ANS-C01 Network Management and Operations Practice Test 9 — 15 Questions

Question 1

A network engineer created an IAM policy for a user to manage VPC Flow Logs. The user reports they cannot create flow logs and receive an 'AccessDenied' error. What is the MOST likely reason?

Accepted Answer

The logs:CreateLogGroup resource ARN is too restrictive.. Option D is correct because the policy allows logs:CreateLogGroup only for a specific log group ARN, but the user might be trying to create a log group with a different name pattern. Option A is incorrect because the policy includes ec2:CreateFlowLogs. Option B is incorrect because the policy includes logs:PutLogEvents. Option C is incorrect because the policy includes iam:PassRole for the specific role.

Answer

The ec2:CreateFlowLogs action is missing.

Answer

The logs:PutLogEvents action is missing.

Answer

The iam:PassRole action is missing for the flow logs role.

Question 2

A network engineer is setting up a site-to-site VPN connection between an on-premises network and AWS. After configuring the customer gateway, virtual private gateway, and VPN tunnel, the tunnel status shows 'DOWN'. Which step should the engineer take FIRST to troubleshoot?

Accepted Answer

Check the on-premises VPN device configuration for mismatched parameters. Option D is correct because the first step is to check the VPN configuration on the on-premises device to ensure it matches AWS settings. Option A is incorrect because CloudWatch metrics may not show tunnel status. Option B is incorrect because the VPN is down, so connectivity tests will fail. Option C is incorrect because checking route propagation is secondary.

Answer

Verify that route propagation is enabled on the VPC route table

Answer

Enable detailed CloudWatch metrics on the VPN connection

Answer

Test connectivity by pinging an EC2 instance in the VPC

Question 3

A company has a VPC with multiple subnets across Availability Zones. An application load balancer (ALB) is deployed in public subnets. The network team notices that traffic from the ALB to targets in private subnets is intermittently failing. The targets are healthy. What is the MOST likely cause?

Accepted Answer

The target security group does not allow traffic from the ALB's security group.. Option A is correct because if the ALB's security group does not allow inbound traffic from the ALB's source IP (the ALB's private IP), health checks may fail? Actually, the question says targets are healthy, but traffic from ALB to targets failing. The ALB communicates using its private IP addresses, and the target security group must allow traffic from the ALB's security group. Option B is incorrect because NACLs are stateless and must allow both inbound and outbound traffic. Option C is incorrect because the ALB is in public subnets and can reach the internet. Option D is incorrect because cross-zone load balancing is enabled by default.

Answer

The ALB is not associated with a public subnet.

Answer

The network ACL for the target subnets blocks outbound traffic.

Answer

Cross-zone load balancing is disabled.

Question 4

A financial company has a multi-account AWS environment using AWS Organizations. They have deployed a centralized inspection VPC with a third-party firewall appliance. All VPCs are attached to a Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by the firewall. The firewall is deployed in an Auto Scaling group behind a Network Load Balancer (NLB). What is the BEST way to route traffic to the firewall?

Accepted Answer

Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.. Option A is correct because Transit Gateway supports equal-cost multi-path (ECMP) routing, allowing traffic to be distributed across multiple firewall instances via the NLB. Option B is incorrect because VPC peering bypasses the Transit Gateway. Option C is incorrect because the firewall should be in the inspection VPC, not in each VPC. Option D is incorrect because the GWLB is not used here; the NLB is the correct choice.

Answer

Use a Gateway Load Balancer (GWLB) endpoint in each VPC to route traffic to the firewall.

Answer

Use VPC peering between each VPC and the inspection VPC.

Answer

Deploy a firewall appliance in each VPC and route traffic locally.

Question 5

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection in real time. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch. Option D is correct because CloudWatch provides metrics for Direct Connect connections including bandwidth utilization. Option A is incorrect because VPC Flow Logs capture traffic per interface, not aggregate bandwidth. Option B is incorrect because CloudTrail logs API calls. Option C is incorrect because AWS Config records configuration changes.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 6

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. The two connections will terminate on different AWS Direct Connect locations. Which configuration will provide the HIGHEST availability?

Accepted Answer

Use different customer gateway devices and different Direct Connect locations. Option C is correct because using two different devices and different locations provides physical diversity, increasing availability. Option A is incorrect because using the same device introduces a single point of failure. Option B is incorrect because using the same location reduces diversity. Option D is incorrect because using the same ASN can cause issues but is not the primary concern.

Answer

Use the same customer gateway device for both connections

Answer

Use the same Direct Connect location for both connections

Answer

Use the same BGP ASN for both connections

Question 7

A company's VPC includes a public subnet with a NAT gateway and a private subnet with EC2 instances. The EC2 instances in the private subnet need to access the internet for software updates. The NAT gateway's Elastic IP is associated correctly, and the route tables are configured. However, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table for the private subnet is missing a default route pointing to the NAT gateway.. The most common issue is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from the private subnet cannot be directed to the NAT gateway, and thus cannot reach the internet.

Answer

The NAT gateway is in the private subnet.

Answer

The network ACL for the private subnet is blocking outbound traffic.

Answer

The security group for the EC2 instances does not allow outbound traffic.

Question 8

A network engineer is troubleshooting intermittent connectivity issues between two VPCs that are peered. The VPC peering connection is in the 'active' state. ICMP ping from an instance in VPC A to an instance in VPC B fails intermittently. What is the most likely cause?

