ANS-C01 Network Management and Operations Practice Test 21 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy network infrastructure. The network team wants to ensure that all subnets created in the VPC have a tag 'Environment' with the value 'Production'. Which CloudFormation resource property should they use?

Accepted Answer

Use the 'TagSpecifications' property of the AWS::EC2::Subnet resource.. The 'TagSpecifications' property allows tagging resources during creation. 'Tags' is a top-level property for some resources, but for EC2 resources like subnets, 'TagSpecifications' is the correct property.

Answer

Use 'PropagateTags' property in the VPC.

Answer

Use a separate AWS::ResourceGroups::Tagging resource.

Answer

Use the 'Tags' property of the AWS::EC2::Subnet resource.

Question 2

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise the 10.0.0.0/8 prefix to AWS. The VPC has a route table that includes a route to the Virtual Private Gateway for 10.0.0.0/8. On-premises hosts can ping EC2 instances in the VPC, but EC2 instances cannot ping on-premises hosts. The VPC has an Internet Gateway and a NAT Gateway. The EC2 instances are in private subnets with routes to the NAT Gateway for 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The VPC route table has a more specific local route (10.0.0.0/16) that overrides the route to the VGW for part of the on-premises CIDR.. For EC2 instances to reach on-premises hosts, the VPC route table must have a route for the on-premises CIDR pointing to the Virtual Private Gateway. The engineer has that route. However, the on-premises hosts are in the 10.0.0.0/8 range, and the VPC also uses 10.0.0.0/16. The issue is that the VPC route table has a local route for 10.0.0.0/16, which is more specific than the 10.0.0.0/8 route to the VGW. Traffic from EC2 to on-premises hosts within the 10.0.0.0/16 range will be routed locally within the VPC, not through the VGW. The on-premises hosts must be in a different CIDR than the VPC's CIDR, or the VPC must use a different CIDR. Since the VPC uses 10.0.0.0/16, any on-premises host with an IP in that range will be considered local and won't go through the VGW. The solution is to ensure the VPC CIDR does not overlap with the on-premises CIDR.

Answer

The Direct Connect virtual interface is configured for public VIF instead of private VIF.

Answer

The EC2 instances' security group outbound rules are blocking ICMP.

Answer

The on-premises router is not advertising the 10.0.0.0/8 route to AWS.

Question 3

A company is designing a multi-VPC architecture using AWS Transit Gateway. They need to ensure that traffic between VPCs is encrypted and that only specific VPCs can communicate with each other. Which two services should they use together? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway provides transitive routing between VPCs. AWS Network Firewall can inspect and encrypt traffic. AWS PrivateLink is for service access, not transitive routing. AWS VPN CloudHub is for VPN connections. AWS Direct Connect is for on-premises.

Answer

AWS PrivateLink

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub

Question 4

A company has a VPC with a single public subnet. The subnet has a web server that needs to be accessible over the internet. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the subnet allows inbound HTTP from 0.0.0.0/0 and outbound traffic on ports 1024-65535 to 0.0.0.0/0. The internet gateway is attached to the VPC, and the route table has a route to the internet gateway for 0.0.0.0/0. The web server has a public IP address. However, users cannot access the web server. The engineer verifies that the web server is running and listening on port 80. What is the most likely cause?

Accepted Answer

The network ACL's outbound rule does not allow traffic from port 80 to the internet.. Although the security group allows inbound HTTP, the network ACL's inbound rule only allows HTTP. However, the network ACL is stateless, so for a user to access the web server, the inbound rule must allow the HTTP traffic, and the outbound rule must allow return traffic. The outbound rule allows ephemeral ports, which is correct. However, the network ACL's default deny all inbound could be blocking if the rule order is wrong. But the question says the NACL allows inbound HTTP. The likely issue is that the security group is stateful and allows return traffic, but the network ACL is not stateful, and if the inbound rule does not allow the initial HTTP, it would fail. But it does allow inbound HTTP. So the issue might be that the security group's outbound rule is blocking the return traffic? No, security group is stateful. The most common mistake is that the network ACL's inbound rule does not allow the HTTP traffic from the internet because the rule number is higher than a deny rule. However, the question states the NACL allows inbound HTTP. Another common issue is that the web server's OS firewall is blocking. But the engineer verified the server is listening. The likely cause is that the security group is attached to the wrong ENI or the web server is in a private subnet. But the question says public subnet. The answer: the network ACL's outbound rule might be missing the return traffic for the HTTP response. The response uses ephemeral ports, but the outbound rule allows all outbound on ephemeral ports, so that's fine. Wait: the outbound rule allows traffic to 0.0.0.0/0 on ports 1024-65535, but the HTTP response comes from the server's port 80 to the client's ephemeral port, so the outbound traffic is from port 80 to the client's ephemeral port. The NACL outbound rule should allow traffic from the server's port 80 to the client's port. The outbound rule only allows source port 1024-65535, not port 80. That is the issue! The outbound rule must allow traffic from the server's port (80) to the client's ephemeral port. So the missing outbound rule for port 80 causes the response to be dropped.

