ANS-C01 Network Management and Operations Practice Test 4 — 15 Questions

Question 1

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Direct Connect private virtual interface. The scenario requires connecting an existing Direct Connect private VIF to multiple VPCs in the same region through a Transit Gateway, so the three required components are A, B, and E. A (Direct Connect private virtual interface) is correct because the private VIF is the existing Direct Connect attachment that carries private traffic from the on-premises network into AWS. E (AWS Direct Connect gateway) is correct because it is the global gateway that associates the private VIF with the Transit Gateway, allowing the Direct Connect connection to reach multiple VPCs attached to that Transit Gateway without creating separate VIFs per VPC. B (AWS Transit Gateway) is correct because it acts as the regional hub that attaches the VPCs and connects to the Direct Connect gateway, simplifying multi-VPC routing and management. C (VPC peering connection) is not required because Transit Gateway replaces the need for full-mesh VPC peering in this design. D (AWS Site-to-Site VPN connection) is not required because the company is already using Direct Connect for private connectivity and does not need a VPN overlay for this scenario.

Answer

VPC peering connection

Answer

AWS Site-to-Site VPN connection

Question 2

A network engineer is configuring a site-to-site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE components should the engineer check?

Accepted Answer

Security group rules on the VPC resources to allow inbound traffic from on-premises. The engineer should check A, security group rules on the VPC resources, because security groups are stateful and must explicitly allow inbound traffic from the on-premises CIDR for resources to receive it; even with a working tunnel, missing inbound rules block traffic. B, on-premises firewall rules, must be verified because the customer gateway firewall must permit IPsec traffic (UDP 500/4500 and ESP, protocol 50) for the tunnel to pass traffic in both directions. E, the VPC route table, is essential because a route to the on-premises CIDR must point to the virtual private gateway; without it, return traffic from AWS has no path back over the VPN. C is not marked correct because network ACLs are stateless and, while they can affect return traffic, the question's marked answers focus on the security group, on-premises firewall, and route table as the primary checks. D is not marked correct because an Internet Gateway is not required for a site-to-site VPN; the virtual private gateway handles VPN traffic and does not depend on an IGW attachment.

Answer

Network ACLs for the subnet to allow return traffic

Answer

Internet Gateway attachment to the VPC

Question 3

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer wants to use monitoring tools to identify the source of the latency. Which two AWS services can provide metrics and logs to help diagnose the issue? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (C) is correct because it collects and stores metrics such as Direct Connect connection state, bit rate, packet rate, and latency-related statistics, and it can trigger alarms to pinpoint when and where latency spikes occur. VPC Flow Logs (E) is correct because it captures IP traffic metadata (source/destination, ports, protocol, bytes, packets, accept/reject) for traffic traversing the VPC, which helps correlate latency with traffic patterns, retransmissions, or asymmetric routing on the Direct Connect path. AWS CloudTrail (A) only records API activity and management events, not network performance metrics, so it cannot diagnose latency. AWS Config (B) tracks resource configuration changes and compliance, not real-time network telemetry. AWS Trusted Advisor (D) provides best-practice checks and recommendations but does not deliver the granular metrics or flow-level logs needed for latency troubleshooting.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 4

A network engineer is troubleshooting an issue where an EC2 instance launched in VPC vpc-0abcd1234efgh5678 cannot resolve DNS names for other instances using their private DNS names. The VPC has DHCP options set with domain-name-servers=AmazonProvidedDNS. What is the most likely cause?

Accepted Answer

The VPC attribute 'enableDnsHostnames' is set to false. For EC2 instances to resolve each other's private DNS names (e.g., ip-10-0-0-1.ec2.internal), the VPC must have both enableDnsSupport and enableDnsHostnames set to true. The question states DHCP options use AmazonProvidedDNS (which handles DNS resolution), but if enableDnsHostnames is false, instances do not receive DNS hostnames, so private DNS name resolution fails. This is the most likely cause given the scenario.

Answer

VPC Flow Logs are not enabled

Answer

The security group on the instances blocks DNS traffic

Answer

The DHCP options set is not using AmazonProvidedDNS

Question 5

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic is intermittently dropping and the BGP session between the on-premises router and the AWS Direct Connect virtual interface goes down. Which configuration should be checked first to resolve this issue?

Accepted Answer

Ensure the BGP hold timer values are consistent on both ends. BGP session flapping between an on-premises router and an AWS Direct Connect virtual interface is most commonly caused by mismatched timer values, particularly the hold timer. If the hold timer is shorter on one side than the keepalive interval on the other, the session will time out and reset. Checking timer consistency is the first diagnostic step before changing authentication or other settings.

Answer

Increase the BGP keepalive timer on the on-premises router to 90 seconds

Answer

Disable BGP authentication on the virtual interface

Answer

Enable BGP MD5 authentication on the on-premises router

Question 6

A network engineer is configuring VPC Flow Logs to deliver to an S3 bucket in a different account. The bucket policy is shown. The flow logs are not being delivered. What is the most likely reason?

Accepted Answer

The aws:SourceArn condition restricts access to a specific account, but the flow logs are from a different account. VPC Flow Logs delivering to an S3 bucket in a different account require the bucket policy to grant `s3:PutObject` to the flow logs delivery service principal, and any `aws:SourceArn` condition must match the source VPC's ARN. If the `aws:SourceArn` condition is scoped to a different account's VPC ARN than the one generating the flow logs, the delivery service's assumed role will be denied, causing silent delivery failure. This is the most likely cause of the described symptom.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject

Answer

The Principal must be the destination account's log delivery service

Answer

The Resource does not include the bucket ARN itself

Question 7

A network engineer is troubleshooting SSH connectivity to an EC2 instance in subnet subnet-0abcd1234efgh5678, which is associated with the network ACL shown. The security group allows inbound SSH. Why can't the engineer SSH to the instance?

Accepted Answer

The network ACL rule 200 denies SSH traffic, overriding rule 100. The network ACL exhibit shows inbound rule 100 allowing HTTP traffic (port 80) and rule 200 denying SSH traffic (port 22). Since NACL rules are evaluated in ascending order, when an SSH packet arrives, rule 100 does not match (it allows HTTP, not SSH), so rule 200 matches and denies the traffic. Thus, SSH is blocked. Option A is wrong because the security group allows SSH. Option B is wrong because the subnet is associated with the NACL as stated. Option C is wrong because rule 300 is a higher-numbered rule and would only be evaluated if no earlier rule matched; here rule 200 already matches and denies SSH.

Answer

The security group is blocking SSH traffic

Answer

The network ACL is not associated with the subnet

Answer

The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule

Question 8

A network engineer needs to capture TCP traffic between an EC2 instance (eni-abc123) and an RDS instance (eni-def456) in the same VPC for troubleshooting. Which AWS service should be used to capture the traffic and store it in S3?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information at the network interface level and can be published to S3. They can filter traffic by ENI, so they can capture traffic between eni-abc123 and eni-def456. Option D is correct. Amazon Inspector (A) is for vulnerability assessment, not traffic capture. AWS CloudTrail (B) records API activity, not network traffic. AWS Config (C) tracks configuration changes, not packet-level data.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 9

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its data center to a VPC. The network team needs to ensure high availability and failover in case the primary connection fails. Which solution provides the most cost-effective high availability?

Accepted Answer

Provision a second Direct Connect connection at a different AWS Direct Connect location and configure BGP with AS_PATH prepending. Provisioning a second Direct Connect connection at a different AWS Direct Connect location and configuring BGP with AS_PATH prepending provides high availability and failover. AS_PATH prepending makes the primary path preferred, and if it fails, BGP automatically reroutes traffic to the backup connection. This approach is cost-effective because it uses Direct Connect's dedicated network instead of internet-based VPN, which can have variable performance and higher data transfer costs.

Answer

Use a VPN connection over the internet as a backup

Answer

Use a VPN connection over the same Direct Connect connection as backup

Answer

Provision a second private virtual interface on the same Direct Connect connection

Question 10

A company has deployed a transit gateway with multiple VPC attachments and VPN attachments. The network team notices that traffic between two VPCs is taking an unexpected path and experiencing high latency. Which tool should be used to trace the path and identify the specific transit gateway route table that is being used?

