ANS-C01 Practice Exam 60 — 20 Questions

Question 1

A network engineer is designing a highly available VPN connection between an on-premises network and AWS. The on-premises network has two internet connections from different ISPs. Which AWS VPN configuration should be used to provide the highest availability?

Accepted Answer

Create two customer gateways, each with a VPN tunnel to the virtual private gateway.. Option B is correct because using two customer gateways with two VPN tunnels each provides redundancy at both the device and ISP level. Option A is wrong because a single VPN tunnel is not redundant. Option C is wrong because a single customer gateway with two tunnels only provides ISP redundancy. Option D is wrong because Direct Connect is not a VPN.

Answer

Create a single VPN tunnel from one customer gateway to the virtual private gateway.

Answer

Create one customer gateway with two VPN tunnels, each using different internet connections.

Answer

Use AWS Direct Connect instead of VPN for higher availability.

Question 2

A network engineer is monitoring a hybrid network with a VPN connection to AWS. The engineer notices periodic packet loss and high latency during peak hours. The VPN tunnel uses static routing. The on-premises bandwidth is 100 Mbps, and the VPN connection is limited to 1.25 Gbps. What is the most likely cause?

Accepted Answer

The on-premises internet connection is saturated.. The VPN connection's bandwidth (1.25 Gbps) is sufficient, but if the on-premises link is only 100 Mbps, any traffic exceeding that will cause congestion and packet loss. The VPN tunnel itself is not the bottleneck.

Answer

The VPC route table has a blackhole route for the on-premises CIDR.

Answer

The VPN tunnel is using the incorrect encryption algorithm.

Answer

The VPN tunnel is exceeding its maximum bandwidth limit.

Question 3

A company is designing a multi-VPC architecture using AWS Transit Gateway. They need to ensure that traffic between VPCs is encrypted and that only specific VPCs can communicate with each other. Which two services should they use together? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway provides transitive routing between VPCs. AWS Network Firewall can inspect and encrypt traffic. AWS PrivateLink is for service access, not transitive routing. AWS VPN CloudHub is for VPN connections. AWS Direct Connect is for on-premises.

Answer

AWS PrivateLink

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub

Question 4

A network engineer must design a solution to monitor and troubleshoot connectivity from an on-premises data center to a VPC over an AWS Direct Connect connection. The solution must provide visibility into BGP routing, packet loss, and latency. Which TWO services or features should the engineer use? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs for Direct Connect. Amazon CloudWatch metrics for Direct Connect can monitor BGP session state, packet loss, and latency. AWS CloudTrail logs API calls but not network performance. VPC Flow Logs capture IP traffic metadata but not BGP details or latency. AWS X-Ray is for application tracing. Amazon Inspector is for security assessments.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS X-Ray

Question 5

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team notices that traffic from on-premises to an EC2 instance in the VPC is taking a suboptimal path through the internet instead of the Direct Connect. What is the most likely cause?

Accepted Answer

The on-premises router does not have a specific route for the VPC CIDR via the Direct Connect.. Option A is correct. If the on-premises network does not have a specific route pointing to the Direct Connect for the VPC CIDR, traffic may use the internet. Option B is wrong because prefix lists are not required. Option C is wrong because ASN prepending would affect outbound traffic, not inbound. Option D is wrong because VPC route tables are not visible to on-premises.

Answer

The VPC route table does not include a route to the Direct Connect gateway.

Answer

The Direct Connect virtual interface has BGP ASN prepending configured.

Answer

The VPC route table does not have a prefix list for the on-premises CIDR.

Question 6

A network engineer is troubleshooting a VPN connectivity issue. The VPN tunnel is up, but traffic is not passing. Which TWO AWS services should the engineer use to diagnose the problem?

Accepted Answer

VPC Flow Logs. The correct answers are A and C. VPC Flow Logs can show if traffic is reaching the VPN endpoint, and CloudWatch provides tunnel metrics and logs. Option B is wrong because CloudTrail logs API calls, not traffic. Option D is wrong because AWS Config tracks configuration, not traffic. Option E is wrong because Direct Connect is for dedicated connections, not VPN.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Direct Connect

Question 7

A network engineer is troubleshooting a slow connection between an EC2 instance and an RDS database in the same VPC. The engineer wants to analyze network performance metrics. Which TWO metrics should the engineer examine? (Choose two.)

