ANS-C01 Network Management and Operations Practice Test 19 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to make outbound internet requests. A NAT Gateway is deployed in the public subnet. The network engineer notices that instances in the private subnet cannot reach the internet, but the NAT Gateway's Elastic IP is reachable from the internet. Which of the following is the most likely cause?

Accepted Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway.. Option C is correct because the private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Option A is wrong because the NAT Gateway is in a public subnet with a route to IGW. Option B is wrong because security groups are not applicable to NAT Gateway. Option D is wrong because NACL on private subnet would affect inbound/outbound traffic, but the issue is routing.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The NAT Gateway is not associated with an Elastic IP.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Question 2

A company wants to monitor network traffic in its VPC for security analysis. Which TWO AWS services can be used to capture and analyze network traffic?

Accepted Answer

Amazon Inspector. Option A and D are correct because VPC Flow Logs capture network traffic information, and Amazon Inspector can analyze network configurations for vulnerabilities. Option B is wrong because CloudTrail records API calls. Option C is wrong because AWS Config monitors resource configuration. Option E is wrong because AWS Shield is for DDoS protection.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Shield

Question 3

A network engineer is designing a highly available VPN connection between an on-premises network and AWS. The on-premises network has two internet connections from different ISPs. Which AWS VPN configuration should be used to provide the highest availability?

Accepted Answer

Create two customer gateways, each with a VPN tunnel to the virtual private gateway.. Option B is correct because using two customer gateways with two VPN tunnels each provides redundancy at both the device and ISP level. Option A is wrong because a single VPN tunnel is not redundant. Option C is wrong because a single customer gateway with two tunnels only provides ISP redundancy. Option D is wrong because Direct Connect is not a VPN.

Answer

Create a single VPN tunnel from one customer gateway to the virtual private gateway.

Answer

Create one customer gateway with two VPN tunnels, each using different internet connections.

Answer

Use AWS Direct Connect instead of VPN for higher availability.

Question 4

A company has a hub-and-spoke network architecture using AWS Transit Gateway. The hub VPC contains a central inspection appliance (NVA) for traffic inspection. Spoke VPCs are attached to the Transit Gateway and have routes pointing to the Transit Gateway for all traffic. The Transit Gateway has a default route table that routes traffic to the NVA for inspection. Recently, the network team noticed that traffic between two spoke VPCs is not being inspected. The team verified that the Transit Gateway route tables are correctly configured and that the NVA is healthy. What should the team do to ensure that inter-spoke traffic is inspected?

Accepted Answer

Configure route propagation in the Transit Gateway route tables to propagate routes from the spoke attachments. Option B is correct because enabling route propagation from the Transit Gateway attachments to the route tables ensures that routes are dynamically updated. Option A is wrong because static routes may cause issues if the NVA IP changes. Option C is wrong because VPC Flow Logs do not configure inspection. Option D is wrong because increasing bandwidth does not solve the inspection routing issue.

Answer

Enable VPC Flow Logs on the spoke VPCs to capture traffic

Answer

Add static routes in the spoke VPC route tables pointing to the NVA

Answer

Increase the bandwidth of the Transit Gateway attachments

Question 5

A network engineer is troubleshooting network connectivity issues in a VPC. The engineer suspects that the network ACL is blocking traffic. Which TWO actions should the engineer take to verify this?

Accepted Answer

Review the inbound and outbound rules of the network ACL.. Options A and C are correct because reviewing NACL rules and enabling VPC Flow Logs with ACL accept/reject status can identify blocked traffic. Option B is wrong because security groups are stateful and work differently. Option D is wrong because CloudTrail does not log network traffic. Option E is wrong because Direct Connect is unrelated.

Answer

Check the security group rules for the affected instances.

Answer

Use AWS CloudTrail to view network traffic logs.

Answer

Test connectivity using AWS Direct Connect.

Question 6

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB). The application is experiencing intermittent timeouts. CloudWatch metrics show that the ALB's RequestCount is within normal limits, but TargetResponseTime occasionally spikes to 10 seconds. What is the most likely cause?

