ANS-C01 Network Management and Operations Practice Test 11 — 15 Questions

Question 1

A company wants to monitor network traffic between two VPCs connected via a Transit Gateway. Which THREE AWS services can be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. Options A, C, and D are correct. VPC Flow Logs capture IP traffic for network interfaces, Transit Gateway Flow Logs capture traffic through the transit gateway, and third-party network monitoring appliances deployed in a VPC can capture and analyze traffic. Option B is incorrect because AWS Config records configuration changes, not traffic. Option E is incorrect because AWS CloudTrail logs API calls, not network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Question 2

A network engineer notices that traffic from an EC2 instance in a public subnet to the internet is not working. The instance has a public IP assigned and is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What should the engineer check next?

Accepted Answer

Verify that the route table for the subnet has a 0.0.0.0/0 route pointing to the internet gateway.. Even if the instance has a public IP, if the subnet's route table does not have a default route (0.0.0.0/0) pointing to the internet gateway, traffic to the internet will fail. This is a common misconfiguration.

Answer

Ensure the network ACL allows outbound traffic.

Answer

Confirm that the internet gateway is attached to the VPC.

Answer

Check if the instance has a public IP assigned.

Question 3

Refer to the exhibit. A network engineer has established a VPC peering connection between VPC A (10.0.0.0/16) in account 111111111111 and VPC B (192.168.0.0/16) in account 222222222222. The peering connection status is 'active'. However, instances in VPC A cannot reach instances in VPC B. What is the MOST likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes to the peer CIDR. The VPC peering connection is active, so A is incorrect. The CIDR blocks (10.0.0.0/16 and 192.168.0.0/16) do not overlap, so D is incorrect. Security groups can block traffic, but the most common cause is missing routes in the route tables of one or both VPCs to the peer CIDR via the peering connection. Therefore, B is correct.

Answer

The peering connection is not in the 'active' state

Answer

Security groups in VPC B are blocking traffic

Answer

The CIDR blocks overlap

Question 4

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company wants to ensure that traffic to the VPC uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the virtual private gateway.. To ensure traffic uses Direct Connect, the route table in the VPC must have a route to the on-premises CIDR via the virtual private gateway (VGW) attached to the Direct Connect. Additionally, on the on-premises side, routes must point to the Direct Connect. The VPC route table should have a more specific route or a default route pointing to the VGW.

Answer

Create a VPC peering connection to the on-premises network.

Answer

Use a NAT gateway in the VPC.

Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the internet gateway.

Question 5

Refer to the exhibit. The IAM policy above is attached to a user in account A (123456789012). The user needs to create a VPC peering connection with account B and accept it. The user in account A can create the peering request, but the accept fails with an 'UnauthorizedOperation' error. What is the MOST likely reason?

Accepted Answer

The user does not have permission to accept the peering connection from the other account. The 'AcceptVpcPeeringConnection' action is allowed on all resources ('*'), but the specific ARN for the peering connection is not granted for the accept action. The second statement allows actions only on peering connections in account A, but the accept action is performed on the requester's side? Actually, the accept is done by the accepter (account B). The user in account A is trying to accept? The scenario says 'the user in account A can create the peering request, but the accept fails'. Actually, the accept is done by account B. So the user in account A cannot accept a peering connection that belongs to account B. The policy allows accept on 'ec2:AcceptVpcPeeringConnection' with resource '*', but the accept action is performed on the resource in the accepter account. The second statement restricts to peering connections in account A. The accept action is not covered by the second statement because it's not in the action list of the second statement. Wait, the first statement allows accept on all resources. So why would it fail? The issue is that the accept action is called on the peering connection resource in the accepter account, which is not in account A. The policy does not have permissions for resources in other accounts. The correct answer is that the user does not have permission to accept the peering connection because the resource ARN in the second statement only covers peering connections in account A. But the first statement allows accept on all resources. However, the 'ec2:AcceptVpcPeeringConnection' action requires permission on the resource of the peering connection in the accepter account. Since the user is in account A, they cannot accept a peering connection that is owned by account B. The most likely reason is that the user lacks permissions to accept the peering connection in the other account. Option C captures this.

