ANS-C01 Network Management and Operations Practice Test 23 — 15 Questions

Question 1

A media company streams live video to viewers worldwide. The application runs on EC2 instances behind an Application Load Balancer in two AWS regions, us-east-1 and eu-west-1. The company uses Amazon CloudFront as a CDN with origins pointing to both regional ALBs. The network team recently deployed AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. However, after enabling Global Accelerator, viewers in Europe report buffering issues, while viewers in the US have no issues. The team has verified that the Global Accelerator endpoints are healthy and the ALBs are functioning correctly. The application uses a custom domain name. The DNS is managed by Route 53. What is the most likely cause of the buffering issues for European viewers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Global Accelerator is directing European traffic to the us-east-1 endpoint due to endpoint weight misconfiguration.. Global Accelerator provides static IP addresses that are anycast from edge locations. If viewers' DNS queries resolve to the Global Accelerator DNS name, they get IPs that may route to the us-east-1 endpoint if the eu-west-1 endpoint is not properly configured or weighted, causing high latency. The most common issue is that the DNS resolution for the custom domain points to Global Accelerator, but the routing within Global Accelerator may not be directing European traffic to the eu-west-1 endpoint if the endpoint weights are misconfigured or if one endpoint is unhealthy. Option B is wrong because CloudFront origins are separate; Global Accelerator is used instead of CloudFront? Actually, they use both, but the issue is after enabling Global Accelerator. Option C is wrong because CloudFront would not cause issues when Global Accelerator is used. Option D is wrong because the application is not on-premises.

Answer

The Route 53 DNS record is not pointing to Global Accelerator but to CloudFront, bypassing Global Accelerator.

Answer

CloudFront is caching content from the us-east-1 origin only, causing high latency for European viewers.

Answer

The eu-west-1 ALB is not configured to accept traffic from Global Accelerator IPs.

Question 2

A company has a Direct Connect connection with a private virtual interface to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection. They have enabled VPC Flow Logs for the VPC, but the flow logs do not show traffic that traverses the Direct Connect. The team needs a solution to capture the bandwidth usage of the Direct Connect connection. Which solution should they implement?

Accepted Answer

Use CloudWatch metrics for the Direct Connect connection.. Direct Connect publishes metrics to CloudWatch, including bandwidth utilization, connection state, and BGP status. These metrics can be used to monitor the bandwidth usage of the Direct Connect connection. VPC Flow Logs capture IP traffic within the VPC, not traffic on the Direct Connect physical connection. Option B is wrong because CloudTrail logs API calls, not bandwidth metrics. Option C is wrong because flow logs cannot be enabled on a Direct Connect virtual interface; they only capture traffic on VPC network interfaces. Option D is wrong because AWS Config rules are used for compliance and configuration monitoring, not for bandwidth metrics.

Answer

Enable AWS CloudTrail for the Direct Connect connection.

Answer

Enable VPC Flow Logs on the Direct Connect virtual interface.

Answer

Use AWS Config rules to monitor bandwidth.

Question 3

A company has a VPC with a public subnet and a private subnet. The public subnet contains a web server (EC2 instance) that must be accessible from the internet. The private subnet contains a database server (EC2 instance) that should only be accessible from the web server. The web server's security group allows HTTP (80) and HTTPS (443) from 0.0.0.0/0. The database server's security group allows MySQL (3306) from the web server's security group. However, the web server cannot connect to the database server. The network engineer has verified that the web server can reach the internet and that the database server's security group is correctly configured. What is the most likely cause of the connectivity problem?

Accepted Answer

The network ACL associated with the private subnet is blocking inbound MySQL traffic from the web server.. Security groups are stateful, meaning that if the web server initiates traffic to the database, the return traffic is automatically allowed regardless of outbound rules in the security group. However, network ACLs (NACLs) are stateless and require explicit inbound and outbound rules. In this scenario, the database server's security group is correctly configured to allow MySQL traffic from the web server's security group, indicating that the security group is not the issue. The most likely cause is that the network ACL associated with the private subnet is blocking inbound MySQL traffic (port 3306) from the web server. Option A is incorrect because the route table for the private subnet does not need a route to the public subnet for traffic within the same VPC; local routes handle that. Option B is incorrect because security groups are stateful, so outbound traffic from the web server to the database is allowed by default. Option D is incorrect because the database server does not need a route to the internet gateway for internal VPC communication.

Answer

The route table for the private subnet does not have a route to the public subnet.

Answer

The web server's security group does not allow outbound traffic to the database server.

Answer

The database server does not have a route to the internet gateway.

