ANS-C01 Network Management and Operations Practice Test 6 — 15 Questions

Question 1

A company wants to monitor network traffic between its EC2 instances and determine which IP addresses are generating the most traffic. Which AWS service should be used to capture and analyze this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling analysis of traffic patterns and identification of high-traffic IP addresses. AWS Trusted Advisor (Option A) provides best-practice checks, not traffic data. AWS CloudTrail (Option B) records API calls, not network traffic. AWS Config (Option C) tracks resource configuration changes.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

AWS Config

Question 2

A company has a Direct Connect connection with a private VIF and a public VIF. The private VIF is used to access VPC resources, and the public VIF is used to access AWS public services. Recently, the company enabled AWS Global Accelerator for its application. The network team notices that traffic to the application via Global Accelerator is not using the Direct Connect connection but is going over the internet. What should the team do to ensure traffic uses the Direct Connect public VIF?

Accepted Answer

Configure a VPN connection over the Direct Connect public VIF to route Global Accelerator traffic. Global Accelerator uses static anycast IP addresses that are not directly reachable over a Direct Connect public VIF. The public VIF provides access to AWS public services via the Direct Connect connection, but Global Accelerator IPs are not advertised over the BGP session. To route on-premises traffic to Global Accelerator through Direct Connect, you must establish a VPN connection over the public VIF. This VPN tunnel encapsulates the traffic and sends it over the Direct Connect link, ensuring it does not traverse the public internet. Option B is incorrect because you cannot advertise Global Accelerator IPs from your on-premises router; they are owned and advertised by AWS. Option C is incorrect because a Direct Connect gateway is used for private VIFs and does not integrate with Global Accelerator. Option D is incorrect because a private VIF is for accessing VPC resources, not public services like Global Accelerator.

Answer

Advertise the Global Accelerator IP addresses on the on-premises router to route traffic via the public VIF

Answer

Attach a Direct Connect gateway to the Global Accelerator

Answer

Create a private VIF for Global Accelerator traffic

Question 3

A company has an AWS Direct Connect connection with a private VIF to a VPC. They notice that traffic from the on-premises network to the VPC is being routed through the internet instead of the Direct Connect. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the prefix via BGP over the Direct Connect. If the on-premises router is not advertising the prefix via BGP over the Direct Connect, the VPC will not have a route to the on-premises network through the Direct Connect, causing traffic to go over the internet. Option A is incorrect because if the virtual private gateway were not attached, the VPC would have no route to the on-premises network at all. Option B is incorrect because security groups do not affect routing decisions; they filter traffic at the instance level. Option C is incorrect because a more specific route would still use the virtual private gateway, not the internet.

Answer

The virtual private gateway is not attached to the VPC

Answer

The security group on the VPC resources blocks the traffic

Answer

The on-premises CIDR is more specific than the VPC route table entry

Question 4

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?

Accepted Answer

The NAT Gateway is in a private subnet. The NAT Gateway must be in a public subnet with an internet gateway route to function. Option A is wrong because the NAT Gateway itself does not have a route; the route table of the subnet where it resides needs a route to the internet gateway. Option C is wrong because security groups are for instances, not NAT Gateways. Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.

Answer

The NAT Gateway does not have a route to the internet gateway

Answer

The VPC does not have a VPC endpoint for the software update service

Answer

The security group attached to the NAT Gateway is blocking traffic

Question 5

A company uses AWS Global Accelerator to improve performance for a global application. The application is deployed in two AWS regions behind Network Load Balancers. Users in Asia report high latency even though the accelerator should route them to the nearest endpoint. What is the most likely reason?

Accepted Answer

The endpoint in the closer region is marked unhealthy. If the endpoint in the closer region is marked unhealthy, Global Accelerator will automatically route traffic to the next nearest healthy endpoint, which may be in a distant region, causing high latency. Option B is incorrect because if Traffic Dial were set to 100% for the distant region, traffic would be intentionally routed there, so users would not expect routing to the nearest endpoint. Option C is incorrect because on-premises endpoints are not typical for Global Accelerator, and even if used, they would not cause high latency specifically for Asian users if the closer region has healthy endpoints. Option D is incorrect because client affinity affects stickiness, not overall latency; it would not cause all Asian users to experience high latency.

Answer

Traffic Dial is set to 100% for the distant region

Answer

The accelerator is configured with on-premises endpoints

Answer

Client affinity is set to source IP

Question 6

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure that if the primary VPN tunnel goes down, traffic automatically fails over to the secondary tunnel. Which configuration is required?

Accepted Answer

Enable dynamic routing (BGP) on the VPN connection. Dynamic routing with BGP enables automatic failover between VPN tunnels because BGP advertises routes and automatically withdraws them when a tunnel fails, causing the routing table to update and traffic to use the other tunnel. Static routes (A) require manual intervention for failover, as they do not dynamically adapt. VPN CloudHub (B) is designed to interconnect multiple VPN connections, not for failover between tunnels. Configuring a second customer gateway device (D) is necessary for redundancy but does not itself enable automatic failover without BGP.

Answer

Use static routes with equal-cost multipath (ECMP)

Answer

Enable VPN CloudHub

Answer

Configure a second customer gateway device

Question 7

A network engineer is monitoring network traffic using VPC Flow Logs. The engineer wants to capture traffic that is rejected by security groups and network ACLs. Which flow log format should be used?

Accepted Answer

Custom format with 'action' field. The default VPC Flow Log format includes the action field, so it does capture ACCEPT/REJECT information. However, a common myth is that the default format omits the action field. In reality, both default and custom formats can capture rejected traffic. The correct answer is D because a custom format that explicitly includes the action field is the targeted way to capture only the rejection status, reducing log volume and making analysis easier. Option A is incorrect because it is not the most efficient approach; it logs many unnecessary fields. Options B and C are irrelevant or incomplete.

Answer

Default format

Answer

Flow logs are delivered to CloudWatch Logs with DNS query logs

Answer

Custom format with 'srcaddr' and 'dstaddr' only

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path, going through the on-premises network instead of staying within AWS. What is the most likely cause?

Accepted Answer

The Transit Gateway route table has a propagated route from the on-premises network with a longer prefix. When a Transit Gateway route table contains a propagated route from an on-premises network with a longer prefix (more specific) than the local VPC route, traffic destined for that specific CIDR will be sent to the on-premises network instead of using the inter-VPC route. This is because more specific routes take precedence over less specific ones. The suboptimal path occurs because the traffic is forced through the on-premises network, even though both VPCs are attached to the Transit Gateway and could communicate directly within AWS. Option A is correct. Option B is incorrect because VPC peering is not used with Transit Gateway; if peering existed, it could create route conflicts, but the scenario describes Transit Gateway. Option C is incorrect because VPC Flow Logs are for monitoring traffic and do not affect routing. Option D is incorrect because security groups are stateful firewalls that control traffic, but they do not determine routing paths; routing is controlled by route tables.

Answer

The VPCs are also peered directly, creating a conflict

Answer

VPC Flow Logs are enabled, causing latency

Answer

Security groups are blocking direct traffic between VPCs

Question 9

A company is migrating its on-premises data center to AWS. The network team needs to establish a site-to-site VPN connection with dynamic routing using BGP. The on-premises router supports BGP but does not support BGP communities. The VPN connection is established, but the VPC does not learn the on-premises routes. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising any prefixes over BGP. For the VPC to learn on-premises routes via BGP, the on-premises router must advertise its prefixes over the BGP session. Without any route advertisement, the VPC cannot learn the routes regardless of VPN tunnel status. Option A is incorrect because authentication method (pre-shared keys vs certificates) does not affect route advertisement. Option B is incorrect because with dynamic routing using BGP, a static route is not required; BGP automatically exchanges routes if both peers advertise them. Option C is incorrect because the scenario states the VPN connection is established, implying the tunnel is UP.

Answer

The VPN tunnel uses pre-shared keys instead of certificates

Answer

The VPC route table needs a static route to the on-premises CIDR

Answer

The VPN tunnel is not in a UP state

Question 10

A company has a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic only from the ALB security group. However, the health checks are failing. What is the most likely cause?

Accepted Answer

The target group is not configured with the correct health check path. The most likely cause of health check failures is an incorrect health check path configured in the target group. The security group configuration described in the stem should allow health check traffic because the EC2 security group explicitly allows inbound traffic from the ALB security group. However, if the target group's health check path does not match the actual endpoint on the EC2 instances (e.g., it expects a 200 response from a specific URL that is not available), the health checks will fail. Option B is incorrect because ALBs can be placed in private subnets without issue. Option C is incorrect because the stem states the EC2 security group allows inbound traffic from the ALB security group. Option D is incorrect because outbound rules on the ALB security group do not affect inbound health checks.

Answer

The ALB is in a private subnet

Answer

The EC2 security group does not allow inbound traffic from the ALB security group

Answer

The ALB security group does not allow outbound traffic

Question 11

A network engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a public subnet and an on-premises server over AWS Direct Connect. The instance can reach the internet but cannot reach the on-premises server. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Check the VPC route table to ensure a route exists for the on-premises CIDR pointing to the virtual private gateway. The correct answers are A and C. For connectivity between an EC2 instance in a public subnet and an on-premises server over AWS Direct Connect, two key checks are: (1) The VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway (VGW) to route traffic to the Direct Connect connection. (2) The security group attached to the EC2 instance must allow inbound traffic from the on-premises CIDR, as security groups act as a stateful firewall for the instance. Option B is incorrect because Direct Connect uses a virtual private gateway, not a VPN tunnel. Option D is incorrect because VPC Flow Logs are used for analysis, not real-time diagnosis. Option E is incorrect because network ACLs are stateless; outbound traffic does not automatically allow return traffic, so explicit inbound rules are required for the return traffic.

Answer

Check the VPN connection status to ensure the tunnel is up

Answer

Enable VPC Flow Logs and analyze them for dropped packets

Answer

Check the network ACLs for the subnet to ensure they allow inbound traffic from on-premises

Question 12

A company is deploying a web application on EC2 instances behind an ALB. The application must be accessible only over HTTPS. Which security group rule should be added to the ALB security group?

Accepted Answer

Inbound: TCP port 443 from 0.0.0.0/0. The ALB must terminate HTTPS traffic, which requires an inbound rule allowing TCP port 443 (HTTPS) from 0.0.0.0/0. This ensures clients can establish encrypted TLS connections to the load balancer, as the application is only accessible over HTTPS.

Answer

Inbound: TCP port 22 from 0.0.0.0/0

Answer

Inbound: TCP port 3306 from 0.0.0.0/0

Answer

Inbound: TCP port 80 from 0.0.0.0/0

Question 13

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure high availability by using two tunnels. Which two components must be configured to achieve this? (Choose TWO.)

Accepted Answer

A virtual private gateway with two BGP sessions. For high availability with two tunnels in an AWS Site-to-Site VPN, a single VPN connection provides two tunnels by default, terminating on two different AWS endpoints. This requires only one customer gateway with a single public IP address. The virtual private gateway must be configured with two BGP sessions (one per tunnel) to support dynamic routing and automatic failover. Option C is incorrect because two customer gateways are unnecessary; one customer gateway with one IP suffices. Option D is incorrect because two VPN connections are not required—a single VPN connection already provides two tunnels. Option A is incorrect because a customer gateway cannot have two IP addresses. Option B is incorrect because an AWS Transit Gateway is optional and not required for a basic HA VPN setup.

Answer

A single customer gateway with two IP addresses

Answer

An AWS Transit Gateway

Answer

Two customer gateways, each with a unique public IP address

Answer

Two VPN connections

Question 14

A company is using AWS Transit Gateway with multiple VPCs and Direct Connect Gateway. They want to ensure that traffic between VPCs and on-premises is encrypted. Which TWO solutions can achieve this?

Accepted Answer

Enable MACsec on the Direct Connect connection. The correct answers are A and B. MACsec (802.1ae) encrypts traffic at Layer 2 on the Direct Connect connection, providing encryption between the on-premises device and AWS. A VPN attachment on the Transit Gateway establishes an IPsec VPN between the Transit Gateway and an on-premises VPN device, encrypting traffic at Layer 3. Option C is incorrect because Transit Gateway does not have native IPsec capabilities; it relies on VPN attachments for IPsec. Option D is incorrect because IPsec is not supported over a private virtual interface; IPsec is typically used over a public virtual interface or a VPN connection. Option E is incorrect because VPC peering does not extend to on-premises traffic; it is only between VPCs.

Answer

Use Transit Gateway IPsec VPN to encrypt traffic between VPCs

Answer

Enable IPsec on the private virtual interface

Answer

Use VPC peering with encryption

Question 15

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Accepted Answer

Direct Connect private virtual interface. Options A, B, and E are correct. A Direct Connect private virtual interface provides the physical connection from on-premises to AWS. AWS Transit Gateway serves as the central hub to interconnect multiple VPCs. A Direct Connect gateway is required to associate the Direct Connect virtual interface with the Transit Gateway, enabling connectivity to multiple VPCs in the same region. Options C and D are incorrect: VPC peering and Site-to-Site VPN are not required when using Transit Gateway with Direct Connect.

Answer

VPC peering connection

Answer

AWS Site-to-Site VPN connection