ANS-C01 Network Management and Operations Practice Test 29 — 15 Questions

Question 1

A network engineer manages a VPC (10.0.0.0/16) with a private subnet (10.0.1.0/24) hosting EC2 instances that must reach an on-premises server at 192.168.1.10/32 through an AWS Site-to-Site VPN attached to a virtual private gateway. The instances cannot reach the on-premises server, but the VPN tunnel status is UP and the on-premises firewall allows the traffic. The engineer verifies that the route table for the private subnet contains a route for 192.168.1.10/32 pointing to the virtual private gateway, and the EC2 instances have a security group that allows outbound ICMP. Which of the following is the MOST likely cause of the connectivity failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises customer gateway device does not have a static route for the VPC CIDR 10.0.0.0/16 pointing to the VPN tunnel.. The failure is most likely due to missing return routing on the on-premises customer gateway. Even with a healthy VPN tunnel and correct VPC route table entry, the on-premises device must have a route for the VPC CIDR pointing to the VPN tunnel. Without it, return traffic never reaches the EC2 instances, making the connection appear broken despite the tunnel being UP.

Answer

The VPC route table is missing a route for the on-premises CIDR because the virtual private gateway does not propagate routes from the VPN.

Answer

The virtual private gateway does not support static routes, so the engineer must configure a transit gateway instead.

Answer

The security group attached to the EC2 instances is blocking inbound return traffic from the on-premises server.

Question 2

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to connect this VPC to an on-premises network that uses the CIDR block 10.0.0.0/8. The network engineer sets up an AWS Site-to-Site VPN connection. After the VPN is established, the engineer notices that some on-premises hosts cannot reach certain EC2 instances in the VPC, and some VPC instances cannot reach certain on-premises hosts. The engineer suspects a routing issue. Which of the following is the most likely cause?

Accepted Answer

The on-premises network has a route for the VPC CIDR that points to the VPN, but the VPC CIDR overlaps with the on-premises CIDR.. The on-premises CIDR 10.0.0.0/8 encompasses the VPC CIDR 10.0.0.0/16. This overlap causes routing ambiguity: on-premises routers may treat VPC addresses as local, and VPC route tables may have conflicting entries. As a result, only hosts with non-overlapping addresses can communicate reliably. The engineer must re-address either the VPC or on-premises network to eliminate the overlap, or use more specific routes and NAT, but the fundamental issue is the overlapping CIDR blocks.

Answer

The VPC route table does not have a route for the on-premises CIDR.

Answer

The VPN connection is configured with a static route instead of BGP.

Answer

The VPN tunnel is not up.

Question 3

A network engineer is deploying a new AWS Transit Gateway to connect multiple VPCs and on-premises networks. The engineer needs to ensure that the TGW can route traffic between all attachments and that the necessary route table associations and propagations are configured. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Create a TGW route table and associate all VPC and VPN attachments with it.. To enable full routing between all attachments on a Transit Gateway, you must associate each attachment with a TGW route table and enable route propagation. Association determines which route table an attachment uses for forwarding, and propagation populates that route table with routes from the attachment. Without both, traffic cannot be routed correctly. Static routes and other methods are not required for basic full-mesh connectivity.

Answer

Create a VPC peering connection between each VPC and the TGW.

Answer

Attach an Internet Gateway to the TGW to allow internet access.

Answer

Configure a static route in the TGW route table pointing to each attachment.

Question 4

A network engineer is deploying a new application in a VPC that requires high availability and automatic scaling. The engineer configures an Application Load Balancer (ALB) with targets in multiple Availability Zones. During testing, the engineer notices that some requests are failing with HTTP 504 errors. The engineer suspects that the ALB health checks are not correctly configured. Which of the following should the engineer verify to ensure that the ALB can properly health check the targets?

Accepted Answer

The targets' security groups allow inbound traffic from the ALB's security group on the health check port.. The correct answer is that the targets' security groups must allow inbound traffic from the ALB's security group on the health check port. This ensures the ALB can reach the targets to perform health checks. Without this, targets are marked unhealthy, leading to 504 errors. Other options either reverse the direction or focus on less likely causes like network ACLs.

