both VPCs do not have routes to the peered VPC's CIDR

Question 8

A network engineer is troubleshooting intermittent connectivity issues between two VPCs that are peered. The VPC peering connection is in the 'active' state. ICMP ping from an instance in VPC A to an instance in VPC B fails intermittently. What is the most likely cause?

Accepted Answer

The route tables in one or both VPCs lack routes to the peer VPC's CIDR via the peering connection.. Since the VPC peering connection is active, the issue is likely that the route tables in one or both VPCs are not correctly configured to route traffic to the peered VPC's CIDR via the peering connection. Without proper routes, traffic is dropped.

Answer

The network ACLs are blocking ICMP traffic.

Answer

The security groups on the instances do not allow inbound ICMP.

Answer

The VPC peering connection is not in the 'active' state.

Question 9

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that S3 traffic is taking a suboptimal path over the internet instead of the Direct Connect. Which configuration is MOST likely missing?

Accepted Answer

The VPC route tables are not updated to include the Direct Connect route. Option A is correct because without propagating the Direct Connect route to the VPC route tables, traffic may default to the internet. Option B is wrong because VPC endpoints are for private connectivity, but the question already uses Direct Connect. Option C is wrong because the public VIF already provides access to AWS public services. Option D is wrong because the Direct Connect gateway is used for private VIFs, not public VIFs.

Answer

The public VIF is not associated with the VPC

Answer

A Direct Connect gateway is not attached to the VPC

Answer

A VPC endpoint for S3 is not configured

Question 10

A network engineer ran the command shown in the exhibit to check VPC peering connections. Two peering connections are active. The engineer wants to verify that routes are correctly configured. What additional step is needed to ensure that instances in vpc-11111111 can communicate with instances in vpc-33333333?

Accepted Answer

Add a route in the route table of vpc-11111111 pointing to vpc-33333333 via the peering connection, and a route in vpc-33333311 pointing to vpc-11111111 via the same peering connection.. Option B is correct because VPC peering requires route table entries in both VPCs pointing to the peering connection. Option A is wrong because the peering is active. Option C is wrong because security groups need to allow traffic, but routing is the first step. Option D is wrong because DNS resolution is not required for IP communication.

Answer

Configure security groups to allow traffic between the VPCs.

Answer

Enable DNS resolution for the peering connection.

Answer

Ensure that the peering connection is in the 'active' state.

Question 11

A network engineer is designing a multi-region application that requires low-latency traffic between EC2 instances in two different AWS Regions. The engineer needs to ensure that traffic between the instances uses the AWS global network and not the public internet. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator. The correct answer is D because VPC Peering does not support inter-region peering unless explicitly enabled, but Global Accelerator uses the AWS global network to route traffic. However, the question asks for low-latency traffic between EC2 instances in different Regions; AWS Transit Gateway does not support inter-region peering by default, and Direct Connect is for on-premises. Option A is wrong because VPC Peering requires explicit inter-region peering and does not provide low-latency optimization. Option B is wrong because Transit Gateway does not natively support inter-region connectivity. Option C is wrong because Direct Connect is for on-premises to AWS. Option D is correct because Global Accelerator routes traffic over the AWS global network.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 12

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The engineer notices that BGP sessions are flapping. What should the engineer check first?

Accepted Answer

Verify BGP timers and ensure they match on both sides.. Option B is correct because BGP timers mismatches are a common cause of flapping. Option A is incorrect because VIF status doesn't directly cause flapping if BGP timers mismatch. Option C is incorrect because MTU issues typically cause packet loss, not flapping. Option D is incorrect because routing policies affect route propagation, not BGP session stability.

Answer

Configure route propagation in the VPC route tables.

Answer

Check the virtual interface (VIF) status in the AWS console.

Answer

Increase the MTU on the Direct Connect link.

Question 13

A company runs a multi-account AWS environment using AWS Organizations. They need to centrally manage VPC flow logs across all accounts and enable analysis for security incidents. The flow logs must be stored in a central S3 bucket in the management account. What is the MOST scalable and cost-effective approach?

Accepted Answer

Configure VPC Flow Logs in each account to deliver to a central S3 bucket using cross-account delivery.. Option B is correct because sending flow logs to a central S3 bucket using cross-account delivery is scalable and cost-effective. Option A is incorrect because logging to CloudWatch Logs in each account and then exporting incurs additional costs and complexity. Option C is incorrect because VPC Flow Logs cannot be sent directly to a central S3 bucket from member accounts without enabling cross-account delivery. Option D is incorrect because VPC Flow Logs do not support Kinesis Data Firehose directly.

Answer

Use a Lambda function in each account to copy flow logs from CloudWatch to a central S3 bucket.

