ANS-C01 Network Management and Operations Practice Test 5 — 15 Questions

Question 1

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?

Accepted Answer

The NAT Gateway is in a private subnet. Option B is correct because the NAT Gateway must be in a public subnet with an internet gateway route to function. Option A is wrong because the NAT Gateway itself does not have a route; the route table of the subnet where it resides needs a route to the internet gateway. Option C is wrong because security groups are for instances, not NAT Gateways. Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.

Answer

The NAT Gateway does not have a route to the internet gateway

Answer

The VPC does not have a VPC endpoint for the software update service

Answer

The security group attached to the NAT Gateway is blocking traffic

Question 2

A company uses AWS Global Accelerator to improve performance for a global application. The application is deployed in two AWS regions behind Network Load Balancers. Users in Asia report high latency even though the accelerator should route them to the nearest endpoint. What is the most likely reason?

Accepted Answer

The endpoint in the closer region is marked unhealthy. Option A is correct because if the endpoints are unhealthy, Global Accelerator will route traffic to the other region. Option B is incorrect because Traffic Dial can shift traffic but does not cause high latency. Option C is incorrect because client affinity does not affect latency. Option D is incorrect because Global Accelerator endpoints are typically in AWS, not on-premises.

Answer

Traffic Dial is set to 100% for the distant region

Answer

The accelerator is configured with on-premises endpoints

Answer

Client affinity is set to source IP

Question 3

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure that if the primary VPN tunnel goes down, traffic automatically fails over to the secondary tunnel. Which configuration is required?

Accepted Answer

Enable dynamic routing (BGP) on the VPN connection. Option A is correct because dynamic routing with BGP allows automatic failover between tunnels by propagating routes. Option B is wrong because static routes require manual intervention for failover. Option C is wrong because customer gateways are not for failover; they are endpoints. Option D is wrong because VPN CloudHub is for connecting multiple VPNs, not failover.

Answer

Use static routes with equal-cost multipath (ECMP)

Answer

Enable VPN CloudHub

Answer

Configure a second customer gateway device

Question 4

A network engineer is monitoring network traffic using VPC Flow Logs. The engineer wants to capture traffic that is rejected by security groups and network ACLs. Which flow log format should be used?

Accepted Answer

Custom format with 'action' field. Option D is correct because the default format includes only the first 20-30 bytes of the packet, not the action field. To capture rejections, the custom format must include 'action'. Option A is incorrect because the default format omits action. Option B is incorrect because the default format does not include it. Option C is incorrect because DNS is not involved.

Answer

Default format

Answer

Flow logs are delivered to CloudWatch Logs with DNS query logs

Answer

Custom format with 'srcaddr' and 'dstaddr' only

Question 5

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path, going through the on-premises network instead of staying within AWS. What is the most likely cause?

Accepted Answer

The Transit Gateway route table has a propagated route from the on-premises network with a longer prefix. Option D is correct because Transit Gateway route propagation from on-premises (VPN or Direct Connect) can advertise more specific routes that override the local VPC routes. Option A is wrong because VPC peering is not used with Transit Gateway. Option B is wrong because security groups do not affect routing. Option C is wrong because flow logs are for monitoring, not routing decisions.

Answer

The VPCs are also peered directly, creating a conflict

Answer

VPC Flow Logs are enabled, causing latency

Answer

Security groups are blocking direct traffic between VPCs

Question 6

A company is migrating its on-premises data center to AWS. The network team needs to establish a site-to-site VPN connection with dynamic routing using BGP. The on-premises router supports BGP but does not support BGP communities. The VPN connection is established, but the VPC does not learn the on-premises routes. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising any prefixes over BGP. Option B is correct because the on-premises router must advertise its routes over the BGP session. Option A is incorrect because BGP communities are not required. Option C is incorrect because the VPN connection is established. Option D is incorrect because BGP does not require static routes.

Answer

The VPN tunnel uses pre-shared keys instead of certificates

Answer

The VPC route table needs a static route to the on-premises CIDR

Answer

The VPN tunnel is not in a UP state

Question 7

A company has a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic only from the ALB security group. However, the health checks are failing. What is the most likely cause?

Accepted Answer

The EC2 security group does not allow inbound traffic from the ALB security group. Option C is correct because ALB health checks come from the ALB's private IP addresses, which are in the VPC CIDR; the security group must allow traffic from the ALB security group, not from the internet. Option A is wrong because the ALB security group is correct. Option B is wrong because the ALB subnet is not relevant. Option D is wrong because the target group configuration is separate.

Answer

The target group is not configured with the correct health check path

Answer

The ALB is in a private subnet

Answer

The ALB security group does not allow outbound traffic

Question 8

A network engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a public subnet and an on-premises server over AWS Direct Connect. The instance can reach the internet but cannot reach the on-premises server. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Check the VPC route table to ensure a route exists for the on-premises CIDR pointing to the virtual private gateway. Options B and D are correct. Checking route tables verifies that the on-premises CIDR is pointing to the virtual private gateway. Checking security groups ensures inbound traffic from on-premises is allowed. Option A is incorrect because NACLs are stateless and usually allow return traffic if properly configured. Option C is incorrect because flow logs are for logging, not real-time diagnosis. Option E is incorrect because the VPN is not involved.

