ANS-C01 Network Management and Operations Practice Test 17 — 15 Questions

Question 1

A network engineer is troubleshooting high latency on a VPN connection between an on-premises network and AWS. The VPN uses two tunnels to a virtual private gateway. The engineer notices that traffic is only using one tunnel, and the other tunnel is idle. What should the engineer do to ensure both tunnels are utilized?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create two separate site-to-site VPN connections to two different virtual private gateways and enable ECMP.. Creating two separate site-to-site VPN connections, each to a different virtual private gateway, and enabling ECMP (Equal Cost Multipath Routing) allows traffic to be load-balanced across both tunnels. AWS site-to-site VPN connections by default operate in active/passive mode, using only one tunnel at a time. To achieve active/active usage, you need multiple VPN connections with ECMP. Option B (BGP MED) is incorrect because MED influences path selection but cannot force both tunnels to be used simultaneously when the underlying VPN is active/passive. Option C (static routes with equal metrics) is incorrect because static routes do not enable ECMP for a single VPN connection; AWS still treats tunnels as active/passive. Option D (transit gateway with ECMP) is incorrect because while a transit gateway can use ECMP across multiple VPN connections, the original scenario describes a single VPN connection to a virtual private gateway, not a transit gateway.

Answer

Configure BGP MED values to prefer the idle tunnel.

Answer

Configure static routes with equal metrics on both tunnels.

Answer

Use a transit gateway with equal cost multipath routing.

Question 2

A financial services company uses AWS Direct Connect to connect its data center to multiple VPCs via a transit gateway. They need to meet PCI DSS compliance requirements by encrypting all traffic between the data center and AWS. What solution meets this requirement with the least operational overhead?

Accepted Answer

Enable MACsec on the Direct Connect connection.. MACsec (Option A) is the correct solution because it provides encryption at Layer 2 directly on the Direct Connect connection, ensuring all traffic is encrypted with minimal overhead and no additional configuration. This meets PCI DSS requirements with the least operational overhead. Option B (TLS) only encrypts application-level traffic, not all traffic. Option C (private VIFs) does not encrypt traffic by default. Option D (IPsec VPN over Direct Connect) adds complexity and operational overhead compared to MACsec.

Answer

Use TLS for all application traffic between data center and VPC.

Answer

Use private VIFs without additional encryption.

Answer

Create an IPsec VPN tunnel over the Direct Connect VIF to encrypt traffic.

Question 3

A company uses AWS Direct Connect with a private VIF to connect to their VPC. They want to monitor the network latency between their on-premises router and the AWS Direct Connect location. Which AWS service should they use?

Accepted Answer

AWS Direct Connect metrics in CloudWatch. AWS Direct Connect publishes metrics such as latency (round-trip time) and BGP session state to CloudWatch. These metrics can be used to monitor network latency between on-premises and the Direct Connect location. Option B is incorrect because AWS X-Ray is for tracing application requests, not network infrastructure latency. Option C is incorrect because VPC Flow Logs capture IP traffic metadata (e.g., sources, destinations, ports), not latency. Option D is incorrect because CloudWatch Synthetics monitors endpoint availability and response times via canaries, not Direct Connect link latency.

Answer

AWS X-Ray

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Synthetics

Question 4

A company has a VPC with public and private subnets. The private subnets use a NAT gateway for outbound internet access. The security team notices that some EC2 instances in the private subnets are able to reach the internet, but others are not. All instances have the same security group and are in the same private subnet. What is the most likely cause?

Accepted Answer

The NAT gateway's security group is blocking traffic from some instances.. The most likely cause is that the NAT gateway's security group (attached to its elastic network interface) is blocking traffic from some instances. Although all EC2 instances are in the same private subnet and have the same security group, the NAT gateway's own security group can be configured to allow outbound traffic only from specific source IPs or security groups. If the NAT gateway's security group only permits traffic from certain instances' private IPs (or security groups) within the subnet, it would allow some instances to reach the internet while blocking others. Option A is incorrect because a missing route would affect all instances in that subnet equally. Option B is incorrect because a network ACL applies to the entire subnet and would block all instances. Option D is incorrect because the internet gateway is attached to the VPC, not directly to private subnets, and its absence would prevent all internet access.

Answer

The route table associated with the private subnet is missing a default route to the NAT gateway.

Answer

The network ACL is blocking outbound traffic on ephemeral ports.

Answer

The internet gateway is not attached to the VPC.

Question 5

A company uses AWS Client VPN to provide remote access to its VPC. Users report slow connection speeds. The CloudWatch metrics show high packet loss on the VPN connections. What is the most likely cause?

