ANS-C01 Network Management and Operations Practice Test 22 — 15 Questions

Question 1

A company has a VPC with multiple subnets across Availability Zones. An application load balancer (ALB) is deployed in public subnets. The network team notices that traffic from the ALB to targets in private subnets is intermittently failing. The targets are healthy. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The target security group does not allow traffic from the ALB's security group.. ALB target security groups must explicitly allow inbound traffic from the ALB's security group on the target port. If the target SG does not reference the ALB SG (or the correct port), health checks may pass intermittently or fail, causing traffic to be dropped. This is the most common cause of intermittent ALB-to-target failures when targets are otherwise healthy.

Answer

The ALB is not associated with a public subnet.

Answer

The network ACL for the target subnets blocks outbound traffic.

Answer

Cross-zone load balancing is disabled.

Question 2

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection in real time. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the AWS service that collects and displays Direct Connect metrics such as ConnectionBpsEgress, ConnectionBpsIngress, and VirtualInterfaceBpsEgress/Ingress, allowing real-time bandwidth utilization monitoring. These metrics are published automatically to CloudWatch under the AWS/DX namespace. CloudWatch dashboards and alarms can then be built on top of them.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 3

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. The two connections will terminate on different AWS Direct Connect locations. Which configuration will provide the HIGHEST availability?

Accepted Answer

Use different customer gateway devices and different Direct Connect locations. Highest availability for Direct Connect redundancy requires terminating the two connections on different customer gateway devices and at different Direct Connect locations, so a failure of one device or one location does not take down both connections. This provides both device-level and location-level redundancy, which is the AWS-recommended maximum-resilience design.

Answer

Use the same customer gateway device for both connections

Answer

Use the same Direct Connect location for both connections

Answer

Use the same BGP ASN for both connections

Question 4

A company has a VPC with public and private subnets. The private subnets need internet access for software updates. The company wants to minimize costs and management overhead. Which solution should they use?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the private subnet route table pointing to the NAT gateway. A NAT gateway deployed in a public subnet allows instances in private subnets to initiate outbound traffic to the internet for software updates while preventing inbound internet traffic, and it is a fully managed service requiring minimal overhead. Option A (VPC endpoints) only provides access to specific AWS services like S3 and CloudFront, not general internet. Option B (attaching an IGW and adding a default route to private subnets) would make the private subnets effectively public, allowing unsolicited inbound connections and violating security best practices. Option D (NAT instance) requires manual configuration, patching, and scaling, increasing management overhead compared to a NAT gateway.

Answer

Use a VPC endpoint for S3 and CloudFront

Answer

Attach an internet gateway to the VPC and add a default route to the private subnet route table pointing to the internet gateway

Answer

Launch a NAT instance on an EC2 instance in a public subnet

Question 5

A solutions architect is designing a hybrid network using AWS Transit Gateway with multiple VPN attachments. The on-premises network uses BGP dynamic routing. What is the best practice to achieve high availability and fast failover?

Accepted Answer

Create two VPN connections from two different customer gateways to two different AWS VPN endpoints, and enable BGP on both.. Option C is correct because AWS best practice for a highly available, fast-failover hybrid VPN design is to use two VPN connections terminating on different customer gateways and different AWS VPN endpoints, with BGP enabled on both so dynamic routing can reconverge quickly when a path fails. Each AWS Site-to-Site VPN connection already provides two tunnels for redundancy, but using two separate connections across diverse customer gateways and endpoints protects against a single device or endpoint failure and lets BGP withdraw and prefer the surviving path. Option A is wrong because a single VPN connection with static routes has no dynamic failover and a single connection is a single point of failure. Option B is wrong because a single tunnel with static routes and a higher-metric backup still relies on static routing and does not provide BGP-based fast failover. Option D is wrong because one tunnel with BGP enabled lacks path diversity and cannot provide high availability if that tunnel or endpoint fails.

Answer

Use a single VPN connection with static routes.

Answer

Configure the VPN connection with a single tunnel and use static routes with a higher metric for backup.

Answer

Use only one VPN tunnel with BGP enabled.

Question 6

A company wants to monitor network traffic between two VPCs connected via a Transit Gateway. Which THREE AWS services can be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs (A) are correct because they capture IP traffic metadata (source/destination IP, ports, protocol, bytes, accept/reject) for ENIs in a VPC, so they can record traffic traversing the VPCs attached to the Transit Gateway. Transit Gateway Flow Logs (D) are correct because AWS specifically supports flow logs on the Transit Gateway attachment, capturing traffic that flows through the TGW between the connected VPCs. A third-party network monitoring appliance deployed in a VPC (C) is correct because a customer-managed instance (e.g., a firewall or IDS/IPS) placed inline or via mirroring can capture and deeply inspect packets between the VPCs. AWS Config (B) is not for traffic capture; it records resource configuration changes and compliance. AWS CloudTrail (E) logs API activity and management events, not network packet or flow data.

Answer

AWS Config

Answer

AWS CloudTrail

Question 7

Refer to the exhibit. A network engineer has established a VPC peering connection between VPC A (10.0.0.0/16) in account 111111111111 and VPC B (192.168.0.0/16) in account 222222222222. The peering connection status is 'active'. However, instances in VPC A cannot reach instances in VPC B. What is the MOST likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes to the peer CIDR. Even when a VPC peering connection is 'active', traffic will not flow unless both VPC route tables contain routes pointing the peer CIDR to the peering connection. The most common cause of this symptom is missing or incorrect route table entries in one or both VPCs. Security groups and CIDR overlap are possible but less likely given the scenario.

