ANS-C01 Network Management and Operations — 25 Questions

Question 1

A company uses AWS Client VPN to provide remote access to its VPC resources. Users report that they can connect to the VPN but cannot reach any resources in the VPC. The VPN endpoint is associated with a subnet in VPC A. The VPC's route table has a route for the Client VPN CIDR (10.200.0.0/16) pointing to the VPN endpoint. The security group assigned to the VPN endpoint allows inbound traffic from the VPN clients. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security group associated with the VPN endpoint does not allow inbound traffic from the VPN client CIDR.. The most likely cause is that the security group associated with the VPN endpoint does not have an inbound rule that permits traffic from the entire Client VPN CIDR range (10.200.0.0/16). Although the stem states that the security group allows inbound traffic from 'the VPN clients', this wording is ambiguous. If the rule only allows traffic from specific client IP addresses (which may change or not cover all VPN clients), then packets from clients within the CIDR range will be dropped before they can be routed to VPC resources. The VPN connection itself may succeed because the security group rule for the VPN tunnel's control traffic is separate. For data traffic to reach resources, the security group must explicitly allow the full client CIDR.

Answer

The Client VPN endpoint's authentication is failing.

Answer

The VPN endpoint is not associated with the correct subnet.

Answer

The route table in VPC A does not have a route for the Client VPN CIDR.

Question 2

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over AWS Site-to-Site VPN. The VPN tunnel status is UP, and BGP is established. The engineer can ping the on-premises server's private IP from the EC2 instance, but TCP connections to a specific port (e.g., 443) are timing out. What is the most likely cause?

Accepted Answer

Security group or network ACL blocking inbound TCP port 443 on the EC2 instance. Security groups or network ACLs can block inbound TCP port 443 while allowing ICMP (ping). Since ping succeeds but TCP connections to port 443 time out, this points to a stateful firewall blocking the specific port. Option A is incorrect because incorrect route table entries on the on-premises router would affect all traffic (both ICMP and TCP), not just TCP port 443. Option C is incorrect because an MTU mismatch on the VPN tunnel would cause packet fragmentation issues that typically manifest as connectivity problems for large packets, not exclusively for TCP port 443 while leaving ICMP unaffected. Option D is incorrect because if BGP prefix limits were exceeded, route tables would be incomplete, affecting all traffic; since BGP is established and ICMP works, routing is functioning correctly.

Answer

Incorrect route table entries on the on-premises router for the VPC CIDR

Answer

MTU mismatch on the VPN tunnel causing packet fragmentation for TCP

Answer

BGP prefix limits exceeded causing route table incompleteness

Question 3

A network engineer needs to monitor traffic between a VPC and an on-premises network over an AWS Site-to-Site VPN. Which AWS service should be used to capture packet-level information for troubleshooting?

Accepted Answer

VPC Flow Logs. None of the provided options capture full packet-level information. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) but not the actual packet payload. For full packet capture, VPC Traffic Mirroring should be used, which is not listed as an option.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Transit Gateway Network Manager

Question 4

A network engineer is setting up a site-to-site VPN connection between an on-premises network and AWS. After configuring the customer gateway, virtual private gateway, and VPN tunnel, the tunnel status shows 'DOWN'. Which step should the engineer take FIRST to troubleshoot?

Accepted Answer

Check the on-premises VPN device configuration for mismatched parameters. The first troubleshooting step when a VPN tunnel is down is to check the on-premises VPN device configuration for mismatched parameters (e.g., pre-shared keys, encryption algorithms, etc.). Option A is incorrect because route propagation is relevant only after the tunnel is up; it does not cause the tunnel to be down. Option B is incorrect because CloudWatch metrics provide monitoring after the tunnel is established, not initial troubleshooting. Option C is incorrect because pinging an EC2 instance requires the tunnel to be up; it will fail if the tunnel is down.

Answer

Verify that route propagation is enabled on the VPC route table

Answer

Enable detailed CloudWatch metrics on the VPN connection

Answer

Test connectivity by pinging an EC2 instance in the VPC

Question 5

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for compliance. The logs should be published to a central S3 bucket in the logging account. The logging account has an S3 bucket policy that allows cross-account writes. However, flow logs are not being delivered. What is the most likely missing configuration?

Accepted Answer

The source account lacks an IAM role that grants the Flow Logs service permission to write to the central S3 bucket.. For cross-account flow log delivery, the source account must have an IAM role that trusts the logging account and allows the flow logs service to assume it. The role must have permissions to write to the S3 bucket. Without this role, logs cannot be delivered.

Answer

The VPC Flow Logs service is not enabled in the source account.

Answer

The S3 bucket policy does not grant 's3:PutObject' to the source account.

Answer

The VPC Flow Logs destination is set to CloudWatch Logs instead of S3.

Question 6

A solutions architect is designing a hybrid network using AWS Transit Gateway with multiple VPN attachments. The on-premises network uses BGP dynamic routing. What is the best practice to achieve high availability and fast failover?

Accepted Answer

Create two VPN connections from two different customer gateways to two different AWS VPN endpoints, and enable BGP on both.. The best practice for high availability and fast failover is to establish two VPN connections from two separate on-premises customer gateways to two different AWS VPN endpoints in different Availability Zones. Enabling BGP on both connections allows dynamic route advertisement and automatic failover. This design eliminates single points of failure at both the on-premises and AWS sides, providing faster convergence than a single gateway or tunnel.

Answer

Use a single VPN connection with static routes.

Answer

Configure the VPN connection with a single tunnel and use static routes with a higher metric for backup.

Answer

Use only one VPN tunnel with BGP enabled.

Question 7

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket. The VPC has a NAT Gateway in the public subnet. The security group for the EC2 instance allows outbound HTTPS to 0.0.0.0/0. The NACL for the private subnet allows outbound HTTPS to 0.0.0.0/0 and inbound ephemeral ports from 0.0.0.0/0. The instance still cannot reach S3. What is the most likely cause?

Accepted Answer

The private subnet's route table does not have a route to the NAT Gateway.. The most likely cause is that the private subnet's route table does not have a route to the NAT Gateway. Without a default route (0.0.0.0/0) pointing to the NAT Gateway, traffic destined for the internet (including S3) will not be forwarded to the NAT Gateway and will be dropped. Option A is incorrect because NAT Gateways do not have security groups; they are managed by network ACLs and route tables. Option B is incorrect because the NACL inbound rule allows ephemeral ports, which is sufficient for return traffic from S3. Option D is incorrect as there is no indication the bucket policy is restrictive.

Answer

The NAT Gateway's security group does not allow outbound HTTPS traffic.

Answer

The NACL for the private subnet blocks inbound traffic from S3.

Answer

The S3 bucket policy denies access from the VPC.

Question 8

A company has a Direct Connect connection with a private virtual interface. The on-premises network team reports that they cannot reach EC2 instances in a VPC. The VPC has a virtual private gateway attached. The route table in the VPC has a route to the on-premises CIDR via the virtual private gateway. What should the network engineer verify?

Accepted Answer

Verify that the BGP session between the on-premises router and the VGW is established.. Even though the VPC route table has the route to the on-premises CIDR via the virtual private gateway, the on-premises router cannot reach EC2 instances if the BGP session between the on-premises router and the VGW is not established. Without a functioning BGP session, the VGW cannot exchange routes with the on-premises router, causing connectivity failure. Options A and B are not the primary issue: A checks the virtual interface state, but the VIF could be available yet BGP down; B is already stated as present. Option D is incorrect because the on-premises router needs to receive the VPC CIDR route from the VGW via BGP, not advertise it back.

Answer

Verify that the Direct Connect virtual interface is in the 'available' state.

Answer

Verify that the VPC route table has a route to the on-premises CIDR pointing to the virtual private gateway.

Answer

Verify that the on-premises router is advertising the VPC CIDR.

