ANS-C01 Network Management and Operations Practice Test 27 — 15 Questions

Question 1

A company is using AWS Client VPN for remote access. Users can authenticate and establish a VPN connection, but they cannot access resources in the VPC. The Client VPN endpoint is associated with a subnet in the VPC. The security group for the Client VPN endpoint allows all traffic. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

There is no authorization rule to allow access to the VPC CIDR.. AWS Client VPN requires authorization rules to permit access to the VPC CIDR. Without an authorization rule, even if authentication and connection succeed, the client cannot access VPC resources. The security group allowing all traffic is irrelevant because the authorization rule is a separate access control layer. Therefore, the missing authorization rule is the most likely cause.

Answer

The Client VPN endpoint is not associated with the correct subnet.

Answer

The route table for the subnet does not have a route to the Client VPN endpoint.

Answer

The Client VPN endpoint's server certificate is expired.

Question 2

A company has a global application deployed across multiple AWS Regions. The application uses Amazon Route 53 latency-based routing. The network team wants to monitor the health of the application endpoints. They configure Route 53 health checks with fast interval (10 seconds) for each endpoint. After a few days, they notice an increase in costs. Which change will reduce costs while maintaining adequate health monitoring?

Accepted Answer

Change the health check interval to standard (30 seconds).. Route 53 health checks with fast interval (10 seconds) cost more than standard interval (30 seconds). Changing to standard interval reduces cost while still providing adequate monitoring for most applications. Standard interval is the default and is sufficient unless sub-30-second failover is required.

Answer

Disable health checks and rely on Route 53 latency measurements.

Answer

Use CloudWatch alarms instead of Route 53 health checks.

Answer

Remove health checks for endpoints that are in the same Region.

Question 3

A company has a VPC with a Transit Gateway (TGW) connected to multiple VPCs and an on-premises network via Direct Connect. The network team wants to implement centralized inspection of all traffic between VPCs and between VPCs and on-premises. Which architecture should they use?

Accepted Answer

Create a Gateway Load Balancer (GWLB) in a dedicated inspection VPC and attach it to the Transit Gateway.. Centralized inspection of traffic between VPCs and between VPCs and on-premises through a Transit Gateway requires a Gateway Load Balancer (GWLB) deployed in a dedicated inspection VPC, with the GWLB endpoint attached to the TGW. This allows all traffic routed through the TGW to be redirected to third-party firewall appliances (or AWS Network Firewall) for inspection before reaching its destination, using GENEVE encapsulation on port 6081. This is the AWS-recommended hub-and-spoke inspection architecture.

Answer

Attach a Direct Connect Gateway to the Transit Gateway and configure route propagation.

Answer

Use AWS Network Firewall in each VPC.

Answer

Deploy a third-party firewall in each VPC and use VPC peering.

Question 4

A company is using AWS CloudWatch to monitor network metrics. They want to create a dashboard that shows the total number of bytes sent and received by all EC2 instances in a specific VPC. Which two metrics should they use? (Choose TWO.)

Accepted Answer

NetworkOut. Option C (NetworkOut) is correct because it is the CloudWatch EC2 metric that reports the number of bytes sent out by an instance, which directly represents bytes transmitted for the instances in the VPC. Option E (NetworkIn) is correct because it is the CloudWatch EC2 metric that reports the number of bytes received by an instance, matching the 'bytes received' requirement. Together, NetworkIn and NetworkOut give the total bytes received and sent across the EC2 instances. Option A (TotalNetworkBytes) is not a valid EC2 CloudWatch metric, so it cannot be used. Options B (NetworkPacketsOut) and D (NetworkPacketsIn) measure packet counts, not bytes, so they do not satisfy the byte-based requirement.

Answer

TotalNetworkBytes

Answer

NetworkPacketsOut

Answer

NetworkPacketsIn

Question 5

A company is using AWS Direct Connect with a private VIF to connect its on-premises data center to a VPC. The network team wants to monitor the link health and receive alarms if the connection goes down. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch with Direct Connect metrics.. Amazon CloudWatch provides metrics for Direct Connect connections, such as connection state and BGP status, and can trigger alarms. Option B is wrong because Amazon Inspector is for security assessments, not link health monitoring. Option C is wrong because AWS Config tracks configuration changes, not operational status. Option D is wrong because VPC Flow Logs capture IP traffic logs, not link health.

Answer

Amazon Inspector.

Answer

AWS Config.

Answer

VPC Flow Logs.

Question 6

A company has a multi-account AWS environment using AWS Transit Gateway with a centralized network account. The network team wants to ensure that only specific VPCs can communicate with each other. What is the best practice to achieve this?

Accepted Answer

Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.. The best practice for segmenting communication between VPCs attached to a centralized Transit Gateway is to create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table. This allows the network team to control which VPCs can reach which others by controlling route propagation and association, without relying on per-VPC security groups or point-to-point peering.

Answer

Configure security groups in each VPC to allow traffic only from specific VPC CIDRs.

Answer

Use VPC peering connections between the VPCs that need to communicate.

Answer

Use AWS Network Manager to create routing policies.

Question 7

A company has a multi-VPC architecture using AWS Transit Gateway (TGW). They have a central inspection VPC with a Gateway Load Balancer (GWLB) and third-party firewall appliances. All other VPCs are attached to the TGW and have route tables that send traffic to the inspection VPC for inspection. Recently, the network team deployed a new VPC (VPC-D) and attached it to the TGW. They configured the VPC-D route table to send all inter-VPC traffic to the TGW. However, traffic from VPC-D to other VPCs is not being inspected. The team confirmed that the firewall appliances are healthy and the GWLB is correctly configured. Which action should the network team take to ensure traffic from VPC-D is inspected?

Accepted Answer

Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.. The issue is that VPC-D's TGW attachment is not associated with the correct TGW route table that routes traffic to the inspection VPC. In a Transit Gateway, route tables control how traffic is forwarded between attachments. Even if VPC-D's subnet route tables point to the TGW, the TGW must have a route table that directs traffic from VPC-D to the inspection VPC's attachment. Therefore, associating VPC-D's attachment with the correct TGW route table ensures inspection.

Answer

Enable route propagation on VPC-D's TGW attachment.

Answer

Add a route in VPC-D's subnet route tables pointing to the TGW for all traffic.

Answer

Create a new TGW route table and associate all VPC attachments to it.

Question 8

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Answer

AWS Config.

Answer

AWS CloudTrail.

Answer

AWS X-Ray.

Question 9

A company has a VPC with multiple EC2 instances that need to access an Amazon S3 bucket. The network team wants to ensure that traffic to S3 stays within the AWS network and does not traverse the internet. The VPC has a VPC endpoint for S3 (Gateway type). The team has created the endpoint and attached the appropriate policy allowing access to the specific S3 bucket. However, EC2 instances in a private subnet cannot access the S3 bucket. The private subnet route table has a default route pointing to a NAT Gateway. Which change should the network team make to allow private instances to access S3 via the endpoint?

Accepted Answer

Add a route in the private subnet route table for the S3 prefix list (com.amazonaws.region.s3) pointing to the VPC endpoint.. For a Gateway VPC endpoint to work, the route table associated with the subnet must include a route for the S3 prefix list (e.g., com.amazonaws.region.s3) pointing to the endpoint ID. The existing default route to the NAT Gateway would otherwise route S3 traffic to the internet, bypassing the endpoint. Adding the specific route for the S3 prefix list ensures that traffic destined for S3 uses the VPC endpoint and stays within the AWS network. Therefore, option D is correct.

Answer

Modify the VPC endpoint policy to allow all principals.

Answer

Change the private subnet route table's default route to point to the VPC endpoint.

Answer

Remove the default route from the private subnet route table.

Question 10

A company has a hybrid network with multiple VPCs connected via AWS Transit Gateway and an on-premises network via Direct Connect. The network team is planning to migrate a legacy application from on-premises to a new VPC. The application requires low-latency access to an RDS database running in an existing VPC. The team wants to minimize changes to the existing routing. What should the team do to meet these requirements?

Accepted Answer

Attach the new VPC to the existing transit gateway and ensure the transit gateway route tables permit traffic between the new VPC and the RDS VPC.. Attaching the new VPC to the existing transit gateway allows immediate connectivity to the RDS VPC without changing existing routes, provided the transit gateway route tables are configured correctly. Option B is wrong because routing traffic through on-premises adds unnecessary latency and complexity. Option C is wrong because VPC peering requires route table updates in both VPCs, which contradicts the requirement to minimize routing changes. Option D is wrong because migrating the RDS database would change the database endpoint and potentially cause downtime, and does not leverage the existing transit gateway.

Answer

Set up a VPN connection from the new VPC to the on-premises network, and route traffic through on-premises to the RDS VPC.

Answer

Create a VPC peering connection between the new VPC and the RDS VPC.

Answer

Migrate the RDS database to the new VPC to keep the application and database in the same VPC.

Question 11

A company has a Direct Connect connection with a private virtual interface to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection. They have enabled VPC Flow Logs for the VPC, but the flow logs do not show traffic that traverses the Direct Connect. The team needs a solution to capture the bandwidth usage of the Direct Connect connection. Which solution should they implement?

