ANS-C01 Network Management and Operations Practice Test 13 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage its network infrastructure. After a recent update, the stack fails to update, with an error indicating that a security group rule conflicts with an existing rule. What is the most likely cause?

Accepted Answer

The template attempts to add a security group rule that already exists.. Option B is correct because a duplicate security group rule (same protocol, port, and source) causes a conflict. Option A is wrong because IAM permissions cause a different error. Option C is wrong because it would not cause a conflict error. Option D is wrong because security groups are typically referenced by ID, not name.

Answer

The CIDR block in the rule is not in the same VPC.

Answer

The referenced security group was deleted outside of CloudFormation.

Answer

The stack update exceeded the service quota for security groups.

Question 2

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to a partner VPC with CIDR 10.0.0.0/16. Both VPCs are in the same region. They want to use VPC Peering. After creating the peering connection and adding routes, connectivity fails. What is the most likely cause?

Accepted Answer

Overlapping CIDR blocks prevent VPC peering connectivity.. Option A is correct because overlapping CIDRs are not allowed in VPC peering; routes cannot distinguish. Option B is wrong because there is no route conflict after peering. Option C is wrong because VPC peering does not support transitive routing. Option D is wrong because any status other than active would prevent connectivity, but with overlapping CIDRs, even active won't work.

Answer

The peering connection is not set up for transitive routing.

Answer

The peering connection status is 'pending-acceptance'.

Answer

The route tables do not have a route to the peering connection.

Question 3

A company is designing a multi-region architecture using AWS Transit Gateway inter-region peering. They need to ensure that traffic between VPCs in different regions can traverse the TGW peering attachment without being inspected by a central security appliance. Which configuration should be used?

Accepted Answer

Create TGW peering attachments and configure the route tables to point to each other's TGW attachment.. Option D is correct. TGW peering attachments allow traffic to bypass the central inspection VPC if routing is set up to go directly between TGWs. Option A is wrong because it forces inspection. Option B is wrong because VPN is not needed. Option C is wrong because VPC peering does not support transitive routing via TGW.

Answer

Route all inter-region traffic through a centralized inspection VPC in one region.

Answer

Set up a VPN connection between the two TGWs for encrypted traffic.

Answer

Use VPC peering between the VPCs instead of TGW peering.

Question 4

A company wants to monitor network traffic to and from an EC2 instance to detect anomalous outbound traffic. Which AWS service should they use to capture and analyze the traffic?

Accepted Answer

VPC Traffic Mirroring. Option C is correct because VPC Traffic Mirroring captures and copies traffic for analysis. Option A is wrong because AWS Config records configuration changes. Option B is wrong because CloudWatch Logs can capture logs but not full packet traffic. Option D is wrong because GuardDuty is a threat detection service that analyzes findings but does not capture raw traffic.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 5

A network engineer is configuring an AWS Site-to-Site VPN with dynamic routing (BGP). The customer gateway device is a Cisco router. The VPN tunnel is established, but BGP is not forming. Which configuration on the Cisco router is most likely missing?

Accepted Answer

The BGP neighbor statement with the correct Amazon ASN (64512).. Option C is correct. The BGP neighbor must have the correct ASN; a mismatch prevents session formation. Option A is wrong because the tunnel is already established, so IKE is fine. Option B is wrong because the tunnel interface is up. Option D is wrong because it's a routing protocol, not a VPN parameter.

Answer

The VPN connection's local IP address.

Answer

The correct IP address for the tunnel interface.

Answer

The pre-shared key for IKE phase 1.

Question 6

A company has a Direct Connect connection with a private virtual interface. The on-premises network team reports that they cannot reach EC2 instances in a VPC. The VPC has a virtual private gateway attached. The route table in the VPC has a route to the on-premises CIDR via the virtual private gateway. What should the network engineer verify?

Accepted Answer

Verify that the VPC route table has a route to the on-premises CIDR pointing to the virtual private gateway.. Option B is correct because the VPC route table needs a route to the on-premises CIDR pointing to the virtual private gateway. Option A is wrong because the virtual interface must be up. Option C is wrong because BGP sessions must be established. Option D is wrong because the on-premises router must advertise routes.

Answer

Verify that the Direct Connect virtual interface is in the 'available' state.

Answer

Verify that the BGP session between the on-premises router and the VGW is established.

Answer

Verify that the on-premises router is advertising the VPC CIDR.

Question 7

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team notices that traffic from on-premises to an EC2 instance in the VPC is taking a suboptimal path through the internet instead of the Direct Connect. What is the most likely cause?

Accepted Answer

The on-premises router does not have a specific route for the VPC CIDR via the Direct Connect.. Option A is correct. If the on-premises network does not have a specific route pointing to the Direct Connect for the VPC CIDR, traffic may use the internet. Option B is wrong because prefix lists are not required. Option C is wrong because ASN prepending would affect outbound traffic, not inbound. Option D is wrong because VPC route tables are not visible to on-premises.

Answer

The VPC route table does not include a route to the Direct Connect gateway.

Answer

The Direct Connect virtual interface has BGP ASN prepending configured.

Answer

The VPC route table does not have a prefix list for the on-premises CIDR.