Answer

The peering connection is not in the 'active' state

Answer

Security groups in VPC B are blocking traffic

Answer

The CIDR blocks overlap

Question 8

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The company wants to ensure that traffic to the VPC uses the Direct Connect connection instead of the internet. Which configuration is required?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the virtual private gateway.. To ensure traffic to the on-premises network uses Direct Connect instead of the internet, you must add a route in the VPC route table that points to the on-premises CIDR via the virtual private gateway (VGW). The VGW is the AWS side of the Direct Connect connection, and this route directs traffic through the private virtual interface. Without this route, traffic would follow the default route to the internet gateway.

Answer

Create a VPC peering connection to the on-premises network.

Answer

Use a NAT gateway in the VPC.

Answer

Add a route in the VPC route table pointing to the on-premises CIDR via the internet gateway.

Question 9

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that some VPCs cannot communicate with each other even though they are attached to the same transit gateway. What is the most likely cause?

Accepted Answer

The transit gateway route tables are missing routes to the other VPCs.. Transit Gateway uses its own route tables to control which attachments can reach which destinations. If VPCs are attached but their routes are not propagated or associated with the correct TGW route table, traffic between them is dropped. The most likely cause of selective VPC-to-VPC failure is missing routes in the TGW route table.

Answer

The security groups on the instances are not allowing inbound traffic from the other VPCs.

Answer

The VPC attachments are not in the 'available' state.

Answer

The VPCs' network ACLs are blocking traffic.

Question 10

Refer to the exhibit. A Direct Connect private virtual interface is in the 'available' state, and the BGP session is up. However, the on-premises network cannot reach any resources in the VPC attached to the Direct Connect gateway. What is the MOST likely cause?

Accepted Answer

The Direct Connect gateway is not associated with the virtual private gateway or route propagation is not enabled. For a Direct Connect private VIF to provide access to a VPC, the Direct Connect gateway must be associated with the virtual private gateway (VGW) of that VPC, and route propagation must be enabled so that on-premises routes are advertised into the VPC and VPC routes are advertised to on-premises. If the association or route propagation is missing, BGP may be up but no routes are exchanged, resulting in no connectivity.

Answer

The BGP ASN is private and not allowed

Answer

The VLAN ID is incorrect

Answer

The BGP session is not established

Question 11

A company uses AWS Direct Connect and VPN as backup. The network team notices that during a VPN failover, traffic drops for several minutes. The VPN tunnels are configured with BGP dynamic routing. Which configuration change would MOST likely reduce failover time?

Accepted Answer

Enable BFD on the VPN BGP sessions. BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions by sending rapid heartbeat packets independent of BGP keepalives. When enabled on VPN BGP sessions, BFD can detect a dead peer in milliseconds rather than waiting for the BGP hold timer to expire (which defaults to 90 seconds), dramatically reducing failover time during VPN failover scenarios.

Answer

Configure static routes over the VPN instead of BGP

Answer

Increase the BGP keepalive interval and decrease the hold timer

Answer

Decrease the BGP keepalive interval and increase the hold timer

Question 12

A network engineer needs to monitor network traffic to an Amazon RDS instance for security analysis. Which AWS service should be used to capture and analyze network traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring allows capturing and inspecting network traffic from an RDS instance (full packet capture). Option A is wrong because Amazon Inspector is for vulnerability assessment, not network traffic capture. Option B is wrong because VPC Flow Logs provide metadata (IP, port, etc.) about traffic, not full packet capture. Option D is wrong because AWS CloudTrail records API activity, not network traffic.

Answer

Amazon Inspector

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 13

An EC2 instance with the attached network interface shown above is unable to reach the internet. The instance is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What is the most likely cause?

Accepted Answer

The network interface's attachment status is 'attached', but the instance may not have a public IP address.. For an EC2 instance to reach the internet through an internet gateway, it must have a public IPv4 address (or Elastic IP) associated with its network interface. The question states the subnet has a route to an IGW and the security group allows outbound traffic, so the missing piece is the public IP. Without a public IP, the instance's traffic cannot be translated to a routable address for the internet.

Answer

The source/destination check is enabled, which prevents the instance from sending traffic to the internet if it is not the source of the traffic.

Answer

The route table for the subnet does not have a 0.0.0.0/0 route pointing to the internet gateway.

Answer

The security group is not associated with the network interface.

Question 14

A company uses a centralized inspection VPC for traffic inspection. All VPCs route traffic to the inspection VPC via Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by a network virtual appliance in the inspection VPC. Which Transit Gateway feature should be configured?

Accepted Answer

Transit Gateway route tables. Transit Gateway route tables allow you to control routing between attachments. By associating VPC attachments with a specific route table and propagating routes only to the inspection VPC attachment, you can force all inter-VPC traffic through the inspection VPC. This is the standard method to achieve centralized inspection with AWS Transit Gateway.

Answer

Transit Gateway flow logs

Answer

Transit Gateway multicast

Answer

Transit Gateway peering

Question 15

A company has a Direct Connect connection with a private VIF to a VPC. The network team notices intermittent packet loss on the link. CloudWatch metrics show no errors on the connection. What should the team do next to isolate the issue?

Accepted Answer

Run a traceroute from an on-premises device to an EC2 instance in the VPC.. Running a traceroute from on-premises to an EC2 instance in the VPC is the best next step to isolate where packet loss occurs along the path. Since CloudWatch shows no errors on the Direct Connect connection, the issue may be in the network path beyond the connection, and traceroute reveals the hop-by-hop latency and loss. This helps determine whether the loss is on the customer side, the AWS side, or an intermediate network.

Answer

Check the BGP session status on the customer router.

Answer

Enable VPC Flow Logs on the VPC.

Answer

Increase the bandwidth of the Direct Connect connection.