Accepted Answer

Round-trip time between the EC2 instance and RDS. Option A and Option D are correct. Network packets dropped by the RDS instance's network interface indicate congestion. Round-trip time is a direct measure of latency. Option B is incorrect because CPU utilization is a system metric, not network-specific. Option C is incorrect because database connections are application-level. Option E is incorrect because disk queue depth is storage-related.

Answer

Database connections count

Answer

Disk queue depth

Answer

RDS instance CPU utilization

Question 8

A network engineer needs to monitor the network traffic between EC2 instances in a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. Option D is correct because VPC Flow Logs capture IP traffic information for network interfaces. Option A is wrong because CloudWatch Logs can store logs but does not capture network traffic. Option B is wrong because AWS Config tracks resource configuration changes. Option C is wrong because CloudTrail records API calls.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 9

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. The network engineer needs to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which THREE steps are necessary to achieve this?

Accepted Answer

Add a route in the subnet route table for ::/0 to an egress-only internet gateway.. Options A, B, and D are correct. A: Associate an IPv6 CIDR block. B: Enable IPv6 on the subnet. D: Add a route for ::/0 to an egress-only internet gateway or internet gateway. Option C is wrong because IPv6 traffic uses egress-only IGW, not NAT. Option E is wrong because security groups do not need to be updated specifically for IPv6; they work for both.

Answer

Update security group rules to allow IPv6 traffic.

Answer

Configure a NAT64 gateway for IPv6 to IPv4 translation.

Question 10

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a private subnet and an RDS database in another VPC connected via a VPC peering connection. The connection works for a few minutes and then drops. CloudWatch logs show no errors on the peering connection. What should the engineer check first?

Accepted Answer

The route tables in both VPCs to ensure they have routes pointing to the peering connection for the respective CIDR blocks.. Option C is correct because the most common cause of intermittent drops over VPC peering is the lack of proper route table entries in both VPCs to route traffic back to the source. Option A is wrong because security groups are stateful and do not cause intermittent drops. Option B is wrong because NACLs are stateless but would block consistently, not intermittently. Option D is wrong because DNS resolution settings affect name resolution, not connectivity drops.

Answer

The DNS resolution settings of the VPC peering connection.

Answer

The network ACL of the subnet where the EC2 instance resides.

Answer

The security group attached to the RDS database allowing traffic from the EC2 instance.

Question 11

A company is using AWS CloudFormation to deploy a VPC with public and private subnets, an internet gateway, and a NAT gateway. The deployment fails with the error: 'Route table rtb-12345678 already has a route with destination 0.0.0.0/0'. The network engineer reviews the template and sees that the public route table has a route to the internet gateway and the private route table has a route to the NAT gateway. Both route tables are defined in the same template. What is the most likely cause of this error?

Accepted Answer

The public and private route tables are the same resource due to a typo in the template.. Option B is correct because the error indicates that the same route table is being used for both routes, which happens when both resources reference the same route table ID. Option A is wrong because a route table can have multiple routes, but only one default route. Option C is wrong because the error is specific to duplicate routes, not a missing route. Option D is wrong because internet and NAT gateways can coexist in the same VPC.

Answer

The internet gateway and NAT gateway cannot exist in the same VPC simultaneously.

Answer

The public route table already has a route to the internet gateway, and adding another default route is not allowed.

Answer

The NAT gateway route is missing a destination CIDR block.

Question 12

A network engineer is troubleshooting an AWS Lambda function that needs to create and manage ENIs in a VPC. The Lambda function is unable to create ENIs. The IAM policy attached to the Lambda execution role is shown in the exhibit. What is the issue?

Accepted Answer

The policy is missing the ec2:AttachNetworkInterface action.. Option B is correct because Lambda requires permissions for ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, ec2:DeleteNetworkInterface, and also ec2:AttachNetworkInterface. Option A is wrong because the actions are allowed. Option C is wrong because resource restriction is not the issue. Option D is wrong because the policy already allows the actions.

Answer

The policy restricts the resource to a specific VPC.

Answer

The policy does not allow the ec2:CreateNetworkInterface action.

Answer

The policy does not allow the ec2:DeleteNetworkInterface action.

Question 13

A company has a VPC with public and private subnets. The security team wants to analyze all traffic to and from the internet for security incidents. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. The correct answer is C because VPC Flow Logs capture IP traffic information for network interfaces, including traffic to/from the internet. Option A is wrong because AWS WAF filters web traffic but does not provide traffic logs. Option B is wrong because AWS Shield Advanced provides DDoS protection, not traffic analysis. Option D is wrong because AWS Network Firewall provides firewall capabilities but not detailed traffic logs like Flow Logs.