Question 8

A company uses AWS Direct Connect and VPN as backup. They have a Transit Gateway with multiple VPC attachments. The network engineer wants to ensure that traffic uses Direct Connect when available and fails over to VPN. Which configuration should be applied?

Accepted Answer

Apply BGP community tags from Direct Connect to set a higher local preference.. Option D is correct because BGP communities from AWS allow setting local preference to prefer Direct Connect routes over VPN. Option A is wrong because AS_PATH prepending is for inbound route selection. Option B is wrong because MED is for inbound selection. Option C is wrong because BFD detects failure but does not control preference.

Answer

Set a higher MED value on the VPN BGP advertisements.

Answer

Prepend AS_PATH on the VPN BGP advertisements to make them less preferred.

Answer

Configure BFD on both Direct Connect and VPN interfaces.

Question 9

A network engineer needs to capture and analyze traffic crossing a VPC peering connection for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs for the peering connection.. VPC Flow Logs capture IP traffic information for network interfaces, including those attached to a VPC peering connection. They can be published to Amazon CloudWatch Logs or Amazon S3, and the logs contain fields such as source/destination IP, ports, protocol, and packet/byte counts, which are essential for troubleshooting traffic across the peering link. This is the correct service because it directly logs metadata about the traffic traversing the peering connection without requiring any changes to the network path.

Answer

AWS CloudTrail.

Answer

VPC Traffic Mirroring.

Answer

AWS Transit Gateway Network Manager.

Question 10

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Accepted Answer

iperf. Option A and Option D are correct. iperf measures network throughput, and traceroute shows the path and latency. Option B is wrong because nslookup does not measure throughput. Option C is wrong because tcpdump captures packets but does not measure throughput. Option E is wrong because ping measures latency but not throughput.

Answer

tcpdump

Answer

nslookup

Answer

ping

Question 11

A company is migrating from a legacy MPLS network to AWS using Direct Connect. The network team wants to ensure high availability with a backup connection. They have two Direct Connect connections from different providers, both terminating at the same AWS Direct Connect location. Which configuration provides the most resilient setup?

Accepted Answer

Use both connections with separate virtual interfaces, each terminating on different customer routers.. Option D is correct. Using two different devices and separate virtual interfaces provides redundancy at both the physical and logical level. Option A is wrong because a single device is a single point of failure. Option B is wrong because a single VIF is a single point of failure. Option C is wrong because using the same provider reduces diversity.

Answer

Use both connections but from the same provider to simplify management.

Answer

Use one connection with two virtual interfaces for redundancy.

Answer

Use both connections with a single virtual interface on each, but terminate on the same router.

Question 12

A company has a Direct Connect connection and wants to use it for both private and public resources. Which TWO components are required to achieve this?

Accepted Answer

Public virtual interface (VIF). Option B and Option D are correct. A private VIF is required for private IP connectivity to VPCs, and a public VIF is required for public IP connectivity to AWS public services. Option A is wrong because a VPN connection is not required for Direct Connect. Option C is wrong because a Transit Gateway is optional. Option E is wrong because an internet gateway is not used with Direct Connect public VIF.

Answer

Transit Gateway

Answer

Internet gateway

Answer

VPN connection to the VPC

Question 13

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a NAT Gateway in the public subnet. However, the instance cannot reach the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause?

Accepted Answer

The NAT Gateway does not have an Elastic IP address attached.. Option B is correct. The NAT Gateway's Elastic IP must be associated, otherwise traffic cannot be translated. Option A is wrong because the route is already present. Option C is wrong because NACLs are stateless but would affect both directions if misconfigured. Option D is wrong because security groups are stateful and allow return traffic.

Answer

The security group for the EC2 instance blocks outbound traffic.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The private subnet route table does not have a route to the internet gateway.

Question 14

A network engineer is analyzing VPC Flow Logs and notices that some rejected traffic is not logged. Which THREE conditions could cause this?

Accepted Answer

The Flow Logs capture only accepted traffic due to the filter.. Option A, Option B, and Option D are correct. Flow Logs do not capture traffic that does not reach the network interface (e.g., blocked by security group), traffic that is not logged for the specific interface, or traffic that is not logged if the log format is incorrect. Option C is wrong because NACL logs are captured. Option E is wrong because Flow Logs capture both accepted and rejected traffic if they reach the interface.

Answer

The traffic is blocked by a network ACL.

Answer

The traffic is rejected by the destination network.

Question 15

A network engineer is troubleshooting an issue where an EC2 instance in a VPC cannot reach an S3 bucket via a gateway endpoint. The instance is in a private subnet with a route table that has a route for the S3 prefix list pointing to the gateway endpoint. Which TWO actions should the engineer take to diagnose the problem?

Accepted Answer

Verify that the route table for the subnet includes a route for the S3 prefix list (com.amazonaws.region.s3) with target type gateway endpoint.. Options A and C are correct. The route table must have the prefix list route, and the security group must allow HTTPS traffic. Option B is wrong because the instance does not need a public IP for gateway endpoint. Option D is wrong because interface endpoints are different. Option E is wrong because VPC Flow Logs can help but are not the first diagnostic step.

Answer

Ensure the VPC has an interface endpoint for S3.

Answer

Review VPC Flow Logs for the subnet to see if traffic is being dropped.

Answer

Confirm that the EC2 instance has a public IP address.