ANS-C01 Network Management and Operations Practice Test 14 — 15 Questions

Question 1

A company is deploying a new application across multiple Availability Zones in a VPC. The application needs to be highly available and must handle traffic from both internal users and external customers. Which TWO options should the network team implement to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provision a NAT Gateway in each AZ for outbound connectivity from private subnets.. Option C is correct because provisioning a NAT Gateway in each Availability Zone provides highly available outbound internet connectivity for instances in private subnets; if one AZ fails, the NAT Gateway in the remaining AZ continues to serve traffic, avoiding a single point of failure. Option E is correct because deploying an Application Load Balancer across multiple public subnets in different AZs gives the application a highly available, layer-7 entry point that can route both internal and external HTTP/HTTPS traffic to targets in multiple AZs. Option A is not sufficient on its own: an Internet Gateway is required for public subnet connectivity but does not by itself provide load distribution or high availability across AZs. Option B is not the best fit because a Network Load Balancer operates at layer 4 and, while it can span AZs, it does not provide the layer-7 routing typically needed for application traffic from internal and external users. Option D is incorrect because a single NAT Gateway in one AZ creates an availability risk and does not meet the high-availability requirement.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use a Network Load Balancer to distribute traffic across AZs.

Answer

Create a single NAT Gateway in one AZ for outbound traffic.

Question 2

A company has a hybrid network with an AWS Direct Connect connection and an AWS Site-to-Site VPN as a backup. The network team notices that traffic is asymmetrically routing through both connections, causing performance issues. Which TWO steps should the team take to ensure traffic uses the primary Direct Connect and only fails over to the VPN? (Choose two.)

Accepted Answer

Configure BGP communities on the Direct Connect to influence route preference.. Option C is correct because BGP communities on the Direct Connect (for example, the well-known NO_EXPORT or a custom community matched by local preference on the on-premises router) let the network team influence route preference so the Direct Connect path is selected as primary over the VPN. Option E is correct because advertising a more specific prefix (longer prefix length) over Direct Connect than over the VPN causes longest-prefix-match to prefer the Direct Connect path, ensuring the VPN is used only when the Direct Connect route is withdrawn. Option A is not correct because increasing the MED on the VPN would make it less preferred only if MED comparison applies, but MED is non-transitive and typically not compared across different autonomous systems, so it does not reliably enforce Direct Connect preference here. Option B is not correct because AWS VPN CloudHub is a hub-and-spoke VPN topology for connecting multiple remote sites, not an automatic failover mechanism between Direct Connect and a Site-to-Site VPN. Option D is not correct because disabling AS path prepend on the Direct Connect session would not by itself make Direct Connect preferred; AS path prepending is used to make a path less preferred, and removing it does not create a deterministic primary/backup relationship with the VPN.

Answer

Increase the BGP MED value on the VPN connection to make it less preferred.

Answer

Enable VPN automatic failover using AWS VPN CloudHub.

Answer

Disable AS path prepend on the Direct Connect BGP session.

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that VPC A cannot communicate with VPC B, while all other VPCs communicate normally. The transit gateway route table shows routes from both VPCs. Which TWO actions should the network engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Check the security groups and network ACLs in VPC A and VPC B.. Option A is correct because security groups and network ACLs are stateful/stateless filters that can silently block traffic even when Transit Gateway routes exist; checking both VPCs' SG inbound/outbound rules and NACL ingress/egress rules is a standard first diagnostic step for selective VPC-to-VPC connectivity failures. Option D is correct because a VPC attachment must be associated with the Transit Gateway route table that contains the target routes, and if VPC A or VPC B is associated with a different (or default) route table, traffic will not be forwarded despite routes appearing in the table being inspected. Options B and E are incorrect because VPN attachments and Direct Connect virtual interfaces are for connecting on-premises or remote networks to the Transit Gateway, not for enabling intra-Transit-Gateway VPC-to-VPC traffic. Option C is incorrect because VPC peering is an alternative connectivity method that bypasses the Transit Gateway entirely and is not a diagnostic action for an existing Transit Gateway routing problem.

Answer

Establish a VPN connection between VPC A and the transit gateway.

Answer

Create a VPC peering connection between VPC A and VPC B.

Answer

Configure an AWS Direct Connect virtual interface between the VPCs.

