ANS-C01 Network Management and Operations Practice Test 8 — 15 Questions

Question 1

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel status shows 'UP' but traffic is not passing. The engineer checks the route tables and finds that the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely missing configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security group of the EC2 instances does not allow inbound traffic from on-premises. Since the VPN tunnel status is 'UP', the pre-shared key and Phase 2 parameters are correctly configured. With the VPC route table already pointing to the virtual private gateway for the on-premises CIDR, the most likely missing configuration is that the security group associated with the EC2 instances in the VPC does not allow inbound traffic from the on-premises network. Security groups act as a virtual firewall for instances, and inbound traffic from on-premises must be explicitly allowed. Option A is incorrect because the stem states the route exists. Option C is incorrect because a tunnel UP status confirms the pre-shared keys match. Option D is less likely because even if the on-premises router is not advertising the VPC CIDR, that would affect return traffic but not necessarily all traffic; also the question does not specify BGP usage.

Answer

The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway

Answer

The VPN tunnel is using the wrong pre-shared key

Answer

The on-premises router is not advertising the VPC CIDR over BGP

Question 2

A network engineer is configuring an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer creates a customer gateway, VPN connection, and virtual private gateway. The VPN tunnel status shows 'down'. Which configuration step is most likely missing?

Accepted Answer

Configure the on-premises router with the correct pre-shared key and tunnel IP addresses. The VPN tunnel status will remain down if the on-premises router is not configured with the correct pre-shared key and tunnel IP addresses as specified in the AWS VPN tunnel configuration. While attaching the VPN connection to the virtual private gateway (option A) is necessary, it is typically done during creation. Option B (enable route propagation) and option C (add static route) are related to routing, not tunnel establishment. Therefore, the most likely missing step is configuring the on-premises router.

Answer

Attach the VPN connection to the virtual private gateway

Answer

Enable route propagation on the virtual private gateway

Answer

Add a static route to the VPN connection in the route table

Question 3

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates. The instance is associated with an Elastic IP address. The route table for the private subnet has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in the public subnet and has an Elastic IP. Despite this, the instance cannot reach the internet. The security groups and NACLs are properly configured. What is the likely cause?

Accepted Answer

The NAT gateway is not in a public subnet. The instance cannot reach the internet because the NAT gateway, although placed in a subnet labeled as public, is not in a functional public subnet—the subnet's route table must include a default route (0.0.0.0/0) pointing to an internet gateway. The problem statement indicates the NAT gateway has an Elastic IP, so association is not the issue. Instead, the likely cause is that the public subnet's route table lacks this route, meaning the NAT gateway cannot communicate with the internet gateway. Option A is incorrect because the NAT gateway's Elastic IP is properly associated. Option C is incorrect because NACLs are properly configured. Option D is incorrect because the private subnet route table correctly points to the NAT gateway for 0.0.0.0/0.

Answer

The NAT gateway's Elastic IP is not associated with the NAT gateway

Answer

The private subnet's network ACL is blocking outbound traffic

Answer

The EC2 instance does not have a route to the internet

Question 4

A company has a VPC with resources that need to access an S3 bucket in the same region. To minimize latency and avoid internet traffic, which configuration should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet, minimizing latency and avoiding data transfer costs. It is the recommended approach for accessing S3 from a VPC. While VPC Interface Endpoints for S3 also provide private access, they incur hourly charges and additional data processing fees. In most scenarios, Gateway Endpoints are preferred for S3 and DynamoDB due to their simplicity and cost-effectiveness. NAT Gateway (A) is used for internet-bound traffic, not private S3 access. VPC peering (C) connects VPCs but does not provide direct access to S3.

Answer

Use a NAT Gateway in a public subnet and route traffic through it

Answer

Use VPC peering to connect to an S3 bucket

Answer

Create a VPC Interface Endpoint for S3

Question 5

A network engineer needs to monitor the number of bytes dropped by a VPC flow log for a specific network interface. Which Amazon CloudWatch metric should be used?

Accepted Answer

FlowLogsBytesDropped. The correct CloudWatch metric for monitoring dropped bytes from VPC Flow Logs is 'BytesDropped' under the AWS/FlowLogs namespace. While option D uses the name 'FlowLogsBytesDropped', this is a common but non-standard variation. The intended correct answer is D as it is the only option that references dropped data from VPC Flow Logs.

