ANS-C01 Network Management and Operations Practice Test 24 — 15 Questions

Question 1

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team notices that traffic from on-premises to an EC2 instance in the VPC is taking a suboptimal path through the internet instead of the Direct Connect. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises router does not have a specific route for the VPC CIDR via the Direct Connect.. If the on-premises router lacks a specific route for the VPC CIDR pointing to the Direct Connect virtual interface, traffic destined for the VPC will follow the default route out to the internet instead of the private VIF. The most likely cause is therefore a missing or incorrect static route (or BGP advertisement) on the customer side for the VPC CIDR via the DX connection. Adding the route restores the intended private path.

Answer

The VPC route table does not include a route to the Direct Connect gateway.

Answer

The Direct Connect virtual interface has BGP ASN prepending configured.

Answer

The VPC route table does not have a prefix list for the on-premises CIDR.

Question 2

A company is migrating from a legacy MPLS network to AWS using Direct Connect. The network team wants to ensure high availability with a backup connection. They have two Direct Connect connections from different providers, both terminating at the same AWS Direct Connect location. Which configuration provides the most resilient setup?

Accepted Answer

Use both connections with separate virtual interfaces, each terminating on different customer routers.. Using two separate Direct Connect connections with separate virtual interfaces, each terminating on different customer routers, provides high availability by eliminating single points of failure at both the physical and logical levels. Option A is wrong because using the same provider reduces diversity. Option C is wrong because using a single connection with two VIFs still has a single physical link. Option D is wrong because terminating on the same router creates a single point of failure.

Answer

Use both connections but from the same provider to simplify management.

Answer

Use one connection with two virtual interfaces for redundancy.

Answer

Use both connections with a single virtual interface on each, but terminate on the same router.

Question 3

A company has a Direct Connect connection and wants to use it for both private and public resources. Which TWO components are required to achieve this?

Accepted Answer

Public virtual interface (VIF). To use a single Direct Connect connection for both private and public AWS resources, you must provision two separate virtual interfaces on that connection. Option D, the public virtual interface (VIF), is required because it is the only VIF type that lets you reach AWS public services such as S3, DynamoDB, and other public endpoints over the Direct Connect link using public IP addresses. Option E, the private virtual interface (VIF), is required because it provides private connectivity to resources inside your VPC (for example, EC2 instances) using private IPv4 or IPv6 addresses and a VLAN. A Transit Gateway (A) is only needed when you want to centralize and scale connectivity across many VPCs or on-premises networks, not as a mandatory component for private plus public access over one Direct Connect. An Internet gateway (B) is for VPC internet access over the public AWS network, not for Direct Connect traffic, and a VPN connection to the VPC (C) is a separate IPsec-based path over the internet and is not required to use Direct Connect for private and public resources.

Answer

Transit Gateway

Answer

Internet gateway

Answer

VPN connection to the VPC

Question 4

A company is deploying a multi-tier application across two Availability Zones. The web tier must be highly available and scale based on traffic. The application load balancer (ALB) is internet-facing. Which TWO configurations are required to ensure the ALB can route traffic to the web instances across both AZs?

Accepted Answer

Register the ALB with subnets in at least two Availability Zones.. Option A is correct because an internet-facing ALB must be associated with at least two subnets in different Availability Zones to achieve high availability and to route traffic across both AZs; the ALB nodes are created in each of those subnets. Option C is correct because the ALB forwards requests to targets registered in a target group, so the target group must include the web instances from both Availability Zones for the load balancer to distribute traffic to them. Option B is not required because VPC route tables inherently allow traffic between subnets within the same VPC, including cross-AZ traffic, without special configuration. Option D is not required because a security group is not scoped per AZ; a single security group can allow traffic from the ALB to instances in both AZs. Option E is incorrect because placing the ALB in a single subnet does not provide cross-AZ routing or high availability, and an ALB requires subnets in at least two AZs.

Answer

Configure the VPC route tables to allow cross-AZ traffic.

Answer

Assign a security group that allows traffic from both AZs.

Answer

Place the ALB in a single subnet for simplicity and attach multiple ENIs.

Question 5

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

Accepted Answer

The connection was down for most of the day.. The CloudWatch ConnectionState metric for Direct Connect reports 1 when the connection is up and 0 when it is down. An average of 0.0 across most of the day therefore indicates the connection was in the down state for that period. This is a direct reading of the metric's binary semantics.

Answer

The connection was fluctuating between up and down.

Answer

The metric data is incomplete.

Answer

The connection was up and stable.

Question 6

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

Accepted Answer

AWS X-Ray. Correct answer: C. AWS X-Ray provides end-to-end tracing and can capture network latency between services, including EC2 instances. It can help identify where delays occur. Option A (AWS Config) is incorrect because it monitors configuration changes, not performance. Option B (AWS CloudTrail) is incorrect because it records API calls for auditing, not network metrics. Option D (VPC Flow Logs) is incorrect because it captures IP traffic metadata (packet-level) but does not provide latency or performance metrics.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 7

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic from a specific VPC to an on-premises network is being dropped. All other VPCs can reach the on-premises network. Which configuration should be checked first?

Accepted Answer

Check the Transit Gateway route tables. When traffic from a specific VPC to on-premises is dropped while other VPCs can reach on-premises, the most likely cause is a misconfiguration in the Transit Gateway route tables. Transit Gateway route tables control which VPCs can route to which attachments (e.g., VPN, Direct Connect). The issue is isolated to one VPC, so checking the TGW route table for that VPC's attachment is the first step. Other options like on-premises firewall, security groups, or NACLs could be factors but are less likely given the specific VPC isolation.

