ANS-C01 Network Management and Operations Practice Test 11 — 15 Questions

Question 1

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The Direct Connect Gateway is associated with a Transit Gateway. The on-premises network advertises a prefix via BGP, but the prefix does not appear in the Transit Gateway route table. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The prefix is not included in the allowed prefixes list for the Direct Connect Gateway.. When a private VIF is attached to a Direct Connect Gateway that is associated with a Transit Gateway, AWS requires the on-premises prefixes to be explicitly listed in the Direct Connect Gateway's allowed prefixes list before they are propagated into the Transit Gateway route table. If the prefix is not in that list, BGP will still form the adjacency, but the route will be filtered and never appear in the TGW route table. This is the most likely cause of the missing prefix.

Answer

Route propagation is not enabled on the Transit Gateway route table.

Answer

The on-premises router is not sending the BGP community attribute.

Answer

The Transit Gateway is not associated with the Direct Connect Gateway.

Question 2

A company is using AWS Direct Connect with a private VIF. They want to monitor the BGP session status and receive alerts if the session goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it can monitor the BGP session status of a Direct Connect private VIF by publishing metrics such as 'bgp_session_state' (0=down, 1=up) and 'connection_state' to CloudWatch. You can then create a CloudWatch alarm that triggers an alert (e.g., via SNS) when the BGP session state transitions to 0, providing real-time notification of a session failure.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

Which TWO are valid methods to monitor and troubleshoot AWS Direct Connect connections?

Accepted Answer

Enable Direct Connect Connection and Virtual Interface metrics in CloudWatch.. Option C is correct because AWS Direct Connect publishes Connection and Virtual Interface metrics to Amazon CloudWatch, allowing you to monitor utilization, bit rate, packet rate, and error counters for troubleshooting. Option D is correct because AWS Direct Connect provides built-in connection tests (via the console, CLI, or API) that verify connectivity and measure performance such as latency and packet loss on a virtual interface. Option A is incorrect because CloudFront is a content delivery network and does not monitor Direct Connect utilization. Option B is incorrect because CloudTrail logs API activity for auditing, not connection health or performance monitoring. Option E is incorrect because VPC Flow Logs capture IP traffic metadata at the ENI/subnet/VPC level and cannot be enabled directly on a Direct Connect virtual interface.

Answer

Use CloudFront to monitor Direct Connect utilization.

Answer

Enable AWS CloudTrail to log Direct Connect API calls.

Answer

Enable VPC Flow Logs on the VIF.

Question 4

A network engineer is troubleshooting a slow connection between an EC2 instance and an RDS database in the same VPC. The engineer wants to analyze network performance metrics. Which TWO metrics should the engineer examine? (Choose two.)

Accepted Answer

Round-trip time between the EC2 instance and RDS. Option C (Round-trip time between the EC2 instance and RDS) is correct because RTT directly measures the latency of the network path between the two endpoints, which is the primary indicator of a slow connection; tools like VPC Flow Logs, CloudWatch Network Monitor, or ping/traceroute can reveal this. Option E (Network packets dropped by the RDS instance's network interface) is correct because packet loss on the RDS ENI forces TCP retransmissions, which degrades throughput and increases perceived latency, so examining dropped packets on the interface is essential for diagnosing a slow connection. Option A (Database connections count) reflects application-level session load, not network performance, so it does not explain a slow link. Option B (Disk queue depth) is a storage-layer metric that affects query I/O, not the network path between EC2 and RDS. Option D (RDS instance CPU utilization) indicates compute pressure on the database host, which is unrelated to network performance between the two resources.

Answer

Database connections count

Answer

Disk queue depth

Answer

RDS instance CPU utilization

Question 5

A company is designing a multi-region architecture with VPCs connected via VPC peering. They need to ensure high availability and low latency. Which THREE design principles should they follow? (Choose three.)

Accepted Answer

Deploy redundant VPN connections to each region. Option B is correct because deploying redundant VPN connections to each region provides resilient, highly available hybrid connectivity so that a single tunnel or device failure does not isolate a region. Option D is correct because AWS Direct Connect offers dedicated, private, low-latency, high-bandwidth connectivity between on-premises networks and AWS regions, which directly supports the low-latency requirement. Option E is correct because a transit gateway acts as a regional hub that simplifies and scales inter-region peering, avoiding the complexity and full-mesh limits of many individual VPC peering connections. Option A is not required here because VPC endpoints only provide private access to specific AWS services and do not address inter-region VPC connectivity or hybrid low-latency links. Option C is incorrect because a single NAT gateway is a single point of failure and does not provide high availability; NAT gateways should be deployed per Availability Zone.

Answer

Use VPC endpoints for all AWS service access

Answer

Use a single NAT gateway for all outbound traffic

Question 6

Which TWO are requirements for using AWS Client VPN to provide secure remote access?

Accepted Answer

The Client VPN endpoint must be in a subnet with a route to the internet.. Option B is correct because the Client VPN endpoint is created in a VPC subnet, and for clients to reach the internet or remote networks through the VPN, that subnet must have a route (e.g., via an internet gateway or NAT) to the destination; without an appropriate route, traffic cannot be forwarded. Option D is correct because the client CIDR range assigned to VPN clients must be a unique range that does not overlap with the VPC CIDR or any on-premises networks reachable over the VPN, otherwise routing conflicts and connectivity failures occur. Option A is not required: security groups are associated with the subnet/VPC resources and the Client VPN endpoint uses its own authorization rules and target network associations, not a mandatory security group on the endpoint itself. Option C is incorrect because the client CIDR must not be inside the VPC CIDR; it must be a separate, non-overlapping range. Option E is incorrect because AWS Client VPN supports certificate-based authentication for both server and client, and it can also use other authentication methods such as Active Directory or SAML, so certificate-based server authentication alone is not a requirement.

Answer

A security group must be associated with the Client VPN endpoint.

Answer

The client CIDR range must be within the VPC CIDR.

Answer

The Client VPN endpoint must use certificate-based server authentication only.

Question 7

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. They notice that traffic between VPCs is being dropped intermittently. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Monitor the Transit Gateway's CloudWatch metrics for packets dropped due to route table limits. Option A is correct because AWS Transit Gateway publishes CloudWatch metrics such as PacketDropCountBlackhole and PacketDropCountNoRoute, which directly reveal whether traffic is being dropped due to missing or blackhole routes in the TGW route tables — the most common cause of intermittent inter-VPC drops. Option C is correct because enabling VPC Flow Logs on the attached VPCs captures accepted and rejected traffic at the ENI level, letting the engineer confirm whether packets leave the source VPC, reach the destination VPC, and whether security groups or NACLs are silently dropping them. Option B is incorrect because security groups are not associated with Transit Gateway attachments; TGW does not evaluate security group rules, so there is nothing to review there. Option D is incorrect because overlapping VPC CIDRs would cause a persistent routing conflict, not intermittent drops, and TGW would not even allow the overlapping routes to be advertised cleanly. Option E is incorrect because creating a backup VPN connection does not diagnose the existing intermittent drop issue and would only add another path without identifying the root cause.

Answer

Review the security group rules on the Transit Gateway

Answer

Check if the VPC CIDRs are overlapping

Answer

Create a VPN connection for backup

Question 8

A company has deployed a multi-VPC architecture with AWS Transit Gateway. The network team notices that traffic between two VPCs is intermittently dropped. Both VPCs are attached to the same transit gateway. Which action should the network engineer take to troubleshoot the issue?

Accepted Answer

Enable VPC Flow Logs on the subnets of the VPCs.. VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, accept/reject) for ENIs in the subnets, which is the most direct way to determine whether traffic between the two VPCs is being dropped and by what. Since both VPCs are attached to the same TGW, flow logs on the subnets will show whether packets are reaching the destination and whether security groups or NACLs are rejecting them.

Answer

Configure AWS Direct Connect to route traffic between the VPCs.

Answer

Use Transit Gateway Network Manager to view the network topology.

Answer

Enable CloudWatch metrics for the transit gateway attachments.

Question 9

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The template includes an Internet Gateway and a NAT Gateway. After deployment, instances in the private subnet cannot access the internet. The network engineer checks the route tables and finds that the private subnet route table has a default route pointing to the NAT Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway is deployed in the private subnet instead of the public subnet.. A NAT Gateway must reside in a public subnet and have an Elastic IP so it can route traffic to the Internet Gateway. If the NAT Gateway is placed in a private subnet, it has no path to the IGW, so instances in other private subnets that route 0.0.0.0/0 to it cannot reach the internet — even though their route table is correctly configured.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Answer

The private subnet route table does not have a default route (0.0.0.0/0) to the NAT Gateway.

Answer

The NAT Gateway is in a private subnet and has no route to the internet gateway.

Question 10

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to its VPC. The on-premises network team reports that they can ping the private IP address of an EC2 instance in the VPC, but cannot establish a TCP connection to a web server running on that instance. The network security group allows inbound TCP port 80 from the on-premises CIDR. What should the network engineer check next?

Accepted Answer

Check the operating system firewall and web server configuration on the EC2 instance.. Since ping (ICMP) works but TCP port 80 fails, the issue is likely not network-level (routing, security groups, NACLs) but rather at the instance level. Checking the operating system firewall and web server configuration (B) is the next logical step to ensure the web server is running and the OS firewall allows inbound TCP 80. The security group already allows the traffic, so the problem is likely within the instance.

