ANS-C01 Network Management and Operations Practice Test 22 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection uses a private virtual interface (VIF) and BGP. The network team recently added a new CIDR block (10.0.3.0/24) to the VPC. They updated the VPC's route table to include a route to the on-premises network. However, the on-premises network cannot reach resources in the new subnet. The BGP session is up, and the Direct Connect gateway is configured. What should the network team do to resolve the issue?

Accepted Answer

Add the new CIDR block (10.0.3.0/24) to the Direct Connect gateway's allowed prefixes.. When adding a new CIDR to a VPC, the Direct Connect gateway does not automatically advertise the new prefix to the on-premises router. The team needs to ensure that the VPC's CIDR is allowed in the Direct Connect gateway's allowed prefixes. Option A is correct because the new CIDR must be added to the allowed prefixes list for the Direct Connect gateway to advertise it via BGP. Option D is incorrect as it would cause traffic to be routed through VPN, not Direct Connect.

Answer

Add a static route in the on-premises router pointing to the Direct Connect interface.

Answer

Set up a new VPN connection as a backup and route traffic over VPN.

Answer

Create a new private VIF for the new CIDR block.

Question 2

A company wants to centralize logging of VPC Flow Logs from multiple accounts into a single Amazon S3 bucket. The logs must be encrypted at rest using an AWS KMS CMK. What is the recommended approach?

Accepted Answer

Create a centralized S3 bucket with default encryption using a KMS CMK and a bucket policy that allows cross-account writes from the source accounts.. Option D is correct because using a centralized S3 bucket with appropriate bucket policies to allow cross-account writes and enabling default encryption with a KMS CMK is the best practice. Option A is wrong because SSE-S3 is not a CMK. Option B is wrong because enabling encryption at the flow log level uses SSE-S3 or CloudWatch Logs encryption, not S3 bucket encryption. Option C is wrong because bucket policies control access, not encryption.

Answer

Enable encryption on VPC Flow Logs using a KMS key in each account and aggregate logs using AWS Logs cross-account subscription.

Answer

Create a bucket with SSE-S3 encryption and have each account write flow logs directly.

Answer

Use a single bucket with a bucket policy that denies access unless encryption headers are present, and use a KMS key shared across accounts.

Question 3

A company has a VPC with multiple EC2 instances that need to access an Amazon S3 bucket. The network team wants to ensure that traffic to S3 stays within the AWS network and does not traverse the internet. The VPC has a VPC endpoint for S3 (Gateway type). The team has created the endpoint and attached the appropriate policy allowing access to the specific S3 bucket. However, EC2 instances in a private subnet cannot access the S3 bucket. The private subnet route table has a default route pointing to a NAT Gateway. Which change should the network team make to allow private instances to access S3 via the endpoint?

Accepted Answer

Add a route in the private subnet route table for the S3 prefix list (com.amazonaws.region.s3) pointing to the VPC endpoint.. For a Gateway VPC endpoint to work, the route table associated with the subnet must have a route that points to the endpoint for S3 (prefix list id). The existing default route to NAT Gateway would route traffic to the internet, not through the endpoint. Option A is correct because adding a route for the S3 prefix list to the endpoint overrides the default route for S3 traffic. Option D would cause asymmetric routing and potential issues.

Answer

Modify the VPC endpoint policy to allow all principals.

Answer

Change the private subnet route table's default route to point to the VPC endpoint.

Answer

Remove the default route from the private subnet route table.

Question 4

A company is deploying a new application across multiple Availability Zones in a VPC. The application needs to be highly available and must handle traffic from both internal users and external customers. Which TWO options should the network team implement to meet these requirements? (Choose two.)