Accepted Answer

MTU mismatch between the client and the VPN endpoint.. An MTU mismatch between the client and VPN endpoint can cause fragmentation and packet loss, leading to slow speeds. Option A is incorrect because an expired certificate would cause authentication failure, not packet loss. Option B is incorrect because subnet size affects IP address availability, not packet loss. Option D is incorrect because route propagation affects reachability, not packet loss.

Answer

The client certificate has expired.

Answer

The Client VPN subnet is too small.

Answer

Route propagation is not enabled in the VPC route table.

Question 6

A network engineer is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. The VPCs are in the same region. After accepting the peering request, instances in VPC-A cannot communicate with instances in VPC-B. What should the engineer check first?

Accepted Answer

The route tables in both VPCs have routes to the peer VPC CIDR.. For VPC peering to work, each VPC's route table must have a route to the peer VPC's CIDR block pointing to the peering connection. Without these routes, traffic will not be directed across the peering link. Option A is incorrect because security groups are stateful and can allow traffic, but they are not the first check; the routing issue is more fundamental. Option B is incorrect because network ACLs are stateless and could block traffic, but again, routing is the primary concern. Option D is incorrect because while the VPC peering connection status should be 'active' for traffic to flow, the most common issue after accepting the request is missing route table entries; thus, checking route tables should be the first step.

Answer

The security groups in both VPCs allow traffic from the peer VPC CIDR.

Answer

The network ACLs in both VPCs allow traffic from the peer VPC CIDR.

Answer

The VPC peering connection status is 'active'.

Question 7

A company has deployed a Network Load Balancer (NLB) in front of a fleet of EC2 instances in a VPC. The NLB is configured with a TCP listener on port 443. Clients are experiencing timeouts. The target group health checks are passing. What is the most likely cause?

Accepted Answer

The security group for the EC2 instances does not allow traffic from the NLB.. Security groups must allow traffic from the NLB's private IP addresses. Option A is incorrect because cross-zone load balancing affects distribution, not timeouts. Option B is incorrect because health checks passing means targets are healthy. Option D is incorrect because deletion protection prevents accidental deletion, not timeouts.

Answer

Cross-zone load balancing is disabled.

Answer

Deletion protection is enabled on the NLB.

Answer

The target group is using an incorrect health check path.

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They want to monitor the number of packets dropped due to route table limits. Which CloudWatch metric should they use?

Accepted Answer

PacketsDroppedByRouteTable. The correct CloudWatch metric to monitor the number of packets dropped due to Transit Gateway route table limits is 'PacketsDroppedByRouteTable'. This metric specifically counts packets dropped because the route table is at capacity. 'BytesDroppedByRouteTable' measures bytes dropped, not packets. Option A ('PacketsIn') tracks incoming packets, not dropped. Option C ('BytesOut') measures outgoing traffic volume. Option D ('BytesDroppedByRouteTable') is the byte equivalent, but the question asks for the number of packets.

Answer

PacketsIn

Answer

BytesOut

Answer

BytesDroppedByRouteTable

Question 9

A network engineer is setting up an AWS Site-to-Site VPN connection. The customer gateway device is behind a NAT device that performs PAT. The VPN tunnel fails to come up. What is the most likely cause?

Accepted Answer

The NAT device is not forwarding UDP 500 and UDP 4500 traffic.. IPsec requires UDP ports 500 and 4500, which must be forwarded through the NAT device. Option A is incorrect because tunnel options such as DPD and encryption algorithms do not need to match exactly for the tunnel to come up. Option B is incorrect because disabling DPD does not prevent tunnel establishment; it only affects detection of peer failure. Option C is incorrect because route propagation does not affect the establishment of the VPN tunnel itself; it affects routing of traffic once the tunnel is up.

Answer

The tunnel options (DPD, encryption algorithms) must match exactly.

Answer

Dead peer detection (DPD) is disabled.

Answer

The VPN connection does not have route propagation enabled.

Question 10

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach any resources in the VPC. What is the most likely cause?

Accepted Answer

The Client VPN endpoint does not have a subnet association.. If users can connect to the VPN but cannot reach resources in the VPC, the most likely cause is that the Client VPN endpoint lacks a subnet association. Without a subnet association, the endpoint cannot route traffic to the VPC. Option A is incorrect because authorization rules control which users can access specific resources, but the issue is broader connectivity. Option C is incorrect because the security group controls inbound traffic to the endpoint, but the connection itself works; the problem is routing. Option D is incorrect because DNS configuration affects name resolution, not basic IP reachability.

