ANS-C01 Network Management and Operations Practice Test 16 — 15 Questions

Question 1

A company wants to monitor network traffic between VPCs in the same AWS Region that are connected via VPC Peering. Which AWS service can provide visibility into the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs can be enabled on the peering connection to capture traffic. Option B is wrong because AWS Config does not capture network traffic. Option C is wrong because AWS Direct Connect is for on-premises connectivity, not VPC traffic monitoring. Option D is wrong because AWS CloudTrail does not capture network traffic (it logs API calls).

Answer

AWS Config

Answer

AWS Direct Connect

Answer

AWS CloudTrail

Question 2

A network engineer is monitoring network performance between an EC2 instance and an on-premises server using AWS VPN. The engineer notices intermittent packet loss. Which AWS service can provide detailed network metrics and path visualization to troubleshoot?

Accepted Answer

AWS Transit Gateway Network Manager. AWS X-Ray is for application tracing, not network path. VPC Flow Logs provide packet metadata but not path visualization. Amazon CloudWatch can monitor VPN tunnels but not path. AWS Transit Gateway Network Manager provides network topology and path visualization.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS X-Ray

Question 3

A network engineer is troubleshooting a VPN connectivity issue. The VPN tunnel is up, but traffic is not passing. Which TWO AWS services should the engineer use to diagnose the problem?

Accepted Answer

VPC Flow Logs. The correct answers are B and E. VPC Flow Logs capture IP traffic information for network interfaces, which can show if traffic is reaching the VPN endpoint. Amazon CloudWatch provides VPN tunnel metrics (e.g., tunnel state, data in/out) and logs, helping to diagnose connectivity issues. Option A (AWS Config) is incorrect because it tracks resource configuration changes, not network traffic. Option C (AWS CloudTrail) is incorrect because it logs API calls, not data plane traffic. Option D (AWS Direct Connect) is incorrect because it is a dedicated connection service, not a diagnostic tool for VPN.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Direct Connect

Question 4

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect but cannot access any resources. The VPN is configured with a security group that allows all traffic. What should the administrator check?

Accepted Answer

The client VPN authorization rules. Client VPN uses an authorization rule to allow access to specific networks. Without an authorization rule, even if the security group allows traffic, the VPN will not forward traffic.

Answer

The client VPN security group inbound rules

Answer

The client VPN endpoint certificate

Answer

The client VPN route table

Question 5

A company wants to implement a network monitoring solution that provides real-time traffic analysis and anomaly detection. Which THREE AWS services should be used together?

Accepted Answer

Amazon GuardDuty. The correct answers are B (Amazon GuardDuty), C (VPC Flow Logs), and E (Amazon CloudWatch). VPC Flow Logs capture network traffic information, which can be sent to CloudWatch for metrics and alarms, and GuardDuty provides anomaly detection using threat intelligence. Option A (AWS Config) is incorrect because it is used for resource configuration tracking, not network traffic analysis. Option D (AWS CloudTrail) is incorrect because it logs API calls, not network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Question 6

A company has multiple VPCs connected via VPC peering. They want to simplify network management and reduce the number of peering connections. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks, reducing the need for full mesh peering.

Answer

AWS PrivateLink

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect Gateway

Question 7

A network engineer needs to monitor network performance between an on-premises data center and AWS via Direct Connect. Which TWO metrics should the engineer monitor in Amazon CloudWatch?

Accepted Answer

VirtualInterfaceBgpState. The correct answers are A and B. VirtualInterfaceBgpState indicates the BGP session status for the virtual interface, which is critical for monitoring Direct Connect connectivity. ConnectionBandwidthUtilization measures the bandwidth usage on the Direct Connect connection. Options C, D, and E (Jitter, PacketLoss, Latency) are not standard Direct Connect CloudWatch metrics; they are typically measured using additional tools like Amazon CloudWatch Synthetics or third-party solutions.

Answer

Jitter

Answer

PacketLoss

Answer

Latency

Question 8

Which TWO actions are recommended to troubleshoot asymmetric routing in a VPC with multiple NAT gateways?

Accepted Answer

Use a single NAT gateway per Availability Zone. Asymmetric routing occurs when traffic takes different paths. Using a single NAT gateway per AZ and ensuring route tables point to the NAT gateway in the same subnet's AZ can prevent this. Additionally, disabling source/destination check on instances that do not need it can help, but for NAT gateways, this is not configurable.

Answer

Enable source/destination check on all EC2 instances

Answer

Use a Network Load Balancer to distribute traffic

Answer

Disable VPC Flow Logs

Question 9

Refer to the exhibit. A company has created a VPC endpoint for S3. However, an EC2 instance in the subnet associated with the route table cannot access S3 via the endpoint. The route table has a route to the endpoint. What is the most likely cause?

Accepted Answer

Private DNS is not enabled. The endpoint policy is set to Allow all, which is fine. However, the PrivateDnsEnabled is false, meaning that DNS resolution for S3 endpoints does not resolve to the endpoint IP. To use the endpoint, either enable Private DNS or use the endpoint-specific DNS name. Option A is wrong because the endpoint state is 'available'. Option B is wrong because the route table is associated. Option D is wrong because the security group is not specified (empty), but default SG allows all outbound traffic.