Answer

The route table for the subnet does not have a route to the internet gateway.

Answer

The internet gateway is not properly attached to the VPC.

Answer

The security group's outbound rule is blocking the HTTP response.

Question 5

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS Direct Connect. The network team has verified that the virtual interface (VIF) is up and BGP is established. However, traffic is not flowing. Which two configuration issues could cause this problem? (Choose TWO.)

Accepted Answer

The on-premises router is not advertising the on-premises CIDR prefix via BGP.. Correct routes on both sides are needed. If the VPC route table does not have a route to the on-premises CIDR via the Direct Connect VIF, traffic won't flow. Similarly, if the on-premises router does not advertise the correct prefix, or if the VPC's route table lacks a route, connectivity fails. Security group rules might block, but they are not the most likely if BGP is up. The VIF state is up, so that's not the issue.

Answer

The AWS Direct Connect connection is not associated with the correct Direct Connect gateway.

Answer

The virtual interface is in a 'down' state.

Answer

The security group attached to the EC2 instance blocks inbound traffic from on-premises.

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers. The network team notices that traffic between two VPCs is taking an unexpected path through the on-premises network instead of staying within the Transit Gateway. What is the most likely cause?

Accepted Answer

The on-premises network is advertising more specific routes via BGP that override the Transit Gateway routes.. Option B is correct because route propagation from the on-premises network via the VPN or Direct Connect can introduce more specific routes that override the local Transit Gateway routes. Option A is wrong because route tables are attached to the Transit Gateway, not specific VPC attachments. Option C is wrong because VPC peering is not used with Transit Gateway. Option D is wrong because subnet associations do not affect Transit Gateway routing.

Answer

The Transit Gateway route table is not associated with the VPC attachments.

Answer

The VPC subnet route tables are not pointing to the Transit Gateway as the target.

Answer

VPC peering connections are being used alongside Transit Gateway, creating conflicting routes.

Question 7

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a private subnet and an RDS database in another VPC connected via a VPC peering connection. The connection works for a few minutes and then drops. CloudWatch logs show no errors on the peering connection. What should the engineer check first?

Accepted Answer

The route tables in both VPCs to ensure they have routes pointing to the peering connection for the respective CIDR blocks.. Option C is correct because the most common cause of intermittent drops over VPC peering is the lack of proper route table entries in both VPCs to route traffic back to the source. Option A is wrong because security groups are stateful and do not cause intermittent drops. Option B is wrong because NACLs are stateless but would block consistently, not intermittently. Option D is wrong because DNS resolution settings affect name resolution, not connectivity drops.

Answer

The DNS resolution settings of the VPC peering connection.

Answer

The network ACL of the subnet where the EC2 instance resides.

Answer

The security group attached to the RDS database allowing traffic from the EC2 instance.

Question 8

A company is using AWS CloudWatch to monitor network metrics. They want to create a dashboard that shows the total number of bytes sent and received by all EC2 instances in a specific VPC. Which three metrics should they use? (Choose THREE.)

Accepted Answer

NetworkOut. The relevant metrics are NetworkIn, NetworkOut, and NetworkPacketsIn (or PacketsOut). However, the question asks for bytes sent and received; NetworkIn and NetworkOut are direct measures. NetworkPacketsIn counts packets, not bytes. The combination of NetworkIn + NetworkOut gives total bytes. The other options are not metrics.

Answer

TotalNetworkBytes

Answer

NetworkPacketsOut

Answer

NetworkPacketsIn

Question 9

A company is using AWS Direct Connect with a private VIF to connect its on-premises data center to a VPC. The network team wants to monitor the link health and receive alarms if the connection goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch with Direct Connect metrics.. Option A is correct because CloudWatch provides metrics for Direct Connect connections, such as connection state and BGP status, and can trigger alarms. Option B is wrong because VPC Flow Logs capture IP traffic logs, not link health. Option C is wrong because AWS Config tracks configuration changes, not operational status. Option D is wrong because Amazon Inspector is for security assessments.

