ANS-C01 Network Management and Operations Practice Test 2 — 15 Questions

Question 1

Match each BGP attribute to its role in route selection.

Accepted Answer

AS_PATH: Used to determine the shortest path to a destination. BGP attributes influence route selection in a specific order: Weight, LOCAL_PREF, AS_PATH, MED, and others. AS_PATH measures path length, LOCAL_PREF directs outbound traffic, MED directs inbound traffic, and Weight is a Cisco-proprietary local preference.

Answer

AS_PATH: Used to influence outbound traffic from an AS

Answer

LOCAL_PREF: Used to determine the shortest AS path

Question 2

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking an unexpected path. Which AWS service should be used to analyze the packet-level traffic flow and identify the path?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the network interface level, enabling analysis of packet-level traffic flow paths through AWS Transit Gateway. By enabling flow logs on the Transit Gateway attachment or VPC subnets, you can trace the actual path traffic takes between VPCs, including whether it traverses the Transit Gateway or an unexpected route.

Answer

AWS CloudTrail

Answer

AWS X-Ray

Answer

AWS Config

Question 3

A company has a multi-account AWS environment with hundreds of VPCs connected via a transit gateway. The network team needs to centrally monitor network traffic and detect anomalies such as unusual outbound data transfers. Which combination of services would provide the most scalable and cost-effective solution?

Accepted Answer

Enable VPC Flow Logs in each VPC, publish to Amazon S3, and use Amazon Athena to query logs from a central account. VPC Flow Logs capture IP traffic metadata at scale, and publishing to Amazon S3 provides a cost-effective, durable storage layer. Using Amazon Athena to query the logs from a central account enables serverless, on-demand analysis across hundreds of VPCs without provisioning servers, making it both scalable and cost-effective for anomaly detection.

Answer

Use AWS Trusted Advisor to check for unusual traffic patterns

Answer

Enable VPC Flow Logs in each VPC, publish to CloudWatch Logs, and create cross-account CloudWatch dashboards

Answer

Use AWS Network Manager to monitor all VPCs and Transit Gateway attachments

Question 4

A company has a hybrid network architecture with multiple VPCs connected via a transit gateway and on-premises via Direct Connect. The network team wants to automate the response to a BGP session failure on a Direct Connect virtual interface. Which AWS service can be used to monitor the BGP status and trigger an automated action?

Accepted Answer

AWS CloudWatch Events (EventBridge) with Direct Connect BGP metric alarms. AWS CloudWatch Events (EventBridge) can monitor Direct Connect BGP session status via the `bgp_session_state` metric in the `AWS/DX` namespace. When the BGP session transitions to the `down` state, you can create an EventBridge rule that triggers an automated action, such as invoking a Lambda function or sending an SNS notification, enabling a rapid response to BGP failures without manual intervention.

Answer

AWS Lambda with VPC Flow Logs

Answer

AWS Systems Manager Automation

Answer

AWS Config rules

Question 5

A company is using a centralized egress VPC model with a NAT gateway for outbound traffic from multiple VPCs. The network team notices that some EC2 instances are having connectivity timeouts when accessing the internet. The team has verified the route tables and security groups. Which additional check should be performed to troubleshoot the issue?

Accepted Answer

Check the NAT gateway CloudWatch metrics for error packets and connection counts. NAT Gateway CloudWatch metrics, specifically `ErrorPortAllocation` and `PacketsDropCount`, directly indicate whether the NAT Gateway is running out of available ports or dropping packets due to connection limits. In a centralized egress model with multiple VPCs, high connection counts can exhaust the NAT Gateway's ephemeral port capacity (65,535 per IP), causing connectivity timeouts even when route tables and security groups are correctly configured.

Answer

Check the security group rules for outbound traffic

Answer

Check the VPC Flow Logs for denied traffic

Answer

Check the route tables for the internet gateway

Question 6

Which TWO services can be used to centrally manage and monitor VPN connections across multiple AWS accounts? (Choose 2.)

Accepted Answer

AWS Network Manager. AWS Network Manager (option A) is correct because it provides a central dashboard to visualize and monitor global networks, including VPN connections, across multiple AWS accounts and Regions, using features like Network Manager events and route analysis. AWS Transit Gateway (option B) is correct because it acts as a regional hub that centrally connects VPCs and on-premises networks via VPN attachments, and with Transit Gateway Network Manager it enables centralized management and monitoring of VPN connections across accounts. AWS CloudFormation (option C) is incorrect because it is an infrastructure-as-code service for provisioning resources, not for centrally monitoring VPN connections. AWS Organizations (option D) is incorrect because it manages accounts, policies, and consolidated billing, not VPN connection monitoring. AWS Direct Connect Gateway (option E) is incorrect because it connects Direct Connect links to VPCs and Transit Gateways, not VPN connections.

