ANS-C01 Network Management and Operations Practice Test 22 — 15 Questions

Question 1

A company has a multi-VPC architecture using AWS Transit Gateway (TGW). They have a central inspection VPC with a Gateway Load Balancer (GWLB) and third-party firewall appliances. All other VPCs are attached to the TGW and have route tables that send traffic to the inspection VPC for inspection. Recently, the network team deployed a new VPC (VPC-D) and attached it to the TGW. They configured the VPC-D route table to send all inter-VPC traffic to the TGW. However, traffic from VPC-D to other VPCs is not being inspected. The team confirmed that the firewall appliances are healthy and the GWLB is correctly configured. Which action should the network team take to ensure traffic from VPC-D is inspected?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.. Each VPC attached to a Transit Gateway is associated with a specific TGW route table. This route table controls how traffic from that VPC is forwarded to other attachments. For traffic from VPC-D to be inspected, the TGW route table associated with VPC-D's attachment must include routes that direct traffic to the inspection VPC's attachment (where the Gateway Load Balancer and firewall appliances reside). Simply attaching VPC-D does not automatically associate it with the correct route table; the network team must explicitly associate VPC-D's attachment with the existing route table that routes traffic to the inspection VPC. Option D correctly describes this action.

Answer

Enable route propagation on VPC-D's TGW attachment.

Answer

Add a route in VPC-D's subnet route tables pointing to the TGW for all traffic.

Answer

Create a new TGW route table and associate all VPC attachments to it.

Question 2

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Answer

AWS Config.

Answer

AWS CloudTrail.

Answer

AWS X-Ray.

Question 3

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection uses a private virtual interface (VIF) and BGP. The network team recently added a new CIDR block (10.0.3.0/24) to the VPC. They updated the VPC's route table to include a route to the on-premises network. However, the on-premises network cannot reach resources in the new subnet. The BGP session is up, and the Direct Connect gateway is configured. What should the network team do to resolve the issue?

Accepted Answer

Add the new CIDR block (10.0.3.0/24) to the Direct Connect gateway's allowed prefixes.. When a new CIDR block is added to an existing VPC connected via Direct Connect, the Direct Connect gateway must be updated to include the new prefix in its allowed prefixes list. By default, the Direct Connect gateway only advertises prefixes that are explicitly allowed. The on-premises network cannot reach the new subnet because the gateway is not advertising the 10.0.3.0/24 route via BGP. Option C is correct: add the new CIDR to the Direct Connect gateway's allowed prefixes. Option A is incorrect because adding a static route on the on-premises router does not affect BGP advertisements from the AWS side; the gateway must advertise the route. Option B is unnecessary and adds complexity; the issue is with prefix propagation, not with connectivity. Option D is incorrect because a new private VIF is not needed; the existing VIF can handle multiple prefixes if allowed.

Answer

Add a static route in the on-premises router pointing to the Direct Connect interface.

Answer

Set up a new VPN connection as a backup and route traffic over VPN.

Answer

Create a new private VIF for the new CIDR block.

Question 4

A company wants to centralize logging of VPC Flow Logs from multiple accounts into a single Amazon S3 bucket. The logs must be encrypted at rest using an AWS KMS CMK. What is the recommended approach?

Accepted Answer

Create a centralized S3 bucket with default encryption using a KMS CMK and a bucket policy that allows cross-account writes from the source accounts.. The recommended approach uses a centralized S3 bucket with default encryption using a KMS CMK and a bucket policy that allows cross-account writes. This ensures logs are encrypted at rest centrally without requiring per-account KMS keys. Option A is wrong because KMS keys in each account would complicate key management and cross-account access. Option C is wrong because SSE-S3 encryption does not use a CMK and does not provide the same level of control. Option D is wrong because denying access unless encryption headers are present is not a reliable way to enforce encryption; bucket policies can be bypassed if headers are not included, and shared KMS keys are not recommended.

Answer

Enable encryption on VPC Flow Logs using a KMS key in each account and aggregate logs using AWS Logs cross-account subscription.

Answer

Create a bucket with SSE-S3 encryption and have each account write flow logs directly.

Answer

Use a single bucket with a bucket policy that denies access unless encryption headers are present, and use a KMS key shared across accounts.

