ANS-C01 Network Management and Operations Practice Test 20 — 15 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team needs to monitor the BGP session status for each VPN attachment. Which TWO services can be used to monitor BGP status and receive alerts if a session goes down?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Alarms on the BGP status metric.. Amazon CloudWatch provides metrics for VPN tunnels, including the BGP status metric (e.g., TunnelState, BGPStatus). CloudWatch Alarms can be set on this metric to trigger notifications if the BGP session goes down. Option A is correct because CloudWatch Alarms on the BGP status metric directly monitor and alert on BGP session state. Option E is correct because CloudWatch metrics for VPN tunnels include BGP status data. Option B (AWS Config) is incorrect because AWS Config is used for resource compliance and configuration changes, not real-time monitoring of BGP sessions. Option C (VPC Flow Logs) is incorrect because VPC Flow Logs capture IP traffic information, not BGP routing protocol status. Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls, not BGP session state.

Answer

AWS Config rules.

Answer

VPC Flow Logs.

Answer

AWS CloudTrail logs.

Question 2

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway, and the private subnet has EC2 instances that need internet access. The private instances can reach the internet, but cannot access an S3 bucket in the same region using the S3 gateway endpoint. What is the most likely cause?

Accepted Answer

The private subnet's route table does not have a route to the S3 gateway endpoint.. For private instances to use a gateway endpoint, the route table for the private subnet must have a route pointing to the S3 endpoint. Additionally, the endpoint's policy must allow the traffic. The NAT Gateway is not used for gateway endpoints.

Answer

The S3 gateway endpoint is not in the same VPC.

Answer

The S3 bucket policy does not allow access from the VPC.

Answer

The NAT Gateway is in a different availability zone than the private instances.

Question 3

A network engineer is monitoring a hybrid network with a VPN connection to AWS. The engineer notices periodic packet loss and high latency during peak hours. The VPN tunnel uses static routing. The on-premises bandwidth is 100 Mbps, and the VPN connection is limited to 1.25 Gbps. What is the most likely cause?

Accepted Answer

The on-premises internet connection is saturated.. The VPN connection's bandwidth (1.25 Gbps) is sufficient, but if the on-premises link is only 100 Mbps, any traffic exceeding that will cause congestion and packet loss. The VPN tunnel itself is not the bottleneck.

Answer

The VPC route table has a blackhole route for the on-premises CIDR.

Answer

The VPN tunnel is using the incorrect encryption algorithm.

Answer

The VPN tunnel is exceeding its maximum bandwidth limit.

Question 4

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC contains an Amazon RDS for MySQL database in a private subnet. The database is accessed by EC2 instances in the same VPC and by on-premises servers via a Site-to-Site VPN. The network team recently enabled VPC Flow Logs and noticed that the database is receiving a high number of SYN packets from an IP address that is not part of the VPC or on-premises network. The security group for the database only allows inbound traffic on port 3306 from the EC2 instances' security group and the on-premises CIDR (10.0.0.0/8). The network ACL for the database subnet allows inbound and outbound traffic on all ports from all sources. What is the most likely cause of the unexpected traffic?

Accepted Answer

The network ACL for the database subnet allows all inbound traffic, so packets from the internet reach the database subnet's network ACL before being evaluated by the security group.. The network ACL (NACL) is stateless and allows all inbound traffic from any source, including the internet. While the security group (SG) denies the unexpected traffic (since it only allows traffic from the EC2 security group and on-premises CIDR), the NACL permits it. VPC Flow Logs capture traffic at the network interface level after NACL evaluation but before SG evaluation; thus, even though the SG drops the SYN packets, they are logged by Flow Logs because they pass through the NACL. Option A is incorrect because the security group explicitly restricts inbound traffic to specific sources, not 0.0.0.0/0. Option B is incorrect because the RDS database is in a private subnet and does not have a public endpoint; a public endpoint would have been configured explicitly. Option C is incorrect because the Site-to-Site VPN is configured for the on-premises network only, and the unexpected IP is not from that CIDR; the VPN itself does not route internet traffic into the VPC.

Answer

The security group for the database has an inbound rule that allows traffic from 0.0.0.0/0.

Answer

The RDS database has a public endpoint that is accessible from the internet.

Answer

The Site-to-Site VPN is misconfigured and routing internet traffic into the VPC.

Question 5

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network can reach some VPCs but not others. All VPCs are attached to the same Transit Gateway. What should the engineer check first?

Accepted Answer

The Transit Gateway route tables and associations.. The Transit Gateway route tables control which VPCs and attachments can communicate. If some VPCs are in a different route table or if propagation is not configured, traffic may not be routed correctly.

