ANS-C01 Network Management and Operations Practice Test 6 — 15 Questions

Question 1

A network engineer is troubleshooting why an EC2 instance (with the above security group) is not responding to HTTP requests from the internet. The instance is in a public subnet with an Internet Gateway attached. The route table has a default route to the Internet Gateway. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security group only allows traffic from the 10.0.0.0/8 range. The security group's inbound rules restrict HTTP (port 80) to sources within 10.0.0.0/8, which is a private RFC 1918 range and cannot include public internet clients. Since the instance is in a public subnet with a working IGW route, the SG source restriction is the only thing blocking external HTTP. Security groups are stateful and default-deny, so any inbound rule not matching the client's public IP will drop the request.

Answer

The security group does not allow inbound ICMP traffic

Answer

The route table does not have a route for the internet

Answer

The network ACL is blocking inbound HTTP

Question 2

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The network engineer needs to capture all traffic between the VPC and the internet. Which THREE resources must have VPC Flow Logs enabled?

Accepted Answer

Internet gateway. VPC Flow Logs can be enabled at three levels: VPC, subnet, or network interface, but to capture traffic between the VPC and the internet, the specific gateway resources handling that traffic must be targeted. Option A (Internet gateway) is correct because it is the resource through which all IPv4 and IPv6 traffic flows between the VPC and the internet, so enabling flow logs on it captures that traffic. Option B (NAT gateway) is correct because it handles outbound IPv4 traffic from private subnets to the internet, and flow logs on the NAT gateway capture that traffic. Option E (Egress-only internet gateway) is correct because it handles outbound IPv6 traffic from the VPC to the internet, and flow logs on it capture that IPv6 traffic. Options C (Subnet) and D (VPC) are not required because flow logs at those levels capture traffic within the VPC, not specifically the internet-bound traffic through the gateways; the question asks for the resources that must have flow logs enabled to capture all traffic between the VPC and the internet, which are the gateway resources.

Answer

Subnet

Answer

VPC

Question 3

A company needs to centrally manage network security policies across multiple VPCs and on-premises networks. Which AWS service provides a centralized dashboard for managing firewall rules?

Accepted Answer

AWS Network Firewall. AWS Network Firewall offers a centralized dashboard for managing network-level firewall rules across multiple VPCs and on-premises networks, with policy-based management. Option A is incorrect because Network ACLs are stateless, applied at the subnet level, and lack centralized management capabilities. Option B is incorrect because Security Groups are stateful, applied at the ENI level, and not designed for centralized cross-VPC management. Option C is incorrect because AWS WAF protects web applications at the application layer (HTTP/S), not network-layer firewall rules.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF

Question 4

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They want to centralize outbound internet traffic through a single VPC with a NAT gateway. The security team requires that all traffic to the internet must be logged. Which solution is MOST operationally efficient?

Accepted Answer

Enable VPC Flow Logs on the central VPC and publish to Amazon CloudWatch Logs. Enabling VPC Flow Logs on the central VPC and publishing to CloudWatch Logs is the most operationally efficient because it captures all traffic traversing the central VPC's network interfaces, including NAT gateway traffic, and CloudWatch Logs provides native querying, metric filters, and alarms without managing additional infrastructure. This centralizes logging for the hub VPC that handles all outbound internet traffic. It satisfies the security requirement to log all internet-bound traffic with minimal operational overhead.

Answer

Enable VPC Flow Logs on the NAT gateway's subnet and publish to Amazon S3

Answer

Deploy a third-party firewall appliance in the central VPC and enable logging

Answer

Enable AWS CloudTrail to log all network events

Question 5

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway. The network team wants to monitor DNS queries from EC2 instances in private subnets to a custom DNS resolver on-premises over a VPN. Which TWO services can capture this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic at the network interface level, including DNS queries (port 53) to any destination, such as a custom on-premises resolver over VPN. AWS Network Firewall can inspect and log DNS traffic that passes through it, including queries to custom resolvers. Option A (Route 53 Resolver query logs) is incorrect because it only logs queries made to Amazon Route 53 Resolver, not to custom on-premises resolvers. Option B (CloudWatch) is incorrect because CloudWatch does not directly capture network traffic; it can aggregate logs but cannot capture raw DNS packets. Option E (CloudTrail) is incorrect because it logs API calls to AWS services, not network traffic.

