ANS-C01 Network Management and Operations Practice Test 19 — 15 Questions

Question 1

A network engineer needs to troubleshoot high latency between two EC2 instances in the same VPC but in different Availability Zones. Which tool should be used to measure network performance?

Accepted Answer

Use iperf to measure throughput and latency. Iperf is the correct tool because it can measure both throughput and latency between two points, making it ideal for troubleshooting high latency. Traceroute (A) shows the network path but does not measure performance. Ping (B) measures round-trip time but not throughput. Netstat (D) displays network connections and statistics but does not actively measure performance.

Answer

Use traceroute to identify the path

Answer

Use ping to test connectivity

Answer

Use netstat to check network statistics

Question 2

A company has set up a Site-to-Site VPN connection between its on-premises network and AWS. The VPN tunnel shows as 'UP' but traffic is not flowing. What should the engineer check?

Accepted Answer

Verify that route propagation is enabled on the VPC route table. Route propagation from the virtual private gateway to the VPC route table must be enabled. Option A is wrong because the tunnel state is up, so security group is not likely the issue (security group affects instances, not VPN endpoint). Option B is wrong because the internet gateway is for public internet access, not VPN. Option C is wrong because the customer gateway is the on-premises endpoint; it is configured but if routes are not propagated, traffic won't flow.

Answer

Ensure the customer gateway is configured correctly

Answer

Verify the security group rules for the VPN connection

Answer

Check the internet gateway route table

Question 3

A company is experiencing high latency for traffic between EC2 instances in the same VPC but in different Availability Zones. The network team suspects the issue is related to the placement group used. The instances are in a spread placement group. What should the network engineer do to reduce latency?

Accepted Answer

Change the placement group to a cluster placement group and ensure instances are in the same Availability Zone.. A cluster placement group is designed for low-latency, high-throughput traffic by ensuring instances are in close proximity. Option B is incorrect because enabling enhanced networking and increasing instance size can improve throughput but does not directly reduce latency caused by inter-AZ distance. Option C is incorrect because moving instances to the same AZ helps, but a spread placement group still places instances on different racks, which introduces additional latency compared to a cluster placement group. Option D is incorrect because VPC peering is used for connectivity between different VPCs; for intra-VPC traffic, adding a VPC peering connection does not reduce latency and may even add complexity.

Answer

Enable enhanced networking on the instances and increase the instance size.

Answer

Move the instances to the same subnet within the same Availability Zone but keep the spread placement group.

Answer

Create a VPC peering connection between the two AZs and route traffic through it.

Question 4

A company uses AWS Direct Connect with multiple virtual interfaces (VIFs) to connect to multiple VPCs. The network team wants to ensure high availability and failover. Which configuration provides the best resiliency?

Accepted Answer

Provision two Direct Connect connections from different providers and configure BGP. Using two separate Direct Connect connections from different providers provides path diversity and eliminates single points of failure. If one connection fails, BGP will route traffic through the other connection. Option B is wrong because a single Direct Connect connection with a VPN backup still shares the same physical infrastructure and the internet backup may not provide the same SLA. Option C is wrong because multiple AS paths on the same connection do not provide physical redundancy; they only affect route selection. Option D is wrong because multiple private VIFs on a single connection still depend on that single physical link.

Answer

Use a single Direct Connect connection with a VPN backup over the internet

Answer

Configure BGP with multiple AS paths on the same Direct Connect connection

Answer

Create multiple private VIFs on a single Direct Connect connection

Question 5

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.. The VPC route tables must have a route to the on-premises network pointing to the virtual private gateway (VGW) for traffic to reach the EC2 instances. Without this route, the VPC has no way to send return traffic or allow inbound traffic from on-premises. Option A is incorrect because the VPN tunnel status is UP, indicating the pre-shared key is correct. Option B is plausible but less likely; security groups can block traffic, but they are stateful and automatically allow return traffic. The first step in troubleshooting is to verify routes. Option C is incorrect because the VGW does not have security groups; it uses route tables for forwarding decisions.

Answer

The VPN tunnel is not properly configured with the correct pre-shared key.

Answer

The security groups on the EC2 instances are blocking inbound traffic from the on-premises network.

