ANS-C01 Network Management and Operations Practice Test 3 — 15 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that traffic between two VPCs in different regions is being dropped intermittently. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transit Gateway cannot route traffic between VPCs in different regions without inter-region peering. AWS Transit Gateway does not natively route traffic between VPCs in different AWS Regions unless inter-region peering attachments are configured between the Transit Gateways in each Region. Without that peering, the TGW route tables have no path to the remote Region's VPC CIDR, so traffic is dropped intermittently or entirely depending on route propagation timing. This is the most likely cause of the described symptom.

Answer

Security groups in the source VPC are blocking traffic

Answer

Route tables in the Transit Gateway are not propagating routes correctly

Answer

NAT Gateway in the source VPC is causing asymmetric routing

Question 2

A network engineer is troubleshooting high latency on an AWS Direct Connect connection. The engineer checks the CloudWatch metrics for the virtual interface and sees that 'ConnectionBpsEgress' and 'ConnectionBpsIngress' are both below 50% of the provisioned bandwidth. Which additional metric should be examined to identify potential bufferbloat?

Accepted Answer

PauseFrames (802.3x flow control frames). PauseFrames are IEEE 802.3x flow control frames that a network device sends when its receive buffer is full, signaling the sender to pause transmission. On a Direct Connect virtual interface, a high rate of PauseFrames indicates buffer congestion — the classic symptom of bufferbloat — where large buffers fill up and cause latency spikes even though average throughput (ConnectionBpsEgress/Ingress) remains below 50% of provisioned bandwidth. Examining PauseFrames helps identify this congestion.

Answer

CRAM (Challenge-Response Authentication Mechanism) handshake failures

Answer

Latency metrics from Amazon CloudWatch

Answer

CRC errors on the physical connection

Question 3

A company has a multi-account AWS environment using AWS Organizations. They want to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the management account. The management account S3 bucket policy allows the log delivery service to write logs. However, flow logs are failing to deliver from member accounts. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not include a principal condition for the member account's log delivery service. When centralizing VPC Flow Logs to an S3 bucket in another account, the destination bucket policy must explicitly allow the log delivery service principal from each source account. The default AWS-managed flow log delivery service principal (delivery.logs.amazonaws.com) is scoped to the account that owns the bucket, so a bucket policy that only allows the management account's delivery service will reject writes from member accounts. The fix is to add a condition (e.g., aws:SourceAccount or aws:SourceArn) or a principal entry that authorizes the member accounts' log delivery service.

Answer

Flow logs cannot be delivered cross-account; they must be in the same account

Answer

The member account's IAM role for flow logs does not have permission to write to the bucket

Answer

The S3 bucket uses SSE-KMS encryption and the member account does not have access to the KMS key

Question 4

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices intermittent packet loss and latency spikes during peak hours. Which action should the team take to diagnose the issue?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the virtual interfaces. BFD is a lightweight, sub-second failure-detection protocol that runs over the Direct Connect virtual interfaces (VIFs) and provides rapid liveness detection and link-quality telemetry. Enabling BFD on the VIFs lets the team observe flapping, packet loss, and latency behavior at the BGP session level, which is exactly what's needed to diagnose intermittent degradation during peak hours. It is the only option that adds diagnostic visibility rather than changing capacity or configuration.

Answer

Increase the bandwidth of the Direct Connect connection

Answer

Apply a tag to the Direct Connect connection for monitoring

Answer

Change the private ASN on the customer router

Question 5

A network engineer is designing a hybrid network with AWS Direct Connect and a VPN backup. The company has multiple VPCs connected to an AWS Transit Gateway. The on-premises network advertises the same prefixes over both Direct Connect (via private VIF) and VPN (via BGP). The engineer wants to ensure that traffic from the VPCs to on-premises prefers the Direct Connect path. What should the engineer do?

Accepted Answer

Configure AS path prepending on the VPN BGP advertisements from on-premises. AS path prepending on the VPN BGP advertisements from on-premises makes the VPN path appear longer (worse) to the Transit Gateway, so TGW prefers the Direct Connect routes for the same prefixes. This is the standard BGP traffic-engineering technique for hybrid AWS designs.

Answer

Set a higher local preference on the Transit Gateway for Direct Connect routes

Answer

Decrease the AS path length on the Direct Connect BGP advertisements

Answer

Set a higher MED on the Direct Connect BGP advertisements

Question 6

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?

Accepted Answer

The route tables in VPC A point to a VPN gateway instead of the VPC peering connection. For VPC peering to work, both VPCs' route tables must have explicit routes pointing to the peering connection (pcx-xxxx) for the peer's CIDR. If VPC A's route table points to a VPN gateway instead of the peering connection, traffic destined for VPC B is sent to the VPN instead of the peering link, breaking connectivity even though security groups and NACLs are correct. This is the most likely cause given the scenario.

