ANS-C01 Network Management and Operations Practice Test 4 — 15 Questions

Question 1

A company uses VPC Flow Logs to monitor network traffic. The flow logs are published to Amazon S3. The security team wants to analyze the logs for suspicious traffic patterns using Amazon Athena. After creating the Athena table, queries return zero results. The logs are in the correct S3 bucket. What is the most likely cause?

Accepted Answer

The Athena table is not configured to read from the correct S3 partition structure. Option A is correct because VPC Flow Logs are stored in a partitioned folder structure (e.g., AWSLogs/account-id/vpcflowlogs/region/year/month/day/). If the Athena table does not use partition projection or the partition location is incorrect, queries return no data. Option B is wrong because encryption does not prevent Athena from reading. Option C is wrong because the table can be in any database. Option D is wrong because file format (gzip) is supported by Athena.

Answer

The flow logs are encrypted with SSE-KMS and Athena does not have permission to decrypt

Answer

The Athena table is in a different AWS Glue database

Answer

The flow logs are in gzip format, which Athena does not support

Question 2

A company is designing a VPN connection between an on-premises network and AWS. The network engineer wants to ensure high availability and fast failover. Which TWO actions should the engineer take? (Select TWO.)

Accepted Answer

Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels. Options A and C are correct. A: Two tunnels on two separate AWS endpoints provide redundancy. C: BGP with BFD provides fast failover detection. Option B is wrong because static routes do not provide dynamic failover. Option D is wrong because the same customer gateway IP is used for both tunnels. Option E is wrong because multiple VPN connections to the same VPC are not needed if the tunnels are diverse.

Answer

Use the same customer gateway IP address for both tunnels

Answer

Use static routes instead of BGP to simplify configuration

Answer

Create two separate VPN connections to the same VPC

Question 3

A company is using AWS Transit Gateway to connect multiple VPCs and Direct Connect. The network team wants to monitor network performance and detect anomalies. Which THREE AWS services should the team use together to achieve this goal? (Select THREE.)

Accepted Answer

Amazon CloudWatch. Options A, C, and D are correct. A: VPC Flow Logs capture IP traffic information. C: Amazon CloudWatch can aggregate and analyze logs and metrics. D: AWS Network Manager provides a global view of Transit Gateway networks and performance metrics. Option B is wrong because AWS X-Ray is for application tracing, not network performance. Option E is wrong because AWS Trusted Advisor provides best practice checks, not real-time monitoring.

Answer

AWS Trusted Advisor

Answer

AWS X-Ray

Question 4

A company has a Direct Connect connection with a private VIF to a VPC. The network engineer needs to ensure that traffic from the on-premises network to the VPC uses the Direct Connect path, while internet-bound traffic from the VPC uses an Internet Gateway. Which TWO configurations are required? (Select TWO.)

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway (VGW). Options A and C are correct. A: The VPC route table must have a route to the on-premises CIDR via the virtual private gateway. C: The VPC route table must have a default route (0.0.0.0/0) to the Internet Gateway. Option B is wrong because the VPC does not need a route to the Direct Connect location. Option D is wrong because the on-premises router should not have a default route to the VPC. Option E is wrong because the VPC does not need a NAT gateway for internet access if using an Internet Gateway.

Answer

Add a route in the VPC route table for the Direct Connect location prefix

Answer

Deploy a NAT Gateway in the VPC for internet access

Answer

Configure the on-premises router to send all internet traffic to the VPC

Question 5

A company is using AWS Global Accelerator to improve performance for a global application. The application uses an Application Load Balancer (ALB) in each region. The network team wants to ensure that traffic is distributed evenly across regions and that failover happens quickly. Which THREE steps should the team take? (Select THREE.)

Accepted Answer

Configure multiple endpoint groups, one per region, and set traffic dials to distribute load. Options A, C, and D are correct. A: Multiple endpoint groups with traffic dials allow distributing traffic across regions. C: Health checks on endpoints ensure quick failover. D: Adjusting traffic dials can fine-tune distribution. Option B is wrong because weighted routing is not a Global Accelerator feature; it uses proximity. Option E is wrong because client IP preservation is not related to traffic distribution.

Answer

Enable client IP address preservation on the Global Accelerator

Answer

Use Route 53 weighted routing in front of Global Accelerator

Question 6

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that traffic between two VPCs in different regions is being dropped intermittently. What is the most likely cause?

Accepted Answer

Transit Gateway cannot route traffic between VPCs in different regions without inter-region peering. Option B is correct because Transit Gateway is a regional resource and does not support inter-region peering natively; traffic between VPCs in different regions must go through a VPN or Direct Connect, or use Transit Gateway inter-region peering (which must be explicitly configured). Option A is incorrect because security groups are stateful and would not drop traffic intermittently. Option C is incorrect because route propagation does not cause intermittent drops. Option D is incorrect because NAT Gateway is used for outbound traffic to the internet, not for inter-VPC traffic.

Answer

Security groups in the source VPC are blocking traffic

Answer

Route tables in the Transit Gateway are not propagating routes correctly

Answer

NAT Gateway in the source VPC is causing asymmetric routing

Question 7

A network engineer is troubleshooting high latency on an AWS Direct Connect connection. The engineer checks the CloudWatch metrics for the virtual interface and sees that 'ConnectionBpsEgress' and 'ConnectionBpsIngress' are both below 50% of the provisioned bandwidth. Which additional metric should be examined to identify potential bufferbloat?

Accepted Answer

PauseFrames (802.3x flow control frames). Option A is correct because 'PauseFrames' indicates that the link is being flow-controlled due to congestion, which can cause bufferbloat. Option B is incorrect because CRAM is a security protocol. Option C is incorrect because CRC errors indicate physical layer issues. Option D is incorrect because latency metrics are not available for Direct Connect at the virtual interface level.

Answer

CRAM (Challenge-Response Authentication Mechanism) handshake failures

Answer

Latency metrics from Amazon CloudWatch

Answer

CRC errors on the physical connection

Question 8

A company has a multi-account AWS environment using AWS Organizations. They want to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the management account. The management account S3 bucket policy allows the log delivery service to write logs. However, flow logs are failing to deliver from member accounts. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not include a principal condition for the member account's log delivery service. Option C is correct because the S3 bucket policy must explicitly allow the log delivery service principal (delivery.logs.amazonaws.com) from the member account to write objects. Option A is incorrect because flow logs can be delivered cross-account with proper permissions. Option B is incorrect because the bucket policy is evaluated, not the member account's VPC flow log role. Option D is incorrect because encryption is not the issue.

Answer

Flow logs cannot be delivered cross-account; they must be in the same account

Answer

The member account's IAM role for flow logs does not have permission to write to the bucket

Answer

The S3 bucket uses SSE-KMS encryption and the member account does not have access to the KMS key

Question 9

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices intermittent packet loss and latency spikes during peak hours. Which action should the team take to diagnose the issue?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the virtual interfaces. Option B is correct because enabling Bidirectional Forwarding Detection (BFD) on the virtual interfaces allows rapid detection of connectivity failures, which can help isolate whether the issue is on the AWS side or the customer side. Option A is wrong because increasing bandwidth may not resolve intermittent issues caused by routing problems. Option C is wrong because changing the private ASN does not affect performance. Option D is wrong because tagging does not impact network performance.

Answer

Increase the bandwidth of the Direct Connect connection

Answer

Apply a tag to the Direct Connect connection for monitoring

Answer

Change the private ASN on the customer router

Question 10

A network engineer is designing a hybrid network with AWS Direct Connect and a VPN backup. The company has multiple VPCs connected to an AWS Transit Gateway. The on-premises network advertises the same prefixes over both Direct Connect (via private VIF) and VPN (via BGP). The engineer wants to ensure that traffic from the VPCs to on-premises prefers the Direct Connect path. What should the engineer do?

