ANS-C01 Network Management and Operations Practice Test 16 — 15 Questions

Question 1

A network engineer is deploying a new VPC and needs to ensure that all outbound internet traffic from private subnets is routed through a NAT gateway. The engineer has created a NAT gateway in a public subnet. Which TWO additional steps are required to enable this routing? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the NAT gateway is associated with an Elastic IP address.. To enable outbound internet traffic from private subnets through a NAT gateway, you must update the private subnets' route table to direct 0.0.0.0/0 to the NAT gateway, and the NAT gateway must have an Elastic IP address associated. These two steps are essential; without either, the routing will not work. Other options are either already required for the public subnet or are not applicable to NAT gateways.

Answer

Create a VPC endpoint for the NAT gateway service.

Answer

Attach an internet gateway to the VPC and update the public subnet's route table to point to the internet gateway.

Answer

Configure a security group on the NAT gateway to allow outbound traffic.

Question 2

A company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The company also has a backup VPN connection over the internet. The network engineer wants to ensure that traffic to the VPC prefers the Direct Connect connection but fails over to the VPN if the Direct Connect goes down. The engineer has configured BGP with the Direct Connect connection and the VPN. Which configuration should the engineer apply to achieve this?

Accepted Answer

Apply AS_PATH prepending to the routes advertised over the VPN connection.. To prefer Direct Connect over VPN for traffic entering AWS, the engineer can manipulate BGP attributes on the routes advertised from on-premises to AWS. AS_PATH prepending on the VPN-advertised routes makes the AS path longer, so BGP on the AWS side will prefer the shorter path via Direct Connect. If Direct Connect fails, the VPN routes become the best available, providing failover. This method works across autonomous systems and is a common practice for influencing inbound traffic.

Answer

Set a lower Multi-Exit Discriminator (MED) value on the VPN connection than on the Direct Connect connection.

Answer

Advertise more specific routes over the VPN connection than over the Direct Connect connection.

Answer

Set a higher BGP local preference on the VPN connection than on the Direct Connect connection.

Question 3

A company runs a production VPC with a single NAT gateway in one Availability Zone. The network team wants to monitor how many bytes are transferred through the NAT gateway to identify cost anomalies. They enable VPC Flow Logs on the NAT gateway's elastic network interface. After 24 hours, they notice that the flow logs show traffic to and from the NAT gateway's private IP address, but they cannot correlate it to specific EC2 instances. What is the most likely reason for this limitation?

Accepted Answer

VPC Flow Logs on a NAT gateway's ENI capture traffic after NAT translation, so the source IP is the NAT gateway's private IP, not the originating instance.. NAT gateways apply source NAT, replacing the originating instance's private IP with the NAT gateway's private IP. Flow logs on the NAT gateway's ENI therefore show the NAT gateway's IP as the source, not the instance's IP. To correlate traffic to specific instances, you would need flow logs on the instances' ENIs or use other mechanisms like VPC Traffic Mirroring.

Answer

VPC Flow Logs cannot be enabled on NAT gateways; only on EC2 instances and VPC subnets.

Answer

VPC Flow Logs only capture traffic that is accepted by security groups, and the NAT gateway's security group is blocking outbound traffic.

Answer

VPC Flow Logs on a NAT gateway's ENI capture traffic before NAT translation, so the source IP is the private IP of the originating instance.

Question 4

A network engineer is using AWS Transit Gateway Network Manager to monitor a global network. The engineer wants to receive alerts when the state of a Transit Gateway attachment changes to 'blackhole'. Which action should the engineer take to achieve this?

Accepted Answer

Configure a Network Manager event subscription for the Transit Gateway attachment state change event and publish to an SNS topic.. Network Manager provides visibility into Transit Gateway attachments and can generate events when the state changes, including to 'blackhole'. By creating an event subscription in Network Manager, you can route these events to Amazon EventBridge and then to SNS for alerts. This is the native and most direct way to monitor attachment states across a global network.

