ANS-C01 Mock Exam 85 — 25 Questions

Question 1

A company is designing a hybrid network architecture that requires high availability and low latency between its on-premises data center and AWS. The company currently has two Direct Connect connections from different providers terminating at two different AWS Direct Connect locations. Which solution provides the most resilient and high-performance connectivity?

Accepted Answer

Use two Direct Connect connections from different providers at different locations with a VPN backup.. Option B is correct because using two Direct Connect connections from different providers at different locations ensures physical and provider diversity, eliminating single points of failure. Adding a VPN backup provides an additional failover path over the internet, which is essential for maintaining connectivity if both Direct Connect links fail. This design meets the requirements for high availability and low latency by leveraging active/active or active/passive traffic engineering with BGP routing and AS path prepending.

Answer

Use a single Direct Connect connection with multiple VLANs.

Answer

Use Site-to-Site VPN over the internet as the primary connection.

Answer

Use two Direct Connect connections from the same provider at the same location.

Question 2

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Accepted Answer

Provision subnets in at least two Availability Zones. Option A is correct because deploying subnets across at least two Availability Zones (AZs) ensures high availability by eliminating a single point of failure. If one AZ experiences an outage, the application can continue serving traffic from the other AZ. This is a foundational principle for building fault-tolerant architectures in AWS.

Answer

Assign public IP addresses to all instances for direct access

Answer

Use a single Availability Zone to reduce latency

Question 3

A company has multiple VPCs that need to communicate with each other. They want to use a hub-and-spoke model with centralized network management. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (D) is the correct choice because it acts as a central hub that interconnects multiple VPCs and on-premises networks using a hub-and-spoke topology. It simplifies network management by providing a single point of connectivity and supports transitive routing between all attached VPCs, which is exactly what the company needs for centralized network management.

Answer

AWS Direct Connect

Answer

VPN CloudHub

Answer

VPC Peering

Question 4

Which THREE of the following are considerations when designing a multi-account VPC architecture using AWS Transit Gateway? (Choose 3.)

Accepted Answer

Transit Gateway can be integrated with Direct Connect Gateway. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks. It can be integrated with Direct Connect Gateway, allowing a single Direct Connect connection to reach multiple VPCs attached to the Transit Gateway, simplifying hybrid network design and reducing operational overhead.

Answer

Each VPC must have a unique route table

Answer

VPCs with overlapping CIDR blocks can be attached

Question 5

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

Accepted Answer

The instances are in different Availability Zones.. The primary cause of higher latency between EC2 instances in different Availability Zones is the physical distance and the additional network hops required to traverse the AZ boundary. Even within the same VPC, traffic between AZs must pass through AWS's regional network infrastructure, which introduces a baseline latency of 1-2 milliseconds, whereas instances in the same AZ can communicate with sub-millisecond latency. The question explicitly states the instances are in different AZs, making this the most likely source of the latency issue.

Answer

The instances are using jumbo frames.

Answer

The instances are in a cluster placement group.

Answer

The instances have Enhanced Networking enabled.

Question 6

A company wants to use AWS Direct Connect to establish a dedicated network connection from their on-premises data center to AWS. They need to connect to a VPC in the us-east-1 region. Which of the following is a required step in the setup process?

Accepted Answer

Create a private virtual interface and attach it to a Virtual Private Gateway.. To establish a Direct Connect connection to a VPC, you must create a private virtual interface (VIF) and attach it to a Virtual Private Gateway (VGW) that is attached to the VPC. The private VIF carries traffic over the dedicated connection and uses BGP to exchange routes between the on-premises network and the VPC via the VGW. This is the core requirement for routing traffic from the Direct Connect link into a VPC.

Answer

Attach a Transit Gateway to the VPC.

Answer

Configure CloudFront to route traffic through the Direct Connect.

Answer

Create a site-to-site VPN connection as a backup.

Question 7

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over a Direct Connect connection. The engineer has verified that the VPC route tables, Direct Connect virtual interface, and on-premises routing are correctly configured. Which tool should be used to verify the path MTU and identify fragmentation issues?

Accepted Answer

Use the ping command with the DF flag set to test MTU. The ping command with the Don't Fragment (DF) flag set (e.g., `ping -M do -s <size>` on Linux) is the correct tool to verify path MTU because it forces the packet not to be fragmented. If the packet size exceeds the MTU of any link along the path, the router will drop the packet and send an ICMP Fragmentation Needed message back, allowing the engineer to pinpoint the maximum supported MTU and identify fragmentation issues.