Question 4

A network engineer must design a solution to monitor and troubleshoot connectivity from an on-premises data center to a VPC over an AWS Direct Connect connection. The solution must provide visibility into BGP routing, packet loss, and latency. Which TWO services or features should the engineer use? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs for Direct Connect. Amazon CloudWatch metrics for Direct Connect can monitor BGP session state, packet loss, and latency. AWS CloudTrail logs API calls but not network performance. VPC Flow Logs capture IP traffic metadata but not BGP details or latency. AWS X-Ray is for application tracing. Amazon Inspector is for security assessments.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS X-Ray

Question 5

A company uses AWS CloudWAN to build a global network connecting multiple VPCs and on-premises sites. The network team has configured a core network with a segment that includes VPCs in us-east-1 and eu-west-1. The team notices that traffic between VPCs in different regions is taking a suboptimal path, going through the internet instead of staying within the AWS global network. The team has verified that the core network attachments are correctly configured and that the route tables are propagated. What should the team do to ensure traffic stays within the AWS global network?

Accepted Answer

Ensure both VPCs are attached to the same CloudWAN segment.. CloudWAN uses segments to control routing. If both VPCs are attached to the same segment, traffic between them will use the AWS global network. Option A is wrong because VPC peering creates a direct connection but does not leverage CloudWAN's global backbone and may lead to suboptimal routing. Option B is wrong because AWS Direct Connect is designed for on-premises connectivity, not inter-region VPC traffic. Option D is wrong because transit gateway peering is unnecessary when using CloudWAN, which already provides inter-region routing via its core network.

Answer

Establish a VPC peering connection between the two VPCs.

Answer

Set up an AWS Direct Connect gateway to route traffic between regions.

Answer

Create a transit gateway in each region and peer them together.

Question 6

A company has a multi-account AWS environment with hundreds of VPCs interconnected via a transit gateway. The network team needs to centrally monitor VPC reachability and identify asymmetric routing paths. Which THREE services or features should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Contributor Insights. VPC Reachability Analyzer can test paths and detect asymmetric routing. AWS Network Manager provides central visibility for transit gateway networks. Amazon CloudWatch Contributor Insights helps analyze VPC Flow Logs to identify traffic patterns. AWS Config evaluates rules but not real-time path analysis. AWS CloudHSM is for hardware security modules.

Answer

AWS Config

Answer

AWS CloudHSM

Question 7

A company has a multi-account AWS environment using AWS Organizations. Each account contains a VPC with a private subnet and a public subnet. The company uses a centralized inspection VPC in the network account with third-party firewall appliances. All internet-bound traffic from the VPCs must be routed through the inspection VPC via an AWS Transit Gateway. The network team has configured the transit gateway with separate route tables: one for the inspection VPC and one for the spoke VPCs. The spoke VPCs have a default route (0.0.0.0/0) pointing to the transit gateway. The inspection VPC has a default route pointing to an egress VPC that has an internet gateway. However, traffic from a spoke VPC is not reaching the internet. The network engineer has verified that the firewall appliances are running and that the security groups and NACLs allow traffic. What is the most likely cause of the issue?

Accepted Answer

The inspection VPC route table does not have a route to the transit gateway for the spoke VPC CIDRs.. For traffic from a spoke VPC to reach the internet via the inspection VPC, the inspection VPC must be able to route return traffic back to the spoke VPC. The inspection VPC's route table requires routes for each spoke VPC's CIDR blocks with the Transit Gateway as the target. Without these routes, the firewall cannot forward return traffic, causing the initial connection to time out and internet access to fail. Option B is similar but misstates the requirement. Options C and D describe different issues that do not align with the described symptoms.

Answer

The inspection VPC route table does not have a route to the spoke VPC CIDRs via the transit gateway.

Answer

The inspection VPC route table has a blackhole route for the spoke VPC CIDRs.

Answer

The transit gateway route table for the spoke VPCs does not have a route to the egress VPC.

Question 8

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones. The application is fronted by an Application Load Balancer (ALB). The network team recently migrated from a transit VPC to a transit gateway for inter-VPC connectivity. After the migration, users experience intermittent connectivity failures. The team checks the ALB target group and sees that health checks are passing. However, from an EC2 instance in the same VPC, they can reach the ALB but not the application. They notice that the application sends traffic to an internal DNS server that is in a different VPC, and the application depends on that DNS resolution. The transit gateway route tables are configured to propagate routes from attached VPCs. The DNS server is reachable from the application VPC over the transit gateway. What is the MOST likely cause of the intermittent failures?

Accepted Answer

The DNS server returns different IP addresses for the same DNS name, and some IPs are not reachable due to route table misconfiguration.. If the DNS server returns different IP addresses for the same DNS name due to DNS round-robin or time-to-live (TTL) caching, the application may get an IP address that is not reachable (e.g., from a different VPC or a terminated instance). The health check may pass because the target group health check uses the ALB's IP, not the application's DNS resolution. Option A is plausible but less likely because the DNS server is reachable. Option B could cause total failure, not intermittent. Option D would affect all traffic, not just intermittent.

Answer

The transit gateway route tables have a blackhole route for the DNS server's VPC.

Answer

The Auto Scaling group is scaling in and out frequently, causing application instances to be terminated during DNS resolution.

Answer

The ALB security group does not allow traffic from the application instances on the ephemeral ports.

Question 9

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The connection uses a private virtual interface (VIF) to access the VPC. The network team is monitoring the link and notices that the BGP session goes down intermittently. The team has checked the physical layer and found no issues. The BGP keepalive timer is set to 30 seconds on both sides. The network engineer suspects that the issue might be related to the BGP hold timer. What should the engineer do to stabilize the BGP session?

Accepted Answer

Increase the BGP hold timer to 90 seconds on both the on-premises router and the AWS side.. Increasing the BGP hold timer to 90 seconds on both the on-premises router and the AWS side allows more time to receive keepalive messages, reducing the likelihood of the session going down due to transient network issues or slight delays. This stabilizes the BGP session without changing the underlying physical connection. Option A is incorrect because a static route would bypass BGP and remove the dynamic routing benefits. Option B is incorrect because decreasing the hold timer makes the session more sensitive to delays, worsening the flapping. Option D is incorrect because changing to a public VIF does not affect BGP stability and is unrelated to the hold timer issue.

Answer

Configure a static route on the on-premises router for the VPC CIDR.

Answer

Decrease the BGP hold timer to 10 seconds on the on-premises router.

Answer

Change the virtual interface to a public VIF to improve BGP stability.

Question 10

A company has an AWS Site-to-Site VPN connection between an on-premises network and a VPC. The VPN uses virtual private gateways and static routes. The network team reports that the VPN tunnel is up, but traffic from the on-premises network cannot reach some EC2 instances in the VPC. The EC2 instances have security groups that allow inbound traffic from the on-premises network. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. The tunnel status shows 'UP' from both sides. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The VPC route table does not have a route for the on-premises subnet that the traffic originates from, but only for a larger CIDR.. The security group may be allowing traffic from the on-premises CIDR but not from the tunnel endpoint IP. However, the more common issue is that the on-premises network's source IP is being translated or the VPC route table is missing a route for the specific subnet. Option A is a typical cause: if the on-premises CIDR is not exactly matched, the VPC may not route traffic back. Option C could cause issues if the VPN is not in the main route table. Option D would cause tunnel issues.

Answer

The VPC has a network ACL that denies inbound traffic from the on-premises CIDR.

Answer

The customer gateway device is using a different pre-shared key than configured in AWS.

Answer

The virtual private gateway is not attached to the correct VPC.

Question 11

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that the latency to S3 increases significantly during peak hours. They have tested the connection and confirmed that the physical link is not saturated. The company uses a single Direct Connect connection. The S3 traffic is routed over the public VIF. The team wants to improve performance without adding a new Direct Connect connection. Which action should the team take to reduce latency?

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and route S3 traffic through a private VIF attached to the VPC.. Using a Direct Connect gateway allows you to connect to multiple VPCs and also to AWS public services via a private VIF. However, for S3, you can use a private VIF with a VPC interface endpoint (Gateway Endpoint for S3) to keep traffic within the AWS network and avoid internet transit. This reduces latency because traffic goes from Direct Connect to the VPC and then to S3 via the gateway endpoint. Option B (adding VPN) adds IPSec overhead. Option C uses a different AWS region, which may increase latency. Option D (adding a second Direct Connect) is not allowed per the question.

Answer

Use an AWS Site-to-Site VPN connection over the Direct Connect to access S3 via private IP.

Answer

Add a second Direct Connect connection to load balance traffic.

Answer

Configure the Direct Connect public VIF to use a different AWS region closer to the on-premises location.

Question 12

A company has a VPC with public and private subnets. The public subnets have a NAT gateway for outbound internet access. The private subnets route all 0.0.0.0/0 traffic to the NAT gateway. The network team wants to centrally log all outbound internet traffic from the private subnets. They enable VPC Flow Logs and publish them to Amazon S3. However, they notice that the flow logs are capturing only traffic between instances within the VPC, not the NAT gateway traffic. What should the team do to capture outbound internet traffic?

