ANS-C01 Network Management and Operations Practice Test 21 — 15 Questions

Question 1

A company is migrating its on-premises data center to AWS. The network team needs to establish a site-to-site VPN connection with dynamic routing using BGP. The on-premises router supports BGP but does not support BGP communities. The VPN connection is established, but the VPC does not learn the on-premises routes. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises router is not advertising any prefixes over BGP. For a site-to-site VPN with dynamic routing, the VPC learns on-premises routes only via BGP advertisements from the customer gateway. If the on-premises router is not advertising any prefixes over BGP (for example, because the network statements or route redistribution are missing), the VPC route tables will never receive those routes even though the tunnel is UP and BGP peering may be established. The lack of BGP communities support is irrelevant because communities are optional attributes, not required for basic prefix advertisement.

Answer

The VPN tunnel uses pre-shared keys instead of certificates

Answer

The VPC route table needs a static route to the on-premises CIDR

Answer

The VPN tunnel is not in a UP state

Question 2

A company is deploying a web application on EC2 instances behind an ALB. The application must be accessible only over HTTPS. Which security group rule should be added to the ALB security group?

Accepted Answer

Inbound: TCP port 443 from 0.0.0.0/0. The ALB must terminate HTTPS traffic, which requires an inbound rule allowing TCP port 443 (HTTPS) from 0.0.0.0/0. This ensures clients can establish encrypted TLS connections to the load balancer, as the application is only accessible over HTTPS.

Answer

Inbound: TCP port 22 from 0.0.0.0/0

Answer

Inbound: TCP port 3306 from 0.0.0.0/0

Answer

Inbound: TCP port 80 from 0.0.0.0/0

Question 3

A network engineer is designing a multi-region architecture using AWS Transit Gateway and wants to minimize inter-region latency for data transfer between VPCs. The application requires high throughput and low latency. Which design should be used?

Accepted Answer

Use Transit Gateway inter-region peering between Transit Gateways. Transit Gateway inter-region peering attaches Transit Gateways in different AWS Regions over the AWS global backbone, providing predictable low latency and high throughput without the need for a VPN overlay. It supports dynamic routing via BGP and scales to thousands of VPC attachments, making it the intended solution for multi-region hub-and-spoke designs. Unlike VPC peering, it avoids full-mesh complexity and does not traverse the public internet.

Answer

Establish VPC peering connections between all VPCs across regions

Answer

Use AWS Site-to-Site VPN between Transit Gateways in each region

Answer

Configure VPC endpoints to route traffic through AWS backbone

Question 4

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?

Accepted Answer

Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway. For a private subnet's EC2 instance to reach the internet via a NAT Gateway, the NAT Gateway must have an Elastic IP (EIP) attached and the private subnet's route table must contain a route to that NAT Gateway. Without the EIP, the NAT Gateway cannot perform source NAT, and without the route, traffic never reaches the NAT Gateway. Therefore, verifying these two elements is the correct troubleshooting step.

Answer

Move the NAT Gateway to a private subnet

Answer

Verify that the NAT Gateway is in the same subnet as the EC2 instance

Answer

Attach an Internet Gateway to the private subnet

Question 5

A company is using AWS Direct Connect with a private VIF to connect to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot establish TCP connections to an EC2 instance's private IP. The security groups and NACLs are configured to allow the traffic. What is the most likely cause of this issue?

Accepted Answer

The EC2 instance's operating system firewall is blocking TCP traffic. The fact that ICMP (ping) succeeds proves the Direct Connect private VIF, VPC route tables, and network path are all functional end-to-end. Since security groups and NACLs are confirmed to allow the traffic, the remaining layer where TCP could be blocked is the EC2 instance's own operating system firewall (iptables, Windows Firewall, etc.), which is outside AWS's visibility and control.

Answer

The Direct Connect virtual interface is in a down state

Answer

The on-premises firewall is blocking ICMP but not TCP

Answer

The VPC route table is missing a route for the on-premises CIDR

Question 6

A company has multiple AWS accounts and wants to centralize VPC flow logs for analysis. The flow logs are published to Amazon S3 in each account. A central account needs to access these logs. Which solution meets the requirements with the least operational overhead?

Accepted Answer

Use S3 bucket policies in each account to grant the central account access. Using S3 bucket policies with cross-account permissions allows the central account to access the flow logs directly from the S3 buckets in each account without additional infrastructure. Option A is incorrect because AWS Glue jobs would add unnecessary operational overhead for copying data. Option B is incorrect because AWS Transit Gateway handles network traffic routing, not S3 access. Option C is incorrect because VPC peering provides network connectivity between VPCs but does not grant access to S3 buckets; S3 access is managed via IAM and bucket policies.

Answer

Set up AWS Glue jobs to copy logs to a central S3 bucket

Answer

Use AWS Transit Gateway to centralize network traffic and capture logs

Answer

Use VPC peering to connect the accounts and access the S3 buckets directly

Question 7

A company has a VPC with resources that need to access an S3 bucket in the same region. To minimize latency and avoid internet traffic, which configuration should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet, minimizing latency and avoiding data transfer costs. It is the recommended approach for accessing S3 from a VPC. While VPC Interface Endpoints for S3 also provide private access, they incur hourly charges and additional data processing fees. In most scenarios, Gateway Endpoints are preferred for S3 and DynamoDB due to their simplicity and cost-effectiveness. NAT Gateway (A) is used for internet-bound traffic, not private S3 access. VPC peering (C) connects VPCs but does not provide direct access to S3.

Answer

Use a NAT Gateway in a public subnet and route traffic through it

Answer

Use VPC peering to connect to an S3 bucket

Answer

Create a VPC Interface Endpoint for S3

Question 8

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team notices increased latency and packet loss during peak hours. The Direct Connect virtual interface (VIF) is configured as a private VIF to a VPC. What is the MOST likely cause of the issue?

Accepted Answer

The VIF bandwidth is insufficient for the traffic volume.. Increased latency and packet loss during peak hours on a private VIF most likely indicate that the VIF's bandwidth capacity is insufficient for the traffic volume. Direct Connect offers dedicated bandwidth (e.g., 1 Gbps, 10 Gbps), and when utilization approaches the limit, packets are dropped and latency spikes due to queuing.

Answer

Jumbo frames are not enabled on the VIF.

Answer

The BGP keepalive timer is set too low.

Answer

The MTU size of the VIF is set to 1500 bytes.

Question 9

A company is using a transit gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that some VPCs can communicate with each other but not with the on-premises network. The transit gateway route tables are configured correctly. Which TWO configurations should the team check?

Accepted Answer

Verify that the on-premises router is advertising the on-premises CIDR over BGP to the VPN. Option C is correct because for a transit gateway VPN attachment to route traffic to on-premises networks, the customer gateway router must advertise the on-premises CIDR blocks to AWS over BGP; if those routes are not propagated, the transit gateway has no path to the on-premises network even though VPC-to-VPC routing works. Option E is correct because a VPN attachment must be associated with the transit gateway route table that the VPC attachments use (and/or its routes must be propagated into that table); if the VPN attachment is associated with a different route table, VPCs will not learn the VPN routes and cannot reach on-premises. Option A is not the right check because a transit gateway in 'available' state is the normal operating state and would affect all attachments, not selectively block on-premises traffic while VPC-to-VPC works. Option B is not the right check because security groups apply to EC2 instance traffic and would not explain a routing gap specific to the on-premises path. Option D is not the right check because VPC Flow Logs can show dropped packets but do not directly validate the transit gateway VPN route propagation or BGP advertisements needed for on-premises connectivity.

Answer

Verify that the transit gateway is in a 'available' state

Answer

Check the security group rules of the EC2 instances in the VPCs

Answer

Check the VPC Flow Logs for dropped packets

Question 10

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team wants to monitor BGP session status for all Transit Gateway attachments. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager is the purpose-built service for monitoring and managing Transit Gateway attachments, including BGP session status, tunnel status, and on-premises connectivity via Direct Connect and VPN. It provides a global view of the network topology and surfaces BGP peering state for each attachment. CloudWatch metrics and VPC Flow Logs do not expose BGP session state, and AWS Config tracks resource configuration changes rather than live routing protocol status.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch with Transit Gateway metrics

Question 11

A network engineer has created a VPC endpoint for a VPC endpoint service. The endpoint is 'available' but the application cannot connect to the service using the private DNS name. The engineer checks the Route 53 private hosted zone and finds that no record exists for the endpoint. What is the most likely cause?

Accepted Answer

The 'PrivateDnsEnabled' flag is set to false on the VPC endpoint. When the 'PrivateDnsEnabled' flag is set to false on a VPC endpoint, AWS does not automatically create a Route 53 private hosted zone for the endpoint, so the private DNS name does not resolve. This is the most likely cause given that no DNS record exists. Option D is correct. Options A, B, and C could cause connectivity issues but would not prevent the DNS record from being created.

Answer

The VPC endpoint service is not accepting connections

Answer

The VPC endpoint policy is blocking connectivity

Answer

The security group for the endpoint does not allow inbound traffic

Question 12

A network engineer troubleshoots a VPN connection that shows 'available' state but traffic is not passing. The on-premises firewall logs show that the tunnel is established, but no traffic. The engineer checks the VPN configuration. Based on the exhibit, what is the MOST likely cause of the problem?

Accepted Answer

The VPN is configured for BGP (StaticRoutesOnly: false), but only a static route is added.. The VPN connection is configured for BGP (StaticRoutesOnly: false), but only a static route is added. This mismatch means that the VPN expects BGP to exchange routes, but no BGP configuration is present, so no routes are learned, and traffic cannot be routed. The tunnel is up, but no traffic passes because the routing table lacks the necessary routes.

Answer

The VPN connection is not in 'available' state.

Answer

The outside IP addresses are not routable over the internet.

Answer

The inside IP addresses for the tunnels are missing.

Question 13

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The issue occurs only during peak business hours. CloudWatch metrics show increased latency and packet loss at the Direct Connect virtual interface. What is the MOST likely cause?

Accepted Answer

Insufficient bandwidth on the Direct Connect connection. The intermittent nature of the issue, occurring only during peak business hours, combined with increased latency and packet loss at the Direct Connect virtual interface, strongly points to bandwidth saturation. Direct Connect connections have a fixed capacity (e.g., 1 Gbps, 10 Gbps), and when traffic exceeds that capacity during peak periods, packets are dropped, causing retransmissions and increased latency. This is a classic symptom of insufficient bandwidth, not a configuration error or routing issue.

Answer

VPN tunnel misconfiguration over Direct Connect

Answer

Asymmetric routing between on-premises and AWS

Answer

BGP peering session flapping

Question 14

A network engineer needs to verify the routing path between two EC2 instances in different subnets within the same VPC. Which AWS tool can provide this information?

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer is purpose-built to analyze the path between a source and destination (including ENIs, subnets, gateways, and security groups) and reports whether the path is reachable and where it breaks. It works without sending actual traffic, making it the correct tool for verifying routing between EC2 instances in different subnets.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Run traceroute from one instance to the other

Question 15

A company is using AWS Transit Gateway with multiple VPC attachments. They need to ensure that traffic between two specific VPCs is encrypted in transit. The VPCs are in the same AWS region. What is the SIMPLEST solution?

Accepted Answer

Create a VPN attachment on the Transit Gateway and route traffic through it. AWS Transit Gateway does not natively encrypt traffic between VPC attachments; the simplest way to encrypt inter-VPC traffic over a TGW is to create a VPN attachment (site-to-site VPN) on the transit gateway and route the traffic through it, which applies IPsec encryption. This uses the existing TGW routing model and requires no changes to VPC peering or PrivateLink.

Answer

Enable encryption on the Transit Gateway route tables

Answer

Use AWS PrivateLink to connect the VPCs

Answer

Use VPC peering instead of Transit Gateway and enable encryption