Answer

Network ACLs are not configured to allow inbound ICMP

Answer

Security groups are stateful and block return traffic

Answer

The VPC peering connection is in the 'failed' state

Question 7

A company has a Direct Connect connection with a private VIF and a public VIF. The private VIF is used to access VPC resources, and the public VIF is used to access AWS public services. Recently, the company enabled AWS Global Accelerator for its application. The network team notices that traffic to the application via Global Accelerator is not using the Direct Connect connection but is going over the internet. What should the team do to ensure traffic uses the Direct Connect public VIF?

Accepted Answer

Configure a VPN connection over the Direct Connect public VIF to route Global Accelerator traffic. Global Accelerator uses static anycast IP addresses that are not directly reachable over a Direct Connect public VIF. The public VIF provides access to AWS public services via the Direct Connect connection, but Global Accelerator IPs are not advertised over the BGP session. To route on-premises traffic to Global Accelerator through Direct Connect, you must establish a VPN connection over the public VIF. This VPN tunnel encapsulates the traffic and sends it over the Direct Connect link, ensuring it does not traverse the public internet. Option B is incorrect because you cannot advertise Global Accelerator IPs from your on-premises router; they are owned and advertised by AWS. Option C is incorrect because a Direct Connect gateway is used for private VIFs and does not integrate with Global Accelerator. Option D is incorrect because a private VIF is for accessing VPC resources, not public services like Global Accelerator.

Answer

Advertise the Global Accelerator IP addresses on the on-premises router to route traffic via the public VIF

Answer

Attach a Direct Connect gateway to the Global Accelerator

Answer

Create a private VIF for Global Accelerator traffic

Question 8

A company has an AWS Direct Connect connection with a private VIF to a VPC. They notice that traffic from the on-premises network to the VPC is being routed through the internet instead of the Direct Connect. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the prefix via BGP over the Direct Connect. If the on-premises router is not advertising the prefix via BGP over the Direct Connect, the VPC will not have a route to the on-premises network through the Direct Connect, causing traffic to go over the internet. Option A is incorrect because if the virtual private gateway were not attached, the VPC would have no route to the on-premises network at all. Option B is incorrect because security groups do not affect routing decisions; they filter traffic at the instance level. Option C is incorrect because a more specific route would still use the virtual private gateway, not the internet.

Answer

The virtual private gateway is not attached to the VPC

Answer

The security group on the VPC resources blocks the traffic

Answer

The on-premises CIDR is more specific than the VPC route table entry

Question 9

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?

Accepted Answer

The NAT Gateway is in a private subnet. A NAT Gateway must reside in a public subnet and have an Elastic IP to translate private subnet traffic to the internet. If the NAT Gateway is placed in a private subnet, it has no route to the Internet Gateway, so instances in other private subnets cannot reach the internet even though their route table points to the NAT Gateway. The correct fix is to recreate the NAT Gateway in a public subnet.

Answer

The NAT Gateway does not have a route to the internet gateway

Answer

The VPC does not have a VPC endpoint for the software update service

Answer

The security group attached to the NAT Gateway is blocking traffic

Question 10

A company uses AWS Global Accelerator to improve performance for a global application. The application is deployed in two AWS regions behind Network Load Balancers. Users in Asia report high latency even though the accelerator should route them to the nearest endpoint. What is the most likely reason?

Accepted Answer

The endpoint in the closer region is marked unhealthy. If the endpoint in the closer region is marked unhealthy, Global Accelerator will automatically route traffic to the next nearest healthy endpoint, which may be in a distant region, causing high latency. Option B is incorrect because if Traffic Dial were set to 100% for the distant region, traffic would be intentionally routed there, so users would not expect routing to the nearest endpoint. Option C is incorrect because on-premises endpoints are not typical for Global Accelerator, and even if used, they would not cause high latency specifically for Asian users if the closer region has healthy endpoints. Option D is incorrect because client affinity affects stickiness, not overall latency; it would not cause all Asian users to experience high latency.

Answer

Traffic Dial is set to 100% for the distant region

Answer

The accelerator is configured with on-premises endpoints

Answer

Client affinity is set to source IP

Question 11

A network engineer is monitoring network traffic using VPC Flow Logs. The engineer wants to capture traffic that is rejected by security groups and network ACLs. Which flow log format should be used?

Accepted Answer

Custom format with 'action' field. VPC Flow Logs capture metadata about IP traffic, and the 'action' field indicates whether traffic was ACCEPTed or REJECTed by security groups or network ACLs. To specifically capture rejected traffic, you must include the 'action' field in a custom flow log format and filter on REJECT. The default format does not include the action field, so a custom format is required.

Answer

Default format

Answer

Flow logs are delivered to CloudWatch Logs with DNS query logs

Answer

Custom format with 'srcaddr' and 'dstaddr' only

Question 12

A company has a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic only from the ALB security group. However, the health checks are failing. What is the most likely cause?

