ANS-C01 Network Management and Operations Practice Test 19 — 15 Questions

Question 1

A company uses AWS Site-to-Site VPN over a Direct Connect connection with a private VIF to connect to on-premises. The network team wants to monitor the health of the VPN tunnels and automatically fail over to a backup VPN if the primary VPN goes down. Which combination of AWS services should the team use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon CloudWatch alarms on the VPN TunnelState metric and an AWS Lambda function to modify the route table to point to the backup VPN.. To automate failover from a primary VPN to a backup VPN, you need to detect the tunnel state and then change routing. CloudWatch alarms can monitor the TunnelState metric, and a Lambda function can modify the VPC route table to point to the backup VPN. This approach is fully automated and uses native AWS services, avoiding manual intervention.

Answer

Use AWS Network Firewall to monitor VPN tunnel health and automatically reroute traffic to the backup VPN.

Answer

Use AWS Direct Connect failover testing with a virtual interface and an Amazon Route 53 health check to update DNS records for on-premises resources.

Answer

Use AWS Transit Gateway route propagation with BGP and rely on BGP to fail over between the primary and backup VPN.

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a subnet with CIDR 10.0.1.0/24 that hosts a Network Load Balancer (NLB) and several EC2 instances. The NLB has a target group with the EC2 instances registered. The company wants to use AWS PrivateLink to provide access to a service running on these EC2 instances to other VPCs. The service must be accessible via a VPC endpoint service. The network engineer creates a VPC endpoint service configuration using the NLB. However, when consumers try to connect to the service, they receive connection timeouts. The engineer verifies that the NLB is healthy and the targets are passing health checks. The engineer also confirms that the security groups on the EC2 instances allow traffic from the NLB. What is the most likely cause of the connection timeouts?

Accepted Answer

The security group associated with the VPC endpoint service does not allow inbound traffic from the consumer VPCs on the service port.. When using AWS PrivateLink, the VPC endpoint service is associated with a security group that controls inbound traffic to the service. If this security group does not allow traffic from the consumer VPCs on the service port, connections will time out. The NLB itself does not have a security group, and the targets' security groups must allow traffic from the NLB, but the endpoint service security group is a separate requirement. Ensuring it allows the consumer CIDRs or security groups resolves the issue.

Answer

The NLB does not have a security group attached, and the default security group is blocking inbound traffic from the consumers.

Answer

The route table for the subnet hosting the NLB does not have a route to the consumer VPCs' CIDR blocks.

Answer

The VPC endpoint service is not configured to accept connections from the consumer VPCs, and the allowed principals list is empty.

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a subnet with CIDR 10.0.1.0/24 that hosts an EC2 instance. The instance needs to communicate with an on-premises server at 192.168.1.10 over an AWS Site-to-Site VPN connection. The VPC route table has a route for 192.168.1.0/24 pointing to the virtual private gateway. However, the instance cannot reach the on-premises server. The network engineer checks the VPN tunnel status and sees that both tunnels are 'UP'. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the 192.168.1.0/24 route over BGP.. In a Site-to-Site VPN with dynamic routing, the virtual private gateway learns on-premises routes via BGP. Even if the VPC route table points to the VGW, the VGW must have a route to the on-premises CIDR learned from BGP. If the on-premises router does not advertise the route, the VGW will not forward traffic. Thus, checking BGP advertisements is crucial.

Answer

The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway.

Answer

The EC2 instance's security group does not allow outbound traffic to 192.168.1.0/24.

Answer

The VPN connection is configured with static routes instead of BGP, and the static route is missing.

Question 4

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team notices that traffic from on-premises to the VPC is intermittently taking a longer path through a backup Site-to-Site VPN instead of the Direct Connect connection. The Direct Connect connection is up and BGP sessions are established. Which AWS feature can the team use to influence path selection and ensure traffic prefers the Direct Connect connection?