Answer

Review the network ACL associated with the subnet to ensure it allows inbound TCP 80.

Answer

Check the BGP session status on the Direct Connect virtual interface.

Answer

Verify the route table on the VPC has a route back to the on-premises network.

Question 11

A company has set up a Site-to-Site VPN connection between its on-premises network and AWS. The VPN tunnel shows as 'UP' but traffic is not flowing. What should the engineer check?

Accepted Answer

Verify that route propagation is enabled on the VPC route table. Route propagation from the virtual private gateway to the VPC route table must be enabled. Option A is wrong because the tunnel state is up, so security group is not likely the issue (security group affects instances, not VPN endpoint). Option B is wrong because the internet gateway is for public internet access, not VPN. Option C is wrong because the customer gateway is the on-premises endpoint; it is configured but if routes are not propagated, traffic won't flow.

Answer

Ensure the customer gateway is configured correctly

Answer

Verify the security group rules for the VPN connection

Answer

Check the internet gateway route table

Question 12

A company is experiencing high latency for traffic between EC2 instances in the same VPC but in different Availability Zones. The network team suspects the issue is related to the placement group used. The instances are in a spread placement group. What should the network engineer do to reduce latency?

Accepted Answer

Change the placement group to a cluster placement group and ensure instances are in the same Availability Zone.. A cluster placement group is designed for low-latency, high-throughput traffic by ensuring instances are in close proximity. Option B is incorrect because enabling enhanced networking and increasing instance size can improve throughput but does not directly reduce latency caused by inter-AZ distance. Option C is incorrect because moving instances to the same AZ helps, but a spread placement group still places instances on different racks, which introduces additional latency compared to a cluster placement group. Option D is incorrect because VPC peering is used for connectivity between different VPCs; for intra-VPC traffic, adding a VPC peering connection does not reduce latency and may even add complexity.

Answer

Enable enhanced networking on the instances and increase the instance size.

Answer

Move the instances to the same subnet within the same Availability Zone but keep the spread placement group.

Answer

Create a VPC peering connection between the two AZs and route traffic through it.

Question 13

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.. The VGW responds to pings because it is the VPN termination point and is reachable over the tunnel, but EC2 instances are unreachable because the VPC route tables lack a route directing on-premises CIDR traffic to the virtual private gateway. Without that route, return traffic from EC2 instances has no path back to the on-premises network, even though the tunnel is UP.

Answer

The VPN tunnel is not properly configured with the correct pre-shared key.

Answer

The security groups on the EC2 instances are blocking inbound traffic from the on-premises network.

Answer

The virtual private gateway has its own security group that blocks traffic.

Question 14

A company is designing a highly available network architecture using AWS Direct Connect. Which TWO actions should be taken to ensure redundancy?

Accepted Answer

Provision two Direct Connect connections at different locations. Option C is correct because provisioning two Direct Connect connections at physically separate Direct Connect locations provides true path diversity, so a failure at one location or in one provider facility does not take down all connectivity. Option E is correct because configuring BGP with different ASNs on each connection ensures each Direct Connect link is treated as an independent routing path, allowing failover and load sharing rather than having one connection silently back up the other with identical routing attributes. Options A and D are incorrect because a single Direct Connect connection, even with multiple private VIFs, still represents a single point of failure at the connection and facility level. Option B is not the best answer here because a VPN over the internet is a lower-priority backup path, not a redundant Direct Connect design, and the question specifically asks for Direct Connect redundancy.

Answer

Create a single private VIF on the Direct Connect connection

Answer

Set up a VPN connection over the internet as a backup

Answer

Use a single Direct Connect connection with multiple VIFs

Question 15

A company manages multiple VPCs connected via a transit gateway. Each VPC has a VPN connection to an on-premises data center. The network team wants to monitor the bandwidth utilization on each VPN connection. Which approach is the most efficient?

Accepted Answer

Use Amazon CloudWatch metrics for the VPN tunnels.. AWS VPN connections publish CloudWatch metrics for each tunnel, including TunnelDataIn and TunnelDataOut, which can be used to monitor bandwidth utilization. These metrics are available per VPN connection and can be graphed in CloudWatch. This is the most efficient approach because it requires no additional logging or configuration beyond what is already enabled by default. Therefore, option A is correct.

Answer

Enable VPC Flow Logs on each VPC and aggregate them in CloudWatch Logs Insights.

Answer

Use Transit Gateway Network Manager to view VPN bandwidth.

Answer

Use AWS Config rules to monitor VPN bandwidth changes.