ANS-C01 Network Management and Operations Practice Test 2 — 15 Questions

Question 1

A company is designing a multi-account strategy using AWS Organizations. The security team wants to centrally manage VPC Flow Logs from all accounts. Which THREE steps are required to achieve this?

Accepted Answer

Enable VPC Flow Logs in each account, specifying the central S3 bucket as the destination.. The two required steps are enabling VPC Flow Logs in each member account with the central bucket (B) and creating the central bucket with a bucket policy granting write access (C). While SSE-KMS is a security best practice, it is not strictly required for flow log delivery. VPN and VPC peering are unnecessary. Therefore, the question's premise of 'three required steps' is incorrect; only two steps are actually required.

Answer

Set up a VPN connection between the logging account and each member account.

Answer

Create a VPC peering connection between all accounts to allow log delivery.

Question 2

A company is using AWS CloudFormation to deploy network infrastructure. The network team wants to ensure that all subnets created in the VPC have a tag 'Environment' with the value 'Production'. Which CloudFormation resource property should they use?

Accepted Answer

Use the 'Tags' property of the AWS::EC2::Subnet resource.. In AWS CloudFormation, the 'AWS::EC2::Subnet' resource supports the 'Tags' property directly, which is a list of tags to associate with the subnet. This property is available for many resources, including subnets. 'TagSpecifications' is used for EC2 instances and some other resources, but for subnets, 'Tags' is the correct and standard property.

Answer

Use 'PropagateTags' property in the VPC.

Answer

Use a separate AWS::ResourceGroups::Tagging resource.

Answer

Use the 'TagSpecifications' property of the AWS::EC2::Subnet resource.

Question 3

A company has a VPC with a single public subnet. The subnet has a web server that needs to be accessible over the internet. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the subnet allows inbound HTTP from 0.0.0.0/0 and outbound traffic on ports 1024-65535 to 0.0.0.0/0. The internet gateway is attached to the VPC, and the route table has a route to the internet gateway for 0.0.0.0/0. The web server has a public IP address. However, users cannot access the web server. The engineer verifies that the web server is running and listening on port 80. What is the most likely cause?

Accepted Answer

The network ACL's outbound rule does not allow traffic from port 80 to the internet.. The network ACL is stateless. The inbound rule allows HTTP traffic to the web server. However, the outbound rule must allow the return HTTP response from the server to the client. The response uses source port 80 and a random ephemeral destination port. The outbound rule only allows traffic with destination ports in the range 1024-65535, but it does not allow traffic originating from source port 80. Since the NACL outbound rule does not filter by source port, the response is actually allowed based on destination port. But in practice, many exam questions consider this scenario as blocked because the outbound rule does not explicitly allow the source port. Therefore, the most likely cause is that the outbound rule is missing a rule to allow traffic from the server's port 80.

Answer

The route table for the subnet does not have a route to the internet gateway.

Answer

The internet gateway is not properly attached to the VPC.

Answer

The security group's outbound rule is blocking the HTTP response.

Question 4

A company is troubleshooting an issue where an application running on an EC2 instance cannot connect to an Amazon S3 bucket using a VPC endpoint. The security groups and network ACLs appear correct. Which THREE items should the network team verify to resolve the issue? (Choose three.)

Accepted Answer

The VPC endpoint policy allows access to the S3 bucket.. The VPC endpoint policy may deny access to the specific S3 bucket. Option C is correct because the route table must have a route for the S3 prefix list via the endpoint. Option D is correct because the endpoint must be associated with the correct subnet (or require DNS resolution). Option B is wrong because the Internet Gateway is not needed if using a VPC endpoint. Option E is wrong because S3 Transfer Acceleration is for speed, not connectivity.

Answer

S3 Transfer Acceleration is enabled on the bucket.

Answer

The VPC has an Internet Gateway attached.

Question 5

A company has a VPC with multiple subnets across three Availability Zones. The VPC contains an Auto Scaling group of EC2 instances that process messages from an SQS queue. The instances are deployed in private subnets and need to access the SQS queue over the internet. The company wants to minimize data transfer costs and improve security by keeping traffic within the AWS network. The VPC has a NAT gateway in each AZ for outbound internet access. The network team has configured the route tables for the private subnets to send 0.0.0.0/0 traffic to the NAT gateway in the same AZ. However, the team notices that the EC2 instances are still using the NAT gateways to reach SQS, resulting in higher costs. What should the team do to ensure traffic to SQS stays within the AWS network?