Accepted Answer

Provision a NAT Gateway in each AZ for outbound connectivity from private subnets.. Option A is correct because an ALB can route traffic to targets across multiple AZs, providing high availability. Option C is correct because NAT Gateways in each AZ allow instances in private subnets to initiate outbound traffic to the internet while maintaining high availability. Option B is wrong because a single NAT Gateway in one AZ creates a single point of failure. Option D is wrong because a Network Load Balancer is for TCP/UDP traffic, but the question does not specify protocol requirements, and ALB is more common for HTTP applications. Option E is wrong because an Internet Gateway is a single point of failure only if the VPC has only one, but IGWs are highly available by design, but the question asks for actions to implement, and IGW is already present.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use a Network Load Balancer to distribute traffic across AZs.

Answer

Create a single NAT Gateway in one AZ for outbound traffic.

Question 5

A company has a hybrid network with an AWS Direct Connect connection and an AWS Site-to-Site VPN as a backup. The network team notices that traffic is asymmetrically routing through both connections, causing performance issues. Which TWO steps should the team take to ensure traffic uses the primary Direct Connect and only fails over to the VPN? (Choose two.)

Accepted Answer

Configure BGP communities on the Direct Connect to influence route preference.. Option A is correct because adjusting the BGP metrics (AS path prepend or MED) on the Direct Connect side makes it preferred. Option D is correct because using a more specific prefix for the Direct Connect route attracts traffic to it. Option B is wrong because enabling VPN is not needed. Option C is wrong because disabling AS path prepend would make Direct Connect less preferred. Option E is wrong because increasing the VPN BGP metric would make VPN less preferred, but the goal is to prefer Direct Connect.

Answer

Increase the BGP MED value on the VPN connection to make it less preferred.

Answer

Enable VPN automatic failover using AWS VPN CloudHub.

Answer

Disable AS path prepend on the Direct Connect BGP session.

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that VPC A cannot communicate with VPC B, while all other VPCs communicate normally. The transit gateway route table shows routes from both VPCs. Which TWO actions should the network engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Check the security groups and network ACLs in VPC A and VPC B.. Option A is correct because route table association is required for a VPC to use the transit gateway's routes. Option C is correct because security groups or NACLs in the VPCs can block traffic between subnets in different VPCs even if the transit gateway routes are correct. Option B is wrong because VPC peering is not required when using Transit Gateway. Option D is wrong because AWS Direct Connect is unrelated to inter-VPC routing. Option E is wrong because a VPN connection is not needed for VPC-to-VPC communication via Transit Gateway.

Answer

Establish a VPN connection between VPC A and the transit gateway.

Answer

Create a VPC peering connection between VPC A and VPC B.

Answer

Configure an AWS Direct Connect virtual interface between the VPCs.

Question 7

A company wants to monitor network traffic between its VPC and on-premises data center over a Direct Connect private VIF. The network team needs to capture the source and destination IP addresses, protocols, and packet counts. Which THREE AWS services or features should they use together? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. Option B is correct because VPC Flow Logs capture IP traffic metadata. Option D is correct because CloudWatch Logs can store and analyze flow logs. Option E is correct because CloudWatch Contributor Insights can analyze flow log data to identify top talkers etc. Option A is wrong because CloudTrail records API calls. Option C is wrong because AWS Config tracks configuration.

Answer

AWS CloudTrail

Answer

AWS Config

Question 8

A financial services company is deploying a multi-account environment using AWS Organizations. The security team requires that all network traffic to and from the internet must flow through a centralized inspection VPC that hosts third-party firewall appliances. The architecture uses a single AWS Transit Gateway with a centralized inspection VPC attached. Which THREE steps are necessary to enforce this architecture? (Choose THREE.)

Accepted Answer

Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.. Option A is correct because all VPCs need default routes pointing to the transit gateway for internet-bound traffic. Option C is correct because the inspection VPC must have routes to send inspected traffic to an egress VPC or Direct Connect for internet access. Option D is correct because the transit gateway route tables must be configured with blackhole routes or specific routes to force traffic through the inspection VPC. Option B is wrong because VPC endpoints do not route internet traffic. Option E is wrong because service control policies do not enforce routing.

Answer

Use AWS Organizations service control policies to prevent direct internet access from spoke VPCs.

Answer

Deploy VPC Gateway Endpoints for S3 and DynamoDB in each spoke VPC.

