ANS-C01 Network Management and Operations Practice Test 12 — 15 Questions

Question 1

A company uses a centralized inspection VPC for traffic inspection. All VPCs route traffic to the inspection VPC via Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by a network virtual appliance in the inspection VPC. Which Transit Gateway feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transit Gateway route tables. To ensure that all traffic between VPCs is inspected by the network virtual appliance in the inspection VPC, you must control the routing. Transit Gateway route tables (Option C) allow you to define which traffic is sent to the inspection VPC by associating attachments with specific route tables and adding static routes or propagating routes. This ensures that inter-VPC traffic is forced through the inspection appliance before reaching its destination. Transit Gateway flow logs (Option A) only provide visibility into traffic but do not enforce inspection; they are a monitoring tool, not a routing mechanism. Therefore, Option C is correct, while Options A, B, and D are incorrect.

Answer

Transit Gateway flow logs

Answer

Transit Gateway multicast

Answer

Transit Gateway peering

Question 2

An engineer is troubleshooting connectivity from on-premises to a VPC via Direct Connect private VIF. The BGP session is up, traffic is flowing, but the on-premises network cannot reach some subnets in the VPC. The VPC CIDR is 10.0.0.0/16. What is the most likely cause based on the exhibit?

Accepted Answer

The security groups or network ACLs in the VPC are blocking traffic to those subnets.. The BGP session being up and traffic flowing indicates that routing is properly configured between on-premises and the VPC. The inability to reach only some subnets suggests the issue is at the network security layer within the VPC. Security groups and network ACLs can block traffic to specific subnets while routing remains intact. Therefore, the most likely cause based on the exhibit is that security groups or NACLs are filtering traffic to those subnets.

Answer

The BGP session is up, but the on-premises router is not receiving the VPC CIDR route due to missing route propagation on the virtual private gateway.

Answer

The customer router configuration snippet is missing the BGP configuration for those subnets.

Answer

The route filter prefixes only allow the VPC CIDR 10.0.0.0/16, but the VPC has additional CIDRs that are not being advertised.

Question 3

A network engineer is troubleshooting high latency to an application hosted in Amazon EC2. The application uses an Application Load Balancer. Which metrics in Amazon CloudWatch should be examined to identify if the load balancer is causing latency?

Accepted Answer

TargetResponseTime. TargetResponseTime measures the time taken by the target to respond, which directly indicates backend latency. Option A (HTTP 5XX Count) is wrong because it indicates errors, not latency. Option B (ActiveConnectionCount) is wrong because it measures concurrent connections, not latency. Option D (RequestCount) is wrong because it is a count of requests, not latency.

Answer

HTTP 5XX Count

Answer

ActiveConnectionCount

Answer

RequestCount

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. The network team notices intermittent packet loss on the link. CloudWatch metrics show no errors on the connection. What should the team do next to isolate the issue?

Accepted Answer

Run a traceroute from an on-premises device to an EC2 instance in the VPC.. Running a traceroute from an on-premises device to an EC2 instance in the VPC helps identify where packets are being dropped along the path. Option B is incorrect because checking BGP session status only verifies routing adjacency, not packet loss. Option C is incorrect because VPC Flow Logs capture metadata but do not indicate packet loss on the Direct Connect link. Option D is incorrect because increasing bandwidth does not resolve packet loss; it only adds capacity.

Answer

Check the BGP session status on the customer router.

Answer

Enable VPC Flow Logs on the VPC.

Answer

Increase the bandwidth of the Direct Connect connection.

Question 5

A company has a global application deployed across multiple AWS Regions. Users are routed to the nearest Region using Amazon Route 53. The application uses an Application Load Balancer in each Region. The network team wants to ensure that traffic is always routed to a healthy Region in case of a Regional failure. Which Route 53 routing policy should be used?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks. This policy routes traffic to the region with the lowest latency and can automatically failover to a healthy region if health checks fail. Option B (Weighted routing) distributes traffic based on weights, not latency, and does not provide automatic failover based on health. Option C (Simple routing) routes to a single resource and cannot automatically failover. Option D (Failover routing) is a primary/backup setup, not latency-based, so it doesn't consider latency.

Answer

Weighted routing

Answer

Simple routing

Answer

Failover routing

Question 6

A network engineer is troubleshooting an issue where an on-premises server cannot reach an EC2 instance in a VPC over a Site-to-Site VPN. The VPN tunnel is up, and BGP is established. The engineer checks the route tables and sees the on-premises CIDR in the VPC route table pointing to the virtual private gateway. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route back to the VPC CIDR pointing to the VPN tunnel.. Although the VPN tunnel is up and BGP is established, the on-premises router must have a route pointing back to the VPC CIDR through the VPN tunnel for return traffic. Without this route, traffic from the EC2 instance to the on-premises server cannot be routed back, causing a one-way connectivity issue. Option A is incorrect because a mismatch in pre-shared keys would prevent the tunnel from coming up. Option C is incorrect because network ACLs are stateless and would affect traffic in both directions if misconfigured, not just one-way. Option D is incorrect because security group rules affect inbound traffic only; the issue here is return traffic from the EC2 instance, which is outbound from the VPC perspective, and the security group does not control outbound traffic in this context.

Answer

The VPN tunnel is not passing traffic due to a mismatch in pre-shared keys.

Answer

The network ACLs in the VPC are blocking the traffic.

Answer

The security group attached to the EC2 instance is blocking inbound traffic from the on-premises CIDR.

Question 7

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that S3 traffic is taking a suboptimal path over the internet instead of the Direct Connect. Which configuration is MOST likely missing?

Accepted Answer

A VPC endpoint for S3 is not configured. For a public VIF, S3 traffic from on-premises should use Direct Connect if the on-premises router is configured to route S3 prefixes to the Direct Connect connection. The provided options do not address this missing configuration. None of the options (VPC route tables, VIF association, Direct Connect gateway, or VPC endpoint) are correct for this scenario. The question may need to be revised to include an appropriate option.

Answer

The VPC route tables are not updated to include the Direct Connect route

Answer

The public VIF is not associated with the VPC

Answer

A Direct Connect gateway is not attached to the VPC

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team wants to monitor the amount of data transferred between VPCs for cost allocation. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs for each VPC.. VPC Flow Logs can be published to CloudWatch Logs or S3 and provide network traffic logs that include source/destination IP, ports, and byte counts, which can be used for cost allocation. Option A is wrong because CloudWatch Metrics for Transit Gateway only show aggregate metrics like bytes in/out per attachment, not per-flow. Option C is wrong because AWS Config records resource configuration changes, not traffic. Option D is wrong because CloudTrail records API calls.

Answer

CloudWatch Metrics for Transit Gateway.

Answer

AWS Config rules.

Answer

AWS CloudTrail logs.

Question 9

An organization has a multi-account setup using AWS Organizations. The security team wants to centrally manage and enforce security group rules across all VPCs in all accounts. Which solution should they implement?

Accepted Answer

Use AWS Firewall Manager to create common security group policies.. AWS Firewall Manager is the correct solution because it centralizes the management and enforcement of security group rules across all VPCs and accounts in an AWS Organization. It allows the security team to create common security group policies that are automatically applied to new and existing resources. Option A is incorrect because network ACLs are stateless and operate at the subnet level, not suitable for security group-like rules. Option B is incorrect: VPC Flow Logs capture network traffic information for analysis, not enforcement. Option C is incorrect: AWS Config can detect non-compliant security groups but cannot enforce rules; remediation requires additional automation, whereas Firewall Manager provides direct enforcement.

Answer

Deploy a centralized network ACL in each VPC.

Answer

Enable VPC Flow Logs and analyze using Amazon Detective.

Answer

Use AWS Config rules to remediate non-compliant security groups.

Question 10

A network engineer needs to capture and analyze DNS query logs generated by Amazon Route 53. Which AWS service should be used to store and query these logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon Route 53 can be configured to log DNS queries to Amazon CloudWatch Logs. CloudWatch Logs provides a centralized location to store and query these logs using CloudWatch Logs Insights. Option A (AWS CloudTrail) records API calls, not DNS queries. Option B (Amazon Kinesis Data Firehose) is a streaming data delivery service that can deliver logs to destinations like S3, but it does not directly store logs for querying. Option D (Amazon S3) is an object storage service and requires additional services (e.g., Athena) to query logs. Therefore, Amazon CloudWatch Logs is the correct service for storing and querying Route 53 DNS query logs directly.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3

Question 11

A company has a Direct Connect connection with a public VIF to access AWS public services. The on-premises network team reports that they can reach S3 but not DynamoDB. The route table on the customer router shows a default route to the public VIF. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking outbound traffic to the DynamoDB IP ranges.. DynamoDB uses a different set of public IP ranges than S3, and the on-premises firewall might block access to those ranges. Option A is wrong because the Direct Connect connection is a single physical link; if it were degraded, it would affect all traffic, not just DynamoDB. Option B is wrong because the public VIF does use BGP, but the customer router has a default route to the public VIF, indicating the BGP session is established and routes are being received. Option D is wrong because the public VIF accesses AWS public services directly, not through the VPC route table.