Answer

NetworkPacketsDropped

Answer

VPCFlowLogsDroppedPackets

Answer

ENIDroppedPackets

Question 6

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and a VPC over a Direct Connect connection. The engineer reviews the CloudWatch metrics for the virtual interface and sees an increase in 'ConnectionReset' and 'PacketDropRate'. Which TWO actions should the engineer take to resolve the issue? (Choose TWO.)

Accepted Answer

Check the BGP session status and metrics on the virtual interface. Options C and E are correct. Checking the BGP session status and metrics on the virtual interface helps identify if there are BGP-related issues such as route flapping or session drops that could cause connectivity problems. Checking physical layer metrics like light levels and signal strength can reveal underlying physical issues with the Direct Connect connection. Option A is incorrect because adding BGP peers does not address the symptoms of ConnectionReset and PacketDropRate. Option B is incorrect because increasing MTU could actually increase drop rates if the underlying physical layer has issues. Option D is incorrect because the VPN connection is not directly related to Direct Connect and increasing its bandwidth would not resolve issues with the Direct Connect connection.

Answer

Add additional BGP peers to the Direct Connect connection

Answer

Increase the MTU on the virtual interface to 1500

Answer

Increase the bandwidth of the VPN connection as a backup

Question 7

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). They want to ensure that traffic from on-premises to a specific VPC uses a specific VIF for security compliance. The VPC is associated with a virtual private gateway. Which configuration ensures this?

Accepted Answer

Use BGP community tags on the Direct Connect gateway to influence routing. To steer traffic from on-premises to a specific VPC over a specific VIF, you can use BGP community tags on the Direct Connect gateway. This allows you to influence routing decisions by tagging routes. Option A does not achieve traffic steering because different ASNs are not used for that purpose. Option C (static routes) would not provide the flexibility and dynamic routing capabilities needed. Option D is unnecessary and does not solve the requirement. Therefore, option B is correct.

Answer

Configure the on-premises router to use a different BGP ASN for each VIF

Answer

Assign different IP addresses to each VIF and add static routes

Answer

Create a separate virtual private gateway for each VIF

Question 8

A company has a global application deployed across multiple AWS regions. The application uses Application Load Balancers (ALBs) and Auto Scaling groups. The network team wants to route traffic to the nearest region based on latency, and also wants to failover to another region if the primary region becomes unhealthy. Which THREE services should be used together to achieve this? (Choose THREE.)

Accepted Answer

Amazon Route 53 latency-based routing. Route 53 latency-based routing (B) directs traffic to the region with the lowest latency. CloudWatch alarms (C) can monitor health metrics like ALB 5xx errors or instance health to detect regional failure. AWS Lambda (D) can be triggered by CloudWatch alarms to automatically update Route 53 records (e.g., change failover records or disable unhealthy records) to redirect traffic to a healthy region. Option A (CloudFront with origin failover) is for content delivery and static origin failover, not dynamic routing based on latency and regional health. Option E (Global Accelerator) provides anycast IP and global traffic optimization but does not natively support latency-based routing to the nearest region with automatic failover based on CloudWatch alarms in the same manner; it has different health check mechanisms and is not the standard combination described.

Answer

Amazon CloudFront with origin failover

Answer

AWS Global Accelerator

Question 9

A company wants to monitor network traffic in its VPC for security analysis and troubleshooting. Which TWO AWS services can be used to capture and analyze IP traffic information? (Choose TWO.)

Accepted Answer

AWS Network Firewall. Options A and E are correct. VPC Flow Logs capture IP traffic metadata for analysis, and AWS Network Firewall can capture and inspect network traffic. Option B (CloudTrail) is incorrect because it records API calls, not network traffic. Option C (Trusted Advisor) is incorrect as it provides best practice checks. Option D (GuardDuty) is incorrect because it is a threat detection service that uses flow logs but does not capture them directly.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 10

A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC peering connection is active, and the route tables have appropriate routes. However, instances in VPC A cannot reach instances in VPC B. The security groups in both VPCs allow all traffic. What is the most likely issue?

Accepted Answer

The route tables in both VPCs do not have routes pointing to the peering connection for the other VPC's CIDR. The most likely issue is that the route tables in both VPCs do not have routes pointing to the VPC peering connection for the other VPC's CIDR. Although the VPC peering connection is active, without explicit routes in the route tables, traffic cannot be directed to the peer VPC. Since security groups allow all traffic, they are not the cause. Different availability zones do not affect VPC peering. Therefore, the correct answer is B.