Answer

Create an Amazon CloudWatch alarm on the Transit Gateway attachment state metric and configure an SNS topic for notifications.

Answer

Use AWS CloudTrail to monitor for Transit Gateway attachment state change API calls and create an EventBridge rule to send alerts.

Answer

Enable VPC Flow Logs on the Transit Gateway attachment and analyze the logs for dropped packets.

Question 5

A financial services company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The company requires that all traffic between on-premises and AWS be encrypted in transit. The network engineer must implement a solution that provides encryption without modifying the on-premises network equipment. Which solution meets these requirements?

Accepted Answer

Configure a Site-to-Site VPN over the Direct Connect private VIF using a Transit Gateway.. To encrypt traffic over Direct Connect without changing on-premises equipment, the best approach is to run a Site-to-Site VPN over the Direct Connect private VIF. This is often called a VPN over Direct Connect or a private VIF with VPN. It uses the existing Direct Connect connection for transport and adds IPsec encryption. The VPN termination can be on a Transit Gateway or a Virtual Private Gateway, and the on-premises side only needs to configure the VPN tunnel, which is typically already supported.

Answer

Enable MACsec on the Direct Connect connection at the AWS side.

Answer

Use AWS VPN CloudHub to encrypt traffic between the on-premises network and the VPC.

Answer

Implement a software-based VPN appliance on an EC2 instance in the VPC and route traffic through it.

Question 6

A company has a hybrid network with an AWS Direct Connect connection and a VPN backup. The network engineer needs to ensure that traffic to on-premises fails over to the VPN if the Direct Connect becomes unavailable. The engineer has configured BGP on both connections. Which TWO actions should the engineer take to achieve automatic failover? (Choose two.)

Accepted Answer

Configure the on-premises router to prefer the Direct Connect BGP session by setting a lower MED.. To achieve automatic failover from Direct Connect to VPN, you need to ensure that the Direct Connect path is preferred when both are up. AS_PATH prepending on the VPN makes it less preferred, and setting a lower MED on the Direct Connect advertisements makes it more preferred. Together, these BGP manipulations enable seamless failover.

Answer

Advertise more specific prefixes over the VPN than over the Direct Connect.

Answer

Configure the VPN connection to use a higher BGP priority than the Direct Connect.

Answer

Set a higher BGP local preference for routes learned over the Direct Connect.

Question 7

A company uses AWS Transit Gateway to connect 30 VPCs across three AWS Regions. The network team needs to verify whether a specific transit gateway route table is propagating routes to a VPC attachment. They have enabled Transit Gateway Network Manager and want to inspect the current route propagation status and next-hop information for that attachment. Which AWS feature or tool provides this specific information with the least operational overhead?

Accepted Answer

Transit Gateway Network Manager route analyzer. Transit Gateway Network Manager provides centralized visibility into transit gateway route tables, including propagation status and next-hop reachability for attachments across Regions. The route analyzer feature is built specifically to answer whether a given attachment has learned or propagated a route. Other tools such as CloudTrail, VPC Flow Logs, or Resource Access Manager do not expose live route propagation state.

Answer

VPC Flow Logs with a custom format including transit gateway attachment ID

Answer

AWS Resource Access Manager sharing the transit gateway route table

Answer

AWS CloudTrail event history filtered by DescribeTransitGatewayRouteTables

Question 8

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection is established, but the on-premises network can only reach some subnets in the VPC. The network engineer suspects that the issue is related to route propagation. Which action should the engineer take to ensure that all VPC subnets are reachable from on-premises?

Accepted Answer

Enable route propagation for the virtual private gateway in all VPC route tables.. Enabling route propagation on all VPC route tables ensures that routes to the on-premises network are automatically added, allowing all subnets to communicate with on-premises. Without propagation, subnets whose route tables lack a route to the virtual private gateway will not be able to send traffic back to on-premises, resulting in partial connectivity.

Answer

Add a static route to the virtual private gateway in the VPC route tables for each subnet.

Answer

Modify the VPN connection to use a different tunnel inside IP address.