Question 9

A company is troubleshooting an issue where an application running on an EC2 instance cannot connect to an Amazon S3 bucket using a VPC endpoint. The security groups and network ACLs appear correct. Which THREE items should the network team verify to resolve the issue? (Choose three.)

Accepted Answer

The VPC endpoint policy allows access to the S3 bucket.. Option A is correct because the VPC endpoint policy may deny access to the specific S3 bucket. Option C is correct because the route table must have a route for the S3 prefix list via the endpoint. Option D is correct because the endpoint must be associated with the correct subnet (or require DNS resolution). Option B is wrong because the Internet Gateway is not needed if using a VPC endpoint. Option E is wrong because S3 Transfer Acceleration is for speed, not connectivity.

Answer

S3 Transfer Acceleration is enabled on the bucket.

Answer

The VPC has an Internet Gateway attached.

Question 10

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network engineer is troubleshooting connectivity issues and notices that the BGP session between the on-premises router and the AWS Direct Connect virtual interface is down. The engineer has verified the physical connectivity and the VLAN configuration. What should the engineer check next?

Accepted Answer

Confirm that the BGP ASN configured on the on-premises router matches the one provided by AWS.. Option C is correct because BGP session establishment depends on matching the BGP ASN on both sides. If they do not match, the session will not come up. Option A is wrong because CIDR size does not affect BGP. Option B is wrong because the VPC CIDR is not used in the BGP peering process. Option D is wrong because the virtual interface type (private or public) is not the direct cause of BGP failure.

Answer

Ensure the virtual interface type is set to 'public'.

Answer

Verify that the on-premises router is advertising a CIDR block smaller than /24.

Answer

Check the VPC CIDR range in the route table.

Question 11

A network engineer is troubleshooting an EC2 instance that cannot connect to S3 via a VPC endpoint. The describe-vpc-endpoints output shows the endpoint is associated with a route table but no subnets. What is the likely issue?

Accepted Answer

The subnet's route table does not include a route for the S3 prefix list via the endpoint.. Option B is correct because Gateway Endpoints for S3 are associated with route tables, not subnets. The instance needs a route in its subnet's route table pointing to the endpoint. If the route table associated with the endpoint is not the same as the subnet's route table, the traffic will not use the endpoint. Option A is wrong because the endpoint state is available. Option C is wrong because endpoint policy allows all. Option D is wrong because the DNS name is present.

Answer

The DNS entry for the endpoint is not resolving.

Answer

The VPC endpoint policy denies access to S3.

Answer

The VPC endpoint state is not available.

Question 12

A company is using AWS CloudFormation to deploy a VPC with public and private subnets, an internet gateway, and a NAT gateway. The deployment fails with the error: 'Route table rtb-12345678 already has a route with destination 0.0.0.0/0'. The network engineer reviews the template and sees that the public route table has a route to the internet gateway and the private route table has a route to the NAT gateway. Both route tables are defined in the same template. What is the most likely cause of this error?

Accepted Answer

The public and private route tables are the same resource due to a typo in the template.. Option B is correct because the error indicates that the same route table is being used for both routes, which happens when both resources reference the same route table ID. Option A is wrong because a route table can have multiple routes, but only one default route. Option C is wrong because the error is specific to duplicate routes, not a missing route. Option D is wrong because internet and NAT gateways can coexist in the same VPC.

Answer

The internet gateway and NAT gateway cannot exist in the same VPC simultaneously.

Answer

The public route table already has a route to the internet gateway, and adding another default route is not allowed.

Answer

The NAT gateway route is missing a destination CIDR block.

Question 13

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones in a VPC. The application communicates with an on-premises database over an AWS Direct Connect private VIF. The network team has configured a VPN connection as a backup. Recently, the application experienced intermittent timeouts when accessing the database. The team suspects asymmetric routing because the primary Direct Connect and backup VPN are both active. The network team wants to ensure that all traffic to the on-premises network uses the Direct Connect when it is available, and only fails over to the VPN if Direct Connect goes down. The BGP sessions are configured on both connections. The Direct Connect advertises the on-premises CIDR of 10.0.0.0/16, and the VPN advertises the same CIDR. The team has access to the on-premises router configuration and AWS console. Which action should the team take to resolve the issue?

