ANS-C01 Network Management and Operations Practice Test 26 — 15 Questions

Question 1

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has set up a NAT gateway in the public subnet. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The private subnet route table does not have a route to the NAT gateway. Instances in a private subnet require a route to the NAT gateway to reach the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway as its target. Without this route, traffic from private instances sent to the internet will not be directed to the NAT gateway, and will instead remain in the VPC or be dropped. Option A is incorrect because the NAT gateway itself resides in a public subnet and uses the internet gateway via that subnet's route table; it does not require its own route to the IGW. Option B is incorrect because security groups by default allow all outbound traffic, so this is unlikely to be the issue. Option C is incorrect because not having an Elastic IP would prevent the NAT gateway from having a public IP, but the question states a NAT gateway is set up, implying it has an Elastic IP; the more fundamental issue is the missing route.

Answer

The NAT gateway does not have a route to the internet gateway

Answer

The security group for the instances blocks outbound traffic

Answer

The NAT gateway is not associated with an Elastic IP

Question 2

A network engineer is monitoring network performance and needs to collect and analyze network metrics from multiple AWS services in a centralized dashboard. Which AWS service should be used to aggregate and visualize these metrics?

Accepted Answer

Amazon CloudWatch Dashboards. Amazon CloudWatch Dashboards is the correct service because it aggregates metrics from multiple AWS services (EC2, RDS, Lambda, ELB, etc.) into a single customizable, visual dashboard with graphs, alarms, and cross-account/cross-region views. It is purpose-built for centralized metric visualization and operational monitoring.

Answer

AWS VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 3

A company has multiple AWS accounts and wants to centrally manage network resources using AWS Transit Gateway. Which feature allows sharing the Transit Gateway across accounts?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) is the service that lets you share AWS resources, including Transit Gateway, with other accounts or within an AWS Organization. Once shared via RAM, the recipient accounts can attach their VPCs to the Transit Gateway without needing to own it. This is the standard mechanism for cross-account TGW sharing.

Answer

VPC peering

Answer

AWS Organizations

Answer

AWS Service Catalog

Question 4

A network engineer needs to troubleshoot high latency between two EC2 instances in the same VPC but in different Availability Zones. Which tool should be used to measure network performance?

Accepted Answer

Use iperf to measure throughput and latency. iperf is a network performance measurement tool that actively generates TCP or UDP traffic to measure throughput, latency, jitter, and packet loss between two endpoints. For troubleshooting high latency between EC2 instances in different AZs, iperf provides quantitative bandwidth and latency measurements that ping and traceroute cannot. It is the correct tool for performance benchmarking.

Answer

Use traceroute to identify the path

Answer

Use ping to test connectivity

Answer

Use netstat to check network statistics

Question 5

A company uses AWS Direct Connect with multiple virtual interfaces (VIFs) to connect to multiple VPCs. The network team wants to ensure high availability and failover. Which configuration provides the best resiliency?

Accepted Answer

Provision two Direct Connect connections from different providers and configure BGP. The most resilient Direct Connect design requires physically diverse connections from different providers so that a single provider outage, fiber cut, or location failure cannot take down both links. Configuring BGP on both connections enables automatic failover and dynamic path selection between the two diverse paths. AWS explicitly recommends this multi-provider, multi-location design for maximum Direct Connect resiliency.

Answer

Use a single Direct Connect connection with a VPN backup over the internet

Answer

Configure BGP with multiple AS paths on the same Direct Connect connection

Answer

Create multiple private VIFs on a single Direct Connect connection

Question 6

A network engineer is troubleshooting a VPN connection that is not passing traffic. The tunnel status shows as 'UP'. Which THREE steps should the engineer take to diagnose the issue?

Accepted Answer

Ensure that the security groups for instances allow inbound traffic from the on-premises network. Option A is correct because even when a VPN tunnel is UP, security groups on the instances act as stateful firewalls and must explicitly permit inbound traffic sourced from the on-premises CIDR range, otherwise packets are silently dropped. Option B is correct because the tunnel being UP only proves IKE/IPsec Phase 1 and Phase 2 succeeded; if the on-premises router is not advertising the correct prefixes via BGP (or the BGP session is down), the VPC will have no learned routes and traffic cannot return. Option D is correct because the VPC route table must contain a route pointing the on-premises CIDR to the virtual private gateway; without it, instances have no path to send traffic into the VPN. Option C is not the best step here since IKE/IPsec mismatches would typically prevent the tunnel from reaching UP status, and the scenario states the tunnel is already UP. Option E is incorrect because an internet gateway route table is irrelevant to VPN traffic, which traverses the virtual private gateway, not the IGW.