Answer

Check the on-premises firewall rules

Answer

Check the VPC's security groups

Answer

Check the VPC's network ACLs

Question 8

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

Accepted Answer

Amazon CloudWatch and Amazon CloudWatch Alarms. Amazon CloudWatch collects metrics from Direct Connect, including latency, and CloudWatch Alarms can trigger notifications via SNS when thresholds are exceeded. Option A is incorrect because CloudTrail logs API calls, not performance metrics. Option B is incorrect because Trusted Advisor provides best practice checks, not real-time latency monitoring, and SES is for email sending, not alerting. Option D is incorrect because VPC Flow Logs capture IP traffic metadata, not latency metrics, and CloudWatch Logs store log data, not metrics.

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Trusted Advisor and Amazon SES

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Question 9

A network engineer is troubleshooting an issue where an EC2 instance in a public subnet cannot reach the internet. The instance has a public IP, and the route table has a default route to an internet gateway. What is the most likely cause?

Accepted Answer

The network ACL is blocking outbound traffic. A network ACL is stateless, so outbound traffic must be explicitly allowed by an outbound rule, and return traffic must be allowed by an inbound rule. If the NACL's outbound rules block ephemeral ports or HTTP/HTTPS, the instance cannot reach the internet even though the route table and IGW are correct. This is the most likely cause given the other components are verified.

Answer

The internet gateway is not attached to the VPC

Answer

The security group does not allow outbound HTTP traffic

Answer

The instance does not have a public IP

Question 10

A company has a VPC with public and private subnets. The security team wants to analyze all traffic to and from the internet for security incidents. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, action) for ENIs, subnets, or VPCs, and can be published to CloudWatch Logs, S3, or Kinesis Data Firehose for analysis. This is the native AWS mechanism for capturing and analyzing traffic to and from the internet at the VPC level. It is the correct answer because the question asks for traffic capture and analysis, not inline filtering or threat detection.

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Answer

AWS WAF

Question 11

A network administrator is setting up VPC Flow Logs to monitor traffic to an Amazon RDS instance. The logs are sent to Amazon S3. After enabling Flow Logs, the administrator notices that no logs are being delivered. What is the most likely cause?

Accepted Answer

The IAM role for Flow Logs does not have permissions to write to S3. VPC Flow Logs require an IAM role that grants permissions to write logs to the destination (S3, CloudWatch Logs, or Kinesis Data Firehose). If the role lacks s3:PutObject and related permissions, logs will not be delivered. The other options are less likely because Flow Logs can be enabled on any VPC, RDS instances in private subnets still generate flow logs, and S3 buckets in different regions can still receive logs if permissions are correct.

Answer

The VPC Flow Logs are not enabled for the correct VPC

Answer

The RDS instance is in a private subnet

Answer

The S3 bucket is in a different region

Question 12

A company has a VPC with a NAT gateway in a public subnet. The security team wants to log all outbound traffic from private subnets to the internet. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, bytes, action) for network interfaces in a VPC, including traffic traversing a NAT gateway from private subnets to the internet. They can be published to CloudWatch Logs or S3 and are the correct tool for logging outbound traffic flows. This directly satisfies the requirement to log all outbound traffic from private subnets.

Answer

AWS CloudTrail

Answer

Amazon S3 Access Logs

Answer

AWS Config

Question 13

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The connection is up, but the network team cannot reach resources in a VPC. The virtual interface is in the 'available' state, and BGP session is established. What should the team check next?

Accepted Answer

Check the VPC route tables for propagated routes. Since the Direct Connect physical link is up, the virtual interface is available, and the BGP session is established, the issue lies in the routing of traffic within AWS. The most likely cause is that the VPC route tables do not contain the necessary routes (either static or propagated from the Direct Connect virtual private gateway) to direct traffic back to the on-premises network. Checking the VPC route tables for propagated routes is the correct next step to ensure the on-premises CIDR is being advertised and accepted.

Answer

Check the on-premises firewall rules

Answer

Check the BGP authentication

Answer

Check the Direct Connect physical link status

Question 14

A company has a VPC with a VPN connection to an on-premises network. The network team reports that the VPN tunnel is flapping intermittently. You need to identify the cause. Which AWS service provides logs that can help troubleshoot the VPN tunnel status?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct answer because AWS Site-to-Site VPN automatically publishes tunnel status metrics to CloudWatch, including TunnelState (which indicates whether each tunnel is UP or DOWN) and TunnelDataIn/TunnelDataOut. These metrics allow you to monitor the VPN connection's health and set alarms for flapping tunnels. CloudWatch Logs can also capture detailed VPN tunnel logs if logging is enabled on the VPN connection, providing granular troubleshooting data.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Health Dashboard

Question 15

A company has a VPC with multiple subnets and an internet gateway. The security team wants to detect and block malicious traffic patterns. Which AWS service should be used to provide intrusion detection and prevention?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed, stateful network firewall and intrusion detection/prevention service that can inspect traffic at the VPC level. It supports Suricata-compatible rules for deep packet inspection, allowing you to detect and block malicious patterns. It is the only AWS-native service in the list that provides true IDS/IPS capabilities.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF