ANS-C01 Network Management and Operations Practice Test 10 — 15 Questions

Question 1

A network engineer needs to verify the routing path between two EC2 instances in different subnets within the same VPC. Which AWS tool can provide this information?

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer can test connectivity and provide the routing path between two resources in the same VPC. Option A is incorrect because Amazon CloudWatch Logs is used for collecting log data, not for analyzing network paths. Option C is incorrect because AWS Config tracks configuration changes and compliance, not real-time path analysis. Option D is incorrect because running traceroute is not an AWS tool; it is a manual command-line utility that requires access to the instances and does not provide a holistic view of the VPC routing path.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Run traceroute from one instance to the other

Question 2

A company is using AWS Transit Gateway with multiple VPC attachments. They need to ensure that traffic between two specific VPCs is encrypted in transit. The VPCs are in the same AWS region. What is the SIMPLEST solution?

Accepted Answer

Create a VPN attachment on the Transit Gateway and route traffic through it. Creating a VPN attachment on the Transit Gateway and routing traffic through it provides encryption in transit between VPCs. The VPN attachment establishes an IPsec VPN tunnel over the AWS network, ensuring encryption. Option A is incorrect because Transit Gateway route tables do not provide encryption. Option B is incorrect because AWS PrivateLink is designed for accessing services, not for VPC-to-VPC encryption. Option D is incorrect because VPC peering does not encrypt traffic by default and is not the simplest solution.

Answer

Enable encryption on the Transit Gateway route tables

Answer

Use AWS PrivateLink to connect the VPCs

Answer

Use VPC peering instead of Transit Gateway and enable encryption

Question 3

A network engineer created an IAM policy for a user to manage VPC Flow Logs. The user reports they cannot create flow logs and receive an 'AccessDenied' error. What is the MOST likely reason?

Accepted Answer

The logs:CreateLogGroup resource ARN is too restrictive.. The logs:CreateLogGroup action is required to create a log group for VPC Flow Logs. If the IAM policy grants this action but restricts the resource ARN to a specific log group name (e.g., arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*), the user will get an AccessDenied error when trying to create a flow log that would create a log group with a different name. Options A, C, and D are less likely because the policy may include those actions but the resource restriction on logs:CreateLogGroup is the most common cause.

Answer

The ec2:CreateFlowLogs action is missing.

Answer

The logs:PutLogEvents action is missing.

Answer

The iam:PassRole action is missing for the flow logs role.

Question 4

A company has a VPC with multiple subnets across Availability Zones. An application load balancer (ALB) is deployed in public subnets. The network team notices that traffic from the ALB to targets in private subnets is intermittently failing. The targets are healthy. What is the MOST likely cause?

Accepted Answer

The target security group does not allow traffic from the ALB's security group.. The ALB communicates with targets using its private IP addresses. For traffic to reach the targets, the target security group must allow inbound traffic from the ALB's security group. If this rule is missing, traffic from the ALB will be dropped by the target security group, even though the targets are healthy. Option A is incorrect because the ALB is already deployed in public subnets, so it is associated with a public subnet. Option C is incorrect because network ACLs are stateless and only affect traffic crossing subnet boundaries; if the NACL blocked outbound traffic from targets, there would be issues with response traffic, but the question states traffic from ALB to targets is failing, so the issue is likely inbound to targets. Option D is incorrect because cross-zone load balancing is enabled by default and would not cause intermittent failures; it only affects distribution of traffic across zones.

Answer

The ALB is not associated with a public subnet.

Answer

The network ACL for the target subnets blocks outbound traffic.

Answer

Cross-zone load balancing is disabled.

Question 5

A financial company has a multi-account AWS environment using AWS Organizations. They have deployed a centralized inspection VPC with a third-party firewall appliance. All VPCs are attached to a Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by the firewall. The firewall is deployed in an Auto Scaling group behind a Network Load Balancer (NLB). What is the BEST way to route traffic to the firewall?