Answer

Amazon Route 53 Resolver query logs

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Question 6

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). They notice that traffic from on-premises to a VPC is being dropped. The VPC is associated with a private VIF. The on-premises router has a BGP route to the VPC's CIDR. The VPC's route table has a route to the virtual private gateway. What is the MOST likely cause of the dropped traffic?

Accepted Answer

The VPC route table does not have a route pointing to the virtual private gateway for the on-premises CIDR. For return traffic from on-premises to reach the VPC, the VPC route table must contain a route for the on-premises CIDR pointing to the virtual private gateway. The question states the VPC route table only has a route to the VGW (presumably for the VPC CIDR or a default), but not specifically for the on-premises CIDR, so packets arriving at the VPC have no matching route and are dropped.

Answer

The MTU size on the Direct Connect connection is too small

Answer

The BGP session is not established

Answer

The allowed prefixes on the virtual private gateway do not include the on-premises CIDR

Question 7

A network engineer created an IAM policy for a user to manage VPC Flow Logs. The user reports they cannot create flow logs and receive an 'AccessDenied' error. What is the MOST likely reason?

Accepted Answer

The logs:CreateLogGroup resource ARN is too restrictive.. When creating VPC Flow Logs to CloudWatch Logs, the caller must have logs:CreateLogGroup permission on the specific log group ARN, and if the policy scopes the resource to a log group that does not yet exist or uses a restrictive ARN pattern that does not match the target group, the CreateFlowLogs call fails with AccessDenied. The ec2:CreateFlowLogs action may be present, but the dependent logs permission is evaluated separately and is the most common cause of this error.

Answer

The ec2:CreateFlowLogs action is missing.

Answer

The logs:PutLogEvents action is missing.

Answer

The iam:PassRole action is missing for the flow logs role.

Question 8

A network engineer is setting up a site-to-site VPN connection between an on-premises network and AWS. After configuring the customer gateway, virtual private gateway, and VPN tunnel, the tunnel status shows 'DOWN'. Which step should the engineer take FIRST to troubleshoot?

Accepted Answer

Check the on-premises VPN device configuration for mismatched parameters. The first troubleshooting step when a VPN tunnel is down is to check the on-premises VPN device configuration for mismatched parameters (e.g., pre-shared keys, encryption algorithms, etc.). Option A is incorrect because route propagation is relevant only after the tunnel is up; it does not cause the tunnel to be down. Option B is incorrect because CloudWatch metrics provide monitoring after the tunnel is established, not initial troubleshooting. Option C is incorrect because pinging an EC2 instance requires the tunnel to be up; it will fail if the tunnel is down.

Answer

Verify that route propagation is enabled on the VPC route table

Answer

Enable detailed CloudWatch metrics on the VPN connection

Answer

Test connectivity by pinging an EC2 instance in the VPC

Question 9

A financial company has a multi-account AWS environment using AWS Organizations. They have deployed a centralized inspection VPC with a third-party firewall appliance. All VPCs are attached to a Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by the firewall. The firewall is deployed in an Auto Scaling group behind a Network Load Balancer (NLB). What is the BEST way to route traffic to the firewall?

Accepted Answer

Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.. The best approach. By creating a Transit Gateway attachment in the inspection VPC and configuring the Network Load Balancer (NLB) as the target, all inter-VPC traffic can be routed through the firewall via Transit Gateway route tables. This ensures centralized inspection without introducing complexity. Option A is incorrect because a Gateway Load Balancer (GWLB) is not needed here; the NLB already provides load balancing for the firewall instances. Option B is incorrect because VPC peering bypasses the Transit Gateway, defeating centralized inspection. Option C is incorrect because deploying a firewall in each VPC is not centralized and increases management overhead.

Answer

Use a Gateway Load Balancer (GWLB) endpoint in each VPC to route traffic to the firewall.

Answer

Use VPC peering between each VPC and the inspection VPC.

Answer

Deploy a firewall appliance in each VPC and route traffic locally.

Question 10

A company's VPC includes a public subnet with a NAT gateway and a private subnet with EC2 instances. The EC2 instances in the private subnet need to access the internet for software updates. The NAT gateway's Elastic IP is associated correctly, and the route tables are configured. However, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table for the private subnet is missing a default route pointing to the NAT gateway.. For a private subnet's EC2 instances to reach the internet through a NAT gateway, the private subnet's route table must contain a default route (0.0.0.0/0) targeting the NAT gateway. If that route is missing, instances have no path to the NAT gateway and cannot reach the internet, even if the NAT gateway and its Elastic IP are correctly configured. This is the most likely cause given the scenario.