Answer

The security groups are not allowing ICMP traffic

Answer

The VPC peering connection is not in the 'active' state

Answer

The instances are in different availability zones

Question 11

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team notices increased latency and packet loss during peak hours. The Direct Connect virtual interface (VIF) is configured as a private VIF to a VPC. What is the MOST likely cause of the issue?

Accepted Answer

The VIF bandwidth is insufficient for the traffic volume.. The most likely cause is insufficient VIF bandwidth for the traffic volume. During peak hours, increased traffic can exceed the provisioned bandwidth, causing congestion, which manifests as increased latency and packet loss. Option A is incorrect because jumbo frames (larger MTU) can improve efficiency but not prevent congestion. Option C is incorrect because BGP keepalive timers affect routing convergence, not throughput. Option D is incorrect because a 1500-byte MTU is standard and should not cause issues; the problem arises only during peak hours, indicating a capacity issue.

Answer

Jumbo frames are not enabled on the VIF.

Answer

The BGP keepalive timer is set too low.

Answer

The MTU size of the VIF is set to 1500 bytes.

Question 12

A company wants to centralize VPC flow log management from multiple accounts into a single S3 bucket in the management account. Which combination of AWS services should be used?

Accepted Answer

AWS Organizations and Amazon S3 bucket policy. AWS Organizations with SCP can allow cross-account S3 bucket policies. AWS CloudTrail is not needed for flow logs. Option D is correct. Options A, B, and C either miss key services or include unnecessary ones.

Answer

AWS CloudTrail and Amazon S3

Answer

AWS Lambda and Amazon S3

Answer

Amazon Kinesis Data Firehose and Amazon S3

Question 13

A network engineer is diagnosing connectivity issues between an on-premises network and AWS over a Direct Connect connection. The BGP session is established, and the engineer can ping the VPC's private IP addresses. However, TCP connections to EC2 instances are failing. Which TWO actions should the engineer take to identify the issue?

Accepted Answer

Review the security group rules associated with the EC2 instance. Options A and E are correct. Checking the security group rules (A) is critical because security groups are stateful and may be blocking inbound TCP while allowing ICMP. Checking the EC2 instance's operating system firewall (E) is essential because OS firewalls can also block TCP while allowing ICMP. Option B is incorrect because the BGP session is already established. Option C is incorrect because the VPC route table is likely correct if pings work. Option D is incorrect because MTU issues would affect all traffic, not just TCP.

Answer

Review the VPC route table for the subnet

Answer

Verify the BGP session status

Answer

Check the MTU settings on the Direct Connect virtual interface

Question 14

A company has a multi-account AWS environment using AWS Transit Gateway with multiple VPC attachments. The network team wants to centralize logging of all network traffic crossing the Transit Gateway. Which TWO services can be used together to achieve this?

Accepted Answer

VPC Flow Logs published to a central Amazon S3 bucket. VPC Flow Logs can be published to a central Amazon S3 bucket, aggregating traffic logs from different VPCs attached to the Transit Gateway. Option D is correct because AWS Transit Gateway Network Manager allows centralized monitoring and can integrate flow logs. Option B is incorrect because Site-to-Site VPN does not generate its own flow logs; VPN traffic is captured by VPC Flow Logs on the VPN attachment. Option C is incorrect because Direct Connect Gateway does not have flow logs; traffic is logged via VPC Flow Logs on the virtual interfaces. Option E is incorrect because AWS CloudTrail records API actions, not network traffic.

Answer

AWS Site-to-Site VPN flow logs

Answer

AWS Direct Connect Gateway flow logs

Answer

AWS CloudTrail for Transit Gateway events

Question 15

A company is using a transit gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that some VPCs can communicate with each other but not with the on-premises network. The transit gateway route tables are configured correctly. Which TWO configurations should the team check?

Accepted Answer

Verify that the on-premises router is advertising the on-premises CIDR over BGP to the VPN. Options C and E are correct. For VPCs to communicate with the on-premises network, the on-premises router must advertise its CIDR over BGP (C) so the transit gateway learns the route. Additionally, the VPN attachment must be associated with the correct transit gateway route table (E) to propagate the learned routes and enable connectivity. Option A is incorrect because the transit gateway is available if inter-VPC traffic works. Option B is incorrect because security groups are instance-level and do not affect routing; if inter-VPC traffic works, security groups are not the issue. Option D is incorrect because VPC Flow Logs only log traffic, they do not affect routing or configuration.

Answer

Verify that the transit gateway is in a 'available' state

Answer

Check the security group rules of the EC2 instances in the VPCs

Answer

Check the VPC Flow Logs for dropped packets