ANS-C01 Network Management and Operations Practice Test 15 — 15 Questions

Question 1

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The connection is up, but the network team cannot reach resources in a VPC. The virtual interface is in the 'available' state, and BGP session is established. What should the team check next?

Accepted Answer

Check the VPC route tables for propagated routes. Since the Direct Connect physical link is up, the virtual interface is available, and the BGP session is established, the issue lies in the routing of traffic within AWS. The most likely cause is that the VPC route tables do not contain the necessary routes (either static or propagated from the Direct Connect virtual private gateway) to direct traffic back to the on-premises network. Checking the VPC route tables for propagated routes is the correct next step to ensure the on-premises CIDR is being advertised and accepted.

Answer

Check the on-premises firewall rules

Answer

Check the BGP authentication

Answer

Check the Direct Connect physical link status

Question 2

A company has a VPC with a VPN connection to an on-premises network. The network team reports that the VPN tunnel is flapping intermittently. You need to identify the cause. Which AWS service provides logs that can help troubleshoot the VPN tunnel status?

Accepted Answer

Amazon CloudWatch. The correct answer is A because VPN tunnel metrics are available in CloudWatch, including tunnel state and data in/out. Option B is wrong because CloudTrail does not provide tunnel status logs. Option C is wrong because VPC Flow Logs capture traffic, not tunnel status. Option D is wrong because AWS Health Dashboard provides service health, not specific VPN tunnel logs.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Health Dashboard

Question 3

A company has a VPC with multiple subnets and an internet gateway. The security team wants to detect and block malicious traffic patterns. Which AWS service should be used to provide intrusion detection and prevention?

Accepted Answer

AWS Network Firewall. The correct answer is C because AWS Network Firewall provides managed intrusion detection and prevention capabilities. Option A is wrong because AWS WAF is for web application layer. Option B is wrong because Security Groups provide stateful filtering but not IPS. Option D is wrong because NACLs are stateless and do not provide intrusion prevention.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF

Question 4

A company has a large AWS environment with hundreds of VPCs connected via Transit Gateway. They want to centrally manage network traffic flow and enforce security policies. Which service should they use to create a central network inspection architecture?

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides managed firewall services that can be centrally deployed in a dedicated VPC and route traffic through it for inspection.

Answer

AWS WAF

Answer

Security groups

Answer

AWS Shield Advanced

Question 5

A company wants to monitor network traffic between VPCs in the same AWS Region that are connected via VPC Peering. Which AWS service can provide visibility into the traffic?

Accepted Answer

VPC Flow Logs. The correct answer is A because VPC Flow Logs can be enabled on the peering connection to capture traffic. Option B is wrong because CloudTrail does not capture network traffic. Option C is wrong because AWS Config does not provide traffic logs. Option D is wrong because Direct Connect is for on-premises, not VPC Peering.

Answer

AWS Config

Answer

AWS Direct Connect

Answer

AWS CloudTrail

Question 6

A network engineer is monitoring network performance between an EC2 instance and an on-premises server using AWS VPN. The engineer notices intermittent packet loss. Which AWS service can provide detailed network metrics and path visualization to troubleshoot?

Accepted Answer

AWS Transit Gateway Network Manager. AWS X-Ray is for application tracing, not network path. VPC Flow Logs provide packet metadata but not path visualization. Amazon CloudWatch can monitor VPN tunnels but not path. AWS Transit Gateway Network Manager provides network topology and path visualization.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS X-Ray

Question 7

A network engineer is troubleshooting a VPN connectivity issue. The VPN tunnel is up, but traffic is not passing. Which TWO AWS services should the engineer use to diagnose the problem?

Accepted Answer

VPC Flow Logs. The correct answers are A and C. VPC Flow Logs can show if traffic is reaching the VPN endpoint, and CloudWatch provides tunnel metrics and logs. Option B is wrong because CloudTrail logs API calls, not traffic. Option D is wrong because AWS Config tracks configuration, not traffic. Option E is wrong because Direct Connect is for dedicated connections, not VPN.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Direct Connect

Question 8

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect but cannot access any resources. The VPN is configured with a security group that allows all traffic. What should the administrator check?

Accepted Answer

The client VPN authorization rules. Client VPN uses an authorization rule to allow access to specific networks. Without an authorization rule, even if the security group allows traffic, the VPN will not forward traffic.