Answer

Associate the virtual private gateway with all VPC route tables.

Question 9

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. A network engineer needs to monitor traffic flow between specific VPC attachments and wants to capture only the traffic that is dropped due to security group rules. The engineer has enabled VPC Flow Logs on the VPCs but is not seeing the desired information. What is the most likely reason for this?

Accepted Answer

The flow logs are configured at the VPC level, but the traffic between VPC attachments traverses the Transit Gateway and is not captured by VPC Flow Logs.. VPC Flow Logs operate at the ENI level and do not capture traffic that traverses a Transit Gateway between VPC attachments because that traffic does not pass through an ENI in the VPC. To monitor dropped traffic between VPCs connected via Transit Gateway, the engineer should use Transit Gateway Flow Logs, which can capture traffic at the attachment level. The other options either misstate flow log capabilities or assume a filter issue that is less likely given the scenario.

Answer

VPC Flow Logs do not capture traffic that is denied by security groups; they only capture traffic that is allowed.

Answer

The flow logs are configured with a filter of ACCEPT, so they only capture allowed traffic and not dropped traffic.

Answer

Security group rules are stateful, so dropped traffic is not logged by VPC Flow Logs.

Question 10

A company has a hybrid network with an AWS Direct Connect connection using a private VIF to access resources in a VPC. The company also has a VPN connection over the internet as a backup. The network team wants to ensure that traffic to on-premises uses the Direct Connect connection when it is available and fails over to the VPN if Direct Connect goes down. They have configured BGP on both connections. What should they do to achieve this?

Accepted Answer

Use BGP attributes to make Direct Connect preferred, such as lower MED or higher local preference.. To prefer Direct Connect, you can manipulate BGP attributes on the on-premises router. Higher local preference or lower MED makes a path more preferred. When Direct Connect is active, its routes are chosen; if it fails, BGP withdrawals cause the VPN routes to be used. This provides automatic failover.

Answer

Advertise more specific routes over the VPN and less specific routes over Direct Connect.

Answer

Set the Direct Connect connection to use a lower BGP weight than the VPN connection.

Answer

Configure AS_PATH prepending on the Direct Connect connection to make it less preferred.

Question 11

A network engineer is troubleshooting a VPC that has a NAT gateway. Instances in a private subnet cannot reach the internet. The engineer has verified that the route table for the private subnet has a route to 0.0.0.0/0 pointing to the NAT gateway, and the NAT gateway is in a public subnet with an internet gateway route. The NAT gateway's status is 'Available'. Which additional check should the engineer perform to resolve the issue?

Accepted Answer

Check the network ACL for the public subnet that contains the NAT gateway to ensure it allows inbound and outbound traffic on ephemeral ports.. Network ACLs in the public subnet must allow inbound traffic on ephemeral ports (1024-65535) for return traffic from the NAT gateway to the instances. Since network ACLs are stateless, they do not automatically allow return traffic. This is a frequent cause of NAT gateway connectivity issues. Other checks like elastic IP association or security group outbound rules are less likely to be the root cause.

Answer

Verify that the internet gateway is attached to the VPC and that the public subnet's route table has a route to 0.0.0.0/0 pointing to the internet gateway.

Answer

Verify that the NAT gateway's elastic IP is associated with the NAT gateway.

Answer

Ensure that the instances in the private subnet have a security group that allows outbound traffic to 0.0.0.0/0.

Question 12

A company is using AWS Direct Connect with a private VIF to connect to a VPC. The network engineer notices that traffic is not flowing over the Direct Connect connection; instead, it is using the internet. The engineer has verified that the virtual interface is up and BGP sessions are established. Which TWO actions should the engineer take to troubleshoot and resolve the issue? (Choose two.)

Accepted Answer

Check the VPC route table to ensure there is a route to the on-premises network pointing to the virtual private gateway.. For traffic to flow over Direct Connect, the VPC route table must have a route to the on-premises CIDR pointing to the virtual private gateway, and the on-premises router must advertise those prefixes via BGP. Without these, traffic may fall back to the internet gateway. The other options are either already satisfied or would not resolve the issue.

