ANS-C01 Network Management and Operations Practice Test 12 — 15 Questions

Question 1

A company wants to monitor network traffic in its VPC for security analysis. Which TWO AWS services can be used to capture and analyze network traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling detailed analysis of network traffic. Amazon Inspector is a vulnerability assessment service that analyzes configurations, not network traffic. AWS Config monitors resource configurations, AWS CloudTrail records API activity, and AWS Shield provides DDoS protection. Therefore, only option D is correct for capturing and analyzing network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Shield

Question 2

A company has a hub-and-spoke network architecture using AWS Transit Gateway. The hub VPC contains a central inspection appliance (NVA) for traffic inspection. Spoke VPCs are attached to the Transit Gateway and have routes pointing to the Transit Gateway for all traffic. The Transit Gateway has a default route table that routes traffic to the NVA for inspection. Recently, the network team noticed that traffic between two spoke VPCs is not being inspected. The team verified that the Transit Gateway route tables are correctly configured and that the NVA is healthy. What should the team do to ensure that inter-spoke traffic is inspected?

Accepted Answer

Configure route propagation in the Transit Gateway route tables to propagate routes from the spoke attachments. For inter-spoke traffic to be inspected, the spoke attachments must propagate their routes into the Transit Gateway route table that the NVA uses, so the NVA's route table knows how to return traffic to each spoke. Without route propagation from the spoke attachments, the TGW route table only has the default route to the NVA and cannot route return traffic back to the originating spoke, causing asymmetric routing or dropped packets. Enabling propagation on the spoke attachments fixes the return path.

Answer

Enable VPC Flow Logs on the spoke VPCs to capture traffic

Answer

Add static routes in the spoke VPC route tables pointing to the NVA

Answer

Increase the bandwidth of the Transit Gateway attachments

Question 3

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. The network engineer needs to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which THREE steps are necessary to achieve this?

Accepted Answer

Add a route in the subnet route table for ::/0 to an egress-only internet gateway.. Option D is correct because the VPC must first be assigned an IPv6 CIDR block (either an Amazon-provided block or a BYOIP block) before any IPv6 addressing can exist in the VPC. Option E is correct because, after the VPC has an IPv6 CIDR, each subnet must be assigned a /64 IPv6 CIDR block and the subnet setting to auto-assign IPv6 addresses must be enabled so that EC2 instances launched in the subnet receive IPv6 addresses. Option B is correct because IPv6 traffic destined for the internet (::/0) requires a route in the subnet's route table, and for instances that should initiate outbound IPv6 traffic without being reachable inbound, that route should point to an egress-only internet gateway. Option A is not among the marked correct answers, so it is not required by this question's answer key even though security groups would typically need IPv6 rules in a real deployment. Option C is incorrect because NAT64 is used to let IPv6-only clients reach IPv4-only destinations, which is not required to give EC2 instances native IPv6 communication in a dual-stack VPC.

Answer

Update security group rules to allow IPv6 traffic.

Answer

Configure a NAT64 gateway for IPv6 to IPv4 translation.

Question 4

A company uses AWS Direct Connect to connect its data center to a VPC. The VIF is up, and the BGP session is established. However, the on-premises router cannot ping the VPC's private IP addresses. Which configuration is most likely missing?

Accepted Answer

The VPC route table does not have a route pointing to the Virtual Private Gateway for the on-premises CIDR.. For traffic to flow from on-premises to a VPC over Direct Connect, the VPC route table must contain a route for the on-premises CIDR pointing to the Virtual Private Gateway (VGW). Without this route, the VPC has no path back to the on-premises network, so return traffic is dropped and pings fail. The BGP session being up only confirms Layer 3 reachability for route exchange — it does not automatically install routes into VPC route tables.

Answer

The Direct Connect virtual interface is in the wrong VLAN.

Answer

The BGP password is incorrect.

Answer

The on-premises router is not advertising the VPC CIDR via BGP.