Accepted Answer

Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.. The best approach. By creating a Transit Gateway attachment in the inspection VPC and configuring the Network Load Balancer (NLB) as the target, all inter-VPC traffic can be routed through the firewall via Transit Gateway route tables. This ensures centralized inspection without introducing complexity. Option A is incorrect because a Gateway Load Balancer (GWLB) is not needed here; the NLB already provides load balancing for the firewall instances. Option B is incorrect because VPC peering bypasses the Transit Gateway, defeating centralized inspection. Option C is incorrect because deploying a firewall in each VPC is not centralized and increases management overhead.

Answer

Use a Gateway Load Balancer (GWLB) endpoint in each VPC to route traffic to the firewall.

Answer

Use VPC peering between each VPC and the inspection VPC.

Answer

Deploy a firewall appliance in each VPC and route traffic locally.

Question 6

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection in real time. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch. CloudWatch provides metrics for Direct Connect connections including bandwidth utilization. Option A is incorrect because CloudTrail logs API calls. Option B is incorrect because VPC Flow Logs capture traffic per interface, not aggregate bandwidth. Option C is incorrect because AWS Config records configuration changes.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 7

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. The two connections will terminate on different AWS Direct Connect locations. Which configuration will provide the HIGHEST availability?

Accepted Answer

Use different customer gateway devices and different Direct Connect locations. Using different customer gateway devices and different Direct Connect locations provides full physical diversity, eliminating single points of failure at both the device and location level. Option A introduces a single point of failure by using the same device. Option B uses the same location, reducing availability in case of location failure. Option C uses the same BGP ASN, which can cause routing issues but is not the primary concern for physical redundancy.

Answer

Use the same customer gateway device for both connections

Answer

Use the same Direct Connect location for both connections

Answer

Use the same BGP ASN for both connections

Question 8

A company's VPC includes a public subnet with a NAT gateway and a private subnet with EC2 instances. The EC2 instances in the private subnet need to access the internet for software updates. The NAT gateway's Elastic IP is associated correctly, and the route tables are configured. However, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table for the private subnet is missing a default route pointing to the NAT gateway.. The most common issue is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from the private subnet cannot be directed to the NAT gateway, and thus cannot reach the internet.

Answer

The NAT gateway is in the private subnet.

Answer

The network ACL for the private subnet is blocking outbound traffic.

Answer

The security group for the EC2 instances does not allow outbound traffic.

Question 9

A network engineer is troubleshooting intermittent connectivity issues between two VPCs that are peered. The VPC peering connection is in the 'active' state. ICMP ping from an instance in VPC A to an instance in VPC B fails intermittently. What is the most likely cause?

Accepted Answer

The route tables in one or both VPCs lack routes to the peer VPC's CIDR via the peering connection.. Since the VPC peering connection is active, the issue is likely that the route tables in one or both VPCs are not correctly configured to route traffic to the peered VPC's CIDR via the peering connection. Without proper routes, traffic is dropped.

Answer

The network ACLs are blocking ICMP traffic.

Answer

The security groups on the instances do not allow inbound ICMP.

Answer

The VPC peering connection is not in the 'active' state.

Question 10

A company has a VPC with public and private subnets. The private subnets need internet access for software updates. The company wants to minimize costs and management overhead. Which solution should they use?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the private subnet route table pointing to the NAT gateway. A NAT gateway deployed in a public subnet allows instances in private subnets to initiate outbound traffic to the internet for software updates while preventing inbound internet traffic, and it is a fully managed service requiring minimal overhead. Option A (VPC endpoints) only provides access to specific AWS services like S3 and CloudFront, not general internet. Option B (attaching an IGW and adding a default route to private subnets) would make the private subnets effectively public, allowing unsolicited inbound connections and violating security best practices. Option D (NAT instance) requires manual configuration, patching, and scaling, increasing management overhead compared to a NAT gateway.

Answer

Use a VPC endpoint for S3 and CloudFront

Answer

Attach an internet gateway to the VPC and add a default route to the private subnet route table pointing to the internet gateway

Answer

Launch a NAT instance on an EC2 instance in a public subnet

Question 11

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that the BGP session for the public VIF is flapping intermittently. Which configuration change on the customer router would most likely stabilize the BGP session?

