ANS-C01 Network Management and Operations Practice Test 15 — 15 Questions

Question 1

A network team is planning a migration of a legacy application to AWS. The application requires a static IP address for the on-premises firewall whitelist. Which THREE AWS services can provide a static IP address for outbound traffic from a VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Direct Connect with a public virtual interface.. Options A, D, and E are correct. A Direct Connect public virtual interface uses a static public IP address for outbound traffic. A NAT Gateway with an Elastic IP provides a static IP for outbound traffic from private subnets. A Network Load Balancer with Elastic IPs per subnet provides static IPs for inbound and outbound traffic. Option B (VPC endpoint for S3) does not provide a static IP; it uses a prefix list. Option C (Application Load Balancer) does not have a static IP by default; it uses dynamic IPs.

Answer

VPC endpoint (gateway endpoint) for S3.

Answer

Application Load Balancer without a static IP.

Question 2

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

Accepted Answer

The connection was down for most of the day.. The ConnectionState metric indicates the state of the Direct Connect connection, where 0 means down and 1 means up. An average value of 0.0 for most of the day indicates the connection was down. Therefore, option B is correct. Option A is incorrect because the metric shows a consistent value of 0, not fluctuating. Option C is incorrect because the data is complete and clearly shows the connection was down. Option D is incorrect because a value of 0 means the connection was not up and stable.

Answer

The connection was fluctuating between up and down.

Answer

The metric data is incomplete.

Answer

The connection was up and stable.

Question 3

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

Accepted Answer

AWS X-Ray. Correct answer: C. AWS X-Ray provides end-to-end tracing and can capture network latency between services, including EC2 instances. It can help identify where delays occur. Option A (AWS Config) is incorrect because it monitors configuration changes, not performance. Option B (AWS CloudTrail) is incorrect because it records API calls for auditing, not network metrics. Option D (VPC Flow Logs) is incorrect because it captures IP traffic metadata (packet-level) but does not provide latency or performance metrics.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 4

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic from a specific VPC to an on-premises network is being dropped. All other VPCs can reach the on-premises network. Which configuration should be checked first?

Accepted Answer

Check the Transit Gateway route tables. The issue is isolated to one VPC, so route tables are the most likely cause. Transit Gateway route tables might not have the route for the on-premises network propagated from that VPC's attachment.

Answer

Check the on-premises firewall rules

Answer

Check the VPC's security groups

Answer

Check the VPC's network ACLs

Question 5

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

Accepted Answer

Amazon CloudWatch and Amazon CloudWatch Alarms. Amazon CloudWatch collects metrics from Direct Connect, including latency, and CloudWatch Alarms can trigger notifications via SNS when thresholds are exceeded. Option A is incorrect because CloudTrail logs API calls, not performance metrics. Option B is incorrect because Trusted Advisor provides best practice checks, not real-time latency monitoring, and SES is for email sending, not alerting. Option D is incorrect because VPC Flow Logs capture IP traffic metadata, not latency metrics, and CloudWatch Logs store log data, not metrics.

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Trusted Advisor and Amazon SES

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Question 6

A network engineer is troubleshooting an issue where an EC2 instance in a public subnet cannot reach the internet. The instance has a public IP, and the route table has a default route to an internet gateway. What is the most likely cause?

Accepted Answer

The network ACL is blocking outbound traffic. Even with correct routes, if the subnet's network ACL does not allow outbound traffic, the instance cannot reach the internet. Network ACLs are stateless and must allow both outbound and inbound ephemeral ports.

Answer

The internet gateway is not attached to the VPC

Answer

The security group does not allow outbound HTTP traffic

Answer

The instance does not have a public IP

Question 7

A company has a VPC with public and private subnets. The security team wants to analyze all traffic to and from the internet for security incidents. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces, including traffic to/from the internet, allowing analysis of all traffic for security incidents. Option A (AWS Shield Advanced) is incorrect because it provides DDoS protection, not traffic analysis. Option B (AWS Network Firewall) is incorrect because it provides firewall capabilities but does not provide detailed traffic logs like VPC Flow Logs. Option C (AWS WAF) is incorrect because it filters web traffic but does not capture or analyze all internet traffic.

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Answer

AWS WAF

Question 8

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. They need to ensure that traffic is distributed evenly across regions and that failover happens automatically. Which configuration should they use?

Accepted Answer

Configure Global Accelerator with two endpoints (one per region) and set equal weights. Global Accelerator uses endpoint weights to distribute traffic. Setting equal weights for both regional endpoints ensures even distribution, and health checks automatically route traffic away from unhealthy regions.