Accepted Answer

Configure AS path prepending on the VPN BGP advertisements from on-premises. Option A is correct because adjusting the AS path prepending length makes the VPN path appear longer (less preferred) in BGP route selection. Option B is incorrect because MED is only compared between routes from the same AS. Option C is incorrect because local preference is used within a single AS, not across ASes. Option D is incorrect because decreasing the AS path length would make the path more preferred.

Answer

Set a higher local preference on the Transit Gateway for Direct Connect routes

Answer

Decrease the AS path length on the Direct Connect BGP advertisements

Answer

Set a higher MED on the Direct Connect BGP advertisements

Question 11

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?

Accepted Answer

The route tables in VPC A point to a VPN gateway instead of the VPC peering connection. Option D is correct because VPC peering does not support transitive routing; if traffic goes through a VPN or another VPC, it will not work. Option A is wrong because security groups are stateful and return traffic is allowed. Option B is wrong because NACLs are stateless but can be checked; however, if correctly configured, they would not block. Option C is wrong because the VPC peering connection is established.

Answer

Network ACLs are not configured to allow inbound ICMP

Answer

Security groups are stateful and block return traffic

Answer

The VPC peering connection is in the 'failed' state

Question 12

A company uses AWS Client VPN to provide remote access to its corporate network. Users report that they can connect to the VPN but cannot reach resources in the VPC. The VPN is configured with mutual authentication and authorization rules. What should the network engineer verify first?

Accepted Answer

The authorization rules grant access to the target network. Option B is correct because authorization rules control which groups can access which networks. Option A is incorrect because if the connection succeeds, the security group is not the issue. Option C is incorrect because the client CIDR range does not affect access to VPC resources. Option D is incorrect because the server certificate is for authentication, not routing.

Answer

The security group associated with the VPN endpoint allows inbound traffic from the client CIDR

Answer

The server certificate is valid and trusted by the client

Answer

The client CIDR range does not overlap with the VPC CIDR

Question 13

A company wants to monitor network traffic between its EC2 instances and determine which IP addresses are generating the most traffic. Which AWS service should be used to capture and analyze this traffic?

Accepted Answer

VPC Flow Logs. Option C is correct because VPC Flow Logs capture IP traffic information and can be published to CloudWatch Logs or S3 for analysis. Option A is wrong because CloudTrail records API calls, not network traffic. Option B is wrong because AWS Config records resource configuration changes. Option D is wrong because Trusted Advisor provides best-practice checks, not traffic analysis.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 14

A company has a Direct Connect connection with a private VIF and a public VIF. The private VIF is used to access VPC resources, and the public VIF is used to access AWS public services. Recently, the company enabled AWS Global Accelerator for its application. The network team notices that traffic to the application via Global Accelerator is not using the Direct Connect connection but is going over the internet. What should the team do to ensure traffic uses the Direct Connect public VIF?

Accepted Answer

Configure a VPN connection over the Direct Connect public VIF to route Global Accelerator traffic. Option A is correct because Global Accelerator uses anycast IPs that are advertised over the public internet; to route traffic via Direct Connect, the on-premises routes must point to the public VIF. Option B is wrong because private VIF is for VPC access, not public services. Option C is wrong because the Direct Connect gateway is for private VIFs. Option D is wrong because VPN is not required.

Answer

Advertise the Global Accelerator IP addresses on the on-premises router to route traffic via the public VIF

Answer

Attach a Direct Connect gateway to the Global Accelerator

Answer

Create a private VIF for Global Accelerator traffic

Question 15

A company has an AWS Direct Connect connection with a private VIF to a VPC. They notice that traffic from the on-premises network to the VPC is being routed through the internet instead of the Direct Connect. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the prefix via BGP over the Direct Connect. Option D is correct because if the on-premises router is advertising the prefix with a community that is not accepted by the Direct Connect BGP peer, the route will not be installed. Option A is incorrect because a more specific route would not cause traffic to go to the internet. Option B is incorrect because the virtual private gateway is the correct target. Option C is incorrect because security groups do not affect routing.

Answer

The virtual private gateway is not attached to the VPC

Answer

The security group on the VPC resources blocks the traffic

Answer

The on-premises CIDR is more specific than the VPC route table entry