Answer

The VPC flow logs for the unreachable VPCs.

Answer

The Direct Connect virtual interface status.

Answer

The BGP session between the on-premises router and the Direct Connect router.

Question 6

A company uses a VPC with multiple subnets in different Availability Zones. The VPC has a NAT Gateway in a public subnet of us-east-1a, and a second NAT Gateway in us-east-1b for high availability. Each private subnet in us-east-1a routes 0.0.0.0/0 to the NAT Gateway in us-east-1a, and private subnets in us-east-1b route to the NAT Gateway in us-east-1b. The company's EC2 instances in private subnets need to access an external service using IPv6. The VPC is not configured for IPv6. The network engineer needs to enable IPv6 connectivity for these instances. Which solution is the most cost-effective and scalable?

Accepted Answer

Add an IPv6 CIDR block to the VPC, assign IPv6 addresses to private subnets, and add a route for ::/0 to an egress-only internet gateway.. Since the VPC is not IPv6-enabled, adding an IPv6 CIDR block assigns IPv6 addresses to subnets. For outbound-only IPv6 access from private subnets, an egress-only internet gateway (EIGW) is the appropriate and most cost-effective solution because it allows outbound traffic to the internet while preventing inbound connections, similar to a NAT gateway for IPv4. A route for ::/0 to the EIGW from the private subnets achieves the goal. Option A is incorrect because NAT64 translates IPv6 to IPv4, but the target service uses IPv6, so no translation is needed. Option C is incorrect because an internet gateway would permit inbound traffic and instances would need public IPv6 addresses, which is not stated and is less secure. Option D is incorrect because NAT Gateways do not support IPv6.

Answer

Add an IPv6 CIDR block to the VPC and configure a NAT64 gateway to translate IPv6 to IPv4.

Answer

Attach an internet gateway to the VPC and add a route for ::/0 to the internet gateway in the private subnets.

Answer

Add an IPv6 CIDR block to the VPC and use the existing NAT Gateways with IPv6.

Question 7

A company has a VPC with a public subnet hosting a web server. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the public subnet allows inbound HTTP from 0.0.0.0/0. Users report that they cannot access the website. The engineer verifies that the web server is running and has a public IP. What is the most likely issue?

Accepted Answer

The network ACL outbound rule is blocking return traffic.. Even if inbound rules allow traffic, if the network ACL's outbound rule (stateless) does not allow return traffic (ephemeral ports), the connection will fail. Security groups are stateful and allow return traffic automatically.

Answer

The web server is listening on a different port.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group outbound rule is blocking return traffic.

Question 8

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The network team notices intermittent packet loss on the Direct Connect virtual interface (VIF). Which AWS service should be used to monitor the latency and packet loss on the VIF?

Accepted Answer

AWS CloudWatch. CloudWatch provides metrics for Direct Connect including packet loss and latency. VPC Flow Logs capture IP traffic metadata but not latency. AWS Health Dashboard shows service health. Transit Gateway is a network transit hub but not a monitoring service.

Answer

AWS Health Dashboard

Answer

VPC Flow Logs

Answer

AWS Transit Gateway Network Manager

Question 9

A company is using AWS Client VPN for remote access. Users can authenticate and establish a VPN connection, but they cannot access resources in the VPC. The Client VPN endpoint is associated with a subnet in the VPC. The security group for the Client VPN endpoint allows all traffic. What is the most likely cause?

Accepted Answer

There is no authorization rule to allow access to the VPC CIDR.. AWS Client VPN requires an authorization rule to specify which networks clients can access. Without an authorization rule allowing access to the VPC CIDR, traffic from clients is dropped even if the security group allows all traffic. The endpoint is associated with a subnet, so option B is incorrect. The subnet's route table automatically has a route for the VPC CIDR locally, so option C is incorrect. Since users can authenticate and establish a connection, the server certificate is valid, making option D incorrect.

Answer

The Client VPN endpoint is not associated with the correct subnet.

Answer

The route table for the subnet does not have a route to the Client VPN endpoint.

Answer

The Client VPN endpoint's server certificate is expired.

Question 10

A company has a VPC with public and private subnets. The security team wants to detect and alert on any SSH traffic (port 22) that originates from the internet to any EC2 instance in the VPC. Which solution achieves this with minimal operational overhead?

Accepted Answer

Enable VPC Flow Logs, publish to CloudWatch Logs, and create a metric filter for SSH traffic.. VPC Flow Logs can be published to CloudWatch Logs, and a CloudWatch Logs filter metric can detect SSH traffic. Security Groups can deny traffic but not alert. AWS Config can track configuration changes. GuardDuty detects threats but not specifically SSH traffic alerts.