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Answer

AWS WAF

Question 14

Refer to the exhibit. A network engineer created a NAT gateway in a public subnet, but its state shows 'failed'. What is the most likely cause?

Accepted Answer

The Elastic IP is already associated with another instance. The correct answer is B because the NAT gateway address has a public IP but the allocation ID is present; a common reason for failure is that the Elastic IP is already associated with another resource. Option A is wrong because the subnet is public (has route to IGW). Option C is wrong because the state is 'failed', not 'pending'. Option D is wrong because the NAT gateway is in a public subnet; it should have a route to IGW.

Answer

The subnet does not have a route to an internet gateway

Answer

The subnet is private

Answer

The NAT gateway is still being created

Question 15

A network engineer is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. The VPCs are in the same region. After accepting the peering request, instances in VPC-A cannot communicate with instances in VPC-B. What should the engineer check first?

Accepted Answer

The route tables in both VPCs have routes to the peer VPC CIDR.. Option C is correct because route tables must be updated with routes to the peer VPC CIDR. Without these routes, traffic is not directed to the peering connection. Option A is incorrect because security groups can be configured to allow cross-account traffic, but they are not the first check. Option B is incorrect because the peering connection is already accepted. Option D is incorrect because NACLs are not the primary issue; routes are.

Answer

The security groups in both VPCs allow traffic from the peer VPC CIDR.

Answer

The network ACLs in both VPCs allow traffic from the peer VPC CIDR.

Answer

The VPC peering connection status is 'active'.

Question 16

A company uses AWS Direct Connect with multiple virtual interfaces (VIFs) to connect to multiple VPCs. The network team wants to ensure high availability and failover. Which configuration provides the best resiliency?

Accepted Answer

Provision two Direct Connect connections from different providers and configure BGP. Option B is correct because using two separate Direct Connect connections provides path diversity; if one fails, the other can handle traffic. Option A is wrong because multiple VIFs on a single connection share the same physical link. Option C is wrong because a VPN backup over the same internet connection may not provide true diversity. Option D is wrong because BGP alone does not provide physical redundancy.

Answer

Use a single Direct Connect connection with a VPN backup over the internet

Answer

Configure BGP with multiple AS paths on the same Direct Connect connection

Answer

Create multiple private VIFs on a single Direct Connect connection

Question 17

A company is designing a multi-account strategy using AWS Organizations. The security team wants to centrally manage VPC Flow Logs from all accounts. Which THREE steps are required to achieve this?

Accepted Answer

Enable VPC Flow Logs in each account, specifying the central S3 bucket as the destination.. To centralize flow logs, you need a central S3 bucket with appropriate permissions, enable flow logs in each account, and send them to the central bucket. The bucket policy must allow cross-account writes.

Answer

Set up a VPN connection between the logging account and each member account.

Answer

Create a VPC peering connection between all accounts to allow log delivery.

Question 18

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

Accepted Answer

The connection was down for most of the day.. Option D is correct because ConnectionState metric has a value of 0 for down and 1 for up. Average 0.0 means the connection was down. Option A is wrong because it was down. Option B is wrong because 0 indicates down. Option C is wrong because it was not varying; it was consistently 0.

Answer

The connection was fluctuating between up and down.

Answer

The metric data is incomplete.

Answer

The connection was up and stable.

Question 19

A company has multiple VPCs connected via VPC peering. They want to simplify network management and reduce the number of peering connections. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks, reducing the need for full mesh peering.

Answer

AWS PrivateLink

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect Gateway

Question 20

A company has a transit gateway with multiple VPC attachments and an on-premises VPN connection. The network team is seeing asymmetric routing and packet drops. What should they implement to resolve this?

Accepted Answer

Disable equal-cost multipath (ECMP) routing on the Transit Gateway.. Option C is correct because equal-cost multipath (ECMP) routing over multiple tunnels can cause asymmetric flows. Disabling ECMP on the Transit Gateway ensures consistent path selection based on flow hashing. Option A is incorrect because VPC peering is not needed. Option B is incorrect because BGP ASN prepending influences path selection but doesn't fix asymmetry from ECMP. Option D is incorrect because route propagation doesn't affect ECMP behavior.

Answer

Create VPC peering connections between all VPCs.

Answer

Use BGP ASN prepending on the on-premises routers.

Answer

Enable route propagation from the Transit Gateway to VPC route tables.