ANS-C01 Network Management and Operations Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. A network engineer created a NAT gateway in a public subnet, but its state shows 'failed'. What is the most likely cause?

Accepted Answer

The Elastic IP is already associated with another instance. A NAT gateway requires an Elastic IP address, and if that Elastic IP is already associated with another resource (such as an EC2 instance or another NAT gateway), the NAT gateway creation fails. The 'failed' state specifically indicates the gateway could not be provisioned, most commonly due to EIP association conflicts or insufficient permissions. The EIP must be available and not attached to any other instance or network interface.

Answer

The subnet does not have a route to an internet gateway

Answer

The subnet is private

Answer

The NAT gateway is still being created

Question 2

Which TWO AWS services can be used to centrally manage and monitor network traffic across multiple VPCs and on-premises networks?

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager (option A) is correct because it provides a central dashboard to visualize and monitor your global network, including Transit Gateway attachments, VPCs, and on-premises connections via SD-WAN, giving end-to-end visibility and event monitoring across multiple VPCs and on-premises networks. Amazon CloudWatch (option B) is correct because it collects and tracks metrics, logs, and events from network resources such as Transit Gateway, VPN, and Direct Connect, enabling centralized monitoring and alarms across the entire network topology. AWS WAF (option C) is incorrect because it is a web application firewall that filters HTTP(S) traffic to protect web applications, not a service for centrally managing or monitoring network traffic across VPCs and on-premises networks. AWS Direct Connect (option D) is incorrect because it is a dedicated private network connection service between on-premises and AWS, not a central management or monitoring tool. AWS Shield (option E) is incorrect because it is a managed DDoS protection service, not a network traffic management or monitoring service.

Answer

AWS WAF

Answer

AWS Direct Connect

Answer

AWS Shield

Question 3

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The engineer notices that BGP sessions are flapping. What should the engineer check first?

Accepted Answer

Verify BGP timers and ensure they match on both sides.. The correct option is B: Verify BGP timers and ensure they match on both sides. BGP session flapping is most commonly caused by mismatched keepalive/hold timers or timer expiry, so checking that the keepalive and hold timers are consistent on both the on-premises router and the AWS Direct Connect peer is the right first step. Mismatched timers cause the session to reset repeatedly, producing the intermittent connectivity observed. Option A is not the first check because route propagation affects route availability, not BGP session stability. Option C is a status check but does not directly diagnose flapping, and option D is unrelated since MTU issues cause fragmentation or packet drops, not BGP session resets.

Answer

Configure route propagation in the VPC route tables.

Answer

Check the virtual interface (VIF) status in the AWS console.

Answer

Increase the MTU on the Direct Connect link.

Question 4

A company is experiencing intermittent SSH connection failures to their EC2 instances in a VPC. The instances are in a private subnet with a NAT gateway. The security group allows inbound SSH from the corporate CIDR. The network ACL is set to default allow all. The route table has a route to the NAT gateway for 0.0.0.0/0. What is the most likely cause of the intermittent failures?

Accepted Answer

The NAT gateway does not have an Elastic IP associated.. The NAT gateway requires an associated Elastic IP to function correctly. Without it, the NAT gateway cannot be created or fails to operate, leading to intermittent connectivity issues for instances in the private subnet. Since the instances rely on the NAT gateway for outbound traffic (e.g., to reach configuration endpoints or DNS), any failure in the NAT gateway can disrupt SSH sessions that depend on such outbound communication. Option A is incorrect because the network ACL is set to default allow all, so it does not block ephemeral ports. Option B is incorrect because a proxy is not typically required for SSH connections in this setup. Option C is incorrect because security groups are stateful, meaning outbound rules do not block return traffic from allowed inbound connections.

Answer

The network ACL inbound rule is blocking ephemeral ports.

Answer

The instances are behind a proxy that is not configured.

Answer

The security group outbound rules are not allowing return traffic.

Question 5

A company has a transit gateway with multiple VPC attachments and an on-premises VPN connection. The network team is seeing asymmetric routing and packet drops. What should they implement to resolve this?

Accepted Answer

Use BGP ASN prepending on the on-premises routers.. BGP ASN prepending on the on-premises routers can influence path selection by making certain routes less preferred, helping to resolve asymmetric routing. By prepending the AS path, the on-premises router can make one path appear longer, steering traffic to a symmetric path through the transit gateway.

Answer

Disable equal-cost multipath (ECMP) routing on the Transit Gateway.

Answer

Create VPC peering connections between all VPCs.

