ANS-C01 Network Management and Operations Practice Test 15 — 15 Questions

Question 1

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones. The application is fronted by an Application Load Balancer (ALB). The network team recently migrated from a transit VPC to a transit gateway for inter-VPC connectivity. After the migration, users experience intermittent connectivity failures. The team checks the ALB target group and sees that health checks are passing. However, from an EC2 instance in the same VPC, they can reach the ALB but not the application. They notice that the application sends traffic to an internal DNS server that is in a different VPC, and the application depends on that DNS resolution. The transit gateway route tables are configured to propagate routes from attached VPCs. The DNS server is reachable from the application VPC over the transit gateway. What is the MOST likely cause of the intermittent failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DNS server returns different IP addresses for the same DNS name, and some IPs are not reachable due to route table misconfiguration.. The intermittent nature of the failures combined with successful health checks points to DNS round-robin returning multiple IPs, where some IPs are unreachable due to route table misconfiguration after the transit gateway migration. Since the application depends on the internal DNS server in another VPC, some returned addresses may not have valid return paths through the TGW route tables, causing sporadic failures. This matches the symptom pattern of intermittent connectivity with healthy targets.

Answer

The transit gateway route tables have a blackhole route for the DNS server's VPC.

Answer

The Auto Scaling group is scaling in and out frequently, causing application instances to be terminated during DNS resolution.

Answer

The ALB security group does not allow traffic from the application instances on the ephemeral ports.

Question 2

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The connection uses a private virtual interface (VIF) to access the VPC. The network team is monitoring the link and notices that the BGP session goes down intermittently. The team has checked the physical layer and found no issues. The BGP keepalive timer is set to 30 seconds on both sides. The network engineer suspects that the issue might be related to the BGP hold timer. What should the engineer do to stabilize the BGP session?

Accepted Answer

Increase the BGP hold timer to 90 seconds on both the on-premises router and the AWS side.. Increasing the BGP hold timer to 90 seconds on both sides is correct because the hold timer determines how long a BGP session waits before declaring the peer dead. If the hold timer is too short relative to network latency or jitter, the session may flap. AWS Direct Connect recommends a hold timer of 90 seconds (with keepalive of 30 seconds) for stability. Since the physical layer is fine, adjusting the hold timer addresses potential transient delays.

Answer

Configure a static route on the on-premises router for the VPC CIDR.

Answer

Decrease the BGP hold timer to 10 seconds on the on-premises router.

Answer

Change the virtual interface to a public VIF to improve BGP stability.

Question 3

A company has an AWS Site-to-Site VPN connection between an on-premises network and a VPC. The VPN uses virtual private gateways and static routes. The network team reports that the VPN tunnel is up, but traffic from the on-premises network cannot reach some EC2 instances in the VPC. The EC2 instances have security groups that allow inbound traffic from the on-premises network. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. The tunnel status shows 'UP' from both sides. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The VPC route table does not have a route for the on-premises subnet that the traffic originates from, but only for a larger CIDR.. The security group may be allowing traffic from the on-premises CIDR but not from the tunnel endpoint IP. However, the more common issue is that the on-premises network's source IP is being translated or the VPC route table is missing a route for the specific subnet. Option A is a typical cause: if the on-premises CIDR is not exactly matched, the VPC may not route traffic back. Option C could cause issues if the VPN is not in the main route table. Option D would cause tunnel issues.

Answer

The VPC has a network ACL that denies inbound traffic from the on-premises CIDR.

Answer

The customer gateway device is using a different pre-shared key than configured in AWS.

Answer

The virtual private gateway is not attached to the correct VPC.

Question 4

A company has a VPC with multiple subnets across three Availability Zones. The VPC contains an Auto Scaling group of EC2 instances that process messages from an SQS queue. The instances are deployed in private subnets and need to access the SQS queue over the internet. The company wants to minimize data transfer costs and improve security by keeping traffic within the AWS network. The VPC has a NAT gateway in each AZ for outbound internet access. The network team has configured the route tables for the private subnets to send 0.0.0.0/0 traffic to the NAT gateway in the same AZ. However, the team notices that the EC2 instances are still using the NAT gateways to reach SQS, resulting in higher costs. What should the team do to ensure traffic to SQS stays within the AWS network?

