ANS-C01 Network Management and Operations Practice Test 5 — 15 Questions

Question 1

A company is using AWS Global Accelerator to improve performance for a web application hosted in two AWS Regions. The application uses an Application Load Balancer (ALB) in each region. The company wants to ensure that traffic is directed to the closest healthy endpoint. Which routing configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Global Accelerator endpoint groups with health checks and traffic dials. Global Accelerator uses anycast IPs to route traffic to the closest healthy endpoint based on latency and health checks. Endpoint groups contain regional endpoints (e.g., ALBs), and health checks ensure only healthy endpoints receive traffic. Traffic dials allow controlling the proportion of traffic sent to each region but are optional. Option B is incorrect because Global Accelerator does not use weighted routing; it uses latency-based routing. Option C is incorrect because Route 53 latency-based routing is a separate service and not the routing configuration for Global Accelerator; Global Accelerator itself handles proximity. Option D is incorrect because Route 53 geolocation routing is not used with Global Accelerator; Global Accelerator automatically routes to the nearest healthy endpoint without geolocation.

Answer

Global Accelerator with weighted endpoint groups

Answer

Route 53 latency-based routing with health checks

Answer

Route 53 geolocation routing with Global Accelerator

Question 2

A network engineer is configuring AWS Client VPN for remote access. The engineer creates a Client VPN endpoint and associates it with a target network (subnet) in the VPC. After associating, clients can connect to the VPN but cannot access resources in the VPC. The security groups and network ACLs allow all traffic. What is the most likely issue?

Accepted Answer

The Client VPN endpoint's route table does not include a route to the VPC CIDR. The Client VPN endpoint's route table must include a route to the VPC CIDR for traffic from clients to reach VPC resources. Without this route, packets are not forwarded to the VPC. Option A is incorrect because the subnet association is properly done; the endpoint is associated with a subnet. Option B is incorrect because a client CIDR overlap would cause routing conflicts, but the question states clients can connect but cannot access resources, indicating the VPN tunnel is established. Option C is incorrect because authorization rules control access to specific networks (e.g., security groups), but if no route exists, traffic won't reach the VPC even with authorization rules.

Answer

The Client VPN endpoint is not associated with a subnet in the VPC

Answer

The client CIDR range overlaps with the VPC CIDR

Answer

The Client VPN endpoint does not have an authorization rule to allow access to the VPC CIDR

Question 3

A company is deploying a hybrid network using AWS Direct Connect and a VPN backup. The Direct Connect connection is established, and BGP is running over the private VIF. The company wants to use the VPN as a backup only when Direct Connect fails. The network engineer configures BGP communities on the Direct Connect VIF to influence route preference. However, during a Direct Connect failure, failover to VPN takes several minutes. What can the engineer do to reduce failover time?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the Direct Connect VIF. BFD provides sub-second failure detection, which significantly reduces failover time compared to BGP timers. Option A is wrong because AS path prepending influences route preference and does not affect failover detection speed. Option B is wrong because static routes do not provide dynamic failover and increase administrative overhead. Option D is wrong because while decreasing BGP timers can reduce failover time, BFD is much faster and is the recommended approach.

Answer

Configure AS path prepending on the VPN BGP session to deprioritize it

Answer

Use static routes instead of BGP for the Direct Connect VIF

Answer

Decrease the BGP keepalive and hold timers on both the Direct Connect and VPN BGP sessions

Question 4

A company uses VPC Flow Logs to monitor network traffic. The flow logs are published to Amazon S3. The security team wants to analyze the logs for suspicious traffic patterns using Amazon Athena. After creating the Athena table, queries return zero results. The logs are in the correct S3 bucket. What is the most likely cause?

Accepted Answer

The Athena table is not configured to read from the correct S3 partition structure. VPC Flow Logs are stored in a partitioned folder structure (e.g., AWSLogs/account-id/vpcflowlogs/region/year/month/day/). If the Athena table does not use partition projection or is not configured to read from the correct partition structure, queries return no data. Option A is wrong because SSE-KMS encryption can be used with Athena if proper permissions are granted. Option B is wrong because the table can be in any AWS Glue database. Option C is wrong because Athena supports gzip format.

Answer

The flow logs are encrypted with SSE-KMS and Athena does not have permission to decrypt

Answer

The Athena table is in a different AWS Glue database

Answer

The flow logs are in gzip format, which Athena does not support

Question 5

A company is designing a VPN connection between an on-premises network and AWS. The network engineer wants to ensure high availability and fast failover. Which TWO actions should the engineer take? (Select TWO.)

Accepted Answer

Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels. To ensure high availability and fast failover for a VPN connection between on-premises and AWS, the correct actions are D and E. Option D: Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels. BGP provides dynamic route exchange and automatic failover, while BFD offers fast failure detection (<1 second). Option E: Configure two VPN tunnels to two different AWS endpoint IP addresses. This provides redundancy at the AWS side, so if one endpoint fails, the other tunnel remains active. Option A is incorrect because using the same customer gateway IP for both tunnels creates a single point of failure; if that IP becomes unreachable, both tunnels go down. Option B is incorrect because static routes cannot dynamically adapt to failures, and BGP is needed for automatic failover. Option C is incorrect because creating two separate VPN connections to the same VPC is unnecessary and more complex; a single VPN connection with two tunnels to different endpoints achieves the same redundancy with simpler management.

Answer

Use the same customer gateway IP address for both tunnels

Answer

Use static routes instead of BGP to simplify configuration

Answer

Create two separate VPN connections to the same VPC

Question 6

A company is using AWS Transit Gateway to connect multiple VPCs and Direct Connect. The network team wants to monitor network performance and detect anomalies. Which THREE AWS services should the team use together to achieve this goal? (Select THREE.)

Accepted Answer

Amazon CloudWatch. Options A, C, and D are correct. A: Amazon CloudWatch collects metrics and logs from AWS resources, enabling monitoring and alarms for anomalies in network performance. C: AWS Network Manager provides a global view of Transit Gateway networks and performance metrics, helping detect anomalies across VPCs and Direct Connect. D: VPC Flow Logs capture IP traffic information for analysis, aiding in anomaly detection. Option B is wrong because AWS Trusted Advisor offers best practice checks, not real-time network monitoring. Option E is wrong because AWS X-Ray is for application tracing, not network performance.

Answer

AWS Trusted Advisor

Answer

AWS X-Ray

Question 7

A company has a Direct Connect connection with a private VIF to a VPC. The network engineer needs to ensure that traffic from the on-premises network to the VPC uses the Direct Connect path, while internet-bound traffic from the VPC uses an Internet Gateway. Which TWO configurations are required? (Select TWO.)

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway (VGW). Options D and E are correct. Option D adds a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway (VGW), which ensures traffic destined for the on-premises network uses the Direct Connect private VIF. Option E adds a default route (0.0.0.0/0) in the VPC route table pointing to the Internet Gateway, which directs all internet-bound traffic from the VPC to the IGW. Option A is incorrect because the Direct Connect location prefix is not a destination in the VPC; the route needed is for the on-premises CIDR. Option B is incorrect because a NAT Gateway is not required for internet access when using an Internet Gateway; the IGW itself provides outbound internet access. Option C is incorrect because the on-premises router should not send internet traffic to the VPC; that would defeat the purpose of using Direct Connect for on-premises-to-VPC traffic only.

Answer

Add a route in the VPC route table for the Direct Connect location prefix

Answer

Deploy a NAT Gateway in the VPC for internet access

Answer

Configure the on-premises router to send all internet traffic to the VPC

Question 8

A company is using AWS Global Accelerator to improve performance for a web application hosted in two AWS Regions. The application uses an Application Load Balancer (ALB) in each region. The company wants to ensure that traffic is directed to the closest healthy endpoint. Which routing configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure multiple endpoint groups, one per region, and set traffic dials to distribute load. Options A, B, and C are correct. A: Multiple endpoint groups with traffic dials allow distributing traffic across regions based on desired percentages. B: Enabling health checks with a low threshold for failure detection ensures fast failover by quickly marking unhealthy endpoints. C: Setting traffic dials for each endpoint group allows fine-tuning the distribution of traffic. Option D is incorrect because client IP address preservation is not related to traffic distribution or failover; it affects source IP visibility. Option E is incorrect because Route 53 weighted routing is unnecessary; Global Accelerator can handle distribution via endpoint groups and traffic dials.

Answer

Enable client IP address preservation on the Global Accelerator

Answer

Use Route 53 weighted routing in front of Global Accelerator

Question 9

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that traffic between two VPCs in different regions is being dropped intermittently. What is the most likely cause?

Accepted Answer

Transit Gateway cannot route traffic between VPCs in different regions without inter-region peering. AWS Transit Gateway is a regional resource. To route traffic between VPCs in different regions, you must explicitly configure Transit Gateway inter-region peering. Without it, Transit Gateway cannot route traffic across regions, causing intermittent drops if traffic attempts to traverse regions. Option B is incorrect because security groups are stateful and would not cause intermittent drops. Option C is incorrect because route propagation issues typically cause persistent failures, not intermittent drops. Option D is incorrect because NAT Gateway is used for outbound internet traffic, not inter-VPC traffic.

Answer

Security groups in the source VPC are blocking traffic

Answer

Route tables in the Transit Gateway are not propagating routes correctly

Answer

NAT Gateway in the source VPC is causing asymmetric routing

Question 10

A network engineer is troubleshooting high latency on an AWS Direct Connect connection. The engineer checks the CloudWatch metrics for the virtual interface and sees that 'ConnectionBpsEgress' and 'ConnectionBpsIngress' are both below 50% of the provisioned bandwidth. Which additional metric should be examined to identify potential bufferbloat?

Accepted Answer

PauseFrames (802.3x flow control frames). (PauseFrames) is correct because PauseFrames indicate that the link is being flow-controlled due to congestion, which can cause bufferbloat. High pause frame counts suggest the local device is forcing the remote device to pause transmission, leading to increased latency. Option A is incorrect because CRAM is a security protocol, not a network metric. Option B is incorrect because detailed latency metrics are not available for Direct Connect virtual interfaces. Option D is incorrect because CRC errors indicate physical layer issues, not bufferbloat.

Answer

CRAM (Challenge-Response Authentication Mechanism) handshake failures

Answer

Latency metrics from Amazon CloudWatch

Answer

CRC errors on the physical connection

Question 11

A company has a multi-account AWS environment using AWS Organizations. They want to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the management account. The management account S3 bucket policy allows the log delivery service to write logs. However, flow logs are failing to deliver from member accounts. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not include a principal condition for the member account's log delivery service. The S3 bucket policy must explicitly allow the log delivery service principal (delivery.logs.amazonaws.com) from the member account to write objects. Option A is incorrect because flow logs can be delivered cross-account with proper permissions. Option B is incorrect because the bucket policy is evaluated, not the member account's VPC flow log role. Option D is incorrect because encryption is not the issue.

Answer

Flow logs cannot be delivered cross-account; they must be in the same account

Answer

The member account's IAM role for flow logs does not have permission to write to the bucket

Answer

The S3 bucket uses SSE-KMS encryption and the member account does not have access to the KMS key

Question 12

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices intermittent packet loss and latency spikes during peak hours. Which action should the team take to diagnose the issue?

