ANS-C01 Network Management and Operations Practice Test 3 — 15 Questions

Question 1

A company is using a centralized egress VPC model with a NAT gateway for outbound traffic from multiple VPCs. The network team notices that some EC2 instances are having connectivity timeouts when accessing the internet. The team has verified the route tables and security groups. Which additional check should be performed to troubleshoot the issue?

Accepted Answer

Check the NAT gateway CloudWatch metrics for error packets and connection counts. Option D is correct because NAT Gateway CloudWatch metrics, specifically `ErrorPortAllocation` and `PacketsDropCount`, directly indicate whether the NAT Gateway is running out of available ports or dropping packets due to connection limits. In a centralized egress model with multiple VPCs, high connection counts can exhaust the NAT Gateway's ephemeral port capacity (65,535 per IP), causing connectivity timeouts even when route tables and security groups are correctly configured.

Answer

Check the security group rules for outbound traffic

Answer

Check the VPC Flow Logs for denied traffic

Answer

Check the route tables for the internet gateway

Question 2

A network engineer is configuring a new AWS Direct Connect connection and needs to establish BGP peering with the AWS side. The engineer has received the BGP configuration from the AWS Direct Connect endpoint. Which information is required to complete the BGP configuration on the on-premises router?

Accepted Answer

The AWS BGP peer IP address and the BGP ASN. B is correct because BGP peering requires the remote peer's IP address and Autonomous System Number (ASN) to establish a TCP connection and exchange routing information. AWS provides these two values in the Direct Connect endpoint configuration, and the on-premises router must use them to configure the BGP neighbor statement. Without both, the BGP session cannot be established.

Answer

The AWS Side BGP password and MD5 hash

Answer

The Amazon side routing table and prefix list

Answer

The Direct Connect virtual interface ID and VLAN ID

Question 3

A company is using AWS Site-to-Site VPN connections to connect multiple branch offices to a central VPC. The network team wants to ensure high availability and automatic failover if one VPN tunnel goes down. Which configuration should be implemented?

Accepted Answer

Use the two tunnels provided by the VPN connection with dynamic routing (BGP). Each AWS Site-to-Site VPN connection provides two tunnels for high availability. By using dynamic routing (BGP) with both tunnels, the VPN automatically fails over to the second tunnel if the first goes down, without manual intervention. This meets the requirement for automatic failover and high availability.

Answer

Configure a second VPN connection to the same customer gateway and use BGP with equal-cost multipath

Answer

Use a single tunnel and rely on AWS automatic recovery

Answer

Configure static routes with a higher metric for the secondary tunnel

Question 4

A company is migrating its on-premises data center to AWS and wants to use AWS Direct Connect for private connectivity. The network team plans to advertise the company's public IP prefixes to AWS via BGP. Which AWS resource must be configured to allow advertisement of these prefixes?

Accepted Answer

A public virtual interface on the Direct Connect connection. To advertise public IP prefixes over AWS Direct Connect, you must use a public virtual interface (VIF). A public VIF allows you to reach public AWS endpoints (such as S3, DynamoDB, or any public IP range) over the Direct Connect link, and it supports BGP peering where you can advertise your public IP prefixes to AWS. Private VIFs are only for private VPC connectivity and do not accept customer-originated public prefix advertisements.

Answer

A VPN CloudHub topology

Answer

A private virtual interface on the Direct Connect connection

Answer

A transit virtual interface on the Direct Connect connection

Question 5

Which TWO options are valid ways to monitor network traffic in an AWS environment? (Choose 2.)

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring (Option C) is a valid way to monitor network traffic because it captures and copies network packets from Elastic Network Interfaces (ENIs) in a VPC and forwards them to monitoring appliances for deep packet inspection, security analysis, or troubleshooting. This allows you to inspect traffic content, including payloads, without impacting the source or destination of the traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 6

Which THREE are best practices for designing a highly available AWS Direct Connect connection? (Choose 3.)