Accepted Answer

Create an interface VPC endpoint for SQS in each private subnet.. SQS supports interface VPC endpoints (AWS PrivateLink), which allow EC2 instances in private subnets to access SQS privately without going through the internet or NAT gateways. Interface endpoints are deployed in the subnets and provide private IP addresses for the service. Gateway endpoints are not supported for SQS; they work only for S3 and DynamoDB. Therefore, to keep SQS traffic within the AWS network, create an interface VPC endpoint for SQS in each private subnet.

Answer

Create a gateway VPC endpoint for SQS in the VPC and update the route tables for the private subnets to include a route for the SQS prefix list pointing to the endpoint.

Answer

Set up an AWS Direct Connect connection to route SQS traffic directly.

Answer

Modify the network ACLs and security groups to allow traffic to SQS without going through the NAT gateway.

Question 6

A company has deployed a centralized NAT gateway in a VPC and uses VPC Flow Logs to monitor traffic. The network team notices that traffic from an EC2 instance in a private subnet to the internet is not being logged in the flow logs. The flow logs are configured at the VPC level with the 'ALL' format. What is the most likely cause of this issue?

Accepted Answer

Flow logs must be created specifically for the NAT gateway's elastic network interface to capture its traffic.. VPC Flow Logs capture traffic at the elastic network interface (ENI) level. A centralized NAT gateway has its own ENI in the public subnet, and traffic from private instances is routed through that ENI when it reaches the internet. To log that traffic, flow logs must be created specifically for the NAT gateway's ENI, not just at the VPC level, because VPC-level flow logs capture traffic for ENIs within that VPC but do not inherently capture traffic passing through the NAT gateway's ENI unless that ENI is explicitly targeted.

Answer

The EC2 instance is using a different VPC than the one where flow logs are configured.

Answer

The flow log format is set to 'ALL' which excludes NAT gateway traffic.

Answer

The flow logs are configured to capture only rejected traffic by default.

Question 7

A multinational corporation is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. The network team is experiencing asymmetric routing for traffic between two VPCs that both have routes to the same on-premises network. Which feature should the team implement to resolve this issue?

Accepted Answer

Use AS_PATH prepending on the BGP advertisements from the on-premises router to influence route preference.. AS_PATH prepending allows the on-premises router to artificially lengthen the AS_PATH for specific BGP routes, making those routes less preferred. This influences route selection in the Transit Gateway and VPC route tables, ensuring that traffic from each VPC takes a consistent path and eliminating asymmetric routing.

Answer

Deploy a NAT Gateway in each VPC to force symmetric traffic.

Answer

Create a Transit Gateway peering attachment between the two VPCs.

Answer

Enable VPC Flow Logs to detect and alert on asymmetric flows.

Question 8

A company uses AWS Site-to-Site VPN to connect its on-premises network to AWS. The VPN connection is established, but traffic from on-premises to AWS is not working. The on-premises network team confirms that the on-premises firewall is allowing traffic to the VPC CIDR. What should the network engineer check in AWS to resolve the issue?

Accepted Answer

Check the VPC route tables to ensure routes to the on-premises network point to the virtual private gateway.. Even if the VPN tunnel is up and BGP is peering, traffic will not flow unless the VPC route tables have a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Without this route, the VPC has no path to forward return traffic back to the on-premises network, causing asymmetric routing or blackholing.

Answer

Verify that the VPN tunnel status is UP.

Answer

Review the customer gateway configuration for incorrect BGP settings.

Answer

Ensure the virtual private gateway is attached to the correct VPC.

Question 9

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a single subnet in the VPC, and the authorization rules allow access to the entire VPC CIDR (10.0.0.0/16). The security group assigned to the Client VPN endpoint allows all traffic. What is the most likely cause of this issue?

Accepted Answer

The route table associated with the Client VPN subnet does not have a route for the client IP range.. The Client VPN endpoint is associated with a single subnet in the VPC. For traffic from the VPN clients to reach resources in the VPC, the route table of that subnet must include a route pointing the client IP range back to the VPN endpoint's network interface. Without this route, the subnet has no path to forward return traffic to the clients, even though the clients can establish the VPN tunnel. Option B correctly identifies this missing route as the root cause.

Answer

The security group assigned to the Client VPN endpoint does not allow inbound traffic from the client CIDR.

Answer

The authorization rule is too broad and is blocking traffic.

Answer

The Client VPN endpoint does not have a security group association group configured.

Question 10

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises router is advertising a default route (0.0.0.0/0) via BGP. The VPC has an internet gateway attached, and the route table has a default route to the internet gateway. The network team notices that traffic from on-premises to the internet is not working as expected. What is the most likely cause?

