ANS-C01 Network Management and Operations Practice Test 25 — 15 Questions

Question 1

A company has a large AWS environment with hundreds of VPCs connected via Transit Gateway. They want to centrally manage network traffic flow and enforce security policies. Which service should they use to create a central network inspection architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides managed firewall services that can be centrally deployed in a dedicated VPC and route traffic through it for inspection.

Answer

AWS WAF

Answer

Security groups

Answer

AWS Shield Advanced

Question 2

A company wants to monitor network traffic between VPCs in the same AWS Region that are connected via VPC Peering. Which AWS service can provide visibility into the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, packets, action) for traffic flowing through VPCs, subnets, or ENIs, including traffic between peered VPCs in the same Region. This makes it the correct service for gaining visibility into VPC Peering traffic. Flow logs can be published to CloudWatch Logs or S3 and queried with Athena for analysis.

Answer

AWS Config

Answer

AWS Direct Connect

Answer

AWS CloudTrail

Question 3

A network engineer is troubleshooting a VPN connectivity issue. The VPN tunnel is up, but traffic is not passing. Which TWO AWS services should the engineer use to diagnose the problem?

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) is correct because it captures IP traffic metadata for ENIs, subnets, and VPCs, letting the engineer verify whether packets are actually traversing the VPN tunnel and whether they are being ACCEPTed or REJECTed by security groups or NACLs. Amazon CloudWatch (E) is correct because it provides VPN tunnel metrics such as TunnelState, TunnelDataIn, and TunnelDataOut, which reveal whether traffic is flowing through the tunnel even when the tunnel state shows UP. AWS Config (A) only records resource configuration changes and compliance, not live packet flow, so it cannot diagnose why traffic is dropped. AWS CloudTrail (C) logs API activity and management events, not data-plane traffic through a VPN. AWS Direct Connect (D) is a dedicated network connection service, not a diagnostic tool, and is unrelated to troubleshooting an existing VPN tunnel.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Direct Connect

Question 4

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect but cannot access any resources. The VPN is configured with a security group that allows all traffic. What should the administrator check?

Accepted Answer

The client VPN authorization rules. The administrator should check the client VPN authorization rules. AWS Client VPN uses authorization rules to grant access to network resources; even if the security group allows all traffic, without an authorization rule allowing the user's group access to the VPC CIDR, users cannot reach resources. This is a common misconfiguration.

Answer

The client VPN security group inbound rules

Answer

The client VPN endpoint certificate

Answer

The client VPN route table

Question 5

A company has multiple VPCs connected via VPC peering. They want to simplify network management and reduce the number of peering connections. Which AWS service should they use?

Accepted Answer

AWS Transit Gateway. Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks, reducing the need for full mesh peering.

Answer

AWS PrivateLink

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect Gateway

Question 6

Refer to the exhibit. A network engineer is creating an IAM policy to allow a user to manage VPC Peering connections. The user reports that they cannot delete a VPC Peering connection. What should the engineer add to the policy?

Accepted Answer

ec2:DeleteVpcPeeringConnection. The IAM policy must include the ec2:DeleteVpcPeeringConnection action to allow deletion of a VPC peering connection. Without this specific action, the user's API call to delete the peering connection is denied, even if they have other peering-related permissions. Adding this action to the policy grants the necessary authorization.

Answer

ec2:DescribeVpcPeeringConnectionRouteTables

Answer

ec2:ModifyVpcPeeringConnectionOptions

Answer

ec2:RejectVpcPeeringConnection

Question 7

A network engineer is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. The VPCs are in the same region. After accepting the peering request, instances in VPC-A cannot communicate with instances in VPC-B. What should the engineer check first?

Accepted Answer

The route tables in both VPCs have routes to the peer VPC CIDR.. VPC peering requires explicit route table entries in both VPCs pointing the peer CIDR to the peering connection (pcx-xxxx). Even after the peering connection is accepted and shows 'active', no traffic flows until each VPC's route table has a route for the other VPC's CIDR targeting the peering connection. This is the most common first misconfiguration and should be checked before deeper troubleshooting.

Answer

The security groups in both VPCs allow traffic from the peer VPC CIDR.

Answer

The network ACLs in both VPCs allow traffic from the peer VPC CIDR.

Answer

The VPC peering connection status is 'active'.

Question 8

A network engineer is setting up an AWS Site-to-Site VPN connection. The customer gateway device is behind a NAT device that performs PAT. The VPN tunnel fails to come up. What is the most likely cause?

Accepted Answer

The NAT device is not forwarding UDP 500 and UDP 4500 traffic.. IPsec requires UDP ports 500 and 4500, which must be forwarded through the NAT device. Option A is incorrect because tunnel options such as DPD and encryption algorithms do not need to match exactly for the tunnel to come up. Option B is incorrect because disabling DPD does not prevent tunnel establishment; it only affects detection of peer failure. Option C is incorrect because route propagation does not affect the establishment of the VPN tunnel itself; it affects routing of traffic once the tunnel is up.

Answer

The tunnel options (DPD, encryption algorithms) must match exactly.

Answer

Dead peer detection (DPD) is disabled.

Answer

The VPN connection does not have route propagation enabled.

Question 9

A company has a VPC with an AWS Site-to-Site VPN connection to their on-premises network. The VPN uses dynamic routing with BGP. The on-premises network is advertising a specific route to the VPC. However, instances in the VPC cannot reach the on-premises network. The VPN tunnels are up and BGP sessions are established. What should the engineer check?