Accepted Answer

The route tables in one or both VPCs lack routes to the peer VPC's CIDR via the peering connection.. Since the VPC peering connection is active, the issue is likely that the route tables in one or both VPCs are not correctly configured to route traffic to the peered VPC's CIDR via the peering connection. Without proper routes, traffic is dropped.

Answer

The network ACLs are blocking ICMP traffic.

Answer

The security groups on the instances do not allow inbound ICMP.

Answer

The VPC peering connection is not in the 'active' state.

Question 9

A company has a VPC with public and private subnets. The private subnets need internet access for software updates. The company wants to minimize costs and management overhead. Which solution should they use?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the private subnet route table pointing to the NAT gateway. Option A is correct because a NAT gateway provides outbound internet access for private subnets with minimal management. Option B is incorrect because a NAT instance requires management. Option C is incorrect because an internet gateway alone does not provide outbound access for private subnets. Option D is incorrect because a VPC endpoint is for specific AWS services, not general internet.

Answer

Use a VPC endpoint for S3 and CloudFront

Answer

Attach an internet gateway to the VPC and add a default route to the private subnet route table pointing to the internet gateway

Answer

Launch a NAT instance on an EC2 instance in a public subnet

Question 10

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The on-premises network team reports that the BGP session for the public VIF is flapping intermittently. Which configuration change on the customer router would most likely stabilize the BGP session?

Accepted Answer

Configure BGP route filtering to limit the number of routes advertised to AWS to no more than 100.. BGP flapping due to route advertisements exceeding the maximum allowed is a known issue. The maximum number of routes allowed on a public VIF is 100. Advertising more than this will cause the session to flap. Limiting routes to 100 will stabilize.

Answer

Set the BGP multi-hop TTL to 255.

Answer

Increase the BGP hold timer to 180 seconds.

Answer

Disable BGP fast-external-fallover on the customer router.

Question 11

A company has a Direct Connect connection with a public VIF to access AWS public services. They notice that traffic to Amazon S3 is taking a suboptimal path via the internet instead of the Direct Connect. What is the MOST likely cause?

Accepted Answer

The on-premises router does not have a route for the S3 CIDR ranges pointing to the Direct Connect. Option D is correct because you need to add a route to the on-premises router pointing to the Direct Connect for the S3 CIDR ranges. Option A is incorrect because the public VIF does not use BGP for prefixes. Option B is incorrect because the VIF is up. Option C is incorrect because the public VIF does not use a virtual private gateway.

Answer

The BGP session for the public VIF is not advertising the S3 prefixes

Answer

The public VIF is in a 'DOWN' state

Answer

The virtual private gateway is not attached to the VPC

Question 12

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for compliance. The logs should be published to a central S3 bucket in the logging account. The logging account has an S3 bucket policy that allows cross-account writes. However, flow logs are not being delivered. What is the most likely missing configuration?

Accepted Answer

The source account lacks an IAM role that grants the Flow Logs service permission to write to the central S3 bucket.. For cross-account flow log delivery, the source account must have an IAM role that trusts the logging account and allows the flow logs service to assume it. The role must have permissions to write to the S3 bucket. Without this role, logs cannot be delivered.

Answer

The VPC Flow Logs service is not enabled in the source account.

Answer

The S3 bucket policy does not grant 's3:PutObject' to the source account.

Answer

The VPC Flow Logs destination is set to CloudWatch Logs instead of S3.

Question 13

A network engineer is troubleshooting high latency on a Direct Connect connection. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Run a continuous 'mtr' from on-premises to an AWS resource. Option A and D are correct because CloudWatch metrics can show latency and packet loss, and 'mtr' can trace the path and identify hops. Option B is incorrect because traceroute may not work over Direct Connect due to ICMP filtering. Option C is incorrect because BGP session status does not directly indicate latency. Option E is incorrect because VPC Flow Logs show traffic metadata, not latency.

Answer

Check the BGP session status

Answer

Enable VPC Flow Logs on the VPC

Answer

Run a traceroute from on-premises to an AWS IP address

Question 14

A solutions architect is designing a hybrid network using AWS Transit Gateway with multiple VPN attachments. The on-premises network uses BGP dynamic routing. What is the best practice to achieve high availability and fast failover?

Accepted Answer

Create two VPN connections from two different customer gateways to two different AWS VPN endpoints, and enable BGP on both.. AWS VPN supports BGP dynamic routing, which provides automatic failover and route propagation. Using two VPN tunnels from the same customer gateway to two different AWS endpoints (e.g., two VPN connections to different Availability Zones) ensures high availability and fast failover if one tunnel goes down.

Answer

Use a single VPN connection with static routes.

Answer

Configure the VPN connection with a single tunnel and use static routes with a higher metric for backup.

Answer

Use only one VPN tunnel with BGP enabled.

Question 15

A company is designing a multi-region network with Direct Connect. They have two Direct Connect connections in each region. They want to achieve the HIGHEST availability and lowest latency for cross-region traffic. Which THREE design elements should they include?

Accepted Answer

Configure BGP ASN prepending to influence path selection. Options A, B, and D are correct because using different providers, different locations, and BGP ASN prepending for path selection enhance availability and latency. Option C is incorrect because using the same ASN can cause issues but is not required. Option E is incorrect because one VIF per connection is sufficient.

Answer

Use multiple virtual interfaces per Direct Connect connection

Answer

Use the same BGP ASN for all Direct Connect connections

ANS-C01 Network Management and Operations Practice Test 9 — 15 Questions

Exhibit

ANS-C01 Network Management and Operations Practice Test 9 — 15 Questions

Exhibit