ANS-C01 Network Management and Operations Practice Test 21 — 15 Questions

Question 1

A company has a VPC with a NAT Gateway in a public subnet. The network team notices that instances in private subnets cannot access the internet. Reviewing the route tables, the private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The NAT Gateway's subnet route table does not have a default route pointing to an Internet Gateway.. The NAT Gateway must have a route to an Internet Gateway. If the NAT Gateway's subnet route table does not have a default route pointing to an IGW, it cannot route traffic to the internet. Security groups, NACLs, or EIP are less likely to be the issue.

Answer

The network ACL in the private subnet blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address attached.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Question 2

A company has a VPC with multiple subnets. The network engineer wants to monitor network traffic between two specific EC2 instances in different subnets. Which THREE methods can be used to capture and analyze this traffic?

Accepted Answer

Enable VPC Flow Logs for the subnets containing the instances.. VPC Flow Logs capture metadata, Traffic Mirroring captures full packets, and AWS Network Firewall can inspect traffic. VPC Peering is for connectivity, not monitoring.

Answer

Use AWS CloudTrail to log network traffic.

Answer

Create a VPC peering connection between the two subnets' VPCs.

Question 3

A company has a VPC with a Transit Gateway (TGW) connected to multiple VPCs and an on-premises network via Direct Connect. The network team wants to implement centralized inspection of all traffic between VPCs and between VPCs and on-premises. Which architecture should they use?

Accepted Answer

Create a Gateway Load Balancer (GWLB) in a dedicated inspection VPC and attach it to the Transit Gateway.. Centralized inspection is achieved by using a Gateway Load Balancer with appliances in a dedicated inspection VPC. Transit Gateway route tables direct traffic to the inspection VPC. AWS Network Firewall can also be used but is placed in a VPC. Direct Connect gateway does not provide inspection.

Answer

Attach a Direct Connect Gateway to the Transit Gateway and configure route propagation.

Answer

Use AWS Network Firewall in each VPC.

Answer

Deploy a third-party firewall in each VPC and use VPC peering.

Question 4

A company has a production VPC with a public and private subnet across two Availability Zones. The public subnet hosts a Network Load Balancer (NLB) that distributes traffic to EC2 instances in the private subnet. The application experiences periodic failures where the NLB marks all targets as unhealthy for about 2 minutes, then they recover. The health checks are HTTP on port 80 with a 5-second interval, 2 consecutive successes to be healthy, and 2 consecutive failures to be unhealthy. The target group health check timeout is 5 seconds. The EC2 instances are behind an Auto Scaling group with a minimum of 2 instances per AZ. CPU utilization on the instances is stable at 40%. The NLB's CloudWatch metrics show HealthyHostCount drops to zero suddenly. The network engineer suspects a network issue. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the interval, causing timeouts under transient network delays.. The health check timeout equals the interval (both 5 seconds). Under transient network delays, a health check response can be delayed beyond the timeout, causing the NLB to count a failure. With 2 consecutive failures required to mark unhealthy, a brief period of latency can cause all targets to be marked unhealthy for about 2 minutes (2 intervals × 5 seconds = 10 seconds of failures, but the recovery requires 2 consecutive successes, leading to the observed ~2-minute duration due to repeated timeouts). The instances are not overloaded (CPU 40%), and security groups and route tables are configured correctly since normal operation resumes. This configuration violates the best practice of setting the timeout lower than the interval to allow for retries.

Answer

The security group for the private subnet is blocking inbound traffic from the NLB.

Answer

The NLB's cross-zone load balancing is disabled, causing all traffic to go to one AZ.

Answer

The route tables for the private subnets are missing a route to the NLB's subnet.

Question 5

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise the 10.0.0.0/8 prefix to AWS. The VPC has a route table that includes a route to the Virtual Private Gateway for 10.0.0.0/8. On-premises hosts can ping EC2 instances in the VPC, but EC2 instances cannot ping on-premises hosts. The VPC has an Internet Gateway and a NAT Gateway. The EC2 instances are in private subnets with routes to the NAT Gateway for 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The VPC route table has a more specific local route (10.0.0.0/16) that overrides the route to the VGW for part of the on-premises CIDR.. For EC2 instances to reach on-premises hosts, the VPC route table must have a route for the on-premises CIDR pointing to the Virtual Private Gateway. The engineer has that route. However, the on-premises hosts are in the 10.0.0.0/8 range, and the VPC also uses 10.0.0.0/16. The issue is that the VPC route table has a local route for 10.0.0.0/16, which is more specific than the 10.0.0.0/8 route to the VGW. Traffic from EC2 to on-premises hosts within the 10.0.0.0/16 range will be routed locally within the VPC, not through the VGW. The on-premises hosts must be in a different CIDR than the VPC's CIDR, or the VPC must use a different CIDR. Since the VPC uses 10.0.0.0/16, any on-premises host with an IP in that range will be considered local and won't go through the VGW. The solution is to ensure the VPC CIDR does not overlap with the on-premises CIDR.

