ANS-C01 Network Management and Operations Practice Test 17 — 15 Questions

Question 1

A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach any resources in the VPC. What is the most likely cause?

Accepted Answer

The Client VPN endpoint does not have a subnet association.. Option D is correct because the subnet associations for the Client VPN endpoint route traffic to the VPC; without a proper subnet association, traffic is not forwarded. Option A is incorrect because the security group for the Client VPN endpoint controls access, but the endpoint can still be reachable. Option B is incorrect; the authorization rules allow specific users/groups, but connectivity issues are likely routing. Option C is incorrect because the client is already connected.

Answer

The authorization rules do not include the client's group.

Answer

The Client VPN endpoint security group does not allow inbound traffic from the client CIDR.

Answer

The client's VPN software is not configured with the correct DNS server.

Question 2

A company uses AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They notice that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What configuration change should be made to ensure optimal routing?

Accepted Answer

Enable route propagation from the VPC attachments into the Transit Gateway route table.. Option A is correct because Transit Gateway route tables control the path; enabling route propagation from VPC attachments will add routes for direct VPC-to-VPC communication. Option B is incorrect because VPN attachments do not affect VPC-to-VPC routing. Option C is incorrect because VPC route tables do not control Transit Gateway path selection. Option D is incorrect because cross-zone load balancing is for load balancers, not routing.

Answer

Disable cross-zone load balancing on the Transit Gateway.

Answer

Add static routes to the Transit Gateway route table pointing to the VPN attachment.

Answer

Modify the VPC route tables to add routes to the other VPC via the Transit Gateway.

Question 3

A company has a VPC with an AWS Site-to-Site VPN connection to their on-premises network. The VPN uses dynamic routing with BGP. The on-premises network is advertising a specific route to the VPC. However, instances in the VPC cannot reach the on-premises network. The VPN tunnels are up and BGP sessions are established. What should the engineer check?

Accepted Answer

Route propagation is enabled on the VPC route tables.. Option C is correct because even if BGP routes are received, they must be propagated to the route tables. If route propagation is not enabled, the routes are not added. Option A is incorrect; static routes are not necessary for dynamic routing. Option B is incorrect because the VPN connection routes are already configured. Option D is incorrect because the tunnels are up, so the configuration is likely correct.

Answer

The tunnel options include the correct encryption algorithms.

Answer

The on-premises router is advertising the route with the correct ASN.

Answer

The VPN connection's static routes are configured for the on-premises CIDR.

Question 4

A company has a Direct Connect connection with a private VIF attached to a Direct Connect Gateway. The Direct Connect Gateway is associated with a Transit Gateway. The on-premises network advertises a prefix via BGP, but the prefix does not appear in the Transit Gateway route table. What is the most likely cause?

Accepted Answer

The prefix is not included in the allowed prefixes list for the Direct Connect Gateway.. Option C is correct because the allowed prefixes list on the Direct Connect Gateway filters which prefixes are accepted. Option A is incorrect because route propagation is for VPCs, not Direct Connect. Option B is incorrect because Transit Gateway associations are for attachments, not prefix filtering. Option D is incorrect because BGP communities are used for tagging, not for prefix acceptance.

Answer

Route propagation is not enabled on the Transit Gateway route table.

Answer

The on-premises router is not sending the BGP community attribute.

Answer

The Transit Gateway is not associated with the Direct Connect Gateway.

Question 5

A company is using AWS Direct Connect with a private VIF. They want to monitor the BGP session status and receive alerts if the session goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it can monitor the BGP session status of a Direct Connect private VIF by publishing metrics such as 'bgp_session_state' (0=down, 1=up) and 'connection_state' to CloudWatch. You can then create a CloudWatch alarm that triggers an alert (e.g., via SNS) when the BGP session state transitions to 0, providing real-time notification of a session failure.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 6

Which TWO are valid methods to monitor and troubleshoot AWS Direct Connect connections?

Accepted Answer

Enable Direct Connect Connection and Virtual Interface metrics in CloudWatch.. Options A and B are correct. Option C is incorrect because VPC Flow Logs do not capture Direct Connect traffic. Option D is incorrect because CloudFront is not related to Direct Connect monitoring. Option E is incorrect because CloudTrail does not provide real-time connection monitoring.

Answer

Use CloudFront to monitor Direct Connect utilization.

Answer

Enable AWS CloudTrail to log Direct Connect API calls.

Answer

Enable VPC Flow Logs on the VIF.

Question 7

A network engineer is troubleshooting a slow connection between an EC2 instance and an RDS database in the same VPC. The engineer wants to analyze network performance metrics. Which TWO metrics should the engineer examine? (Choose two.)

Accepted Answer

Round-trip time between the EC2 instance and RDS. Option A and Option D are correct. Network packets dropped by the RDS instance's network interface indicate congestion. Round-trip time is a direct measure of latency. Option B is incorrect because CPU utilization is a system metric, not network-specific. Option C is incorrect because database connections are application-level. Option E is incorrect because disk queue depth is storage-related.

Answer

Database connections count

Answer

Disk queue depth

Answer

RDS instance CPU utilization

Question 8

Which THREE are best practices for managing network security in a multi-VPC AWS environment using AWS Transit Gateway?

Accepted Answer

Use separate Transit Gateway route tables for different environments (e.g., production, development).. Options A, C, and E are correct. Option B is incorrect because network ACLs are stateless and not needed if security groups are used. Option D is incorrect because a single route table would allow all VPCs to communicate, violating least privilege.

Answer

Attach all VPCs to a single Transit Gateway route table for simplicity.

