ANS-C01 Network Management and Operations Practice Test 30 — 15 Questions

Question 1

A network engineer is using AWS Network Firewall to protect a VPC. The engineer notices that some traffic is being allowed that should be blocked according to the configured stateless rule group. The engineer wants to ensure that the firewall evaluates traffic correctly. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the rule group's rule order and ensure that the rules are evaluated in the correct sequence.. Troubleshooting unintended allowed traffic in AWS Network Firewall involves checking rule order and rule definitions. Stateless rules are evaluated in priority order; if a lower-priority allow rule is processed before a higher-priority block rule, traffic will be allowed. Also, incorrect match criteria in block rules can cause them to be skipped. Verifying these two aspects directly addresses the problem.

Answer

Enable VPC Flow Logs on the firewall's subnet to capture traffic that is being allowed.

Answer

Verify that the stateless rule group's default action is set to forward to the stateful rule group for further inspection.

Answer

Confirm that the firewall policy is associated with the correct VPC and subnets.

Question 2

A company runs a Transit Gateway with several VPC attachments and a Site-to-Site VPN attachment to an on-premises data center. On-premises servers must resolve and reach an Amazon Route 53 private hosted zone that is associated with one spoke VPC. The network team has already created the Transit Gateway, attached the VPCs and VPN, and added routes. Name resolution from on-premises still fails. Which configuration change is required?

Accepted Answer

Configure a Route 53 Resolver inbound endpoint in the VPC that owns the private hosted zone and point the on-premises DNS forwarder at its IP addresses.. On-premises DNS resolution of a private hosted zone requires a Route 53 Resolver inbound endpoint placed in the VPC that has the zone associated. The on-premises DNS forwarder then targets the endpoint IPs over the hybrid connection. Outbound endpoints handle the opposite direction, and Transit Gateway associations do not exist for hosted zones.

Answer

Enable DNS support and DNS hostnames on every VPC attached to the Transit Gateway.

Answer

Create a Route 53 Resolver outbound endpoint and a resolver rule that forwards the on-premises domain to the on-premises DNS servers.

Answer

Associate the private hosted zone with the Transit Gateway so that all attached VPCs and the VPN can resolve it.

Question 3

A company uses AWS Direct Connect with a private virtual interface to connect its on-premises data center to a VPC. The network team wants to monitor the amount of data transferred over the Direct Connect connection and receive alerts when utilization exceeds a threshold. Which AWS service should they use to collect and alarm on these metrics?

Accepted Answer

Amazon CloudWatch with Direct Connect metrics. Amazon CloudWatch is the AWS service that collects Direct Connect metrics, including connection and virtual interface byte rates. You can create CloudWatch alarms on these metrics to alert when utilization exceeds a defined threshold. CloudTrail, VPC Flow Logs, and Trusted Advisor do not provide the required real-time utilization monitoring and alarming for Direct Connect connections.

Answer

VPC Flow Logs with a custom format for Direct Connect virtual interfaces

Answer

AWS CloudTrail with data events for Direct Connect

Answer

AWS Trusted Advisor with Direct Connect checks

Question 4

A company has a hybrid network with an AWS Direct Connect connection and a Site-to-Site VPN as backup. The company wants to ensure that traffic prefers the Direct Connect connection and fails over to the VPN only when Direct Connect is unavailable. The network engineer has configured BGP on both connections. Which BGP attribute should the engineer manipulate to achieve this preference?

Accepted Answer

LOCAL_PREF. To prefer Direct Connect over Site-to-Site VPN for outbound traffic, the engineer should set a higher LOCAL_PREF on routes learned from Direct Connect. LOCAL_PREF is exchanged within the same autonomous system and is the primary attribute for outbound path selection. This ensures that as long as Direct Connect is available, traffic will use it; if it fails, BGP will fall back to the VPN.

Answer

MED

Answer

AS_PATH

Answer

Weight

Question 5

A network engineer is using AWS Network Firewall to protect a VPC. The engineer notices that some traffic is being allowed that should be blocked according to the configured stateless rule group. The engineer wants to ensure that the firewall evaluates traffic correctly. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network Manager's Topology View. AWS Network Manager's Topology View provides a graphical representation of the global network, showing Transit Gateways, VPCs, and their connections. It allows engineers to view route tables and attachments, making it ideal for identifying misconfigured routes. Other features like Route Analyzer, Event Log, and Performance Dashboard serve different purposes and do not offer the same comprehensive visualization.

