ANS-C01 Network Management and Operations Practice Test 14 — 15 Questions

Question 1

A company is designing a multi-region architecture using AWS Transit Gateway inter-region peering. They need to ensure that traffic between VPCs in different regions can traverse the TGW peering attachment without being inspected by a central security appliance. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create TGW peering attachments and configure the route tables to point to each other's TGW attachment.. TGW peering attachments allow traffic to bypass the central inspection VPC if routing is set up to go directly between TGWs. Option B is wrong because it forces inspection. Option C is wrong because VPN is not needed. Option D is wrong because VPC peering does not support transitive routing via TGW.

Answer

Route all inter-region traffic through a centralized inspection VPC in one region.

Answer

Set up a VPN connection between the two TGWs for encrypted traffic.

Answer

Use VPC peering between the VPCs instead of TGW peering.

Question 2

A company wants to monitor network traffic to and from an EC2 instance to detect anomalous outbound traffic. Which AWS service should they use to capture and analyze the traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring (option D) is correct because it captures and copies network traffic from EC2 instances for analysis. Amazon GuardDuty (option A) is a threat detection service that analyzes logs and findings but does not capture raw traffic. Amazon CloudWatch Logs (option B) can capture application and system logs, but not full packet-level traffic. AWS Config (option C) records configuration changes to resources, not network traffic. Therefore, VPC Traffic Mirroring is the appropriate service for capturing and analyzing network traffic to detect anomalous outbound behavior.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 3

A network engineer is configuring an AWS Site-to-Site VPN with dynamic routing (BGP). The customer gateway device is a Cisco router. The VPN tunnel is established, but BGP is not forming. Which configuration on the Cisco router is most likely missing?

Accepted Answer

The BGP neighbor statement with the correct Amazon ASN (64512).. The VPN tunnel is established, indicating IKE phase 1 and IPsec are functioning, so options A, B, and C are not the issue. For BGP to form, the Cisco router must have a BGP neighbor statement pointing to the correct Amazon ASN (64512) and the tunnel interface IP. Without this, BGP will not establish a session. Options A, B, and C are incorrect because the tunnel is up, so local IP, tunnel interface IP, and pre-shared key are properly configured.

Answer

The VPN connection's local IP address.

Answer

The correct IP address for the tunnel interface.

Answer

The pre-shared key for IKE phase 1.

Question 4

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team notices that traffic from on-premises to an EC2 instance in the VPC is taking a suboptimal path through the internet instead of the Direct Connect. What is the most likely cause?

Accepted Answer

The on-premises router does not have a specific route for the VPC CIDR via the Direct Connect.. If the on-premises network does not have a specific route pointing to the Direct Connect for the VPC CIDR, traffic may use the internet. Option B is wrong because prefix lists are not required. Option C is wrong because ASN prepending would affect outbound traffic, not inbound. Option D is wrong because VPC route tables are not visible to on-premises.

Answer

The VPC route table does not include a route to the Direct Connect gateway.

Answer

The Direct Connect virtual interface has BGP ASN prepending configured.

Answer

The VPC route table does not have a prefix list for the on-premises CIDR.

Question 5

A company uses AWS Direct Connect and VPN as backup. They have a Transit Gateway with multiple VPC attachments. The network engineer wants to ensure that traffic uses Direct Connect when available and fails over to VPN. Which configuration should be applied?

Accepted Answer

Apply BGP community tags from Direct Connect to set a higher local preference.. AWS Direct Connect can apply BGP community tags that allow you to set a higher local preference for routes learned via Direct Connect compared to VPN routes. This ensures traffic prefers Direct Connect when available. Option A is incorrect because MED is used for influencing inbound route selection from multiple AS paths, not for preferring Direct Connect over VPN. Option B is incorrect because AS_PATH prepending affects how routes are advertised to neighbors, not how they are preferred locally. Option D is incorrect because BFD (Bidirectional Forwarding Detection) provides fast failure detection but does not influence route preference; it would be used in conjunction with routing policies, not as a standalone solution.

Answer

Set a higher MED value on the VPN BGP advertisements.

Answer

Prepend AS_PATH on the VPN BGP advertisements to make them less preferred.

Answer

Configure BFD on both Direct Connect and VPN interfaces.