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer is the tool that traces the path of network traffic between a source and destination, including through Transit Gateways, and identifies the specific route tables and components used. It provides a hop-by-hop analysis and can pinpoint which Transit Gateway route table is being used, making it ideal for troubleshooting unexpected paths and high latency.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch ServiceLens

Answer

AWS X-Ray

Question 11

A network engineer is troubleshooting connectivity issues between two VPCs that are connected via VPC peering. The VPCs are in the same region and have overlapping CIDR blocks. The engineer can ping the private IP of an instance in the peered VPC from an instance in the first VPC. However, traffic on TCP port 443 (HTTPS) fails. Which is the most likely cause?

Accepted Answer

The security group of the target instance does not allow inbound HTTPS traffic from the source. The security group of the target instance is stateful and must explicitly allow inbound TCP port 443 from the source instance's private IP or CIDR. Since ICMP (ping) succeeds, the VPC peering connection, route tables, and network ACLs are functioning for that protocol. The failure is isolated to HTTPS, which points to a security group rule that permits ICMP but not TCP/443.

Answer

The network ACL in the target subnet is blocking inbound HTTPS traffic

Answer

The VPC peering connection is not in the 'active' state

Answer

The route tables in both VPCs do not have routes to the peered VPC's CIDR

Question 12

A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?

Accepted Answer

Transit Gateway with a security appliance in a central VPC. A Transit Gateway with a security appliance in a central VPC (often called a hub-and-spoke or inspection VPC design) is the standard AWS pattern for centralized traffic inspection between subnets/VPCs. TGW route tables can steer inter-VPC and inter-subnet traffic through the appliance VPC, where a firewall or NGFW inspects east-west flows before forwarding them to the destination.

Answer

VPC peering

Answer

AWS Route 53 Resolver

Answer

AWS Network Firewall

Question 13

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel status shows 'UP' but traffic is not passing. The engineer checks the route tables and finds that the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely missing configuration?

Accepted Answer

The security group of the EC2 instances does not allow inbound traffic from on-premises. The VPN tunnel being UP indicates IKE and IPsec are established, and the VPC route table already has a route to the virtual private gateway. The most likely missing piece is that the EC2 security group does not allow inbound traffic from the on-premises CIDR, which would block traffic even though routing and VPN are correct.

Answer

The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway

Answer

The VPN tunnel is using the wrong pre-shared key

Answer

The on-premises router is not advertising the VPC CIDR over BGP

Question 14

A network engineer is configuring an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer creates a customer gateway, VPN connection, and virtual private gateway. The VPN tunnel status shows 'down'. Which configuration step is most likely missing?

Accepted Answer

Configure the on-premises router with the correct pre-shared key and tunnel IP addresses. The VPN tunnel status will remain down if the on-premises router is not configured with the correct pre-shared key and tunnel IP addresses as specified in the AWS VPN tunnel configuration. While attaching the VPN connection to the virtual private gateway (option A) is necessary, it is typically done during creation. Option B (enable route propagation) and option C (add static route) are related to routing, not tunnel establishment. Therefore, the most likely missing step is configuring the on-premises router.

Answer

Attach the VPN connection to the virtual private gateway

Answer

Enable route propagation on the virtual private gateway

Answer

Add a static route to the VPN connection in the route table

Question 15

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance is associated with an Elastic IP address. The route table for the private subnet has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in the public subnet and has an Elastic IP. Despite this, the instance cannot reach the internet. The security groups and NACLs are properly configured. What is the likely cause?

Accepted Answer

The NAT gateway is not in a public subnet. The instance cannot reach the internet because the NAT gateway, although placed in a subnet labeled as public, is not in a functional public subnet—the subnet's route table must include a default route (0.0.0.0/0) pointing to an internet gateway. The problem statement indicates the NAT gateway has an Elastic IP, so association is not the issue. Instead, the likely cause is that the public subnet's route table lacks this route, meaning the NAT gateway cannot communicate with the internet gateway. Option A is incorrect because the NAT gateway's Elastic IP is properly associated. Option C is incorrect because NACLs are properly configured. Option D is incorrect because the private subnet route table correctly points to the NAT gateway for 0.0.0.0/0.

Answer

The NAT gateway's Elastic IP is not associated with the NAT gateway

Answer

The private subnet's network ACL is blocking outbound traffic

Answer

The EC2 instance does not have a route to the internet