Answer

Configure a security group rule to deny inbound SSH and enable security group logging.

Answer

Use AWS Config to detect security group rules that allow SSH from 0.0.0.0/0.

Answer

Enable Amazon GuardDuty and rely on its threat detection.

Question 11

A company monitors its VPC using VPC Flow Logs. The logs are sent to CloudWatch Logs. The security team wants to detect traffic to known malicious IP addresses. Which AWS service can be used to analyze the flow logs in near real-time?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Athena can query VPC Flow Logs stored in S3, but for near real-time analysis, Amazon Kinesis Data Analytics (or Kinesis Data Firehose with Lambda) can process streaming logs. However, the simplest managed service for real-time pattern matching is Amazon Kinesis Data Analytics with SQL.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

Amazon Athena

Question 12

A company has a global application deployed across multiple AWS Regions. The application uses Amazon Route 53 latency-based routing. The network team wants to monitor the health of the application endpoints. They configure Route 53 health checks with fast interval (10 seconds) for each endpoint. After a few days, they notice an increase in costs. Which change will reduce costs while maintaining adequate health monitoring?

Accepted Answer

Change the health check interval to standard (30 seconds).. Health checks are billed per check. Using a slower interval reduces the number of checks. Standard interval (30 seconds) is sufficient for most cases. Disabling end-to-end health checks or removing health checks would reduce functionality. Using CloudWatch alarms is additional cost.

Answer

Disable health checks and rely on Route 53 latency measurements.

Answer

Use CloudWatch alarms instead of Route 53 health checks.

Answer

Remove health checks for endpoints that are in the same Region.

Question 13

A company has a VPC with a public subnet and a private subnet. The public subnet has a bastion host (EC2) with a security group that allows SSH from a specific IP range. The private subnet has an RDS instance. The company wants to enable the bastion host to connect to the RDS instance. Which TWO steps are required?

Accepted Answer

Add a rule to the NACL for the private subnet to allow inbound traffic from the bastion host's IP.. The bastion host needs network-level access to the RDS instance. The RDS security group must allow inbound from the bastion's security group, and the bastion must be in the same VPC or have network connectivity. The NACL must allow the traffic.

Answer

Configure the RDS instance to use a custom DB parameter group with SSL enabled.

Answer

Assign a public IP address to the RDS instance.

Answer

Create a route in the public subnet's route table to the RDS instance.

Question 14

A company uses AWS Direct Connect with a public VIF to access S3. The on-premises network uses BGP to advertise a specific prefix to AWS. The company wants to ensure that traffic to S3 from on-premises always uses the Direct Connect connection and not the internet. Which ONE configuration must be in place?

Accepted Answer

Set a higher local preference on the Direct Connect BGP session for the S3 prefixes.. To ensure on-premises traffic to S3 uses Direct Connect (public VIF) instead of the internet, the primary mechanism is to set a higher local preference on the Direct Connect BGP session for the S3 prefixes (B). Local preference is evaluated first in the BGP path selection process, making the Direct Connect path more attractive than internet paths. Option E is incorrect because the on-premises router does not advertise S3 CIDRs; AWS advertises them. Other methods like MED or AS path prepend are not as effective for this scenario when comparing routes from different ASes.

Answer

Set a higher MED value on routes learned from the internet to make them less preferred.

Answer

Disable the internet gateway for the VPC.

Answer

Set the AS_PATH prepend on the Direct Connect BGP session.

Answer

Configure the on-premises router to advertise a more specific route for the S3 CIDR blocks over the Direct Connect BGP session.

Question 15

A company is using AWS Direct Connect to connect to its VPC. The network team wants to encrypt all traffic between the on-premises data center and the VPC. Which solution provides encryption?

Accepted Answer

Use an IPsec VPN over the Direct Connect virtual interface.. IPsec VPN over Direct Connect provides encryption for all traffic between on-premises and VPC. Direct Connect itself does not encrypt traffic. MACsec is supported on dedicated Direct Connect connections and provides Layer 2 encryption, but it only encrypts the link between the customer device and AWS, not end-to-end traffic. AWS Client VPN is for individual clients, not site-to-site. Direct Connect virtual interfaces do not support native encryption. Therefore, the correct solution is to use an IPsec VPN over the Direct Connect virtual interface.

Answer

Enable MACsec on the Direct Connect connection.

Answer

Use AWS Client VPN to connect on-premises to VPC.

Answer

Enable encryption on the Direct Connect virtual interface.