Answer

The virtual private gateway has its own security group that blocks traffic.

Question 6

A company is designing a highly available network architecture using AWS Direct Connect. Which TWO actions should be taken to ensure redundancy?

Accepted Answer

Provision two Direct Connect connections at different locations. To ensure redundancy for AWS Direct Connect, you should provision two Direct Connect connections at different locations (option C) to eliminate a single point of failure, and configure BGP with different ASNs on each connection (option E) to enable path diversity and automatic failover. Option A is incorrect because a single private VIF (or multiple VIFs) on a single connection still creates a single point of failure. Option B is incorrect because while a VPN backup provides some redundancy, it is not one of the two required actions for a highly available Direct Connect architecture—the question specifically asks for actions using Direct Connect. Option D is incorrect because multiple VIFs on a single connection do not provide physical path diversity; they share the same underlying connection.

Answer

Create a single private VIF on the Direct Connect connection

Answer

Set up a VPN connection over the internet as a backup

Answer

Use a single Direct Connect connection with multiple VIFs

Question 7

A company manages multiple VPCs connected via a transit gateway. Each VPC has a VPN connection to an on-premises data center. The network team wants to monitor the bandwidth utilization on each VPN connection. Which approach is the most efficient?

Accepted Answer

Use Amazon CloudWatch metrics for the VPN tunnels.. CloudWatch metrics for VPN tunnels provide bandwidth utilization. Option B is wrong because VPC Flow Logs are for packet-level logs, not metrics. Option C is wrong because AWS Config tracks configuration. Option D is wrong because Transit Gateway Network Manager provides topology, not bandwidth metrics.

Answer

Enable VPC Flow Logs on each VPC and aggregate them in CloudWatch Logs Insights.

Answer

Use Transit Gateway Network Manager to view VPN bandwidth.

Answer

Use AWS Config rules to monitor VPN bandwidth changes.

Question 8

A network engineer is troubleshooting a VPN connection that is not passing traffic. The tunnel status shows as 'UP'. Which THREE steps should the engineer take to diagnose the issue?

Accepted Answer

Ensure that the security groups for instances allow inbound traffic from the on-premises network. Security groups act as a virtual firewall for instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up, traffic will be dropped if the security group does not explicitly allow inbound traffic from the on-premises network's IP range. This is a common misconfiguration that prevents traffic flow despite a healthy tunnel.

Answer

Check the IKE and IPSEC settings on the customer gateway

Answer

Check the internet gateway route table for the VPC

Question 9

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to make outbound internet requests. A NAT Gateway is deployed in the public subnet. The network engineer notices that instances in the private subnet cannot reach the internet, but the NAT Gateway's Elastic IP is reachable from the internet. Which of the following is the most likely cause?

Accepted Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway.. The private subnet instances cannot reach the internet because the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic destined for the internet has no path. Option A is incorrect because a NACL blocking outbound traffic would cause a different symptom, but the stem indicates the NAT Gateway's EIP is reachable, suggesting routing is the issue. Option C is incorrect because the NAT Gateway is already associated with an Elastic IP. Option D is incorrect because security groups are not applied to NAT Gateways; they are applied to instances.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The NAT Gateway is not associated with an Elastic IP.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Question 10

A network engineer is designing a highly available VPN connection between an on-premises network and AWS. The on-premises network has two internet connections from different ISPs. Which AWS VPN configuration should be used to provide the highest availability?

Accepted Answer

Create two customer gateways, each with a VPN tunnel to the virtual private gateway.. Using two customer gateways with two VPN tunnels each provides redundancy at both the device and ISP level. Option A is wrong because a single VPN tunnel is not redundant. Option C is wrong because a single customer gateway with two tunnels only provides ISP redundancy. Option D is wrong because Direct Connect is not a VPN.

Answer

Create a single VPN tunnel from one customer gateway to the virtual private gateway.

Answer

Create one customer gateway with two VPN tunnels, each using different internet connections.

Answer

Use AWS Direct Connect instead of VPN for higher availability.

Question 11

A company has a hub-and-spoke network architecture using AWS Transit Gateway. The hub VPC contains a central inspection appliance (NVA) for traffic inspection. Spoke VPCs are attached to the Transit Gateway and have routes pointing to the Transit Gateway for all traffic. The Transit Gateway has a default route table that routes traffic to the NVA for inspection. Recently, the network team noticed that traffic between two spoke VPCs is not being inspected. The team verified that the Transit Gateway route tables are correctly configured and that the NVA is healthy. What should the team do to ensure that inter-spoke traffic is inspected?

Accepted Answer

Configure route propagation in the Transit Gateway route tables to propagate routes from the spoke attachments. Configuring route propagation in the Transit Gateway route tables from the spoke attachments allows the Transit Gateway to learn the specific CIDR blocks of each spoke VPC. With these routes, the Transit Gateway can forward inter-spoke traffic to the NVA for inspection. Option B is incorrect because VPC Flow Logs only capture traffic logs and do not affect routing. Option C is incorrect because adding static routes in the spoke VPC route tables pointing to the NVA would bypass the Transit Gateway and break the hub-and-spoke design. Option D is incorrect because bandwidth increase does not address the routing issue.

Answer

Enable VPC Flow Logs on the spoke VPCs to capture traffic

Answer

Add static routes in the spoke VPC route tables pointing to the NVA

Answer

Increase the bandwidth of the Transit Gateway attachments

Question 12

A network engineer is troubleshooting network connectivity issues in a VPC. The engineer suspects that the network ACL is blocking traffic. Which TWO actions should the engineer take to verify this?

Accepted Answer

Review the inbound and outbound rules of the network ACL.. Options A and D are correct because reviewing the inbound and outbound rules of the network ACL allows the engineer to check if traffic is explicitly blocked by the ACL, and enabling VPC Flow Logs with 'ACCEPT' or 'REJECT' status provides insight into whether the ACL is actually blocking the traffic. Option B is incorrect because security groups are stateful and work at the instance level, not at the subnet level like NACLs. Option C is incorrect because AWS CloudTrail records API activity, not network traffic. Option E is incorrect because AWS Direct Connect establishes a dedicated network connection but does not help verify if a NACL is blocking traffic.

Answer

Check the security group rules for the affected instances.

Answer

Use AWS CloudTrail to view network traffic logs.

Answer

Test connectivity using AWS Direct Connect.

Question 13

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB). The application is experiencing intermittent timeouts. CloudWatch metrics show that the ALB's RequestCount is within normal limits, but TargetResponseTime occasionally spikes to 10 seconds. What is the most likely cause?

Accepted Answer

The EC2 instances are experiencing high CPU utilization during peak periods.. High CPU utilization on the EC2 instances can cause slow response times, leading to timeouts. The ALB distributes requests, so RequestCount may appear normal while individual instances struggle.

Answer

The ALB is configured with an incorrect idle timeout value.

Answer

The ALB's cross-zone load balancing is disabled.

Answer

The security group for the EC2 instances is blocking traffic from the ALB.

Question 14

A network engineer is troubleshooting a VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA. The tunnel status shows 'UP' but no traffic passes. The engineer checks the route tables and finds the correct static routes on both sides. What should the engineer check next?

Accepted Answer

Review the IPsec phase 2 settings, including the traffic selectors.. If the tunnel is up but no traffic passes, the issue is often phase 2 IPsec security associations (SAs) or mismatch in encryption domains. Unlike phase 1, phase 2 can fail silently.

Answer

Check the IKE phase 1 parameters (e.g., encryption, hash).

Answer

Verify that the pre-shared keys match.

Answer

Confirm that the VPC route table has a route to the on-premises subnet.

Question 15

A company uses AWS Direct Connect to connect its data center to a VPC. The VIF is up, and the BGP session is established. However, the on-premises router cannot ping the VPC's private IP addresses. Which configuration is most likely missing?

Accepted Answer

The VPC route table does not have a route pointing to the Virtual Private Gateway for the on-premises CIDR.. For traffic to reach VPC private IPs, the VPC route table must have a route pointing to the Virtual Private Gateway (VGW) for the on-premises CIDR. Even with BGP up, without this route, traffic won't be sent to the VGW.

Answer

The Direct Connect virtual interface is in the wrong VLAN.

Answer

The BGP password is incorrect.

Answer

The on-premises router is not advertising the VPC CIDR via BGP.