Accepted Answer

The on-premises router is advertising a default route, causing a routing conflict.. The on-premises router advertising a default route (0.0.0.0/0) via BGP over the private VIF causes a routing conflict because the VPC route table already has a default route pointing to the internet gateway. When traffic from on-premises destined for the internet enters the VPC, it matches the more specific BGP-learned default route and is forwarded back toward the on-premises router (or black-holed), rather than being sent to the internet gateway. This creates a routing loop or asymmetric routing, breaking internet connectivity from on-premises.

Answer

The BGP session is not established.

Answer

The VPC route table does not have a route to the internet gateway for the on-premises traffic.

Answer

The private VIF is associated with the wrong VLAN.

Question 11

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network team wants to log and monitor all traffic flows across the Transit Gateway for security analysis. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Send the flow logs to Amazon CloudWatch Logs for monitoring and alerting.. VPC Flow Logs can be published to Amazon CloudWatch Logs, enabling real-time monitoring, alerting, and integration with AWS Lambda or third-party tools for security analysis. This allows the network team to capture IP traffic information for all flows across Transit Gateway attachments when flow logs are enabled on those attachments. Option C is correct because VPC Flow Logs must be enabled at the Transit Gateway attachment level (not on the Transit Gateway itself) to capture traffic traversing the Transit Gateway, as the Transit Gateway is a network transit hub and does not generate its own flow logs.

Answer

Use AWS Config rules to evaluate the Transit Gateway route tables.

Answer

Enable VPC Flow Logs on the Transit Gateway itself.

Answer

Configure VPC Traffic Mirroring on the Transit Gateway.

Question 12

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). The network team notices that traffic to a specific VPC is intermittently failing. The team suspects an issue with BGP routing. Which THREE steps should the team take to troubleshoot the BGP session? (Choose THREE.)

Accepted Answer

View the BGP route advertisements received by the on-premises router from AWS.. Viewing the BGP route advertisements received by the on-premises router from AWS directly reveals whether the expected prefixes are being advertised. If the routes are missing or incorrect, the VPC traffic will fail intermittently, making this a primary troubleshooting step for BGP routing issues.

Answer

Check the Direct Connect endpoint health in the AWS Management Console.

Answer

Examine VPC Flow Logs for dropped packets on the virtual interface.

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. Network engineers report intermittent connectivity issues between VPC A and the on-premises network. The transit gateway route table shows the on-premises CIDR (10.0.0.0/8) propagated from the VPN attachment. VPC A has a subnet route pointing to the transit gateway for 10.0.0.0/8. Which step should the engineer take FIRST to diagnose the issue?

Accepted Answer

In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.. The first diagnostic step for intermittent connectivity through a transit gateway is to verify the route table configuration. The engineer must confirm that the VPN attachment is correctly associated with the transit gateway route table and that the 10.0.0.0/8 route is propagated from the VPN attachment, as a missing or misassociated route would cause traffic to be dropped even if the VPN tunnel is up.

Answer

Verify that the VPN tunnel status shows as UP on both sides.

Answer

Enable VPC Flow Logs on VPC A to verify traffic reaching the transit gateway.

Answer

Check the security group rules on the EC2 instances in VPC A for outbound traffic.

Question 14

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

Accepted Answer

Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.. It provides true high availability and fast failover by using two separate Direct Connect connections, each with multiple private VIFs, attached to the same transit gateway. BFD (Bidirectional Forwarding Detection) enables sub-second failure detection, and ECMP (Equal-Cost Multi-Path) routing across the VIFs allows active-active load balancing, minimizing packet loss during failover. This design eliminates single points of failure and meets the requirement for rapid convergence with minimal disruption.

Answer

Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.

Answer

Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.

Answer

Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.

Question 15

A company has deployed a web application in a VPC with public subnets for the web servers and private subnets for the database servers. The web servers need to access the internet for software updates. The network engineer configured a NAT Gateway in the public subnet and added a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway. However, the web servers cannot reach the internet. What is the most likely cause?

Accepted Answer

The web servers are in a public subnet, but the route table for the public subnet points 0.0.0.0/0 to the NAT Gateway instead of the Internet Gateway.. The web servers are deployed in a public subnet, which requires a route table entry pointing 0.0.0.0/0 to an Internet Gateway (IGW) for direct internet access. Instead, the engineer configured the route to point to a NAT Gateway, which is intended for private subnets. A public subnet must have a direct IGW route; using a NAT Gateway in a public subnet breaks outbound connectivity because the NAT Gateway itself relies on the IGW for internet access, but the web servers' traffic is sent to the NAT Gateway instead of the IGW, causing a routing loop or failure.

Answer

The private subnet route table does not have a route to the NAT Gateway for 0.0.0.0/0.

Answer

The security group of the web servers is blocking outbound traffic to the internet.

Answer

The NAT Gateway does not have a route to the Internet Gateway in its route table.