Question 4

A company wants to monitor network traffic between its VPC and on-premises data center over a Direct Connect private VIF. The network team needs to capture the source and destination IP addresses, protocols, and packet counts. Which THREE AWS services or features should they use together? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. VPC Flow Logs (B) is correct because it captures IP traffic going to and from network interfaces in a VPC, recording fields such as source and destination IP addresses, protocol numbers, ports, and packet/byte counts, which directly satisfies the requirement to monitor traffic over the Direct Connect private VIF. Amazon CloudWatch Logs (A) is correct because VPC Flow Logs must be published to a destination such as CloudWatch Logs (or S3), where the flow log records can be stored, queried, and retained for analysis of the captured traffic. Amazon CloudWatch Contributor Insights (E) is correct because it can analyze CloudWatch Logs flow log data to identify top contributors and traffic patterns, such as the heaviest talkers by IP or protocol, adding the monitoring and insight layer on top of the raw flow logs. AWS CloudTrail (C) is not correct because it records API activity and management events, not packet-level network traffic metadata. AWS Config (D) is not correct because it evaluates and tracks resource configuration changes and compliance, not network flow data.

Answer

AWS CloudTrail

Answer

AWS Config

Question 5

A financial services company is deploying a multi-account environment using AWS Organizations. The security team requires that all network traffic to and from the internet must flow through a centralized inspection VPC that hosts third-party firewall appliances. The architecture uses a single AWS Transit Gateway with a centralized inspection VPC attached. Which THREE steps are necessary to enforce this architecture? (Choose THREE.)

Accepted Answer

Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.. Option A is correct because each spoke VPC's route table must send its default route (0.0.0.0/0) to the transit gateway attachment, so all internet-bound traffic is redirected into the Transit Gateway instead of a local internet gateway. Option D is correct because the inspection VPC must route traffic received from the Transit Gateway to the third-party firewall appliances for inspection, then route the inspected traffic back to the Transit Gateway for egress to the internet. Option E is correct because separate Transit Gateway route tables for the inspection VPC and spoke VPCs, with appropriate route propagation, are required to control traffic flow and ensure spoke traffic traverses the inspection VPC rather than bypassing it. Option B is not necessary because SCPs govern API permissions and cannot enforce packet-level routing or prevent direct internet access through route tables and gateways. Option C is not necessary because VPC Gateway Endpoints for S3 and DynamoDB only provide private access to those specific services and do not enforce centralized inspection of general internet traffic.

Answer

Use AWS Organizations service control policies to prevent direct internet access from spoke VPCs.

Answer

Deploy VPC Gateway Endpoints for S3 and DynamoDB in each spoke VPC.

Question 6

A company is troubleshooting an issue where an application running on an EC2 instance cannot connect to an Amazon S3 bucket using a VPC endpoint. The security groups and network ACLs appear correct. Which THREE items should the network team verify to resolve the issue? (Choose three.)

Accepted Answer

The VPC endpoint policy allows access to the S3 bucket.. The VPC endpoint policy may deny access to the specific S3 bucket. Option C is correct because the route table must have a route for the S3 prefix list via the endpoint. Option D is correct because the endpoint must be associated with the correct subnet (or require DNS resolution). Option B is wrong because the Internet Gateway is not needed if using a VPC endpoint. Option E is wrong because S3 Transfer Acceleration is for speed, not connectivity.

Answer

S3 Transfer Acceleration is enabled on the bucket.

Answer

The VPC has an Internet Gateway attached.

Question 7

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network engineer is troubleshooting connectivity issues and notices that the BGP session between the on-premises router and the AWS Direct Connect virtual interface is down. The engineer has verified the physical connectivity and the VLAN configuration. What should the engineer check next?

Accepted Answer

Confirm that the BGP ASN configured on the on-premises router matches the one provided by AWS.. For a Direct Connect BGP session to come up, the BGP ASN configured on the customer-side router must match the ASN specified when creating the virtual interface (or the peer ASN expected by AWS). A mismatch in ASN is a common cause of BGP session failure even when physical and VLAN connectivity are correct.

Answer

Ensure the virtual interface type is set to 'public'.

Answer

Verify that the on-premises router is advertising a CIDR block smaller than /24.

Answer

Check the VPC CIDR range in the route table.

Question 8

A network engineer is troubleshooting an EC2 instance that cannot connect to S3 via a VPC endpoint. The describe-vpc-endpoints output shows the endpoint is associated with a route table but no subnets. What is the likely issue?

Accepted Answer

The subnet's route table does not include a route for the S3 prefix list via the endpoint.. For a Gateway VPC endpoint to work, it must be associated with the route tables of the subnets that need to reach S3. The describe-vpc-endpoints output shows the endpoint is associated with a route table but no subnets — this is a red herring because Gateway endpoints are associated with route tables, not subnets directly. However, the correct answer D points out that the subnet's route table must include a route for the S3 prefix list (pl-xxxx) pointing to the endpoint. If the route table associated with the endpoint is not the one used by the instance's subnet, or if the route is missing, connectivity fails. The output indicating no subnets is misleading because Gateway endpoints don't attach to subnets; they attach to route tables. The likely issue is that the subnet's route table lacks the necessary route to the endpoint, which is why the instance cannot connect.