Accepted Answer

Configure the on-premises router to prepend one or more AS numbers to the routes advertised over the VPN BGP session.. Option C is correct because adjusting the BGP attributes to make the Direct Connect path more preferred ensures all traffic uses Direct Connect when available. Adding AS path prepend on the VPN side makes the VPN path less preferred, so Direct Connect is chosen. Option A is wrong because adding a static route might not be as dynamic and could cause issues if Direct Connect fails. Option B is wrong because removing the VPN BGP session removes redundancy. Option D is wrong because reducing the prefix size on the VPN side would make the VPN path more specific and thus preferred, causing the same issue.

Answer

Add a static route in the VPC route table pointing to the Direct Connect virtual interface for the on-premises CIDR.

Answer

Advertise a more specific prefix (e.g., 10.0.0.0/24) over the VPN BGP session to attract traffic.

Answer

Disable BGP on the VPN connection and use static routes instead.

Question 14

A company has a hybrid network with multiple VPCs connected via AWS Transit Gateway and an on-premises network via Direct Connect. The network team is planning to migrate a legacy application from on-premises to a new VPC. The application requires low-latency access to an RDS database running in an existing VPC. The team wants to minimize changes to the existing routing. What should the team do to meet these requirements?

Accepted Answer

Attach the new VPC to the existing transit gateway and ensure the transit gateway route tables permit traffic between the new VPC and the RDS VPC.. Option D is correct because attaching the new VPC to the existing transit gateway allows immediate connectivity to the RDS VPC without changing existing routes, provided the route tables are configured correctly. Option A is wrong because VPC peering requires route table updates in both VPCs. Option B is wrong because a VPN connection adds complexity and latency. Option C is wrong because moving the RDS instance changes the database endpoint and may cause downtime.

Answer

Set up a VPN connection from the new VPC to the on-premises network, and route traffic through on-premises to the RDS VPC.

Answer

Create a VPC peering connection between the new VPC and the RDS VPC.

Answer

Migrate the RDS database to the new VPC to keep the application and database in the same VPC.

Question 15

A media company streams live video to viewers worldwide. The application runs on EC2 instances behind an Application Load Balancer in two AWS regions, us-east-1 and eu-west-1. The company uses Amazon CloudFront as a CDN with origins pointing to both regional ALBs. The network team recently deployed AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. However, after enabling Global Accelerator, viewers in Europe report buffering issues, while viewers in the US have no issues. The team has verified that the Global Accelerator endpoints are healthy and the ALBs are functioning correctly. The application uses a custom domain name. The DNS is managed by Route 53. What is the most likely cause of the buffering issues for European viewers?

Accepted Answer

Global Accelerator is directing European traffic to the us-east-1 endpoint due to endpoint weight misconfiguration.. Option A is correct because Global Accelerator provides static IP addresses that are anycast from edge locations. If viewers' DNS queries resolve to the Global Accelerator DNS name, they get IPs that may route to the us-east-1 endpoint if the eu-west-1 endpoint is not properly configured or weighted, causing high latency. The most common issue is that the DNS resolution for the custom domain points to Global Accelerator, but the routing within Global Accelerator may not be directing European traffic to the eu-west-1 endpoint if the endpoint weights are misconfigured or if one endpoint is unhealthy. Option B is wrong because CloudFront origins are separate; Global Accelerator is used instead of CloudFront? Actually, they use both, but the issue is after enabling Global Accelerator. Option C is wrong because CloudFront would not cause issues when Global Accelerator is used. Option D is wrong because the application is not on-premises.

Answer

The Route 53 DNS record is not pointing to Global Accelerator but to CloudFront, bypassing Global Accelerator.

Answer

CloudFront is caching content from the us-east-1 origin only, causing high latency for European viewers.

Answer

The eu-west-1 ALB is not configured to accept traffic from Global Accelerator IPs.