ANS-C01 Network Management and Operations Practice Test 6 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic is intermittently dropping and the BGP session between the on-premises router and the AWS Direct Connect virtual interface goes down. Which configuration should be checked first to resolve this issue?

Accepted Answer

Ensure the BGP hold timer values are consistent on both ends. The BGP hold timer mismatch can cause session flapping. Option B is correct because setting the hold timer to a consistent value (e.g., 30 seconds) on both sides stabilizes the session. Option A is wrong because increasing the BGP timers may mask the issue but doesn't address the root cause. Option C is wrong because AWS allows BGP authentication. Option D is wrong because MD5 authentication is supported.

Answer

Increase the BGP keepalive timer on the on-premises router to 90 seconds

Answer

Disable BGP authentication on the virtual interface

Answer

Enable BGP MD5 authentication on the on-premises router

Question 2

A network engineer is configuring VPC Flow Logs to deliver to an S3 bucket in a different account. The bucket policy is shown. The flow logs are not being delivered. What is the most likely reason?

Accepted Answer

The aws:SourceArn condition restricts access to a specific account, but the flow logs are from a different account. Option C is correct because the bucket policy uses the log delivery service principal from account 123456789012, but the flow logs are from a different account. The policy needs to allow access for the source account's log delivery service. Option A is incorrect because the action is correct. Option B is incorrect because the resource includes the full path. Option D is incorrect because the Principal is correct for cross-account delivery.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject

Answer

The Principal must be the destination account's log delivery service

Answer

The Resource does not include the bucket ARN itself

Question 3

A network engineer is designing a multi-region architecture using AWS Transit Gateway and wants to minimize inter-region latency for data transfer between VPCs. The application requires high throughput and low latency. Which design should be used?

Accepted Answer

Use Transit Gateway inter-region peering between Transit Gateways. Option C is correct because Transit Gateway inter-region peering provides direct, encrypted connections with low latency. Option A is wrong because VPC peering is limited to two VPCs and does not scale. Option B is wrong because VPN adds overhead and latency. Option D is wrong because VPC endpoints are for service access, not inter-VPC traffic.

Answer

Establish VPC peering connections between all VPCs across regions

Answer

Use AWS Site-to-Site VPN between Transit Gateways in each region

Answer

Configure VPC endpoints to route traffic through AWS backbone

Question 4

A network engineer is troubleshooting SSH connectivity to an EC2 instance in subnet subnet-0abcd1234efgh5678, which is associated with the network ACL shown. The security group allows inbound SSH. Why can't the engineer SSH to the instance?

Accepted Answer

The network ACL is not associated with the subnet. Option C is correct because network ACLs are evaluated in order of rule number; rule 100 allows SSH, but rule 200 denies SSH (same port, but deny overrides allow because it is evaluated later? Actually, in NACLs, rules are evaluated from lowest to highest, and the first matching rule determines the action. Since rule 100 allows, rule 200 is never reached. However, rule 300 denies all traffic. Since rule 300 has a higher number, it will not override earlier allow rules. Wait: The correct behavior: NACL rules are processed in order; the first rule that matches the traffic determines the action. Since rule 100 matches SSH traffic and allows it, rule 200 and 300 are not evaluated for that traffic. So SSH should be allowed. But the question says can't SSH. Let me re-check: The exhibit shows rule 100 allows SSH, rule 200 denies SSH (same criterion), rule 300 denies all traffic. Since rule 100 matches first, SSH should be allowed. So maybe the issue is that the subnet is not associated with this NACL? Or maybe the security group is blocking? But the security group allows SSH. The most likely cause is that the NACL's inbound rule 100 allows SSH, but the outbound rules might be blocking. However, the exhibit only shows inbound entries. Option A is incorrect because rule 300 is a deny-all, but it is evaluated after rule 100. Option B is incorrect because rule 200 is a deny, but it is not evaluated. Option D is incorrect because security groups are stateful. Actually, the correct answer might be that the NACL's outbound rules are causing the issue, but the exhibit does not show outbound rules. However, since the question asks about the exhibit, we need to pick the best answer. The exhibit shows only inbound rules; maybe the outbound default deny is blocking return traffic? But NACLs are stateless, so return traffic must be allowed by outbound rules. The exhibit does not show outbound rules. The default outbound rule is deny all. So that could be the issue. But among the options, none mention outbound. Let me re-read the options. Option A: 'The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule.' This is incorrect because rule 100 is processed first. Option B: 'The network ACL rule 200 denies SSH traffic, overriding rule 100.' Incorrect because rule 100 is processed first. Option C: 'The network ACL is not associated with the subnet.' This could be the reason. Option D: 'The security group is blocking SSH traffic.' But the scenario says security group allows SSH. So most likely, the NACL is not associated. Therefore, option C is correct.

Answer

The security group is blocking SSH traffic

Answer

The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule

Answer

The network ACL rule 200 denies SSH traffic, overriding rule 100

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?

Accepted Answer

Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway. Option B is correct because the NAT Gateway's Elastic IP must be associated and the route table of the private subnet must point to the NAT Gateway. Option A is wrong because the NAT Gateway is in the public subnet. Option C is wrong because an Internet Gateway is attached to the VPC, not the subnet. Option D is wrong because the NAT Gateway is not in a public subnet if it has an EIP and route to IGW.

Answer

Move the NAT Gateway to a private subnet

Answer

Verify that the NAT Gateway is in the same subnet as the EC2 instance

Answer

Attach an Internet Gateway to the private subnet

Question 6

A network engineer needs to capture TCP traffic between an EC2 instance (eni-abc123) and an RDS instance (eni-def456) in the same VPC for troubleshooting. Which AWS service should be used to capture the traffic and store it in S3?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information at the network interface level and can publish logs to S3. Option C is correct. Options A, B, and D are not designed for packet capture or do not capture traffic between two specific ENIs.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 7

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its data center to a VPC. The network team needs to ensure high availability and failover in case the primary connection fails. Which solution provides the most cost-effective high availability?

Accepted Answer

Provision a second Direct Connect connection at a different AWS Direct Connect location and configure BGP with AS_PATH prepending. Option C is correct because using a second Direct Connect connection to a different AWS Direct Connect location provides geographic redundancy. Option A is wrong because it's a single point of failure. Option B is wrong because VPN over the same Direct Connect relies on the same physical connection. Option D is wrong because adding a VPN over the internet provides a backup but is not as reliable as a second Direct Connect.

Answer

Use a VPN connection over the internet as a backup

Answer

Use a VPN connection over the same Direct Connect connection as backup

Answer

Provision a second private virtual interface on the same Direct Connect connection

Question 8

A company has deployed a transit gateway with multiple VPC attachments and VPN attachments. The network team notices that traffic between two VPCs is taking an unexpected path and experiencing high latency. Which tool should be used to trace the path and identify the specific transit gateway route table that is being used?

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer performs connectivity and path analysis between sources and destinations, showing the route table decisions. Option B is correct. Options A, C, and D are not designed for path tracing.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch ServiceLens

Answer

AWS X-Ray

Question 9

A network engineer is troubleshooting connectivity issues between two VPCs that are connected via VPC peering. The VPCs are in the same region and have overlapping CIDR blocks. The engineer can ping the private IP of an instance in the peered VPC from an instance in the first VPC. However, traffic on TCP port 443 (HTTPS) fails. Which is the most likely cause?

Accepted Answer

The security group of the target instance does not allow inbound HTTPS traffic from the source. Option A is correct because the security group of the target instance must allow inbound HTTPS traffic from the source instance's security group or CIDR. Option B is wrong because ICMP works. Option C is wrong because the route table has a route to the peering connection. Option D is wrong because NACLs are stateless and would block ICMP too if misconfigured.

Answer

The network ACL in the target subnet is blocking inbound HTTPS traffic

Answer

The VPC peering connection is not in the 'active' state

Answer

The route tables in both VPCs do not have routes to the peered VPC's CIDR

Question 10

A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?

