ANS-C01 Network Management and Operations Practice Test 18 — 15 Questions

Question 1

A company has deployed a multi-VPC architecture with AWS Transit Gateway. The network team notices that traffic between two VPCs is intermittently dropped. Both VPCs are attached to the same transit gateway. Which action should the network engineer take to troubleshoot the issue?

Accepted Answer

Enable VPC Flow Logs on the subnets of the VPCs.. Option B is correct because enabling VPC Flow Logs captures IP traffic information, which helps identify dropped packets. Option A is wrong because CloudWatch metrics do not provide packet-level details. Option C is wrong because Transit Gateway Network Manager provides topology visualization, not packet drops. Option D is wrong because Direct Connect is unrelated to inter-VPC traffic.

Answer

Configure AWS Direct Connect to route traffic between the VPCs.

Answer

Use Transit Gateway Network Manager to view the network topology.

Answer

Enable CloudWatch metrics for the transit gateway attachments.

Question 2

A network engineer needs to monitor the network traffic between EC2 instances in a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. Option D is correct because VPC Flow Logs capture IP traffic information for network interfaces. Option A is wrong because CloudWatch Logs can store logs but does not capture network traffic. Option B is wrong because AWS Config tracks resource configuration changes. Option C is wrong because CloudTrail records API calls.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 3

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The template includes an Internet Gateway and a NAT Gateway. After deployment, instances in the private subnet cannot access the internet. The network engineer checks the route tables and finds that the private subnet route table has a default route pointing to the NAT Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway is deployed in the private subnet instead of the public subnet.. Option D is correct because the NAT Gateway must be in a public subnet with a route to the IGW. Option A is wrong because the route is present. Option B is wrong because security groups allow outbound traffic by default. Option C is wrong because the default route points to NAT Gateway, not IGW.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Answer

The private subnet route table does not have a default route (0.0.0.0/0) to the NAT Gateway.

Answer

The NAT Gateway is in a private subnet and has no route to the internet gateway.

Question 4

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has set up a NAT gateway in the public subnet. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route to the NAT gateway. Option B is correct because the private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT gateway. Option A is wrong because NAT gateway does not need an internet gateway route; it uses the internet gateway of the public subnet. Option C is wrong because security group rules for outbound traffic are usually allowed by default. Option D is wrong because the NAT gateway is in the public subnet, so it has internet access; the issue is routing from private subnet.

Answer

The NAT gateway does not have a route to the internet gateway

Answer

The security group for the instances blocks outbound traffic

Answer

The NAT gateway is not associated with an Elastic IP

Question 5

A network engineer is monitoring network performance and needs to collect and analyze network metrics from multiple AWS services in a centralized dashboard. Which AWS service should be used to aggregate and visualize these metrics?

Accepted Answer

Amazon CloudWatch Dashboards. Option B is correct because CloudWatch Dashboards provide centralized visualization of metrics from various AWS services. Option A is wrong because VPC Flow Logs are for IP traffic logs, not metrics. Option C is wrong because AWS Config tracks resource configuration, not metrics. Option D is wrong because CloudTrail logs API calls.

Answer

AWS VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company has multiple AWS accounts and wants to centrally manage network resources using AWS Transit Gateway. Which feature allows sharing the Transit Gateway across accounts?

Accepted Answer

AWS Resource Access Manager (RAM). Option C is correct because AWS Resource Access Manager (RAM) allows sharing Transit Gateways across accounts. Option A is wrong because AWS Organizations manages accounts but not resource sharing directly. Option B is wrong because VPC peering is a separate feature. Option D is wrong because AWS Service Catalog is for creating standardized products.

Answer

VPC peering

Answer

AWS Organizations

Answer

AWS Service Catalog

Question 7

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to its VPC. The on-premises network team reports that they can ping the private IP address of an EC2 instance in the VPC, but cannot establish a TCP connection to a web server running on that instance. The network security group allows inbound TCP port 80 from the on-premises CIDR. What should the network engineer check next?

Accepted Answer

Check the operating system firewall and web server configuration on the EC2 instance.. Option C is correct because the instance's OS firewall or web server configuration may be blocking the connection. Option A is wrong because ping works, indicating routing is fine. Option B is wrong because the BGP session status is unrelated to connectivity to the instance. Option D is wrong because the NACL is stateless and would affect ping as well.

Answer

Review the network ACL associated with the subnet to ensure it allows inbound TCP 80.

Answer

Check the BGP session status on the Direct Connect virtual interface.

Answer

Verify the route table on the VPC has a route back to the on-premises network.

Question 8

A network engineer needs to troubleshoot high latency between two EC2 instances in the same VPC but in different Availability Zones. Which tool should be used to measure network performance?

Accepted Answer

Use iperf to measure throughput and latency. Option A is correct because iperf is a common tool for measuring network throughput and latency. Option B is wrong because traceroute shows the path but not detailed performance. Option C is wrong because netstat shows connections and statistics but not active measurements. Option D is wrong because ping measures round-trip time but not throughput.

Answer

Use traceroute to identify the path

Answer

Use ping to test connectivity

Answer

Use netstat to check network statistics

Question 9

A company has set up a Site-to-Site VPN connection between its on-premises network and AWS. The VPN tunnel shows as 'UP' but traffic is not flowing. What should the engineer check?

Accepted Answer

Verify that route propagation is enabled on the VPC route table. Option D is correct because route propagation from the virtual private gateway to the VPC route table must be enabled. Option A is wrong because the tunnel state is up, so security group is not likely the issue (security group affects instances, not VPN endpoint). Option B is wrong because the internet gateway is for public internet access, not VPN. Option C is wrong because the customer gateway is the on-premises endpoint; it is configured but if routes are not propagated, traffic won't flow.

Answer

Ensure the customer gateway is configured correctly

Answer

Verify the security group rules for the VPN connection

Answer

Check the internet gateway route table

Question 10

A company is experiencing high latency for traffic between EC2 instances in the same VPC but in different Availability Zones. The network team suspects the issue is related to the placement group used. The instances are in a spread placement group. What should the network engineer do to reduce latency?

Accepted Answer

Change the placement group to a cluster placement group and ensure instances are in the same Availability Zone.. Option A is correct because a cluster placement group is recommended for low-latency, high-throughput traffic. Option B is wrong because moving to same subnet does not guarantee low latency across AZs. Option C is wrong because VPC peering does not reduce latency for intra-VPC traffic. Option D is wrong because increasing bandwidth does not directly reduce latency.

Answer

Enable enhanced networking on the instances and increase the instance size.

Answer

Move the instances to the same subnet within the same Availability Zone but keep the spread placement group.

Answer

Create a VPC peering connection between the two AZs and route traffic through it.

Question 11

A company uses AWS Direct Connect with multiple virtual interfaces (VIFs) to connect to multiple VPCs. The network team wants to ensure high availability and failover. Which configuration provides the best resiliency?

Accepted Answer

Provision two Direct Connect connections from different providers and configure BGP. Option B is correct because using two separate Direct Connect connections provides path diversity; if one fails, the other can handle traffic. Option A is wrong because multiple VIFs on a single connection share the same physical link. Option C is wrong because a VPN backup over the same internet connection may not provide true diversity. Option D is wrong because BGP alone does not provide physical redundancy.

Answer

Use a single Direct Connect connection with a VPN backup over the internet

Answer

Configure BGP with multiple AS paths on the same Direct Connect connection

Answer

Create multiple private VIFs on a single Direct Connect connection

Question 12

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.. Option B is correct because the route table for the subnets must have a route to the on-premises network via the VGW. Option A is wrong because the tunnel is UP. Option C is wrong because security groups are stateful and allow return traffic. Option D is wrong because the VGW does not have security groups.

Answer

The VPN tunnel is not properly configured with the correct pre-shared key.

Answer

The security groups on the EC2 instances are blocking inbound traffic from the on-premises network.

Answer

The virtual private gateway has its own security group that blocks traffic.

Question 13

A company is designing a highly available network architecture using AWS Direct Connect. Which TWO actions should be taken to ensure redundancy?

Accepted Answer

Provision two Direct Connect connections at different locations. Option A and C are correct because using two separate Direct Connect connections and configuring BGP with different ASNs provide path diversity and failover. Option B is wrong because a single connection is a single point of failure. Option D is wrong because VPN backup over the same internet connection does not provide true diversity. Option E is wrong because a single VIF on a single connection offers no redundancy.

Answer

Create a single private VIF on the Direct Connect connection

Answer

Set up a VPN connection over the internet as a backup

Answer

Use a single Direct Connect connection with multiple VIFs

Question 14

A company manages multiple VPCs connected via a transit gateway. Each VPC has a VPN connection to an on-premises data center. The network team wants to monitor the bandwidth utilization on each VPN connection. Which approach is the most efficient?

Accepted Answer

Use Amazon CloudWatch metrics for the VPN tunnels.. Option A is correct because CloudWatch metrics for VPN tunnels provide bandwidth utilization. Option B is wrong because VPC Flow Logs are for packet-level logs, not metrics. Option C is wrong because AWS Config tracks configuration. Option D is wrong because Transit Gateway Network Manager provides topology, not bandwidth metrics.

Answer

Enable VPC Flow Logs on each VPC and aggregate them in CloudWatch Logs Insights.

Answer

Use Transit Gateway Network Manager to view VPN bandwidth.

Answer

Use AWS Config rules to monitor VPN bandwidth changes.

Question 15

A network engineer is troubleshooting a VPN connection that is not passing traffic. The tunnel status shows as 'UP'. Which THREE steps should the engineer take to diagnose the issue?

Accepted Answer

Ensure that the security groups for instances allow inbound traffic from the on-premises network. Option A is correct because security groups act as a virtual firewall for instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up, traffic will be dropped if the security group does not explicitly allow inbound traffic from the on-premises network's IP range. This is a common misconfiguration that prevents traffic flow despite a healthy tunnel.

Answer

Check the IKE and IPSEC settings on the customer gateway

Answer

Check the internet gateway route table for the VPC