Question 5

A company has a VPC with multiple EC2 instances that need to access an Amazon S3 bucket. The network team wants to ensure that traffic to S3 stays within the AWS network and does not traverse the internet. The VPC has a VPC endpoint for S3 (Gateway type). The team has created the endpoint and attached the appropriate policy allowing access to the specific S3 bucket. However, EC2 instances in a private subnet cannot access the S3 bucket. The private subnet route table has a default route pointing to a NAT Gateway. Which change should the network team make to allow private instances to access S3 via the endpoint?

Accepted Answer

Add a route in the private subnet route table for the S3 prefix list (com.amazonaws.region.s3) pointing to the VPC endpoint.. For a Gateway VPC endpoint to work, the route table associated with the subnet must include a route for the S3 prefix list (e.g., com.amazonaws.region.s3) pointing to the endpoint ID. The existing default route to the NAT Gateway would otherwise route S3 traffic to the internet, bypassing the endpoint. Adding the specific route for the S3 prefix list ensures that traffic destined for S3 uses the VPC endpoint and stays within the AWS network. Therefore, option D is correct.

Answer

Modify the VPC endpoint policy to allow all principals.

Answer

Change the private subnet route table's default route to point to the VPC endpoint.

Answer

Remove the default route from the private subnet route table.

Question 6

A company is deploying a new application across multiple Availability Zones in a VPC. The application needs to be highly available and must handle traffic from both internal users and external customers. Which TWO options should the network team implement to meet these requirements? (Choose two.)

Accepted Answer

Provision a NAT Gateway in each AZ for outbound connectivity from private subnets.. Provisioning a NAT Gateway in each AZ allows instances in private subnets to initiate outbound traffic to the internet without relying on a single AZ, thus providing high availability and fault tolerance. Option E is correct because deploying an Application Load Balancer in each public subnet across multiple AZs ensures that the ALB can route traffic to healthy targets across AZs, providing high availability and fault tolerance for incoming client traffic. Option A is incorrect because an Internet Gateway is a VPC-level component that allows communication between the VPC and the internet; it is not something that needs to be 'attached' per se (it's already attached to the VPC), and it does not handle traffic distribution across AZs. Option B is incorrect because a Network Load Balancer is suitable for TCP/UDP traffic, but the question does not specify protocol requirements; however, the primary reason it is not the best choice is that the requirement for high availability is better met with an Application Load Balancer for HTTP/HTTPS traffic, and the option says 'use a Network Load Balancer to distribute traffic across AZs' which is not the best fit for typical web applications. Option D is incorrect because a single NAT Gateway in one AZ creates a single point of failure; if that AZ goes down, outbound connectivity is lost.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use a Network Load Balancer to distribute traffic across AZs.

Answer

Create a single NAT Gateway in one AZ for outbound traffic.

Question 7

A company has a hybrid network with an AWS Direct Connect connection and an AWS Site-to-Site VPN as a backup. The network team notices that traffic is asymmetrically routing through both connections, causing performance issues. Which TWO steps should the team take to ensure traffic uses the primary Direct Connect and only fails over to the VPN? (Choose two.)

Accepted Answer

Configure BGP communities on the Direct Connect to influence route preference.. BGP communities can be used on the Direct Connect connection to set a higher local preference, making the routes learned via Direct Connect preferred over those from the VPN. Option E is correct: Advertising a more specific prefix over Direct Connect ensures that traffic selects the more specific route, preferring Direct Connect. Option A is incorrect because increasing BGP MED on the VPN would make VPN less preferred, but this is not as effective or reliable as using BGP communities or more specific prefixes for ensuring primary use. Option B is incorrect because AWS VPN CloudHub is designed for interconnecting multiple VPN sites, not for failover from Direct Connect to VPN. Option D is incorrect because disabling AS path prepend on Direct Connect would actually make Direct Connect more preferred (shorter AS path), but this is not a recommended step to ensure primary use; it may also disrupt existing routing policies. The best practice is to use BGP communities and specific prefix advertisements to achieve the desired traffic flow.

Answer

Increase the BGP MED value on the VPN connection to make it less preferred.

Answer

Enable VPN automatic failover using AWS VPN CloudHub.

Answer

Disable AS path prepend on the Direct Connect BGP session.

