ANS-C01 Network Management and Operations Practice Test 4 — 15 Questions

Question 1

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over a Direct Connect connection. The engineer has verified that the VPC route tables, Direct Connect virtual interface, and on-premises routing are correctly configured. Which tool should be used to verify the path MTU and identify fragmentation issues?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the ping command with the DF flag set to test MTU. The ping command with the Don't Fragment (DF) flag set (e.g., `ping -M do -s <size>` on Linux) is the correct tool to verify path MTU because it forces the packet not to be fragmented. If the packet size exceeds the MTU of any link along the path, the router will drop the packet and send an ICMP Fragmentation Needed message back, allowing the engineer to pinpoint the maximum supported MTU and identify fragmentation issues.

Answer

Use the netstat command

Answer

Use the nslookup command

Answer

Use the traceroute command

Question 2

A company has a multi-account AWS environment with hundreds of VPCs connected via a transit gateway. The network team needs to centrally monitor network traffic and detect anomalies such as unusual outbound data transfers. Which combination of services would provide the most scalable and cost-effective solution?

Accepted Answer

Enable VPC Flow Logs in each VPC, publish to Amazon S3, and use Amazon Athena to query logs from a central account. VPC Flow Logs capture IP traffic metadata at scale, and publishing to Amazon S3 provides a cost-effective, durable storage layer. Using Amazon Athena to query the logs from a central account enables serverless, on-demand analysis across hundreds of VPCs without provisioning servers, making it both scalable and cost-effective for anomaly detection.

Answer

Use AWS Trusted Advisor to check for unusual traffic patterns

Answer

Enable VPC Flow Logs in each VPC, publish to CloudWatch Logs, and create cross-account CloudWatch dashboards

Answer

Use AWS Network Manager to monitor all VPCs and Transit Gateway attachments

Question 3

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to monitor the latency and packet loss on the Direct Connect virtual interfaces. Which AWS service should be used to measure these metrics?

Accepted Answer

AWS CloudWatch. AWS CloudWatch is the correct service because it provides built-in metrics for Direct Connect virtual interfaces, including 'VirtualInterfaceRxNoPacket' and 'VirtualInterfaceTxNoPacket' for packet loss, and you can derive latency by monitoring the 'VirtualInterfaceBpsEgress' and 'VirtualInterfaceBpsIngress' metrics with appropriate alarms. CloudWatch also supports custom metrics and logs that can be used to calculate round-trip time (RTT) by analyzing ping results or using AWS Direct Connect's native health checks. This allows the network team to set up dashboards and alarms for latency and packet loss directly from the Direct Connect metrics.

Answer

AWS Config

Answer

AWS X-Ray

Answer

AWS CloudTrail

Question 4

A company has a hybrid network architecture with multiple VPCs connected via a transit gateway and on-premises via Direct Connect. The network team wants to automate the response to a BGP session failure on a Direct Connect virtual interface. Which AWS service can be used to monitor the BGP status and trigger an automated action?

Accepted Answer

AWS CloudWatch Events (EventBridge) with Direct Connect BGP metric alarms. AWS CloudWatch Events (EventBridge) can monitor Direct Connect BGP session status via the `bgp_session_state` metric in the `AWS/DX` namespace. When the BGP session transitions to the `down` state, you can create an EventBridge rule that triggers an automated action, such as invoking a Lambda function or sending an SNS notification, enabling a rapid response to BGP failures without manual intervention.

Answer

AWS Lambda with VPC Flow Logs

Answer

AWS Systems Manager Automation

Answer

AWS Config rules

Question 5

A company is using a centralized egress VPC model with a NAT gateway for outbound traffic from multiple VPCs. The network team notices that some EC2 instances are having connectivity timeouts when accessing the internet. The team has verified the route tables and security groups. Which additional check should be performed to troubleshoot the issue?

Accepted Answer

Check the NAT gateway CloudWatch metrics for error packets and connection counts. NAT Gateway CloudWatch metrics, specifically `ErrorPortAllocation` and `PacketsDropCount`, directly indicate whether the NAT Gateway is running out of available ports or dropping packets due to connection limits. In a centralized egress model with multiple VPCs, high connection counts can exhaust the NAT Gateway's ephemeral port capacity (65,535 per IP), causing connectivity timeouts even when route tables and security groups are correctly configured.

