ANS-C01 Network Management and Operations Practice Test 3 — 15 Questions

Question 1

A company is using an AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect. The network team notices that traffic from an on-premises network (CIDR 172.16.0.0/12) to a VPC (CIDR 10.0.0.0/16) is being dropped. The transit gateway route table shows a static route for 10.0.0.0/16 pointing to the VPC attachment. The Direct Connect virtual interface (VIF) is associated with the transit gateway and the on-premises router is advertising 172.16.0.0/12 via BGP. What is the most likely cause of the traffic being dropped?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The transit gateway route table does not have a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment.. The transit gateway route table must contain a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment for return traffic to be forwarded correctly. Without this route, the transit gateway has no path for traffic destined to the on-premises network, causing it to be dropped. The static route for 10.0.0.0/16 only handles traffic toward the VPC, not the return direction.

Answer

The VPC has a route that points to the transit gateway for the on-premises CIDR, causing asymmetric routing.

Answer

The Direct Connect VIF is not configured with BFD.

Answer

The VPC route table does not have a route for the on-premises CIDR pointing to the transit gateway.

Question 2

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team needs to monitor the Direct Connect connection for performance issues and receive alerts when latency exceeds a certain threshold. Which TWO actions should the team take to meet these requirements? (Choose TWO.)

Accepted Answer

Create a CloudWatch alarm on the Direct Connect latency metric to send notifications when latency exceeds the threshold.. AWS Direct Connect provides a built-in 'Latency' metric in CloudWatch that measures the round-trip time between the Direct Connect location and the AWS region. By creating a CloudWatch alarm on this metric, the team can trigger an SNS notification when latency exceeds a defined threshold, enabling proactive monitoring of performance issues.

Answer

Subscribe to AWS Health Dashboard events for Direct Connect.

Answer

Enable VPC Flow Logs to capture traffic patterns and latency.

Answer

Configure a VPN CloudWatch metric to monitor the Direct Connect connection.

Question 3

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Verify that the transit gateway route table contains the CIDR blocks of both VPCs.. The transit gateway route table must contain the CIDR blocks of both VPCs for traffic to be forwarded between them. Without these static routes, the transit gateway has no destination to route the traffic, causing it to be dropped. Verifying the route table entries ensures the necessary paths exist.

Answer

Check the Direct Connect virtual interface status.

Answer

Verify that the NAT Gateway in each VPC is properly configured.

Question 4

Refer to the exhibit. A network engineer is analyzing VPC Flow Logs to troubleshoot connectivity issues. The engineer notices that traffic from 10.0.1.5 to 192.168.1.1 on port 80 is logged as ACCEPT, but the application team reports that the web request failed. What is the most likely cause?

Accepted Answer

The destination host 192.168.1.1 is not reachable or does not have a route back to the source.. The VPC Flow Logs record the state of the TCP handshake from the perspective of the network path, but they do not confirm that the destination host successfully processed the request or that a return path exists. If 192.168.1.1 has no route back to 10.0.1.5, the initial SYN-ACK will never reach the source, causing the application to time out even though the forward traffic was accepted by the network ACL and security group.

Answer

The VPC Flow Logs are not capturing all packets due to sampling.

Answer

The network ACL is returning an ICMP unreachable message that is not logged.

Answer

The security group on the ENI is blocking outbound traffic to 192.168.1.1.

Question 5

A company is experiencing intermittent connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS regions. VPC A has CIDR 10.0.0.0/16 and VPC B has CIDR 10.1.0.0/16. The route tables in both VPCs have been updated to include routes pointing to the peering connection. Security groups and network ACLs are configured to allow all traffic for testing. However, traffic from VPC A to VPC B fails intermittently. Which of the following is the most likely cause of this intermittent failure?

Accepted Answer

The VPC peering connection does not support transitive routing. If any traffic is being routed through an intermediate device (e.g., a NAT instance or a VPN connection), the peering connection will not forward that traffic.. The intermittent failure is most likely due to VPC peering's lack of transitive routing. If traffic from VPC A to VPC B is routed through an intermediate device (e.g., a NAT instance, VPN connection, or another VPC), the VPC peering connection will not forward that traffic because it does not support transitive routing. This can cause intermittent failures when the intermediate device's route or state changes, even though direct routes and security groups are correctly configured.

Answer

The security group rules in VPC A are not allowing inbound traffic from VPC B's CIDR. The security group must reference the VPC B CIDR explicitly.

Answer

The route tables in both VPCs must include explicit routes for each other's CIDR blocks, but they should also include routes to the internet gateway for proper routing.

Answer

The VPCs are in different regions, and cross-region VPC peering is not supported. A transit gateway must be used instead.

Question 6

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

Accepted Answer

Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.. Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Verify that the on-premises firewall is not blocking UDP port 500 for IKE.

Answer

Verify that the VPN tunnel's pre-shared key matches on both sides.

Question 7

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

Accepted Answer

BGP session between the customer router and AWS is down.. A private VIF relies on a BGP session between the customer router and the AWS Direct Connect router to exchange routes and maintain the virtual interface state. When the BGP session goes down, the VIF state transitions to 'down' because no routing information is being exchanged, causing connectivity loss. This is the most direct and common cause of a VIF being in the 'down' state.

Answer

AWS Site-to-Site VPN is not established.

Answer

MACsec encryption is misconfigured on the customer router.

Answer

Jumbo frames are enabled on the VIF but not supported by the customer router.

Question 8

A network engineer is troubleshooting high latency on an AWS Transit Gateway that connects multiple VPCs and an on-premises network via AWS Site-to-Site VPN. The engineer wants to identify potential causes. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Review the CloudWatch metrics for the VPN tunnels for packet loss and latency.. CloudWatch metrics for VPN tunnels provide direct visibility into packet loss and latency, which are key indicators of performance issues on the AWS Site-to-Site VPN component of the Transit Gateway. Option C is correct because Transit Gateway Flow Logs capture IP traffic information between attachments, allowing the engineer to analyze traffic patterns, identify drops, and pinpoint which VPC or VPN attachment is contributing to the high latency.

Answer

Review the NACL rules for each subnet in the VPCs.

Answer

Re-create the VPN connections to reset the tunnels.

Answer

Enable VPC Flow Logs on the VPCs attached to the transit gateway.

Question 9

Arrange the steps to configure a site-to-site VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA in the correct order.

Accepted Answer

Define customer gateway, then create VPN connection, then apply VPN configuration to Cisco ASA, then verify tunnel status, then configure routing.. First, define the customer gateway, then create the VPN connection, apply the configuration, verify the tunnel, and finally configure routing.

Answer

Create VPN connection, then define customer gateway, then apply configuration, then verify tunnel, then configure routing.

Answer

Define customer gateway, then create VPN connection, then verify tunnel, then apply configuration, then configure routing.

Answer

Define customer gateway, then apply configuration, then create VPN connection, then verify tunnel, then configure routing.

Question 10

Arrange the steps to configure BGP on a Cisco router for a Direct Connect private virtual interface:

Accepted Answer

Enter configuration mode, then enable BGP, then define the neighbor, then advertise prefixes, then verify.. First enter config mode, enable BGP, define the neighbor, advertise prefixes, then verify.

Answer

Enable BGP, then enter configuration mode, then define the neighbor, then advertise prefixes, then verify.

Answer

Enter configuration mode, then enable BGP, then advertise prefixes, then define the neighbor, then verify.

Answer

Enter configuration mode, then enable BGP, then define the neighbor, then verify, then advertise prefixes.

Question 11

Arrange the steps to configure an AWS Client VPN endpoint for remote access:

Accepted Answer

First create server and client certificates, then create the Client VPN endpoint, then associate the endpoint with a target network, then authorize ingress rules, then download and distribute the client configuration.. First create certificates, then the endpoint, associate with network, authorize access, then distribute client config.

Answer

First create the Client VPN endpoint, then create server and client certificates, then associate with a target network, then authorize ingress rules, then distribute client configuration.

Answer

First create server and client certificates, then create the Client VPN endpoint, then authorize ingress rules, then associate with a target network, then distribute client configuration.

Answer

First create the Client VPN endpoint, then associate with a target network, then create server and client certificates, then authorize ingress rules, then distribute client configuration.

Question 12

Match each AWS service or feature to its primary function in network architecture.

Accepted Answer

VPC: Isolated virtual network in AWS where you can launch resources. Correct matches: VPC is an isolated virtual network; Direct Connect is a dedicated physical connection; VPN is an encrypted internet-based connection; Route 53 is a DNS service. Common confusions include mixing Direct Connect with VPN and VPC with Direct Connect.

Answer

VPC: Dedicated physical connection from on-premises to AWS

Answer

Direct Connect: Encrypted connection over the internet to AWS

Question 13

Match each VPN term to its correct description in the context of AWS Site-to-Site VPN.

Accepted Answer

VPN Connection: A logical connection between a VPC and an on-premises network.. The correct matches are: VPN Connection → logical connection, VPN Tunnel → encrypted tunnel, Transit Gateway → central hub. Common confusions involve swapping the definitions of Virtual Private Gateway (AWS-side) and Customer Gateway (customer-side).

Answer

Virtual Private Gateway: The device on the customer side of the VPN connection.

Answer

Customer Gateway: The VPN concentrator on the AWS side.

Question 14

Match each BGP attribute to its role in route selection.

Accepted Answer

AS_PATH: Used to determine the shortest path to a destination. BGP attributes influence route selection in a specific order: Weight, LOCAL_PREF, AS_PATH, MED, and others. AS_PATH measures path length, LOCAL_PREF directs outbound traffic, MED directs inbound traffic, and Weight is a Cisco-proprietary local preference.

Answer

AS_PATH: Used to influence outbound traffic from an AS

Answer

LOCAL_PREF: Used to determine the shortest AS path

Question 15

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking an unexpected path. Which AWS service should be used to analyze the packet-level traffic flow and identify the path?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the network interface level, enabling analysis of packet-level traffic flow paths through AWS Transit Gateway. By enabling flow logs on the Transit Gateway attachment or VPC subnets, you can trace the actual path traffic takes between VPCs, including whether it traverses the Transit Gateway or an unexpected route.

Answer

AWS CloudTrail

Answer

AWS X-Ray

Answer

AWS Config