Accepted Answer

Adjust the BGP local preference on the on-premises router for routes learned from Direct Connect.. To influence on-premises-to-AWS traffic to prefer Direct Connect over VPN, you must adjust BGP attributes on the on-premises router. Local preference is used for outbound path selection within the on-premises AS. Setting a higher local preference for Direct Connect routes makes them preferred. Other options either affect the wrong direction or do not influence path selection.

Answer

Enable BGP route propagation on the VPC route tables.

Answer

Configure a more specific route in the VPC route table for the Direct Connect connection.

Answer

Use AS_PATH prepending on the backup VPN connection.

Question 5

A company has a hybrid network with an AWS Direct Connect connection and a Site-to-Site VPN as backup. The network engineer notices that during a recent Direct Connect maintenance, traffic failed to fail over to the VPN. The engineer verifies that the VPN tunnel is up and BGP sessions are established. The engineer needs to ensure automatic failover. Which configuration change should be made?

Accepted Answer

Set a higher local preference for the VPN BGP session.. To ensure automatic failover from Direct Connect to VPN, the VPN should be configured as less preferred during normal operation. AS_PATH prepending on the VPN BGP session makes the VPN path less attractive, so Direct Connect is used when available. When Direct Connect fails, its BGP routes are withdrawn, and the VPN becomes the preferred path. This setup provides seamless failover without manual intervention. Other options either make the VPN always preferred or do not address path selection.

Answer

Enable BGP graceful restart on the customer gateway.

Answer

Configure AS_PATH prepending on the VPN BGP session.

Answer

Configure a more specific route for the VPN.

Question 6

A company has a VPC with an internet gateway and a NAT gateway. The network engineer needs to capture and analyze traffic that is being dropped due to security group and network ACL rules. The engineer has enabled VPC Flow Logs. Which TWO fields in the flow log records should the engineer use to identify the source of the drop? (Choose two.)

Accepted Answer

The 'interface-id' field, which shows the network interface ID.. To identify the source of dropped traffic, the engineer should examine the action field to confirm a REJECT, and the interface-id field to determine whether the drop occurred at the instance level (security group) or subnet level (network ACL). The action field indicates that traffic was dropped, while the interface-id provides context about where the drop might have occurred. By correlating these fields with security group and network ACL rules, the engineer can pinpoint the cause. Other fields like log-status, srcaddr, and dstport do not directly indicate the drop source.

Answer

The 'dstport' field, which shows the destination port.

Answer

The 'log-status' field, which indicates the logging status.

Answer

The 'srcaddr' field, which shows the source IP address.

Question 7

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). The network team notices that traffic to a specific VPC is intermittently failing. The team suspects an issue with BGP routing. Which THREE steps should the team take to troubleshoot the BGP session? (Choose THREE.)

Accepted Answer

View the BGP route advertisements received by the on-premises router from AWS.. Viewing the BGP route advertisements received by the on-premises router from AWS directly reveals whether the expected prefixes are being advertised. If the routes are missing or incorrect, the VPC traffic will fail intermittently, making this a primary troubleshooting step for BGP routing issues.

Answer

Check the Direct Connect endpoint health in the AWS Management Console.

Answer

Examine VPC Flow Logs for dropped packets on the virtual interface.

Question 8

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

Accepted Answer

Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.. It provides true high availability and fast failover by using two separate Direct Connect connections, each with multiple private VIFs, attached to the same transit gateway. BFD (Bidirectional Forwarding Detection) enables sub-second failure detection, and ECMP (Equal-Cost Multi-Path) routing across the VIFs allows active-active load balancing, minimizing packet loss during failover. This design eliminates single points of failure and meets the requirement for rapid convergence with minimal disruption.

Answer

Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.

Answer

Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.

Answer

Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.

Question 9

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs to troubleshoot connectivity issues. The engineer notices that traffic from 10.0.1.5 to 192.168.1.1 on port 80 is logged as ACCEPT, but the application team reports that the web request failed. What is the most likely cause?