Accepted Answer

Use multiple Direct Connect connections to different AWS Direct Connect locations. Option B is correct because using multiple Direct Connect connections to different AWS Direct Connect locations provides geographic redundancy. If one location experiences an outage, traffic can fail over to the other location, ensuring high availability. This aligns with AWS best practices for resilient hybrid networking.

Answer

Use a single Direct Connect connection with redundant virtual interfaces

Answer

Use a single large Direct Connect connection instead of multiple smaller ones

Question 7

Which TWO services can be used to centrally manage and monitor VPN connections across multiple AWS accounts? (Choose 2.)

Accepted Answer

AWS Network Manager. AWS Network Manager centrally manages and monitors VPN connections across multiple AWS accounts by providing a global view of your network topology, including on-premises and AWS resources. It integrates with Transit Gateway to monitor VPN tunnel status and performance metrics, enabling cross-account visibility via resource shares.

Answer

AWS CloudFormation

Answer

AWS Organizations

Answer

AWS Direct Connect Gateway

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team notices that traffic from an on-premises data center to a VPC is intermittently dropping. CloudWatch metrics show no errors on the Direct Connect virtual interface. What is the most likely cause of the intermittent drops?

Accepted Answer

Asymmetric routing due to missing or incorrect route propagation in Transit Gateway route tables. Option B is correct because asymmetric routing can cause packet drops when Transit Gateway does not have a route back to the source. Option A is wrong because BGP timers would cause sustained loss. Option C is wrong because MTU mismatch typically causes packet loss only for large packets. Option D is wrong because VPN would not be in path if Direct Connect is used.

Answer

Latency spikes on the Direct Connect link due to AWS VPN backup path

Answer

MTU mismatch causing packet fragmentation for jumbo frames

Answer

BGP keepalive timer mismatch between the on-premises router and the Direct Connect router

Question 9

A global company is designing a multi-region Active-Active application using Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) fronting Auto Scaling groups. The application requires sticky sessions based on the user's source IP. The network team notices that users are frequently switched to a different region mid-session, causing errors. What should the team do to resolve this issue?

Accepted Answer

Use a custom origin header in the Route 53 latency policy to route based on the user's IP address and enable ALB stickiness. Option C is correct because Route 53 latency-based routing does not natively support sticky sessions; using a custom origin header with ALB stickiness ensures users stick to the correct regional endpoint. Option A is wrong because enabling ALB stickiness alone does not prevent Route 53 from switching regions. Option B is wrong because health checks do not affect routing decisions during a session. Option D is wrong because geolocation routing would not adapt to latency and may cause incorrect routing.

Answer

Configure Route 53 health checks with a low threshold to quickly detect failures

Answer

Enable stickiness on each ALB using a cookie generated by the ALB

Answer

Switch to geolocation routing policy with a bias to maintain sessions

Question 10

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over AWS Site-to-Site VPN. The VPN tunnel status is UP, and BGP is established. The engineer can ping the on-premises server's private IP from the EC2 instance, but TCP connections to a specific port (e.g., 443) are timing out. What is the most likely cause?

Accepted Answer

Security group or network ACL blocking inbound TCP port 443 on the EC2 instance. Option B is correct because security groups or network ACLs can block specific ports while allowing ICMP. Option A is wrong because MTU mismatch would affect all traffic. Option C is wrong because the VPN tunnel is UP, so routing issues would affect all traffic. Option D is wrong because BGP is established, indicating proper route exchange.

Answer

Incorrect route table entries on the on-premises router for the VPC CIDR

Answer

MTU mismatch on the VPN tunnel causing packet fragmentation for TCP

Answer

BGP prefix limits exceeded causing route table incompleteness

Question 11

A company is using AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon VPC with public and private subnets, NAT gateways, and route tables. After deployment, the EC2 instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet with an Internet Gateway attached. What is the most likely cause?

Accepted Answer

The route table of the private subnet does not have a default route pointing to the NAT Gateway. Option D is correct because the route table associated with the private subnet must have a default route (0.0.0.0/0) pointing to the NAT Gateway. Option A is wrong because security groups can be checked separately. Option B is wrong because NACLs are stateless and would block all traffic if misconfigured. Option C is wrong because Internet Gateway is not needed in the private subnet route; only the NAT Gateway route is needed.