Accepted Answer

Configure BGP route filtering to limit the number of routes advertised to AWS to no more than 100.. BGP flapping due to route advertisements exceeding the maximum allowed is a known issue. The maximum number of routes allowed on a public VIF is 100. Advertising more than this will cause the session to flap. Limiting routes to 100 will stabilize.

Answer

Set the BGP multi-hop TTL to 255.

Answer

Increase the BGP hold timer to 180 seconds.

Answer

Disable BGP fast-external-fallover on the customer router.

Question 12

A company has a Direct Connect connection with a public VIF to access AWS public services. They notice that traffic to Amazon S3 is taking a suboptimal path via the internet instead of the Direct Connect. What is the MOST likely cause?

Accepted Answer

The on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect. The most likely cause is that the on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect interface. Even though the public VIF is established and BGP is advertising the appropriate prefixes, the on-premises router must have a specific route directing S3 traffic to the Direct Connect. Without this route, traffic will take the default path via the internet. Option A is incorrect because BGP for public VIFs does advertise prefixes, including S3. Option B is incorrect because a 'DOWN' state would prevent all traffic, not just suboptimal routing. Option D is incorrect because a virtual private gateway is not used with a public VIF.

Answer

The BGP session for the public VIF is not advertising the S3 prefixes

Answer

The public VIF is in a 'DOWN' state

Answer

The virtual private gateway is not attached to the VPC

Question 13

A network engineer is troubleshooting high latency on a Direct Connect connection. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Run a continuous 'mtr' from on-premises to an AWS resource. Running a continuous 'mtr' from on-premises to an AWS resource (C) can identify latency and packet loss along each hop, including the Direct Connect connection. Reviewing CloudWatch metrics for the Direct Connect virtual interface (D) provides latency, packet loss, and throughput statistics. Option A is incorrect because BGP session status only indicates whether the routing session is established, not the latency. Option B is incorrect because VPC Flow Logs show traffic metadata, not latency. Option E is incorrect because traceroute may be blocked by ICMP filtering and is less reliable than 'mtr' for measuring latency over Direct Connect.

Answer

Check the BGP session status

Answer

Enable VPC Flow Logs on the VPC

Answer

Run a traceroute from on-premises to an AWS IP address

Question 14

A company is designing a multi-region network with Direct Connect. They have two Direct Connect connections in each region. They want to achieve the HIGHEST availability and lowest latency for cross-region traffic. Which THREE design elements should they include?

Accepted Answer

Configure BGP ASN prepending to influence path selection. Options A, B, and C are correct. Using different Direct Connect providers in each region avoids a single point of failure and enhances availability. Using different Direct Connect locations within each region provides physical diversity, further increasing resilience. ASN prepending allows you to influence BGP path selection, enabling you to choose lower-latency paths for cross-region traffic. Option D is incorrect because multiple virtual interfaces per connection are not necessary for the highest availability; they would still share the same underlying physical connection. Option E is incorrect because using the same BGP ASN for all connections can cause routing issues and does not improve availability or latency.

Answer

Use multiple virtual interfaces per Direct Connect connection

Answer

Use the same BGP ASN for all Direct Connect connections

Question 15

A company is using AWS Client VPN to provide remote access to employees. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a subnet, and authorization rules are configured. What is the most likely cause?

Accepted Answer

The Client VPN endpoint's security group does not allow inbound traffic from the client IP pool.. The most likely cause is that the Client VPN endpoint's security group does not allow inbound traffic from the client IP pool. Since users can connect to the VPN, the subnet association and authorization rules are correctly configured. However, the security group attached to the VPN endpoint acts as a virtual firewall for inbound and outbound traffic. If it does not permit inbound traffic from the client IP range, resources in the VPC will not be reachable. The network ACLs are stateless and default to allowing outbound traffic, so they are less likely to be the issue.

Answer

The VPC's network ACLs are blocking traffic.

Answer

The authorization rules are not associated with the correct groups.

Answer

The subnet association is missing.