ANS-C01 Network Management and Operations Practice Test 20 — 15 Questions

Question 1

A company uses a VPC with multiple subnets in different Availability Zones. The VPC has a NAT Gateway in a public subnet of us-east-1a, and a second NAT Gateway in us-east-1b for high availability. Each private subnet in us-east-1a routes 0.0.0.0/0 to the NAT Gateway in us-east-1a, and private subnets in us-east-1b route to the NAT Gateway in us-east-1b. The company's EC2 instances in private subnets need to access an external service using IPv6. The VPC is not configured for IPv6. The network engineer needs to enable IPv6 connectivity for these instances. Which solution is the most cost-effective and scalable?

Accepted Answer

Add an IPv6 CIDR block to the VPC, assign IPv6 addresses to private subnets, and add a route for ::/0 to an egress-only internet gateway.. Option C is correct because using an egress-only internet gateway (EIGW) provides IPv6 outbound connectivity for instances in private subnets when the VPC is dual-stack. Option A is wrong because NAT64 translates IPv6 to IPv4, but the service is IPv6, so not needed. Option B is wrong because adding IPv6 CIDR and using NAT64 is not necessary. Option D is wrong because an internet gateway alone does not work for private subnets; it requires a route and instances need public IPv6 addresses.

Answer

Add an IPv6 CIDR block to the VPC and configure a NAT64 gateway to translate IPv6 to IPv4.

Answer

Attach an internet gateway to the VPC and add a route for ::/0 to the internet gateway in the private subnets.

Answer

Add an IPv6 CIDR block to the VPC and use the existing NAT Gateways with IPv6.

Question 2

A company has a VPC with a public subnet hosting a web server. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the public subnet allows inbound HTTP from 0.0.0.0/0. Users report that they cannot access the website. The engineer verifies that the web server is running and has a public IP. What is the most likely issue?

Accepted Answer

The network ACL outbound rule is blocking return traffic.. Even if inbound rules allow traffic, if the network ACL's outbound rule (stateless) does not allow return traffic (ephemeral ports), the connection will fail. Security groups are stateful and allow return traffic automatically.

Answer

The web server is listening on a different port.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group outbound rule is blocking return traffic.

Question 3

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The network team notices intermittent packet loss on the Direct Connect virtual interface (VIF). Which AWS service should be used to monitor the latency and packet loss on the VIF?

Accepted Answer

AWS CloudWatch. CloudWatch provides metrics for Direct Connect including packet loss and latency. VPC Flow Logs capture IP traffic metadata but not latency. AWS Health Dashboard shows service health. Transit Gateway is a network transit hub but not a monitoring service.

Answer

AWS Health Dashboard

Answer

VPC Flow Logs

Answer

AWS Transit Gateway Network Manager

Question 4

A company is using AWS Client VPN for remote access. Users can authenticate and establish a VPN connection, but they cannot access resources in the VPC. The Client VPN endpoint is associated with a subnet in the VPC. The security group for the Client VPN endpoint allows all traffic. What is the most likely cause?

Accepted Answer

There is no authorization rule to allow access to the VPC CIDR.. Client VPN uses an authorization rule to grant access to specific networks. Without an authorization rule that allows access to the VPC CIDR, traffic from clients will be dropped.

Answer

The Client VPN endpoint is not associated with the correct subnet.

Answer

The route table for the subnet does not have a route to the Client VPN endpoint.

Answer

The Client VPN endpoint's server certificate is expired.

Question 5

A company has a VPC with public and private subnets. The security team wants to detect and alert on any SSH traffic (port 22) that originates from the internet to any EC2 instance in the VPC. Which solution achieves this with minimal operational overhead?

Accepted Answer

Enable VPC Flow Logs, publish to CloudWatch Logs, and create a metric filter for SSH traffic.. VPC Flow Logs can be published to CloudWatch Logs, and a CloudWatch Logs filter metric can detect SSH traffic. Security Groups can deny traffic but not alert. AWS Config can track configuration changes. GuardDuty detects threats but not specifically SSH traffic alerts.

Answer

Configure a security group rule to deny inbound SSH and enable security group logging.

Answer

Use AWS Config to detect security group rules that allow SSH from 0.0.0.0/0.

Answer

Enable Amazon GuardDuty and rely on its threat detection.

Question 6

A company monitors its VPC using VPC Flow Logs. The logs are sent to CloudWatch Logs. The security team wants to detect traffic to known malicious IP addresses. Which AWS service can be used to analyze the flow logs in near real-time?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Athena can query VPC Flow Logs stored in S3, but for near real-time analysis, Amazon Kinesis Data Analytics (or Kinesis Data Firehose with Lambda) can process streaming logs. However, the simplest managed service for real-time pattern matching is Amazon Kinesis Data Analytics with SQL.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

Amazon Athena

Question 7

A company has a global application deployed across multiple AWS Regions. The application uses Amazon Route 53 latency-based routing. The network team wants to monitor the health of the application endpoints. They configure Route 53 health checks with fast interval (10 seconds) for each endpoint. After a few days, they notice an increase in costs. Which change will reduce costs while maintaining adequate health monitoring?

Accepted Answer

Change the health check interval to standard (30 seconds).. Health checks are billed per check. Using a slower interval reduces the number of checks. Standard interval (30 seconds) is sufficient for most cases. Disabling end-to-end health checks or removing health checks would reduce functionality. Using CloudWatch alarms is additional cost.

Answer

Disable health checks and rely on Route 53 latency measurements.

Answer

Use CloudWatch alarms instead of Route 53 health checks.

Answer

Remove health checks for endpoints that are in the same Region.

Question 8

A company has a VPC with a public subnet and a private subnet. The public subnet has a bastion host (EC2) with a security group that allows SSH from a specific IP range. The private subnet has an RDS instance. The company wants to enable the bastion host to connect to the RDS instance. Which TWO steps are required?

Accepted Answer

Add a rule to the NACL for the private subnet to allow inbound traffic from the bastion host's IP.. The bastion host needs network-level access to the RDS instance. The RDS security group must allow inbound from the bastion's security group, and the bastion must be in the same VPC or have network connectivity. The NACL must allow the traffic.

Answer

Configure the RDS instance to use a custom DB parameter group with SSL enabled.

Answer

Assign a public IP address to the RDS instance.

Answer

Create a route in the public subnet's route table to the RDS instance.

Question 9

A company uses AWS Direct Connect with a public VIF to access S3. The on-premises network uses BGP to advertise a specific prefix to AWS. The company wants to ensure that traffic to S3 from on-premises always uses the Direct Connect connection and not the internet. Which TWO configurations must be in place?

Accepted Answer

Set a higher local preference on the Direct Connect BGP session for the S3 prefixes.. To force traffic to S3 through Direct Connect, the on-premises routers must prefer the Direct Connect path. This involves advertising a specific prefix (like the S3 service endpoints) over BGP with a higher local preference, and using the most specific route (longest prefix match).

Answer

Set a higher MED value on routes learned from the internet to make them less preferred.

Answer

Disable the internet gateway for the VPC.

Answer

Set the AS_PATH prepend on the Direct Connect BGP session.

Question 10

A company is using AWS Direct Connect to connect to its VPC. The network team wants to encrypt all traffic between the on-premises data center and the VPC. Which solution provides encryption?

Accepted Answer

Use an IPsec VPN over the Direct Connect virtual interface.. IPsec VPN over Direct Connect provides encryption. Direct Connect itself does not encrypt traffic. MACsec encrypts at Layer 2 but is not supported over Direct Connect. AWS Site-to-Site VPN can be used over the internet or over Direct Connect as an IPsec tunnel.

Answer

Enable MACsec on the Direct Connect connection.

Answer

Use AWS Client VPN to connect on-premises to VPC.

Answer

Enable encryption on the Direct Connect virtual interface.

