ANS-C01 Network Management and Operations Practice Test 23 — 15 Questions

Question 1

A company has a Direct Connect connection with a private virtual interface to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection. They have enabled VPC Flow Logs for the VPC, but the flow logs do not show traffic that traverses the Direct Connect. The team needs a solution to capture the bandwidth usage of the Direct Connect connection. Which solution should they implement?

Accepted Answer

Use CloudWatch metrics for the Direct Connect connection.. Option B is correct because Direct Connect publishes metrics to CloudWatch, including bandwidth utilization, connection state, and BGP status. VPC Flow Logs capture IP traffic within the VPC, not traffic on the Direct Connect physical connection. Option A is wrong because flow logs only capture traffic on VPC network interfaces. Option C is wrong because AWS Config does not provide bandwidth metrics. Option D is wrong because CloudTrail logs API calls.

Answer

Enable AWS CloudTrail for the Direct Connect connection.

Answer

Enable VPC Flow Logs on the Direct Connect virtual interface.

Answer

Use AWS Config rules to monitor bandwidth.

Question 2

A company has a VPC with a public subnet and a private subnet. The public subnet contains a web server (EC2 instance) that must be accessible from the internet. The private subnet contains a database server (EC2 instance) that should only be accessible from the web server. The web server's security group allows HTTP (80) and HTTPS (443) from 0.0.0.0/0. The database server's security group allows MySQL (3306) from the web server's security group. However, the web server cannot connect to the database server. The network engineer has verified that the web server can reach the internet and that the database server's security group is correctly configured. What is the most likely cause of the connectivity problem?

Accepted Answer

The network ACL associated with the private subnet is blocking inbound MySQL traffic from the web server.. Option B is correct because the default network ACL in a VPC allows all inbound and outbound traffic, but if a custom NACL is associated with the private subnet, it may block traffic if not properly configured. Option A is wrong because the route table does not affect traffic within the same VPC. Option C is wrong because security groups are stateful, so outbound traffic is automatically allowed. Option D is wrong because internet gateway is not needed for VPC internal traffic.

Answer

The route table for the private subnet does not have a route to the public subnet.

Answer

The web server's security group does not allow outbound traffic to the database server.

Answer

The database server does not have a route to the internet gateway.

Question 3

A network engineer must design a solution to monitor and troubleshoot connectivity from an on-premises data center to a VPC over an AWS Direct Connect connection. The solution must provide visibility into BGP routing, packet loss, and latency. Which TWO services or features should the engineer use? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs for Direct Connect. Amazon CloudWatch metrics for Direct Connect can monitor BGP session state, packet loss, and latency. AWS CloudTrail logs API calls but not network performance. VPC Flow Logs capture IP traffic metadata but not BGP details or latency. AWS X-Ray is for application tracing. Amazon Inspector is for security assessments.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS X-Ray

Question 4

A company uses AWS CloudWAN to build a global network connecting multiple VPCs and on-premises sites. The network team has configured a core network with a segment that includes VPCs in us-east-1 and eu-west-1. The team notices that traffic between VPCs in different regions is taking a suboptimal path, going through the internet instead of staying within the AWS global network. The team has verified that the core network attachments are correctly configured and that the route tables are propagated. What should the team do to ensure traffic stays within the AWS global network?

Accepted Answer

Ensure both VPCs are attached to the same CloudWAN segment.. Option C is correct because CloudWAN uses segments and attachments; if the VPCs are not in the same segment, traffic may be routed through the internet. Option A is wrong because Transit Gateway is not needed when using CloudWAN. Option B is wrong because DX is for on-premises, not inter-region VPC traffic. Option D is wrong because VPC peering is not part of CloudWAN architecture.

Answer

Establish a VPC peering connection between the two VPCs.

Answer

Set up an AWS Direct Connect gateway to route traffic between regions.

Answer

Create a transit gateway in each region and peer them together.

Question 5

A company has a multi-account AWS environment with hundreds of VPCs interconnected via a transit gateway. The network team needs to centrally monitor VPC reachability and identify asymmetric routing paths. Which THREE services or features should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Contributor Insights. VPC Reachability Analyzer can test paths and detect asymmetric routing. AWS Network Manager provides central visibility for transit gateway networks. Amazon CloudWatch Contributor Insights helps analyze VPC Flow Logs to identify traffic patterns. AWS Config evaluates rules but not real-time path analysis. AWS CloudHSM is for hardware security modules.