Answer

Enable route propagation from the Transit Gateway to VPC route tables.

Question 6

A network engineer is troubleshooting high latency on a VPN connection between an on-premises network and AWS. The VPN uses two tunnels to a virtual private gateway. The engineer notices that traffic is only using one tunnel, and the other tunnel is idle. What should the engineer do to ensure both tunnels are utilized?

Accepted Answer

Create two separate site-to-site VPN connections to two different virtual private gateways and enable ECMP.. AWS Site-to-Site VPN supports Equal-Cost Multipath (ECMP) only when the VPN terminates on a Transit Gateway (or when using multiple VPN connections to the same TGW), not on a Virtual Private Gateway. To utilize both tunnels of a VPN to a VGW, the engineer must create two separate VPN connections to two different VGWs (or use a TGW) and enable ECMP so traffic is load-balanced across both tunnels. This is the documented AWS approach for active-active VPN utilization.

Answer

Configure BGP MED values to prefer the idle tunnel.

Answer

Configure static routes with equal metrics on both tunnels.

Answer

Use a transit gateway with equal cost multipath routing.

Question 7

A financial services company uses AWS Direct Connect to connect its data center to multiple VPCs via a transit gateway. They need to meet PCI DSS compliance requirements by encrypting all traffic between the data center and AWS. What solution meets this requirement with the least operational overhead?

Accepted Answer

Enable MACsec on the Direct Connect connection.. MACsec (IEEE 802.1AE) provides line-rate Layer 2 encryption on supported Direct Connect dedicated connections (10 Gbps and 100 Gbps at select locations), encrypting all traffic between the customer router and the AWS Direct Connect endpoint without any overlay tunnels. It meets PCI DSS encryption-in-transit requirements with the least operational overhead because it is configured once on the connection and requires no per-VPC or per-application changes.

Answer

Use TLS for all application traffic between data center and VPC.

Answer

Use private VIFs without additional encryption.

Answer

Create an IPsec VPN tunnel over the Direct Connect VIF to encrypt traffic.

Question 8

A company uses AWS Direct Connect with a private VIF to connect to their VPC. They want to monitor the network latency between their on-premises router and the AWS Direct Connect location. Which AWS service should they use?

Accepted Answer

AWS Direct Connect metrics in CloudWatch. AWS Direct Connect publishes metrics such as latency (round-trip time) and BGP session state to CloudWatch. These metrics can be used to monitor network latency between on-premises and the Direct Connect location. Option B is incorrect because AWS X-Ray is for tracing application requests, not network infrastructure latency. Option C is incorrect because VPC Flow Logs capture IP traffic metadata (e.g., sources, destinations, ports), not latency. Option D is incorrect because CloudWatch Synthetics monitors endpoint availability and response times via canaries, not Direct Connect link latency.

Answer

AWS X-Ray

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Synthetics

Question 9

A company has a VPC with public and private subnets. The private subnets use a NAT gateway for outbound internet access. The security team notices that some EC2 instances in the private subnets are able to reach the internet, but others are not. All instances have the same security group and are in the same private subnet. What is the most likely cause?

Accepted Answer

The NAT gateway's security group is blocking traffic from some instances.. The most likely cause is that the NAT gateway's security group (attached to its elastic network interface) is blocking traffic from some instances. Although all EC2 instances are in the same private subnet and have the same security group, the NAT gateway's own security group can be configured to allow outbound traffic only from specific source IPs or security groups. If the NAT gateway's security group only permits traffic from certain instances' private IPs (or security groups) within the subnet, it would allow some instances to reach the internet while blocking others. Option A is incorrect because a missing route would affect all instances in that subnet equally. Option B is incorrect because a network ACL applies to the entire subnet and would block all instances. Option D is incorrect because the internet gateway is attached to the VPC, not directly to private subnets, and its absence would prevent all internet access.

Answer

The route table associated with the private subnet is missing a default route to the NAT gateway.

Answer

The network ACL is blocking outbound traffic on ephemeral ports.

Answer

The internet gateway is not attached to the VPC.

Question 10

A company uses AWS Client VPN to provide remote access to its VPC. Users report slow connection speeds. The CloudWatch metrics show high packet loss on the VPN connections. What is the most likely cause?

Accepted Answer

MTU mismatch between the client and the VPN endpoint.. MTU mismatch between the client and the AWS Client VPN endpoint is the most likely cause of high packet loss and slow speeds. When the client's MTU exceeds the path MTU supported by the VPN tunnel (typically 1500 bytes minus overhead), packets get fragmented or dropped, especially with TLS/UDP encapsulation. AWS Client VPN uses a default MTU of 1500, but if the underlying network or client has a smaller MTU, large packets are silently discarded, leading to retransmissions and degraded throughput.

