ANS-C01 Network Management and Operations Practice Test 18 — 15 Questions

Question 1

A network engineer is troubleshooting a slow connection between an EC2 instance and an RDS database in the same VPC. The engineer wants to analyze network performance metrics. Which TWO metrics should the engineer examine? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Round-trip time between the EC2 instance and RDS. (Round-trip time) directly measures latency between the EC2 instance and RDS, which is key for diagnosing slow connections. Option E (Network packets dropped) indicates network congestion or performance issues at the network interface. Option A (Database connections count) is an application-level metric that does not directly measure network performance. Option B (Disk queue depth) is storage-related. Option D (RDS CPU utilization) is a system metric that may affect database performance but does not directly indicate network latency or packet loss.

Answer

Database connections count

Answer

Disk queue depth

Answer

RDS instance CPU utilization

Question 2

Which THREE are best practices for managing network security in a multi-VPC AWS environment using AWS Transit Gateway?

Accepted Answer

Use separate Transit Gateway route tables for different environments (e.g., production, development).. Options A, B, and D are correct. Using separate Transit Gateway route tables for different environments (A) enforces isolation and least privilege. Centralizing egress through a shared VPC with a NAT gateway or proxy (B) provides a controlled exit point for internet-bound traffic. Enabling VPC Flow Logs on all VPCs and centralizing logs in a security account (D) enables monitoring and auditing of traffic patterns. Option C is incorrect because a single route table would allow all VPCs to communicate, violating environment isolation. Option E is incorrect because network ACLs are stateless and not designed for inter-VPC traffic filtering in a Transit Gateway architecture; security groups and route tables are more appropriate.

Answer

Attach all VPCs to a single Transit Gateway route table for simplicity.

Answer

Use network ACLs on every subnet to filter traffic between VPCs.

Question 3

A company is designing a multi-region architecture with VPCs connected via VPC peering. They need to ensure high availability and low latency. Which THREE design principles should they follow? (Choose three.)

Accepted Answer

Deploy redundant VPN connections to each region. Options B, D, and E are correct. Deploying redundant VPN connections ensures high availability and failover between regions. AWS Direct Connect provides consistent low-latency connectivity for inter-region traffic. Using a transit gateway simplifies inter-region peering with transitive routing and centralized management. Option A is incorrect because VPC endpoints are for accessing AWS services privately, not for inter-region connectivity. Option C is incorrect because a single NAT gateway creates a single point of failure and does not support inter-region traffic.

Answer

Use VPC endpoints for all AWS service access

Answer

Use a single NAT gateway for all outbound traffic

Question 4

A network engineer is troubleshooting intermittent connectivity issues between two VPCs connected via a VPC peering connection. The engineer notices that the route tables in both VPCs have the correct routes. What should the engineer check next?

Accepted Answer

Check security group and network ACL rules. Security group rules and NACLs can block traffic even if routes are correct. Option B is wrong because DNS resolution is not related to basic connectivity. Option C is wrong because internet gateway is not involved in VPC peering. Option D is wrong because VPN connection is a different service.

Answer

Verify that DNS resolution is enabled for the VPCs

Answer

Ensure that the VPN connection is active

Answer

Check the internet gateway configuration

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. They notice that traffic between VPCs is being dropped intermittently. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Monitor the Transit Gateway's CloudWatch metrics for packets dropped due to route table limits. Monitoring Transit Gateway CloudWatch metrics for dropped packets can identify route table limits or throttling issues. Option C is correct because enabling VPC Flow Logs helps analyze traffic patterns and identify dropped packets. Option B is incorrect because security groups do not apply to Transit Gateway; they apply to ENIs. Option D is incorrect because overlapping VPC CIDRs can be handled with proper routing and do not cause intermittent drops by themselves. Option E is incorrect because creating a VPN connection is a solution, not a diagnostic step.

Answer

Review the security group rules on the Transit Gateway

Answer

Check if the VPC CIDRs are overlapping

Answer

Create a VPN connection for backup

Question 6

A company has set up a Direct Connect connection with a private VIF to its VPC. The BGP session is up, but traffic is not passing between the on-premises network and the VPC. Which configuration should be verified?

Accepted Answer

Check the BGP advertised routes and the VPC route tables. For traffic to flow between on-premises and the VPC over a Direct Connect private VIF, the on-premises network must advertise the appropriate routes via BGP, and the VPC route tables must have routes pointing to the virtual private gateway (VGW). Option A is wrong because jumbo frames are not required for basic connectivity. Option B is wrong because the VIF type (private vs public) is not the issue—the BGP session is already up, indicating the VIF is correctly configured as private. Option C is wrong because CloudWatch metrics are for monitoring performance, not for diagnosing routing issues.

Answer

Ensure jumbo frames are enabled on the Direct Connect interface

Answer

Verify that the VIF is a public VIF

Answer

Review the Direct Connect virtual interface metrics in CloudWatch

Question 7

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a web application that needs to access an external API over the internet. The private subnet uses a NAT Gateway in the public subnet for outbound internet access. The web application is failing to reach the external API. The engineer has verified the following: the NAT Gateway has an Elastic IP attached, the route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway, the security group for the web application allows outbound HTTPS (TCP 443) to 0.0.0.0/0, the network ACL for the private subnet allows inbound and outbound TCP ephemeral ports (1024-65535) from and to 0.0.0.0/0, and the IAM role attached to the EC2 instance allows outbound HTTPS. The engineer also confirmed that the NAT Gateway is in the public subnet which has a route to an Internet Gateway. Despite all these checks, the web application still cannot reach the external API. What should the engineer do next?

Accepted Answer

Verify that the route table is correctly associated with the private subnet.. Even though the route table contains a default route to the NAT Gateway, it may not be associated with the private subnet. If the route table is not associated, the private subnet uses the main route table, which might not have the default route. The engineer should verify that the correct route table is associated with the private subnet. Option A is incorrect because the security group already allows outbound HTTPS. Option B is incorrect because the NAT Gateway must be in a public subnet. Option D is incorrect because a specific route is unnecessary when a default route already exists.

Answer

Add an inbound rule to the security group for the external API's IP address.

Answer

Move the NAT Gateway to the private subnet.

Answer

Add a specific route for the external API's IP address to the route table.

Question 8

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. After a network change, some VPCs cannot reach the on-premises network. The Transit Gateway route table shows the correct association and propagation. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route pointing to the Transit Gateway. The VPC route tables do not have a route pointing to the Transit Gateway. Even though the Transit Gateway route table has correct associations and propagations, traffic from VPCs to on-premises requires a route in the VPC route tables pointing to the Transit Gateway attachment. Without such a route, VPCs cannot send traffic to the Transit Gateway, causing connectivity loss. Option A is incorrect because the attachment state is fine if the route table shows correct association. Option B is incorrect because insufficient bandwidth would cause performance issues, not complete loss of connectivity. Option C is incorrect because a down BGP session would affect route propagation, but the Transit Gateway route table already shows correct propagation, implying BGP is functioning.

Answer

The Transit Gateway attachment is in a failed state

Answer

The VPN connection to the on-premises network has insufficient bandwidth

Answer

The BGP session between the Transit Gateway and on-premises router is down

Question 9

A company has deployed a multi-VPC architecture with AWS Transit Gateway. The network team notices that traffic between two VPCs is intermittently dropped. Both VPCs are attached to the same transit gateway. Which action should the network engineer take to troubleshoot the issue?

Accepted Answer

Enable VPC Flow Logs on the subnets of the VPCs.. VPC Flow Logs capture IP traffic information at the network interface level, allowing engineers to analyze traffic patterns and identify dropped packets. Option A is incorrect because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not between VPCs. Option B is incorrect because Transit Gateway Network Manager provides a visual representation of the network topology but does not provide packet-level details. Option C is incorrect because CloudWatch metrics for transit gateway attachments show aggregate metrics like bytes in/out but not individual packet drops.

Answer

Configure AWS Direct Connect to route traffic between the VPCs.

Answer

Use Transit Gateway Network Manager to view the network topology.

Answer

Enable CloudWatch metrics for the transit gateway attachments.

Question 10

A network engineer needs to monitor the network traffic between EC2 instances in a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC. Option B is wrong because AWS Config tracks resource configuration changes, not network traffic. Option C is wrong because CloudTrail records API calls, not IP traffic. Option D is wrong because CloudWatch Logs can store logs but does not capture network traffic; it is a destination for logs, not a traffic capture service.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 11

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The template includes an Internet Gateway and a NAT Gateway. After deployment, instances in the private subnet cannot access the internet. The network engineer checks the route tables and finds that the private subnet route table has a default route pointing to the NAT Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway is deployed in the private subnet instead of the public subnet.. The NAT Gateway must be deployed in a public subnet with a route to the Internet Gateway. If it is in a private subnet, it cannot reach the internet, so instances in the private subnet cannot use it for outbound traffic. Option B is incorrect because security groups by default allow outbound traffic. Option C is incorrect because the question states the private subnet route table has a default route pointing to the NAT Gateway. Option D is incorrect because while the NAT Gateway being in a private subnet and lacking a route to the IGW is a related issue, the most direct cause is that the NAT Gateway itself is in the wrong subnet, as stated in option A.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Answer

The private subnet route table does not have a default route (0.0.0.0/0) to the NAT Gateway.

Answer

The NAT Gateway is in a private subnet and has no route to the internet gateway.

Question 12

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has set up a NAT gateway in the public subnet. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Accepted Answer

The private subnet route table does not have a route to the NAT gateway. Instances in a private subnet require a route to the NAT gateway to reach the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway as its target. Without this route, traffic from private instances sent to the internet will not be directed to the NAT gateway, and will instead remain in the VPC or be dropped. Option A is incorrect because the NAT gateway itself resides in a public subnet and uses the internet gateway via that subnet's route table; it does not require its own route to the IGW. Option B is incorrect because security groups by default allow all outbound traffic, so this is unlikely to be the issue. Option C is incorrect because not having an Elastic IP would prevent the NAT gateway from having a public IP, but the question states a NAT gateway is set up, implying it has an Elastic IP; the more fundamental issue is the missing route.

Answer

The NAT gateway does not have a route to the internet gateway

Answer

The security group for the instances blocks outbound traffic

Answer

The NAT gateway is not associated with an Elastic IP

Question 13

A network engineer is monitoring network performance and needs to collect and analyze network metrics from multiple AWS services in a centralized dashboard. Which AWS service should be used to aggregate and visualize these metrics?

Accepted Answer

Amazon CloudWatch Dashboards. Amazon CloudWatch Dashboards provide a centralized view of metrics from various AWS services, allowing you to create custom dashboards for monitoring and analysis. Option A is wrong because VPC Flow Logs capture IP traffic information but are not designed for aggregating metrics from multiple services. Option B is wrong because AWS CloudTrail logs API activity for auditing, not performance metrics. Option D is wrong because AWS Config tracks resource configuration changes, not metrics.

Answer

AWS VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 14

A company has multiple AWS accounts and wants to centrally manage network resources using AWS Transit Gateway. Which feature allows sharing the Transit Gateway across accounts?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM). RAM enables sharing of Transit Gateways across multiple AWS accounts within an organization, simplifying centralized network management. Option A (VPC peering) is a separate feature for connecting VPCs, not for sharing resources. Option C (AWS Organizations) helps manage accounts and policies but does not directly share resources. Option D (AWS Service Catalog) creates standardized products, not for sharing existing resources.

Answer

VPC peering

Answer

AWS Organizations

Answer

AWS Service Catalog

Question 15

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to its VPC. The on-premises network team reports that they can ping the private IP address of an EC2 instance in the VPC, but cannot establish a TCP connection to a web server running on that instance. The network security group allows inbound TCP port 80 from the on-premises CIDR. What should the network engineer check next?

Accepted Answer

Check the operating system firewall and web server configuration on the EC2 instance.. The instance's OS firewall or web server configuration may be blocking the TCP connection, even though ping works (ICMP may be allowed). Option A is wrong because ping works, indicating routing and NACL are fine. Option C is wrong because the BGP session status is unrelated to connectivity to the instance. Option D is wrong because the NACL is stateless and would affect ping as well, so routing is fine.

Answer

Review the network ACL associated with the subnet to ensure it allows inbound TCP 80.

Answer

Check the BGP session status on the Direct Connect virtual interface.

Answer

Verify the route table on the VPC has a route back to the on-premises network.