Answer

Network Manager's Event Log

Answer

Network Manager's Performance Dashboard

Answer

Network Manager's Route Analyzer

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team needs to monitor the amount of data transferred over the Transit Gateway and set up alerts when traffic exceeds a threshold. Which combination of AWS services should the team use to achieve this?

Accepted Answer

Amazon CloudWatch and AWS Transit Gateway metrics. AWS Transit Gateway publishes metrics such as BytesIn and BytesOut to Amazon CloudWatch. The network team can use CloudWatch to monitor these metrics and create alarms that trigger when data transfer exceeds a defined threshold. This provides a native, efficient solution for monitoring and alerting on Transit Gateway traffic. Other services like VPC Flow Logs, CloudTrail, Network Manager, and CloudWatch Logs do not provide the necessary aggregate metrics for this purpose.

Answer

AWS Network Manager and AWS CloudFormation

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

VPC Flow Logs and AWS CloudTrail

Question 7

A company uses AWS Client VPN to allow employees to access resources in a VPC. The VPC has a CIDR of 10.0.0.0/16. The Client VPN endpoint is associated with a subnet in the VPC. Users can connect to the VPN but cannot access an EC2 instance in a private subnet with IP 10.0.2.10. The security group on the EC2 instance allows all inbound traffic from the VPC CIDR. The Client VPN endpoint's security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The Client VPN endpoint does not have an authorization rule that allows access to the VPC CIDR.. Client VPN endpoints require authorization rules to allow clients to access network resources. Without an authorization rule that permits access to the VPC CIDR, clients cannot reach resources in the VPC, even if security groups and routes are correctly configured. The authorization rule is a separate access control mechanism specific to Client VPN.

Answer

The Client VPN endpoint's route table does not have a route to the VPC CIDR.

Answer

The Client VPN endpoint is associated with a subnet that does not have a route to the private subnet.

Answer

The EC2 instance's network ACL is blocking inbound traffic from the VPN clients.

Question 8

A company has a VPC with an internet gateway and a NAT gateway. The NAT gateway is in a public subnet, and private subnet instances use it for internet access. The company wants to capture and analyze traffic that is dropped by the NAT gateway due to exceeding the maximum connection tracking limit. Which AWS service or feature should the engineer use to monitor these drops?

Accepted Answer

Amazon CloudWatch metrics for the NAT gateway, specifically the ErrorPortAllocation metric.. NAT gateways have a connection tracking limit and publish the ErrorPortAllocation CloudWatch metric when they fail to allocate a source port. This metric is the most direct way to monitor drops due to exceeding the limit. Other metrics like ActiveConnectionCount and ConnectionAttemptCount can help diagnose high utilization but do not specifically indicate port allocation failures. VPC Flow Logs and other services do not capture these internal drops.

Answer

AWS Network Firewall logs for the NAT gateway subnet.

Answer

VPC Flow Logs with a filter for the NAT gateway elastic network interface.

Answer

AWS Transit Gateway Flow Logs on the NAT gateway attachment.

Question 9

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. A network engineer needs to monitor the traffic flow between VPCs attached to the transit gateway. The engineer wants to capture metadata about the traffic, such as source and destination IP addresses, ports, and protocol, without impacting performance. The engineer also needs to analyze the data using Amazon Athena. Which AWS service should the engineer use to meet these requirements?

Accepted Answer

Transit Gateway Flow Logs.. Transit Gateway Flow Logs are specifically designed to capture IP traffic metadata for traffic traversing a transit gateway. They can be published to Amazon S3, where they can be queried using Amazon Athena. This service provides the required fields without performance impact and is the correct tool for monitoring transit gateway traffic. Other options either do not capture the necessary data or are not suitable for transit gateway traffic.

Answer

VPC Traffic Mirroring on the transit gateway.

Answer

AWS CloudTrail logs for the transit gateway.

Answer

VPC Flow Logs on the transit gateway attachment.

Question 10

A network engineer is responsible for a VPC that uses AWS PrivateLink to expose a service to other VPCs. The service is behind a Network Load Balancer (NLB). The engineer needs to monitor the number of active connections and the bytes processed by the endpoint service. Which AWS service or feature should they use to collect these metrics?

Accepted Answer

Amazon CloudWatch metrics for the Network Load Balancer.. Network Load Balancers automatically publish metrics to Amazon CloudWatch, including ActiveFlowCount and ProcessedBytes. These metrics directly provide the required information about active connections and data processed. Using CloudWatch allows for easy visualization, alarming, and integration with other monitoring tools, making it the correct choice for this scenario.

Answer

AWS CloudTrail logs for the VPC endpoint service.