Answer

Amazon Inspector.

Answer

AWS Config.

Answer

VPC Flow Logs.

Question 10

A company has a VPC with multiple subnets. They want to implement network segmentation such that traffic between subnets is controlled by a centralized firewall. Which three components are required? (Choose THREE.)

Accepted Answer

AWS Transit Gateway. Centralized firewall inspection requires a Transit Gateway to route traffic to the firewall VPC, a Gateway Load Balancer to distribute traffic to firewall instances, and appropriate route tables to direct traffic accordingly. VPC peering does not support transitive routing. NAT Gateway is for outbound internet access.

Answer

VPC peering connections

Answer

NAT Gateway

Question 11

A company has a multi-account AWS environment using AWS Transit Gateway with a centralized network account. The network team wants to ensure that only specific VPCs can communicate with each other. What is the best practice to achieve this?

Accepted Answer

Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.. Option C is correct because Transit Gateway route tables with route propagation and static routes allow fine-grained control over which VPCs can communicate. Option A is wrong because Network Manager is for monitoring, not routing control. Option B is wrong because VPC peering is point-to-point and does not scale. Option D is wrong because security groups in each VPC add complexity and do not control Transit Gateway routing.

Answer

Configure security groups in each VPC to allow traffic only from specific VPC CIDRs.

Answer

Use VPC peering connections between the VPCs that need to communicate.

Answer

Use AWS Network Manager to create routing policies.

Question 12

A company is using AWS Site-to-Site VPN to connect its on-premises network to a VPC. The network team wants to ensure high availability and failover. Which three actions should they take? (Choose THREE.)

Accepted Answer

Configure both tunnels as active/active.. For high availability, use two tunnels (both active/active or active/passive), use two Customer Gateway devices for redundancy, and configure BGP for dynamic routing and fast failover. Static routes require manual intervention. A single tunnel is not redundant.

Answer

Use static routes instead of BGP.

Answer

Configure two VPN tunnels to the same Customer Gateway.

Question 13

A company is using AWS Database Migration Service (DMS) to replicate data from an on-premises Oracle database to an Amazon RDS for Oracle instance. The replication is failing intermittently with connection timeouts. The network connectivity uses a Direct Connect private VIF. What should the network team investigate first?

Accepted Answer

The MTU settings on the on-premises router and the AWS Direct Connect interface.. Option B is correct because the MTU mismatch between on-premises and AWS can cause packet fragmentation or drops, leading to timeouts. Option A is wrong because security groups do not apply to on-premises traffic. Option C is wrong because routing is point-to-point, no internet. Option D is wrong because VPN is not used.

Answer

The route table of the VPC to ensure it has a route to the on-premises CIDR via the Direct Connect virtual interface.

Answer

The VPN connection status as a backup path.

Answer

The security group of the RDS instance to ensure it allows traffic from the on-premises IP range.

Question 14

A company has a multi-VPC architecture using AWS Transit Gateway (TGW). They have a central inspection VPC with a Gateway Load Balancer (GWLB) and third-party firewall appliances. All other VPCs are attached to the TGW and have route tables that send traffic to the inspection VPC for inspection. Recently, the network team deployed a new VPC (VPC-D) and attached it to the TGW. They configured the VPC-D route table to send all inter-VPC traffic to the TGW. However, traffic from VPC-D to other VPCs is not being inspected. The team confirmed that the firewall appliances are healthy and the GWLB is correctly configured. Which action should the network team take to ensure traffic from VPC-D is inspected?

Accepted Answer

Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.. Each VPC attached to TGW has a TGW route table that controls how traffic is forwarded. To send traffic from VPC-D through the inspection VPC, the TGW route table associated with VPC-D's attachment must have routes that point to the inspection VPC's attachment. Simply attaching the VPC does not automatically associate it with the correct TGW route table. Option B is correct because it ensures that the TGW route table used by VPC-D directs traffic to the inspection VPC.

Answer

Enable route propagation on VPC-D's TGW attachment.

Answer

Add a route in VPC-D's subnet route tables pointing to the TGW for all traffic.

Answer

Create a new TGW route table and associate all VPC attachments to it.

Question 15

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Answer

AWS Config.

Answer

AWS CloudTrail.

Answer

AWS X-Ray.