Answer

Deliver flow logs to Kinesis Data Firehose in each account and then to a central S3 bucket.

Answer

Create flow logs in each account and export them to a central CloudWatch Logs destination.

Question 14

A company is using AWS Direct Connect with a private VIF to connect to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot establish TCP connections to an EC2 instance's private IP. The security groups and NACLs are configured to allow the traffic. What is the most likely cause of this issue?

Accepted Answer

The EC2 instance's operating system firewall is blocking TCP traffic. If pings work but TCP connections fail, the issue is likely at Layer 4 or above. The most common cause is the EC2 instance's operating system firewall (e.g., iptables) blocking inbound TCP. Option D is correct. Options A, B, and C are Layer 3 issues that would affect ping as well.

Answer

The Direct Connect virtual interface is in a down state

Answer

The on-premises firewall is blocking ICMP but not TCP

Answer

The VPC route table is missing a route for the on-premises CIDR

Question 15

A network engineer is troubleshooting why an EC2 instance (with the above security group) is not responding to HTTP requests from the internet. The instance is in a public subnet with an Internet Gateway attached. The route table has a default route to the Internet Gateway. What is the most likely cause?

Accepted Answer

The security group only allows traffic from the 10.0.0.0/8 range. The security group allows HTTP from 10.0.0.0/8 only, which is a private IP range. It does not allow traffic from 0.0.0.0/0 (the internet). Option B is correct. Options A, C, and D are not the issue.

Answer

The security group does not allow inbound ICMP traffic

Answer

The route table does not have a route for the internet

Answer

The network ACL is blocking inbound HTTP

Question 16

A company is using AWS Transit Gateway with multiple VPC attachments. They need to ensure that traffic between two specific VPCs is encrypted in transit. The VPCs are in the same AWS region. What is the SIMPLEST solution?

Accepted Answer

Create a VPN attachment on the Transit Gateway and route traffic through it. Option B is correct because an AWS Transit Gateway supports transit gateway peering attachments with VPN encryption for traffic between VPCs. Option A is incorrect because the Transit Gateway itself does not encrypt traffic. Option C is incorrect because VPC peering does not provide encryption by default. Option D is incorrect because AWS PrivateLink is for services, not VPC-to-VPC encryption.

Answer

Enable encryption on the Transit Gateway route tables

Answer

Use AWS PrivateLink to connect the VPCs

Answer

Use VPC peering instead of Transit Gateway and enable encryption

Question 17

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company wants to ensure that traffic to the VPC uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the virtual private gateway.. To ensure traffic uses Direct Connect, the route table in the VPC must have a route to the on-premises CIDR via the virtual private gateway (VGW) attached to the Direct Connect. Additionally, on the on-premises side, routes must point to the Direct Connect. The VPC route table should have a more specific route or a default route pointing to the VGW.

Answer

Create a VPC peering connection to the on-premises network.

Answer

Use a NAT gateway in the VPC.

Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the internet gateway.

Question 18

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They want to limit traffic between specific VPCs for security purposes. Which feature should they use?

Accepted Answer

Transit Gateway route tables.. Option C is correct because Transit Gateway route tables can be used to control traffic between attachments by creating separate route tables and associating attachments accordingly. Option A is wrong because Network ACLs are per-subnet, not per-VPC. Option B is wrong because security groups are instance-level. Option D is wrong because VPC Flow Logs are for monitoring, not control.

Answer

Security groups attached to the Transit Gateway.

Answer

VPC Flow Logs.

Answer

Network ACLs in each VPC.

Question 19

A network engineer is designing a hybrid network with Direct Connect and VPN backup. The company has multiple VPCs connected via Transit Gateway. They want to use BGP to exchange routes. Which BGP feature should be configured to fail over from Direct Connect to VPN if the Direct Connect link goes down?

Accepted Answer

BGP communities. Option C is correct because BGP communities allow controlling route preference; AWS uses community tags to influence route priority. Option A is wrong because BFD detects failures faster but does not control preference. Option B is wrong because AS_PATH prepending is used to influence inbound routes, not outbound. Option D is wrong because MED is used to influence inbound routes.

Answer

Multi-Exit Discriminator (MED)

Answer

Bidirectional Forwarding Detection (BFD)

Answer

AS_PATH prepending

Question 20

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Accepted Answer

iperf. Option A and Option D are correct. iperf measures network throughput, and traceroute shows the path and latency. Option B is wrong because nslookup does not measure throughput. Option C is wrong because tcpdump captures packets but does not measure throughput. Option E is wrong because ping measures latency but not throughput.

Answer

tcpdump

Answer

nslookup

Answer

ping