Answer

The NAT gateway is in the private subnet.

Answer

The network ACL for the private subnet is blocking outbound traffic.

Answer

The security group for the EC2 instances does not allow outbound traffic.

Question 11

A network engineer is troubleshooting intermittent connectivity issues between two VPCs that are peered. The VPC peering connection is in the 'active' state. ICMP ping from an instance in VPC A to an instance in VPC B fails intermittently. What is the most likely cause?

Accepted Answer

The route tables in one or both VPCs lack routes to the peer VPC's CIDR via the peering connection.. Since the VPC peering connection is active, the issue is likely that the route tables in one or both VPCs are not correctly configured to route traffic to the peered VPC's CIDR via the peering connection. Without proper routes, traffic is dropped.

Answer

The network ACLs are blocking ICMP traffic.

Answer

The security groups on the instances do not allow inbound ICMP.

Answer

The VPC peering connection is not in the 'active' state.

Question 12

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that the BGP session for the public VIF is flapping intermittently. Which configuration change on the customer router would most likely stabilize the BGP session?

Accepted Answer

Configure BGP route filtering to limit the number of routes advertised to AWS to no more than 100.. AWS Direct Connect public VIFs have a documented limit of 100 route prefixes that the customer can advertise to AWS over the BGP session; exceeding this causes AWS to reject the session or reset it, leading to flapping. Applying an outbound route filter (e.g., a prefix-list or route-map) on the customer router to advertise no more than 100 prefixes keeps the session within AWS's limit and stabilizes it.

Answer

Set the BGP multi-hop TTL to 255.

Answer

Increase the BGP hold timer to 180 seconds.

Answer

Disable BGP fast-external-fallover on the customer router.

Question 13

A company has a Direct Connect connection with a public VIF to access AWS public services. They notice that traffic to Amazon S3 is taking a suboptimal path via the internet instead of the Direct Connect. What is the MOST likely cause?

Accepted Answer

The on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect. For a public VIF, AWS advertises AWS public service prefixes (including S3) over BGP, but the on-premises router must have a route for those S3 CIDRs pointing to the Direct Connect interface. If the router lacks that route, traffic falls back to the internet path even though the VIF is up and BGP is exchanging routes.

Answer

The BGP session for the public VIF is not advertising the S3 prefixes

Answer

The public VIF is in a 'DOWN' state

Answer

The virtual private gateway is not attached to the VPC

Question 14

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for compliance. The logs should be published to a central S3 bucket in the logging account. The logging account has an S3 bucket policy that allows cross-account writes. However, flow logs are not being delivered. What is the most likely missing configuration?

Accepted Answer

The source account lacks an IAM role that grants the Flow Logs service permission to write to the central S3 bucket.. For cross-account flow log delivery, the source account must have an IAM role that trusts the logging account and allows the flow logs service to assume it. The role must have permissions to write to the S3 bucket. Without this role, logs cannot be delivered.

Answer

The VPC Flow Logs service is not enabled in the source account.

Answer

The S3 bucket policy does not grant 's3:PutObject' to the source account.

Answer

The VPC Flow Logs destination is set to CloudWatch Logs instead of S3.

Question 15

A network engineer is troubleshooting high latency on a Direct Connect connection. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Run a continuous 'mtr' from on-premises to an AWS resource. Option C is correct because running a continuous 'mtr' (My Traceroute) from on-premises to an AWS resource provides hop-by-hop latency and packet loss statistics, which is essential for pinpointing where along the Direct Connect path the high latency is introduced. Option D is correct because reviewing CloudWatch metrics for the Direct Connect virtual interface (such as VirtualInterfaceBpsIngress/Egress, PacketDropCount, and ConnectionState) gives visibility into the AWS-side performance and health of the dedicated connection. Option A is not the best choice because BGP session status only confirms whether routes are being exchanged, not the latency characteristics of the data path. Option B is incorrect because VPC Flow Logs capture IP traffic metadata within the VPC but do not measure latency or diagnose Direct Connect path issues. Option E is not selected because a single traceroute provides only a one-time snapshot, whereas continuous monitoring (as in option C) is needed to observe intermittent latency patterns.

Answer

Check the BGP session status

Answer

Enable VPC Flow Logs on the VPC

Answer

Run a traceroute from on-premises to an AWS IP address