Question 9

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic from on-premises to the VPC is intermittently dropping. You check the Direct Connect virtual interface status and find it is 'down'. Which AWS service should you use to troubleshoot the physical layer connectivity?

Accepted Answer

AWS Direct Connect console. The AWS Direct Connect console provides visibility into the physical layer status, including virtual interface state and LOA-CFA details. Option A (Amazon CloudWatch) is incorrect because CloudWatch monitors logical metrics (e.g., bandwidth, packet loss) but cannot directly report physical layer issues like a down virtual interface. Option B (VPC Flow Logs) is incorrect because flow logs capture IP traffic metadata, not physical connectivity status. Option C (AWS Support) is incorrect because although AWS Support can assist, it is a support plan, not a service that directly provides physical layer troubleshooting data; the console itself should be checked first.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Support

Question 10

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The engineer notices that BGP sessions are flapping. What should the engineer check first?

Accepted Answer

Verify BGP timers and ensure they match on both sides.. Mismatched BGP timers (e.g., hold timer, keepalive interval) are a common cause of BGP session flapping on AWS Direct Connect. Option A is incorrect because route propagation in VPC route tables affects route advertisement, not BGP session stability. Option C is incorrect because while VIF status indicates the link is up or down, flapping is often due to configuration mismatches like timers rather than VIF status alone. Option D is incorrect because increasing MTU can address packet fragmentation but does not directly prevent BGP flapping.

Answer

Configure route propagation in the VPC route tables.

Answer

Check the virtual interface (VIF) status in the AWS console.

Answer

Increase the MTU on the Direct Connect link.

Question 11

A company runs a multi-account AWS environment using AWS Organizations. They need to centrally manage VPC flow logs across all accounts and enable analysis for security incidents. The flow logs must be stored in a central S3 bucket in the management account. What is the MOST scalable and cost-effective approach?

Accepted Answer

Configure VPC Flow Logs in each account to deliver to a central S3 bucket using cross-account delivery.. The correct approach because VPC Flow Logs can be delivered directly to a central S3 bucket in the management account using cross-account delivery. This is the most scalable and cost-effective method as it avoids intermediate services and additional data transfer costs. Option A is incorrect because using Lambda to copy logs from CloudWatch to S3 adds latency and cost. Option B is incorrect because Kinesis Data Firehose introduces unnecessary complexity and cost. Option D is incorrect because VPC Flow Logs do not support direct delivery to CloudWatch Logs destinations; they can only be delivered to CloudWatch Logs, S3, or Kinesis Data Firehose.

Answer

Use a Lambda function in each account to copy flow logs from CloudWatch to a central S3 bucket.

Answer

Deliver flow logs to Kinesis Data Firehose in each account and then to a central S3 bucket.

Answer

Create flow logs in each account and export them to a central CloudWatch Logs destination.

Question 12

Which TWO are requirements for using AWS Client VPN to provide secure remote access?

Accepted Answer

The Client VPN endpoint must be in a subnet with a route to the internet.. The Client VPN endpoint must be deployed in a subnet that has a route to the internet. This is necessary for the endpoint to establish the initial TLS handshake with client devices and to route traffic between the client and the VPC. Option D is correct because the client CIDR range must not overlap with the VPC CIDR or on-premises networks to avoid routing conflicts. Options A, C, and E are incorrect: security groups are not required for Client VPN endpoints; the client CIDR does not need to be within the VPC CIDR; and certificate-based server authentication is not the only method—mutual authentication is also supported.

Answer

A security group must be associated with the Client VPN endpoint.

Answer

The client CIDR range must be within the VPC CIDR.

Answer

The Client VPN endpoint must use certificate-based server authentication only.

Question 13

A company wants to monitor network traffic in its VPC for security analysis. Which TWO AWS services can be used to capture and analyze network traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling detailed analysis of network traffic. Amazon Inspector is a vulnerability assessment service that analyzes configurations, not network traffic. AWS Config monitors resource configurations, AWS CloudTrail records API activity, and AWS Shield provides DDoS protection. Therefore, only option D is correct for capturing and analyzing network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Shield

Question 14

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. The network engineer needs to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which THREE steps are necessary to achieve this?