Accepted Answer

The destination host 192.168.1.1 is not reachable or does not have a route back to the source.. The VPC Flow Logs record the state of the TCP handshake from the perspective of the network path, but they do not confirm that the destination host successfully processed the request or that a return path exists. If 192.168.1.1 has no route back to 10.0.1.5, the initial SYN-ACK will never reach the source, causing the application to time out even though the forward traffic was accepted by the network ACL and security group.

Answer

The VPC Flow Logs are not capturing all packets due to sampling.

Answer

The network ACL is returning an ICMP unreachable message that is not logged.

Answer

The security group on the ENI is blocking outbound traffic to 192.168.1.1.

Question 10

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

Accepted Answer

Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.. Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Verify that the on-premises firewall is not blocking UDP port 500 for IKE.

Answer

Verify that the VPN tunnel's pre-shared key matches on both sides.

Question 11

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

Accepted Answer

BGP session between the customer router and AWS is down.. A private VIF relies on a BGP session between the customer router and the AWS Direct Connect router to exchange routes and maintain the virtual interface state. When the BGP session goes down, the VIF state transitions to 'down' because no routing information is being exchanged, causing connectivity loss. This is the most direct and common cause of a VIF being in the 'down' state.

Answer

AWS Site-to-Site VPN is not established.

Answer

MACsec encryption is misconfigured on the customer router.

Answer

Jumbo frames are enabled on the VIF but not supported by the customer router.

Question 12

Arrange the steps to configure a site-to-site VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA in the correct order.

Accepted Answer

Define customer gateway, then create VPN connection, then apply VPN configuration to Cisco ASA, then verify tunnel status, then configure routing.. First, define the customer gateway, then create the VPN connection, apply the configuration, verify the tunnel, and finally configure routing.

Answer

Create VPN connection, then define customer gateway, then apply configuration, then verify tunnel, then configure routing.

Answer

Define customer gateway, then create VPN connection, then verify tunnel, then apply configuration, then configure routing.

Answer

Define customer gateway, then apply configuration, then create VPN connection, then verify tunnel, then configure routing.

Question 13

Arrange the steps to configure BGP on a Cisco router for a Direct Connect private virtual interface:

Accepted Answer

Enter configuration mode, then enable BGP, then define the neighbor, then advertise prefixes, then verify.. First enter config mode, enable BGP, define the neighbor, advertise prefixes, then verify.

Answer

Enable BGP, then enter configuration mode, then define the neighbor, then advertise prefixes, then verify.

Answer

Enter configuration mode, then enable BGP, then advertise prefixes, then define the neighbor, then verify.

Answer

Enter configuration mode, then enable BGP, then define the neighbor, then verify, then advertise prefixes.

Question 14

Arrange the steps to configure an AWS Client VPN endpoint for remote access:

Accepted Answer

First create server and client certificates, then create the Client VPN endpoint, then associate the endpoint with a target network, then authorize ingress rules, then download and distribute the client configuration.. First create certificates, then the endpoint, associate with network, authorize access, then distribute client config.

Answer

First create the Client VPN endpoint, then create server and client certificates, then associate with a target network, then authorize ingress rules, then distribute client configuration.

Answer

First create server and client certificates, then create the Client VPN endpoint, then authorize ingress rules, then associate with a target network, then distribute client configuration.

Answer

First create the Client VPN endpoint, then associate with a target network, then create server and client certificates, then authorize ingress rules, then distribute client configuration.

Question 15

Match each AWS service or feature to its primary function in network architecture.

Accepted Answer

VPC: Isolated virtual network in AWS where you can launch resources. Correct matches: VPC is an isolated virtual network; Direct Connect is a dedicated physical connection; VPN is an encrypted internet-based connection; Route 53 is a DNS service. Common confusions include mixing Direct Connect with VPN and VPC with Direct Connect.

Answer

VPC: Dedicated physical connection from on-premises to AWS

Answer

Direct Connect: Encrypted connection over the internet to AWS