ANS-C01 Network Management and Operations Practice Test 14 — 15 Questions

Question 1

A network engineer is troubleshooting an AWS Lambda function that needs to create and manage ENIs in a VPC. The Lambda function is unable to create ENIs. The IAM policy attached to the Lambda execution role is shown in the exhibit. What is the issue?

Accepted Answer

The policy is missing the ec2:AttachNetworkInterface action.. Option B is correct because Lambda requires permissions for ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, ec2:DeleteNetworkInterface, and also ec2:AttachNetworkInterface. Option A is wrong because the actions are allowed. Option C is wrong because resource restriction is not the issue. Option D is wrong because the policy already allows the actions.

Answer

The policy restricts the resource to a specific VPC.

Answer

The policy does not allow the ec2:CreateNetworkInterface action.

Answer

The policy does not allow the ec2:DeleteNetworkInterface action.

Question 2

A company is deploying a multi-tier application across two Availability Zones. The web tier must be highly available and scale based on traffic. The application load balancer (ALB) is internet-facing. Which TWO configurations are required to ensure the ALB can route traffic to the web instances across both AZs?

Accepted Answer

Register the ALB with subnets in at least two Availability Zones.. Options B and D are correct. The ALB must have subnets in both AZs to be highly available, and each target group must include instances from both AZs. Option A is wrong because route tables are not directly relevant to ALB routing. Option C is wrong because security groups are per instance, not per AZ. Option E is wrong because a single subnet would limit availability.

Answer

Configure the VPC route tables to allow cross-AZ traffic.

Answer

Assign a security group that allows traffic from both AZs.

Answer

Place the ALB in a single subnet for simplicity and attach multiple ENIs.

Question 3

A network engineer ran the command shown in the exhibit to check VPC peering connections. Two peering connections are active. The engineer wants to verify that routes are correctly configured. What additional step is needed to ensure that instances in vpc-11111111 can communicate with instances in vpc-33333333?

Accepted Answer

Add a route in the route table of vpc-11111111 pointing to vpc-33333333 via the peering connection, and a route in vpc-33333311 pointing to vpc-11111111 via the same peering connection.. Option B is correct because VPC peering requires route table entries in both VPCs pointing to the peering connection. Option A is wrong because the peering is active. Option C is wrong because security groups need to allow traffic, but routing is the first step. Option D is wrong because DNS resolution is not required for IP communication.

Answer

Configure security groups to allow traffic between the VPCs.

Answer

Enable DNS resolution for the peering connection.

Answer

Ensure that the peering connection is in the 'active' state.

Question 4

A network team is planning a migration of a legacy application to AWS. The application requires a static IP address for the on-premises firewall whitelist. Which THREE AWS services can provide a static IP address for outbound traffic from a VPC?

Accepted Answer

AWS Direct Connect with a public virtual interface.. Options A, B, and E are correct. NAT Gateway provides a static EIP, Direct Connect uses public VIF with static IP, and an internet-facing NLB can provide static IPs. Option C is wrong because VPC endpoints do not provide static IP. Option D is wrong because ALB does not have static IP by default.

Answer

VPC endpoint (gateway endpoint) for S3.

Answer

Application Load Balancer without a static IP.

Question 5

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

Accepted Answer

The connection was down for most of the day.. Option D is correct because ConnectionState metric has a value of 0 for down and 1 for up. Average 0.0 means the connection was down. Option A is wrong because it was down. Option B is wrong because 0 indicates down. Option C is wrong because it was not varying; it was consistently 0.

Answer

The connection was fluctuating between up and down.

Answer

The metric data is incomplete.

Answer

The connection was up and stable.

Question 6

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic from on-premises to the VPC is intermittently dropping. You check the Direct Connect virtual interface status and find it is 'down'. Which AWS service should you use to troubleshoot the physical layer connectivity?

Accepted Answer

AWS Direct Connect console. The correct answer is D because AWS Direct Connect Troubleshooting Guide recommends checking the cross-connect and using the AWS Direct Connect console to view the LOA-CFA status. Option A is wrong because AWS Support is not a service but a support plan. Option B is wrong because CloudWatch metrics show logical metrics, not physical layer. Option C is wrong because VPC Flow Logs capture IP traffic logs, not physical connectivity.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Support

Question 7

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

Accepted Answer

AWS X-Ray. The correct answer is A because AWS X-Ray provides end-to-end tracing of requests and can identify network latency. Option B is wrong because VPC Flow Logs only capture metadata, not latency. Option C is wrong because CloudTrail records API calls, not network performance. Option D is wrong because AWS Config tracks configuration changes, not performance.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic from a specific VPC to an on-premises network is being dropped. All other VPCs can reach the on-premises network. Which configuration should be checked first?

