ANS-C01 Network Management and Operations Practice Test 10 — 15 Questions

Question 1

A company is using AWS Client VPN to provide remote access to employees. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a subnet, and authorization rules are configured. What is the most likely cause?

Accepted Answer

The Client VPN endpoint's security group does not allow inbound traffic from the client IP pool.. The Client VPN endpoint must be associated with a subnet, but the subnet must have a route to the target network (e.g., the VPC CIDR). If the route table for the subnet does not have a route back to the VPC CIDR via the VPN endpoint, traffic will not be forwarded. Alternatively, the security group on the VPN endpoint must allow inbound traffic from the client CIDR.

Answer

The VPC's network ACLs are blocking traffic.

Answer

The authorization rules are not associated with the correct groups.

Answer

The subnet association is missing.

Question 2

A company wants to monitor network traffic between two VPCs connected via a Transit Gateway. Which THREE AWS services can be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. Options A, B, and E are correct because VPC Flow Logs, Transit Gateway Flow Logs, and third-party appliances can capture traffic. Option C is incorrect because CloudTrail logs API calls. Option D is incorrect because AWS Config records configuration changes.

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

A network engineer notices that traffic from an EC2 instance in a public subnet to the internet is not working. The instance has a public IP assigned and is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What should the engineer check next?

Accepted Answer

Verify that the route table for the subnet has a 0.0.0.0/0 route pointing to the internet gateway.. Even if the instance has a public IP, if the subnet's route table does not have a default route (0.0.0.0/0) pointing to the internet gateway, traffic to the internet will fail. This is a common misconfiguration.

Answer

Ensure the network ACL allows outbound traffic.

Answer

Confirm that the internet gateway is attached to the VPC.

Answer

Check if the instance has a public IP assigned.

Question 4

Refer to the exhibit. A network engineer has established a VPC peering connection between VPC A (10.0.0.0/16) in account 111111111111 and VPC B (192.168.0.0/16) in account 222222222222. The peering connection status is 'active'. However, instances in VPC A cannot reach instances in VPC B. What is the MOST likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes to the peer CIDR. Option D is correct because the route tables in both VPCs need routes to the peer CIDR via the peering connection. Option A is incorrect because the status is active. Option B is incorrect because the CIDRs are non-overlapping. Option C is incorrect because there is no indication of security groups blocking, though they could; but the most common cause is missing routes.

Answer

The peering connection is not in the 'active' state

Answer

Security groups in VPC B are blocking traffic

Answer

The CIDR blocks overlap

Question 5

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company wants to ensure that traffic to the VPC uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the virtual private gateway.. To ensure traffic uses Direct Connect, the route table in the VPC must have a route to the on-premises CIDR via the virtual private gateway (VGW) attached to the Direct Connect. Additionally, on the on-premises side, routes must point to the Direct Connect. The VPC route table should have a more specific route or a default route pointing to the VGW.

Answer

Create a VPC peering connection to the on-premises network.

Answer

Use a NAT gateway in the VPC.

Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the internet gateway.

Question 6

Refer to the exhibit. The IAM policy above is attached to a user in account A (123456789012). The user needs to create a VPC peering connection with account B and accept it. The user in account A can create the peering request, but the accept fails with an 'UnauthorizedOperation' error. What is the MOST likely reason?

Accepted Answer

The user does not have permission to accept the peering connection from the other account. Option C is correct because the 'AcceptVpcPeeringConnection' action is allowed on all resources ('*'), but the specific ARN for the peering connection is not granted for the accept action. The second statement allows actions only on peering connections in account A, but the accept action is performed on the requester's side? Actually, the accept is done by the accepter (account B). The user in account A is trying to accept? The scenario says 'the user in account A can create the peering request, but the accept fails'. Actually, the accept is done by account B. So the user in account A cannot accept a peering connection that belongs to account B. The policy allows accept on 'ec2:AcceptVpcPeeringConnection' with resource '*', but the accept action is performed on the resource in the accepter account. The second statement restricts to peering connections in account A. The accept action is not covered by the second statement because it's not in the action list of the second statement. Wait, the first statement allows accept on all resources. So why would it fail? The issue is that the accept action is called on the peering connection resource in the accepter account, which is not in account A. The policy does not have permissions for resources in other accounts. The correct answer is that the user does not have permission to accept the peering connection because the resource ARN in the second statement only covers peering connections in account A. But the first statement allows accept on all resources. However, the 'ec2:AcceptVpcPeeringConnection' action requires permission on the resource of the peering connection in the accepter account. Since the user is in account A, they cannot accept a peering connection that is owned by account B. The most likely reason is that the user lacks permissions to accept the peering connection in the other account. Option C captures this.

Answer

The user does not have permission to create routes in the VPC

Answer

The 'ec2:CreateVpcPeeringConnection' action requires a specific VPC ARN

Answer

The 'ec2:AcceptVpcPeeringConnection' action is not allowed in the policy

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that some VPCs cannot communicate with each other even though they are attached to the same transit gateway. What is the most likely cause?

Accepted Answer

The transit gateway route tables are missing routes to the other VPCs.. Transit Gateway uses route tables to control inter-VPC traffic. If the route tables do not have routes to the other VPCs, or if the VPCs are in different route tables that are not associated or propagated correctly, communication fails. The most common issue is that the transit gateway route tables are not properly configured with routes to the other VPC attachments.

Answer

The security groups on the instances are not allowing inbound traffic from the other VPCs.

Answer

The VPC attachments are not in the 'available' state.

Answer

The VPCs' network ACLs are blocking traffic.

Question 8

Refer to the exhibit. A Direct Connect private virtual interface is in the 'available' state, and the BGP session is up. However, the on-premises network cannot reach any resources in the VPC attached to the Direct Connect gateway. What is the MOST likely cause?

Accepted Answer

The Direct Connect gateway is not associated with the virtual private gateway or route propagation is not enabled. Option B is correct because even though the BGP session is up, the on-premises router may not be learning the VPC routes. The Direct Connect gateway must be associated with the virtual private gateway and route propagation must be enabled. Option A is incorrect because the BGP session is up. Option C is incorrect because the VLAN is configured. Option D is incorrect because the ASN is valid.

Answer

The BGP ASN is private and not allowed

Answer

The VLAN ID is incorrect

Answer

The BGP session is not established

Question 9

Which TWO configuration steps are required to enable VPC Flow Logs to be published to an S3 bucket in a different AWS account? (Select TWO.)

Accepted Answer

Attach a resource-based policy to the S3 bucket that grants the source account's Flow Logs service permission to write.. For cross-account flow logs, you need an IAM role in the source account that the Flow Logs service can assume, and that role must have permissions to write to the destination bucket. Additionally, the S3 bucket policy must grant the source account (or the role) the necessary permissions.

Answer

Configure the Flow Logs destination as a CloudWatch Logs log group in the source account.

Answer

Create an IAM user in the source account with programmatic access and share the access keys.

Answer

Enable S3 cross-account replication.

Question 10

A company is designing a highly available Direct Connect connection. Which THREE components should be deployed to meet this requirement? (Select THREE.)

Accepted Answer

Two Direct Connect connections to two different AWS Direct Connect locations.. For high availability, you need at least two Direct Connect connections (preferably to different AWS locations), two customer routers (or one router with two interfaces), and two virtual interfaces (VIFs) to provide redundancy. Using BGP with multiple sessions ensures automatic failover.

Answer

A single BGP session over one of the virtual interfaces.

Answer

A VPN connection as a backup to Direct Connect.

Question 11

A company uses AWS Direct Connect and VPN as backup. The network team notices that during a VPN failover, traffic drops for several minutes. The VPN tunnels are configured with BGP dynamic routing. Which configuration change would MOST likely reduce failover time?

Accepted Answer

Enable BFD on the VPN BGP sessions. Option B is correct because BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions, reducing failover time. Option A is wrong because increasing the keepalive interval and decreasing the hold timer can help but may not be as fast as BFD. Option C is wrong because decreasing the keepalive interval and increasing the hold timer would slow down failure detection. Option D is wrong because static routes do not dynamically adapt to failures.

Answer

Configure static routes over the VPN instead of BGP

Answer

Increase the BGP keepalive interval and decrease the hold timer

Answer

Decrease the BGP keepalive interval and increase the hold timer

Question 12

Which TWO actions should a network engineer take to troubleshoot a BGP session that is not establishing between an on-premises router and AWS Direct Connect? (Select TWO.)

Accepted Answer

Verify that the BGP ASN configured on the customer router matches the one provided by AWS.. Common BGP issues include incorrect BGP ASN, incorrect peer IP addresses, missing authentication, and firewall rules blocking TCP port 179. Verifying these settings on both sides is key.

Answer

Increase the MTU on the customer router interface.

Answer

Ensure that the virtual interface is in the 'available' state.

Answer

Check that the Direct Connect connection is in the 'available' state.

Question 13

A network engineer needs to monitor network traffic to an Amazon RDS instance for security analysis. Which AWS service should be used to capture and analyze network traffic?

Accepted Answer

VPC Traffic Mirroring. Option C is correct because VPC Traffic Mirroring allows capturing and inspecting network traffic from an RDS instance. Option A is wrong because AWS CloudTrail records API activity, not network traffic. Option B is wrong because Amazon Inspector is for vulnerability assessment. Option D is wrong because VPC Flow Logs provide metadata about traffic, not full packet capture.

Answer

Amazon Inspector

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 14

An engineer is trying to create a VPC Flow Log that delivers to a CloudWatch Logs log group in the same account. The IAM role used has the above trust policy. However, the flow log creation fails with an error. What is the most likely reason?

Accepted Answer

The IAM role lacks a permissions policy that grants the actions on the log group.. The trust policy shown trusts the VPC Flow Logs service principal, but the IAM role itself must have a permissions policy that allows the actions on the log group. The exhibit only shows the trust policy; the permissions policy is missing. The error likely indicates that the role does not have the necessary permissions to perform the actions.

Answer

The log group does not exist yet.

Answer

The trust policy incorrectly specifies the service principal; it should be 'ec2.amazonaws.com'.

Answer

The resource ARN in the trust policy does not include the log group name.

Question 15

A company has a hybrid network with multiple AWS Direct Connect connections to different VPCs. The on-premises network uses BGP to advertise prefixes to AWS. The network team notices that some on-premises prefixes are not being received by the VPCs. What is the MOST likely cause?

Accepted Answer

The on-premises router is advertising more than 100 prefixes over the BGP session. Option A is correct because the maximum number of routes advertised over a Direct Connect virtual interface is 100 by default, and exceeding this limit causes BGP to reject additional routes. Option B is wrong because AS_PATH prepending would affect route preference, not advertisement. Option C is wrong because the MED attribute affects path selection, not advertisement. Option D is wrong because BGP communities are optional and not required for prefix advertisement.

Answer

The on-premises router is not using BGP communities

Answer

The on-premises router is using AS_PATH prepending

Answer

The on-premises router is not setting the MED attribute