Accepted Answer

Transit Gateway with a security appliance in a central VPC. Option B is correct because Transit Gateway with a middlebox appliance (e.g., firewall) in a shared services VPC allows traffic inspection. Option A is wrong because VPC peering is point-to-point and not centralized. Option C is wrong because AWS Network Firewall can be used but Transit Gateway provides the architecture for central inspection. Option D is wrong because Route 53 is DNS.

Answer

VPC peering

Answer

AWS Route 53 Resolver

Answer

AWS Network Firewall

Question 11

A company is using AWS Direct Connect with a private VIF to connect to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot establish TCP connections to an EC2 instance's private IP. The security groups and NACLs are configured to allow the traffic. What is the most likely cause of this issue?

Accepted Answer

The EC2 instance's operating system firewall is blocking TCP traffic. If pings work but TCP connections fail, the issue is likely at Layer 4 or above. The most common cause is the EC2 instance's operating system firewall (e.g., iptables) blocking inbound TCP. Option D is correct. Options A, B, and C are Layer 3 issues that would affect ping as well.

Answer

The Direct Connect virtual interface is in a down state

Answer

The on-premises firewall is blocking ICMP but not TCP

Answer

The VPC route table is missing a route for the on-premises CIDR

Question 12

A company has multiple AWS accounts and wants to centralize VPC flow logs for analysis. The flow logs are published to Amazon S3 in each account. A central account needs to access these logs. Which solution meets the requirements with the least operational overhead?

Accepted Answer

Use S3 bucket policies in each account to grant the central account access. Option C is correct because cross-account bucket policies allow the central account to access logs without additional infrastructure. Option A is wrong because VPC peering does not grant S3 access. Option B is wrong because Transit Gateway does not provide S3 access. Option D is wrong because it adds complexity.

Answer

Set up AWS Glue jobs to copy logs to a central S3 bucket

Answer

Use AWS Transit Gateway to centralize network traffic and capture logs

Answer

Use VPC peering to connect the accounts and access the S3 buckets directly

Question 13

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel status shows 'UP' but traffic is not passing. The engineer checks the route tables and finds that the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely missing configuration?

Accepted Answer

The VPN tunnel is using the wrong pre-shared key. For a VPN to pass traffic, the on-premises router must have a route pointing back to the VPC CIDR via the VPN tunnel. Option B is correct. Options A, C, and D are either already done or not directly related to traffic passing.

Answer

The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway

Answer

The security group of the EC2 instances does not allow inbound traffic from on-premises

Answer

The on-premises router is not advertising the VPC CIDR over BGP

Question 14

A network engineer is configuring an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer creates a customer gateway, VPN connection, and virtual private gateway. The VPN tunnel status shows 'down'. Which configuration step is most likely missing?

Accepted Answer

Configure the on-premises router with the correct pre-shared key and tunnel IP addresses. Option C is correct because the on-premises router must have the correct tunnel interface configuration matching AWS parameters. Option A is wrong because route propagation is for dynamic routing, not tunnel establishment. Option B is wrong because the VPN connection includes the tunnel configuration. Option D is wrong because propagation is not required for tunnel status.

Answer

Attach the VPN connection to the virtual private gateway

Answer

Enable route propagation on the virtual private gateway

Answer

Add a static route to the VPN connection in the route table

Question 15

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance is associated with an Elastic IP address. The route table for the private subnet has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in the public subnet and has an Elastic IP. Despite this, the instance cannot reach the internet. The security groups and NACLs are properly configured. What is the likely cause?

Accepted Answer

The NAT gateway's Elastic IP is not associated with the NAT gateway. If an instance has a public IP (Elastic IP) and is in a private subnet, the route to the internet must go through a NAT gateway or Internet Gateway. The private subnet's route table points to NAT, which is correct. However, the NAT gateway itself must have a route to the internet via an Internet Gateway. Option C is correct. Options A, B, and D are common misconfigurations but not the most likely given the setup.

Answer

The NAT gateway is not in a public subnet

Answer

The private subnet's network ACL is blocking outbound traffic

Answer

The EC2 instance does not have a route to the internet