ANS-C01 Network Management and Operations Practice Test 18 — 15 Questions

Question 1

A company uses AWS Network Firewall to inspect traffic between a VPC and the internet. The firewall is deployed in a dedicated inspection VPC, and traffic is routed through a Transit Gateway. The network engineer notices that some outbound HTTP traffic is being blocked, but the firewall logs show that the traffic is allowed by the firewall policy. The engineer suspects that the issue is related to the Network Firewall configuration or routing. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Network Firewall policy's stateless rule group for a rule that drops the traffic before the stateful rule group processes it.. The engineer should verify routing to the Network Firewall endpoint and check stateless rule groups. Routing ensures traffic is directed through the firewall for inspection. Stateless rules are evaluated first and can drop traffic even if stateful rules would allow it. The logs indicating allowed traffic may only reflect stateful evaluation, so stateless rules are a prime suspect.

Answer

Confirm that the Transit Gateway route tables have propagated routes for the application VPC and the inspection VPC.

Answer

Verify that the Network Firewall's stateful rule group is using the correct default action and that the rules are ordered correctly.

Answer

Ensure that the Network Firewall endpoint is associated with a subnet that has a route to the internet gateway.

Question 2

A company has a Transit Gateway with multiple VPC attachments and a VPN attachment to on-premises. The network team notices that traffic between two VPCs attached to the same Transit Gateway is not flowing, although each VPC can reach on-premises. The route tables in both VPCs point to the Transit Gateway, and the Transit Gateway route table has the VPC CIDRs. Which TWO actions should the team take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify that the Transit Gateway route table associated with the VPC attachments has routes for the peer VPC CIDRs and that the attachments are associated with that route table.. Transit Gateway routing is controlled by route tables. For VPC-to-VPC traffic, the attachment must be associated with a route table that contains routes to the destination VPC CIDR. Additionally, security groups and network ACLs on the instances can block traffic even when routing is correct. Therefore, checking the Transit Gateway route table associations and routes, and verifying security group and NACL rules, are the two key troubleshooting steps.

Answer

Ensure that the VPN attachment is associated with the same Transit Gateway route table as the VPC attachments.

Answer

Confirm that the VPC route tables have a route to the Transit Gateway for the peer VPC CIDR.

Answer

Verify that the Transit Gateway has a default route to the internet gateway for the VPCs.

Question 3

A company has a hybrid network with an AWS Direct Connect connection and a Site-to-Site VPN as backup. The company uses a transit gateway to connect multiple VPCs and on-premises networks. The network team notices that during a recent Direct Connect maintenance, traffic failed to fail over to the VPN, causing an outage. The team wants to ensure automatic failover. Which TWO actions should be taken to achieve this? (Choose two.)

Accepted Answer

Enable route propagation from the VPN attachment to the transit gateway route table and ensure the VPN BGP routes are less preferred than Direct Connect routes.. To achieve automatic failover from Direct Connect to VPN, the transit gateway must learn routes from both attachments and prefer Direct Connect when it is available. This is accomplished by enabling route propagation for both and using BGP attributes to make the VPN routes less preferred. AS path prepending on the on-premises router for the VPN session is a common method. These actions ensure that when Direct Connect fails, the VPN routes become active.

Answer

Enable Equal-Cost Multi-Path (ECMP) on the transit gateway for the Direct Connect and VPN attachments to load-balance traffic.

Answer

Configure the transit gateway route table to prefer the Direct Connect attachment over the VPN attachment by using a lower BGP MED value for the VPN.

Answer

Create a static route in the transit gateway route table pointing to the VPN attachment with a higher priority than the Direct Connect attachment.

Question 4

A network engineer is using AWS Direct Connect with a transit VIF to connect an on-premises data center to multiple VPCs via a Direct Connect gateway. The engineer notices that traffic from on-premises to a specific VPC is being dropped, even though the Direct Connect gateway association with the virtual private gateway (VGW) is active and the VIF is up. The on-premises router has a route for the VPC CIDR pointing to the Direct Connect gateway. What is the most likely cause?

Accepted Answer

The VGW route table does not have a route for the on-premises CIDR pointing to the Direct Connect gateway.. When using a Direct Connect gateway with a transit VIF, the VGW must have a route for the on-premises CIDR pointing to the Direct Connect gateway. Without this route, the VGW cannot send return traffic back to on-premises, resulting in dropped packets. The Direct Connect gateway association alone does not create this route; it must be added manually or via route propagation. The on-premises router having a route to the VPC CIDR is necessary but not sufficient.