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team needs to monitor the BGP session status for each VPN attachment. Which TWO services can be used to monitor BGP status and receive alerts if a session goes down?

Accepted Answer

Amazon CloudWatch Alarms on the BGP status metric.. Option A is correct because AWS publishes VPN BGP session status as a CloudWatch metric (TunnelState/BGP peer state) for each VPN tunnel, so a CloudWatch alarm can be created on that metric to trigger notifications (e.g., via SNS) when the BGP session goes down. Option E is correct because CloudWatch metrics for VPN tunnels are the underlying data source that exposes tunnel and BGP session state for each VPN attachment, allowing the network team to monitor status and alert on changes. AWS Config rules (B) evaluate resource configuration compliance, not real-time BGP session state, so they cannot alert on a session going down. VPC Flow Logs (C) capture IP traffic metadata for ENIs and do not report BGP routing or session status. CloudTrail (D) records API activity and management events, not the operational state of BGP sessions, so it is not suitable for this monitoring requirement.

Answer

AWS Config rules.

Answer

VPC Flow Logs.

Answer

AWS CloudTrail logs.

Question 6

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway, and the private subnet has EC2 instances that need internet access. The private instances can reach the internet, but cannot access an S3 bucket in the same region using the S3 gateway endpoint. What is the most likely cause?

Accepted Answer

The private subnet's route table does not have a route to the S3 gateway endpoint.. The private subnet's route table must have a route to the S3 gateway endpoint (prefix list) for instances to use the endpoint. Without that route, traffic to S3 will attempt to go through the NAT Gateway, but the gateway endpoint is not used, and if the bucket policy or endpoint policy restricts access, it may fail. The most likely cause is the missing route.

Answer

The S3 gateway endpoint is not in the same VPC.

Answer

The S3 bucket policy does not allow access from the VPC.

Answer

The NAT Gateway is in a different availability zone than the private instances.

Question 7

A company has a hybrid network architecture with an AWS VPC (10.0.0.0/16) connected to an on-premises data center via AWS Direct Connect with a private VIF. The on-premises network uses 10.1.0.0/16. The VPC has subnets in two Availability Zones, each with a private subnet (10.0.1.0/24 and 10.0.2.0/24) and a public subnet. The company recently deployed a new application in the VPC that uses an Application Load Balancer (ALB) in the public subnets. The ALB targets EC2 instances in the private subnets. Users on-premises report that they cannot access the application using the ALB's DNS name. The on-premises network team confirms that they can ping the ALB's private IP address from on-premises. The VPC route tables have routes for the on-premises network pointing to the virtual private gateway (VGW). The security groups and network ACLs are configured to allow traffic from on-premises. What is the most likely cause of the issue?

Accepted Answer

The on-premises DNS resolver does not resolve the ALB's DNS name to a private IP address, causing traffic to go over the internet.. The correct answer is D: the on-premises DNS resolver does not resolve the ALB's DNS name to a private IP address, causing traffic to go over the internet. ALB DNS names resolve to public IP addresses by default, and since on-premises clients can ping the ALB's private IP but cannot reach it by DNS name, their resolver is likely returning public addresses that are unreachable or routed incorrectly over the internet rather than through the Direct Connect private VIF. The fix would be to configure the on-premises DNS to resolve the ALB name to its private IPs (for example via Route 53 Resolver inbound endpoints or a private hosted zone). Option A is incorrect because the scenario states the VPC route tables already have routes to on-premises via the VGW, and the ALB subnets are covered by the VPC's local route. Option B is incorrect because security groups and NACLs are confirmed to allow on-premises traffic. Option C is incorrect because the ALB is stated to be deployed in the public subnets.

Answer

The VPC route tables do not have a route to the on-premises network for the ALB's subnet.

Answer

The security group on the ALB blocks inbound traffic from the on-premises CIDR.

Answer

The ALB is deployed in private subnets instead of public subnets.

