ANS-C01 Network Management and Operations Practice Test 17 — 15 Questions

Question 1

A network engineer is troubleshooting a VPC that uses AWS PrivateLink to provide access to a service. Clients in other VPCs are unable to connect to the endpoint service. The engineer has verified that the Network Load Balancer (NLB) is healthy and the endpoint service is configured. Which TWO additional configurations should the engineer check to resolve the connectivity issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security group of the target instances allows inbound traffic from the client VPC CIDR on the service port.. For AWS PrivateLink connectivity, two critical configurations are often overlooked: the security group of the target instances must allow inbound traffic from the client VPC CIDR on the service port, and the VPC endpoint policy must permit the client VPC to access the service. These ensure that traffic is allowed at both the network and authorization layers.

Answer

The NLB listener is configured to accept traffic on the service port and forward to a target group.

Answer

The route table of the client VPC has a route to the endpoint service's NLB.

Answer

The security group of the NLB allows inbound traffic from the client VPC CIDR on the service port.

Question 2

A company operates a Transit Gateway in us-east-1 with 50 VPC attachments and 10 Site-to-Site VPN attachments. The network team wants to monitor traffic that is dropped by the Transit Gateway due to route table lookup failures. They need to capture metadata including source and destination IP, port, and the reason for the drop. Which AWS feature should they use?

Accepted Answer

Enable Transit Gateway Flow Logs on the Transit Gateway and filter for 'reject' traffic.. Transit Gateway Flow Logs provide visibility into traffic traversing the TGW, including drops due to missing routes. They capture 5-tuple information and indicate reject status. VPC Flow Logs and Route Analyzer do not capture these TGW-level drops with detailed reasons. Thus, enabling TGW Flow Logs and filtering for reject traffic is the correct approach.

Answer

Enable Transit Gateway Flow Logs on the Transit Gateway attachment.

Answer

Enable VPC Flow Logs on all VPCs attached to the Transit Gateway.

Answer

Use AWS Network Manager Route Analyzer to analyze the route tables and identify missing routes.

Question 3

A network engineer has deployed AWS Network Firewall in a dedicated inspection VPC. The firewall policy uses a stateless rule group followed by a stateful rule group with default action 'drop all'. After deployment, all traffic passing through the firewall is dropped, including traffic that should match the stateless pass rules. The engineer verifies that the route tables in the inspection VPC correctly direct traffic to the firewall endpoint. What is the most likely cause of the problem?

Accepted Answer

The stateful rule group's default action is set to drop all, and no stateful rules exist to allow the traffic.. In AWS Network Firewall, a firewall policy evaluates traffic in order: stateless rule groups first, then stateful rule groups. If a stateful rule group has a default action of 'drop all', any packet not explicitly allowed by a stateful rule is dropped, regardless of stateless pass rules. The stateless rules only determine whether traffic reaches the stateful engine; they do not bypass it. Therefore, the absence of stateful allow rules causes all traffic to be dropped.

Answer

The inspection VPC route tables are misconfigured, sending traffic to the wrong firewall endpoint.

Answer

The firewall policy is missing a rule group that allows return traffic for established connections.

Answer

The stateless rule group's default action is set to drop all, which overrides the stateful rules.

Question 4

A network engineer is using AWS Network Manager to monitor a global network that includes multiple Transit Gateways in different AWS Regions. The engineer wants to visualize the network topology and identify any route propagation issues between the Transit Gateways. Which feature of AWS Network Manager should the engineer use to achieve this?

Accepted Answer

Network Manager's Route Analyzer. Route Analyzer in AWS Network Manager is designed to analyze routes and troubleshoot connectivity across Transit Gateways. It can trace the path between a source and destination and show which routes are used, including propagation between Transit Gateways. Topology View, Event Logs, and Performance Dashboard serve different purposes: visualization, event tracking, and performance monitoring, respectively. Therefore, Route Analyzer is the correct tool for identifying route propagation issues.