Answer

The Internet Gateway is not attached to the VPC

Answer

The security group of the EC2 instances blocks outbound traffic to the internet

Answer

The network ACL of the private subnet blocks outbound traffic

Question 12

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs. The company wants to use the same Direct Connect connection for both VPCs, but the on-premises router only has one physical port. The network engineer configures a single BGP session over a VLAN-tagged interface. After configuration, only one VPC is reachable. What is the most likely reason?

Accepted Answer

Each private VIF requires a separate BGP session, and only one session was configured. Option C is correct because each private VIF requires a unique BGP session and VLAN ID. Using a single BGP session cannot serve two VIFs because the VIFs are logically separate. Option A is wrong because the same BGP ASN can be used on both VIFs if the Direct Connect gateway is used. Option B is wrong because there is no requirement to use the same VLAN. Option D is wrong because the BGP session can be established with different peer IPs.

Answer

The on-premises router is using the same BGP ASN for both VIFs, which is not allowed

Answer

The BGP peer IP addresses must be in the same subnet for both VIFs

Answer

The VLAN ID must be the same for both VIFs to work over a single physical port

Question 13

A company is using AWS Global Accelerator to improve performance for a web application hosted in two AWS Regions. The application uses an Application Load Balancer (ALB) in each region. The company wants to ensure that traffic is directed to the closest healthy endpoint. Which routing configuration should be used?

Accepted Answer

Global Accelerator endpoint groups with health checks and traffic dials. Option B is correct because Global Accelerator uses Anycast IPs and directs traffic to the nearest healthy endpoint based on latency and health checks. Option A is wrong because Route 53 latency routing is not used with Global Accelerator. Option C is wrong because Global Accelerator does not use weighted routing. Option D is wrong because geolocation routing is not the default; Global Accelerator uses proximity.

Answer

Global Accelerator with weighted endpoint groups

Answer

Route 53 latency-based routing with health checks

Answer

Route 53 geolocation routing with Global Accelerator

Question 14

A network engineer is configuring AWS Client VPN for remote access. The engineer creates a Client VPN endpoint and associates it with a target network (subnet) in the VPC. After associating, clients can connect to the VPN but cannot access resources in the VPC. The security groups and network ACLs allow all traffic. What is the most likely issue?

Accepted Answer

The Client VPN endpoint's route table does not include a route to the VPC CIDR. Option C is correct because the Client VPN endpoint's route table must have a route to the VPC CIDR. Without it, traffic from clients is not forwarded to the VPC. Option A is wrong because the authorization rule is for access to specific networks, not routing. Option B is wrong because the subnet association is for the VPN endpoint itself, not routing. Option D is wrong because client CIDR is used for assigning IPs to clients, not for routing to VPC.

Answer

The Client VPN endpoint is not associated with a subnet in the VPC

Answer

The client CIDR range overlaps with the VPC CIDR

Answer

The Client VPN endpoint does not have an authorization rule to allow access to the VPC CIDR

Question 15

A company is deploying a hybrid network using AWS Direct Connect and a VPN backup. The Direct Connect connection is established, and BGP is running over the private VIF. The company wants to use the VPN as a backup only when Direct Connect fails. The network engineer configures BGP communities on the Direct Connect VIF to influence route preference. However, during a Direct Connect failure, failover to VPN takes several minutes. What can the engineer do to reduce failover time?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the Direct Connect VIF. Option D is correct because BFD can detect failures in sub-second time, reducing failover time. Option A is wrong because BGP timers can be adjusted but are typically already low; BFD is faster. Option B is wrong because static routes are less flexible and increase administrative overhead. Option C is wrong because AS prepending is for route preference, not failover speed.

Answer

Configure AS path prepending on the VPN BGP session to deprioritize it

Answer

Use static routes instead of BGP for the Direct Connect VIF

Answer

Decrease the BGP keepalive and hold timers on both the Direct Connect and VPN BGP sessions