ANS-C01 Network Management and Operations Practice Test 7 — 15 Questions

Question 1

A company is designing a multi-region network with Direct Connect. They have two Direct Connect connections in each region. They want to achieve the HIGHEST availability and lowest latency for cross-region traffic. Which THREE design elements should they include?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure BGP ASN prepending to influence path selection. Option A is correct because BGP ASN prepending lets you influence which Direct Connect path is preferred for cross-region traffic, helping ensure the lowest-latency path is selected. Option B is correct because using different Direct Connect providers in each region avoids a single provider as a shared failure domain and increases redundancy and availability. Option C is correct because using different Direct Connect locations within each region ensures that a failure at one Direct Connect location does not take down all connectivity in that region. Option D is not required for highest availability and lowest latency because multiple virtual interfaces on one connection do not protect against connection or location failure. Option E is not required and can even reduce routing flexibility, since using the same BGP ASN for all connections does not by itself improve availability or latency.

Answer

Use multiple virtual interfaces per Direct Connect connection

Answer

Use the same BGP ASN for all Direct Connect connections

Question 2

A company is using AWS Client VPN to provide remote access to employees. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a subnet, and authorization rules are configured. What is the most likely cause?

Accepted Answer

The Client VPN endpoint's security group does not allow inbound traffic from the client IP pool.. The most likely cause is that the Client VPN endpoint's security group does not allow inbound traffic from the client IP pool. When a Client VPN endpoint is associated with a subnet, the security group attached to the endpoint's elastic network interface must allow inbound traffic from the client CIDR block. If it doesn't, users can connect to the VPN but cannot reach VPC resources.

Answer

The VPC's network ACLs are blocking traffic.

Answer

The authorization rules are not associated with the correct groups.

Answer

The subnet association is missing.

Question 3

A network engineer notices that traffic from an EC2 instance in a public subnet to the internet is not working. The instance has a public IP assigned and is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What should the engineer check next?

Accepted Answer

Verify that the route table for the subnet has a 0.0.0.0/0 route pointing to the internet gateway.. The question states the instance is in a public subnet with a route to an internet gateway, but the correct answer asks to verify that the route table has a 0.0.0.0/0 route pointing to the internet gateway. This is correct because even if the subnet is public and the instance has a public IP, the route table must explicitly contain a default route (0.0.0.0/0) targeting the internet gateway for traffic to reach the internet. Without that specific route, traffic will not be forwarded to the IGW, regardless of other configurations. The other options are either already confirmed in the scenario or are less likely to be the missing piece.

Answer

Ensure the network ACL allows outbound traffic.

Answer

Confirm that the internet gateway is attached to the VPC.

Answer

Check if the instance has a public IP assigned.

Question 4

Refer to the exhibit. The IAM policy above is attached to a user in account A (123456789012). The user needs to create a VPC peering connection with account B and accept it. The user in account A can create the peering request, but the accept fails with an 'UnauthorizedOperation' error. What is the MOST likely reason?

Accepted Answer

The user does not have permission to accept the peering connection from the other account. The 'AcceptVpcPeeringConnection' action is allowed on all resources ('*'), but the specific ARN for the peering connection is not granted for the accept action. The second statement allows actions only on peering connections in account A, but the accept action is performed on the requester's side? Actually, the accept is done by the accepter (account B). The user in account A is trying to accept? The scenario says 'the user in account A can create the peering request, but the accept fails'. Actually, the accept is done by account B. So the user in account A cannot accept a peering connection that belongs to account B. The policy allows accept on 'ec2:AcceptVpcPeeringConnection' with resource '*', but the accept action is performed on the resource in the accepter account. The second statement restricts to peering connections in account A. The accept action is not covered by the second statement because it's not in the action list of the second statement. Wait, the first statement allows accept on all resources. So why would it fail? The issue is that the accept action is called on the peering connection resource in the accepter account, which is not in account A. The policy does not have permissions for resources in other accounts. The correct answer is that the user does not have permission to accept the peering connection because the resource ARN in the second statement only covers peering connections in account A. But the first statement allows accept on all resources. However, the 'ec2:AcceptVpcPeeringConnection' action requires permission on the resource of the peering connection in the accepter account. Since the user is in account A, they cannot accept a peering connection that is owned by account B. The most likely reason is that the user lacks permissions to accept the peering connection in the other account. Option C captures this.

Answer

The user does not have permission to create routes in the VPC

Answer

The 'ec2:CreateVpcPeeringConnection' action requires a specific VPC ARN

Answer

The 'ec2:AcceptVpcPeeringConnection' action is not allowed in the policy

Question 5

Which TWO configuration steps are required to enable VPC Flow Logs to be published to an S3 bucket in a different AWS account? (Select TWO.)