Accepted Answer

Use CloudWatch metrics for the Direct Connect connection.. Amazon CloudWatch provides native metrics for AWS Direct Connect connections, including ConnectionBpsEgress, ConnectionBpsIngress, ConnectionPpsEgress, and ConnectionPpsIngress, which directly measure bandwidth utilization. VPC Flow Logs capture IP traffic within the VPC but do not record traffic traversing a Direct Connect virtual interface, so CloudWatch metrics are the correct solution.

Answer

Enable AWS CloudTrail for the Direct Connect connection.

Answer

Enable VPC Flow Logs on the Direct Connect virtual interface.

Answer

Use AWS Config rules to monitor bandwidth.

Question 12

A company has a multi-account AWS environment with hundreds of VPCs interconnected via a transit gateway. The network team needs to centrally monitor VPC reachability and identify asymmetric routing paths. Which THREE services or features should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Contributor Insights. VPC Reachability Analyzer (B) is correct because it performs static, hop-by-hop path analysis between a source and destination (ENI, IP, or resource) and explicitly reports whether the path is reachable and where it breaks, which is exactly what is needed to validate VPC reachability across the transit gateway. AWS Network Manager (C) is correct because its Route Analyzer and topology views model the transit gateway route tables and attachments, letting the team centrally visualize routing and detect asymmetric or suboptimal paths across hundreds of VPCs. Amazon CloudWatch Contributor Insights (A) is correct because it analyzes VPC Flow Logs to surface the top contributors and traffic patterns, helping identify asymmetric routing behavior in live traffic that static analysis alone may miss. AWS Config (D) is not correct here because it records resource configuration changes and evaluates compliance rules, not end-to-end path reachability or routing asymmetry. AWS CloudHSM (E) is not correct because it is a dedicated hardware security module service for cryptographic key operations and has no role in network path analysis.

Answer

AWS Config

Answer

AWS CloudHSM

Question 13

A network engineer manages a VPC with a Transit Gateway (TGW) that has multiple VPC attachments and a Direct Connect gateway attachment. The engineer needs to verify that traffic from an on-premises network to a specific VPC is taking the expected path through the TGW. Which AWS service or feature should the engineer use to capture and analyze the traffic path?

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager is designed to provide a global view of your network, including TGWs and on-premises connections. It offers topology visualization and route analysis, which are essential for verifying that traffic from on-premises to a VPC traverses the expected TGW path. Other options like VPC Flow Logs, CloudTrail, and Direct Connect Gateway do not provide end-to-end path visibility across a TGW.

Answer

AWS CloudTrail

Answer

AWS Direct Connect Gateway

Answer

VPC Flow Logs

Question 14

A company uses AWS Site-to-Site VPN to connect its on-premises data center to a VPC. The VPN connection has two tunnels, but the company notices that only one tunnel is actively passing traffic. The network engineer wants to ensure that both tunnels are used simultaneously to increase aggregate throughput. Which action should the engineer take?

Accepted Answer

Configure the VPN connection to use a Transit Gateway with ECMP enabled, and ensure the on-premises router uses ECMP.. To use both VPN tunnels simultaneously for increased throughput, you must use a Transit Gateway with ECMP enabled. The virtual private gateway does not support ECMP, so it cannot load-balance across tunnels. Global Accelerator and BGP multipath on VGW are not applicable. The Transit Gateway, combined with ECMP on the on-premises router, allows active-active VPN tunnels.

Answer

Use AWS Global Accelerator to distribute traffic across both VPN tunnels.

Answer

Enable ECMP on the virtual private gateway and configure the on-premises router to use ECMP.

Answer

Enable BGP multipath on the virtual private gateway.

Question 15

A network engineer has deployed AWS Network Firewall in a centralized inspection VPC and attached it to a Transit Gateway. After enabling the firewall, the engineer notices that traffic between VPCs is not being inspected and is bypassing the firewall. The Transit Gateway route tables show that the attachment for the inspection VPC is associated with the same route table as the other VPC attachments. What is the most likely cause?

Accepted Answer

The Transit Gateway route tables are not configured to route traffic through the firewall VPC attachment.. Centralized inspection with AWS Network Firewall and Transit Gateway requires that the Transit Gateway route tables have routes pointing to the firewall VPC attachment for the traffic that needs inspection. Simply associating the inspection VPC attachment with the same route table as other VPCs does not automatically route traffic through it; the route table must have explicit routes for the destination CIDRs with the inspection VPC attachment as the target. Without these routes, traffic flows directly between VPCs, bypassing the firewall.

Answer

The Transit Gateway attachment for the inspection VPC is not associated with any route table.

Answer

The Network Firewall is not configured with the correct subnet IDs.

Answer

The Network Firewall policy is not attached to the firewall.