ANS-C01 Network Management and Operations Practice Test 28 — 15 Questions

Question 1

A company has deployed AWS Network Firewall in a centralized inspection VPC. A network engineer notices that traffic from a workload VPC to the internet is not being inspected by the firewall, even though the firewall endpoints are deployed and the Transit Gateway route tables are configured correctly. The engineer confirms that the workload VPC's route table has a route to the inspection VPC's CIDR via the Transit Gateway. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The workload VPC's route table points directly to an internet gateway instead of through the Transit Gateway, bypassing the inspection VPC.. For AWS Network Firewall to inspect traffic, the workload VPC must route traffic through the inspection VPC via the Transit Gateway. If a route to 0.0.0.0/0 points directly to an internet gateway, traffic bypasses the firewall entirely. The correct answer identifies this bypass as the cause, while the other options describe misconfigurations that would either prevent inspection differently or cause connectivity failures.

Answer

The Network Firewall endpoints are deployed in the wrong Availability Zones, causing traffic to be dropped.

Answer

The Network Firewall policy is missing a stateless rule group to allow the traffic.

Answer

The workload VPC's route table lacks a route to the internet via the Transit Gateway, so traffic bypasses the firewall.

Question 2

A company has a hybrid network with an AWS Site-to-Site VPN connection to an on-premises data center. The VPN connection is established, but users report intermittent connectivity to instances in a VPC. The network engineer suspects issues with the VPN tunnel. Which TWO actions should the engineer take to troubleshoot the intermittent connectivity? (Choose two.)

Accepted Answer

Check the VPN tunnel status in the AWS Management Console and review CloudWatch metrics for TunnelState and TunnelDataIn/Out.. Intermittent VPN connectivity often stems from tunnel flapping or IKE rekey issues. Monitoring CloudWatch metrics like TunnelState and TunnelDataIn/Out provides visibility into tunnel stability. Reviewing on-premises VPN device logs for IKEv2 rekey failures or dead peer detection timeouts helps identify the root cause. These two actions together address both the AWS-side and on-premises-side diagnostics.

Answer

Verify that the on-premises VPN device is configured with the correct pre-shared key and IKE identifiers.

Answer

Increase the VPN tunnel's bandwidth by enabling accelerated VPN.

Answer

Enable VPC Flow Logs on the VPN attachment and analyze for rejected traffic.

Question 3

A company operates a production VPC with a Transit Gateway (TGW) that connects to an on-premises data center via AWS Site-to-Site VPN. The network team notices that traffic from on-premises to a specific EC2 instance in the VPC is intermittently dropped. The TGW route table shows the VPN attachment as the next hop for the on-premises CIDR, and the VPC route table has a route to the TGW. The team wants to capture detailed flow logs for traffic traversing the TGW to diagnose the issue. Which solution will meet this requirement?

Accepted Answer

Enable Transit Gateway Flow Logs on the TGW and publish to CloudWatch Logs or S3.. Transit Gateway Flow Logs are specifically designed to capture IP traffic traversing a TGW, including traffic from VPN and VPC attachments. They provide granular details such as source, destination, and whether the traffic was accepted or rejected. VPC Flow Logs only capture traffic at the ENI level within a VPC, so they miss traffic that is dropped at the TGW. CloudTrail is for API auditing, not packet analysis.

Answer

Enable VPC Flow Logs on the VPC and filter for traffic to and from the on-premises CIDR.

Answer

Enable VPC Flow Logs on the TGW attachment and publish to CloudWatch Logs.

Answer

Use AWS CloudTrail to log API calls to the TGW and analyze the logs for dropped packets.

Question 4

A network engineer is using AWS Network Manager to monitor a global network that includes multiple transit gateways in different AWS Regions. The engineer wants to receive alerts when the number of bytes dropped on a transit gateway exceeds a threshold. What is the MOST appropriate way to achieve this?

Accepted Answer

Create a CloudWatch alarm on the BytesDropCount metric for the transit gateway and configure an SNS notification.. AWS Network Manager integrates with CloudWatch to provide metrics such as BytesDropCount for transit gateways. Creating a CloudWatch alarm on this metric and configuring an SNS notification is the standard and most efficient method to alert on dropped bytes. It leverages native AWS monitoring and alerting capabilities.

Answer

Use AWS CloudTrail to monitor transit gateway API calls and set up an alarm for drop events.

Answer

Enable VPC Flow Logs on all VPCs attached to the transit gateway and analyze the logs for drops.

Answer

Configure a transit gateway route table to log dropped packets to Amazon S3 and set up a Lambda function to alert.

Question 5

A network engineer is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The engineer needs to monitor the traffic flow between specific VPC attachments and the on-premises network. The engineer has enabled Transit Gateway Flow Logs and sent them to Amazon CloudWatch Logs. Which additional step is necessary to analyze the traffic from a specific VPC attachment to on-premises?