Answer

The Direct Connect connection is degraded and only supports S3 traffic.

Answer

The BGP session between the customer router and AWS is down.

Answer

The VPC route table does not have a route to the DynamoDB endpoint.

Question 12

A company has a multi-account AWS environment using AWS Transit Gateway. The network team wants to centralize network logging from all accounts into a single account for analysis. Which combination of services should be used to achieve this?

Accepted Answer

Amazon S3 and Amazon Athena. VPC Flow Logs from each account's VPCs can be published to a centralized Amazon S3 bucket using cross-account permissions. Amazon Athena can then be used to query and analyze the flow logs directly from S3 using standard SQL. This approach provides a cost-effective and scalable solution for centralizing network logging across multiple accounts. Option A is incorrect because AWS CloudTrail logs API activity, not network traffic; CloudWatch Logs can aggregate logs but require additional subscription filters for cross-account. Option B is incorrect because Kinesis Data Streams is designed for real-time streaming and requires additional processing to store and analyze logs, making it less suitable for historical analysis. Option D is incorrect because AWS Config records configuration changes and resource compliance, not network traffic logs.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

Amazon Kinesis Data Streams and Amazon Redshift

Answer

AWS Config and Amazon DynamoDB

Question 13

A network engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic information for network interfaces within a VPC, enabling analysis of traffic between EC2 instances. Option A is wrong because CloudTrail logs API calls, not network traffic. Option B is wrong because CloudWatch Metrics provide performance metrics, not packet-level details. Option D is wrong because AWS Config monitors configuration changes, not traffic.

Answer

AWS CloudTrail.

Answer

Amazon CloudWatch Metrics.

Answer

AWS Config.

Question 14

A network engineer is diagnosing a connectivity issue between an on-premises network and an Amazon VPC connected via a site-to-site VPN. The VPN tunnel is up, but traffic is not reaching the VPC. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Accepted Answer

Review the security group rules associated with the VPC resources to ensure they allow traffic from the on-premises network. Security groups act as a virtual firewall for VPC resources. If traffic from the on-premises network is not reaching the VPC, the security group rules must allow inbound traffic from the on-premises IP range. Option C is correct because the VPC route tables need a route for the on-premises network pointing to the virtual private gateway (VGW) to direct traffic correctly. Option B is incorrect because the customer gateway is the on-premises VPN endpoint, and its association with the VPC is already established since the VPN tunnel is up. Option D is incorrect because NAT is not a requirement for site-to-site VPN; the issue is about routing, not address translation. Option E is incorrect because the tunnel is already up, so checking its status again does not help diagnose why traffic is not flowing.

Answer

Confirm the customer gateway is associated with the correct VPC

Answer

Verify that the on-premises network has a NAT device configured

Answer

Check that the VPN tunnel's status is 'UP'

Question 15

A company is using AWS Direct Connect with a private VIF to connect to a VPC. They want to ensure high availability by having a second Direct Connect connection. Which configuration provides the most resilient setup?

Accepted Answer

Two Direct Connect connections from different providers to different Direct Connect locations.. Using two Direct Connect connections from different providers to different AWS Direct Connect locations eliminates single points of failure. A single provider outage or location failure will not disrupt connectivity. Option A is incorrect because two connections from the same provider to the same location share the same physical infrastructure, so a single failure can affect both. Option C is incorrect because a Site-to-Site VPN backup typically offers lower bandwidth and higher latency compared to Direct Connect, and it relies on the public internet, which is less reliable than a dedicated connection. Option D is incorrect because two private VIFs on a single Direct Connect connection still share the same physical link; a link failure impacts both VIFs.

Answer

Two Direct Connect connections from the same provider to the same Direct Connect location with separate VIFs.

Answer

One Direct Connect connection and one Site-to-Site VPN as backup.

Answer

One Direct Connect connection with two private VIFs.