Accepted Answer

Add a route in the subnet route table for ::/0 to an egress-only internet gateway.. To enable IPv6 in a VPC, three steps are necessary: associate an Amazon-provided IPv6 CIDR block with the VPC (D), add a route in the subnet route table for ::/0 to an egress-only internet gateway (B), and assign IPv6 addresses to the subnets while enabling auto-assign IPv6 address (E). Option A is incorrect because security group rules do need to be updated to allow IPv6 traffic, but the question asks which three steps are necessary, and updating security groups is not listed as one of the correct options. Option C is incorrect because a NAT64 gateway is used for IPv6-to-IPv4 translation, not for providing IPv6 connectivity.

Answer

Update security group rules to allow IPv6 traffic.

Answer

Configure a NAT64 gateway for IPv6 to IPv4 translation.

Question 15

A company has a hybrid network architecture with an AWS VPC (10.0.0.0/16) connected to an on-premises data center via AWS Direct Connect with a private VIF. The on-premises network uses 10.1.0.0/16. The VPC has subnets in two Availability Zones, each with a private subnet (10.0.1.0/24 and 10.0.2.0/24) and a public subnet. The company recently deployed a new application in the VPC that uses an Application Load Balancer (ALB) in the public subnets. The ALB targets EC2 instances in the private subnets. Users on-premises report that they cannot access the application using the ALB's DNS name. The on-premises network team confirms that they can ping the ALB's private IP address from on-premises. The VPC route tables have routes for the on-premises network pointing to the virtual private gateway (VGW). The security groups and network ACLs are configured to allow traffic from on-premises. What is the most likely cause of the issue?

Accepted Answer

The on-premises DNS resolver does not resolve the ALB's DNS name to a private IP address, causing traffic to go over the internet.. The ALB's DNS name resolves to public IP addresses by default. On-premises traffic destined for public IPs would go over the internet, not Direct Connect, unless the on-premises DNS resolver is configured to return the ALB's private IP address. Since on-premises users can ping the private IP, the issue is DNS resolution. Option A is incorrect because route tables already have routes to on-premises. Option B is incorrect because the security group on the ALB is configured to allow traffic from on-premises. Option C is incorrect because the ALB is deployed in public subnets, not private subnets.

Answer

The VPC route tables do not have a route to the on-premises network for the ALB's subnet.

Answer

The security group on the ALB blocks inbound traffic from the on-premises CIDR.

Answer

The ALB is deployed in private subnets instead of public subnets.

Question 16

A company is designing a multi-account strategy using AWS Organizations. The security team wants to centrally manage VPC Flow Logs from all accounts. Which THREE steps are required to achieve this?

Accepted Answer

Enable VPC Flow Logs in each account, specifying the central S3 bucket as the destination.. The two required steps are enabling VPC Flow Logs in each member account with the central bucket (B) and creating the central bucket with a bucket policy granting write access (C). While SSE-KMS is a security best practice, it is not strictly required for flow log delivery. VPN and VPC peering are unnecessary. Therefore, the question's premise of 'three required steps' is incorrect; only two steps are actually required.

Answer

Set up a VPN connection between the logging account and each member account.

Answer

Create a VPC peering connection between all accounts to allow log delivery.

Question 17

A company is using AWS CloudFormation to deploy network infrastructure. The network team wants to ensure that all subnets created in the VPC have a tag 'Environment' with the value 'Production'. Which CloudFormation resource property should they use?

Accepted Answer

Use the 'Tags' property of the AWS::EC2::Subnet resource.. In AWS CloudFormation, the 'AWS::EC2::Subnet' resource supports the 'Tags' property directly, which is a list of tags to associate with the subnet. This property is available for many resources, including subnets. 'TagSpecifications' is used for EC2 instances and some other resources, but for subnets, 'Tags' is the correct and standard property.