Answer

The on-premises router is advertising the VPC CIDR back to AWS, causing a routing loop.

Answer

The Direct Connect gateway association with the VGW is in a different AWS Region than the VPC.

Answer

The transit VIF is configured with a VLAN ID that conflicts with another VIF on the same connection.

Question 5

A company uses AWS Network Firewall to protect a VPC. The firewall is deployed in a dedicated subnet and endpoint associations are configured for multiple subnets. A security engineer notices that traffic from an EC2 instance in a protected subnet to an internet host is allowed by the firewall's stateless rules but the response traffic is dropped. The firewall's policy has a stateless default action of 'drop' for fragmented packets. What is the most likely reason for the dropped response traffic?

Accepted Answer

The firewall's stateless default action for fragmented packets is 'drop', and the return traffic is fragmented, so it is dropped before stateful inspection.. AWS Network Firewall evaluates stateless rules first. The default action for fragmented packets applies when no stateless rule matches. If set to drop, fragmented return traffic is discarded before stateful inspection, breaking the connection. To resolve, either add stateless rules that allow the necessary fragments or change the default fragmented packet action to forward, ensuring stateful inspection can process the flow.

Answer

The firewall's endpoint association is missing for the subnet where the EC2 instance resides, so return traffic bypasses the firewall.

Answer

The stateless rules do not allow return traffic, and the firewall's stateful engine is not configured to handle the flow.

Answer

The stateful rule group is not configured to allow the return traffic, and the default stateful action is drop.

Question 6

A company has a hybrid network with an AWS Direct Connect connection using a private VIF to access resources in a VPC. The company also has a backup VPN connection over the internet. The network team wants to ensure that traffic to on-premises prefers the Direct Connect connection but fails over to the VPN if Direct Connect becomes unavailable. They have configured BGP on both connections. Which TWO actions should the network team take to meet these requirements? (Choose two.)

Accepted Answer

Set a higher BGP local preference for routes learned over the Direct Connect connection on the on-premises router.. To prefer Direct Connect over VPN for on-premises to AWS traffic, the on-premises router must select Direct Connect as the best path. This can be achieved by setting a higher BGP local preference for routes learned over Direct Connect, or by prepending the AS_PATH on routes learned over VPN to make them less preferred. Both methods influence BGP path selection on the on-premises side. The VPN will then be used only if Direct Connect fails, providing the desired failover.

Answer

Configure the VPN connection to use a higher BGP local preference than the Direct Connect connection on the AWS side.

Answer

Advertise more specific prefixes from on-premises over the VPN connection than over Direct Connect.

Answer

Advertise the same prefixes over both connections with equal BGP attributes to enable equal-cost multipath (ECMP).

Question 7

A network engineer is configuring a transit gateway to route traffic between a VPC and an on-premises network over a Site-to-Site VPN. The engineer has created a transit gateway, attached the VPC, and attached the VPN. However, traffic from the VPC to on-premises is not reaching the destination. The engineer has verified that the VPC route table has a route to the transit gateway and the VPN connection is up. Which additional step is required on the transit gateway route table to enable this traffic?

Accepted Answer

Associate the VPN attachment with the transit gateway route table and enable route propagation from the VPN attachment.. A transit gateway attachment must be associated with a transit gateway route table to participate in routing. For a VPN attachment, you also need to enable route propagation so that routes learned from on-premises via BGP are added to the route table. Once the VPN attachment is associated and propagation is enabled, the transit gateway can route traffic from the VPC to on-premises. Static routes alone are insufficient if the attachment is not associated.

Answer

Enable equal-cost multi-path (ECMP) on the VPN attachment.

Answer

Create a static route in the transit gateway route table for the on-premises CIDR pointing to the VPN attachment.

Answer

Modify the VPC attachment to use a different subnet for the transit gateway ENI.

Question 8

A company uses AWS Direct Connect with a private VIF to connect to resources in a VPC. The network team wants to monitor the health of the BGP session between the on-premises router and the Direct Connect endpoint. They need to receive alerts when the BGP session goes down. Which AWS service or feature should they use to monitor the BGP session status and trigger an alert?

Accepted Answer

Amazon CloudWatch alarms based on the Direct Connect virtual interface's BGP session state metric.. Direct Connect virtual interfaces publish a CloudWatch metric called BGP session state, which indicates whether the BGP session is up (1) or down (0). By creating a CloudWatch alarm on this metric, the network team can receive alerts when the session goes down. This is the correct and native AWS solution for monitoring BGP session health and triggering alerts.

Answer

AWS Direct Connect gateway and its associated BGP session monitoring.

Answer

AWS Network Manager and its Route Analyzer feature.

Answer

AWS CloudWatch metrics for the Direct Connect virtual interface, specifically the BGP session state metric.

Question 9

A company uses AWS Direct Connect with a private VIF to connect their on-premises data center to a VPC in us-east-1. They have a virtual private gateway (VGW) attached to the VPC. The network team notices that traffic from on-premises to the VPC is intermittently failing. They suspect an issue with the Direct Connect connection or the VGW. Which TWO actions should they take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify that the BGP session status for the private VIF is 'up' and that routes are being advertised and received.. Intermittent traffic failures over Direct Connect often stem from physical layer issues or BGP session problems. Checking the connection state ensures the physical link is stable, and verifying BGP session status and route exchange confirms the logical routing is working. These two actions directly address the most common causes of intermittent connectivity in a Direct Connect private VIF setup.

Answer

Ensure that the VPC route table has a route to the on-premises CIDR pointing to the virtual private gateway.

Answer

Verify that the on-premises router is configured with the correct VLAN ID for the private VIF.

Answer

Check the Direct Connect gateway associations to ensure the virtual private gateway is associated with the correct Direct Connect gateway.

Question 10

A network engineer is responsible for monitoring a large AWS environment with multiple VPCs and wants to centralize network traffic analysis. The engineer needs to capture VPC Flow Logs from all VPCs and store them in a central S3 bucket for analysis. The engineer also wants to ensure that the flow logs are delivered reliably and can be queried efficiently. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Ensure that the S3 bucket policy allows the flow log service to put objects into the bucket, and that the IAM role used by each flow log has the necessary s3:PutObject permission.. To centralize VPC Flow Logs in an S3 bucket, you must create a flow log for each VPC, specifying the central S3 bucket as the destination and an IAM role with write permissions. Additionally, the S3 bucket policy must allow the flow log service to put objects, and the IAM role must have s3:PutObject permission. Enabling at organization level is not supported, and using CloudWatch Logs as an intermediary is unnecessary. Reusing a single role is possible, but the action as described is inaccurate. Therefore, the two correct actions are creating flow logs per VPC with a role, and ensuring proper S3 bucket policy and IAM permissions.

Answer

Use Amazon CloudWatch Logs as the destination for the flow logs and then export them to S3 using a subscription filter.

Answer

Enable VPC Flow Logs at the organization level using AWS Organizations and a service control policy (SCP) to enforce logging.

Answer

Configure the flow logs to use a single IAM role that has permissions to write to the central S3 bucket, and attach that role to all VPCs.

Question 11

A network engineer is responsible for a large AWS environment with multiple VPCs connected via AWS Transit Gateway. The engineer needs to implement a centralized egress solution for internet access from private subnets across all VPCs. The solution must be highly available and scalable. Which TWO configurations should the engineer implement to achieve this? (Choose two.)

Accepted Answer

Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the egress VPC attachment.. The two correct configurations are: creating a dedicated egress VPC with NAT gateways in each Availability Zone and attaching it to the Transit Gateway, and configuring a default route in the Transit Gateway route table pointing to the egress VPC attachment. Together, these provide a centralized, highly available, and scalable egress solution. Other options either propose non-centralized approaches or are incomplete components.

Answer

Associate the egress VPC with a route table that has a route to an internet gateway, and configure the NAT gateways in public subnets.

Answer

Deploy a NAT instance in each VPC and configure route tables to use the NAT instance for internet access.

Answer

Enable route propagation on the Transit Gateway route table for all VPC attachments to automatically learn routes.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They have deployed an AWS Network Firewall in a dedicated subnet to inspect traffic between the VPC and the internet. The network team wants to log all traffic that is allowed by the firewall and also capture the full packet payload for further analysis. Which logging configuration should they use?