Answer

Use the netstat command

Answer

Use the nslookup command

Answer

Use the traceroute command

Question 8

A company has a multi-account AWS environment with hundreds of VPCs connected via a transit gateway. The network team needs to centrally monitor network traffic and detect anomalies such as unusual outbound data transfers. Which combination of services would provide the most scalable and cost-effective solution?

Accepted Answer

Enable VPC Flow Logs in each VPC, publish to Amazon S3, and use Amazon Athena to query logs from a central account. Option D is correct because VPC Flow Logs capture IP traffic metadata at scale, and publishing to Amazon S3 provides a cost-effective, durable storage layer. Using Amazon Athena to query the logs from a central account enables serverless, on-demand analysis across hundreds of VPCs without provisioning servers, making it both scalable and cost-effective for anomaly detection.

Answer

Use AWS Trusted Advisor to check for unusual traffic patterns

Answer

Enable VPC Flow Logs in each VPC, publish to CloudWatch Logs, and create cross-account CloudWatch dashboards

Answer

Use AWS Network Manager to monitor all VPCs and Transit Gateway attachments

Question 9

Which TWO options are valid ways to monitor network traffic in an AWS environment? (Choose 2.)

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring (Option C) is a valid way to monitor network traffic because it captures and copies network packets from Elastic Network Interfaces (ENIs) in a VPC and forwards them to monitoring appliances for deep packet inspection, security analysis, or troubleshooting. This allows you to inspect traffic content, including payloads, without impacting the source or destination of the traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 10

A network engineer is configuring a new AWS Direct Connect connection and needs to establish BGP peering with the AWS side. The engineer has received the BGP configuration from the AWS Direct Connect endpoint. Which information is required to complete the BGP configuration on the on-premises router?

Accepted Answer

The AWS BGP peer IP address and the BGP ASN. B is correct because BGP peering requires the remote peer's IP address and Autonomous System Number (ASN) to establish a TCP connection and exchange routing information. AWS provides these two values in the Direct Connect endpoint configuration, and the on-premises router must use them to configure the BGP neighbor statement. Without both, the BGP session cannot be established.

Answer

The AWS Side BGP password and MD5 hash

Answer

The Amazon side routing table and prefix list

Answer

The Direct Connect virtual interface ID and VLAN ID

Question 11

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to monitor the latency and packet loss on the Direct Connect virtual interfaces. Which AWS service should be used to measure these metrics?

Accepted Answer

AWS CloudWatch. AWS CloudWatch is the correct service because it provides built-in metrics for Direct Connect virtual interfaces, including 'VirtualInterfaceRxNoPacket' and 'VirtualInterfaceTxNoPacket' for packet loss, and you can derive latency by monitoring the 'VirtualInterfaceBpsEgress' and 'VirtualInterfaceBpsIngress' metrics with appropriate alarms. CloudWatch also supports custom metrics and logs that can be used to calculate round-trip time (RTT) by analyzing ping results or using AWS Direct Connect's native health checks. This allows the network team to set up dashboards and alarms for latency and packet loss directly from the Direct Connect metrics.

Answer

AWS Config

Answer

AWS X-Ray

Answer

AWS CloudTrail

Question 12

Which TWO services can be used to centrally manage and monitor VPN connections across multiple AWS accounts? (Choose 2.)

Accepted Answer

AWS Network Manager. AWS Network Manager centrally manages and monitors VPN connections across multiple AWS accounts by providing a global view of your network topology, including on-premises and AWS resources. It integrates with Transit Gateway to monitor VPN tunnel status and performance metrics, enabling cross-account visibility via resource shares.

Answer

AWS CloudFormation

Answer

AWS Organizations

Answer

AWS Direct Connect Gateway

Question 13

A company has a hybrid network architecture with multiple VPCs connected via a transit gateway and on-premises via Direct Connect. The network team wants to automate the response to a BGP session failure on a Direct Connect virtual interface. Which AWS service can be used to monitor the BGP status and trigger an automated action?

Accepted Answer

AWS CloudWatch Events (EventBridge) with Direct Connect BGP metric alarms. Option C is correct because AWS CloudWatch Events (EventBridge) can monitor Direct Connect BGP session status via the `bgp_session_state` metric in the `AWS/DX` namespace. When the BGP session transitions to the `down` state, you can create an EventBridge rule that triggers an automated action, such as invoking a Lambda function or sending an SNS notification, enabling a rapid response to BGP failures without manual intervention.