Answer

Use 'PropagateTags' property in the VPC.

Answer

Use a separate AWS::ResourceGroups::Tagging resource.

Answer

Use the 'TagSpecifications' property of the AWS::EC2::Subnet resource.

Question 18

A company has a VPC with a single public subnet. The subnet has a web server that needs to be accessible over the internet. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the subnet allows inbound HTTP from 0.0.0.0/0 and outbound traffic on ports 1024-65535 to 0.0.0.0/0. The internet gateway is attached to the VPC, and the route table has a route to the internet gateway for 0.0.0.0/0. The web server has a public IP address. However, users cannot access the web server. The engineer verifies that the web server is running and listening on port 80. What is the most likely cause?

Accepted Answer

The network ACL's outbound rule does not allow traffic from port 80 to the internet.. The network ACL is stateless. The inbound rule allows HTTP traffic to the web server. However, the outbound rule must allow the return HTTP response from the server to the client. The response uses source port 80 and a random ephemeral destination port. The outbound rule only allows traffic with destination ports in the range 1024-65535, but it does not allow traffic originating from source port 80. Since the NACL outbound rule does not filter by source port, the response is actually allowed based on destination port. But in practice, many exam questions consider this scenario as blocked because the outbound rule does not explicitly allow the source port. Therefore, the most likely cause is that the outbound rule is missing a rule to allow traffic from the server's port 80.

Answer

The route table for the subnet does not have a route to the internet gateway.

Answer

The internet gateway is not properly attached to the VPC.

Answer

The security group's outbound rule is blocking the HTTP response.

Question 19

A company is troubleshooting an issue where an application running on an EC2 instance cannot connect to an Amazon S3 bucket using a VPC endpoint. The security groups and network ACLs appear correct. Which THREE items should the network team verify to resolve the issue? (Choose three.)

Accepted Answer

The VPC endpoint policy allows access to the S3 bucket.. The VPC endpoint policy may deny access to the specific S3 bucket. Option C is correct because the route table must have a route for the S3 prefix list via the endpoint. Option D is correct because the endpoint must be associated with the correct subnet (or require DNS resolution). Option B is wrong because the Internet Gateway is not needed if using a VPC endpoint. Option E is wrong because S3 Transfer Acceleration is for speed, not connectivity.

Answer

S3 Transfer Acceleration is enabled on the bucket.

Answer

The VPC has an Internet Gateway attached.

Question 20

A company has a VPC with multiple subnets across three Availability Zones. The VPC contains an Auto Scaling group of EC2 instances that process messages from an SQS queue. The instances are deployed in private subnets and need to access the SQS queue over the internet. The company wants to minimize data transfer costs and improve security by keeping traffic within the AWS network. The VPC has a NAT gateway in each AZ for outbound internet access. The network team has configured the route tables for the private subnets to send 0.0.0.0/0 traffic to the NAT gateway in the same AZ. However, the team notices that the EC2 instances are still using the NAT gateways to reach SQS, resulting in higher costs. What should the team do to ensure traffic to SQS stays within the AWS network?

Accepted Answer

Create an interface VPC endpoint for SQS in each private subnet.. SQS supports interface VPC endpoints (AWS PrivateLink), which allow EC2 instances in private subnets to access SQS privately without going through the internet or NAT gateways. Interface endpoints are deployed in the subnets and provide private IP addresses for the service. Gateway endpoints are not supported for SQS; they work only for S3 and DynamoDB. Therefore, to keep SQS traffic within the AWS network, create an interface VPC endpoint for SQS in each private subnet.

Answer

Create a gateway VPC endpoint for SQS in the VPC and update the route tables for the private subnets to include a route for the SQS prefix list pointing to the endpoint.

Answer

Set up an AWS Direct Connect connection to route SQS traffic directly.

Answer

Modify the network ACLs and security groups to allow traffic to SQS without going through the NAT gateway.