Answer

Use Route 53 latency-based routing with health checks

Answer

Configure Global Accelerator with a single endpoint group containing both ALBs

Answer

Use a Network Load Balancer in each region and Route 53 weighted routing

Question 9

A network engineer is designing a multi-region application that requires low-latency traffic between EC2 instances in two different AWS Regions. The engineer needs to ensure that traffic between the instances uses the AWS global network and not the public internet. Which AWS service should be used?

Accepted Answer

VPC Peering. (VPC Peering). Inter-region VPC peering connects VPCs in different regions using the AWS global network backbone, providing low-latency and private connectivity between EC2 instances. Option A (AWS Direct Connect) is used for on-premises to AWS connectivity, not between instances. Option B (AWS Global Accelerator) optimizes internet-facing traffic and adds unnecessary hops for internal traffic. Option C (AWS Transit Gateway) supports inter-region transit but requires additional configuration and is not the simplest solution for direct instance-to-instance connectivity.

Answer

AWS Direct Connect

Answer

AWS Global Accelerator

Answer

AWS Transit Gateway

Question 10

A network administrator is setting up VPC Flow Logs to monitor traffic to an Amazon RDS instance. The logs are sent to Amazon S3. After enabling Flow Logs, the administrator notices that no logs are being delivered. What is the most likely cause?

Accepted Answer

The IAM role for Flow Logs does not have permissions to write to S3. Flow Logs require a service-linked role or an IAM role with permissions to publish to S3. If the role is missing or incorrect, logs will not be delivered.

Answer

The VPC Flow Logs are not enabled for the correct VPC

Answer

The RDS instance is in a private subnet

Answer

The S3 bucket is in a different region

Question 11

A company has a VPC with a NAT gateway in a public subnet. The security team wants to log all outbound traffic from private subnets to the internet. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs can be enabled on the NAT gateway's elastic network interface (ENI) to capture all outbound traffic from private subnets to the internet. Option B is incorrect because AWS CloudTrail logs API calls, not network traffic. Option C is incorrect because Amazon S3 Access Logs only log requests made to S3 buckets, not NAT gateway traffic. Option D is incorrect because AWS Config records configuration changes, not network traffic.

Answer

AWS CloudTrail

Answer

Amazon S3 Access Logs

Answer

AWS Config

Question 12

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The connection is up, but the network team cannot reach resources in a VPC. The virtual interface is in the 'available' state, and BGP session is established. What should the team check next?

Accepted Answer

Check the VPC route tables for propagated routes. Since the Direct Connect physical link is up, the virtual interface is available, and the BGP session is established, the issue lies in the routing of traffic within AWS. The most likely cause is that the VPC route tables do not contain the necessary routes (either static or propagated from the Direct Connect virtual private gateway) to direct traffic back to the on-premises network. Checking the VPC route tables for propagated routes is the correct next step to ensure the on-premises CIDR is being advertised and accepted.

Answer

Check the on-premises firewall rules

Answer

Check the BGP authentication

Answer

Check the Direct Connect physical link status

Question 13

A company has a VPC with a VPN connection to an on-premises network. The network team reports that the VPN tunnel is flapping intermittently. You need to identify the cause. Which AWS service provides logs that can help troubleshoot the VPN tunnel status?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides VPN tunnel metrics, including tunnel state, data in/out, and other status indicators that help identify the cause of flapping. Option A (VPC Flow Logs) captures IP traffic but not tunnel status. Option C (AWS CloudTrail) logs API calls, not tunnel status. Option D (AWS Health Dashboard) shows service health events but not detailed tunnel status.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Health Dashboard

Question 14

A company has a VPC with multiple subnets and an internet gateway. The security team wants to detect and block malicious traffic patterns. Which AWS service should be used to provide intrusion detection and prevention?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides both intrusion detection and intrusion prevention capabilities, with stateful inspection of network traffic. Option B (Network ACLs) is incorrect because NACLs are stateless and do not provide intrusion prevention; they only provide basic allow/deny rules. Option C (Security Groups) is incorrect because Security Groups are stateful but only provide instance-level filtering without IPS functionality. Option D (AWS WAF) is incorrect because WAF protects web applications at Layer 7 and does not provide network-level intrusion prevention.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF

Question 15

A company has a large AWS environment with hundreds of VPCs connected via Transit Gateway. They want to centrally manage network traffic flow and enforce security policies. Which service should they use to create a central network inspection architecture?

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides managed firewall services that can be centrally deployed in a dedicated VPC and route traffic through it for inspection.

Answer

AWS WAF

Answer

Security groups

Answer

AWS Shield Advanced