Accepted Answer

Route propagation is enabled on the VPC route tables.. With dynamic routing over an AWS Site-to-Site VPN, BGP-learned routes are not automatically installed into VPC route tables. Route propagation must be explicitly enabled on each route table that needs to reach the on-premises network via the virtual private gateway (VGW). Even though the tunnels are up and BGP sessions are established, without route propagation enabled, the VPC route tables have no entry pointing the on-premises CIDR to the VGW, so instances cannot reach on-premises hosts.

Answer

The tunnel options include the correct encryption algorithms.

Answer

The on-premises router is advertising the route with the correct ASN.

Answer

The VPN connection's static routes are configured for the on-premises CIDR.

Question 10

Which THREE are best practices for managing network security in a multi-VPC AWS environment using AWS Transit Gateway?

Accepted Answer

Use separate Transit Gateway route tables for different environments (e.g., production, development).. Option A is correct because separate Transit Gateway route tables provide segmentation and isolation between environments such as production and development, preventing unintended cross-environment routing and enforcing least-privilege connectivity. Option B is correct because centralizing internet egress through a shared VPC with a NAT gateway or proxy enables consistent inspection, logging, and control of outbound traffic while reducing the number of internet-facing entry points. Option D is correct because enabling VPC Flow Logs on all VPCs and centralizing them in a security account supports centralized monitoring, auditing, and incident response across the multi-VPC environment. Option C is not recommended because attaching all VPCs to a single Transit Gateway route table removes segmentation and increases blast radius. Option E is not a best practice for inter-VPC filtering because network ACLs are stateless and subnet-level, whereas security groups and Transit Gateway route table segmentation provide more precise, stateful control for VPC-to-VPC traffic.

Answer

Attach all VPCs to a single Transit Gateway route table for simplicity.

Answer

Use network ACLs on every subnet to filter traffic between VPCs.

Question 11

A network engineer is troubleshooting intermittent connectivity issues between two VPCs connected via a VPC peering connection. The engineer notices that the route tables in both VPCs have the correct routes. What should the engineer check next?

Accepted Answer

Check security group and network ACL rules. When VPC peering routes are correctly configured in both route tables but connectivity is intermittent, the next logical check is security group and network ACL rules. Security groups are stateful and control instance-level traffic, while network ACLs are stateless and control subnet-level traffic — either can silently drop packets even when routing is correct. Intermittent issues often point to NACL ephemeral port ranges or security group rules that do not account for return traffic.

Answer

Verify that DNS resolution is enabled for the VPCs

Answer

Ensure that the VPN connection is active

Answer

Check the internet gateway configuration

Question 12

A company has set up a Direct Connect connection with a private VIF to its VPC. The BGP session is up, but traffic is not passing between the on-premises network and the VPC. Which configuration should be verified?

Accepted Answer

Check the BGP advertised routes and the VPC route tables. For traffic to flow between on-premises and the VPC over a Direct Connect private VIF, the on-premises network must advertise the appropriate routes via BGP, and the VPC route tables must have routes pointing to the virtual private gateway (VGW). Option A is wrong because jumbo frames are not required for basic connectivity. Option B is wrong because the VIF type (private vs public) is not the issue—the BGP session is already up, indicating the VIF is correctly configured as private. Option C is wrong because CloudWatch metrics are for monitoring performance, not for diagnosing routing issues.

Answer

Ensure jumbo frames are enabled on the Direct Connect interface

Answer

Verify that the VIF is a public VIF

Answer

Review the Direct Connect virtual interface metrics in CloudWatch

Question 13

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a web application that needs to access an external API over the internet. The private subnet uses a NAT Gateway in the public subnet for outbound internet access. The web application is failing to reach the external API. The engineer has verified the following: the NAT Gateway has an Elastic IP attached, the route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway, the security group for the web application allows outbound HTTPS (TCP 443) to 0.0.0.0/0, the network ACL for the private subnet allows inbound and outbound TCP ephemeral ports (1024-65535) from and to 0.0.0.0/0, and the IAM role attached to the EC2 instance allows outbound HTTPS. The engineer also confirmed that the NAT Gateway is in the public subnet which has a route to an Internet Gateway. Despite all these checks, the web application still cannot reach the external API. What should the engineer do next?

Accepted Answer

Verify that the route table is correctly associated with the private subnet.. The most likely remaining cause is that the route table containing the 0.0.0.0/0 → NAT Gateway route is not actually associated with the private subnet. A route table can exist with the correct routes but if it is not associated with the subnet, the subnet uses the main route table instead, which typically lacks the NAT route. All other listed checks (NAT GW EIP, SG outbound, NACL ephemeral ports, IAM role) are already verified, so subnet-to-route-table association is the logical next diagnostic step.

Answer

Add an inbound rule to the security group for the external API's IP address.

Answer

Move the NAT Gateway to the private subnet.

Answer

Add a specific route for the external API's IP address to the route table.

Question 14

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. After a network change, some VPCs cannot reach the on-premises network. The Transit Gateway route table shows the correct association and propagation. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route pointing to the Transit Gateway. For a VPC to send traffic to the Transit Gateway, the VPC subnet route table must contain a route whose target is the TGW attachment (e.g., 0.0.0.0/0 or the on-premises CIDR → tgw-xxxx). Even if the TGW route table has correct associations and propagations, the packet is dropped at the VPC because no route points to the TGW. This is the most common cause of 'TGW looks correct but traffic fails' scenarios.

Answer

The Transit Gateway attachment is in a failed state

Answer

The VPN connection to the on-premises network has insufficient bandwidth

Answer

The BGP session between the Transit Gateway and on-premises router is down

Question 15

A network engineer needs to monitor the network traffic between EC2 instances in a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including source/destination IP, ports, protocol, and packet/byte counts. This is the appropriate service for monitoring network traffic between EC2 instances.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs