ANS-C01 Network Management and Operations Practice Test 13 — 15 Questions

Question 1

A company is designing a highly available hybrid network using two AWS Direct Connect connections from different providers. The company wants to use BGP to advertise the same on-premises prefixes to AWS. Which THREE practices should be followed to ensure high availability and optimal traffic flow? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advertise the same prefixes with different prefix lengths to influence route selection. Advertising the same prefixes with different prefix lengths allows AWS to prefer the more specific prefix, enabling path selection and load balancing while maintaining redundancy. Option C is correct because using a unique private ASN for each Direct Connect connection prevents BGP's AS_PATH loop detection from discarding routes when both connections advertise the same prefixes. Option E is correct because using different BGP community tags for each connection allows you to influence routing policies (e.g., via local preference) to control traffic flow. Option A is incorrect because advertising different prefixes on each connection compromises redundancy; if one connection fails, its prefixes become unreachable. Option D is incorrect because setting the same MED value on both connections provides no differentiation for path selection, whereas using different MED values can influence which connection is preferred.

Answer

Advertise different on-premises prefixes on each connection

Answer

Set the same MED value for prefixes advertised on both connections

Question 2

A network engineer is setting up a VPC peering connection between two VPCs in the same AWS account and Region. Which TWO steps are required to enable communication between instances in the peered VPCs? (Choose two.)

Accepted Answer

Add routes in each VPC's route table pointing to the CIDR of the other VPC. VPC peering requires adding routes in both VPC route tables to direct traffic to the peered VPC's CIDR. Option E is correct because security group rules must be updated to allow inbound traffic from the peered VPC's CIDR. Option A is incorrect because VPC peering does not require an internet gateway. Option B is incorrect because VPC peering does not use a VPN connection. Option D is incorrect because a NAT gateway is not required for VPC peering.

Answer

Attach an internet gateway to each VPC

Answer

Establish a VPN connection between the VPCs

Answer

Configure a NAT gateway in each VPC

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They want to limit traffic between specific VPCs for security purposes. Which feature should they use?

Accepted Answer

Transit Gateway route tables.. Transit Gateway route tables control traffic between attachments by creating separate route tables and associating attachments accordingly, enabling isolation between specific VPCs. Option A is wrong because security groups are not supported on Transit Gateway attachments; they are instance-level. Option C is wrong because VPC Flow Logs are for monitoring traffic, not controlling it. Option D is wrong because Network ACLs are per-subnet and do not provide centralized control across attachments.

Answer

Security groups attached to the Transit Gateway.

Answer

VPC Flow Logs.

Answer

Network ACLs in each VPC.

Question 4

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a VPC and an on-premises data center over a Direct Connect virtual interface. The engineer notices that the BGP session is flapping. Which configuration should the engineer verify first?

Accepted Answer

Verify that the BGP hold timer and keepalive interval are consistent between the on-premises router and the AWS side.. BGP session flapping is often caused by mismatched BGP timers (hold timer and keepalive interval) between BGP peers. Verifying that these timers are consistent should be the first step. Option B is incorrect because MTU mismatch typically leads to packet loss or fragmentation, not BGP flapping. Option C is incorrect because advertising the correct prefix is necessary for route propagation, but BGP session stability depends on timer and configuration compatibility. Option D is incorrect because the virtual interface state being 'available' is a prerequisite, but if it is available, flapping suggests a higher-layer configuration issue.

Answer

Verify that the MTU setting on the Direct Connect virtual interface matches the on-premises router.

Answer

Verify that the on-premises router is advertising the correct prefix to AWS.

Answer

Verify that the Direct Connect virtual interface is in the 'available' state.

Question 5

A network engineer is diagnosing a connectivity issue between two VPCs connected via VPC peering. The engineer has confirmed that the route tables in both VPCs have appropriate routes and the security groups allow traffic. However, traffic from VPC A to VPC B fails. Which TWO steps should the engineer take to troubleshoot? (Select TWO.)

Accepted Answer

Check the network ACL of the subnet in VPC B where the target instance resides.. Checking the network ACL (NACL) of the subnet in VPC B where the target instance resides can reveal if inbound traffic is blocked by the stateless NACL. Option D is correct because verifying the operating system firewall on the target instance in VPC B can block traffic even if AWS network rules are open. Option B is wrong because VPC peering can work across different AWS accounts, so being in the same account is not necessary. Option C is wrong because the engineer should already have verified the peering connection status as part of initial checks; if it were inactive, the problem would be obvious, so it is not a likely next step. Option E is wrong because while VPC Flow Logs are useful for deep analysis, they are not the first step for a basic connectivity check; direct checks like NACLs and OS firewalls are more immediate.

Answer

Confirm that both VPCs are in the same AWS account.

Answer

Verify the VPC peering connection status is active.