Answer

AWS Config

Answer

AWS CloudHSM

Question 6

A company has a multi-account AWS environment using AWS Organizations. Each account contains a VPC with a private subnet and a public subnet. The company uses a centralized inspection VPC in the network account with third-party firewall appliances. All internet-bound traffic from the VPCs must be routed through the inspection VPC via an AWS Transit Gateway. The network team has configured the transit gateway with separate route tables: one for the inspection VPC and one for the spoke VPCs. The spoke VPCs have a default route (0.0.0.0/0) pointing to the transit gateway. The inspection VPC has a default route pointing to an egress VPC that has an internet gateway. However, traffic from a spoke VPC is not reaching the internet. The network engineer has verified that the firewall appliances are running and that the security groups and NACLs allow traffic. What is the most likely cause of the issue?

Accepted Answer

The inspection VPC route table does not have a route to the transit gateway for the spoke VPC CIDRs.. Option B is correct because in a centralized inspection architecture, spoke VPCs must send traffic to the inspection VPC, and the inspection VPC must have a route to send traffic back to the transit gateway for egress. If the inspection VPC's route table does not have a route pointing to the transit gateway for the spoke VPCs' CIDRs, the return traffic will be dropped. Option A is wrong because the inspection VPC does not need a route to the spoke VPCs via the transit gateway; it needs a route to the transit gateway for return traffic. Option C is wrong because the transit gateway route table for spoke VPCs needs a route to the inspection VPC, not the egress VPC. Option D is wrong because the inspection VPC route table should not have a blackhole route for spoke VPCs.

Answer

The inspection VPC route table does not have a route to the spoke VPC CIDRs via the transit gateway.

Answer

The inspection VPC route table has a blackhole route for the spoke VPC CIDRs.

Answer

The transit gateway route table for the spoke VPCs does not have a route to the egress VPC.

Question 7

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones. The application is fronted by an Application Load Balancer (ALB). The network team recently migrated from a transit VPC to a transit gateway for inter-VPC connectivity. After the migration, users experience intermittent connectivity failures. The team checks the ALB target group and sees that health checks are passing. However, from an EC2 instance in the same VPC, they can reach the ALB but not the application. They notice that the application sends traffic to an internal DNS server that is in a different VPC, and the application depends on that DNS resolution. The transit gateway route tables are configured to propagate routes from attached VPCs. The DNS server is reachable from the application VPC over the transit gateway. What is the MOST likely cause of the intermittent failures?

Accepted Answer

The DNS server returns different IP addresses for the same DNS name, and some IPs are not reachable due to route table misconfiguration.. If the DNS server returns different IP addresses for the same DNS name due to DNS round-robin or time-to-live (TTL) caching, the application may get an IP address that is not reachable (e.g., from a different VPC or a terminated instance). The health check may pass because the target group health check uses the ALB's IP, not the application's DNS resolution. Option A is plausible but less likely because the DNS server is reachable. Option B could cause total failure, not intermittent. Option D would affect all traffic, not just intermittent.

Answer

The transit gateway route tables have a blackhole route for the DNS server's VPC.

Answer

The Auto Scaling group is scaling in and out frequently, causing application instances to be terminated during DNS resolution.

Answer

The ALB security group does not allow traffic from the application instances on the ephemeral ports.

Question 8

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The connection uses a private virtual interface (VIF) to access the VPC. The network team is monitoring the link and notices that the BGP session goes down intermittently. The team has checked the physical layer and found no issues. The BGP keepalive timer is set to 30 seconds on both sides. The network engineer suspects that the issue might be related to the BGP hold timer. What should the engineer do to stabilize the BGP session?

Accepted Answer

Increase the BGP hold timer to 90 seconds on both the on-premises router and the AWS side.. Option A is correct because increasing the BGP hold timer allows more time to receive keepalives, reducing flapping due to transient issues. Option B is wrong because decreasing the hold timer would make the session more sensitive. Option C is wrong because a static route would bypass BGP and not provide redundancy. Option D is wrong because moving to a public VIF is unrelated to BGP stability.