Answer

Network Manager's Topology View

Answer

Network Manager's Event Logs

Answer

Network Manager's Performance Dashboard

Question 5

A company has a hybrid network with an AWS Direct Connect connection and a Site-to-Site VPN as backup. The company wants to automatically fail over to the VPN if the Direct Connect connection becomes unavailable. The network engineer must configure the routing to prefer Direct Connect and use VPN only when Direct Connect is down. Which solution meets these requirements?

Accepted Answer

Configure BGP on both the Direct Connect and VPN, and set a higher local preference for the Direct Connect routes.. To achieve automatic failover from Direct Connect to VPN, BGP is the appropriate routing protocol. By manipulating BGP attributes such as local preference, you can make Direct Connect routes preferred. When Direct Connect fails, BGP withdraws the routes, and the VPN routes become active. This provides seamless failover without manual intervention. Static routes and more specific routes do not provide dynamic failover.

Answer

Use static routes with a lower administrative distance for the VPN than for Direct Connect.

Answer

Use AWS Global Accelerator to route traffic over Direct Connect and fail over to VPN.

Answer

Configure the VPN with a more specific route than Direct Connect to force traffic over VPN.

Question 6

A company has a hybrid network with an AWS Site-to-Site VPN connection to its on-premises data center. The network engineer notices that some traffic between AWS and on-premises is experiencing high latency and packet loss. The engineer suspects issues with the VPN tunnel. Which TWO actions should the engineer take to troubleshoot the VPN tunnel performance? (Choose two.)

Accepted Answer

Check the CloudWatch metrics for TunnelState and TunnelDataIn/Out.. The correct answers are checking CloudWatch metrics for TunnelState and TunnelDataIn/Out, and verifying the BGP session status on the virtual private gateway. These actions provide direct visibility into VPN tunnel health and routing. VPC Flow Logs and Direct Connect checks are not relevant, and on-premises logs, while useful, are not AWS-specific actions for this scenario.

Answer

Check the Direct Connect virtual interface BGP status.

Answer

Review the on-premises router's IPsec logs for Phase 1 and Phase 2 negotiations.

Answer

Enable VPC Flow Logs on the VPN attachment subnet.

Question 7

A network engineer manages a VPC that uses a NAT gateway in a public subnet for outbound internet access from a private subnet. Amazon CloudWatch shows the NAT gateway's ErrorPortAllocation metric climbing steadily, and instances intermittently fail to reach external endpoints even though the NAT gateway status is Available and route tables are correct. Which action should the engineer take to resolve the root cause?

Accepted Answer

Enable port allocation reuse by associating an additional elastic IP address with the NAT gateway.. The ErrorPortAllocation metric reflects source port exhaustion on the NAT gateway, which occurs when many simultaneous connections target the same destination with only one elastic IP. Associating additional elastic IPs expands the port pool and restores outbound connectivity. Bandwidth, subnet sizing, and internet gateway routes do not address the translation table limit.

Answer

Increase the size of the private subnet CIDR so more instances can obtain IP addresses.

Answer

Add a second route table entry pointing the default route to the internet gateway for the private subnet.

Answer

Replace the NAT gateway with a NAT instance that has a larger instance type and higher network bandwidth.

Question 8

A network engineer is deploying a new AWS Site-to-Site VPN connection to an on-premises router. The VPN tunnel is up, but only some subnets in the VPC can reach on-premises resources. The engineer has verified that the VPC route table has a route for the on-premises CIDR pointing to the virtual private gateway. Which additional configuration is required to allow the missing subnets to use the VPN connection?

Accepted Answer

Enable route propagation for the virtual private gateway on the route tables associated with the missing subnets.. For a VPC subnet to send traffic to on-premises over a Site-to-Site VPN, its route table must have a route to the on-premises CIDR with the virtual private gateway as target. Route propagation from the virtual private gateway automatically adds these routes. If propagation is disabled on the route tables for some subnets, those subnets will lack the route even though the VPN is up. Enabling propagation on those route tables resolves the issue.

Answer

Modify the VPN connection to use a different tunnel outside IP address.