Question 6

A network engineer needs to capture and analyze traffic crossing a VPC peering connection for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs for the peering connection.. VPC Flow Logs capture IP traffic information for network interfaces, including those attached to a VPC peering connection. They can be published to Amazon CloudWatch Logs or Amazon S3, and the logs contain fields such as source/destination IP, ports, protocol, and packet/byte counts, which are essential for troubleshooting traffic across the peering link. This is the correct service because it directly logs metadata about the traffic traversing the peering connection without requiring any changes to the network path.

Answer

AWS CloudTrail.

Answer

VPC Traffic Mirroring.

Answer

AWS Transit Gateway Network Manager.

Question 7

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Accepted Answer

iperf. Options A and C are correct. iperf is a tool used to measure network throughput between two hosts. Traceroute diagnoses network path and latency, which can help identify performance bottlenecks. Options B, D, and E are incorrect: tcpdump captures packets but does not measure throughput; nslookup is a DNS lookup tool that does not measure network performance; ping measures latency but not throughput.

Answer

tcpdump

Answer

nslookup

Answer

ping

Question 8

A company is migrating from a legacy MPLS network to AWS using Direct Connect. The network team wants to ensure high availability with a backup connection. They have two Direct Connect connections from different providers, both terminating at the same AWS Direct Connect location. Which configuration provides the most resilient setup?

Accepted Answer

Use both connections with separate virtual interfaces, each terminating on different customer routers.. Using two separate Direct Connect connections with separate virtual interfaces, each terminating on different customer routers, provides high availability by eliminating single points of failure at both the physical and logical levels. Option A is wrong because using the same provider reduces diversity. Option C is wrong because using a single connection with two VIFs still has a single physical link. Option D is wrong because terminating on the same router creates a single point of failure.

Answer

Use both connections but from the same provider to simplify management.

Answer

Use one connection with two virtual interfaces for redundancy.

Answer

Use both connections with a single virtual interface on each, but terminate on the same router.

Question 9

A company has a Direct Connect connection and wants to use it for both private and public resources. Which TWO components are required to achieve this?

Accepted Answer

Public virtual interface (VIF). Options D and E are correct. A Direct Connect connection supports multiple virtual interfaces: a private VIF for private IP connectivity to VPCs, and a public VIF for public IP connectivity to AWS public services. Using both enables access to private and public resources. Option A is incorrect because a Transit Gateway is optional and not required for this setup. Option B is incorrect because an Internet gateway provides internet access through the public internet, not through Direct Connect public VIF. Option C is incorrect because a VPN connection is a separate mechanism and not required for Direct Connect.

Answer

Transit Gateway

Answer

Internet gateway

Answer

VPN connection to the VPC

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a NAT Gateway in the public subnet. However, the instance cannot reach the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause?

Accepted Answer

The NAT Gateway does not have an Elastic IP address attached.. A NAT Gateway requires an Elastic IP address to translate private IP addresses to a public IP for internet access. Without it, outbound traffic cannot be routed to the internet. Option B is incorrect because the private subnet route table correctly has a default route pointing to the NAT Gateway. Option C is incorrect because the security group is stateful and allows return traffic; outbound traffic would only be blocked if explicitly denied. Option D is incorrect because network ACLs are stateless but the question does not indicate any blocking rules; the default NACL allows all outbound traffic.

Answer

The security group for the EC2 instance blocks outbound traffic.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The private subnet route table does not have a route to the internet gateway.

Question 11

A network engineer is analyzing VPC Flow Logs and notices that some rejected traffic is not logged. Which THREE conditions could cause this?

Accepted Answer

The Flow Logs capture only accepted traffic due to the filter.. Correct options are C, D, and E. Option C: If the Flow Logs are configured to capture only accepted traffic (filter: ACCEPT), then rejected traffic is not logged. Option D: Flow Logs are per network interface; if the traffic does not traverse the monitored interface, it won't be logged. Option E: Security groups operate at the instance level; if a security group blocks traffic before it reaches the network interface, the flow log for that interface will not capture the rejected traffic. Options A and B are incorrect because network ACLs operate at the subnet level and their deny actions are logged by Flow Logs if the traffic reaches the subnet; destination network rejection is also logged as 'REJECT' in the flow log record.

Answer

The traffic is blocked by a network ACL.

Answer

The traffic is rejected by the destination network.