Answer

Use network ACLs on every subnet to filter traffic between VPCs.

Question 9

A company is designing a multi-region architecture with VPCs connected via VPC peering. They need to ensure high availability and low latency. Which THREE design principles should they follow? (Choose three.)

Accepted Answer

Deploy redundant VPN connections to each region. Option A, Option B, and Option D are correct. Using a transit gateway simplifies management and supports transitive routing. Deploying redundant VPN connections ensures failover. Direct Connect provides consistent low latency. Option C is incorrect because a single NAT gateway is a single point of failure. Option E is incorrect because VPC endpoints are for service access, not inter-region connectivity.

Answer

Use VPC endpoints for all AWS service access

Answer

Use a single NAT gateway for all outbound traffic

Question 10

Which TWO are requirements for using AWS Client VPN to provide secure remote access?

Accepted Answer

The Client VPN endpoint must be in a subnet with a route to the internet.. Option B is correct because the Client VPN endpoint must be deployed in a subnet that has a route to the internet. This is necessary for the endpoint to establish the initial TLS handshake with client devices and to route traffic between the client and the VPC. Without internet connectivity, the endpoint cannot receive client connections or forward traffic to the internet if split-tunnel is disabled.

Answer

A security group must be associated with the Client VPN endpoint.

Answer

The client CIDR range must be within the VPC CIDR.

Answer

The Client VPN endpoint must use certificate-based server authentication only.

Question 11

A network engineer is troubleshooting intermittent connectivity issues between two VPCs connected via a VPC peering connection. The engineer notices that the route tables in both VPCs have the correct routes. What should the engineer check next?

Accepted Answer

Check security group and network ACL rules. Option A is correct because security group rules and NACLs can block traffic even if routes are correct. Option B is wrong because DNS resolution is not related to basic connectivity. Option C is wrong because internet gateway is not involved in VPC peering. Option D is wrong because VPN connection is a different service.

Answer

Verify that DNS resolution is enabled for the VPCs

Answer

Ensure that the VPN connection is active

Answer

Check the internet gateway configuration

Question 12

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. They notice that traffic between VPCs is being dropped intermittently. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Monitor the Transit Gateway's CloudWatch metrics for packets dropped due to route table limits. Option A and Option D are correct. Monitoring Transit Gateway CloudWatch metrics for dropped packets can identify route table limits or throttling. Enabling VPC Flow Logs helps analyze traffic patterns and dropped packets. Option B is incorrect; the VPC CIDR does not need to be unique if properly routed. Option C is incorrect; a VPN connection is not needed for Direct Connect. Option E is incorrect; security groups do not apply to Transit Gateway.

Answer

Review the security group rules on the Transit Gateway

Answer

Check if the VPC CIDRs are overlapping

Answer

Create a VPN connection for backup

Question 13

A company has set up a Direct Connect connection with a private VIF to its VPC. The BGP session is up, but traffic is not passing between the on-premises network and the VPC. Which configuration should be verified?

Accepted Answer

Check the BGP advertised routes and the VPC route tables. Option C is correct because the on-premises network must advertise routes to the VPC via BGP, and the VPC must have routes pointing to the virtual private gateway. Option A is wrong because jumbo frames are not required. Option B is wrong because VIF type (private vs public) is not the issue if BGP is up. Option D is wrong because CloudWatch metrics are for monitoring, not routing.

Answer

Ensure jumbo frames are enabled on the Direct Connect interface

Answer

Verify that the VIF is a public VIF

Answer

Review the Direct Connect virtual interface metrics in CloudWatch

Question 14

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a web application that needs to access an external API over the internet. The private subnet uses a NAT Gateway in the public subnet for outbound internet access. The web application is failing to reach the external API. The engineer has verified the following: the NAT Gateway has an Elastic IP attached, the route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway, the security group for the web application allows outbound HTTPS (TCP 443) to 0.0.0.0/0, the network ACL for the private subnet allows inbound and outbound TCP ephemeral ports (1024-65535) from and to 0.0.0.0/0, and the IAM role attached to the EC2 instance allows outbound HTTPS. The engineer also confirmed that the NAT Gateway is in the public subnet which has a route to an Internet Gateway. Despite all these checks, the web application still cannot reach the external API. What should the engineer do next?

Accepted Answer

Verify that the route table is correctly associated with the private subnet.. Option D is correct because even though the route table has a default route to the NAT Gateway, the subnet association might be incorrect. The route table associated with the private subnet might not be the one being used. Checking the subnet association ensures that the correct route table is applied. Option A is incorrect because the NAT Gateway is already in the public subnet. Option B is incorrect because the default route is present. Option C is incorrect because the security group already allows outbound HTTPS.

Answer

Add an inbound rule to the security group for the external API's IP address.

Answer

Move the NAT Gateway to the private subnet.

Answer

Add a specific route for the external API's IP address to the route table.

Question 15

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. After a network change, some VPCs cannot reach the on-premises network. The Transit Gateway route table shows the correct association and propagation. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route pointing to the Transit Gateway. Option B is correct because the VPC route table must have a static route or propagated route pointing to the Transit Gateway for traffic to flow. Option A is wrong because attachment is fine if route table shows correct association. Option C is wrong because BGP is used for on-premises routes, not for VPC routes. Option D is wrong because VPN is one way to connect on-premises, but the issue is about VPC routing.

Answer

The Transit Gateway attachment is in a failed state

Answer

The VPN connection to the on-premises network has insufficient bandwidth

Answer

The BGP session between the Transit Gateway and on-premises router is down