Answer

The authorization rules do not include the client's group.

Answer

The Client VPN endpoint security group does not allow inbound traffic from the client CIDR.

Answer

The client's VPN software is not configured with the correct DNS server.

Question 11

A company uses AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They notice that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What configuration change should be made to ensure optimal routing?

Accepted Answer

Enable route propagation from the VPC attachments into the Transit Gateway route table.. Transit Gateway route tables control the path; enabling route propagation from VPC attachments will add routes for direct VPC-to-VPC communication. Option B is incorrect because cross-zone load balancing is a feature of load balancers, not Transit Gateway routing. Option C is incorrect because adding static routes to the VPN attachment would force traffic through the VPN, which is suboptimal. Option D is incorrect because modifying VPC route tables to point to the Transit Gateway is necessary for VPCs to send traffic to the Transit Gateway, but it does not control the Transit Gateway's internal path selection; the issue is about the Transit Gateway route table, not VPC route tables.

Answer

Disable cross-zone load balancing on the Transit Gateway.

Answer

Add static routes to the Transit Gateway route table pointing to the VPN attachment.

Answer

Modify the VPC route tables to add routes to the other VPC via the Transit Gateway.

Question 12

A company has a VPC with an AWS Site-to-Site VPN connection to their on-premises network. The VPN uses dynamic routing with BGP. The on-premises network is advertising a specific route to the VPC. However, instances in the VPC cannot reach the on-premises network. The VPN tunnels are up and BGP sessions are established. What should the engineer check?

Accepted Answer

Route propagation is enabled on the VPC route tables.. Even if BGP routes are received, they must be propagated to the route tables. If route propagation is not enabled, the routes are not added. Option A is incorrect; static routes are not necessary for dynamic routing. Option B is incorrect because the VPN connection routes are already configured. Option D is incorrect because the tunnels are up, so the configuration is likely correct.

Answer

The tunnel options include the correct encryption algorithms.

Answer

The on-premises router is advertising the route with the correct ASN.

Answer

The VPN connection's static routes are configured for the on-premises CIDR.

Question 13

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The Direct Connect Gateway is associated with a Transit Gateway. The on-premises network advertises a prefix via BGP, but the prefix does not appear in the Transit Gateway route table. What is the most likely cause?

Accepted Answer

The prefix is not included in the allowed prefixes list for the Direct Connect Gateway.. The Direct Connect Gateway has an allowed prefixes list that filters which BGP prefixes are accepted from the on-premises network. If the prefix is not in that list, it will not be propagated to the Transit Gateway route table. Option A is incorrect because route propagation on the Transit Gateway route table is used for VPC attachments, not for Direct Connect prefixes. Option B is incorrect because BGP community attributes are used for tagging and influencing routing policies, not as a prerequisite for prefix acceptance. Option C is incorrect because the Transit Gateway association with the Direct Connect Gateway is already present as stated in the question, so this cannot be the cause.

Answer

Route propagation is not enabled on the Transit Gateway route table.

Answer

The on-premises router is not sending the BGP community attribute.

Answer

The Transit Gateway is not associated with the Direct Connect Gateway.

Question 14

A company is using AWS Direct Connect with a private VIF. They want to monitor the BGP session status and receive alerts if the session goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it can monitor the BGP session status of a Direct Connect private VIF by publishing metrics such as 'bgp_session_state' (0=down, 1=up) and 'connection_state' to CloudWatch. You can then create a CloudWatch alarm that triggers an alert (e.g., via SNS) when the BGP session state transitions to 0, providing real-time notification of a session failure.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 15

Which TWO are valid methods to monitor and troubleshoot AWS Direct Connect connections?

Accepted Answer

Enable Direct Connect Connection and Virtual Interface metrics in CloudWatch.. Options C and D are correct. Option C: Direct Connect connection and virtual interface metrics can be monitored through CloudWatch, providing utilization and error stats. Option D: Direct Connect Connection tests (e.g., using the AWS Management Console or CLI) allow you to verify connectivity and performance. Options A and B are incorrect: CloudFront is a CDN and not used for Direct Connect monitoring; CloudTrail logs API calls but does not provide real-time connection monitoring. Option E is incorrect: VPC Flow Logs capture IP traffic for VPCs, not Direct Connect link-level data.

Answer

Use CloudFront to monitor Direct Connect utilization.

Answer

Enable AWS CloudTrail to log Direct Connect API calls.

Answer

Enable VPC Flow Logs on the VIF.