Accepted Answer

Enable VPC Flow Logs specifically for the NAT gateway's elastic network interface.. VPC Flow Logs capture traffic at the network interface level. Traffic from private subnets to the NAT gateway is captured by flow logs on the private subnet instances' ENIs, but the NAT gateway's outbound traffic goes through its own ENI. To log the actual outbound internet traffic, you must enable flow logs on the NAT gateway's ENI. Option A correctly identifies this. Option B would not capture NAT gateway egress because flow logs are per-ENI. Option C (CloudTrail) logs API calls, not network traffic. Option D is incorrect because the destination (S3 vs CloudWatch) does not affect what traffic is captured.

Answer

Enable VPC Flow Logs for all subnets in the VPC.

Answer

Use AWS CloudTrail to log NAT gateway traffic.

Answer

Enable VPC Flow Logs for the VPC and publish to CloudWatch Logs instead of S3.

Question 13

A company has a VPC with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via AWS Direct Connect. The network team needs to ensure that only specific VPCs can communicate with each other. They create a transit gateway route table for each VPC and attach the VPC to the route table. They also propagate routes from the Direct Connect virtual interface. However, after configuration, traffic between two VPCs that should not communicate is still flowing. What is the MOST likely cause?

Accepted Answer

The VPC attachments are using the default transit gateway route table instead of custom route tables.. The most likely cause is that the VPC attachments are using the default transit gateway route table instead of custom route tables. By default, a transit gateway has a default route table that is shared among all attachments, which can allow unintended inter-VPC traffic if the team did not explicitly associate each VPC attachment with a dedicated route table. The correct approach is to create individual route tables for each VPC and associate the respective VPC attachment with its custom route table, ensuring isolation. Option A is incorrect because VPC route tables pointing to the transit gateway are necessary for VPCs to communicate via the transit gateway; they do not cause unintended traffic by themselves. Option B is incorrect because the issue is about which route table the attachments are associated with, not whether route tables exist. Option D is incorrect because propagating Direct Connect routes into all route tables would affect on-premises connectivity, but the issue is specifically inter-VPC traffic.

Answer

The VPC route tables have a route for the other VPC CIDR pointing to the transit gateway.

Answer

The transit gateway route tables are not associated with the VPC attachments.

Answer

The Direct Connect virtual interface is propagating routes into all route tables.

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a VPC, public and private subnets, security groups, and an Application Load Balancer. The network team wants to ensure that the ALB can only accept traffic from a specific set of IP addresses. They add a security group rule that allows inbound traffic on port 443 from the allowed IP CIDR. However, after deployment, the ALB is not responding to requests from the allowed IPs. The team checks the security group and confirms the rule exists. They also verify that the ALB is in the public subnet and has a public DNS name. What is the MOST likely cause?

Accepted Answer

The public subnet does not have a route to an internet gateway.. The most likely cause is that the public subnet does not have a route to an internet gateway. For an internet-facing ALB to receive traffic from the internet, the subnets where the ALB is deployed must have a default route (0.0.0.0/0) pointing to an internet gateway. Without this route, even if the security group allows the traffic, the ALB cannot be reached because the subnet is not routable from the internet. Option A is incorrect because security groups are stateful and automatically allow return traffic, so that would not block responses. Option B is incorrect because the listener configuration affects whether traffic is forwarded to targets, not whether the ALB itself accepts incoming connections from allowed IPs. Option D is incorrect because the ALB uses an internet-facing scheme; if it were internal, it would not have a public DNS name.

Answer

The security group rule is blocking return traffic; security groups are stateful.

Answer

The ALB listener is not configured to forward traffic to the target group.

Answer

The ALB is using an internal scheme instead of internet-facing.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). An EC2 instance in the private subnet needs to download patches from the internet. The team creates a NAT gateway in the public subnet and updates the private subnet route table to route 0.0.0.0/0 to the NAT gateway. The EC2 instance still cannot reach the internet. The team confirms the NAT gateway has an elastic IP and the public subnet has an internet gateway. What is the MOST likely cause?

Accepted Answer

The network ACL for the private subnet denies outbound traffic to the internet.. The most likely cause is that the network ACL (NACL) for the private subnet denies outbound traffic to the internet. Even though the route table correctly points 0.0.0.0/0 to the NAT gateway, the NACL is a stateless firewall that can block outbound traffic if it doesn't allow the necessary ephemeral ports. It must also allow inbound return traffic. Option A is incorrect because the private subnet route table already has a route to the NAT gateway. Option C is incorrect because the public subnet already has a route to the internet gateway. Option D is incorrect because the NAT gateway is a managed service with source/destination check automatically disabled.

Answer

The private subnet route table does not have a route for the NAT gateway's IP.

Answer

The public subnet does not have a route to the internet gateway.

Answer

The NAT gateway does not have source/destination check disabled.