Answer

AWS CloudFormation

Answer

AWS Organizations

Answer

AWS Direct Connect Gateway

Question 7

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team notices that traffic from an on-premises data center to a VPC is intermittently dropping. CloudWatch metrics show no errors on the Direct Connect virtual interface. What is the most likely cause of the intermittent drops?

Accepted Answer

Asymmetric routing due to missing or incorrect route propagation in Transit Gateway route tables. Intermittent drops with no Direct Connect virtual interface errors and no CloudWatch errors strongly suggest a routing issue rather than a link-layer problem. Asymmetric routing due to missing or incorrect route propagation in Transit Gateway route tables causes return traffic to take a different path (or be dropped), producing intermittent connectivity failures. This is the most likely cause given the symptoms.

Answer

Latency spikes on the Direct Connect link due to AWS VPN backup path

Answer

MTU mismatch causing packet fragmentation for jumbo frames

Answer

BGP keepalive timer mismatch between the on-premises router and the Direct Connect router

Question 8

A global company is designing a multi-region Active-Active application using Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) fronting Auto Scaling groups. The application requires sticky sessions based on the user's source IP. The network team notices that users are frequently switched to a different region mid-session, causing errors. What should the team do to resolve this issue?

Accepted Answer

Switch to geolocation routing policy with a bias to maintain sessions. The issue is that latency-based routing can change the selected region mid-session due to fluctuating latency, breaking sticky sessions. Geolocation routing policy routes users to a region based on their source IP address, ensuring that the same user always reaches the same region, thus maintaining session stickiness. Using a bias allows fine-tuning to adjust routing for specific locations. Option C is not valid because Route 53 latency-based routing does not support custom origin headers; this is not a feature available in AWS. Option A only affects health checks and does not influence session persistence. Option B enables stickiness within a region but does not prevent Route 53 from switching regions. Therefore, switching to geolocation routing is the correct solution.

Answer

Configure Route 53 health checks with a low threshold to quickly detect failures

Answer

Enable stickiness on each ALB using a cookie generated by the ALB

Answer

Use a custom origin header in the Route 53 latency policy to route based on the user's IP address and enable ALB stickiness

Question 9

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over AWS Site-to-Site VPN. The VPN tunnel status is UP, and BGP is established. The engineer can ping the on-premises server's private IP from the EC2 instance, but TCP connections to a specific port (e.g., 443) are timing out. What is the most likely cause?

Accepted Answer

Security group or network ACL blocking inbound TCP port 443 on the EC2 instance. A security group or network ACL blocking inbound TCP port 443 on the EC2 instance. Since ICMP ping succeeds and the VPN tunnel is UP with BGP established, IP connectivity and routing between the VPC and on-premises network are working; the failure is specific to TCP port 443, which points to a stateful security group rule or stateless network ACL not permitting that port. Option A is unlikely because incorrect on-premises routing for the VPC CIDR would also break ping replies, not just TCP 443. Option C is unlikely because an MTU mismatch typically causes intermittent failures or TLS handshake stalls rather than a clean TCP SYN timeout, and ping (small packets) would still work. Option D is unlikely because exceeded BGP prefix limits would affect route advertisement broadly, not selectively block a single TCP port while ping still succeeds.

Answer

Incorrect route table entries on the on-premises router for the VPC CIDR

Answer

MTU mismatch on the VPN tunnel causing packet fragmentation for TCP

Answer

BGP prefix limits exceeded causing route table incompleteness

Question 10

A company is using AWS Global Accelerator to improve performance for a web application hosted in two AWS Regions. The application uses an Application Load Balancer (ALB) in each region. The company wants to ensure that traffic is directed to the closest healthy endpoint. Which routing configuration should be used?

Accepted Answer

Global Accelerator endpoint groups with health checks and traffic dials. Global Accelerator endpoint groups with health checks and traffic dials is correct because endpoint groups map to regional endpoints (the ALBs), health checks remove unhealthy endpoints, and traffic dials adjust the percentage of traffic sent to each group. This ensures traffic goes to the closest healthy endpoint via anycast IPs and the AWS global network.

Answer

Global Accelerator with weighted endpoint groups

Answer

Route 53 latency-based routing with health checks

Answer

Route 53 geolocation routing with Global Accelerator

Question 11

A network engineer is configuring AWS Client VPN for remote access. The engineer creates a Client VPN endpoint and associates it with a target network (subnet) in the VPC. After associating, clients can connect to the VPN but cannot access resources in the VPC. The security groups and network ACLs allow all traffic. What is the most likely issue?

Accepted Answer

The Client VPN endpoint's route table does not include a route to the VPC CIDR. When a Client VPN endpoint is associated with a subnet, the endpoint's route table must include a route that directs traffic destined for the VPC CIDR to the target network (the associated subnet). Without this route, clients can establish the VPN tunnel but their packets destined for VPC resources have no matching route and are dropped. The route table is separate from the association and must be explicitly configured.