Accepted Answer

Attach a resource-based policy to the S3 bucket that grants the source account's Flow Logs service permission to write.. Option A is correct because when VPC Flow Logs deliver to an S3 bucket owned by a different account, the destination bucket must have a resource-based policy (bucket policy) that grants the source account's Flow Logs delivery service principal (delivery.logs.amazonaws.com) permission to write objects, typically including s3:PutObject and s3:GetBucketAcl. Option C is correct because the source account must create an IAM role that the Flow Logs service can assume, with a trust policy allowing delivery.logs.amazonaws.com to assume it and a permissions policy granting s3:PutObject (and related actions) to the destination bucket, which is the mechanism AWS uses for cross-account delivery. Option B is incorrect because CloudWatch Logs log groups cannot be used as a destination for cross-account S3 delivery and are a separate destination type entirely. Option D is incorrect because creating an IAM user with access keys is not how Flow Logs authenticates; the service assumes a role, and sharing long-term credentials is not a supported or secure mechanism. Option E is incorrect because S3 cross-account replication copies existing objects between buckets and has nothing to do with enabling Flow Logs delivery.

Answer

Configure the Flow Logs destination as a CloudWatch Logs log group in the source account.

Answer

Create an IAM user in the source account with programmatic access and share the access keys.

Answer

Enable S3 cross-account replication.

Question 6

A company is designing a highly available Direct Connect connection. Which THREE components should be deployed to meet this requirement? (Select THREE.)

Accepted Answer

Two Direct Connect connections to two different AWS Direct Connect locations.. Option B is correct because deploying two Direct Connect connections at two different AWS Direct Connect locations provides physical and location-level redundancy, so a failure at one Direct Connect location or its fiber path does not take down all connectivity. Option D is correct because each Direct Connect connection must terminate on customer-side routing equipment, so using two customer routers (or one router with two physical interfaces) ensures there is no single device or interface failure on the customer side. Option E is correct because virtual interfaces (VIFs) are the logical BGP-peered connections over the physical Direct Connect links, and configuring VIFs on both connections enables traffic to fail over between the redundant connections. Option A is not correct because a single BGP session over one virtual interface is a single logical point of failure and does not provide high availability. Option C is not correct because a VPN backup improves resiliency but is not one of the three components required to build the highly available Direct Connect design itself.

Answer

A single BGP session over one of the virtual interfaces.

Answer

A VPN connection as a backup to Direct Connect.

Question 7

Which TWO actions should a network engineer take to troubleshoot a BGP session that is not establishing between an on-premises router and AWS Direct Connect? (Select TWO.)

Accepted Answer

Verify that the BGP ASN configured on the customer router matches the one provided by AWS.. Option A is correct because BGP peering requires the customer-side ASN to match the ASN configured on the AWS side of the virtual interface; a mismatch in the ASN (for example, using a private ASN when AWS expects a public one, or vice versa) will prevent the BGP session from reaching the Established state. Option D is correct because BGP neighbors must have correctly configured and mutually reachable peer IP addresses (the AWS-side and customer-side /30 addresses on the virtual interface); if either peer IP is wrong or unreachable at Layer 3, the TCP session on port 179 cannot form and the BGP session will not establish. Option B is not appropriate because MTU issues typically affect data-plane traffic and path MTU discovery rather than preventing the BGP TCP session from establishing, and increasing MTU is not a standard first troubleshooting step for a down BGP session. Option C is not the best answer because while the virtual interface state matters, the question focuses on BGP session establishment, and the virtual interface being 'available' is a prerequisite rather than a direct BGP troubleshooting action; similarly, Option E refers to the Direct Connect connection state, which is a Layer 1/2 concern and not the specific cause of a BGP session failing to establish when the underlying connection is already up.

Answer

Increase the MTU on the customer router interface.

Answer

Ensure that the virtual interface is in the 'available' state.

Answer

Check that the Direct Connect connection is in the 'available' state.

Question 8

An engineer is trying to create a VPC Flow Log that delivers to a CloudWatch Logs log group in the same account. The IAM role used has the above trust policy. However, the flow log creation fails with an error. What is the most likely reason?

Accepted Answer

The IAM role lacks a permissions policy that grants the actions on the log group.. A VPC Flow Log delivering to CloudWatch Logs requires an IAM role that the flow log service can assume, and that role must also have a permissions policy granting actions like logs:CreateLogStream and logs:PutLogEvents on the target log group. The trust policy only establishes who can assume the role; it does not grant permissions to write logs. Without the permissions policy, flow log creation fails.

Answer

The log group does not exist yet.

Answer

The trust policy incorrectly specifies the service principal; it should be 'ec2.amazonaws.com'.

Answer

The resource ARN in the trust policy does not include the log group name.