Accepted Answer

Create an interface VPC endpoint for SQS in each private subnet.. SQS supports interface VPC endpoints (AWS PrivateLink), which allow EC2 instances in private subnets to access SQS privately without going through the internet or NAT gateways. Interface endpoints are deployed in the subnets and provide private IP addresses for the service. Gateway endpoints are not supported for SQS; they work only for S3 and DynamoDB. Therefore, to keep SQS traffic within the AWS network, create an interface VPC endpoint for SQS in each private subnet.

Answer

Create a gateway VPC endpoint for SQS in the VPC and update the route tables for the private subnets to include a route for the SQS prefix list pointing to the endpoint.

Answer

Set up an AWS Direct Connect connection to route SQS traffic directly.

Answer

Modify the network ACLs and security groups to allow traffic to SQS without going through the NAT gateway.

Question 5

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that the latency to S3 increases significantly during peak hours. They have tested the connection and confirmed that the physical link is not saturated. The company uses a single Direct Connect connection. The S3 traffic is routed over the public VIF. The team wants to improve performance without adding a new Direct Connect connection. Which action should the team take to reduce latency?

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and route S3 traffic through a private VIF attached to the VPC.. Using a Direct Connect gateway allows you to connect to multiple VPCs and also to AWS public services via a private VIF. However, for S3, you can use a private VIF with a VPC interface endpoint (Gateway Endpoint for S3) to keep traffic within the AWS network and avoid internet transit. This reduces latency because traffic goes from Direct Connect to the VPC and then to S3 via the gateway endpoint. Option B (adding VPN) adds IPSec overhead. Option C uses a different AWS region, which may increase latency. Option D (adding a second Direct Connect) is not allowed per the question.

Answer

Use an AWS Site-to-Site VPN connection over the Direct Connect to access S3 via private IP.

Answer

Add a second Direct Connect connection to load balance traffic.

Answer

Configure the Direct Connect public VIF to use a different AWS region closer to the on-premises location.

Question 6

A company has a VPC with public and private subnets. The public subnets have a NAT gateway for outbound internet access. The private subnets route all 0.0.0.0/0 traffic to the NAT gateway. The network team wants to centrally log all outbound internet traffic from the private subnets. They enable VPC Flow Logs and publish them to Amazon S3. However, they notice that the flow logs are capturing only traffic between instances within the VPC, not the NAT gateway traffic. What should the team do to capture outbound internet traffic?

Accepted Answer

Enable VPC Flow Logs specifically for the NAT gateway's elastic network interface.. VPC Flow Logs capture traffic at the elastic network interface (ENI) level. When private subnet instances send traffic to a NAT gateway, the flow logs on the instance's ENI record the traffic to the NAT gateway's private IP, not the translated public internet destination. To capture the actual outbound internet traffic (post-NAT), you must enable flow logs on the NAT gateway's ENI, which records the translated source and destination addresses.

Answer

Enable VPC Flow Logs for all subnets in the VPC.

Answer

Use AWS CloudTrail to log NAT gateway traffic.

Answer

Enable VPC Flow Logs for the VPC and publish to CloudWatch Logs instead of S3.

Question 7

A company has a VPC with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via AWS Direct Connect. The network team needs to ensure that only specific VPCs can communicate with each other. They create a transit gateway route table for each VPC and attach the VPC to the route table. They also propagate routes from the Direct Connect virtual interface. However, after configuration, traffic between two VPCs that should not communicate is still flowing. What is the MOST likely cause?

Accepted Answer

The VPC attachments are using the default transit gateway route table instead of custom route tables.. The most likely cause is that the VPC attachments are using the default transit gateway route table instead of custom route tables. By default, a transit gateway has a default route table that is shared among all attachments, which can allow unintended inter-VPC traffic if the team did not explicitly associate each VPC attachment with a dedicated route table. The correct approach is to create individual route tables for each VPC and associate the respective VPC attachment with its custom route table, ensuring isolation. Option A is incorrect because VPC route tables pointing to the transit gateway are necessary for VPCs to communicate via the transit gateway; they do not cause unintended traffic by themselves. Option B is incorrect because the issue is about which route table the attachments are associated with, not whether route tables exist. Option D is incorrect because propagating Direct Connect routes into all route tables would affect on-premises connectivity, but the issue is specifically inter-VPC traffic.