Question 8

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC contains an Amazon RDS for MySQL database in a private subnet. The database is accessed by EC2 instances in the same VPC and by on-premises servers via a Site-to-Site VPN. The network team recently enabled VPC Flow Logs and noticed that the database is receiving a high number of SYN packets from an IP address that is not part of the VPC or on-premises network. The security group for the database only allows inbound traffic on port 3306 from the EC2 instances' security group and the on-premises CIDR (10.0.0.0/8). The network ACL for the database subnet allows inbound and outbound traffic on all ports from all sources. What is the most likely cause of the unexpected traffic?

Accepted Answer

The network ACL for the database subnet allows all inbound traffic, so packets from the internet reach the database subnet's network ACL before being evaluated by the security group.. The network ACL (NACL) is stateless and allows all inbound traffic from any source, including the internet. While the security group (SG) denies the unexpected traffic (since it only allows traffic from the EC2 security group and on-premises CIDR), the NACL permits it. VPC Flow Logs capture traffic at the network interface level after NACL evaluation but before SG evaluation; thus, even though the SG drops the SYN packets, they are logged by Flow Logs because they pass through the NACL. Option A is incorrect because the security group explicitly restricts inbound traffic to specific sources, not 0.0.0.0/0. Option B is incorrect because the RDS database is in a private subnet and does not have a public endpoint; a public endpoint would have been configured explicitly. Option C is incorrect because the Site-to-Site VPN is configured for the on-premises network only, and the unexpected IP is not from that CIDR; the VPN itself does not route internet traffic into the VPC.

Answer

The security group for the database has an inbound rule that allows traffic from 0.0.0.0/0.

Answer

The RDS database has a public endpoint that is accessible from the internet.

Answer

The Site-to-Site VPN is misconfigured and routing internet traffic into the VPC.

Question 9

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The network team notices intermittent packet loss on the Direct Connect virtual interface (VIF). Which AWS service should be used to monitor the latency and packet loss on the VIF?

Accepted Answer

AWS CloudWatch. AWS CloudWatch provides metrics for Direct Connect virtual interfaces, including latency and packet loss. You can monitor these metrics using CloudWatch alarms and dashboards to detect intermittent packet loss. CloudWatch is the native monitoring service for Direct Connect and provides the necessary visibility into VIF performance.

Answer

AWS Health Dashboard

Answer

VPC Flow Logs

Answer

AWS Transit Gateway Network Manager

Question 10

A company has a VPC with public and private subnets. The security team wants to detect and alert on any SSH traffic (port 22) that originates from the internet to any EC2 instance in the VPC. Which solution achieves this with minimal operational overhead?

Accepted Answer

Enable VPC Flow Logs, publish to CloudWatch Logs, and create a metric filter for SSH traffic.. VPC Flow Logs published to CloudWatch Logs with a metric filter for port 22 and the internet source range provides a low-overhead, native way to detect and alert on SSH traffic from the internet. This requires no agents, no third-party tooling, and integrates directly with CloudWatch alarms for alerting.

Answer

Configure a security group rule to deny inbound SSH and enable security group logging.

Answer

Use AWS Config to detect security group rules that allow SSH from 0.0.0.0/0.

Answer

Enable Amazon GuardDuty and rely on its threat detection.

Question 11

A company monitors its VPC using VPC Flow Logs. The logs are sent to CloudWatch Logs. The security team wants to detect traffic to known malicious IP addresses. Which AWS service can be used to analyze the flow logs in near real-time?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics can consume VPC Flow Logs streamed to CloudWatch Logs (via subscription filters) or directly to Kinesis Data Streams, and run SQL or Apache Flink applications to detect patterns such as traffic to known malicious IPs in near real-time. It is designed for continuous, low-latency stream processing. Athena, by contrast, is a batch query service over S3.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

Amazon Athena

Question 12

A company has a VPC with a public subnet and a private subnet. The public subnet has a bastion host (EC2) with a security group that allows SSH from a specific IP range. The private subnet has an RDS instance. The company wants to enable the bastion host to connect to the RDS instance. Which TWO steps are required?