Accepted Answer

Use CloudWatch Logs Insights to query the flow logs by filtering on the attachment ID and the destination IP range of the on-premises network.. Transit Gateway Flow Logs capture traffic at the attachment level and include the attachment ID and IP addresses. To analyze traffic from a specific VPC attachment to on-premises, you filter the logs using CloudWatch Logs Insights, querying by attachment ID and on-premises CIDR. This provides the necessary visibility without additional services.

Answer

Use AWS CloudTrail to log Transit Gateway API calls and identify the attachment ID.

Answer

Enable VPC Flow Logs on the VPC that contains the attachment and correlate with Transit Gateway Flow Logs.

Answer

Configure a CloudWatch metric filter on the Transit Gateway Flow Logs to count packets from the attachment to on-premises.

Question 6

A network engineer needs to monitor all traffic entering and leaving a VPC that is used for a production application. The engineer wants to capture both accepted and rejected traffic for security analysis. Which AWS service should the engineer use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs is the correct service for capturing IP traffic information for network interfaces in a VPC. It can log both accepted and rejected traffic, providing the necessary data for security analysis. Other services like CloudTrail, Transit Gateway Network Manager, and GuardDuty serve different purposes and do not provide raw traffic capture.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Transit Gateway Network Manager

Question 7

A network engineer is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The engineer needs to monitor traffic flow logs for the Transit Gateway to troubleshoot connectivity issues. The logs must capture information about the source and destination IP addresses, ports, protocol, and the AWS account ID of the source VPC. Which configuration should the engineer use?

Accepted Answer

Enable Transit Gateway Flow Logs and publish to Amazon S3 or CloudWatch Logs.. Transit Gateway Flow Logs are specifically designed to capture traffic traversing a Transit Gateway, including detailed metadata such as source and destination IP addresses, ports, protocol, and the AWS account ID of the source VPC. Publishing these logs to Amazon S3 or CloudWatch Logs provides a centralized and scalable monitoring solution, which is essential for troubleshooting connectivity in complex hub-and-spoke architectures.

Answer

Enable VPC Flow Logs on each VPC attachment and publish to CloudWatch Logs.

Answer

Enable VPC Flow Logs on the Transit Gateway attachment subnets and publish to S3.

Answer

Use AWS Network Firewall logging and send logs to CloudWatch Logs.

Question 8

A company's network team needs to verify that traffic sourced from a specific Elastic Network Interface (ENI) in a VPC is allowed or denied by the attached security groups and network ACLs. They have enabled VPC Flow Logs for the VPC and want to capture only the traffic for that ENI, including both accepted and rejected packets. Which configuration should they use to achieve this with minimal overhead?

Accepted Answer

Create a flow log at the ENI level with a filter of 'ALL' and send it to CloudWatch Logs.. The requirement is to capture both accepted and rejected traffic for a specific ENI with minimal overhead. ENI-level flow logs with filter ALL directly provide this by scoping the capture to the interface and including all traffic decisions. Subnet or VPC level logs would capture more data than needed, and using a filter other than ALL would omit either accepted or rejected packets. Sending to CloudWatch Logs is a standard destination that supports querying.

Answer

Create a flow log at the subnet level with a filter of 'REJECT' and send it to S3.

Answer

Enable VPC Flow Logs on the VPC with a filter of 'ACCEPT' and use a subscription filter to forward only the ENI's logs to a Lambda function for analysis.

Answer

Create a flow log at the VPC level with a filter of 'ALL' and then filter the logs by the ENI ID using CloudWatch Logs Insights.

Question 9

A network engineer is investigating why some instances in a VPC are not receiving expected traffic. The engineer has enabled VPC Flow Logs with the default format and log destination as CloudWatch Logs. The engineer notices that the flow logs show records with action 'REJECT' for traffic from a specific source IP to a specific instance, but the security group attached to the instance allows that traffic. What is the most likely cause of the REJECT action?

Accepted Answer

The network ACL associated with the subnet is denying the traffic.. VPC Flow Logs show REJECT for traffic denied by security groups or network ACLs. Since the security group allows the traffic, the denial must come from a network ACL rule. Network ACLs are stateless and evaluated separately, so they can block traffic that security groups permit. Thus, the REJECT is caused by the network ACL.

Answer

The security group is not attached to the instance's network interface.

Answer

The route table for the subnet does not have a route to the source IP.

Answer

The instance's operating system firewall is blocking the traffic.

Question 10

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network engineer notices that traffic to Amazon S3 is going over the public internet instead of the Direct Connect connection. The engineer has configured a public VIF and advertised the on-premises routes. Which action should the engineer take to ensure S3 traffic uses the Direct Connect connection?

Accepted Answer

Configure a route in the on-premises router to direct S3 traffic to the public VIF, and ensure that the on-premises router prefers the BGP route learned over the Direct Connect connection over the internet route.. To force S3 traffic over Direct Connect, the on-premises router must have a specific route for S3 public IP prefixes pointing to the public VIF. Additionally, the BGP route over Direct Connect must be preferred over any internet route. This requires proper BGP configuration and route filtering on the on-premises router. Other options do not address the routing requirement.

Answer

Enable S3 Transfer Acceleration on the bucket and update the on-premises DNS to use the accelerated endpoint.

Answer

Use AWS Transit Gateway to route S3 traffic through a VPN connection.

Answer

Create a private VIF and configure a route to S3 through the private VIF.

Question 11

A network engineer needs to capture information about the IP traffic going to and from network interfaces in a VPC for security analysis. The engineer wants to log all traffic, including accepted and rejected traffic, and store the logs in Amazon S3 for long-term retention. Which AWS service should the engineer use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs is the correct service for capturing IP traffic information for network interfaces in a VPC. It can log accepted and rejected traffic and deliver logs to Amazon S3 for retention. CloudTrail logs API activity, Traffic Mirroring copies packets for inspection, and Inspector assesses vulnerabilities, none of which provide flow logs to S3.

Answer

Amazon Inspector

Answer

AWS Traffic Mirroring

Answer

AWS CloudTrail

Question 12

A network engineer manages a VPC that uses an internet gateway for public subnets and a NAT gateway for private subnets. The engineer needs to verify which elastic network interfaces (ENIs) and IP addresses are associated with the NAT gateway to troubleshoot a connectivity issue. Which AWS service or feature should the engineer use to obtain this information?

Accepted Answer

Amazon EC2 API (DescribeNatGateways). The correct answer is the Amazon EC2 API DescribeNatGateways because it directly provides the NAT gateway's ENI and IP address details needed for troubleshooting. Other services like VPC Flow Logs, Trusted Advisor, and AWS Config offer monitoring or compliance data but do not expose the gateway's own network interface attributes. Using the EC2 API ensures accurate and immediate retrieval of the required information.

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 13

A network engineer is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The engineer needs to monitor the traffic flow and troubleshoot connectivity issues. The engineer wants to enable Transit Gateway Flow Logs to capture information about IP traffic going through the Transit Gateway. Which TWO statements are true regarding Transit Gateway Flow Logs? (Choose two.)

Accepted Answer

Transit Gateway Flow Logs can be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose.. Transit Gateway Flow Logs provide visibility into IP traffic traversing a Transit Gateway. They can be published to CloudWatch Logs, S3, or Kinesis Data Firehose, and they can be enabled for specific attachments or the entire Transit Gateway. They capture detailed 5-tuple information including ports. They do not enforce security groups; that is handled by VPC security groups. Understanding these capabilities helps in designing effective monitoring and troubleshooting strategies.

Answer

Transit Gateway Flow Logs include the source and destination IP addresses, but not the source and destination ports.

Answer

Transit Gateway Flow Logs can be used to capture traffic that is denied by security groups on the Transit Gateway.

Answer

Transit Gateway Flow Logs capture traffic only at the VPC attachment level, not at the Transit Gateway level.

Question 14

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The network engineer notices that traffic from on-premises to AWS is being dropped intermittently. The engineer suspects that the Direct Connect gateway route propagation is not working correctly. Which tool or feature should the engineer use to verify the routes advertised from the on-premises network to AWS?

Accepted Answer

Virtual interface BGP session details. The correct answer is the virtual interface BGP session details because it directly shows the prefixes advertised from the on-premises network to AWS. The Direct Connect gateway route table shows routes in the opposite direction, VPC route tables show VPC routing, and CloudTrail logs API activity but not BGP advertisements. Inspecting the BGP session is essential for diagnosing intermittent route propagation problems.

Answer

VPC route table

Answer

AWS Direct Connect gateway route table

Answer

AWS CloudTrail logs

Question 15

A network engineer needs to verify that a newly created VPC Flow Log is correctly capturing traffic for a specific network interface. The engineer wants to quickly check the flow log records in near real-time. Where should the engineer look?

Accepted Answer

Amazon CloudWatch Logs log group associated with the flow log.. VPC Flow Logs can be published to CloudWatch Logs, which provides near real-time log viewing. This allows the engineer to quickly verify that the flow log is capturing the expected traffic. Other destinations like S3 or Kinesis Firehose involve delays and are not ideal for immediate verification.

Answer

Amazon Kinesis Data Firehose delivery stream.

Answer

AWS CloudTrail event history.

Answer

Amazon S3 bucket where the flow logs are delivered.