Answer

Configure a static route on the on-premises router for the VPC CIDR.

Answer

Decrease the BGP hold timer to 10 seconds on the on-premises router.

Answer

Change the virtual interface to a public VIF to improve BGP stability.

Question 9

A company has an AWS Site-to-Site VPN connection between an on-premises network and a VPC. The VPN uses virtual private gateways and static routes. The network team reports that the VPN tunnel is up, but traffic from the on-premises network cannot reach some EC2 instances in the VPC. The EC2 instances have security groups that allow inbound traffic from the on-premises network. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. The tunnel status shows 'UP' from both sides. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The VPC route table does not have a route for the on-premises subnet that the traffic originates from, but only for a larger CIDR.. The security group may be allowing traffic from the on-premises CIDR but not from the tunnel endpoint IP. However, the more common issue is that the on-premises network's source IP is being translated or the VPC route table is missing a route for the specific subnet. Option A is a typical cause: if the on-premises CIDR is not exactly matched, the VPC may not route traffic back. Option C could cause issues if the VPN is not in the main route table. Option D would cause tunnel issues.

Answer

The VPC has a network ACL that denies inbound traffic from the on-premises CIDR.

Answer

The customer gateway device is using a different pre-shared key than configured in AWS.

Answer

The virtual private gateway is not attached to the correct VPC.

Question 10

A company has a VPC with multiple subnets across three Availability Zones. The VPC contains an Auto Scaling group of EC2 instances that process messages from an SQS queue. The instances are deployed in private subnets and need to access the SQS queue over the internet. The company wants to minimize data transfer costs and improve security by keeping traffic within the AWS network. The VPC has a NAT gateway in each AZ for outbound internet access. The network team has configured the route tables for the private subnets to send 0.0.0.0/0 traffic to the NAT gateway in the same AZ. However, the team notices that the EC2 instances are still using the NAT gateways to reach SQS, resulting in higher costs. What should the team do to ensure traffic to SQS stays within the AWS network?

Accepted Answer

Create a gateway VPC endpoint for SQS in the VPC and update the route tables for the private subnets to include a route for the SQS prefix list pointing to the endpoint.. Option B is correct because VPC Gateway Endpoints for SQS allow traffic to SQS to stay within the AWS network, avoiding NAT gateways and reducing costs. Option A is wrong because VPC Interface Endpoints are used for services that require private IPs, but SQS supports Gateway Endpoints. Option C is wrong because NACLs and security groups do not change the path; they only filter traffic. Option D is wrong because Direct Connect is for on-premises, not for VPC-to-SQS traffic.

Answer

Create an interface VPC endpoint for SQS in each private subnet.

Answer

Set up an AWS Direct Connect connection to route SQS traffic directly.

Answer

Modify the network ACLs and security groups to allow traffic to SQS without going through the NAT gateway.

Question 11

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that the latency to S3 increases significantly during peak hours. They have tested the connection and confirmed that the physical link is not saturated. The company uses a single Direct Connect connection. The S3 traffic is routed over the public VIF. The team wants to improve performance without adding a new Direct Connect connection. Which action should the team take to reduce latency?

Accepted Answer

Create an S3 Gateway Endpoint in the VPC and route S3 traffic through a private VIF attached to the VPC.. Using a Direct Connect gateway allows you to connect to multiple VPCs and also to AWS public services via a private VIF. However, for S3, you can use a private VIF with a VPC interface endpoint (Gateway Endpoint for S3) to keep traffic within the AWS network and avoid internet transit. This reduces latency because traffic goes from Direct Connect to the VPC and then to S3 via the gateway endpoint. Option B (adding VPN) adds IPSec overhead. Option C uses a different AWS region, which may increase latency. Option D (adding a second Direct Connect) is not allowed per the question.

Answer

Use an AWS Site-to-Site VPN connection over the Direct Connect to access S3 via private IP.

Answer

Add a second Direct Connect connection to load balance traffic.

Answer

Configure the Direct Connect public VIF to use a different AWS region closer to the on-premises location.

Question 12

A company has a VPC with public and private subnets. The public subnets have a NAT gateway for outbound internet access. The private subnets route all 0.0.0.0/0 traffic to the NAT gateway. The network team wants to centrally log all outbound internet traffic from the private subnets. They enable VPC Flow Logs and publish them to Amazon S3. However, they notice that the flow logs are capturing only traffic between instances within the VPC, not the NAT gateway traffic. What should the team do to capture outbound internet traffic?

Accepted Answer

Enable VPC Flow Logs specifically for the NAT gateway's elastic network interface.. VPC Flow Logs capture traffic at the network interface level. To capture traffic that goes through the NAT gateway, you need to enable flow logs on the NAT gateway's network interface. Option B is the correct approach. Option A is not necessary because NAT gateway traffic is not VPC-to-VPC. Option C would capture traffic but not specifically the outbound traffic. Option D is incorrect because the issue is not with VPC Flow Logs configuration but with the resource being monitored.

Answer

Enable VPC Flow Logs for all subnets in the VPC.

Answer

Use AWS CloudTrail to log NAT gateway traffic.

Answer

Enable VPC Flow Logs for the VPC and publish to CloudWatch Logs instead of S3.

Question 13

A company has a VPC with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via AWS Direct Connect. The network team needs to ensure that only specific VPCs can communicate with each other. They create a transit gateway route table for each VPC and attach the VPC to the route table. They also propagate routes from the Direct Connect virtual interface. However, after configuration, traffic between two VPCs that should not communicate is still flowing. What is the MOST likely cause?

Accepted Answer

The VPC attachments are using the default transit gateway route table instead of custom route tables.. If the transit gateway has a default route table that is shared, all attachments may be associated with it by default. If the team did not explicitly associate each VPC with its own route table, they might be using the default route table, which allows all routes. Option B is correct. Option A is not possible because route tables are not associated with attachments; attachments are associated with route tables. Option C would affect on-premises connectivity, not inter-VPC. Option D is the opposite of what is needed.

Answer

The VPC route tables have a route for the other VPC CIDR pointing to the transit gateway.

Answer

The transit gateway route tables are not associated with the VPC attachments.

Answer

The Direct Connect virtual interface is propagating routes into all route tables.

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a VPC, public and private subnets, security groups, and an Application Load Balancer. The network team wants to ensure that the ALB can only accept traffic from a specific set of IP addresses. They add a security group rule that allows inbound traffic on port 443 from the allowed IP CIDR. However, after deployment, the ALB is not responding to requests from the allowed IPs. The team checks the security group and confirms the rule exists. They also verify that the ALB is in the public subnet and has a public DNS name. What is the MOST likely cause?

Accepted Answer

The public subnet does not have a route to an internet gateway.. The ALB must be in a public subnet with an internet gateway route for 0.0.0.0/0 to be accessible from the internet. If the subnet route table does not have that route, traffic from the internet cannot reach the ALB. Option A is the most likely. Option B is false because security groups are stateful. Option C is irrelevant as ALB uses listeners. Option D is not needed for internet-facing ALB.

Answer

The security group rule is blocking return traffic; security groups are stateful.

Answer

The ALB listener is not configured to forward traffic to the target group.

Answer

The ALB is using an internal scheme instead of internet-facing.

Question 15

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). An EC2 instance in the private subnet needs to download patches from the internet. The team creates a NAT gateway in the public subnet and updates the private subnet route table to route 0.0.0.0/0 to the NAT gateway. The EC2 instance still cannot reach the internet. The team confirms the NAT gateway has an elastic IP and the public subnet has an internet gateway. What is the MOST likely cause?

Accepted Answer

The network ACL for the private subnet denies outbound traffic to the internet.. The security group or network ACL of the private subnet may be blocking outbound traffic. However, a common mistake is not disabling source/destination check on the NAT gateway. But NAT gateway is a managed service, so source/destination check is automatically disabled. Option A is correct: the private subnet's network ACL must allow outbound traffic and inbound return traffic. Option B is not needed because NAT gateway is managed. Option C is not a requirement. Option D would be for the NAT gateway's subnet.

Answer

The private subnet route table does not have a route for the NAT gateway's IP.

Answer

The public subnet does not have a route to the internet gateway.

Answer

The NAT gateway does not have source/destination check disabled.