Answer

AWS Lambda with VPC Flow Logs

Answer

AWS Systems Manager Automation

Answer

AWS Config rules

Question 14

A company is using a centralized egress VPC model with a NAT gateway for outbound traffic from multiple VPCs. The network team notices that some EC2 instances are having connectivity timeouts when accessing the internet. The team has verified the route tables and security groups. Which additional check should be performed to troubleshoot the issue?

Accepted Answer

Check the NAT gateway CloudWatch metrics for error packets and connection counts. Option D is correct because NAT Gateway CloudWatch metrics, specifically `ErrorPortAllocation` and `PacketsDropCount`, directly indicate whether the NAT Gateway is running out of available ports or dropping packets due to connection limits. In a centralized egress model with multiple VPCs, high connection counts can exhaust the NAT Gateway's ephemeral port capacity (65,535 per IP), causing connectivity timeouts even when route tables and security groups are correctly configured.

Answer

Check the security group rules for outbound traffic

Answer

Check the VPC Flow Logs for denied traffic

Answer

Check the route tables for the internet gateway

Question 15

A company is using AWS Site-to-Site VPN connections to connect multiple branch offices to a central VPC. The network team wants to ensure high availability and automatic failover if one VPN tunnel goes down. Which configuration should be implemented?

Accepted Answer

Use the two tunnels provided by the VPN connection with dynamic routing (BGP). Each AWS Site-to-Site VPN connection provides two tunnels for high availability. By using dynamic routing (BGP) with both tunnels, the VPN automatically fails over to the second tunnel if the first goes down, without manual intervention. This meets the requirement for automatic failover and high availability.

Answer

Configure a second VPN connection to the same customer gateway and use BGP with equal-cost multipath

Answer

Use a single tunnel and rely on AWS automatic recovery

Answer

Configure static routes with a higher metric for the secondary tunnel

Question 16

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Answer

AWS Config.

Answer

AWS CloudTrail.

Answer

AWS X-Ray.

Question 17

A company needs to connect its on-premises data center to a VPC in AWS using a dedicated, private, and high-bandwidth connection. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private, high-bandwidth network connection from an on-premises data center directly to AWS, bypassing the public internet. This meets the requirements for a private, low-latency, and consistent network path, unlike VPN-based solutions that traverse the internet.

Answer

AWS Client VPN

Answer

VPC Peering

Answer

AWS Site-to-Site VPN

Question 18

A company needs to establish private connectivity between two VPCs in different AWS accounts. The VPCs are in the same Region. Which AWS feature should be used?

Accepted Answer

VPC peering. VPC peering is the correct choice because it establishes a direct, private network connection between two VPCs in the same AWS Region, even across different AWS accounts, using the AWS backbone without requiring a transit hub or external connectivity. It leverages the existing AWS infrastructure to route traffic between the VPCs via private IPv4 or IPv6 addresses, with no bandwidth bottlenecks or single points of failure inherent in the design.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 19

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to add a secondary CIDR block for additional subnets. Which CIDR block can be used?

Accepted Answer

10.1.0.0/16. Option A (10.1.0.0/16) is correct because it is a valid RFC 1918 private IP address range that does not overlap with the existing VPC CIDR block (10.0.0.0/16). AWS allows adding a secondary CIDR block to a VPC as long as it does not conflict with the primary CIDR or any existing secondary CIDR blocks, and 10.1.0.0/16 is a non-overlapping /16 within the 10.0.0.0/8 private range.

Answer

172.16.0.0/16

Answer

192.168.0.0/16

Answer

10.0.0.0/16

Question 20

A network engineer needs to capture and analyze traffic crossing a VPC peering connection for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs for the peering connection.. VPC Flow Logs capture IP traffic information for network interfaces, including those attached to a VPC peering connection. They can be published to Amazon CloudWatch Logs or Amazon S3, and the logs contain fields such as source/destination IP, ports, protocol, and packet/byte counts, which are essential for troubleshooting traffic across the peering link. This is the correct service because it directly logs metadata about the traffic traversing the peering connection without requiring any changes to the network path.

Answer

AWS CloudTrail.

Answer

VPC Traffic Mirroring.

Answer

AWS Transit Gateway Network Manager.