Accepted Answer

Enable Bidirectional Forwarding Detection (BFD) on the virtual interfaces. Enabling Bidirectional Forwarding Detection (BFD) on the virtual interfaces allows rapid detection of connectivity failures, which can help isolate whether the issue is on the AWS side or the customer side. Option A is wrong because increasing bandwidth may not resolve intermittent issues caused by routing problems. Option C is wrong because tagging does not impact network performance. Option D is wrong because changing the private ASN does not affect performance.

Answer

Increase the bandwidth of the Direct Connect connection

Answer

Apply a tag to the Direct Connect connection for monitoring

Answer

Change the private ASN on the customer router

Question 13

A network engineer is designing a hybrid network with AWS Direct Connect and a VPN backup. The company has multiple VPCs connected to an AWS Transit Gateway. The on-premises network advertises the same prefixes over both Direct Connect (via private VIF) and VPN (via BGP). The engineer wants to ensure that traffic from the VPCs to on-premises prefers the Direct Connect path. What should the engineer do?

Accepted Answer

Configure AS path prepending on the VPN BGP advertisements from on-premises. To prefer the Direct Connect path, the engineer should make the VPN path less preferred in BGP path selection. AS path prepending on the VPN BGP advertisements artificially increases the AS path length, making the VPN route less preferred compared to the Direct Connect route (which has a shorter AS path). Option A is incorrect because local preference is a BGP attribute typically set on the receiving router within an AS, not on the Transit Gateway; the Transit Gateway does not set local preference for routes received from on-premises. Option B is incorrect because you cannot decrease the AS path length below the actual path; the Direct Connect path already has the minimum path length. Option D is incorrect because setting a higher MED (Multi-Exit Discriminator) on the Direct Connect advertisements would make them less preferred (lower MED is better), which is the opposite of what is desired.

Answer

Set a higher local preference on the Transit Gateway for Direct Connect routes

Answer

Decrease the AS path length on the Direct Connect BGP advertisements

Answer

Set a higher MED on the Direct Connect BGP advertisements

Question 14

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?

Accepted Answer

The route tables in VPC A point to a VPN gateway instead of the VPC peering connection. For VPC peering to work, each VPC must have routes in their route tables that point to the peering connection as the target for the other VPC's CIDR. If the route table in VPC A points to a VPN gateway instead of the VPC peering connection, traffic will not traverse the peering connection, causing connectivity failure. Option A is incorrect because Network ACLs are stateless and must allow both inbound and outbound ICMP; if they were misconfigured, they could block traffic, but the question states that route tables and security groups are correctly configured, not NACLs. Option C is incorrect because security groups are stateful and automatically allow return traffic; they would not block return traffic. Option D is incorrect because the VPC peering connection being in 'failed' state would prevent connectivity, but the question implies the connection is established (as the engineer verified route tables and security groups, not the peering state).

Answer

Network ACLs are not configured to allow inbound ICMP

Answer

Security groups are stateful and block return traffic

Answer

The VPC peering connection is in the 'failed' state

Question 15

A company uses AWS Client VPN to provide remote access to its corporate network. Users report that they can connect to the VPN but cannot reach resources in the VPC. The VPN is configured with mutual authentication and authorization rules. What should the network engineer verify first?

Accepted Answer

The authorization rules grant access to the target network. AWS Client VPN uses authorization rules to control which groups of clients can access specific target networks (e.g., subnets in the VPC). Even if the VPN connection is established, without proper authorization rules granting access to the target network, traffic will not be forwarded to the VPC resources. Option A is incorrect because the security group associated with the VPN endpoint controls inbound traffic to the endpoint itself, not traffic between clients and VPC resources. Option B is incorrect because if the client can connect, the server certificate is valid and trusted. Option C is incorrect because while overlapping CIDR ranges can cause routing issues, the fact that the connection succeeds indicates that the client CIDR range is valid and does not overlap with the VPC CIDR.

Answer

The security group associated with the VPN endpoint allows inbound traffic from the client CIDR

Answer

The server certificate is valid and trusted by the client

Answer

The client CIDR range does not overlap with the VPC CIDR