Answer

The DNS entry for the endpoint is not resolving.

Answer

The VPC endpoint policy denies access to S3.

Answer

The VPC endpoint state is not available.

Question 9

A company is using AWS CloudFormation to deploy a VPC with public and private subnets, an internet gateway, and a NAT gateway. The deployment fails with the error: 'Route table rtb-12345678 already has a route with destination 0.0.0.0/0'. The network engineer reviews the template and sees that the public route table has a route to the internet gateway and the private route table has a route to the NAT gateway. Both route tables are defined in the same template. What is the most likely cause of this error?

Accepted Answer

The public and private route tables are the same resource due to a typo in the template.. The error indicates that the same route table is being used for both routes, which happens when both resources reference the same route table ID. Option A is wrong because a route table can have multiple routes, but only one default route. Option C is wrong because the error is specific to duplicate routes, not a missing route. Option D is wrong because internet and NAT gateways can coexist in the same VPC.

Answer

The internet gateway and NAT gateway cannot exist in the same VPC simultaneously.

Answer

The public route table already has a route to the internet gateway, and adding another default route is not allowed.

Answer

The NAT gateway route is missing a destination CIDR block.

Question 10

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones in a VPC. The application communicates with an on-premises database over an AWS Direct Connect private VIF. The network team has configured a VPN connection as a backup. Recently, the application experienced intermittent timeouts when accessing the database. The team suspects asymmetric routing because the primary Direct Connect and backup VPN are both active. The network team wants to ensure that all traffic to the on-premises network uses the Direct Connect when it is available, and only fails over to the VPN if Direct Connect goes down. The BGP sessions are configured on both connections. The Direct Connect advertises the on-premises CIDR of 10.0.0.0/16, and the VPN advertises the same CIDR. The team has access to the on-premises router configuration and AWS console. Which action should the team take to resolve the issue?

Accepted Answer

Configure the on-premises router to prepend one or more AS numbers to the routes advertised over the VPN BGP session.. When both Direct Connect and VPN advertise the same prefix (10.0.0.0/16), AWS prefers the path with the shortest AS-path length. Prepending AS numbers on the on-premises router's VPN BGP advertisements makes the VPN path longer, so the Direct Connect path wins while it's up; if Direct Connect fails, the VPN path becomes the only option and traffic fails over automatically. This is the standard BGP traffic-engineering technique for active/passive hybrid connectivity.

Answer

Add a static route in the VPC route table pointing to the Direct Connect virtual interface for the on-premises CIDR.

Answer

Advertise a more specific prefix (e.g., 10.0.0.0/24) over the VPN BGP session to attract traffic.

Answer

Disable BGP on the VPN connection and use static routes instead.

Question 11

A media company streams live video to viewers worldwide. The application runs on EC2 instances behind an Application Load Balancer in two AWS regions, us-east-1 and eu-west-1. The company uses Amazon CloudFront as a CDN with origins pointing to both regional ALBs. The network team recently deployed AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. However, after enabling Global Accelerator, viewers in Europe report buffering issues, while viewers in the US have no issues. The team has verified that the Global Accelerator endpoints are healthy and the ALBs are functioning correctly. The application uses a custom domain name. The DNS is managed by Route 53. What is the most likely cause of the buffering issues for European viewers?

Accepted Answer

Global Accelerator is directing European traffic to the us-east-1 endpoint due to endpoint weight misconfiguration.. Global Accelerator uses endpoint weights to distribute traffic among endpoints. If the weight for the us-east-1 endpoint is higher than that for eu-west-1, or if eu-west-1 is not properly weighted, European traffic may be directed to us-east-1, causing increased latency and buffering. The most likely cause is a misconfiguration in endpoint weights.

Answer

The Route 53 DNS record is not pointing to Global Accelerator but to CloudFront, bypassing Global Accelerator.

Answer

CloudFront is caching content from the us-east-1 origin only, causing high latency for European viewers.

Answer

The eu-west-1 ALB is not configured to accept traffic from Global Accelerator IPs.

Question 12

A company has a VPC with a public subnet and a private subnet. The public subnet contains a web server (EC2 instance) that must be accessible from the internet. The private subnet contains a database server (EC2 instance) that should only be accessible from the web server. The web server's security group allows HTTP (80) and HTTPS (443) from 0.0.0.0/0. The database server's security group allows MySQL (3306) from the web server's security group. However, the web server cannot connect to the database server. The network engineer has verified that the web server can reach the internet and that the database server's security group is correctly configured. What is the most likely cause of the connectivity problem?