Answer

Enable VPC Flow Logs on both VPCs to analyze traffic.

Question 6

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway is placed in a private subnet.. The most likely cause is that the NAT gateway is placed in a private subnet (Option A). A NAT gateway must be deployed in a public subnet with an associated Internet Gateway to route traffic to the internet. If it is in a private subnet, it cannot access the internet, thus the instance in the private subnet cannot reach the internet. Option B is incorrect because an instance in a private subnet does not need a public IP address to access the internet through a NAT gateway; it uses the NAT gateway's public IP. Option C is incorrect because security groups are stateful and allow outbound traffic by default; the security group would not block HTTPS outbound unless explicitly configured. Option D is incorrect because the default network ACL allows all outbound traffic; even if modified, the question says the route table points to the NAT gateway, so the issue is the NAT gateway's placement.

Answer

The instance does not have a public IP address assigned.

Answer

The security group attached to the instance does not allow outbound HTTPS traffic.

Answer

The network ACL on the private subnet blocks outbound HTTP traffic.

Question 7

A company is deploying a new application across multiple Availability Zones in a single region. The application requires low-latency communication between instances in different AZs. Which TWO design choices help achieve high availability and low latency? (Select TWO.)

Accepted Answer

Launch EC2 instances in at least two Availability Zones.. To achieve high availability and low-latency communication between instances in different Availability Zones, you should launch instances in at least two AZs (C) to avoid a single point of failure, and use an Application Load Balancer (E) to distribute traffic and perform health checks. A spread placement group (A) is not recommended for low latency; it spreads instances across distinct hardware, which can increase latency. Larger instance sizes (B) only increase capacity and do not improve availability or latency. A single NAT Gateway (D) introduces a single point of failure and does not affect inter-AZ latency.

Answer

Use a spread placement group for the instances.

Answer

Use larger instance sizes to handle traffic spikes.

Answer

Use a single NAT Gateway to provide internet access.

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. After adding a new VPC attachment, traffic from the on-premises network cannot reach the new VPC. The on-premises BGP route table shows the prefixes of the new VPC as received. What should the engineer check?

Accepted Answer

Verify that the new VPC attachment is associated with the Transit Gateway route table that has the on-premises routes.. For traffic from an on-premises network to reach a new VPC via Transit Gateway, the new VPC attachment must be associated with a Transit Gateway route table that contains a route (static or propagated) pointing to the on-premises network. Without this association, the Transit Gateway will not forward traffic to the new VPC even if the on-premises BGP route table has learned the VPC prefixes. Option A is incorrect because the on-premises router already receives the VPC prefixes via BGP, so advertising is not the issue. Option B is incorrect: the VPC's route table controls outbound traffic from the VPC, but inbound traffic from on-premises is governed by the Transit Gateway route table. Option D is irrelevant because DNS resolution does not affect IP routing.

Answer

Verify that the on-premises router is advertising the correct prefix to AWS.

Answer

Verify that the new VPC has a route to the Transit Gateway in its route table.

Answer

Verify that the new VPC's DNS resolution is enabled.

Question 9

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while blocking inbound internet traffic. Which TWO components are required? (Select TWO.)

Accepted Answer

A NAT Gateway in a public subnet.. To allow instances in a private subnet to download updates from the internet (outbound only), a NAT Gateway in a public subnet (D) is required, along with a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway (E). An Internet Gateway (B) alone would allow inbound traffic, which is not desired, and it is not used for private subnets. A Virtual Private Gateway (A) is for VPN connections to on-premises, not for internet access. VPC Peering (C) connects VPCs, not to the internet.

Answer

A Virtual Private Gateway.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Peering connection.

Question 10

A company is experiencing intermittent connectivity issues between a VPC and an on-premises data center over an AWS Direct Connect connection. The network engineer checks the Direct Connect virtual interface status and sees it is 'up'. However, BGP sessions are flapping. Which action should the engineer take to diagnose the issue?

Accepted Answer

Check the BGP keepalive and hold timers on both sides.. BGP session flapping is often caused by mismatched keepalive or hold timers between the customer router and AWS. Checking and aligning these timers helps diagnose and resolve the flapping. Option A is incorrect because the virtual interface is already up, indicating VLAN configuration is likely correct. Option B is incorrect; BFD is used for faster failure detection, not for diagnosing timer mismatches that cause flapping. Option C is excessive; recreating the virtual interface with a new VLAN ID is unnecessary when the issue is BGP-related.

Answer

Verify the VLAN configuration on the customer router.

Answer

Enable BFD on the Direct Connect virtual interface.

Answer

Recreate the virtual interface with a new VLAN ID.

Question 11

A company has a global application deployed across multiple AWS regions using Application Load Balancers (ALBs) and AWS Global Accelerator. Users in Asia report high latency. The network team wants to monitor the performance of the Global Accelerator endpoints. Which AWS service should they use to collect and analyze network metrics?

Accepted Answer

Amazon CloudWatch metrics for Global Accelerator. Amazon CloudWatch metrics for Global Accelerator provide endpoint health and performance metrics, such as latency and packet loss, which are essential for monitoring Global Accelerator endpoints. Option B is incorrect because VPC Flow Logs capture IP traffic information but not accelerator-level performance metrics. Option C is incorrect because AWS X-Ray is used for tracing application requests, not network-level metrics. Option D is incorrect because AWS CloudTrail logs API calls for auditing, not performance monitoring.

Answer

AWS VPC Flow Logs

Answer

AWS X-Ray

Answer

AWS CloudTrail

Question 12

A network engineer is troubleshooting high latency on an AWS Transit Gateway attachment to a VPN. The VPN tunnel is established, and traffic flows, but latency spikes are observed during peak hours. The engineer suspects packet loss. Which diagnostic step should be taken first?

Accepted Answer

Use Amazon CloudWatch metrics for the Transit Gateway attachment to check for dropped packets.. The first step in diagnosing packet loss on a Transit Gateway VPN attachment is to check the attachment's CloudWatch metrics, such as DroppedPacketCount or PacketDropRate, which directly indicate packet loss. Option A (traceroute) can show path latency but does not confirm packet loss at the Transit Gateway level. Option C (verify VPN tunnel status) only confirms the tunnel is up, not packet loss. Option D (VPN CloudWatch metrics) provides tunnel-level metrics but is less specific to the Transit Gateway attachment itself. The attachment metrics are more direct for this issue.

Answer

Run a traceroute from an on-premises host to an EC2 instance.

Answer

Verify the VPN tunnel status in the AWS Management Console.

Answer

Review the VPN CloudWatch metrics for tunnel data.

Question 13

A network engineer is designing a hybrid network with Direct Connect and VPN backup. The company has multiple VPCs connected via Transit Gateway. They want to use BGP to exchange routes. Which BGP feature should be configured to fail over from Direct Connect to VPN if the Direct Connect link goes down?

Accepted Answer

BGP communities. BGP communities allow AWS to tag routes from Direct Connect and VPN with different community values, enabling route preference control. By configuring the VPN routes with a lower preference (higher local preference via communities), traffic prefers Direct Connect when available. If Direct Connect fails, the VPN routes become active, providing failover. Option B (MED) influences inbound routing from external peers, not outbound preference within AWS. Option C (BFD) detects link failures faster but does not control route selection. Option D (AS_PATH prepending) is used to deprioritize routes outbound, not between Direct Connect and VPN.

Answer

Multi-Exit Discriminator (MED)

Answer

Bidirectional Forwarding Detection (BFD)

Answer

AS_PATH prepending

Question 14

A company uses AWS CloudFormation to manage its network infrastructure. After a recent update, the stack fails to update, with an error indicating that a security group rule conflicts with an existing rule. What is the most likely cause?

Accepted Answer

The template attempts to add a security group rule that already exists.. The most likely cause is that the CloudFormation template is attempting to add a security group rule that already exists. AWS CloudFormation does not allow duplicate security group rules; if the same protocol, port range, and source (CIDR or security group) are specified, the update will fail with a conflict error. Option A is incorrect because the CIDR block not being in the same VPC is not a factor for security group rules; they can reference external CIDRs. Option B is incorrect because a deleted security group would result in a different error (e.g., referencing a non-existent group). Option C is incorrect because exceeding service quotas yields a different error message.

Answer

The CIDR block in the rule is not in the same VPC.

Answer

The referenced security group was deleted outside of CloudFormation.

Answer

The stack update exceeded the service quota for security groups.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to a partner VPC with CIDR 10.0.0.0/16. Both VPCs are in the same region. They want to use VPC Peering. After creating the peering connection and adding routes, connectivity fails. What is the most likely cause?

Accepted Answer

Overlapping CIDR blocks prevent VPC peering connectivity.. The most likely cause of connectivity failure is the overlapping CIDR blocks. VPC peering requires non-overlapping IP ranges for proper routing. Even if the peering connection is active and routes are added, the identical CIDR blocks (both 10.0.0.0/16) prevent the route tables from distinguishing the traffic destination, resulting in no connectivity. Option A is incorrect because VPC peering does not support transitive routing, but that is not the issue here. Option B is incorrect because the status would need to be 'active' for connectivity, but the problem is overlapping CIDRs. Option D is incorrect because although routes may be missing, the primary issue is the overlapping CIDRs.

Answer

The peering connection is not set up for transitive routing.

Answer

The peering connection status is 'pending-acceptance'.

Answer

The route tables do not have a route to the peering connection.