Answer

Associate the missing subnets with a network ACL that allows traffic to the on-premises CIDR.

Answer

Add a static route for the on-premises CIDR to the route tables of the missing subnets with the virtual private gateway as the target.

Question 9

A network engineer needs to capture all IP traffic entering and leaving an EC2 instance's elastic network interface for security analysis. The engineer enables VPC Flow Logs on the ENI with a custom format that includes all available fields. After some time, the engineer notices that some traffic is not being logged. Which of the following is the most likely reason for the missing flow log data?

Accepted Answer

Flow logs do not capture traffic that is sent to or from the reserved IP addresses for the VPC router, DNS server, and metadata server.. VPC Flow Logs exclude traffic to and from certain reserved IP addresses within a VPC, including the VPC router, DNS server, and instance metadata service. When an engineer enables flow logs with all fields and expects comprehensive logging, the absence of these reserved-address flows is the most likely cause of missing data. Other limitations, such as non-IP traffic or specific service exclusions, are less likely to be the primary concern in this context.

Answer

Flow logs do not capture traffic that is sent to or from a network load balancer.

Answer

Flow logs do not capture traffic that is not IP traffic, such as ARP or DHCP.

Answer

Flow logs do not capture traffic to and from the instance metadata service (169.254.169.254).

Question 10

A network engineer manages a VPC with a NAT gateway in a public subnet and a private subnet hosting EC2 instances. The engineer needs to capture only the traffic that is allowed through the NAT gateway for compliance auditing. The engineer enables VPC Flow Logs on the NAT gateway's elastic network interface. However, after reviewing the logs, the engineer notices that some traffic that was blocked by the NAT gateway's security group is also being logged. The engineer wants to filter the logs to show only traffic that was actually forwarded by the NAT gateway. Which action should the engineer take to achieve this?

Accepted Answer

Filter the flow logs for records where the action field is ACCEPT.. VPC Flow Logs capture both accepted and rejected traffic, and the action field explicitly marks whether traffic was allowed or denied. For a NAT gateway, traffic that is forwarded will be marked as ACCEPT. By filtering for action=ACCEPT, the engineer can exclude any traffic that was blocked by security groups or network ACLs, thus capturing only the traffic that was actually forwarded. This is the correct approach for compliance auditing of allowed traffic.

Answer

Filter the flow logs for records where the bytes field is greater than zero.

Answer

Filter the flow logs for records where the log-status field is OK.

Answer

Filter the flow logs for records where the packets field is greater than zero.

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to add a second CIDR block of 10.1.0.0/16 to the VPC to accommodate additional resources. After adding the CIDR block, the network engineer notices that some existing resources cannot communicate with the new CIDR block. What is the most likely cause?

Accepted Answer

The route tables associated with the existing subnets do not have routes for the new CIDR block.. When you add a secondary CIDR block to a VPC, the local route in each route table only covers the original CIDR block. You must manually add a route for the new CIDR block to each route table that needs to communicate with it. Without this route, traffic to the new CIDR will not be routed, causing connectivity issues.

Answer

The new CIDR block overlaps with an existing subnet CIDR.

Answer

The security groups do not allow traffic from the new CIDR block.

Answer

The network ACLs do not allow traffic from the new CIDR block.

Question 12

A network engineer needs to verify that a newly configured AWS Site-to-Site VPN connection is passing traffic. The VPN connection shows as 'UP' in the AWS Management Console, but the engineer wants to confirm that the tunnel is actually passing packets and check for any packet loss. Which AWS tool should the engineer use to view tunnel status and packet loss metrics?