Accepted Answer

The network ACL associated with the private subnet is blocking inbound MySQL traffic from the web server.. Security groups are stateful, meaning that if the web server initiates traffic to the database, the return traffic is automatically allowed regardless of outbound rules in the security group. However, network ACLs (NACLs) are stateless and require explicit inbound and outbound rules. In this scenario, the database server's security group is correctly configured to allow MySQL traffic from the web server's security group, indicating that the security group is not the issue. The most likely cause is that the network ACL associated with the private subnet is blocking inbound MySQL traffic (port 3306) from the web server. Option A is incorrect because the route table for the private subnet does not need a route to the public subnet for traffic within the same VPC; local routes handle that. Option B is incorrect because security groups are stateful, so outbound traffic from the web server to the database is allowed by default. Option D is incorrect because the database server does not need a route to the internet gateway for internal VPC communication.

Answer

The route table for the private subnet does not have a route to the public subnet.

Answer

The web server's security group does not allow outbound traffic to the database server.

Answer

The database server does not have a route to the internet gateway.

Question 13

A network engineer must design a solution to monitor and troubleshoot connectivity from an on-premises data center to a VPC over an AWS Direct Connect connection. The solution must provide visibility into BGP routing, packet loss, and latency. Which TWO services or features should the engineer use? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs for Direct Connect. Amazon CloudWatch Logs for Direct Connect (A) is correct because Direct Connect publishes Virtual Interface (VIF) logs to CloudWatch Logs, capturing BGP session state changes and route advertisements, which directly provides the required visibility into BGP routing over the dedicated connection. Amazon CloudWatch metrics for Direct Connect (C) is correct because it exposes metrics such as VirtualInterfaceBpsIngress/Egress, PacketDropCount, and VirtualInterfaceBgpStatus, giving the engineer the packet loss and latency/throughput telemetry needed to troubleshoot the on-premises-to-VPC path. Together these two features cover BGP routing visibility plus loss and performance monitoring for the Direct Connect link. AWS CloudTrail (B) only records API control-plane activity and does not show BGP, packet loss, or latency. VPC Flow Logs (D) capture IP traffic metadata inside the VPC and cannot see the Direct Connect BGP sessions or the on-premises side of the link. AWS X-Ray (E) is an application-level tracing service and has no visibility into network-layer Direct Connect connectivity.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS X-Ray

Question 14

A company uses AWS CloudWAN to build a global network connecting multiple VPCs and on-premises sites. The network team has configured a core network with a segment that includes VPCs in us-east-1 and eu-west-1. The team notices that traffic between VPCs in different regions is taking a suboptimal path, going through the internet instead of staying within the AWS global network. The team has verified that the core network attachments are correctly configured and that the route tables are propagated. What should the team do to ensure traffic stays within the AWS global network?

Accepted Answer

Ensure both VPCs are attached to the same CloudWAN segment.. In AWS Cloud WAN, a core network is composed of segments (similar to route domains) that define isolation and routing boundaries. For VPCs in different regions to communicate over the AWS global network, they must be attached to the same segment. If they are in different segments, traffic between them may be routed via the internet or not at all. The team should verify segment membership and ensure both VPCs are in the same segment.

Answer

Establish a VPC peering connection between the two VPCs.

Answer

Set up an AWS Direct Connect gateway to route traffic between regions.

Answer

Create a transit gateway in each region and peer them together.

Question 15

A company has a multi-account AWS environment using AWS Organizations. Each account contains a VPC with a private subnet and a public subnet. The company uses a centralized inspection VPC in the network account with third-party firewall appliances. All internet-bound traffic from the VPCs must be routed through the inspection VPC via an AWS Transit Gateway. The network team has configured the transit gateway with separate route tables: one for the inspection VPC and one for the spoke VPCs. The spoke VPCs have a default route (0.0.0.0/0) pointing to the transit gateway. The inspection VPC has a default route pointing to an egress VPC that has an internet gateway. However, traffic from a spoke VPC is not reaching the internet. The network engineer has verified that the firewall appliances are running and that the security groups and NACLs allow traffic. What is the most likely cause of the issue?

Accepted Answer

The inspection VPC route table does not have a route to the transit gateway for the spoke VPC CIDRs.. For traffic from a spoke VPC to reach the internet via the inspection VPC, the inspection VPC must be able to route return traffic back to the spoke VPC. The inspection VPC's route table requires routes for each spoke VPC's CIDR blocks with the Transit Gateway as the target. Without these routes, the firewall cannot forward return traffic, causing the initial connection to time out and internet access to fail. Option B is similar but misstates the requirement. Options C and D describe different issues that do not align with the described symptoms.

Answer

The inspection VPC route table does not have a route to the spoke VPC CIDRs via the transit gateway.

Answer

The inspection VPC route table has a blackhole route for the spoke VPC CIDRs.

Answer

The transit gateway route table for the spoke VPCs does not have a route to the egress VPC.