Accepted Answer

The EC2 instances are experiencing high CPU utilization during peak periods.. High CPU utilization on the EC2 instances can cause slow response times, leading to timeouts. The ALB distributes requests, so RequestCount may appear normal while individual instances struggle.

Answer

The ALB is configured with an incorrect idle timeout value.

Answer

The ALB's cross-zone load balancing is disabled.

Answer

The security group for the EC2 instances is blocking traffic from the ALB.

Question 7

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. The network engineer needs to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which THREE steps are necessary to achieve this?

Accepted Answer

Add a route in the subnet route table for ::/0 to an egress-only internet gateway.. Options A, B, and D are correct. A: Associate an IPv6 CIDR block. B: Enable IPv6 on the subnet. D: Add a route for ::/0 to an egress-only internet gateway or internet gateway. Option C is wrong because IPv6 traffic uses egress-only IGW, not NAT. Option E is wrong because security groups do not need to be updated specifically for IPv6; they work for both.

Answer

Update security group rules to allow IPv6 traffic.

Answer

Configure a NAT64 gateway for IPv6 to IPv4 translation.

Question 8

A network engineer is troubleshooting a VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA. The tunnel status shows 'UP' but no traffic passes. The engineer checks the route tables and finds the correct static routes on both sides. What should the engineer check next?

Accepted Answer

Review the IPsec phase 2 settings, including the traffic selectors.. If the tunnel is up but no traffic passes, the issue is often phase 2 IPsec security associations (SAs) or mismatch in encryption domains. Unlike phase 1, phase 2 can fail silently.

Answer

Check the IKE phase 1 parameters (e.g., encryption, hash).

Answer

Verify that the pre-shared keys match.

Answer

Confirm that the VPC route table has a route to the on-premises subnet.

Question 9

A company uses AWS Direct Connect to connect its data center to a VPC. The VIF is up, and the BGP session is established. However, the on-premises router cannot ping the VPC's private IP addresses. Which configuration is most likely missing?

Accepted Answer

The VPC route table does not have a route pointing to the Virtual Private Gateway for the on-premises CIDR.. For traffic to reach VPC private IPs, the VPC route table must have a route pointing to the Virtual Private Gateway (VGW) for the on-premises CIDR. Even with BGP up, without this route, traffic won't be sent to the VGW.

Answer

The Direct Connect virtual interface is in the wrong VLAN.

Answer

The BGP password is incorrect.

Answer

The on-premises router is not advertising the VPC CIDR via BGP.

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team needs to monitor the BGP session status for each VPN attachment. Which TWO services can be used to monitor BGP status and receive alerts if a session goes down?

Accepted Answer

Amazon CloudWatch Alarms on the BGP status metric.. Options A and D are correct. CloudWatch can monitor VPN tunnel metrics including BGP status, and CloudWatch Alarms can trigger alerts. Option B is wrong because VPC Flow Logs do not include BGP status. Option C is wrong because AWS Config does not monitor BGP. Option E is wrong because CloudTrail does not monitor BGP.

Answer

AWS Config rules.

Answer

VPC Flow Logs.

Answer

AWS CloudTrail logs.

Question 11

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway, and the private subnet has EC2 instances that need internet access. The private instances can reach the internet, but cannot access an S3 bucket in the same region using the S3 gateway endpoint. What is the most likely cause?

Accepted Answer

The private subnet's route table does not have a route to the S3 gateway endpoint.. For private instances to use a gateway endpoint, the route table for the private subnet must have a route pointing to the S3 endpoint. Additionally, the endpoint's policy must allow the traffic. The NAT Gateway is not used for gateway endpoints.

Answer

The S3 gateway endpoint is not in the same VPC.

Answer

The S3 bucket policy does not allow access from the VPC.

Answer

The NAT Gateway is in a different availability zone than the private instances.