Answer

The user does not have permission to create routes in the VPC

Answer

The 'ec2:CreateVpcPeeringConnection' action requires a specific VPC ARN

Answer

The 'ec2:AcceptVpcPeeringConnection' action is not allowed in the policy

Question 6

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that some VPCs cannot communicate with each other even though they are attached to the same transit gateway. What is the most likely cause?

Accepted Answer

The transit gateway route tables are missing routes to the other VPCs.. Transit Gateway uses route tables to control inter-VPC traffic. If the route tables do not have routes to the other VPCs, or if the VPCs are in different route tables that are not associated or propagated correctly, communication fails. The most common issue is that the transit gateway route tables are not properly configured with routes to the other VPC attachments.

Answer

The security groups on the instances are not allowing inbound traffic from the other VPCs.

Answer

The VPC attachments are not in the 'available' state.

Answer

The VPCs' network ACLs are blocking traffic.

Question 7

Refer to the exhibit. A Direct Connect private virtual interface is in the 'available' state, and the BGP session is up. However, the on-premises network cannot reach any resources in the VPC attached to the Direct Connect gateway. What is the MOST likely cause?

Accepted Answer

The Direct Connect gateway is not associated with the virtual private gateway or route propagation is not enabled. Even though the Direct Connect private virtual interface is in the 'available' state and the BGP session is up, the on-premises network cannot reach VPC resources because the Direct Connect gateway is not associated with the virtual private gateway or route propagation is not enabled. This association is necessary for route exchange between the VPC and on-premises network. Option A is incorrect because the BGP ASN being private is allowed; the BGP session is up indicating ASN is valid. Option B is incorrect because the VLAN ID is irrelevant once the virtual interface is available and BGP is up. Option D is incorrect because the BGP session is established.

Answer

The BGP ASN is private and not allowed

Answer

The VLAN ID is incorrect

Answer

The BGP session is not established

Question 8

Which TWO configuration steps are required to enable VPC Flow Logs to be published to an S3 bucket in a different AWS account? (Select TWO.)

Accepted Answer

Attach a resource-based policy to the S3 bucket that grants the source account's Flow Logs service permission to write.. To publish VPC Flow Logs to an S3 bucket in a different AWS account, two steps are required: (1) Attach a resource-based policy to the destination S3 bucket that grants the source account's Flow Logs service permission to write objects. This is option A. (2) Create an IAM role in the source account with a trust policy that allows the Flow Logs service to assume it and grants s3:PutObject permission to the destination bucket. This is option C. Option B is incorrect because CloudWatch Logs in the source account would not enable cross-account delivery to S3. Option D is incorrect because sharing IAM user access keys is not a secure or supported method for cross-account flow logs. Option E is incorrect because S3 cross-account replication does not enable the Flow Logs service to write to the bucket.

Answer

Configure the Flow Logs destination as a CloudWatch Logs log group in the source account.

Answer

Create an IAM user in the source account with programmatic access and share the access keys.

Answer

Enable S3 cross-account replication.

Question 9

A company is designing a highly available Direct Connect connection. Which THREE components should be deployed to meet this requirement? (Select THREE.)

Accepted Answer

Two Direct Connect connections to two different AWS Direct Connect locations.. For high availability, you need at least two Direct Connect connections (preferably to different AWS locations), two customer routers (or one router with two interfaces), and two virtual interfaces (VIFs) to provide redundancy. Using BGP with multiple sessions ensures automatic failover.

Answer

A single BGP session over one of the virtual interfaces.

Answer

A VPN connection as a backup to Direct Connect.

Question 10

A company uses AWS Direct Connect and VPN as backup. The network team notices that during a VPN failover, traffic drops for several minutes. The VPN tunnels are configured with BGP dynamic routing. Which configuration change would MOST likely reduce failover time?

Accepted Answer

Enable BFD on the VPN BGP sessions. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions, significantly reducing failover time. Option A is wrong because static routes do not dynamically adapt to failures and would require manual intervention. Option B is wrong because increasing the BGP keepalive interval (making it longer) and decreasing the hold timer (making it shorter) would actually slow down failure detection or cause flapping; the opposite would be needed. Option D is wrong because decreasing the keepalive interval and increasing the hold timer would also not be as fast as BFD; BFD is the optimal solution for fast failover.