Answer

Verify that the on-premises router is configured with a default route pointing to the Direct Connect virtual interface.

Answer

Ensure that the Direct Connect gateway is associated with the virtual private gateway.

Answer

Check that the virtual interface's VLAN ID matches the VLAN ID configured on the on-premises router.

Question 13

A company has a hybrid network with an AWS Direct Connect connection and a Site-to-Site VPN as backup. The network engineer wants to ensure that if the Direct Connect connection fails, traffic automatically fails over to the VPN. The engineer has configured BGP on both connections. Which configuration is required to achieve automatic failover?

Accepted Answer

On the AWS side, configure the Direct Connect virtual interface with a lower BGP AS_PATH prepend than the VPN, and on the on-premises side, set a higher LOCAL_PREF for Direct Connect routes.. Automatic failover between Direct Connect and VPN requires influencing BGP path selection on both sides. On the AWS side, AS_PATH prepending on the VPN makes it less preferred for inbound traffic. On the on-premises side, a higher LOCAL_PREF for Direct Connect routes ensures outbound traffic prefers Direct Connect. When Direct Connect fails, the VPN becomes the active path.

Answer

Use AWS Global Accelerator to automatically fail over between Direct Connect and VPN.

Answer

Configure the on-premises router to prefer the Direct Connect connection by setting a higher LOCAL_PREF for routes learned over Direct Connect, and a lower LOCAL_PREF for VPN routes.

Answer

Advertise the same BGP community on both the Direct Connect and VPN connections.

Question 14

A company uses AWS Transit Gateway to connect 40 VPCs and an on-premises network over an AWS Site-to-Site VPN. The network team notices that traffic between two VPCs attached to the same transit gateway is being routed through the on-premises network instead of directly through the transit gateway. All VPC route tables have a default route (0.0.0.0/0) pointing to the transit gateway, and the transit gateway route table has a default route pointing to the VPN attachment. What is the MOST likely cause of this suboptimal routing?

Accepted Answer

The transit gateway route table has a static route for the VPC CIDRs pointing to the VPN attachment, which takes precedence over the VPC attachments.. Transit gateway route tables evaluate static routes before propagated routes. A static route for VPC CIDRs pointing to the VPN attachment causes inter-VPC traffic to be sent to the VPN instead of directly between VPC attachments. Removing that static route or ensuring more specific VPC attachment routes are preferred resolves the suboptimal path. The correct answer identifies this precedence issue.

Answer

The VPC attachments are associated with a different transit gateway route table that does not have routes to the other VPCs.

Answer

The VPC route tables do not have explicit routes for the remote VPC CIDRs, so traffic falls back to the default route through the VPN.

Answer

The transit gateway does not support direct VPC-to-VPC routing when a VPN attachment is present; all traffic must traverse the VPN.

Question 15

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. A network engineer notices that traffic between two VPC attachments is being dropped intermittently. The engineer suspects that the Transit Gateway route tables are misconfigured. The Transit Gateway has a default route table and a custom route table. VPC A is associated with the default route table and propagated to the custom route table. VPC B is associated with the custom route table but is not propagated to the default route table. Both VPCs have CIDRs that do not overlap. Which of the following changes will allow traffic from VPC A to reach VPC B?

Accepted Answer

Propagate VPC B to the default route table.. The correct action is to propagate VPC B to the default route table. VPC A is associated with the default route table and needs a route to VPC B's CIDR. VPC B is associated with the custom route table, which already has VPC A propagated, so return traffic is possible. Propagating VPC B to the default route table provides the missing route without disrupting existing associations.

Answer

Associate VPC B with the default route table and propagate VPC B to the default route table.

Answer

Associate VPC A with the custom route table and propagate VPC A to the custom route table.

Answer

Propagate VPC B to the default route table and ensure VPC B's attachment is associated with the default route table.