Answer

The Direct Connect virtual interface is configured for public VIF instead of private VIF.

Answer

The EC2 instances' security group outbound rules are blocking ICMP.

Answer

The on-premises router is not advertising the 10.0.0.0/8 route to AWS.

Question 6

A company is designing a multi-VPC architecture using AWS Transit Gateway. They need to ensure that traffic between VPCs is encrypted and that only specific VPCs can communicate with each other. Which two services should they use together? (Choose TWO.)

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway provides transitive routing between VPCs, enabling scalable connectivity. AWS Network Firewall provides centralized stateful inspection and filtering of traffic between VPCs, allowing you to enforce policies that require traffic to be encrypted (e.g., by blocking non-encrypted flows). While Network Firewall itself does not perform encryption, it can inspect and drop unencrypted traffic to meet encryption requirements.

Answer

AWS PrivateLink

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub

Question 7

A company is troubleshooting connectivity issues between an on-premises network and a VPC connected via AWS Direct Connect. The network team has verified that the virtual interface (VIF) is up and BGP is established. However, traffic is not flowing. Which two configuration issues could cause this problem? (Choose TWO.)

Accepted Answer

The on-premises router is not advertising the on-premises CIDR prefix via BGP.. Correct routes on both sides are needed. If the VPC route table does not have a route to the on-premises CIDR via the Direct Connect VIF, traffic won't flow. Similarly, if the on-premises router does not advertise the correct prefix, or if the VPC's route table lacks a route, connectivity fails. Security group rules might block, but they are not the most likely if BGP is up. The VIF state is up, so that's not the issue.

Answer

The AWS Direct Connect connection is not associated with the correct Direct Connect gateway.

Answer

The virtual interface is in a 'down' state.

Answer

The security group attached to the EC2 instance blocks inbound traffic from on-premises.

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers. The network team notices that traffic between two VPCs is taking an unexpected path through the on-premises network instead of staying within the Transit Gateway. What is the most likely cause?

Accepted Answer

The on-premises network is advertising more specific routes via BGP that override the Transit Gateway routes.. When using AWS Transit Gateway with VPN or Direct Connect, the on-premises network can advertise more specific BGP routes that override the default routes learned from the Transit Gateway. This causes traffic to take the path through the on-premises network instead of staying within the Transit Gateway. Option A is wrong because route tables are associated with the Transit Gateway attachments, not the VPCs themselves. Option B is wrong because the subnet route tables must point to the Transit Gateway for traffic to be routed correctly, but that would not cause traffic to go on-premises; rather, it would prevent traffic from reaching the Transit Gateway. Option D is wrong because VPC peering is not used with Transit Gateway in this scenario; conflicting routes could occur but the most likely cause is more specific BGP routes from on-premises.

Answer

The Transit Gateway route table is not associated with the VPC attachments.

Answer

The VPC subnet route tables are not pointing to the Transit Gateway as the target.

Answer

VPC peering connections are being used alongside Transit Gateway, creating conflicting routes.

Question 9

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a private subnet and an RDS database in another VPC connected via a VPC peering connection. The connection works for a few minutes and then drops. CloudWatch logs show no errors on the peering connection. What should the engineer check first?

Accepted Answer

The route tables in both VPCs to ensure they have routes pointing to the peering connection for the respective CIDR blocks.. Intermittent connectivity over a VPC peering connection is often caused by missing or incorrect route table entries. Traffic must be able to return from the RDS database VPC to the EC2 instance VPC, so both VPCs need routes pointing to the peering connection for the respective CIDR blocks. Option A is incorrect because DNS resolution settings affect name resolution, not connectivity drops. Option B is incorrect because network ACLs are stateless and would cause consistent blocking, not intermittent drops. Option C is incorrect because security groups are stateful and allow return traffic automatically; they would not cause intermittent issues once allowed.

Answer

The DNS resolution settings of the VPC peering connection.

Answer

The network ACL of the subnet where the EC2 instance resides.

Answer

The security group attached to the RDS database allowing traffic from the EC2 instance.

Question 10

A company is using AWS CloudWatch to monitor network metrics. They want to create a dashboard that shows the total number of bytes sent and received by all EC2 instances in a specific VPC. Which two metrics should they use? (Choose TWO.)