Answer

Check the security group rules for outbound traffic

Answer

Check the VPC Flow Logs for denied traffic

Answer

Check the route tables for the internet gateway

Question 6

A network engineer is configuring a new AWS Direct Connect connection and needs to establish BGP peering with the AWS side. The engineer has received the BGP configuration from the AWS Direct Connect endpoint. Which information is required to complete the BGP configuration on the on-premises router?

Accepted Answer

The AWS BGP peer IP address and the BGP ASN. B is correct because BGP peering requires the remote peer's IP address and Autonomous System Number (ASN) to establish a TCP connection and exchange routing information. AWS provides these two values in the Direct Connect endpoint configuration, and the on-premises router must use them to configure the BGP neighbor statement. Without both, the BGP session cannot be established.

Answer

The AWS Side BGP password and MD5 hash

Answer

The Amazon side routing table and prefix list

Answer

The Direct Connect virtual interface ID and VLAN ID

Question 7

A company is using AWS Site-to-Site VPN connections to connect multiple branch offices to a central VPC. The network team wants to ensure high availability and automatic failover if one VPN tunnel goes down. Which configuration should be implemented?

Accepted Answer

Use the two tunnels provided by the VPN connection with dynamic routing (BGP). Each AWS Site-to-Site VPN connection provides two tunnels for high availability. By using dynamic routing (BGP) with both tunnels, the VPN automatically fails over to the second tunnel if the first goes down, without manual intervention. This meets the requirement for automatic failover and high availability.

Answer

Configure a second VPN connection to the same customer gateway and use BGP with equal-cost multipath

Answer

Use a single tunnel and rely on AWS automatic recovery

Answer

Configure static routes with a higher metric for the secondary tunnel

Question 8

A company is migrating its on-premises data center to AWS and wants to use AWS Direct Connect for private connectivity. The network team plans to advertise the company's public IP prefixes to AWS via BGP. Which AWS resource must be configured to allow advertisement of these prefixes?

Accepted Answer

A public virtual interface on the Direct Connect connection. A public virtual interface (VIF) on AWS Direct Connect allows BGP peering where you can advertise your public IP prefixes to AWS, enabling private connectivity to public AWS services. Private and transit VIFs do not support customer-originated public prefix advertisements.

Answer

A VPN CloudHub topology

Answer

A private virtual interface on the Direct Connect connection

Answer

A transit virtual interface on the Direct Connect connection

Question 9

Which TWO options are valid ways to monitor network traffic in an AWS environment? (Choose 2.)

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring (Option C) is a valid way to monitor network traffic because it captures and copies network packets from Elastic Network Interfaces (ENIs) in a VPC and forwards them to monitoring appliances for deep packet inspection, security analysis, or troubleshooting. This allows you to inspect traffic content, including payloads, without impacting the source or destination of the traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 10

Which THREE are best practices for designing a highly available AWS Direct Connect connection? (Choose 3.)

Accepted Answer

Use multiple Direct Connect connections to different AWS Direct Connect locations. Using multiple Direct Connect connections to different AWS Direct Connect locations provides geographic redundancy. If one location experiences an outage, traffic can fail over to the other location, ensuring high availability. This aligns with AWS best practices for resilient hybrid networking.

Answer

Use a single Direct Connect connection with redundant virtual interfaces

Answer

Use a single large Direct Connect connection instead of multiple smaller ones

Question 11

Which TWO services can be used to centrally manage and monitor VPN connections across multiple AWS accounts? (Choose 2.)

Accepted Answer

AWS Network Manager. AWS Network Manager centrally manages and monitors VPN connections across multiple AWS accounts by providing a global view of your network topology, including on-premises and AWS resources. It integrates with Transit Gateway to monitor VPN tunnel status and performance metrics, enabling cross-account visibility via resource shares.

Answer

AWS CloudFormation

Answer

AWS Organizations

Answer

AWS Direct Connect Gateway

Question 12

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team notices that traffic from an on-premises data center to a VPC is intermittently dropping. CloudWatch metrics show no errors on the Direct Connect virtual interface. What is the most likely cause of the intermittent drops?