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that VPC A cannot communicate with VPC B, while all other VPCs communicate normally. The transit gateway route table shows routes from both VPCs. Which TWO actions should the network engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Check the security groups and network ACLs in VPC A and VPC B.. Security groups and network ACLs in the VPCs can block traffic even if Transit Gateway routes are correct. Option D is correct because the VPCs must be associated with the correct Transit Gateway route table; an incorrect association can prevent communication. Option B is wrong because a VPN connection is not required for VPC-to-VPC communication via Transit Gateway. Option C is wrong because VPC peering is not necessary when using Transit Gateway; the issue is likely a configuration problem within the Transit Gateway setup. Option E is wrong because AWS Direct Connect is unrelated to inter-VPC routing.

Answer

Establish a VPN connection between VPC A and the transit gateway.

Answer

Create a VPC peering connection between VPC A and VPC B.

Answer

Configure an AWS Direct Connect virtual interface between the VPCs.

Question 9

A company wants to monitor network traffic between its VPC and on-premises data center over a Direct Connect private VIF. The network team needs to capture the source and destination IP addresses, protocols, and packet counts. Which THREE AWS services or features should they use together? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. VPC Flow Logs (option B) capture IP traffic metadata including source and destination IP addresses, protocols, and packet counts. Amazon CloudWatch Logs (option A) can store and analyze these flow logs. Amazon CloudWatch Contributor Insights (option E) can analyze flow log data to identify top talkers and other patterns. AWS CloudTrail (option C) records API calls, not network traffic. AWS Config (option D) tracks resource configuration changes, not network flows.

Answer

AWS CloudTrail

Answer

AWS Config

Question 10

A financial services company is deploying a multi-account environment using AWS Organizations. The security team requires that all network traffic to and from the internet must flow through a centralized inspection VPC that hosts third-party firewall appliances. The architecture uses a single AWS Transit Gateway with a centralized inspection VPC attached. Which THREE steps are necessary to enforce this architecture? (Choose THREE.)

Accepted Answer

Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.. Spoke VPCs need a default route (0.0.0.0/0) pointing to the transit gateway attachment to send internet-bound traffic to the inspection VPC. Option D is correct: in the inspection VPC, traffic from the transit gateway must be routed to the firewall appliances, inspected, and then sent back to the transit gateway for egress to the internet. Option E is correct: separate transit gateway route tables for the inspection VPC and spoke VPCs are required, with appropriate propagation and static routes to enforce traffic flow through the inspection VPC. Option B is incorrect because service control policies (SCPs) can be used to restrict actions in AWS Organizations but do not directly enforce routing; routing is handled via route tables. Option C is incorrect because VPC Gateway Endpoints for S3 and DynamoDB do not affect internet traffic routing; they provide private access to those services.

Answer

Use AWS Organizations service control policies to prevent direct internet access from spoke VPCs.

Answer

Deploy VPC Gateway Endpoints for S3 and DynamoDB in each spoke VPC.

Question 11

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network engineer is troubleshooting connectivity issues and notices that the BGP session between the on-premises router and the AWS Direct Connect virtual interface is down. The engineer has verified the physical connectivity and the VLAN configuration. What should the engineer check next?

Accepted Answer

Confirm that the BGP ASN configured on the on-premises router matches the one provided by AWS.. Correct answer is C. BGP session establishment requires matching BGP ASN on both sides; if they don't match, the session fails. Option A is incorrect because the virtual interface type (private or public) does not prevent BGP from coming up; it affects routing scope. Option B is incorrect because the route size advertised does not affect the BGP session itself; AWS accepts routes of any size within limits. Option D is incorrect because the VPC CIDR is used for routing, but not for BGP session establishment; the session can be up even if no routes are propagated.

Answer

Ensure the virtual interface type is set to 'public'.

Answer

Verify that the on-premises router is advertising a CIDR block smaller than /24.

Answer

Check the VPC CIDR range in the route table.

Question 12

A network engineer is troubleshooting an EC2 instance that cannot connect to S3 via a VPC endpoint. The describe-vpc-endpoints output shows the endpoint is associated with a route table but no subnets. What is the likely issue?

Accepted Answer

The subnet's route table does not include a route for the S3 prefix list via the endpoint.. The VPC endpoint for S3 is a Gateway Endpoint, which is associated with a route table, not a subnet. For the EC2 instance to connect to S3 via the endpoint, the route table associated with the instance's subnet must include a route that directs traffic to the S3 prefix list through the endpoint. If the endpoint is associated with a route table that is different from the subnet's route table, or if the subnet's route table lacks the route, traffic will not use the endpoint. Therefore, the likely issue is that the subnet's route table does not contain the required route for the S3 prefix list via the endpoint. Option A is incorrect because DNS resolution is not the primary issue; the endpoint DNS names should resolve. Option B is incorrect because the endpoint policy defaults to allow all, and there is no indication of a deny. Option C is incorrect because the endpoint state is available as per the output.