Answer

Configure static routes over the VPN instead of BGP

Answer

Increase the BGP keepalive interval and decrease the hold timer

Answer

Decrease the BGP keepalive interval and increase the hold timer

Question 11

Which TWO actions should a network engineer take to troubleshoot a BGP session that is not establishing between an on-premises router and AWS Direct Connect? (Select TWO.)

Accepted Answer

Verify that the BGP ASN configured on the customer router matches the one provided by AWS.. Common BGP issues include incorrect BGP ASN, incorrect peer IP addresses, missing authentication, and firewall rules blocking TCP port 179. Verifying these settings on both sides is key.

Answer

Increase the MTU on the customer router interface.

Answer

Ensure that the virtual interface is in the 'available' state.

Answer

Check that the Direct Connect connection is in the 'available' state.

Question 12

A network engineer needs to monitor network traffic to an Amazon RDS instance for security analysis. Which AWS service should be used to capture and analyze network traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring allows capturing and inspecting network traffic from an RDS instance (full packet capture). Option A is wrong because Amazon Inspector is for vulnerability assessment, not network traffic capture. Option B is wrong because VPC Flow Logs provide metadata (IP, port, etc.) about traffic, not full packet capture. Option D is wrong because AWS CloudTrail records API activity, not network traffic.

Answer

Amazon Inspector

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 13

An engineer is trying to create a VPC Flow Log that delivers to a CloudWatch Logs log group in the same account. The IAM role used has the above trust policy. However, the flow log creation fails with an error. What is the most likely reason?

Accepted Answer

The IAM role lacks a permissions policy that grants the actions on the log group.. The trust policy shown trusts the VPC Flow Logs service principal, but the IAM role itself must have a permissions policy that allows the actions on the log group. The exhibit only shows the trust policy; the permissions policy is missing. The error likely indicates that the role does not have the necessary permissions to perform the actions.

Answer

The log group does not exist yet.

Answer

The trust policy incorrectly specifies the service principal; it should be 'ec2.amazonaws.com'.

Answer

The resource ARN in the trust policy does not include the log group name.

Question 14

A company has a hybrid network with multiple AWS Direct Connect connections to different VPCs. The on-premises network uses BGP to advertise prefixes to AWS. The network team notices that some on-premises prefixes are not being received by the VPCs. What is the MOST likely cause?

Accepted Answer

The on-premises router is advertising more than 100 prefixes over the BGP session. AWS Direct Connect virtual interfaces have a default limit of 100 allowed prefixes. If the on-premises router advertises more than 100 prefixes, BGP will reject the excess routes, causing some prefixes not to be received. Option B is incorrect because BGP communities are optional tags and not required for prefix advertisement. Option C is incorrect because AS_PATH prepending influences route preference but does not prevent advertisement. Option D is incorrect because the MED attribute affects path selection, not the ability to advertise prefixes.

Answer

The on-premises router is not using BGP communities

Answer

The on-premises router is using AS_PATH prepending

Answer

The on-premises router is not setting the MED attribute

Question 15

An EC2 instance with the attached network interface shown above is unable to reach the internet. The instance is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What is the most likely cause?

Accepted Answer

The network interface's attachment status is 'attached', but the instance may not have a public IP address.. The instance is in a public subnet with a route to an internet gateway, and the security group allows outbound traffic. However, for an instance in a public subnet to reach the internet directly, it must have a public IP address (either assigned automatically or as an Elastic IP). Without a public IP, the internet gateway cannot translate the instance's private IP to a public one, so outbound traffic fails. The route table is correct (contains 0.0.0.0/0 pointing to the internet gateway), source/destination check enabled is normal and does not block internet access, and the security group is associated and allows outbound traffic. Therefore, the most likely cause is the lack of a public IP address.

Answer

The source/destination check is enabled, which prevents the instance from sending traffic to the internet if it is not the source of the traffic.

Answer

The route table for the subnet does not have a 0.0.0.0/0 route pointing to the internet gateway.

Answer

The security group is not associated with the network interface.