Accepted Answer

Add a rule to the NACL for the private subnet to allow inbound traffic from the bastion host's IP.. Option B is correct because network ACLs are stateless and must explicitly allow the traffic between subnets; since the bastion host resides in the public subnet and the RDS instance in the private subnet, the private subnet's NACL needs an inbound rule permitting traffic from the bastion host's IP (and typically an outbound rule for the return traffic). Option E is correct because the RDS instance's security group must allow inbound connections on the database port (e.g., 3306 for MySQL or 5432 for PostgreSQL) from the bastion host's security group, which is the standard way to reference the bastion as the source without hardcoding IPs. Option A is not required because SSL is a client connection encryption setting, not a prerequisite for basic bastion-to-RDS connectivity, and it does not address network reachability. Option C is wrong because RDS instances in a private subnet should never have public IP addresses; connectivity is achieved through the bastion host. Option D is wrong because route tables route traffic between subnets via the VPC's implicit local route, and you cannot create a route directly to an RDS instance.

Answer

Configure the RDS instance to use a custom DB parameter group with SSL enabled.

Answer

Assign a public IP address to the RDS instance.

Answer

Create a route in the public subnet's route table to the RDS instance.

Question 13

A company uses AWS Direct Connect with a public VIF to access S3. The on-premises network uses BGP to advertise a specific prefix to AWS. The company wants to ensure that traffic to S3 from on-premises always uses the Direct Connect connection and not the internet. Which ONE configuration must be in place?

Accepted Answer

Set a higher local preference on the Direct Connect BGP session for the S3 prefixes.. For outbound traffic from on-premises to AWS over Direct Connect, the on-premises router makes the forwarding decision based on BGP attributes. Local preference is the highest-priority attribute in BGP path selection and is used within an autonomous system to prefer one exit point over another. Setting a higher local preference on routes learned from the Direct Connect BGP session ensures that the on-premises router prefers the Direct Connect path for S3 prefixes over any routes learned from internet peers. This is the correct and standard way to influence outbound path selection.

Answer

Set a higher MED value on routes learned from the internet to make them less preferred.

Answer

Disable the internet gateway for the VPC.

Answer

Set the AS_PATH prepend on the Direct Connect BGP session.

Answer

Configure the on-premises router to advertise a more specific route for the S3 CIDR blocks over the Direct Connect BGP session.

Question 14

A company is using AWS Direct Connect to connect to its VPC. The network team wants to encrypt all traffic between the on-premises data center and the VPC. Which solution provides encryption?

Accepted Answer

Use an IPsec VPN over the Direct Connect virtual interface.. AWS Direct Connect does not natively encrypt data in transit over the dedicated connection. To encrypt traffic between on-premises and a VPC over Direct Connect, you must layer an IPsec VPN over the Direct Connect virtual interface (public VIF or transit VIF), which provides end-to-end encryption using standard IPsec. This is the documented AWS approach for encrypted Direct Connect traffic.

Answer

Enable MACsec on the Direct Connect connection.

Answer

Use AWS Client VPN to connect on-premises to VPC.

Answer

Enable encryption on the Direct Connect virtual interface.

Question 15

A company is designing a multi-account strategy using AWS Organizations. The security team wants to centrally manage VPC Flow Logs from all accounts. Which THREE steps are required to achieve this?

Accepted Answer

Enable VPC Flow Logs in each account, specifying the central S3 bucket as the destination.. The two required steps are enabling VPC Flow Logs in each member account with the central bucket (B) and creating the central bucket with a bucket policy granting write access (C). While SSE-KMS is a security best practice, it is not strictly required for flow log delivery. VPN and VPC peering are unnecessary. Therefore, the question's premise of 'three required steps' is incorrect; only two steps are actually required.

Answer

Set up a VPN connection between the logging account and each member account.

Answer

Create a VPC peering connection between all accounts to allow log delivery.