ANS-C01 Network Management and Operations Practice Test 12 — 15 Questions

Question 1

A company is using AWS Direct Connect with a private VIF to connect to a VPC. They want to ensure high availability by having a second Direct Connect connection. Which configuration provides the most resilient setup?

Accepted Answer

Two Direct Connect connections from different providers to different Direct Connect locations.. Option A is correct because using two separate Direct Connect connections from different providers to different AWS locations ensures that no single point of failure (e.g., a single provider outage or location failure) can bring down connectivity. Option B is wrong because a single connection with two VIFs still has a single physical link. Option C is wrong because placing both connections in the same location still has a single location failure risk. Option D is wrong because a VPN is lower bandwidth and less reliable than Direct Connect.

Answer

Two Direct Connect connections from the same provider to the same Direct Connect location with separate VIFs.

Answer

One Direct Connect connection and one Site-to-Site VPN as backup.

Answer

One Direct Connect connection with two private VIFs.

Question 2

A company is designing a highly available hybrid network using two AWS Direct Connect connections from different providers. The company wants to use BGP to advertise the same on-premises prefixes to AWS. Which THREE practices should be followed to ensure high availability and optimal traffic flow? (Choose three.)

Accepted Answer

Advertise the same prefixes with different prefix lengths to influence route selection. Option A is correct because using different ASNs prevents BGP loop prevention from discarding routes. Option B is correct because using different BGP communities can influence routing policies. Option D is correct because using different prefix lengths allows AWS to prefer the more specific prefix. Option C is wrong because using the same MED value would not help in path selection. Option E is wrong because advertising the same prefixes on both connections is necessary for redundancy.

Answer

Advertise different on-premises prefixes on each connection

Answer

Set the same MED value for prefixes advertised on both connections

Question 3

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket. The VPC has a NAT Gateway in the public subnet. The security group for the EC2 instance allows outbound HTTPS to 0.0.0.0/0. The NACL for the private subnet allows outbound HTTPS to 0.0.0.0/0 and inbound ephemeral ports from 0.0.0.0/0. The instance still cannot reach S3. What is the most likely cause?

Accepted Answer

The NAT Gateway's security group does not allow outbound HTTPS traffic.. Option B is correct because S3 requires HTTPS (443) for API calls, but the NAT Gateway's security group must allow inbound HTTPS from the private subnet and outbound to S3. If the NAT Gateway's security group does not allow outbound HTTPS to S3, traffic is dropped. Option A is wrong because the private subnet has a route to the NAT Gateway. Option C is wrong because S3 does not have a security group in the VPC. Option D is wrong because the NACL allows inbound ephemeral ports.

Answer

The NACL for the private subnet blocks inbound traffic from S3.

Answer

The private subnet's route table does not have a route to the NAT Gateway.

Answer

The S3 bucket policy denies access from the VPC.

Question 4

A network engineer is setting up a VPC peering connection between two VPCs in the same AWS account and Region. Which TWO steps are required to enable communication between instances in the peered VPCs? (Choose two.)

Accepted Answer

Add routes in each VPC's route table pointing to the CIDR of the other VPC. Option A is correct because VPC peering requires adding routes in both VPC route tables. Option D is correct because security group rules must allow traffic from the peered VPC CIDR. Option B is wrong because VPC peering does not require an internet gateway. Option C is wrong because VPC peering does not use a VPN connection. Option E is wrong because a NAT gateway is not required for VPC peering.

Answer

Attach an internet gateway to each VPC

Answer

Establish a VPN connection between the VPCs

Answer

Configure a NAT gateway in each VPC

Question 5

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They want to limit traffic between specific VPCs for security purposes. Which feature should they use?

Accepted Answer

Transit Gateway route tables.. Option C is correct because Transit Gateway route tables can be used to control traffic between attachments by creating separate route tables and associating attachments accordingly. Option A is wrong because Network ACLs are per-subnet, not per-VPC. Option B is wrong because security groups are instance-level. Option D is wrong because VPC Flow Logs are for monitoring, not control.

