ANS-C01 Practice Exam 62 — 20 Questions

Question 1

A company uses AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They notice that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What configuration change should be made to ensure optimal routing?

Accepted Answer

Enable route propagation from the VPC attachments into the Transit Gateway route table.. Option A is correct because Transit Gateway route tables control the path; enabling route propagation from VPC attachments will add routes for direct VPC-to-VPC communication. Option B is incorrect because VPN attachments do not affect VPC-to-VPC routing. Option C is incorrect because VPC route tables do not control Transit Gateway path selection. Option D is incorrect because cross-zone load balancing is for load balancers, not routing.

Answer

Disable cross-zone load balancing on the Transit Gateway.

Answer

Add static routes to the Transit Gateway route table pointing to the VPN attachment.

Answer

Modify the VPC route tables to add routes to the other VPC via the Transit Gateway.

Question 2

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. They notice that traffic between VPCs is being dropped intermittently. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Monitor the Transit Gateway's CloudWatch metrics for packets dropped due to route table limits. Option A and Option D are correct. Monitoring Transit Gateway CloudWatch metrics for dropped packets can identify route table limits or throttling. Enabling VPC Flow Logs helps analyze traffic patterns and dropped packets. Option B is incorrect; the VPC CIDR does not need to be unique if properly routed. Option C is incorrect; a VPN connection is not needed for Direct Connect. Option E is incorrect; security groups do not apply to Transit Gateway.

Answer

Review the security group rules on the Transit Gateway

Answer

Check if the VPC CIDRs are overlapping

Answer

Create a VPN connection for backup

Question 3

A company wants to monitor network traffic in its VPC for security analysis. Which TWO AWS services can be used to capture and analyze network traffic?

Accepted Answer

Amazon Inspector. Option A and D are correct because VPC Flow Logs capture network traffic information, and Amazon Inspector can analyze network configurations for vulnerabilities. Option B is wrong because CloudTrail records API calls. Option C is wrong because AWS Config monitors resource configuration. Option E is wrong because AWS Shield is for DDoS protection.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Shield

Question 4

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. After a network change, some VPCs cannot reach the on-premises network. The Transit Gateway route table shows the correct association and propagation. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route pointing to the Transit Gateway. Option B is correct because the VPC route table must have a static route or propagated route pointing to the Transit Gateway for traffic to flow. Option A is wrong because attachment is fine if route table shows correct association. Option C is wrong because BGP is used for on-premises routes, not for VPC routes. Option D is wrong because VPN is one way to connect on-premises, but the issue is about VPC routing.

Answer

The Transit Gateway attachment is in a failed state

Answer

The VPN connection to the on-premises network has insufficient bandwidth

Answer

The BGP session between the Transit Gateway and on-premises router is down

Question 5

A network engineer is troubleshooting network connectivity issues in a VPC. The engineer suspects that the network ACL is blocking traffic. Which TWO actions should the engineer take to verify this?

Accepted Answer

Review the inbound and outbound rules of the network ACL.. Options A and C are correct because reviewing NACL rules and enabling VPC Flow Logs with ACL accept/reject status can identify blocked traffic. Option B is wrong because security groups are stateful and work differently. Option D is wrong because CloudTrail does not log network traffic. Option E is wrong because Direct Connect is unrelated.

Answer

Check the security group rules for the affected instances.

Answer

Use AWS CloudTrail to view network traffic logs.

Answer

Test connectivity using AWS Direct Connect.

Question 6

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS Direct Connect. The network team has verified that the virtual interface (VIF) is up and BGP is established. However, traffic is not flowing. Which two configuration issues could cause this problem? (Choose TWO.)

Accepted Answer

The on-premises router is not advertising the on-premises CIDR prefix via BGP.. Correct routes on both sides are needed. If the VPC route table does not have a route to the on-premises CIDR via the Direct Connect VIF, traffic won't flow. Similarly, if the on-premises router does not advertise the correct prefix, or if the VPC's route table lacks a route, connectivity fails. Security group rules might block, but they are not the most likely if BGP is up. The VIF state is up, so that's not the issue.

Answer

The AWS Direct Connect connection is not associated with the correct Direct Connect gateway.

Answer

The virtual interface is in a 'down' state.

Answer

The security group attached to the EC2 instance blocks inbound traffic from on-premises.

Question 7

A company has a multi-account AWS environment with hundreds of VPCs interconnected via a transit gateway. The network team needs to centrally monitor VPC reachability and identify asymmetric routing paths. Which THREE services or features should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Contributor Insights. VPC Reachability Analyzer can test paths and detect asymmetric routing. AWS Network Manager provides central visibility for transit gateway networks. Amazon CloudWatch Contributor Insights helps analyze VPC Flow Logs to identify traffic patterns. AWS Config evaluates rules but not real-time path analysis. AWS CloudHSM is for hardware security modules.

