ANS-C01 Network Management and Operations Practice Test 7 — 15 Questions

Question 1

A network engineer is configuring a site-to-site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE components should the engineer check?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security group rules on the VPC resources to allow inbound traffic from on-premises. Options A, B, and E are correct. Security group rules must allow inbound traffic from the on-premises network (A). On-premises firewall rules must permit IPsec traffic (B). The VPC route table must have a route to the on-premises CIDR pointing to the virtual private gateway (E). Option C is incorrect because Network ACLs are stateless and require explicit inbound rules for return traffic; however, they are not the primary components to check when troubleshooting a site-to-site VPN that is established but not passing traffic. Option D is incorrect because an Internet Gateway is not used for VPN traffic; VPN traffic goes through the virtual private gateway.

Answer

Network ACLs for the subnet to allow return traffic

Answer

Internet Gateway attachment to the VPC

Question 2

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer wants to use monitoring tools to identify the source of the latency. Which two AWS services can provide metrics and logs to help diagnose the issue? (Choose TWO.)

Accepted Answer

Amazon CloudWatch. The correct answers are C (Amazon CloudWatch) and E (VPC Flow Logs). CloudWatch provides metrics for Direct Connect, including connection state, BGP status, packet loss, and latency. VPC Flow Logs capture IP traffic information that can be analyzed to identify latency patterns. Option A (AWS CloudTrail) is incorrect because it logs API calls, not network metrics. Option B (AWS Config) is incorrect because it tracks configuration changes. Option D (AWS Trusted Advisor) is incorrect because it provides recommendations, not real-time metrics or logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 3

A network engineer is troubleshooting an issue where an EC2 instance launched in VPC vpc-0abcd1234efgh5678 cannot resolve DNS names for other instances using their private DNS names. The VPC has DHCP options set with domain-name-servers=AmazonProvidedDNS. What is the most likely cause?

Accepted Answer

The VPC attribute 'enableDnsHostnames' is set to false. For an EC2 instance to resolve private DNS names using the Amazon-provided DNS server, the VPC must have both enableDnsSupport and enableDnsHostnames set to true. The DHCP options are correctly set to AmazonProvidedDNS, so the most likely cause is that enableDnsHostnames is false. Option B is incorrect because VPC Flow Logs are used for monitoring network traffic, not DNS resolution. Option C is incorrect because security groups by default allow all outbound traffic, and DNS traffic (UDP/53) is not blocked unless explicitly denied. Option D is incorrect because the DHCP options are already set to AmazonProvidedDNS as stated in the stem.

Answer

VPC Flow Logs are not enabled

Answer

The security group on the instances blocks DNS traffic

Answer

The DHCP options set is not using AmazonProvidedDNS

Question 4

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic is intermittently dropping and the BGP session between the on-premises router and the AWS Direct Connect virtual interface goes down. Which configuration should be checked first to resolve this issue?

Accepted Answer

Ensure the BGP hold timer values are consistent on both ends. Ensure the BGP hold timer values are consistent on both ends. A mismatch in BGP hold timers can cause the BGP session to flap intermittently. Configuring consistent hold times on both routers stabilizes the session. Option B is incorrect because increasing the keepalive timer may postpone failure detection but does not fix the root cause. Option C is incorrect because disabling BGP authentication is unnecessary and insecure. Option D is incorrect because enabling MD5 authentication is optional and unrelated to the flapping.

Answer

Increase the BGP keepalive timer on the on-premises router to 90 seconds

Answer

Disable BGP authentication on the virtual interface

Answer

Enable BGP MD5 authentication on the on-premises router

Question 5

A network engineer is configuring VPC Flow Logs to deliver to an S3 bucket in a different account. The bucket policy is shown. The flow logs are not being delivered. What is the most likely reason?

Accepted Answer

The aws:SourceArn condition restricts access to a specific account, but the flow logs are from a different account. The bucket policy uses the log delivery service principal from account 123456789012, but the flow logs are from a different account. The policy needs to allow access for the source account's log delivery service. Option A is incorrect because the action is correct. Option B is incorrect because the resource includes the full path. Option D is incorrect because the Principal is correct for cross-account delivery.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject

Answer

The Principal must be the destination account's log delivery service

Answer

The Resource does not include the bucket ARN itself

Question 6

A network engineer is designing a multi-region architecture using AWS Transit Gateway and wants to minimize inter-region latency for data transfer between VPCs. The application requires high throughput and low latency. Which design should be used?