Answer

Security groups attached to the Transit Gateway.

Answer

VPC Flow Logs.

Answer

Network ACLs in each VPC.

Question 6

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a VPC and an on-premises data center over a Direct Connect virtual interface. The engineer notices that the BGP session is flapping. Which configuration should the engineer verify first?

Accepted Answer

Verify that the BGP hold timer and keepalive interval are consistent between the on-premises router and the AWS side.. Option B is correct because BGP timers mismatch is a common cause of BGP session flapping. Option A is wrong because MTU mismatch typically causes packet loss, not BGP flap. Option C is wrong because VIF state being active is required for BGP but flapping suggests a configuration issue. Option D is wrong because route propagation is about route distribution, not BGP session stability.

Answer

Verify that the MTU setting on the Direct Connect virtual interface matches the on-premises router.

Answer

Verify that the on-premises router is advertising the correct prefix to AWS.

Answer

Verify that the Direct Connect virtual interface is in the 'available' state.

Question 7

A network engineer is diagnosing a connectivity issue between two VPCs connected via VPC peering. The engineer has confirmed that the route tables in both VPCs have appropriate routes and the security groups allow traffic. However, traffic from VPC A to VPC B fails. Which TWO steps should the engineer take to troubleshoot? (Select TWO.)

Accepted Answer

Check the network ACL of the subnet in VPC B where the target instance resides.. Option B is correct because checking the NACL of the subnet in VPC B where the target instance resides can reveal if inbound traffic is blocked. Option D is correct because verifying the OS-level firewall on the target instance in VPC B can block traffic even if AWS network is open. Option A is wrong because the peering connection status is active; if it were pending or deleted, it would be obvious. Option C is wrong because cross-account configuration is not mentioned. Option E is wrong because VPC Flow Logs are useful but not the first step for a basic connectivity check.

Answer

Confirm that both VPCs are in the same AWS account.

Answer

Verify the VPC peering connection status is active.

Answer

Enable VPC Flow Logs on both VPCs to analyze traffic.

Question 8

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet.. Option C is correct because the NAT gateway must be in a public subnet with an internet gateway to route traffic. Option A is wrong because security groups are stateful and allow outbound traffic by default. Option B is wrong because a public IP is not needed for outbound traffic through NAT. Option D is wrong because network ACLs are stateless and need explicit rules, but the default allows outbound traffic.

Answer

The instance does not have a public IP address assigned.

Answer

The security group attached to the instance does not allow outbound HTTPS traffic.

Answer

The network ACL on the private subnet blocks outbound HTTP traffic.

Question 9

A company is deploying a new application across multiple Availability Zones in a single region. The application requires low-latency communication between instances in different AZs. Which THREE design choices help achieve high availability and low latency? (Select THREE.)

Accepted Answer

Use a spread placement group for the instances.. Option A is correct because an Application Load Balancer distributes traffic across AZs and provides health checks. Option B is correct because placing instances in multiple AZs ensures availability if one AZ fails. Option C is incorrect because a single NAT Gateway in one AZ creates a single point of failure. Option D is correct because using EC2 instances in a spread placement group reduces correlated failures. Option E is incorrect because increasing instance size does not improve availability or latency.

Answer

Use larger instance sizes to handle traffic spikes.

Answer

Use a single NAT Gateway to provide internet access.

Question 10

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. After adding a new VPC attachment, traffic from the on-premises network cannot reach the new VPC. The on-premises BGP route table shows the prefixes of the new VPC as received. What should the engineer check?

Accepted Answer

Verify that the new VPC attachment is associated with the Transit Gateway route table that has the on-premises routes.. Option B is correct because Transit Gateway route tables control inter-VPC and on-premises connectivity; the new VPC attachment must be associated with the correct route table. Option A is wrong because the on-premises already has the routes. Option C is wrong because there is no implied propagation. Option D is wrong because subdomain is irrelevant.

Answer

Verify that the on-premises router is advertising the correct prefix to AWS.

Answer

Verify that the new VPC has a route to the Transit Gateway in its route table.

Answer

Verify that the new VPC's DNS resolution is enabled.

Question 11

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while blocking inbound internet traffic. Which TWO components are required? (Select TWO.)

Accepted Answer

A NAT Gateway in a public subnet.. Option A is correct because a NAT Gateway provides outbound internet access to instances in private subnets. Option D is correct because the private subnet's route table must have a route to the NAT Gateway for internet-bound traffic. Option B is wrong because an Internet Gateway is used for public subnets, not private. Option C is wrong because a Virtual Private Gateway is for VPN connections. Option E is wrong because a VPC Peering connection connects VPCs, not to the internet.

Answer

A Virtual Private Gateway.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Peering connection.

Question 12

A company is experiencing intermittent connectivity issues between a VPC and an on-premises data center over an AWS Direct Connect connection. The network engineer checks the Direct Connect virtual interface status and sees it is 'up'. However, BGP sessions are flapping. Which action should the engineer take to diagnose the issue?

Accepted Answer

Check the BGP keepalive and hold timers on both sides.. Option B is correct because checking BGP session logs and timers helps identify flapping due to misconfigured timers or routing updates. Option A is wrong because it does not address BGP-specific issues. Option C is wrong because it involves changing routing, not diagnosing. Option D is wrong because it is an extreme measure that may not resolve the BGP issue.

Answer

Verify the VLAN configuration on the customer router.

Answer

Enable BFD on the Direct Connect virtual interface.

Answer

Recreate the virtual interface with a new VLAN ID.

Question 13

A company has a global application deployed across multiple AWS regions using Application Load Balancers (ALBs) and AWS Global Accelerator. Users in Asia report high latency. The network team wants to monitor the performance of the Global Accelerator endpoints. Which AWS service should they use to collect and analyze network metrics?

Accepted Answer

Amazon CloudWatch metrics for Global Accelerator. Option D is correct because CloudWatch metrics for Global Accelerator provide endpoint health and performance metrics. Option A is wrong because VPC Flow Logs capture IP traffic but not accelerator-level metrics. Option B is wrong because AWS X-Ray is for application tracing. Option C is wrong because CloudTrail logs API calls, not performance.

Answer

AWS VPC Flow Logs

Answer

AWS X-Ray

Answer

AWS CloudTrail

Question 14

A network engineer is troubleshooting high latency on an AWS Transit Gateway attachment to a VPN. The VPN tunnel is established, and traffic flows, but latency spikes are observed during peak hours. The engineer suspects packet loss. Which diagnostic step should be taken first?

Accepted Answer

Use Amazon CloudWatch metrics for the Transit Gateway attachment to check for dropped packets.. Option A is correct because monitoring the Transit Gateway attachment metrics can show packet loss or errors. Option B is wrong because it only checks if the tunnel is up. Option C is wrong because CloudWatch metrics for the VPN are more granular. Option D is wrong because it does not provide real-time diagnostics.

Answer

Run a traceroute from an on-premises host to an EC2 instance.

Answer

Verify the VPN tunnel status in the AWS Management Console.

Answer

Review the VPN CloudWatch metrics for tunnel data.

Question 15

A network engineer is designing a hybrid network with Direct Connect and VPN backup. The company has multiple VPCs connected via Transit Gateway. They want to use BGP to exchange routes. Which BGP feature should be configured to fail over from Direct Connect to VPN if the Direct Connect link goes down?

Accepted Answer

BGP communities. Option C is correct because BGP communities allow controlling route preference; AWS uses community tags to influence route priority. Option A is wrong because BFD detects failures faster but does not control preference. Option B is wrong because AS_PATH prepending is used to influence inbound routes, not outbound. Option D is wrong because MED is used to influence inbound routes.

Answer

Multi-Exit Discriminator (MED)

Answer

Bidirectional Forwarding Detection (BFD)

Answer

AS_PATH prepending