ANS-C01 Network Management and Operations Practice Test 8 — 15 Questions

Question 1

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway for outbound internet access. The security team wants to audit all traffic from the private subnets to the internet. Which TWO steps should be taken to capture this traffic?

Accepted Answer

Create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface.. Option A is correct because VPC Flow Logs capture traffic for the NAT gateway interface. Option D is correct because enabling flow logs on the NAT gateway captures traffic sent through it. Option B is incorrect because the internet gateway does not see traffic from private subnets. Option C is incorrect because CloudTrail does not capture network traffic. Option E is incorrect because VPN is not used here.

Answer

Enable VPC Flow Logs on the internet gateway.

Answer

Set up an AWS Site-to-Site VPN to route traffic through a third-party logging appliance.

Answer

Enable AWS CloudTrail for the NAT gateway.

Question 2

A network engineer configured a custom network ACL for a VPC. An EC2 instance in a subnet associated with this ACL cannot receive ping (ICMP) from the internet. The security group allows ICMP. Which rule is causing the issue?

Accepted Answer

Inbound rule 130 allows ICMP, but it is overridden by rule 120.. Option D is correct because the inbound deny-all rule (120) with priority 120 blocks all traffic not explicitly allowed, and ICMP (protocol 1) is allowed only by rule 130 but rule 120 is evaluated first? Actually, evaluation order is by rule number; rule 120 (deny) has lower number than 130 (allow), so rule 120 is evaluated first? Wait, NACL rules are evaluated in ascending order; rule 100, 110, 120, 130. Since rule 120 is deny all, it is evaluated before rule 130. Thus, ICMP traffic is denied by rule 120. The outbound rules are fine because egress is allowed for ephemeral ports. Option A is incorrect because the inbound ICMP rule (130) exists but is after deny-all. Option B is incorrect because inbound HTTPS is allowed. Option C is incorrect because outbound rules are not the issue.

Answer

The default NACL rules are missing.

Answer

Outbound rule 220 blocks all outbound traffic.

Answer

Inbound rule 100 only allows HTTPS.

Question 3

A company is deploying a new application that requires low latency between EC2 instances. Which THREE placement group strategies should the network engineer consider?

Accepted Answer

Spread placement group. Options A, B, and C are valid placement group strategies. Option D is not a placement group type. Option E is not a placement group but a feature of Network Load Balancer.

Answer

Cross-zone load balancing

Answer

Availability Zone placement group

Question 4

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team wants to monitor BGP session status for all Transit Gateway attachments. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway Network Manager. Option A is correct because Transit Gateway Network Manager provides monitoring of BGP sessions and network topology. Option B is incorrect because CloudWatch can monitor metrics but not BGP session status directly. Option C is incorrect because VPC Flow Logs capture traffic, not routing protocol status. Option D is incorrect because AWS Config can track configuration changes but not real-time BGP status.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch with Transit Gateway metrics

Question 5

A network engineer is troubleshooting why an EC2 instance (with the above security group) is not responding to HTTP requests from the internet. The instance is in a public subnet with an Internet Gateway attached. The route table has a default route to the Internet Gateway. What is the most likely cause?

Accepted Answer

The security group only allows traffic from the 10.0.0.0/8 range. The security group allows HTTP from 10.0.0.0/8 only, which is a private IP range. It does not allow traffic from 0.0.0.0/0 (the internet). Option B is correct. Options A, C, and D are not the issue.

Answer

The security group does not allow inbound ICMP traffic

Answer

The route table does not have a route for the internet

Answer

The network ACL is blocking inbound HTTP

Question 6

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The network engineer needs to capture all traffic between the VPC and the internet. Which THREE resources must have VPC Flow Logs enabled?

Accepted Answer

Internet gateway. Option B is correct because the internet gateway (igw) is the attachment point to the internet. Option D is correct because egress-only internet gateway handles IPv6 traffic. Option E is correct because the NAT gateway handles IPv4 traffic from private subnets. Option A is incorrect because VPC itself does not have flow logs; they are on network interfaces. Option C is incorrect because subnets do not have flow logs directly.

Answer

Subnet

Answer

VPC

Question 7

A network engineer has created a VPC endpoint for a VPC endpoint service. The endpoint is 'available' but the application cannot connect to the service using the private DNS name. The engineer checks the Route 53 private hosted zone and finds that no record exists for the endpoint. What is the most likely cause?

Accepted Answer

The 'PrivateDnsEnabled' flag is set to false on the VPC endpoint. When 'VpcEndpointPolicyEnabled' is true, the endpoint has a policy that may restrict access. However, the issue is that the private DNS name is not resolving. For VPC endpoints, AWS automatically creates a Route 53 private hosted zone for the endpoint if 'PrivateDnsEnabled' is true. If it's false, no automatic DNS record is created. Option C is correct. Options A, B, and D are plausible but not the most likely given the lack of DNS record.

Answer

The VPC endpoint service is not accepting connections

Answer

The VPC endpoint policy is blocking connectivity

Answer

The security group for the endpoint does not allow inbound traffic

Question 8

A network engineer troubleshoots a VPN connection that shows 'available' state but traffic is not passing. The on-premises firewall logs show that the tunnel is established, but no traffic. The engineer checks the VPN configuration. Based on the exhibit, what is the MOST likely cause of the problem?

Accepted Answer

The VPN is configured for BGP (StaticRoutesOnly: false), but only a static route is added.. Option A is correct because the VPN connection has StaticRoutesOnly set to false, meaning dynamic routing (BGP) is expected, but the route shown is a static route, which would not be used because the VPN is configured for BGP. Option B is incorrect because the VPN state is available. Option C is incorrect because the inside IP addresses are present. Option D is incorrect because the outside IP addresses are routable.

Answer

The VPN connection is not in 'available' state.

Answer

The outside IP addresses are not routable over the internet.

Answer

The inside IP addresses for the tunnels are missing.

Question 9

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The issue occurs only during peak business hours. CloudWatch metrics show increased latency and packet loss at the Direct Connect virtual interface. What is the MOST likely cause?

Accepted Answer

Insufficient bandwidth on the Direct Connect connection. Option A is correct because insufficient bandwidth leads to congestion during peak hours, causing latency and packet loss. Option B is incorrect because asymmetric routing would cause persistent issues, not intermittent. Option C is incorrect because BGP peering issues would cause complete loss, not just latency/packet loss. Option D is incorrect because VPN over Direct Connect is not a common configuration and would not cause these symptoms.

Answer

VPN tunnel misconfiguration over Direct Connect

Answer

Asymmetric routing between on-premises and AWS

Answer

BGP peering session flapping

Question 10

A company needs to centrally manage network security policies across multiple VPCs and on-premises networks. Which AWS service provides a centralized dashboard for managing firewall rules?

Accepted Answer

AWS Network Firewall. Option C is correct because AWS Network Firewall provides a centralized firewall management service. Option A is incorrect because AWS WAF is for web application firewall, not network-level policies. Option B is incorrect because NACLs are per-subnet and not centralized. Option D is incorrect because Security Groups are per-ENI and not centralized.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF

Question 11

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They want to centralize outbound internet traffic through a single VPC with a NAT gateway. The security team requires that all traffic to the internet must be logged. Which solution is MOST operationally efficient?

Accepted Answer

Enable VPC Flow Logs on the central VPC and publish to Amazon CloudWatch Logs. Option C is correct because VPC Flow Logs capture all IP traffic and can be published to CloudWatch Logs for analysis. Option A is incorrect because it only captures traffic through the NAT gateway, not all internet-bound traffic. Option B is incorrect because AWS CloudTrail logs API calls, not network traffic. Option D is incorrect because it adds complexity and is not necessary.

Answer

Enable VPC Flow Logs on the NAT gateway's subnet and publish to Amazon S3

Answer

Deploy a third-party firewall appliance in the central VPC and enable logging

Answer

Enable AWS CloudTrail to log all network events

Question 12

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway. The network team wants to monitor DNS queries from EC2 instances in private subnets to a custom DNS resolver on-premises over a VPN. Which TWO services can capture this traffic?

Accepted Answer

VPC Flow Logs. Option A is correct because VPC Flow Logs capture all IP traffic including DNS. Option D is correct because AWS Network Firewall can capture and log DNS traffic. Option B is incorrect because Route 53 Resolver query logs capture queries to Route 53, not custom resolvers. Option C is incorrect because CloudTrail logs API calls. Option E is incorrect because CloudWatch does not capture traffic directly.

Answer

Amazon Route 53 Resolver query logs

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Question 13

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). They notice that traffic from on-premises to a VPC is being dropped. The VPC is associated with a private VIF. The on-premises router has a BGP route to the VPC's CIDR. The VPC's route table has a route to the virtual private gateway. What is the MOST likely cause of the dropped traffic?

Accepted Answer

The VPC route table does not have a route pointing to the virtual private gateway for the on-premises CIDR. Option B is correct because if the VPC's route table does not have a route back to the on-premises CIDR, return traffic will be dropped, causing connectivity issues. Option A is incorrect because the VIF is up and BGP is established. Option C is incorrect because allowed prefixes are for advertisement, not return traffic. Option D is incorrect because MTU issues would not cause drops.

Answer

The MTU size on the Direct Connect connection is too small

Answer

The BGP session is not established

Answer

The allowed prefixes on the virtual private gateway do not include the on-premises CIDR

Question 14

A network engineer needs to verify the routing path between two EC2 instances in different subnets within the same VPC. Which AWS tool can provide this information?

Accepted Answer

VPC Reachability Analyzer. Option B is correct because VPC Reachability Analyzer can test connectivity and provide routing path information. Option A is incorrect because traceroute from an instance requires SSH access. Option C is incorrect because AWS Config provides configuration history, not real-time path analysis. Option D is incorrect because CloudWatch does not provide path analysis.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Run traceroute from one instance to the other

Question 15

A company is using AWS Transit Gateway with multiple VPC attachments. They need to ensure that traffic between two specific VPCs is encrypted in transit. The VPCs are in the same AWS region. What is the SIMPLEST solution?

Accepted Answer

Create a VPN attachment on the Transit Gateway and route traffic through it. Option B is correct because an AWS Transit Gateway supports transit gateway peering attachments with VPN encryption for traffic between VPCs. Option A is incorrect because the Transit Gateway itself does not encrypt traffic. Option C is incorrect because VPC peering does not provide encryption by default. Option D is incorrect because AWS PrivateLink is for services, not VPC-to-VPC encryption.

Answer

Enable encryption on the Transit Gateway route tables

Answer

Use AWS PrivateLink to connect the VPCs

Answer

Use VPC peering instead of Transit Gateway and enable encryption