Answer

The VPC route tables have a route for the other VPC CIDR pointing to the transit gateway.

Answer

The transit gateway route tables are not associated with the VPC attachments.

Answer

The Direct Connect virtual interface is propagating routes into all route tables.

Question 8

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a VPC, public and private subnets, security groups, and an Application Load Balancer. The network team wants to ensure that the ALB can only accept traffic from a specific set of IP addresses. They add a security group rule that allows inbound traffic on port 443 from the allowed IP CIDR. However, after deployment, the ALB is not responding to requests from the allowed IPs. The team checks the security group and confirms the rule exists. They also verify that the ALB is in the public subnet and has a public DNS name. What is the MOST likely cause?

Accepted Answer

The public subnet does not have a route to an internet gateway.. For an internet-facing Application Load Balancer to receive traffic from the internet, its public subnet must have a route to an Internet Gateway (IGW). If the subnet's route table lacks a 0.0.0.0/0 route pointing to an IGW, the ALB cannot communicate with clients even though its security group allows the traffic and it has a public DNS name. This is the most likely cause given the scenario.

Answer

The security group rule is blocking return traffic; security groups are stateful.

Answer

The ALB listener is not configured to forward traffic to the target group.

Answer

The ALB is using an internal scheme instead of internet-facing.

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). An EC2 instance in the private subnet needs to download patches from the internet. The team creates a NAT gateway in the public subnet and updates the private subnet route table to route 0.0.0.0/0 to the NAT gateway. The EC2 instance still cannot reach the internet. The team confirms the NAT gateway has an elastic IP and the public subnet has an internet gateway. What is the MOST likely cause?

Accepted Answer

The network ACL for the private subnet denies outbound traffic to the internet.. The most likely cause is that the network ACL (NACL) for the private subnet denies outbound traffic to the internet. Even though the route table correctly points 0.0.0.0/0 to the NAT gateway, the NACL is a stateless firewall that can block outbound traffic if it doesn't allow the necessary ephemeral ports. It must also allow inbound return traffic. Option A is incorrect because the private subnet route table already has a route to the NAT gateway. Option C is incorrect because the public subnet already has a route to the internet gateway. Option D is incorrect because the NAT gateway is a managed service with source/destination check automatically disabled.

Answer

The private subnet route table does not have a route for the NAT gateway's IP.

Answer

The public subnet does not have a route to the internet gateway.

Answer

The NAT gateway does not have source/destination check disabled.

Question 10

A company has a VPC with an AWS Direct Connect private VIF connected to a virtual private gateway. The on-premises network uses BGP to advertise routes to AWS. The network team wants to ensure that only specific prefixes from on-premises are accepted. They configure the virtual private gateway with a BGP community. However, after configuration, they notice that all prefixes are still being accepted. What is the MOST likely reason?

Accepted Answer

The virtual private gateway does not filter routes based on BGP communities; you need to use a prefix list.. BGP communities are tags that can be applied to routes, but the virtual private gateway (VPG) does not filter routes based on BGP communities. To filter which prefixes are accepted, you must use a prefix list or route table filtering. Therefore, simply configuring a BGP community on the VPG will not prevent all prefixes from being accepted; you need to explicitly filter using a prefix list. Option B is correct. Option A is not needed because BGP communities are already supported. Option C is not the most likely reason because even if the community is advertised, the VPG won't filter based on it. Option D is false because the community can be configured on either side, but filtering still requires a prefix list.

Answer

The virtual private gateway needs to have the BGP community enabled.

Answer

The BGP community is not being advertised by the on-premises router.

Answer

The BGP community must be configured on the customer gateway device.

Question 11

A network engineer manages a VPC (10.0.0.0/16) with a private subnet that hosts a critical database. The engineer wants to capture all traffic that is accepted by the security group attached to the database instance, but only for TCP port 3306. The engineer creates a VPC Flow Log with a filter for accepted traffic. However, the logs show all accepted traffic, not just port 3306. What is the MOST efficient way to capture only the desired traffic?

Accepted Answer

Use AWS Traffic Mirroring to copy traffic from the database instance's ENI to a monitoring appliance, and filter for port 3306.. VPC Flow Logs capture IP traffic metadata but cannot be filtered by port during capture. To capture only specific traffic, AWS Traffic Mirroring is the appropriate service because it allows packet-level filtering based on port, protocol, and other criteria. It sends mirrored traffic to a target, such as a Network Load Balancer or an EC2 instance, for analysis.

Answer

Modify the flow log filter to include a condition for port 3306 using the AWS CLI.

Answer

Enable VPC Flow Logs on the subnet and use Amazon CloudWatch Logs Insights to query for port 3306.

Answer

Create a network ACL rule to allow only port 3306 and enable flow logs on the network ACL.

Question 12

A network engineer manages a VPC with a Transit Gateway. The engineer notices that traffic between two VPC attachments is taking an unexpected path through a third VPC attachment, causing increased latency. The engineer wants to identify the actual path taken by packets. Which AWS tool or feature should the engineer use to trace the path of a specific flow?

Accepted Answer

AWS Transit Gateway Network Manager Route Analyzer. AWS Transit Gateway Network Manager Route Analyzer is designed to analyze and simulate routing paths across transit gateway route tables. It shows the exact sequence of attachments a packet would traverse, which is essential for diagnosing suboptimal routing in a multi-attachment transit gateway setup. Other tools like VPC Flow Logs or Reachability Analyzer do not provide this hop-by-hop path information.

Answer

VPC Reachability Analyzer

Answer

VPC Flow Logs with custom format including the `flow-direction` field

Answer

AWS CloudTrail with VPC Flow Logs integration

Question 13

A company runs a critical web application in a VPC. The security team wants to capture only the traffic that is accepted by a specific network ACL (NACL) on a subnet. They have enabled VPC Flow Logs at the subnet level. Which additional configuration is required to meet this requirement?

Accepted Answer

Configure the subnet flow logs to capture only ACCEPT traffic by setting the traffic type to ACCEPT.. VPC Flow Logs can be configured at the subnet level with a filter to capture only ACCEPT traffic. This allows the security team to focus on traffic that is allowed by the NACL, reducing noise from rejected traffic. The filter is a standard feature of flow logs and directly addresses the requirement without additional services.

Answer

Use AWS CloudTrail to log NACL changes and correlate with flow logs.

Answer

Create a custom metric in Amazon CloudWatch based on the NACL's accepted packets.

Answer

Enable flow logs at the VPC level and filter for ACCEPT traffic.

Question 14

A company has a transit gateway with multiple VPC attachments and a VPN attachment to on-premises. The network engineer needs to monitor all traffic that traverses the transit gateway for compliance. The engineer enables VPC Flow Logs on all VPCs, but notices that traffic between VPCs attached to the transit gateway is not fully captured. What should the engineer do to capture all transit gateway traffic?

Accepted Answer

Enable VPC Flow Logs on the transit gateway itself.. AWS Transit Gateway supports flow logs, which can be enabled on the transit gateway itself. This captures traffic that traverses the transit gateway, including inter-VPC and VPN traffic. VPC Flow Logs alone do not capture all transit gateway traffic because traffic between VPCs may not be logged in the individual VPCs if it is routed through the transit gateway.

Answer

Enable flow logs on the transit gateway attachment for each VPC.

Answer

Use AWS Transit Gateway Network Manager to log all traffic.

Answer

Create a traffic mirror session on each VPC attachment to mirror traffic to a central monitoring VPC.

Question 15

A company runs a global web application with Application Load Balancers (ALBs) in us-east-1 and eu-west-1. The network team wants to ensure that users are routed to the closest healthy ALB and that failover occurs automatically if an ALB becomes unhealthy. They also want to minimize latency for users. Which solution should the network engineer implement?

Accepted Answer

Create an Amazon Route 53 latency-based routing policy with health checks for each ALB, and associate both ALBs with the same domain name.. Latency-based routing in Amazon Route 53 directs users to the AWS region that provides the lowest latency. When combined with health checks, Route 53 automatically removes unhealthy endpoints from DNS responses, ensuring high availability. This approach is ideal for global applications that require both performance and automatic failover without manual intervention.

Answer

Configure an Amazon CloudFront distribution with both ALBs as origins and enable origin failover.

Answer

Use AWS Global Accelerator with endpoint groups in both regions, and configure traffic dials to route based on latency.

Answer

Create an Amazon Route 53 weighted routing policy with equal weights for each ALB and enable health checks.