Answer

The endpoint is in 'pending' state

Answer

The route table is not associated with the subnet

Answer

The security group is blocking traffic

Question 10

Which THREE factors should be considered when designing a highly available AWS Site-to-Site VPN connection?

Accepted Answer

Enable BGP for dynamic route propagation. BGP (Border Gateway Protocol) enables dynamic route propagation across the VPN tunnels, allowing automatic failover and route convergence if one tunnel goes down. This is critical for high availability because it eliminates the need for manual route updates and supports path selection based on BGP attributes, ensuring traffic is rerouted through the remaining healthy tunnel.

Answer

Use two VPN tunnels with the same customer gateway IP

Answer

Use a single VPN tunnel with a static route

Question 11

Refer to the exhibit. A network engineer is creating an IAM policy to allow a user to manage VPC Peering connections. The user reports that they cannot delete a VPC Peering connection. What should the engineer add to the policy?

Accepted Answer

ec2:DeleteVpcPeeringConnection. Ec2:DeleteVpcPeeringConnection. The user cannot delete a VPC peering connection because the policy does not include this action. Option B, ec2:DescribeVpcPeeringConnectionRouteTables, is not a valid action and does not relate to deletion. Option C, ec2:ModifyVpcPeeringConnectionOptions, is for modifying options, not deletion. Option D, ec2:RejectVpcPeeringConnection, is for rejecting pending connections, not deleting an existing one. Therefore, adding ec2:DeleteVpcPeeringConnection to the policy will resolve the issue.

Answer

ec2:DescribeVpcPeeringConnectionRouteTables

Answer

ec2:ModifyVpcPeeringConnectionOptions

Answer

ec2:RejectVpcPeeringConnection

Question 12

Refer to the exhibit. A network engineer created a NAT gateway in a public subnet, but its state shows 'failed'. What is the most likely cause?

Accepted Answer

The Elastic IP is already associated with another instance. A NAT gateway requires an Elastic IP that is not associated with any other resource. If the Elastic IP is already associated with another instance or NAT gateway, the NAT gateway creation fails. Option A is incorrect because the subnet must have a route to an internet gateway to be public, but that is not the cause of the failure. Option B is incorrect because the NAT gateway is explicitly placed in a public subnet. Option C is incorrect because the state 'failed' indicates the creation did not succeed, not that it is still pending.

Answer

The subnet does not have a route to an internet gateway

Answer

The subnet is private

Answer

The NAT gateway is still being created

Question 13

Which TWO AWS services can be used to centrally manage and monitor network traffic across multiple VPCs and on-premises networks?

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager provides a central view of network topology and metrics. Amazon CloudWatch can aggregate logs and metrics from multiple sources.

Answer

AWS WAF

Answer

AWS Direct Connect

Answer

AWS Shield

Question 14

A company is experiencing intermittent SSH connection failures to their EC2 instances in a VPC. The instances are in a private subnet with a NAT gateway. The security group allows inbound SSH from the corporate CIDR. The network ACL is set to default allow all. The route table has a route to the NAT gateway for 0.0.0.0/0. What is the most likely cause of the intermittent failures?

Accepted Answer

The NAT gateway does not have an Elastic IP associated.. The NAT gateway requires an associated Elastic IP to function correctly. Without it, the NAT gateway cannot be created or fails to operate, leading to intermittent connectivity issues for instances in the private subnet. Since the instances rely on the NAT gateway for outbound traffic (e.g., to reach configuration endpoints or DNS), any failure in the NAT gateway can disrupt SSH sessions that depend on such outbound communication. Option A is incorrect because the network ACL is set to default allow all, so it does not block ephemeral ports. Option B is incorrect because a proxy is not typically required for SSH connections in this setup. Option C is incorrect because security groups are stateful, meaning outbound rules do not block return traffic from allowed inbound connections.

Answer

The network ACL inbound rule is blocking ephemeral ports.

Answer

The instances are behind a proxy that is not configured.

Answer

The security group outbound rules are not allowing return traffic.

Question 15

A company has a transit gateway with multiple VPC attachments and an on-premises VPN connection. The network team is seeing asymmetric routing and packet drops. What should they implement to resolve this?

Accepted Answer

Use BGP ASN prepending on the on-premises routers.. BGP ASN prepending on the on-premises routers can influence the path selection by making one path less preferred, thereby breaking the equal-cost multipath (ECMP) behavior that causes asymmetric routing. AWS Transit Gateway does not support disabling ECMP; it always uses ECMP for equal-cost paths. By prepending ASN, the on-premises side advertises routes with a longer AS path, making the VPN path less attractive and forcing all traffic through a single preferred path, resolving asymmetry. Option A is incorrect because AWS Transit Gateway does not allow ECMP to be disabled. Option B is incorrect because VPC peering does not address routing through a Transit Gateway. Option D is incorrect because route propagation simply advertises routes and does not affect ECMP behavior.

Answer

Disable equal-cost multipath (ECMP) routing on the Transit Gateway.

Answer

Create VPC peering connections between all VPCs.

Answer

Enable route propagation from the Transit Gateway to VPC route tables.