Question 12

A network engineer is troubleshooting an issue where an EC2 instance in a VPC cannot reach an S3 bucket via a gateway endpoint. The instance is in a private subnet with a route table that has a route for the S3 prefix list pointing to the gateway endpoint. Which TWO actions should the engineer take to diagnose the problem?

Accepted Answer

Verify that the route table for the subnet includes a route for the S3 prefix list (com.amazonaws.region.s3) with target type gateway endpoint.. The correct diagnostic steps are A (verify the route table has the S3 prefix list route to the gateway endpoint) and E (check the security group allows outbound HTTPS). The route table must include the prefix list route for the gateway endpoint to work, and the security group must permit HTTPS (443) outbound because S3 API calls use HTTPS. Option B is incorrect because gateway endpoints are used for S3, not interface endpoints (which are for other services). Option C is incorrect; although VPC Flow Logs can help analyze traffic after initial checks, they are not the first diagnostic step. Option D is incorrect because the instance does not need a public IP; gateway endpoints route traffic within the AWS network without leaving the VPC directly.

Answer

Ensure the VPC has an interface endpoint for S3.

Answer

Review VPC Flow Logs for the subnet to see if traffic is being dropped.

Answer

Confirm that the EC2 instance has a public IP address.

Question 13

A network engineer is troubleshooting an AWS Lambda function that needs to create and manage ENIs in a VPC. The Lambda function is unable to create ENIs. The IAM policy attached to the Lambda execution role is shown in the exhibit. What is the issue?

Accepted Answer

The policy is missing the ec2:AttachNetworkInterface action.. The policy includes permissions for ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface, but it is missing ec2:AttachNetworkInterface. Without this action, the Lambda function cannot attach an ENI to the VPC, which is necessary for Lambda to manage ENIs. Option A is incorrect because the resource restriction in the policy is not the issue; the actions are allowed on any resource. Option B is incorrect because the policy does include ec2:CreateNetworkInterface. Option C is incorrect because it states the policy does not allow ec2:DeleteNetworkInterface, but it does.

Answer

The policy restricts the resource to a specific VPC.

Answer

The policy does not allow the ec2:CreateNetworkInterface action.

Answer

The policy does not allow the ec2:DeleteNetworkInterface action.

Question 14

A company is deploying a multi-tier application across two Availability Zones. The web tier must be highly available and scale based on traffic. The application load balancer (ALB) is internet-facing. Which TWO configurations are required to ensure the ALB can route traffic to the web instances across both AZs?

Accepted Answer

Register the ALB with subnets in at least two Availability Zones.. Options A and C are correct. The ALB must be associated with subnets in at least two Availability Zones to achieve high availability. Additionally, the target group must contain instances from both AZs to allow the ALB to route traffic across zones. Option B is incorrect because VPC route tables already allow cross-AZ traffic by default; no special configuration is needed. Option D is incorrect because security groups are applied to instances, not to AZs, and ALBs use security groups to control inbound traffic. Option E is incorrect because placing the ALB in a single subnet would limit its availability to one AZ, defeating high availability.

Answer

Configure the VPC route tables to allow cross-AZ traffic.

Answer

Assign a security group that allows traffic from both AZs.

Answer

Place the ALB in a single subnet for simplicity and attach multiple ENIs.

Question 15

A network engineer ran the command shown in the exhibit to check VPC peering connections. Two peering connections are active. The engineer wants to verify that routes are correctly configured. What additional step is needed to ensure that instances in vpc-11111111 can communicate with instances in vpc-33333333?

Accepted Answer

Add a route in the route table of vpc-11111111 pointing to vpc-33333333 via the peering connection, and a route in vpc-33333311 pointing to vpc-11111111 via the same peering connection.. For VPC peering to enable communication between instances in different VPCs, route tables in each VPC must have routes pointing to the peering connection. Specifically, vpc-11111111 needs a route to the CIDR of vpc-33333333 via the peering connection, and vpc-33333333 needs a route to the CIDR of vpc-11111111 via the same peering connection. Option A is incorrect because security groups are stateful and allow return traffic, but they do not replace the need for routing. Option B is incorrect because DNS resolution is optional and not required for IP-based communication. Option D is incorrect because the peering connection is already active, as stated.

Answer

Configure security groups to allow traffic between the VPCs.

Answer

Enable DNS resolution for the peering connection.

Answer

Ensure that the peering connection is in the 'active' state.