Answer

The client VPN security group inbound rules

Answer

The client VPN endpoint certificate

Answer

The client VPN route table

Question 9

A company wants to implement a network monitoring solution that provides real-time traffic analysis and anomaly detection. Which THREE AWS services should be used together?

Accepted Answer

Amazon GuardDuty. The correct answers are A, B, and E. VPC Flow Logs capture traffic, CloudWatch provides metrics and alarms, and GuardDuty provides anomaly detection. Option C is wrong because CloudTrail is for API logs, not traffic analysis. Option D is wrong because AWS Config is for configuration tracking.

Answer

AWS Config

Answer

AWS CloudTrail

Question 10

A company has multiple VPCs connected via VPC peering. They want to simplify network management and reduce the number of peering connections. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks, reducing the need for full mesh peering.

Answer

AWS PrivateLink

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect Gateway

Question 11

A network engineer needs to monitor network performance between an on-premises data center and AWS via Direct Connect. Which TWO metrics should the engineer monitor in Amazon CloudWatch?

Accepted Answer

VirtualInterfaceBgpState. The correct answers are B and D. Direct Connect provides metrics for connection bandwidth utilization and virtual interface BGP state. Option A is wrong because latency is not a standard Direct Connect metric (it's available via other methods). Option C is wrong because packet loss is not a standard metric. Option E is wrong because jitter is not a standard metric.

Answer

Jitter

Answer

PacketLoss

Answer

Latency

Question 12

Which TWO actions are recommended to troubleshoot asymmetric routing in a VPC with multiple NAT gateways?

Accepted Answer

Use a single NAT gateway per Availability Zone. Asymmetric routing occurs when traffic takes different paths. Using a single NAT gateway per AZ and ensuring route tables point to the NAT gateway in the same subnet's AZ can prevent this. Additionally, disabling source/destination check on instances that do not need it can help, but for NAT gateways, this is not configurable.

Answer

Enable source/destination check on all EC2 instances

Answer

Use a Network Load Balancer to distribute traffic

Answer

Disable VPC Flow Logs

Question 13

Refer to the exhibit. A company has created a VPC endpoint for S3. However, an EC2 instance in the subnet associated with the route table cannot access S3 via the endpoint. The route table has a route to the endpoint. What is the most likely cause?

Accepted Answer

Private DNS is not enabled. The correct answer is C because the endpoint policy is set to Allow all, which is fine. However, the PrivateDnsEnabled is false, meaning that DNS resolution for S3 endpoints does not resolve to the endpoint IP. To use the endpoint, either enable Private DNS or use the endpoint-specific DNS name. Option A is wrong because the endpoint state is 'available'. Option B is wrong because the route table is associated. Option D is wrong because the security group is not specified (empty), but default SG allows all outbound traffic.

Answer

The endpoint is in 'pending' state

Answer

The route table is not associated with the subnet

Answer

The security group is blocking traffic

Question 14

Which THREE factors should be considered when designing a highly available AWS Site-to-Site VPN connection?

Accepted Answer

Enable BGP for dynamic route propagation. BGP (Border Gateway Protocol) enables dynamic route propagation across the VPN tunnels, allowing automatic failover and route convergence if one tunnel goes down. This is critical for high availability because it eliminates the need for manual route updates and supports path selection based on BGP attributes, ensuring traffic is rerouted through the remaining healthy tunnel.

Answer

Use two VPN tunnels with the same customer gateway IP

Answer

Use a single VPN tunnel with a static route

Question 15

Refer to the exhibit. A network engineer is creating an IAM policy to allow a user to manage VPC Peering connections. The user reports that they cannot delete a VPC Peering connection. What should the engineer add to the policy?

Accepted Answer

ec2:DeleteVpcPeeringConnection. The correct answer is D because the policy does not include 'ec2:DeleteVpcPeeringConnection'. Option A is wrong because 'ec2:ModifyVpcPeeringConnectionOptions' is for modifying options. Option B is wrong because 'ec2:DescribeVpcPeeringConnectionRouteTables' is not a valid action. Option C is wrong because 'ec2:RejectVpcPeeringConnection' is for rejection, not deletion.

Answer

ec2:DescribeVpcPeeringConnectionRouteTables

Answer

ec2:ModifyVpcPeeringConnectionOptions

Answer

ec2:RejectVpcPeeringConnection