Answer

AWS Config

Answer

AWS CloudHSM

Question 8

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The template includes an Internet Gateway and a NAT Gateway. After deployment, instances in the private subnet cannot access the internet. The network engineer checks the route tables and finds that the private subnet route table has a default route pointing to the NAT Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway is deployed in the private subnet instead of the public subnet.. Option D is correct because the NAT Gateway must be in a public subnet with a route to the IGW. Option A is wrong because the route is present. Option B is wrong because security groups allow outbound traffic by default. Option C is wrong because the default route points to NAT Gateway, not IGW.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Answer

The private subnet route table does not have a default route (0.0.0.0/0) to the NAT Gateway.

Answer

The NAT Gateway is in a private subnet and has no route to the internet gateway.

Question 9

A company is designing a highly available network architecture using AWS Direct Connect. Which TWO actions should be taken to ensure redundancy?

Accepted Answer

Provision two Direct Connect connections at different locations. Option A and C are correct because using two separate Direct Connect connections and configuring BGP with different ASNs provide path diversity and failover. Option B is wrong because a single connection is a single point of failure. Option D is wrong because VPN backup over the same internet connection does not provide true diversity. Option E is wrong because a single VIF on a single connection offers no redundancy.

Answer

Create a single private VIF on the Direct Connect connection

Answer

Set up a VPN connection over the internet as a backup

Answer

Use a single Direct Connect connection with multiple VIFs

Question 10

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The network team notices intermittent packet loss on the Direct Connect virtual interface (VIF). Which AWS service should be used to monitor the latency and packet loss on the VIF?

Accepted Answer

AWS CloudWatch. CloudWatch provides metrics for Direct Connect including packet loss and latency. VPC Flow Logs capture IP traffic metadata but not latency. AWS Health Dashboard shows service health. Transit Gateway is a network transit hub but not a monitoring service.

Answer

AWS Health Dashboard

Answer

VPC Flow Logs

Answer

AWS Transit Gateway Network Manager

Question 11

A company has a VPC with multiple subnets. The network engineer wants to monitor network traffic between two specific EC2 instances in different subnets. Which THREE methods can be used to capture and analyze this traffic?

Accepted Answer

Enable VPC Flow Logs for the subnets containing the instances.. VPC Flow Logs capture metadata, Traffic Mirroring captures full packets, and AWS Network Firewall can inspect traffic. VPC Peering is for connectivity, not monitoring.

Answer

Use AWS CloudTrail to log network traffic.

Answer

Create a VPC peering connection between the two subnets' VPCs.

Question 12

A company has multiple AWS accounts and wants to centrally manage network resources using AWS Transit Gateway. Which feature allows sharing the Transit Gateway across accounts?

Accepted Answer

AWS Resource Access Manager (RAM). Option C is correct because AWS Resource Access Manager (RAM) allows sharing Transit Gateways across accounts. Option A is wrong because AWS Organizations manages accounts but not resource sharing directly. Option B is wrong because VPC peering is a separate feature. Option D is wrong because AWS Service Catalog is for creating standardized products.

Answer

VPC peering

Answer

AWS Organizations

Answer

AWS Service Catalog

Question 13

A company monitors its VPC using VPC Flow Logs. The logs are sent to CloudWatch Logs. The security team wants to detect traffic to known malicious IP addresses. Which AWS service can be used to analyze the flow logs in near real-time?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Athena can query VPC Flow Logs stored in S3, but for near real-time analysis, Amazon Kinesis Data Analytics (or Kinesis Data Firehose with Lambda) can process streaming logs. However, the simplest managed service for real-time pattern matching is Amazon Kinesis Data Analytics with SQL.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

Amazon Athena

Question 14

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that VPC A cannot communicate with VPC B, while all other VPCs communicate normally. The transit gateway route table shows routes from both VPCs. Which TWO actions should the network engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Check the security groups and network ACLs in VPC A and VPC B.. Option A is correct because route table association is required for a VPC to use the transit gateway's routes. Option C is correct because security groups or NACLs in the VPCs can block traffic between subnets in different VPCs even if the transit gateway routes are correct. Option B is wrong because VPC peering is not required when using Transit Gateway. Option D is wrong because AWS Direct Connect is unrelated to inter-VPC routing. Option E is wrong because a VPN connection is not needed for VPC-to-VPC communication via Transit Gateway.

Answer

Establish a VPN connection between VPC A and the transit gateway.

Answer

Create a VPC peering connection between VPC A and VPC B.

Answer

Configure an AWS Direct Connect virtual interface between the VPCs.

Question 15

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that the latency to S3 increases significantly during peak hours. They have tested the connection and confirmed that the physical link is not saturated. The company uses a single Direct Connect connection. The S3 traffic is routed over the public VIF. The team wants to improve performance without adding a new Direct Connect connection. Which action should the team take to reduce latency?

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and route S3 traffic through a private VIF attached to the VPC.. Using a Direct Connect gateway allows you to connect to multiple VPCs and also to AWS public services via a private VIF. However, for S3, you can use a private VIF with a VPC interface endpoint (Gateway Endpoint for S3) to keep traffic within the AWS network and avoid internet transit. This reduces latency because traffic goes from Direct Connect to the VPC and then to S3 via the gateway endpoint. Option B (adding VPN) adds IPSec overhead. Option C uses a different AWS region, which may increase latency. Option D (adding a second Direct Connect) is not allowed per the question.

Answer

Use an AWS Site-to-Site VPN connection over the Direct Connect to access S3 via private IP.

Answer

Add a second Direct Connect connection to load balance traffic.

Answer

Configure the Direct Connect public VIF to use a different AWS region closer to the on-premises location.

Question 16

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to its VPC. The on-premises network team reports that they can ping the private IP address of an EC2 instance in the VPC, but cannot establish a TCP connection to a web server running on that instance. The network security group allows inbound TCP port 80 from the on-premises CIDR. What should the network engineer check next?

Accepted Answer

Check the operating system firewall and web server configuration on the EC2 instance.. Option C is correct because the instance's OS firewall or web server configuration may be blocking the connection. Option A is wrong because ping works, indicating routing is fine. Option B is wrong because the BGP session status is unrelated to connectivity to the instance. Option D is wrong because the NACL is stateless and would affect ping as well.

Answer

Review the network ACL associated with the subnet to ensure it allows inbound TCP 80.

Answer

Check the BGP session status on the Direct Connect virtual interface.

Answer

Verify the route table on the VPC has a route back to the on-premises network.

Question 17

A company has a global application deployed across multiple AWS Regions. The application uses Amazon Route 53 latency-based routing. The network team wants to monitor the health of the application endpoints. They configure Route 53 health checks with fast interval (10 seconds) for each endpoint. After a few days, they notice an increase in costs. Which change will reduce costs while maintaining adequate health monitoring?

Accepted Answer

Change the health check interval to standard (30 seconds).. Health checks are billed per check. Using a slower interval reduces the number of checks. Standard interval (30 seconds) is sufficient for most cases. Disabling end-to-end health checks or removing health checks would reduce functionality. Using CloudWatch alarms is additional cost.

Answer

Disable health checks and rely on Route 53 latency measurements.

Answer

Use CloudWatch alarms instead of Route 53 health checks.

Answer

Remove health checks for endpoints that are in the same Region.

Question 18

A company is using AWS Site-to-Site VPN to connect its on-premises network to a VPC. The network team wants to ensure high availability and failover. Which three actions should they take? (Choose THREE.)

Accepted Answer

Configure both tunnels as active/active.. For high availability, use two tunnels (both active/active or active/passive), use two Customer Gateway devices for redundancy, and configure BGP for dynamic routing and fast failover. Static routes require manual intervention. A single tunnel is not redundant.

Answer

Use static routes instead of BGP.

Answer

Configure two VPN tunnels to the same Customer Gateway.

Question 19

A company wants to monitor network traffic between its VPC and on-premises data center over a Direct Connect private VIF. The network team needs to capture the source and destination IP addresses, protocols, and packet counts. Which THREE AWS services or features should they use together? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. Option B is correct because VPC Flow Logs capture IP traffic metadata. Option D is correct because CloudWatch Logs can store and analyze flow logs. Option E is correct because CloudWatch Contributor Insights can analyze flow log data to identify top talkers etc. Option A is wrong because CloudTrail records API calls. Option C is wrong because AWS Config tracks configuration.

Answer

AWS CloudTrail

Answer

AWS Config

Question 20

A network engineer needs to troubleshoot high latency between two EC2 instances in the same VPC but in different Availability Zones. Which tool should be used to measure network performance?

Accepted Answer

Use iperf to measure throughput and latency. Option A is correct because iperf is a common tool for measuring network throughput and latency. Option B is wrong because traceroute shows the path but not detailed performance. Option C is wrong because netstat shows connections and statistics but not active measurements. Option D is wrong because ping measures round-trip time but not throughput.

Answer

Use traceroute to identify the path

Answer

Use ping to test connectivity

Answer

Use netstat to check network statistics