Answer

The DNS entry for the endpoint is not resolving.

Answer

The VPC endpoint policy denies access to S3.

Answer

The VPC endpoint state is not available.

Question 13

A company is using AWS CloudFormation to deploy a VPC with public and private subnets, an internet gateway, and a NAT gateway. The deployment fails with the error: 'Route table rtb-12345678 already has a route with destination 0.0.0.0/0'. The network engineer reviews the template and sees that the public route table has a route to the internet gateway and the private route table has a route to the NAT gateway. Both route tables are defined in the same template. What is the most likely cause of this error?

Accepted Answer

The public and private route tables are the same resource due to a typo in the template.. The error indicates that the same route table is being used for both routes, which happens when both resources reference the same route table ID. Option A is wrong because a route table can have multiple routes, but only one default route. Option C is wrong because the error is specific to duplicate routes, not a missing route. Option D is wrong because internet and NAT gateways can coexist in the same VPC.

Answer

The internet gateway and NAT gateway cannot exist in the same VPC simultaneously.

Answer

The public route table already has a route to the internet gateway, and adding another default route is not allowed.

Answer

The NAT gateway route is missing a destination CIDR block.

Question 14

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones in a VPC. The application communicates with an on-premises database over an AWS Direct Connect private VIF. The network team has configured a VPN connection as a backup. Recently, the application experienced intermittent timeouts when accessing the database. The team suspects asymmetric routing because the primary Direct Connect and backup VPN are both active. The network team wants to ensure that all traffic to the on-premises network uses the Direct Connect when it is available, and only fails over to the VPN if Direct Connect goes down. The BGP sessions are configured on both connections. The Direct Connect advertises the on-premises CIDR of 10.0.0.0/16, and the VPN advertises the same CIDR. The team has access to the on-premises router configuration and AWS console. Which action should the team take to resolve the issue?

Accepted Answer

Configure the on-premises router to prepend one or more AS numbers to the routes advertised over the VPN BGP session.. AS path prepending on the VPN BGP session makes the VPN path less preferred by BGP (longer AS path). Since the Direct Connect path has a shorter AS path, BGP will select the Direct Connect path for all traffic to the on-premises CIDR, ensuring symmetric routing. Option A is incorrect because static routes do not provide dynamic failover and can cause routing issues. Option C is incorrect because advertising a more specific prefix over VPN would make the VPN path more specific (longest prefix match), causing traffic to prefer the VPN, exacerbating the problem. Option D is incorrect because disabling BGP on the VPN removes dynamic routing and reduces redundancy.

Answer

Add a static route in the VPC route table pointing to the Direct Connect virtual interface for the on-premises CIDR.

Answer

Advertise a more specific prefix (e.g., 10.0.0.0/24) over the VPN BGP session to attract traffic.

Answer

Disable BGP on the VPN connection and use static routes instead.

Question 15

A company has a hybrid network with multiple VPCs connected via AWS Transit Gateway and an on-premises network via Direct Connect. The network team is planning to migrate a legacy application from on-premises to a new VPC. The application requires low-latency access to an RDS database running in an existing VPC. The team wants to minimize changes to the existing routing. What should the team do to meet these requirements?

Accepted Answer

Attach the new VPC to the existing transit gateway and ensure the transit gateway route tables permit traffic between the new VPC and the RDS VPC.. Attaching the new VPC to the existing transit gateway allows immediate connectivity to the RDS VPC without changing existing routes, provided the transit gateway route tables are configured correctly. Option B is wrong because routing traffic through on-premises adds unnecessary latency and complexity. Option C is wrong because VPC peering requires route table updates in both VPCs, which contradicts the requirement to minimize routing changes. Option D is wrong because migrating the RDS database would change the database endpoint and potentially cause downtime, and does not leverage the existing transit gateway.

Answer

Set up a VPN connection from the new VPC to the on-premises network, and route traffic through on-premises to the RDS VPC.

Answer

Create a VPC peering connection between the new VPC and the RDS VPC.

Answer

Migrate the RDS database to the new VPC to keep the application and database in the same VPC.