Question 11

A company is designing a multi-account strategy using AWS Organizations. The security team wants to centrally manage VPC Flow Logs from all accounts. Which THREE steps are required to achieve this?

Accepted Answer

Enable VPC Flow Logs in each account, specifying the central S3 bucket as the destination.. To centralize flow logs, you need a central S3 bucket with appropriate permissions, enable flow logs in each account, and send them to the central bucket. The bucket policy must allow cross-account writes.

Answer

Set up a VPN connection between the logging account and each member account.

Answer

Create a VPC peering connection between all accounts to allow log delivery.

Question 12

A company has a VPC with a NAT Gateway in a public subnet. The network team notices that instances in private subnets cannot access the internet. Reviewing the route tables, the private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT Gateway's subnet route table does not have a default route pointing to an Internet Gateway.. The NAT Gateway must have a route to an Internet Gateway. If the NAT Gateway's subnet route table does not have a default route pointing to an IGW, it cannot route traffic to the internet. Security groups, NACLs, or EIP are less likely to be the issue.

Answer

The network ACL in the private subnet blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address attached.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Question 13

A company has a VPC with multiple subnets. The network engineer wants to monitor network traffic between two specific EC2 instances in different subnets. Which THREE methods can be used to capture and analyze this traffic?

Accepted Answer

Enable VPC Flow Logs for the subnets containing the instances.. VPC Flow Logs capture metadata, Traffic Mirroring captures full packets, and AWS Network Firewall can inspect traffic. VPC Peering is for connectivity, not monitoring.

Answer

Use AWS CloudTrail to log network traffic.

Answer

Create a VPC peering connection between the two subnets' VPCs.

Question 14

A company has a VPC with a Transit Gateway (TGW) connected to multiple VPCs and an on-premises network via Direct Connect. The network team wants to implement centralized inspection of all traffic between VPCs and between VPCs and on-premises. Which architecture should they use?

Accepted Answer

Create a Gateway Load Balancer (GWLB) in a dedicated inspection VPC and attach it to the Transit Gateway.. Centralized inspection is achieved by using a Gateway Load Balancer with appliances in a dedicated inspection VPC. Transit Gateway route tables direct traffic to the inspection VPC. AWS Network Firewall can also be used but is placed in a VPC. Direct Connect gateway does not provide inspection.

Answer

Attach a Direct Connect Gateway to the Transit Gateway and configure route propagation.

Answer

Use AWS Network Firewall in each VPC.

Answer

Deploy a third-party firewall in each VPC and use VPC peering.

Question 15

A company has a production VPC with a public and private subnet across two Availability Zones. The public subnet hosts a Network Load Balancer (NLB) that distributes traffic to EC2 instances in the private subnet. The application experiences periodic failures where the NLB marks all targets as unhealthy for about 2 minutes, then they recover. The health checks are HTTP on port 80 with a 5-second interval, 2 consecutive successes to be healthy, and 2 consecutive failures to be unhealthy. The target group health check timeout is 5 seconds. The EC2 instances are behind an Auto Scaling group with a minimum of 2 instances per AZ. CPU utilization on the instances is stable at 40%. The NLB's CloudWatch metrics show HealthyHostCount drops to zero suddenly. The network engineer suspects a network issue. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the interval, causing timeouts under transient network delays.. If the health check timeout equals the interval, a single delayed response can cause consecutive failures. Under load, if the health check request is delayed, the NLB might timeout, count a failure, and after two such timeouts, mark the instance unhealthy. The instances are not overloaded (CPU 40%), but network contention or latency could cause timeouts. However, the most common cause is that the health check timeout is equal to the interval, meaning a missed response leads to immediate failure. The recommended practice is to set timeout less than interval to allow for retries. Option D addresses this by increasing the interval or decreasing the timeout.

Answer

The security group for the private subnet is blocking inbound traffic from the NLB.

Answer

The NLB's cross-zone load balancing is disabled, causing all traffic to go to one AZ.

Answer

The route tables for the private subnets are missing a route to the NLB's subnet.