Accepted Answer

Asymmetric routing due to missing or incorrect route propagation in Transit Gateway route tables. The most likely cause of intermittent traffic drops from on-premises to a VPC via Direct Connect and Transit Gateway is asymmetric routing due to missing or incorrect route propagation. Asymmetric routing can occur when the forward path (on-premises to VPC) is valid, but the return path (VPC to on-premises) lacks a specific route in the Transit Gateway route table. This causes packets to be dropped intermittently as route propagation changes or routing tables are updated. Option A is incorrect because latency spikes are not typical of intermittent drops, and the VPN backup path is not mentioned as active. Option B is incorrect because MTU mismatch usually causes consistent packet loss for large packets, not intermittent drops. Option C is incorrect because BGP keepalive timer mismatches would cause sustained session loss rather than intermittent drops. Therefore, option D is correct.

Answer

Latency spikes on the Direct Connect link due to AWS VPN backup path

Answer

MTU mismatch causing packet fragmentation for jumbo frames

Answer

BGP keepalive timer mismatch between the on-premises router and the Direct Connect router

Question 13

A global company is designing a multi-region Active-Active application using Amazon Route 53 latency-based routing. Each region has an Application Load Balancer (ALB) fronting Auto Scaling groups. The application requires sticky sessions based on the user's source IP. The network team notices that users are frequently switched to a different region mid-session, causing errors. What should the team do to resolve this issue?

Accepted Answer

Switch to geolocation routing policy with a bias to maintain sessions. The issue is that latency-based routing can change the selected region mid-session due to fluctuating latency, breaking sticky sessions. Geolocation routing policy routes users to a region based on their source IP address, ensuring that the same user always reaches the same region, thus maintaining session stickiness. Using a bias allows fine-tuning to adjust routing for specific locations. Option C is not valid because Route 53 latency-based routing does not support custom origin headers; this is not a feature available in AWS. Option A only affects health checks and does not influence session persistence. Option B enables stickiness within a region but does not prevent Route 53 from switching regions. Therefore, switching to geolocation routing is the correct solution.

Answer

Configure Route 53 health checks with a low threshold to quickly detect failures

Answer

Enable stickiness on each ALB using a cookie generated by the ALB

Answer

Use a custom origin header in the Route 53 latency policy to route based on the user's IP address and enable ALB stickiness

Question 14

A company is using AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon VPC with public and private subnets, NAT gateways, and route tables. After deployment, the EC2 instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet with an Internet Gateway attached. What is the most likely cause?

Accepted Answer

The route table of the private subnet does not have a default route pointing to the NAT Gateway. The most likely cause is that the route table of the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. For EC2 instances in a private subnet to access the internet, the private subnet's route table must contain a route that directs internet-bound traffic to the NAT Gateway. Option B is incorrect because the Internet Gateway is already attached to the VPC as stated. Option C is incorrect because security groups are stateful and by default allow all outbound traffic; the question does not indicate any security group changes. Option D is incorrect because network ACLs are stateless and by default allow all outbound traffic; the scenario does not mention any NACL modifications.

Answer

The Internet Gateway is not attached to the VPC

Answer

The security group of the EC2 instances blocks outbound traffic to the internet

Answer

The network ACL of the private subnet blocks outbound traffic

Question 15

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs. The company wants to use the same Direct Connect connection for both VPCs, but the on-premises router only has one physical port. The network engineer configures a single BGP session over a VLAN-tagged interface. After configuration, only one VPC is reachable. What is the most likely reason?

Accepted Answer

Each private VIF requires a separate BGP session, and only one session was configured. Each private VIF requires a separate BGP session. With only one BGP session configured, only one VIF can be established. Option A is incorrect because the same BGP ASN can be used on both VIFs if connecting through a Direct Connect gateway. Option B is incorrect because the BGP peer IPs can be in different subnets. Option C is incorrect because each VIF requires a unique VLAN ID; they cannot share the same VLAN.

Answer

The on-premises router is using the same BGP ASN for both VIFs, which is not allowed

Answer

The BGP peer IP addresses must be in the same subnet for both VIFs

Answer

The VLAN ID must be the same for both VIFs to work over a single physical port