Accepted Answer

The target group is not configured with the correct health check path. The most likely cause of health check failures is an incorrect health check path configured in the target group. The security group configuration described in the stem should allow health check traffic because the EC2 security group explicitly allows inbound traffic from the ALB security group. However, if the target group's health check path does not match the actual endpoint on the EC2 instances (e.g., it expects a 200 response from a specific URL that is not available), the health checks will fail. Option B is incorrect because ALBs can be placed in private subnets without issue. Option C is incorrect because the stem states the EC2 security group allows inbound traffic from the ALB security group. Option D is incorrect because outbound rules on the ALB security group do not affect inbound health checks.

Answer

The ALB is in a private subnet

Answer

The EC2 security group does not allow inbound traffic from the ALB security group

Answer

The ALB security group does not allow outbound traffic

Question 13

A network engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a public subnet and an on-premises server over AWS Direct Connect. The instance can reach the internet but cannot reach the on-premises server. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Check the VPC route table to ensure a route exists for the on-premises CIDR pointing to the virtual private gateway. Option A is correct because for an EC2 instance to reach an on-premises network over Direct Connect, the VPC route table associated with the instance's subnet must contain a route for the on-premises CIDR block with the virtual private gateway (VGW) as the target; without this route, traffic has no path to the on-premises server. Option C is correct because security groups are stateful and must explicitly permit the traffic; if the security group does not allow inbound traffic from the on-premises CIDR (or the relevant protocol/port), return traffic and the connection itself will fail even if routing is correct. Option B is incorrect because Direct Connect does not use VPN tunnels; a VPN connection status check applies to Site-to-Site VPN, not Direct Connect. Option D is not the best diagnostic step here because VPC Flow Logs capture metadata about IP traffic but do not directly identify the specific misconfiguration (route or security group) causing the failure. Option E is not marked correct because, while network ACLs can block traffic, the question asks for the two actions to diagnose the issue and the marked correct answers focus on the route table and security group; network ACLs are stateless and would be a secondary check rather than one of the two primary diagnostic actions in this scenario.

Answer

Check the VPN connection status to ensure the tunnel is up

Answer

Enable VPC Flow Logs and analyze them for dropped packets

Answer

Check the network ACLs for the subnet to ensure they allow inbound traffic from on-premises

Question 14

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure high availability by using two tunnels. Which two components must be configured to achieve this? (Choose TWO.)

Accepted Answer

A virtual private gateway with two BGP sessions. For high availability with two tunnels in an AWS Site-to-Site VPN, a single VPN connection provides two tunnels by default, terminating on two different AWS endpoints. This requires only one customer gateway with a single public IP address. The virtual private gateway must be configured with two BGP sessions (one per tunnel) to support dynamic routing and automatic failover. Option C is incorrect because two customer gateways are unnecessary; one customer gateway with one IP suffices. Option D is incorrect because two VPN connections are not required—a single VPN connection already provides two tunnels. Option A is incorrect because a customer gateway cannot have two IP addresses. Option B is incorrect because an AWS Transit Gateway is optional and not required for a basic HA VPN setup.

Answer

A single customer gateway with two IP addresses

Answer

An AWS Transit Gateway

Answer

Two customer gateways, each with a unique public IP address

Answer

Two VPN connections

Question 15

A company is using AWS Transit Gateway with multiple VPCs and Direct Connect Gateway. They want to ensure that traffic between VPCs and on-premises is encrypted. Which TWO solutions can achieve this?

Accepted Answer

Enable MACsec on the Direct Connect connection. Option A is correct because AWS Direct Connect supports MACsec (IEEE 802.1AE) on dedicated 10 Gbps and 100 Gbps connections, which provides hop-by-hop encryption at Layer 2 between the customer's network device and the AWS Direct Connect location, securing on-premises traffic over the dedicated link. Option B is correct because creating a VPN attachment on the Transit Gateway and configuring an IPsec VPN tunnel to on-premises encrypts traffic end-to-end between the on-premises network and the Transit Gateway, and the TGW then routes that traffic to the attached VPCs. Option C is incorrect because Transit Gateway does not natively provide IPsec encryption for traffic between VPCs; VPC-to-VPC traffic within the AWS backbone is not encrypted by a TGW IPsec feature. Option D is incorrect because IPsec cannot be enabled directly on a private virtual interface (VIF); encryption over Direct Connect requires either MACsec on the connection or a VPN overlay terminating on a TGW or virtual private gateway. Option E is incorrect because VPC peering does not support encryption; it only provides private IP connectivity between VPCs over the AWS network.

Answer

Use Transit Gateway IPsec VPN to encrypt traffic between VPCs

Answer

Enable IPsec on the private virtual interface

Answer

Use VPC peering with encryption