Question 12

A company has a hybrid network architecture with an AWS VPC (10.0.0.0/16) connected to an on-premises data center via AWS Direct Connect with a private VIF. The on-premises network uses 10.1.0.0/16. The VPC has subnets in two Availability Zones, each with a private subnet (10.0.1.0/24 and 10.0.2.0/24) and a public subnet. The company recently deployed a new application in the VPC that uses an Application Load Balancer (ALB) in the public subnets. The ALB targets EC2 instances in the private subnets. Users on-premises report that they cannot access the application using the ALB's DNS name. The on-premises network team confirms that they can ping the ALB's private IP address from on-premises. The VPC route tables have routes for the on-premises network pointing to the virtual private gateway (VGW). The security groups and network ACLs are configured to allow traffic from on-premises. What is the most likely cause of the issue?

Accepted Answer

The on-premises DNS resolver does not resolve the ALB's DNS name to a private IP address, causing traffic to go over the internet.. Option D is correct because the ALB's DNS name resolves to public IPs, and on-premises traffic to public IPs would go over the internet, not Direct Connect, unless the DNS resolution is configured to return private IPs. Since the users can ping the private IP, the issue is DNS resolution. Option A is wrong because the route tables already have routes to on-premises. Option B is wrong because the ALB is in public subnets and should be accessible. Option C is wrong because security groups are not the issue as they allow traffic.

Answer

The VPC route tables do not have a route to the on-premises network for the ALB's subnet.

Answer

The security group on the ALB blocks inbound traffic from the on-premises CIDR.

Answer

The ALB is deployed in private subnets instead of public subnets.

Question 13

A network engineer is monitoring a hybrid network with a VPN connection to AWS. The engineer notices periodic packet loss and high latency during peak hours. The VPN tunnel uses static routing. The on-premises bandwidth is 100 Mbps, and the VPN connection is limited to 1.25 Gbps. What is the most likely cause?

Accepted Answer

The on-premises internet connection is saturated.. The VPN connection's bandwidth (1.25 Gbps) is sufficient, but if the on-premises link is only 100 Mbps, any traffic exceeding that will cause congestion and packet loss. The VPN tunnel itself is not the bottleneck.

Answer

The VPC route table has a blackhole route for the on-premises CIDR.

Answer

The VPN tunnel is using the incorrect encryption algorithm.

Answer

The VPN tunnel is exceeding its maximum bandwidth limit.

Question 14

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC contains an Amazon RDS for MySQL database in a private subnet. The database is accessed by EC2 instances in the same VPC and by on-premises servers via a Site-to-Site VPN. The network team recently enabled VPC Flow Logs and noticed that the database is receiving a high number of SYN packets from an IP address that is not part of the VPC or on-premises network. The security group for the database only allows inbound traffic on port 3306 from the EC2 instances' security group and the on-premises CIDR (10.0.0.0/8). The network ACL for the database subnet allows inbound and outbound traffic on all ports from all sources. What is the most likely cause of the unexpected traffic?

Accepted Answer

The network ACL for the database subnet allows all inbound traffic, so packets from the internet reach the database subnet's network ACL before being evaluated by the security group.. Option B is correct because a network ACL is stateless and allows traffic from any source, including the internet, because it allows all inbound traffic. Even though the security group blocks the traffic, the NACL allows it, so the packets reach the NACL and are logged. Option A is wrong because the security group is blocking the traffic, not allowing it. Option C is wrong because RDS is not publicly accessible. Option D is wrong because the VPN is only for on-premises traffic; the IP is not from on-premises.

Answer

The security group for the database has an inbound rule that allows traffic from 0.0.0.0/0.

Answer

The RDS database has a public endpoint that is accessible from the internet.

Answer

The Site-to-Site VPN is misconfigured and routing internet traffic into the VPC.

Question 15

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network can reach some VPCs but not others. All VPCs are attached to the same Transit Gateway. What should the engineer check first?

Accepted Answer

The Transit Gateway route tables and associations.. The Transit Gateway route tables control which VPCs and attachments can communicate. If some VPCs are in a different route table or if propagation is not configured, traffic may not be routed correctly.

Answer

The VPC flow logs for the unreachable VPCs.

Answer

The Direct Connect virtual interface status.

Answer

The BGP session between the on-premises router and the Direct Connect router.