Answer

Check the IKE and IPSEC settings on the customer gateway

Answer

Check the internet gateway route table for the VPC

Question 7

A company has a VPC with a public subnet and a private subnet. The private subnet instances need to make outbound internet requests. A NAT Gateway is deployed in the public subnet. The network engineer notices that instances in the private subnet cannot reach the internet, but the NAT Gateway's Elastic IP is reachable from the internet. Which of the following is the most likely cause?

Accepted Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway.. The most likely cause is that the private subnet's route table lacks a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, instances in the private subnet have no path to the internet, even though the NAT Gateway itself is reachable from the internet via its Elastic IP. This is a common misconfiguration.

Answer

The network ACL on the private subnet blocks outbound traffic.

Answer

The NAT Gateway is not associated with an Elastic IP.

Answer

The security group attached to the NAT Gateway blocks outbound traffic.

Question 8

A network engineer is designing a highly available VPN connection between an on-premises network and AWS. The on-premises network has two internet connections from different ISPs. Which AWS VPN configuration should be used to provide the highest availability?

Accepted Answer

Create two customer gateways, each with a VPN tunnel to the virtual private gateway.. For highest availability, AWS recommends using two customer gateways (CGWs), each representing a separate on-premises device or internet connection, and establishing a VPN connection from each CGW to the same virtual private gateway (VGW). This creates two independent VPN tunnels (four IPsec tunnels total, two per connection), each terminating on a different on-premises ISP link, so a failure of one ISP or device does not take down the hybrid connection. This design aligns with the AWS Well-Architected reliability pillar for hybrid networking.

Answer

Create a single VPN tunnel from one customer gateway to the virtual private gateway.

Answer

Create one customer gateway with two VPN tunnels, each using different internet connections.

Answer

Use AWS Direct Connect instead of VPN for higher availability.

Question 9

A network engineer is troubleshooting network connectivity issues in a VPC. The engineer suspects that the network ACL is blocking traffic. Which TWO actions should the engineer take to verify this?

Accepted Answer

Review the inbound and outbound rules of the network ACL.. Option A is correct because a network ACL is stateless and applies separate inbound and outbound rule sets at the subnet level, so the engineer must review both the inbound and outbound rules to confirm whether the ACL is denying the traffic in either direction. Option D is correct because VPC Flow Logs capture IP traffic metadata for network interfaces and can be filtered on the 'ACCEPT' or 'REJECT' status, which directly shows whether traffic is being rejected by a network ACL or security group. Option B is not the right verification action here because security group rules are stateful and evaluated at the instance level, not the subnet-level ACL the engineer suspects. Option C is incorrect because AWS CloudTrail records API activity and management events, not network packet traffic. Option E is incorrect because AWS Direct Connect is a dedicated network connection service and is not a troubleshooting tool for VPC ACL traffic.

Answer

Check the security group rules for the affected instances.

Answer

Use AWS CloudTrail to view network traffic logs.

Answer

Test connectivity using AWS Direct Connect.

Question 10

A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB). The application is experiencing intermittent timeouts. CloudWatch metrics show that the ALB's RequestCount is within normal limits, but TargetResponseTime occasionally spikes to 10 seconds. What is the most likely cause?

Accepted Answer

The EC2 instances are experiencing high CPU utilization during peak periods.. TargetResponseTime spikes to 10 seconds while RequestCount is normal point to the backend targets being slow, not the ALB itself. High CPU utilization on the EC2 instances during peak periods is the classic cause of increased processing time and intermittent timeouts.

Answer

The ALB is configured with an incorrect idle timeout value.

Answer

The ALB's cross-zone load balancing is disabled.

Answer

The security group for the EC2 instances is blocking traffic from the ALB.

Question 11

A network engineer is troubleshooting a VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA. The tunnel status shows 'UP' but no traffic passes. The engineer checks the route tables and finds the correct static routes on both sides. What should the engineer check next?