Accepted Answer

Check the Transit Gateway route tables. The issue is isolated to one VPC, so route tables are the most likely cause. Transit Gateway route tables might not have the route for the on-premises network propagated from that VPC's attachment.

Answer

Check the on-premises firewall rules

Answer

Check the VPC's security groups

Answer

Check the VPC's network ACLs

Question 9

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

Accepted Answer

Amazon CloudWatch and Amazon CloudWatch Alarms. The correct answer is B because CloudWatch publishes Direct Connect metrics such as latency, and CloudWatch Alarms can trigger alerts. Option A is wrong because CloudTrail does not provide performance metrics. Option C is wrong because VPC Flow Logs do not provide latency metrics. Option D is wrong because AWS Trusted Advisor provides best-practice checks, not real-time latency monitoring.

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Trusted Advisor and Amazon SES

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Question 10

A network engineer is troubleshooting an issue where an EC2 instance in a public subnet cannot reach the internet. The instance has a public IP, and the route table has a default route to an internet gateway. What is the most likely cause?

Accepted Answer

The network ACL is blocking outbound traffic. Even with correct routes, if the subnet's network ACL does not allow outbound traffic, the instance cannot reach the internet. Network ACLs are stateless and must allow both outbound and inbound ephemeral ports.

Answer

The internet gateway is not attached to the VPC

Answer

The security group does not allow outbound HTTP traffic

Answer

The instance does not have a public IP

Question 11

A company has a VPC with public and private subnets. The security team wants to analyze all traffic to and from the internet for security incidents. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. The correct answer is C because VPC Flow Logs capture IP traffic information for network interfaces, including traffic to/from the internet. Option A is wrong because AWS WAF filters web traffic but does not provide traffic logs. Option B is wrong because AWS Shield Advanced provides DDoS protection, not traffic analysis. Option D is wrong because AWS Network Firewall provides firewall capabilities but not detailed traffic logs like Flow Logs.

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Answer

AWS WAF

Question 12

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. They need to ensure that traffic is distributed evenly across regions and that failover happens automatically. Which configuration should they use?

Accepted Answer

Configure Global Accelerator with two endpoints (one per region) and set equal weights. Global Accelerator uses endpoint weights to distribute traffic. Setting equal weights for both regional endpoints ensures even distribution, and health checks automatically route traffic away from unhealthy regions.

Answer

Use Route 53 latency-based routing with health checks

Answer

Configure Global Accelerator with a single endpoint group containing both ALBs

Answer

Use a Network Load Balancer in each region and Route 53 weighted routing

Question 13

A network engineer is designing a multi-region application that requires low-latency traffic between EC2 instances in two different AWS Regions. The engineer needs to ensure that traffic between the instances uses the AWS global network and not the public internet. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator. The correct answer is D because VPC Peering does not support inter-region peering unless explicitly enabled, but Global Accelerator uses the AWS global network to route traffic. However, the question asks for low-latency traffic between EC2 instances in different Regions; AWS Transit Gateway does not support inter-region peering by default, and Direct Connect is for on-premises. Option A is wrong because VPC Peering requires explicit inter-region peering and does not provide low-latency optimization. Option B is wrong because Transit Gateway does not natively support inter-region connectivity. Option C is wrong because Direct Connect is for on-premises to AWS. Option D is correct because Global Accelerator routes traffic over the AWS global network.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 14

A network administrator is setting up VPC Flow Logs to monitor traffic to an Amazon RDS instance. The logs are sent to Amazon S3. After enabling Flow Logs, the administrator notices that no logs are being delivered. What is the most likely cause?

Accepted Answer

The IAM role for Flow Logs does not have permissions to write to S3. Flow Logs require a service-linked role or an IAM role with permissions to publish to S3. If the role is missing or incorrect, logs will not be delivered.

Answer

The VPC Flow Logs are not enabled for the correct VPC

Answer

The RDS instance is in a private subnet

Answer

The S3 bucket is in a different region

Question 15

A company has a VPC with a NAT gateway in a public subnet. The security team wants to log all outbound traffic from private subnets to the internet. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Flow Logs. The correct answer is B because VPC Flow Logs can be enabled on the NAT gateway's elastic network interface to capture all outbound traffic. Option A is wrong because CloudTrail does not capture network traffic. Option C is wrong because AWS Config does not log traffic. Option D is wrong because S3 Access Logs are for S3 bucket access, not NAT gateway traffic.

Answer

AWS CloudTrail

Answer

Amazon S3 Access Logs

Answer

AWS Config

ANS-C01 Network Management and Operations Practice Test 14 — 15 Questions

Exhibit

ANS-C01 Network Management and Operations Practice Test 14 — 15 Questions

Exhibit