Answer

The client certificate has expired.

Answer

The Client VPN subnet is too small.

Answer

Route propagation is not enabled in the VPC route table.

Question 11

A company has deployed a Network Load Balancer (NLB) in front of a fleet of EC2 instances in a VPC. The NLB is configured with a TCP listener on port 443. Clients are experiencing timeouts. The target group health checks are passing. What is the most likely cause?

Accepted Answer

The security group for the EC2 instances does not allow traffic from the NLB.. Network Load Balancers preserve the client's source IP address when forwarding traffic to targets, so the target EC2 instances see the original client IP — not the NLB's IP. If the EC2 security group only allows traffic from the NLB's subnet or a specific NLB IP, the return traffic or the forwarded packets will be dropped, causing timeouts even though health checks (which originate from the NLB and may be allowed separately) pass. The fix is to allow inbound traffic on port 443 from the client IP range (or 0.0.0.0/0 as appropriate) in the target security group.

Answer

Cross-zone load balancing is disabled.

Answer

Deletion protection is enabled on the NLB.

Answer

The target group is using an incorrect health check path.

Question 12

A company runs a multi-account AWS environment using AWS Organizations. They need to centrally manage VPC flow logs across all accounts and enable analysis for security incidents. The flow logs must be stored in a central S3 bucket in the management account. What is the MOST scalable and cost-effective approach?

Accepted Answer

Configure VPC Flow Logs in each account to deliver to a central S3 bucket using cross-account delivery.. VPC Flow Logs can be configured to publish directly to an S3 bucket in another account, and S3 bucket policies can grant the necessary cross-account delivery permissions, making this the most scalable and cost-effective approach for a multi-account AWS Organizations environment. This avoids intermediate services and per-account processing overhead, and the central S3 bucket in the management account can be queried with services like Amazon Athena for security incident analysis. Option A is not ideal because running a Lambda function in every account adds operational complexity and cost for copying logs. Option B introduces Kinesis Data Firehose in each account, which adds unnecessary streaming infrastructure and cost. Option D uses CloudWatch Logs destinations, which are not the native cross-account target for VPC Flow Logs and would add cost and complexity compared with direct S3 delivery.

Answer

Use a Lambda function in each account to copy flow logs from CloudWatch to a central S3 bucket.

Answer

Deliver flow logs to Kinesis Data Firehose in each account and then to a central S3 bucket.

Answer

Create flow logs in each account and export them to a central CloudWatch Logs destination.

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They want to monitor the number of packets dropped due to route table limits. Which CloudWatch metric should they use?

Accepted Answer

PacketsDroppedByRouteTable. AWS Transit Gateway publishes the CloudWatch metric PacketsDroppedByRouteTable, which specifically counts packets dropped because the transit gateway route table had no matching route or exceeded its route limit. This is the exact metric designed to surface route-table-related drops, making it the correct choice for monitoring drops due to route table limits.

Answer

PacketsIn

Answer

BytesOut

Answer

BytesDroppedByRouteTable

Question 14

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach any resources in the VPC. What is the most likely cause?

Accepted Answer

The Client VPN endpoint does not have a subnet association.. The most likely cause is that the Client VPN endpoint does not have a subnet association. Without an associated subnet, the VPN endpoint has no ENI in the VPC to route traffic into, so clients can establish the TLS tunnel but cannot reach any VPC resources. Associating at least one subnet (in the target VPC) is mandatory for the endpoint to function.

Answer

The authorization rules do not include the client's group.

Answer

The Client VPN endpoint security group does not allow inbound traffic from the client CIDR.

Answer

The client's VPN software is not configured with the correct DNS server.

Question 15

A company uses AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They notice that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What configuration change should be made to ensure optimal routing?

Accepted Answer

Enable route propagation from the VPC attachments into the Transit Gateway route table.. Enabling route propagation from VPC attachments into the Transit Gateway route table ensures that the Transit Gateway learns the VPC CIDRs dynamically. This allows traffic between VPCs to be routed directly through the Transit Gateway without needing to go through on-premises, thus optimizing the path.

Answer

Disable cross-zone load balancing on the Transit Gateway.

Answer

Add static routes to the Transit Gateway route table pointing to the VPN attachment.

Answer

Modify the VPC route tables to add routes to the other VPC via the Transit Gateway.