Answer

Amazon GuardDuty findings for the VPC endpoint.

Answer

VPC Flow Logs on the NLB's elastic network interfaces.

Question 11

A network engineer needs to verify that a newly created VPC peering connection is functioning correctly. The peering connection status is Active. The engineer wants to confirm that traffic can flow between an EC2 instance in VPC A and an EC2 instance in VPC B. Which action should the engineer take first?

Accepted Answer

Check that the route tables in both VPCs have routes pointing to the peering connection for the peer VPC CIDR.. For VPC peering, after the connection is Active, the most common oversight is missing routes in the VPC route tables. Both VPCs must have a route to the peer VPC's CIDR block that targets the peering connection. Only after routing is confirmed should you check security groups and network ACLs, which are evaluated later in the packet flow.

Answer

Confirm that the peering connection is in the same AWS Region as both VPCs.

Answer

Verify that the security groups on both instances allow traffic from the peer VPC CIDR.

Answer

Ensure that the network ACLs on the subnets are allowing traffic in both directions.

Question 12

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection is configured with two tunnels for redundancy. The network engineer notices that traffic is only flowing through one tunnel, and the other tunnel is idle. The engineer wants to ensure that both tunnels are used simultaneously to maximize throughput. The on-premises router supports BGP and is configured with equal BGP attributes for both tunnels. What should the engineer do to achieve this?

Accepted Answer

Configure the on-premises router to use ECMP for the BGP routes learned over the VPN tunnels.. AWS Site-to-Site VPN provides two tunnels for redundancy. To use both tunnels simultaneously for increased throughput, the on-premises router must support and be configured for ECMP. With equal BGP attributes, ECMP will load-balance traffic across both tunnels. Other options either do not enable simultaneous use or would make one tunnel preferred.

Answer

Set the BGP local preference to be higher on one tunnel than the other.

Answer

Configure the VPN connection to use a single tunnel with higher bandwidth.

Answer

Enable acceleration for the VPN connection using AWS Global Accelerator.

Question 13

A network engineer is analyzing a VPC Flow Log that records traffic for an EC2 instance. The log shows a record with source IP 10.0.1.5, destination IP 10.0.2.10, source port 49152, destination port 443, protocol 6, and action NODATA. The engineer needs to determine what this record signifies. What does the NODATA action indicate in this context?

Accepted Answer

No packets were captured for this flow during the aggregation interval.. NODATA in VPC Flow Logs means that no packets were captured for the specified flow during the aggregation interval. This can occur when traffic is blocked before reaching the logging point, or when no traffic was sent. The engineer should investigate potential causes such as security group rules, network ACLs, or routing issues. Unlike REJECT, which explicitly indicates a denial, NODATA is ambiguous and requires further analysis to determine why no packets were seen.

Answer

The traffic was allowed by the security group but denied by the network ACL.

Answer

The flow was rejected by a security group rule.

Answer

The flow log record is incomplete and will be updated later.

Question 14

A network engineer is using AWS Network Firewall to protect a VPC. The engineer notices that some traffic is being allowed that should be blocked according to the configured stateless rule group. The engineer wants to ensure that the firewall evaluates traffic correctly. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network Manager Infrastructure Performance metrics. The Network Manager topology view provides visualization of the global network, while Infrastructure Performance metrics provide real-time latency and packet loss data. Route Analyzer, Event Logs, and CloudWatch integration do not fulfill both requirements. Thus, the correct features are the topology view and Infrastructure Performance metrics.

Answer

Network Manager CloudWatch integration

Answer

Network Manager Route Analyzer

Answer

Network Manager Event Logs

Question 15

A company has a Transit Gateway with multiple VPC attachments. They want to centrally log all traffic that is accepted and rejected by the Transit Gateway to an S3 bucket for long-term analysis. The security team requires that the logs include the source and destination IP addresses, ports, protocol, and the action taken. Which solution should a network engineer implement?

Accepted Answer

Enable Transit Gateway Flow Logs and publish to S3.. Transit Gateway Flow Logs capture traffic at the TGW level, including accepted and rejected packets, with detailed 5-tuple information. They can be published to S3 for long-term retention. VPC Flow Logs, CloudTrail, and NLB traffic mirroring do not provide centralized TGW traffic logging. Thus, enabling TGW Flow Logs is the correct solution.

Answer

Configure a Network Load Balancer to mirror traffic to a logging instance.

Answer

Use AWS CloudTrail to log all API calls related to the Transit Gateway.

Answer

Enable VPC Flow Logs on each VPC attachment and publish to S3.