Accepted Answer

NetworkOut. The question asks for metrics that measure total bytes sent and received. AWS CloudWatch provides `NetworkIn` (bytes received) and `NetworkOut` (bytes sent) for EC2 instances. These are the only two metrics that directly measure bytes. The option `NetworkPacketsIn` and `NetworkPacketsOut` measure packets, not bytes, and `TotalNetworkBytes` is not a valid CloudWatch metric. Therefore, the correct answers are NetworkOut and NetworkIn.

Answer

TotalNetworkBytes

Answer

NetworkPacketsOut

Answer

NetworkPacketsIn

Question 11

A company is using AWS Direct Connect with a private VIF to connect its on-premises data center to a VPC. The network team wants to monitor the link health and receive alarms if the connection goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch with Direct Connect metrics.. Amazon CloudWatch provides metrics for Direct Connect connections, such as connection state and BGP status, and can trigger alarms. Option B is wrong because Amazon Inspector is for security assessments, not link health monitoring. Option C is wrong because AWS Config tracks configuration changes, not operational status. Option D is wrong because VPC Flow Logs capture IP traffic logs, not link health.

Answer

Amazon Inspector.

Answer

AWS Config.

Answer

VPC Flow Logs.

Question 12

A company has a VPC with multiple subnets. They want to implement network segmentation such that traffic between subnets is controlled by a centralized firewall. Which three components are required? (Choose THREE.)

Accepted Answer

AWS Transit Gateway. Centralized firewall inspection requires a Transit Gateway to route traffic to the firewall VPC, a Gateway Load Balancer to distribute traffic to firewall instances, and appropriate route tables to direct traffic accordingly. VPC peering does not support transitive routing. NAT Gateway is for outbound internet access.

Answer

VPC peering connections

Answer

NAT Gateway

Question 13

A company has a multi-account AWS environment using AWS Transit Gateway with a centralized network account. The network team wants to ensure that only specific VPCs can communicate with each other. What is the best practice to achieve this?

Accepted Answer

Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.. Transit Gateway route tables allow you to control routing between VPC attachments. By creating multiple route tables and associating each VPC attachment with the appropriate one, you can isolate or allow communication as needed. Option A is wrong because security groups operate at the instance/ENI level, not at the transit gateway level, so they cannot control VPC-to-VPC communication via Transit Gateway. Option B is wrong because VPC peering is point-to-point and does not scale well, nor does it leverage the centralized Transit Gateway. Option D is wrong because AWS Network Manager is used for monitoring and visualizing global networks, not for defining routing policies.

Answer

Configure security groups in each VPC to allow traffic only from specific VPC CIDRs.

Answer

Use VPC peering connections between the VPCs that need to communicate.

Answer

Use AWS Network Manager to create routing policies.

Question 14

A company is using AWS Site-to-Site VPN to connect its on-premises network to a VPC. The network team wants to ensure high availability and failover. Which three actions should they take? (Choose THREE.)

Accepted Answer

Configure both tunnels as active/active.. For high availability, use two tunnels (both active/active or active/passive), use two Customer Gateway devices for redundancy, and configure BGP for dynamic routing and fast failover. Static routes require manual intervention. A single tunnel is not redundant.

Answer

Use static routes instead of BGP.

Answer

Configure two VPN tunnels to the same Customer Gateway.

Question 15

A company is using AWS Database Migration Service (DMS) to replicate data from an on-premises Oracle database to an Amazon RDS for Oracle instance. The replication is failing intermittently with connection timeouts. The network connectivity uses a Direct Connect private VIF. What should the network team investigate first?

Accepted Answer

The MTU settings on the on-premises router and the AWS Direct Connect interface.. Correct answer: Option A is correct because MTU mismatch between the on-premises router and AWS Direct Connect interface can cause packet fragmentation or drops, leading to intermittent connection timeouts. The default MTU for Direct Connect is 1500 bytes, but if the on-premises router uses a larger MTU (e.g., 9001 for jumbo frames), packets may be dropped or fragmented, causing timeouts. Option B is incorrect because routing misconfiguration would cause persistent failure, not intermittent. Option C is incorrect because a VPN is not used as a primary path when Direct Connect is available. Option D is incorrect because security groups apply to traffic within the VPC, not to on-premises traffic over Direct Connect.

Answer

The route table of the VPC to ensure it has a route to the on-premises CIDR via the Direct Connect virtual interface.

Answer

The VPN connection status as a backup path.

Answer

The security group of the RDS instance to ensure it allows traffic from the on-premises IP range.