Answer

The Client VPN endpoint is not associated with a subnet in the VPC

Answer

The client CIDR range overlaps with the VPC CIDR

Answer

The Client VPN endpoint does not have an authorization rule to allow access to the VPC CIDR

Question 12

A company is deploying a hybrid network using AWS Direct Connect and a VPN backup. The Direct Connect connection is established, and BGP is running over the private VIF. The company wants to use the VPN as a backup only when Direct Connect fails. The network engineer configures BGP communities on the Direct Connect VIF to influence route preference. However, during a Direct Connect failure, failover to VPN takes several minutes. What can the engineer do to reduce failover time?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the Direct Connect VIF. BFD provides sub-second failure detection, which significantly reduces failover time compared to BGP timers. Option A is wrong because AS path prepending influences route preference and does not affect failover detection speed. Option B is wrong because static routes do not provide dynamic failover and increase administrative overhead. Option D is wrong because while decreasing BGP timers can reduce failover time, BFD is much faster and is the recommended approach.

Answer

Configure AS path prepending on the VPN BGP session to deprioritize it

Answer

Use static routes instead of BGP for the Direct Connect VIF

Answer

Decrease the BGP keepalive and hold timers on both the Direct Connect and VPN BGP sessions

Question 13

A company uses VPC Flow Logs to monitor network traffic. The flow logs are published to Amazon S3. The security team wants to analyze the logs for suspicious traffic patterns using Amazon Athena. After creating the Athena table, queries return zero results. The logs are in the correct S3 bucket. What is the most likely cause?

Accepted Answer

The Athena table is not configured to read from the correct S3 partition structure. VPC Flow Logs delivered to S3 are stored in a specific partition structure (e.g., AWSLogs/AccountID/vpcflowlogs/Region/Year/Month/Day). If the Athena table's PARTITIONED BY clause and LOCATION do not match this structure, queries return zero results. This is the most likely cause when logs are present but unreadable.

Answer

The flow logs are encrypted with SSE-KMS and Athena does not have permission to decrypt

Answer

The Athena table is in a different AWS Glue database

Answer

The flow logs are in gzip format, which Athena does not support

Question 14

A company is designing a VPN connection between an on-premises network and AWS. The network engineer wants to ensure high availability and fast failover. Which TWO actions should the engineer take? (Select TWO.)

Accepted Answer

Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels. Option D is correct because AWS Site-to-Site VPN inherently provides two tunnels per connection, and enabling BGP with BFD allows rapid detection of tunnel failures and fast failover between the tunnels, which is essential for high availability. Option E is correct because AWS provides two distinct VPN endpoint IP addresses per VPN connection, and configuring both tunnels to those separate endpoints ensures redundancy if one endpoint or tunnel becomes unavailable. Option A is incorrect because using the same customer gateway IP for both tunnels does not improve redundancy and can create a single point of failure. Option B is incorrect because static routes do not support dynamic failover or fast convergence; BGP is preferred for automatic rerouting. Option C is incorrect because creating two separate VPN connections to the same VPC is unnecessary and does not by itself guarantee fast failover as effectively as using the built-in dual tunnels with BGP/BFD.

Answer

Use the same customer gateway IP address for both tunnels

Answer

Use static routes instead of BGP to simplify configuration

Answer

Create two separate VPN connections to the same VPC

Question 15

A company is using AWS Global Accelerator to improve performance for a global application. The application uses an Application Load Balancer (ALB) in each region. The network team wants to ensure that traffic is distributed evenly across regions and that failover happens quickly. Which THREE steps should the team take? (Select THREE.)

Accepted Answer

Configure multiple endpoint groups, one per region, and set traffic dials to distribute load. Option A is correct because Global Accelerator distributes traffic across Regions using endpoint groups, and creating one endpoint group per Region (each containing that Region's ALB endpoint) is the required structure for multi-Region load distribution. Option B is correct because Global Accelerator performs health checks on endpoints, and configuring a low health-check threshold (e.g., a small number of consecutive failures before an endpoint is marked unhealthy) reduces detection time so failover to a healthy Region happens quickly. Option C is correct because the traffic dial on each endpoint group is the mechanism that controls the percentage of traffic sent to that group, so setting the dials to the desired proportions achieves even (or weighted) distribution across Regions. Option D is not needed here because client IP preservation is a feature choice for preserving source addresses, not a requirement for even distribution or fast failover. Option E is wrong because Global Accelerator already provides anycast IP-based global routing and health-check-driven failover; layering Route 53 weighted routing in front of it adds complexity without contributing to the stated goals.

Answer

Enable client IP address preservation on the Global Accelerator

Answer

Use Route 53 weighted routing in front of Global Accelerator