Accepted Answer

Use AWS Traffic Mirroring to mirror traffic from the Network Firewall endpoint ENI to an EC2 instance running a packet capture tool.. To capture full packet payload for traffic inspected by AWS Network Firewall, you must use AWS Traffic Mirroring. Network Firewall's native logging (alert and flow logs) does not include full packet payload; it only provides metadata. Traffic Mirroring can copy traffic from the firewall endpoint ENI to an EC2 instance or Network Load Balancer for deep packet inspection and analysis.

Answer

Enable flow logs on the Network Firewall endpoint ENI and set the log destination to CloudWatch Logs.

Answer

Configure Network Firewall logging with alert logs and flow logs, and set the log destination to an S3 bucket for alert logs and CloudWatch Logs for flow logs.

Answer

Enable Network Firewall logging with flow logs and set the log destination to Kinesis Data Firehose with a transformation Lambda function to extract payload.

Question 13

A network engineer is using AWS Reachability Analyzer to troubleshoot connectivity between an EC2 instance and an RDS database in the same VPC. The analyzer reports that the path is not reachable due to a security group rule. The engineer verifies that the security group attached to the EC2 instance allows outbound traffic to the RDS security group, and the RDS security group allows inbound traffic from the EC2 security group. However, the analyzer still reports the path as not reachable. What is the most likely reason?

Accepted Answer

The security group rules are correct, but the analyzer is evaluating the path in only one direction; the return traffic is blocked by a security group rule.. Reachability Analyzer performs a detailed analysis of the path, including security group and network ACL rules in both directions. Even if the forward path is allowed, a missing return rule can cause the analyzer to report the path as not reachable. Verifying that both the source and destination security groups allow traffic in both directions, including outbound rules on the destination, is essential.

Answer

The network ACL associated with the subnet is blocking the traffic, and the analyzer misreported it as a security group issue.

Answer

The EC2 instance and RDS database are in different subnets, and the route table does not have a route between them.

Answer

The security group rules are not correctly referencing each other; the analyzer requires CIDR-based rules.

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16. They have a transit gateway that connects this VPC to an on-premises network via a Site-to-Site VPN. The on-premises network uses BGP and advertises a default route (0.0.0.0/0) to the transit gateway. The company wants to ensure that all internet-bound traffic from the VPC is routed through the on-premises network for inspection. The VPC has a route table with a route for 0.0.0.0/0 pointing to the transit gateway. However, instances in the VPC cannot reach the internet. What is the most likely cause?

Accepted Answer

The transit gateway route table does not have a route for 0.0.0.0/0 pointing to the VPN attachment.. The transit gateway must have a route for 0.0.0.0/0 in its route table pointing to the VPN attachment. Even if the VPC route table points to the transit gateway, the transit gateway will not forward traffic without a matching route. By default, transit gateway route tables do not propagate a default route; you must either enable propagation of the default route or create a static route.

Answer

The transit gateway does not propagate the default route from the VPN attachment to the VPC route table.

Answer

The on-premises router is not advertising the default route over BGP.

Answer

The VPC's internet gateway is missing from the route table.

Question 15

A company is using AWS Site-to-Site VPN with a virtual private gateway (VGW) to connect an on-premises network to a VPC. The network engineer notices that the VPN tunnel is up, but traffic from on-premises to the VPC is intermittently failing. The engineer suspects an issue with the VPN tunnel's dead peer detection (DPD) or routing. Which TWO actions should the engineer take to troubleshoot the intermittent connectivity? (Choose two.)

Accepted Answer

Review the CloudWatch metrics for the VPN tunnel, specifically TunnelState and TunnelDataIn/TunnelDataOut.. Intermittent VPN connectivity often stems from routing issues or tunnel instability. Checking the VGW route table ensures that return traffic has a path to on-premises. Reviewing CloudWatch metrics for the VPN tunnel helps identify flapping or periods of no data transfer. These two actions directly address the likely causes. Other options like pre-shared key errors would prevent tunnel establishment, and MTU or security group issues typically cause consistent failures, not intermittent ones.

Answer

Increase the maximum transmission unit (MTU) on the on-premises router to 1500 bytes.

Answer

Check the security group and network ACL rules on the VPC resources to ensure they allow traffic from the on-premises CIDR.

Answer

Verify that the on-premises router is configured to use the correct pre-shared key and IKE version.