Answer

The ALB's security group allows outbound traffic to the targets on the health check port.

Answer

The security group attached to the ALB allows inbound traffic on the health check port from the target's security group.

Answer

The network ACLs associated with the target subnets allow inbound traffic from the ALB's subnet on the health check port.

Question 5

A network operations team manages a hub-and-spoke topology with an AWS Transit Gateway. They need to capture and analyze traffic that traverses the transit gateway for compliance auditing, without impacting production throughput. The traffic includes inter-VPC flows and traffic to on-premises networks. Which TWO approaches meet these requirements? (Choose two.)

Accepted Answer

Configure Transit Gateway Flow Logs with a custom format that includes the attachment ID and deliver them to Amazon S3.. Transit Gateway Flow Logs are generated by the transit gateway and capture traffic traversing it, including inter-VPC and on-premises flows. They can be sent to CloudWatch Logs or Amazon S3, and custom formats can include attachment IDs for precise mapping. VPC Traffic Mirroring and per-VPC flow logs do not cover transit gateway internal forwarding, and inserting a firewall appliance changes the topology and adds overhead.

Answer

Use VPC Traffic Mirroring on each spoke VPC attachment to copy all packets to a central analyzer.

Answer

Deploy a third-party firewall appliance in a shared services VPC and route all transit gateway traffic through it for inspection.

Answer

Enable VPC Flow Logs on every subnet in all spoke VPCs and aggregate them in a central account.

Question 6

A network engineer needs to capture and analyze traffic that is being rejected by a security group in a VPC. The engineer wants to use VPC Flow Logs. Which configuration should the engineer use to capture only the rejected traffic?

Accepted Answer

Create a flow log with a filter of 'REJECT' to capture only traffic that is rejected by security groups or network ACLs.. VPC Flow Logs have a filter option that can be set to 'REJECT' to log only traffic that is rejected by security groups or network ACLs. This is the most direct and cost-effective way to capture only rejected traffic. The other options either capture the wrong traffic or are unnecessarily complex.

Answer

Create a flow log with a filter of 'ALL' and then use a subscription filter to send only rejected traffic to CloudWatch Logs.

Answer

Create a flow log with a filter of 'REJECT' on the network ACL only, as security groups do not generate flow logs.

Answer

Create a flow log with a filter of 'ACCEPT' and then filter the logs for rejected traffic using CloudWatch Logs Insights.

Question 7

A network engineer needs to capture and analyze traffic that is traversing an AWS Transit Gateway. The engineer wants to use VPC Flow Logs to capture this traffic. What should the engineer do?

Accepted Answer

Enable Transit Gateway Flow Logs on the Transit Gateway or its attachments.. To capture traffic traversing an AWS Transit Gateway, you must use Transit Gateway Flow Logs. These logs provide detailed information about IP traffic going through the Transit Gateway, including source and destination IP addresses, ports, protocol, and whether the traffic was accepted or rejected. VPC Flow Logs are limited to VPC-level resources and cannot capture Transit Gateway transit traffic. CloudTrail is for API activity, not network traffic. Therefore, enabling Transit Gateway Flow Logs is the correct action.

Answer

Enable VPC Flow Logs on the VPCs that are attached to the Transit Gateway.

Answer

Use AWS CloudTrail to log Transit Gateway API calls and analyze traffic.

Answer

Enable VPC Flow Logs on the Transit Gateway attachment's ENI.

Question 8

A network engineer needs to capture and analyze all IP traffic entering and leaving a specific EC2 instance's elastic network interface for security auditing. The engineer wants to avoid capturing traffic from other instances and minimize costs. Which solution BEST meets these requirements?

Accepted Answer

Set up Traffic Mirroring with the instance's elastic network interface as the source and a monitoring instance as the target.. Traffic Mirroring is designed to copy network traffic from an ENI to a target for deep packet inspection. By selecting only the instance's ENI as the source, the engineer limits capture to that instance's traffic, reducing costs and fulfilling the need for full IP traffic analysis. Other options either capture metadata only or are overly complex.

Answer

Use AWS Network Firewall to log all traffic and forward logs to Amazon S3 for analysis.

Answer

Configure Traffic Mirroring on the instance's elastic network interface to send traffic to a Network Load Balancer.

Answer

Enable VPC Flow Logs on the VPC and filter the logs for the instance's private IP address.

Question 9

A company has a VPC with a single NAT gateway in one Availability Zone. EC2 instances in private subnets across three AZs use that NAT gateway for internet access. During an AZ impairment, instances in the other AZs lose internet connectivity. The network team must design a resilient egress solution with minimal operational overhead. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in each Availability Zone and update each private subnet's route table to use the NAT gateway in the same AZ.. A NAT gateway is an AZ-scoped resource, so a single NAT gateway creates a single point of failure for all subnets that route through it. Deploying one NAT gateway in each AZ and aligning each private subnet's route table with the NAT gateway in the same AZ provides fault isolation and high availability. Because NAT gateways are fully managed, this design adds resilience without adding patching or scaling tasks.

Answer

Replace the NAT gateway with a NAT instance on an EC2 instance in each private subnet and configure each instance to route through itself.

Answer

Attach an internet gateway to the VPC and add a route in each private subnet's route table to the internet gateway.

Answer

Create a VPC peering connection from each private subnet to a shared services VPC that hosts a single NAT gateway.

Question 10

A company operates a Transit Gateway in us-east-1. They have three VPC attachments and one Site-to-Site VPN attachment. The network team needs to capture detailed flow information for traffic traversing the Transit Gateway to analyze which attachments are communicating and whether traffic is being dropped due to blackhole routes. They have already enabled Transit Gateway Flow Logs to CloudWatch Logs. After reviewing the logs, they see records with a 'status' field of 'NODATA' for some flows. What does this status indicate?

Accepted Answer

No packets matching the flow were observed during the aggregation interval.. Transit Gateway Flow Logs capture information about IP traffic going to and from the Transit Gateway. The 'status' field can be 'OK', 'NODATA', or 'SKIPDATA'. NODATA is used when no packets are observed for a flow during the aggregation interval. This helps network engineers confirm whether traffic is actually traversing the Transit Gateway or if it is being routed elsewhere.

Answer

The flow was allowed but no data was transferred during the aggregation interval.

Answer

The flow log record was skipped because the Transit Gateway did not have sufficient permissions to publish to CloudWatch Logs.

Answer

The flow was observed but the packet was dropped due to a blackhole route in the Transit Gateway route table.

Question 11

A company uses AWS Site-to-Site VPN to connect its on-premises data center to a VPC. The VPN connection shows as UP, but the company's monitoring tools report intermittent packet loss and high latency for traffic traversing the VPN. The VPN uses two tunnels, and both are configured with BGP. Which action should the network engineer take FIRST to troubleshoot the issue?

Accepted Answer

Check the BGP session status on both tunnels and verify that the on-premises router is advertising the correct prefixes.. The first step in troubleshooting a Site-to-Site VPN with intermittent issues is to verify the health of the BGP sessions and the routes being advertised. BGP flapping or misconfigured route advertisements can cause packet loss and latency by directing traffic through a failing tunnel. Checking BGP status provides actionable insights before making changes.

Answer

Restart the VPN tunnels by resetting the connection from the AWS Management Console.

Answer

Modify the VPN connection to use a single tunnel instead of two to simplify routing.

Answer

Increase the VPN tunnel's bandwidth by enabling accelerated site-to-site VPN.

Question 12

A network engineer needs to capture and analyze all traffic entering and leaving a VPC for security auditing. The VPC contains many EC2 instances with elastic network interfaces. The engineer must ensure that flow logs record accepted and rejected traffic, including traffic to and from the instances, and that the logs are delivered to Amazon CloudWatch Logs for real-time analysis. Which configuration should the engineer use?

Accepted Answer

Create a VPC Flow Log at the VPC level with a filter of ALL and deliver to CloudWatch Logs.. VPC Flow Logs at the VPC level capture IP traffic for all ENIs in the VPC. Setting the filter to ALL includes both accepted and rejected traffic, which is necessary for security auditing. Delivering to CloudWatch Logs allows real-time querying and alerting. Per-ENI flow logs with ACCEPT-only filtering would miss rejected traffic and would not scale as new ENIs are added.

Answer

Create a flow log on each EC2 instance's elastic network interface with a filter of ACCEPT and deliver to Amazon S3.

Answer

Configure a VPC traffic mirror session that sends all traffic to an Amazon CloudWatch Logs log group.

Answer

Enable AWS CloudTrail data events for the VPC and deliver to CloudWatch Logs.

Question 13

A network engineer manages a VPC with a CIDR block of 10.0.0.0/16. The VPC has a public subnet 10.0.1.0/24 and a private subnet 10.0.2.0/24. An EC2 instance in the private subnet needs to access the internet for software updates. The engineer configured a NAT gateway in the public subnet and updated the private subnet's route table to point 0.0.0.0/0 to the NAT gateway. However, the instance cannot reach the internet. The engineer verifies that the NAT gateway is in the 'available' state. What is the most likely cause?

Accepted Answer

The NAT gateway is in a public subnet, but the public subnet's route table does not have a route to the internet gateway.. A NAT gateway must reside in a public subnet and that subnet's route table must have a route to an internet gateway. Without this route, the NAT gateway cannot forward traffic to the internet, even though it appears available. The private subnet's route table correctly points to the NAT gateway, so the missing link is the public subnet's route to the internet gateway.

Answer

The NAT gateway's elastic IP address is not associated with the instance.

Answer

The private subnet's route table does not have a route to the internet gateway.

Answer

The private subnet's network ACL is blocking outbound traffic to the NAT gateway.

Question 14

A network engineer manages a VPC with a Transit Gateway (TGW) that has multiple attachments: two VPCs, one AWS Site-to-Site VPN, and one AWS Direct Connect gateway. The engineer notices that traffic from the VPN attachment to a VPC attachment is being dropped, even though the TGW route table associated with the VPN attachment has a route to the VPC CIDR. The TGW route table associated with the VPC attachment does not have a route back to the VPN CIDR. What is the most likely cause of the dropped traffic?

Accepted Answer

The TGW route table associated with the VPC attachment is missing a route to the VPN CIDR, causing asymmetric routing.. Transit Gateway route tables are evaluated independently for each attachment. For traffic to flow from the VPN to a VPC, the VPC attachment's associated route table must contain a route to the VPN CIDR. The missing route causes the TGW to drop return traffic, resulting in connectivity failure. Ensuring bidirectional routes in the appropriate route tables resolves the issue.

Answer

The VPN attachment is not associated with the correct TGW route table, so it cannot learn routes from the VPC attachment.

Answer

The TGW does not support transitive routing between VPN and VPC attachments without a NAT instance.

Answer

The Direct Connect gateway attachment is advertising a more specific route, causing the VPN traffic to be blackholed.

Question 15

A company uses AWS Transit Gateway to connect 50 VPCs across multiple AWS accounts. The network team notices that traffic between two VPCs attached to the same transit gateway is being dropped. The VPC route tables have routes pointing to the transit gateway, and the transit gateway route table has a default route to a blackhole. The attachments for both VPCs are in the 'available' state. What is the most likely reason for the dropped traffic?

Accepted Answer

The transit gateway route table lacks a specific route for the destination VPC CIDR, and the default route points to a blackhole.. Transit gateway route tables use longest prefix match for route selection. If a default route (0.0.0.0/0) points to a blackhole and no more specific route exists for the destination VPC CIDR, traffic matching the default route is dropped. The VPC route tables correctly direct traffic to the transit gateway, but the transit gateway cannot forward it because the only matching route is a blackhole. Adding a specific route for the destination VPC CIDR to the correct attachment resolves the issue.

Answer

The transit gateway route table has a default route to a blackhole, which takes precedence over more specific routes.

Answer

The VPC route tables are missing a route to the transit gateway for the destination VPC CIDR.

Answer

The transit gateway attachments for the VPCs are in different AWS accounts, which prevents routing between them.