Question 9

A company has a hybrid network with multiple AWS Direct Connect connections to different VPCs. The on-premises network uses BGP to advertise prefixes to AWS. The network team notices that some on-premises prefixes are not being received by the VPCs. What is the MOST likely cause?

Accepted Answer

The on-premises router is advertising more than 100 prefixes over the BGP session. AWS Direct Connect public VIFs enforce a hard limit of 100 prefixes that a customer can advertise to AWS; if the on-premises router advertises more than 100 prefixes, AWS drops the excess and the VPCs never learn those routes. This is the most likely cause when 'some' prefixes are missing while others work.

Answer

The on-premises router is not using BGP communities

Answer

The on-premises router is using AS_PATH prepending

Answer

The on-premises router is not setting the MED attribute

Question 10

An engineer is troubleshooting connectivity from on-premises to a VPC via Direct Connect private VIF. The BGP session is up, traffic is flowing, but the on-premises network cannot reach some subnets in the VPC. The VPC CIDR is 10.0.0.0/16. What is the most likely cause based on the exhibit?

Accepted Answer

The security groups or network ACLs in the VPC are blocking traffic to those subnets.. The BGP session being up and traffic flowing indicates that routing is properly configured between on-premises and the VPC. The inability to reach only some subnets suggests the issue is at the network security layer within the VPC. Security groups and network ACLs can block traffic to specific subnets while routing remains intact. Therefore, the most likely cause based on the exhibit is that security groups or NACLs are filtering traffic to those subnets.

Answer

The BGP session is up, but the on-premises router is not receiving the VPC CIDR route due to missing route propagation on the virtual private gateway.

Answer

The customer router configuration snippet is missing the BGP configuration for those subnets.

Answer

The route filter prefixes only allow the VPC CIDR 10.0.0.0/16, but the VPC has additional CIDRs that are not being advertised.

Question 11

A network engineer is troubleshooting high latency to an application hosted in Amazon EC2. The application uses an Application Load Balancer. Which metrics in Amazon CloudWatch should be examined to identify if the load balancer is causing latency?

Accepted Answer

TargetResponseTime. TargetResponseTime is the CloudWatch metric that measures the elapsed time from when an ALB receives a request to when it receives the response from the target, which directly isolates backend/application latency from client-side or network latency. If this metric is elevated while other ALB metrics look normal, the latency originates at the target (EC2 instance, application code, or downstream dependency) rather than the load balancer itself. This makes it the correct metric to examine when troubleshooting high latency through an ALB.

Answer

HTTP 5XX Count

Answer

ActiveConnectionCount

Answer

RequestCount

Question 12

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that S3 traffic is taking a suboptimal path over the internet instead of the Direct Connect. Which configuration is MOST likely missing?

Accepted Answer

A VPC endpoint for S3 is not configured. For a public VIF, S3 traffic from on-premises should use Direct Connect if the on-premises router is configured to route S3 prefixes to the Direct Connect connection. The provided options do not address this missing configuration. None of the options (VPC route tables, VIF association, Direct Connect gateway, or VPC endpoint) are correct for this scenario. The question may need to be revised to include an appropriate option.

Answer

The VPC route tables are not updated to include the Direct Connect route

Answer

The public VIF is not associated with the VPC

Answer

A Direct Connect gateway is not attached to the VPC

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team wants to monitor the amount of data transferred between VPCs for cost allocation. Which AWS feature should they use?

Accepted Answer

VPC Flow Logs for each VPC.. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including source/destination IP, ports, protocol, and bytes transferred. By enabling flow logs on each VPC and analyzing the data (e.g., via Athena or CloudWatch Logs Insights), the network team can determine data transfer volumes between VPCs for cost allocation. This is the correct feature for granular traffic volume monitoring at the VPC level.

Answer

CloudWatch Metrics for Transit Gateway.

Answer

AWS Config rules.

Answer

AWS CloudTrail logs.

Question 14

A network engineer needs to capture and analyze DNS query logs generated by Amazon Route 53. Which AWS service should be used to store and query these logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because Route 53 can be configured to send public DNS query logging directly to CloudWatch Logs, where queries can be stored, filtered, and analyzed using CloudWatch Logs Insights. This is the native, documented integration for Route 53 Resolver query logging and public DNS query logging. CloudWatch Logs supports querying with a purpose-built query language, making it ideal for analyzing DNS query patterns.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3

Question 15

A network engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic information for network interfaces within a VPC, enabling analysis of traffic between EC2 instances. Option A is wrong because CloudTrail logs API calls, not network traffic. Option B is wrong because CloudWatch Metrics provide performance metrics, not packet-level details. Option D is wrong because AWS Config monitors configuration changes, not traffic.

Answer

AWS CloudTrail.

Answer

Amazon CloudWatch Metrics.

Answer

AWS Config.