Answer

Check the VPN connection status to ensure the tunnel is up

Answer

Enable VPC Flow Logs and analyze them for dropped packets

Answer

Check the network ACLs for the subnet to ensure they allow inbound traffic from on-premises

Question 9

A company is deploying a web application on EC2 instances behind an ALB. The application must be accessible only over HTTPS. Which security group rule should be added to the ALB security group?

Accepted Answer

Inbound: TCP port 443 from 0.0.0.0/0. The ALB must terminate HTTPS traffic, which requires an inbound rule allowing TCP port 443 (HTTPS) from 0.0.0.0/0. This ensures clients can establish encrypted TLS connections to the load balancer, as the application is only accessible over HTTPS.

Answer

Inbound: TCP port 22 from 0.0.0.0/0

Answer

Inbound: TCP port 3306 from 0.0.0.0/0

Answer

Inbound: TCP port 80 from 0.0.0.0/0

Question 10

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure high availability by using two tunnels. Which two components must be configured to achieve this? (Choose TWO.)

Accepted Answer

Two customer gateways, each with a unique public IP address. Options A and D are correct. Two customer gateways are needed for two tunnels (one per tunnel endpoint), and the virtual private gateway must have two BGP sessions, one per tunnel. Option B is wrong because one VPN connection can have two tunnels. Option C is wrong because a Transit Gateway is not required. Option E is wrong because one customer gateway is insufficient.

Answer

A single customer gateway with two IP addresses

Answer

An AWS Transit Gateway

Answer

Two VPN connections

Question 11

A company is using AWS Transit Gateway with multiple VPCs and Direct Connect Gateway. They want to ensure that traffic between VPCs and on-premises is encrypted. Which TWO solutions can achieve this?

Accepted Answer

Enable MACsec on the Direct Connect connection. Options B and D are correct. A VPN attachment on the Transit Gateway encrypts traffic between the Transit Gateway and on-premises VPN device. MACsec on the Direct Connect connection encrypts traffic at Layer 2. Option A is incorrect because IPsec over a private VIF is not possible; IPsec is used over public VIF or VPN. Option C is incorrect because Transit Gateway does not support IPsec natively. Option E is incorrect because VPC peering does not involve on-premises.

Answer

Use Transit Gateway IPsec VPN to encrypt traffic between VPCs

Answer

Enable IPsec on the private virtual interface

Answer

Use VPC peering with encryption

Question 12

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Accepted Answer

Direct Connect private virtual interface. Options A, C, and D are correct. A Direct Connect gateway is needed to connect the Direct Connect connection to the Transit Gateway. A Transit Gateway is the central hub. A Direct Connect virtual interface is the connection from on-premises to AWS. Option B is wrong because a VPN connection is not required. Option E is wrong because a VPC peering connection is not used with Transit Gateway.

Answer

VPC peering connection

Answer

AWS Site-to-Site VPN connection

Question 13

A network engineer is configuring a site-to-site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE components should the engineer check?

Accepted Answer

Security group rules on the VPC resources to allow inbound traffic from on-premises. Options A, C, and D are correct. The route table must have a route to the on-premises CIDR via the virtual private gateway. Security groups must allow traffic from on-premises. The on-premises firewall must allow IPsec traffic. Option B is incorrect because the internet gateway is not needed for VPN traffic. Option E is incorrect because NACLs are stateless and usually allow return traffic if outbound is permitted.

Answer

Network ACLs for the subnet to allow return traffic

Answer

Internet Gateway attachment to the VPC

Question 14

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer wants to use monitoring tools to identify the source of the latency. Which two AWS services can provide metrics and logs to help diagnose the issue? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. Options A and E are correct. CloudWatch provides metrics for Direct Connect (e.g., connection state, BGP status, packet loss). VPC Flow Logs capture IP traffic information that can be analyzed for latency patterns. Option B is wrong because CloudTrail logs API calls. Option C is wrong because AWS Config tracks configuration changes. Option D is wrong because Trusted Advisor provides recommendations, not real-time metrics.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 15

A network engineer is troubleshooting an issue where an EC2 instance launched in VPC vpc-0abcd1234efgh5678 cannot resolve DNS names for other instances using their private DNS names. The VPC has DHCP options set with domain-name-servers=AmazonProvidedDNS. What is the most likely cause?

Accepted Answer

The VPC attribute 'enableDnsHostnames' is set to false. Option B is correct because the command shows that EnableDnsHostnames is false, which means instances do not get DNS hostnames. Option A is incorrect because the DHCP option set is correct. Option C is incorrect because VPC Flow Logs are for network traffic, not DNS. Option D is incorrect because security groups do not affect DNS resolution.

Answer

VPC Flow Logs are not enabled

Answer

The security group on the instances blocks DNS traffic

Answer

The DHCP options set is not using AmazonProvidedDNS