Accepted Answer

Review the IPsec phase 2 settings, including the traffic selectors.. When an IPsec tunnel shows 'UP' but no traffic passes and routing is correct, the issue is typically in Phase 2 (IPsec) parameters, particularly the traffic selectors (proxy IDs). Phase 2 negotiates the security association for specific source/destination subnets; if the traffic selectors on the AWS VPN and the Cisco ASA do not match, the tunnel establishes but drops traffic. Reviewing Phase 2 settings is the logical next step.

Answer

Check the IKE phase 1 parameters (e.g., encryption, hash).

Answer

Verify that the pre-shared keys match.

Answer

Confirm that the VPC route table has a route to the on-premises subnet.

Question 12

A network engineer is monitoring a hybrid network with a VPN connection to AWS. The engineer notices periodic packet loss and high latency during peak hours. The VPN tunnel uses static routing. The on-premises bandwidth is 100 Mbps, and the VPN connection is limited to 1.25 Gbps. What is the most likely cause?

Accepted Answer

The on-premises internet connection is saturated.. The VPN connection supports up to 1.25 Gbps, but the on-premises internet connection is only 100 Mbps. During peak hours, the 100 Mbps link saturates, causing packet loss and high latency. The VPN tunnel itself is not the bottleneck; the underlying internet connection is.

Answer

The VPC route table has a blackhole route for the on-premises CIDR.

Answer

The VPN tunnel is using the incorrect encryption algorithm.

Answer

The VPN tunnel is exceeding its maximum bandwidth limit.

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The on-premises network can reach some VPCs but not others. All VPCs are attached to the same Transit Gateway. What should the engineer check first?

Accepted Answer

The Transit Gateway route tables and associations.. With AWS Transit Gateway, reachability between attachments is controlled by Transit Gateway route tables and their associations and propagations. If some VPCs are reachable and others are not, the most likely cause is that the unreachable VPCs are associated with a different TGW route table or their routes are not propagated into the route table used by the on-premises attachment.

Answer

The VPC flow logs for the unreachable VPCs.

Answer

The Direct Connect virtual interface status.

Answer

The BGP session between the on-premises router and the Direct Connect router.

Question 14

A company uses a VPC with multiple subnets in different Availability Zones. The VPC has a NAT Gateway in a public subnet of us-east-1a, and a second NAT Gateway in us-east-1b for high availability. Each private subnet in us-east-1a routes 0.0.0.0/0 to the NAT Gateway in us-east-1a, and private subnets in us-east-1b route to the NAT Gateway in us-east-1b. The company's EC2 instances in private subnets need to access an external service using IPv6. The VPC is not configured for IPv6. The network engineer needs to enable IPv6 connectivity for these instances. Which solution is the most cost-effective and scalable?

Accepted Answer

Add an IPv6 CIDR block to the VPC, assign IPv6 addresses to private subnets, and add a route for ::/0 to an egress-only internet gateway.. The most cost-effective and scalable solution is to add an IPv6 CIDR block to the VPC, assign IPv6 addresses to the private subnets, and route ::/0 to an egress-only internet gateway. This allows instances in private subnets to initiate outbound IPv6 traffic to the internet while preventing inbound IPv6 connections, which is ideal for private instances needing to access external services. It is cost-effective because egress-only internet gateways are free (you only pay for data transfer) and scalable as they automatically scale with your traffic.

Answer

Add an IPv6 CIDR block to the VPC and configure a NAT64 gateway to translate IPv6 to IPv4.

Answer

Attach an internet gateway to the VPC and add a route for ::/0 to the internet gateway in the private subnets.

Answer

Add an IPv6 CIDR block to the VPC and use the existing NAT Gateways with IPv6.

Question 15

A company has a VPC with a public subnet hosting a web server. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the public subnet allows inbound HTTP from 0.0.0.0/0. Users report that they cannot access the website. The engineer verifies that the web server is running and has a public IP. What is the most likely issue?

Accepted Answer

The network ACL outbound rule is blocking return traffic.. Network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules. If the NACL's outbound rules do not allow the return traffic from the web server to the client (e.g., ephemeral ports), the response packets will be blocked, and users cannot access the website. The security group, being stateful, automatically allows return traffic, so the NACL is the most likely culprit.

Answer

The web server is listening on a different port.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group outbound rule is blocking return traffic.