ANS-C01 Practice Exam 57 — 20 Questions

Question 1

A network administrator is setting up VPC Flow Logs to monitor traffic to an Amazon RDS instance. The logs are sent to Amazon S3. After enabling Flow Logs, the administrator notices that no logs are being delivered. What is the most likely cause?

Accepted Answer

The IAM role for Flow Logs does not have permissions to write to S3. Flow Logs require a service-linked role or an IAM role with permissions to publish to S3. If the role is missing or incorrect, logs will not be delivered.

Answer

The VPC Flow Logs are not enabled for the correct VPC

Answer

The RDS instance is in a private subnet

Answer

The S3 bucket is in a different region

Question 2

A company is designing a multi-region architecture with VPCs connected via VPC peering. They need to ensure high availability and low latency. Which THREE design principles should they follow? (Choose three.)

Accepted Answer

Deploy redundant VPN connections to each region. Option A, Option B, and Option D are correct. Using a transit gateway simplifies management and supports transitive routing. Deploying redundant VPN connections ensures failover. Direct Connect provides consistent low latency. Option C is incorrect because a single NAT gateway is a single point of failure. Option E is incorrect because VPC endpoints are for service access, not inter-region connectivity.

Answer

Use VPC endpoints for all AWS service access

Answer

Use a single NAT gateway for all outbound traffic

Question 3

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel status shows 'UP' but traffic is not passing. The engineer checks the route tables and finds that the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely missing configuration?

Accepted Answer

The VPN tunnel is using the wrong pre-shared key. For a VPN to pass traffic, the on-premises router must have a route pointing back to the VPC CIDR via the VPN tunnel. Option B is correct. Options A, C, and D are either already done or not directly related to traffic passing.

Answer

The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway

Answer

The security group of the EC2 instances does not allow inbound traffic from on-premises

Answer

The on-premises router is not advertising the VPC CIDR over BGP

Question 4

A network engineer has created a VPC endpoint for a VPC endpoint service. The endpoint is 'available' but the application cannot connect to the service using the private DNS name. The engineer checks the Route 53 private hosted zone and finds that no record exists for the endpoint. What is the most likely cause?

Accepted Answer

The 'PrivateDnsEnabled' flag is set to false on the VPC endpoint. When 'VpcEndpointPolicyEnabled' is true, the endpoint has a policy that may restrict access. However, the issue is that the private DNS name is not resolving. For VPC endpoints, AWS automatically creates a Route 53 private hosted zone for the endpoint if 'PrivateDnsEnabled' is true. If it's false, no automatic DNS record is created. Option C is correct. Options A, B, and D are plausible but not the most likely given the lack of DNS record.

Answer

The VPC endpoint service is not accepting connections

Answer

The VPC endpoint policy is blocking connectivity

Answer

The security group for the endpoint does not allow inbound traffic

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that some VPCs cannot communicate with each other even though they are attached to the same transit gateway. What is the most likely cause?

Accepted Answer

The transit gateway route tables are missing routes to the other VPCs.. Transit Gateway uses route tables to control inter-VPC traffic. If the route tables do not have routes to the other VPCs, or if the VPCs are in different route tables that are not associated or propagated correctly, communication fails. The most common issue is that the transit gateway route tables are not properly configured with routes to the other VPC attachments.

Answer

The security groups on the instances are not allowing inbound traffic from the other VPCs.

Answer

The VPC attachments are not in the 'available' state.

Answer

The VPCs' network ACLs are blocking traffic.

Question 6

A network engineer is diagnosing a connectivity issue between two VPCs connected via VPC peering. The engineer has confirmed that the route tables in both VPCs have appropriate routes and the security groups allow traffic. However, traffic from VPC A to VPC B fails. Which TWO steps should the engineer take to troubleshoot? (Select TWO.)

Accepted Answer

Check the network ACL of the subnet in VPC B where the target instance resides.. Option B is correct because checking the NACL of the subnet in VPC B where the target instance resides can reveal if inbound traffic is blocked. Option D is correct because verifying the OS-level firewall on the target instance in VPC B can block traffic even if AWS network is open. Option A is wrong because the peering connection status is active; if it were pending or deleted, it would be obvious. Option C is wrong because cross-account configuration is not mentioned. Option E is wrong because VPC Flow Logs are useful but not the first step for a basic connectivity check.

Answer

Confirm that both VPCs are in the same AWS account.

Answer

Verify the VPC peering connection status is active.

Answer

Enable VPC Flow Logs on both VPCs to analyze traffic.

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to a partner VPC with CIDR 10.0.0.0/16. Both VPCs are in the same region. They want to use VPC Peering. After creating the peering connection and adding routes, connectivity fails. What is the most likely cause?

Accepted Answer

Overlapping CIDR blocks prevent VPC peering connectivity.. Option A is correct because overlapping CIDRs are not allowed in VPC peering; routes cannot distinguish. Option B is wrong because there is no route conflict after peering. Option C is wrong because VPC peering does not support transitive routing. Option D is wrong because any status other than active would prevent connectivity, but with overlapping CIDRs, even active won't work.

Answer

The peering connection is not set up for transitive routing.

Answer

The peering connection status is 'pending-acceptance'.

Answer

The route tables do not have a route to the peering connection.

Question 8

A company has a Direct Connect connection and wants to use it for both private and public resources. Which TWO components are required to achieve this?

Accepted Answer

Public virtual interface (VIF). Option B and Option D are correct. A private VIF is required for private IP connectivity to VPCs, and a public VIF is required for public IP connectivity to AWS public services. Option A is wrong because a VPN connection is not required for Direct Connect. Option C is wrong because a Transit Gateway is optional. Option E is wrong because an internet gateway is not used with Direct Connect public VIF.

Answer

Transit Gateway

Answer

Internet gateway

Answer

VPN connection to the VPC

Question 9

A company has a VPC with a VPN connection to an on-premises network. The network team reports that the VPN tunnel is flapping intermittently. You need to identify the cause. Which AWS service provides logs that can help troubleshoot the VPN tunnel status?

Accepted Answer

Amazon CloudWatch. The correct answer is A because VPN tunnel metrics are available in CloudWatch, including tunnel state and data in/out. Option B is wrong because CloudTrail does not provide tunnel status logs. Option C is wrong because VPC Flow Logs capture traffic, not tunnel status. Option D is wrong because AWS Health Dashboard provides service health, not specific VPN tunnel logs.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Health Dashboard

Question 10

A financial services company uses AWS Direct Connect to connect its data center to multiple VPCs via a transit gateway. They need to meet PCI DSS compliance requirements by encrypting all traffic between the data center and AWS. What solution meets this requirement with the least operational overhead?

Accepted Answer

Enable MACsec on the Direct Connect connection.. Option D is correct because MACsec provides encryption at Layer 2 without requiring VPN tunnels or additional configuration. Option A is incorrect because IPsec over Direct Connect adds overhead and complexity. Option B is incorrect because TLS is for application-level traffic, not all traffic. Option C is incorrect because private VIFs do not encrypt traffic by default.

Answer

Use TLS for all application traffic between data center and VPC.

Answer

Use private VIFs without additional encryption.

Answer

Create an IPsec VPN tunnel over the Direct Connect VIF to encrypt traffic.

Question 11

A network engineer created a VPC interface endpoint for a third-party SaaS service using AWS PrivateLink. The endpoint shows 'available' state, but on-premises clients cannot connect to the service via the private endpoint DNS name. What is the MOST likely reason?

Accepted Answer

Private DNS is not enabled for the endpoint.. Option B is correct because Private DNS for the endpoint must be enabled for the private DNS name to resolve correctly from on-premises. Option A is incorrect because the endpoint is in 'available' state. Option C is incorrect because the subnet IDs are present. Option D is incorrect because the endpoint type is Interface, not Gateway.

Answer

The endpoint is not in the 'available' state.

Answer

The endpoint is not associated with any subnet.

Answer

The endpoint type is Gateway, not Interface.

Question 12

A network engineer created an IAM policy for a user to manage VPC Flow Logs. The user reports they cannot create flow logs and receive an 'AccessDenied' error. What is the MOST likely reason?

Accepted Answer

The logs:CreateLogGroup resource ARN is too restrictive.. Option D is correct because the policy allows logs:CreateLogGroup only for a specific log group ARN, but the user might be trying to create a log group with a different name pattern. Option A is incorrect because the policy includes ec2:CreateFlowLogs. Option B is incorrect because the policy includes logs:PutLogEvents. Option C is incorrect because the policy includes iam:PassRole for the specific role.

Answer

The ec2:CreateFlowLogs action is missing.

Answer

The logs:PutLogEvents action is missing.

Answer

The iam:PassRole action is missing for the flow logs role.

Question 13

A company has a Direct Connect connection with a public VIF to access AWS public services. They notice that traffic to Amazon S3 is taking a suboptimal path via the internet instead of the Direct Connect. What is the MOST likely cause?

Accepted Answer

The on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect. Option D is correct because you need to add a route to the on-premises router pointing to the Direct Connect for the S3 CIDR ranges. Option A is incorrect because the public VIF does not use BGP for prefixes. Option B is incorrect because the VIF is up. Option C is incorrect because the public VIF does not use a virtual private gateway.

Answer

The BGP session for the public VIF is not advertising the S3 prefixes

Answer

The public VIF is in a 'DOWN' state

Answer

The virtual private gateway is not attached to the VPC

Question 14

An EC2 instance with the attached network interface shown above is unable to reach the internet. The instance is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What is the most likely cause?

Accepted Answer

The route table for the subnet does not have a 0.0.0.0/0 route pointing to the internet gateway.. The network interface has 'SourceDestCheck' set to true. This is a property that must be disabled for NAT instances or for instances that act as routers. For a normal EC2 instance that is not performing NAT or routing, source/destination check should be enabled. However, if the instance is a NAT instance, it should be disabled. But the question says the instance is a regular instance; the issue is likely that the source/destination check is enabled, but that is normal. Wait, the issue: the instance cannot reach the internet. Since it's in a public subnet with a public IP, source/dest check should be enabled; that is not the problem. Actually, the most likely cause is that the security group outbound rule is missing, but the question says it allows outbound. Another common issue is that the route table for the subnet doesn't have a 0.0.0.0/0 route to the IGW. But the exhibit does not show that. The exhibit shows sourceDestCheck is true, which is correct for most instances. However, if the instance is a NAT instance, sourceDestCheck must be false. But the question does not specify it's a NAT instance. I need to think: The instance is unable to reach the internet. The security group allows outbound. The subnet is public with route to IGW. The instance likely has a public IP. Then what? The sourceDestCheck being true could be a problem if the instance is a NAT instance, but it's not. Another possibility: the security group inbound rules might block return traffic? No, security groups are stateful. The answer likely is that the sourceDestCheck is true, but that is not the issue; the correct answer is something else. Let's re-read: The exhibit shows sourceDestCheck is true, and the attachment status is attached. The question says the instance cannot reach the internet. Maybe the issue is that the network interface is not the primary? But it is attached. Possibly the route table is missing. However, the exhibit does not show the route table. I think the intended answer is that the sourceDestCheck is enabled, which should be disabled for NAT instances, but for a regular instance, it's fine. Alternatively, the security group might be blocking outbound, but the question says it allows. The most likely cause from the exhibit is that the security group is associated with the interface, but the outbound rules are not shown. But the question says it allows. I need to choose an option that fits. The exhibit shows the network interface with a security group. The issue might be that the security group does not allow outbound traffic to the internet. But the question says it does. Perhaps the exhibit is meant to show that the security group is attached, but the engineer should check the security group rules. However, the exhibit does not show the rules. I'll go with a common misconfiguration: the source/destination check is enabled, but if the instance is a NAT instance, it should be disabled. But the question does not indicate it's a NAT instance. Another common issue: the network interface is not the primary, but the exhibit shows it's attached. I think the most likely cause from the exhibit is that the security group is incorrect. But since the question says it allows outbound, that's not it. Perhaps the answer is that the source/destination check should be disabled for instances that need to send traffic to the internet? No, that's only for NAT instances. Let's see the options. I'll create plausible options.

Answer

The source/destination check is enabled, which prevents the instance from sending traffic to the internet if it is not the source of the traffic.

Answer

The network interface's attachment status is 'attached', but the instance may not have a public IP address.

Answer

The security group is not associated with the network interface.

Question 15

A network engineer needs to capture and analyze DNS query logs generated by Amazon Route 53. Which AWS service should be used to store and query these logs?

Accepted Answer

Amazon CloudWatch Logs. Option A is correct because Route 53 can log DNS queries to CloudWatch Logs. Option B is wrong because Amazon S3 is an object store, not a log analysis service. Option C is wrong because Amazon Kinesis Data Firehose can stream data but not directly store for querying. Option D is wrong because AWS CloudTrail records API calls, not DNS queries.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3

Question 16

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic from on-premises to the VPC is intermittently dropping. You check the Direct Connect virtual interface status and find it is 'down'. Which AWS service should you use to troubleshoot the physical layer connectivity?

Accepted Answer

AWS Direct Connect console. The correct answer is D because AWS Direct Connect Troubleshooting Guide recommends checking the cross-connect and using the AWS Direct Connect console to view the LOA-CFA status. Option A is wrong because AWS Support is not a service but a support plan. Option B is wrong because CloudWatch metrics show logical metrics, not physical layer. Option C is wrong because VPC Flow Logs capture IP traffic logs, not physical connectivity.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Support

Question 17

A network engineer needs to monitor network performance between an on-premises data center and AWS via Direct Connect. Which TWO metrics should the engineer monitor in Amazon CloudWatch?

Accepted Answer

VirtualInterfaceBgpState. The correct answers are B and D. Direct Connect provides metrics for connection bandwidth utilization and virtual interface BGP state. Option A is wrong because latency is not a standard Direct Connect metric (it's available via other methods). Option C is wrong because packet loss is not a standard metric. Option E is wrong because jitter is not a standard metric.

Answer

Jitter

Answer

PacketLoss

Answer

Latency

Question 18

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach any resources in the VPC. What is the most likely cause?

Accepted Answer

The Client VPN endpoint does not have a subnet association.. Option D is correct because the subnet associations for the Client VPN endpoint route traffic to the VPC; without a proper subnet association, traffic is not forwarded. Option A is incorrect because the security group for the Client VPN endpoint controls access, but the endpoint can still be reachable. Option B is incorrect; the authorization rules allow specific users/groups, but connectivity issues are likely routing. Option C is incorrect because the client is already connected.

Answer

The authorization rules do not include the client's group.

Answer

The Client VPN endpoint security group does not allow inbound traffic from the client CIDR.

Answer

The client's VPN software is not configured with the correct DNS server.

Question 19

A network engineer configured a custom network ACL for a VPC. An EC2 instance in a subnet associated with this ACL cannot receive ping (ICMP) from the internet. The security group allows ICMP. Which rule is causing the issue?

Accepted Answer

Inbound rule 130 allows ICMP, but it is overridden by rule 120.. Option D is correct because the inbound deny-all rule (120) with priority 120 blocks all traffic not explicitly allowed, and ICMP (protocol 1) is allowed only by rule 130 but rule 120 is evaluated first? Actually, evaluation order is by rule number; rule 120 (deny) has lower number than 130 (allow), so rule 120 is evaluated first? Wait, NACL rules are evaluated in ascending order; rule 100, 110, 120, 130. Since rule 120 is deny all, it is evaluated before rule 130. Thus, ICMP traffic is denied by rule 120. The outbound rules are fine because egress is allowed for ephemeral ports. Option A is incorrect because the inbound ICMP rule (130) exists but is after deny-all. Option B is incorrect because inbound HTTPS is allowed. Option C is incorrect because outbound rules are not the issue.

Answer

The default NACL rules are missing.

Answer

Outbound rule 220 blocks all outbound traffic.

Answer

Inbound rule 100 only allows HTTPS.

Question 20

A company's VPC includes a public subnet with a NAT gateway and a private subnet with EC2 instances. The EC2 instances in the private subnet need to access the internet for software updates. The NAT gateway's Elastic IP is associated correctly, and the route tables are configured. However, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table for the private subnet is missing a default route pointing to the NAT gateway.. The most common issue is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from the private subnet cannot be directed to the NAT gateway, and thus cannot reach the internet.

Answer

The NAT gateway is in the private subnet.

Answer

The network ACL for the private subnet is blocking outbound traffic.

Answer

The security group for the EC2 instances does not allow outbound traffic.