Accepted Answer

Amazon CloudWatch metrics for VPN TunnelState and TunnelDataIn/Out. CloudWatch metrics for VPN provide TunnelState and TunnelDataIn/Out, which directly indicate if the tunnel is up and if data is flowing. Packet loss can be inferred by comparing data in and out or by monitoring for drops. CloudTrail, Trusted Advisor, and VPC Flow Logs do not provide these specific metrics. Thus, CloudWatch is the correct tool.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 13

A network engineer is using AWS Network Manager to monitor a global network that includes multiple Transit Gateways in different AWS Regions and on-premises locations connected via SD-WAN. The engineer wants to visualize the end-to-end path between a source in us-west-2 and a destination in eu-central-1. After configuring a Network Manager global network and registering the Transit Gateways, the engineer notices that the route analysis feature shows incomplete paths. What is the most likely reason?

Accepted Answer

The on-premises devices are not registered as sites or devices in the global network, so Network Manager cannot correlate the full path.. AWS Network Manager provides a central place to manage and monitor global networks. Route analysis requires a complete model of the network, including AWS and on-premises resources. If on-premises devices are not registered as sites or devices, the analysis cannot include them, leading to incomplete paths. Ensuring all segments are registered is crucial for accurate end-to-end visibility.

Answer

The route analysis feature only supports paths within a single AWS Region and cannot traverse multiple Regions.

Answer

The Transit Gateway route tables do not have the necessary static routes to direct traffic between Regions.

Answer

The Transit Gateways are not peered with each other using Transit Gateway peering attachments.

Question 14

A network engineer is using AWS Network Manager to monitor a global network of Transit Gateways across multiple AWS Regions. The engineer wants to visualize the end-to-end path between an on-premises data center and a VPC in another Region. The on-premises connection uses AWS Direct Connect and a Transit Gateway in the home Region. The engineer notices that the Network Manager route analysis shows the path stops at the Transit Gateway in the home Region and does not include the inter-Region peering attachment to the remote Transit Gateway. What is the MOST likely reason for the incomplete path?

Accepted Answer

The inter-Region peering attachment is not associated with a Network Manager route table, so Network Manager cannot analyze routes across the peering connection.. Network Manager route analysis requires that transit gateway route tables and attachments be associated with Network Manager route tables. For inter-Region peering, the peering attachment must be associated with a Network Manager route table that is also associated with the transit gateway. Without this association, the analysis cannot traverse the peering connection, leading to an incomplete path. The correct answer identifies this association requirement.

Answer

The on-premises router does not advertise the remote VPC CIDR over BGP to the Direct Connect gateway, so the path cannot be resolved.

Answer

Network Manager does not support route analysis for inter-Region peering attachments; it only analyzes routes within a single Region.

Answer

The remote Transit Gateway is not registered as a transit gateway in Network Manager, so its attachments are not included in the route analysis.

Question 15

A company has a hybrid network with an AWS Direct Connect connection and a VPN backup. The network engineer needs to monitor the health of the Direct Connect connection and automatically fail over to the VPN if the Direct Connect becomes unavailable. The engineer wants to use AWS-native tools and minimize manual intervention. Which solution should the engineer implement?

Accepted Answer

Configure the Direct Connect connection with a BGP session and the Site-to-Site VPN with a BGP session, and use AS_PATH prepending on the VPN to make it less preferred, relying on BGP to withdraw routes when the Direct Connect fails.. The most AWS-native and automated solution is to use BGP for both Direct Connect and VPN, with AS_PATH prepending on the VPN to make it less preferred. When the Direct Connect BGP session fails, the routes are withdrawn, and BGP automatically fails over to the VPN. This eliminates the need for custom Lambda functions or manual route changes. CloudWatch alarms with Lambda can work but are not as seamless. Route 53 health checks are for DNS failover, not VPC routing. Therefore, the BGP-based approach is correct.

Answer

Configure Amazon CloudWatch alarms on the Direct Connect connection's metrics and use AWS Lambda to modify the route tables to point to the VPN when the alarm triggers.

Answer

Enable AWS Direct Connect failover testing and use Amazon Route 53 health checks to route traffic to the VPN endpoint when the Direct Connect is unhealthy.

Answer

Use AWS Direct Connect gateway with a Site-to-Site VPN as a backup, and configure BGP on the customer gateway to prefer the Direct Connect path, with the VPN as a lower-priority path.