Accepted Answer

Use Transit Gateway inter-region peering between Transit Gateways. Transit Gateway inter-region peering allows direct connectivity between Transit Gateways in different regions, using the AWS global backbone to minimize latency and maximize throughput. Option A (VPC peering) does not scale to multiple VPCs and regions. Option B (Site-to-Site VPN) introduces encryption overhead and potential latency. Option C (VPC endpoints) are for accessing AWS services, not for inter-VPC traffic. Therefore, Option D is the correct design for minimizing inter-region latency and achieving high throughput.

Answer

Establish VPC peering connections between all VPCs across regions

Answer

Use AWS Site-to-Site VPN between Transit Gateways in each region

Answer

Configure VPC endpoints to route traffic through AWS backbone

Question 7

A network engineer is troubleshooting SSH connectivity to an EC2 instance in subnet subnet-0abcd1234efgh5678, which is associated with the network ACL shown. The security group allows inbound SSH. Why can't the engineer SSH to the instance?

Accepted Answer

The network ACL rule 200 denies SSH traffic, overriding rule 100. The network ACL exhibit shows inbound rule 100 allowing HTTP traffic (port 80) and rule 200 denying SSH traffic (port 22). Since NACL rules are evaluated in ascending order, when an SSH packet arrives, rule 100 does not match (it allows HTTP, not SSH), so rule 200 matches and denies the traffic. Thus, SSH is blocked. Option A is wrong because the security group allows SSH. Option B is wrong because the subnet is associated with the NACL as stated. Option C is wrong because rule 300 is a higher-numbered rule and would only be evaluated if no earlier rule matched; here rule 200 already matches and denies SSH.

Answer

The security group is blocking SSH traffic

Answer

The network ACL is not associated with the subnet

Answer

The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule

Question 8

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance has a route to a NAT Gateway in the public subnet. However, the instance cannot reach the internet. Which step should the network engineer take to troubleshoot?

Accepted Answer

Verify that the NAT Gateway has an Elastic IP and the private subnet's route table has a route to the NAT Gateway. For a NAT Gateway to provide internet access to instances in a private subnet, it must have an Elastic IP (EIP) attached, and the private subnet's route table must include a route pointing to the NAT Gateway as the target for 0.0.0.0/0. Option A is wrong because NAT Gateways must reside in a public subnet (with a route to an Internet Gateway) to work. Option B is wrong because the NAT Gateway must be in the same VPC but not necessarily the same subnet as the EC2 instance; it should be in a public subnet. Option D is wrong because an Internet Gateway is attached to the VPC, not to individual subnets; attaching an Internet Gateway directly to a private subnet is not a valid configuration.

Answer

Move the NAT Gateway to a private subnet

Answer

Verify that the NAT Gateway is in the same subnet as the EC2 instance

Answer

Attach an Internet Gateway to the private subnet

Question 9

A network engineer needs to capture TCP traffic between an EC2 instance (eni-abc123) and an RDS instance (eni-def456) in the same VPC for troubleshooting. Which AWS service should be used to capture the traffic and store it in S3?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information at the network interface level and can be published to S3. They can filter traffic by ENI, so they can capture traffic between eni-abc123 and eni-def456. Option D is correct. Amazon Inspector (A) is for vulnerability assessment, not traffic capture. AWS CloudTrail (B) records API activity, not network traffic. AWS Config (C) tracks configuration changes, not packet-level data.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 10

A company uses AWS Direct Connect with a private virtual interface (VIF) to connect its data center to a VPC. The network team needs to ensure high availability and failover in case the primary connection fails. Which solution provides the most cost-effective high availability?

Accepted Answer

Provision a second Direct Connect connection at a different AWS Direct Connect location and configure BGP with AS_PATH prepending. Provisioning a second Direct Connect connection at a different AWS Direct Connect location provides geographic redundancy, and configuring BGP with AS_PATH prepending on the secondary connection ensures the primary connection is preferred under normal conditions. This offers high availability without relying on internet-based VPN, which, while cheaper, introduces variability and lower reliability. Option A (VPN over internet) is less costly but does not guarantee the same level of performance or reliability for hybrid networking. Option C (VPN over same Direct Connect) fails because it shares the same physical connection, creating a single point of failure. Option D (second private VIF on same connection) also shares the same physical infrastructure, so it does not provide true redundancy.

Answer

Use a VPN connection over the internet as a backup

Answer

Use a VPN connection over the same Direct Connect connection as backup

Answer

Provision a second private virtual interface on the same Direct Connect connection

Question 11

A company has deployed a transit gateway with multiple VPC attachments and VPN attachments. The network team notices that traffic between two VPCs is taking an unexpected path and experiencing high latency. Which tool should be used to trace the path and identify the specific transit gateway route table that is being used?

Accepted Answer

VPC Reachability Analyzer. VPC Reachability Analyzer performs connectivity and path analysis between sources and destinations, showing the route table decisions, including the specific transit gateway route table used. Option D is correct. Options A (CloudTrail), B (CloudWatch ServiceLens), and C (X-Ray) are not designed for path tracing.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch ServiceLens

Answer

AWS X-Ray

Question 12

A network engineer is troubleshooting connectivity issues between two VPCs that are connected via VPC peering. The VPCs are in the same region and have overlapping CIDR blocks. The engineer can ping the private IP of an instance in the peered VPC from an instance in the first VPC. However, traffic on TCP port 443 (HTTPS) fails. Which is the most likely cause?

Accepted Answer

The security group of the target instance does not allow inbound HTTPS traffic from the source. The security group of the target instance must allow inbound HTTPS traffic from the source instance's security group or CIDR. Option A is incorrect because ICMP works, indicating that network ACLs are allowing traffic; network ACLs are stateless and would block ICMP if misconfigured. Option C is incorrect because the VPC peering connection must be active for any traffic to pass, and ICMP works. Option D is incorrect because route tables must have routes to the peered VPC's CIDR for traffic to flow, and ICMP works.

Answer

The network ACL in the target subnet is blocking inbound HTTPS traffic

Answer

The VPC peering connection is not in the 'active' state

Answer

The route tables in both VPCs do not have routes to the peered VPC's CIDR

Question 13

A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?

Accepted Answer

Transit Gateway with a security appliance in a central VPC. Transit Gateway with a security appliance in a central VPC (Option D) is the correct approach because it allows centralized inspection of all traffic between subnets by routing traffic through a central inspection VPC where security appliances are deployed. Option A (VPC peering) is incorrect because it only provides direct connectivity between two VPCs and does not support centralized inspection. Option B (AWS Route 53 Resolver) is a DNS service and has no traffic inspection capability. Option C (AWS Network Firewall) is a managed firewall service, but it does not provide the multi-VPC architecture needed to centrally route traffic from multiple subnets/VPCs; Transit Gateway is required to route traffic to the firewall.

Answer

VPC peering

Answer

AWS Route 53 Resolver

Answer

AWS Network Firewall

Question 14

A company is using AWS Direct Connect with a private VIF to connect to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot establish TCP connections to an EC2 instance's private IP. The security groups and NACLs are configured to allow the traffic. What is the most likely cause of this issue?

Accepted Answer

The EC2 instance's operating system firewall is blocking TCP traffic. Since ICMP echo requests (pings) are working but TCP connections fail, the issue lies at Layer 4 or above. The EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) can be configured to allow ICMP while blocking inbound TCP, which matches the reported symptoms. Security groups and NACLs are correctly configured, so they are not the cause. Option A is correct. Option B is incorrect because a down VIF would block all traffic, including pings. Option C is the opposite—if the on-premises firewall were blocking ICMP, pings would fail. Option D is incorrect because a missing route would break all traffic, not just TCP.

Answer

The Direct Connect virtual interface is in a down state

Answer

The on-premises firewall is blocking ICMP but not TCP

Answer

The VPC route table is missing a route for the on-premises CIDR

Question 15

A company has multiple AWS accounts and wants to centralize VPC flow logs for analysis. The flow logs are published to Amazon S3 in each account. A central account needs to access these logs. Which solution meets the requirements with the least operational overhead?

Accepted Answer

Use S3 bucket policies in each account to grant the central account access. Using S3 bucket policies with cross-account permissions allows the central account to access the flow logs directly from the S3 buckets in each account without additional infrastructure. Option A is incorrect because AWS Glue jobs would add unnecessary operational overhead for copying data. Option B is incorrect because AWS Transit Gateway handles network traffic routing, not S3 access. Option C is incorrect because VPC peering provides network connectivity between VPCs but does not grant access to S3 buckets; S3 access is managed via IAM and bucket policies.

Answer

Set up AWS Glue jobs to copy logs to a central S3 bucket

Answer

Use AWS Transit Gateway to centralize network traffic and capture logs

Answer

Use VPC peering to connect the accounts and access the S3 buckets directly