ANS-C01 Network Management and Operations Practice Test 9 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance has a NAT Gateway in the public subnet. However, the instance cannot reach the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The NAT Gateway does not have an Elastic IP address attached.. A NAT Gateway requires an Elastic IP address to be attached during creation; without it, the NAT Gateway cannot perform source NAT and will not route traffic to the internet. If the NAT Gateway lacks an EIP, instances in the private subnet will not be able to reach the internet even if the route table points to the NAT Gateway.

Answer

The security group for the EC2 instance blocks outbound traffic.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The private subnet route table does not have a route to the internet gateway.

Question 2

A network engineer is analyzing VPC Flow Logs and notices that some rejected traffic is not logged. Which THREE conditions could cause this?

Accepted Answer

The Flow Logs capture only accepted traffic due to the filter.. Option C is correct because VPC Flow Logs can be configured with a capture filter that records only ACCEPT traffic, so REJECT entries are simply not published even though the traffic was rejected. Option D is correct because a flow log scoped to a specific elastic network interface (ENI) only captures traffic traversing that interface; rejected traffic on other ENIs in the VPC will not appear. Option E is correct because security groups are stateful and evaluated at the ENI before traffic reaches the flow-log capture point, so traffic denied by a security group is not logged as REJECT (it is not logged at all). Option A is not correct because network ACLs are stateless and evaluated at the subnet boundary; traffic they deny is captured as REJECT in flow logs. Option B is not correct because rejection by the destination network (e.g., a host firewall or remote endpoint) occurs outside the VPC flow-log scope and is not a documented cause of missing REJECT records in the VPC's own flow logs.

Answer

The traffic is blocked by a network ACL.

Answer

The traffic is rejected by the destination network.

Question 3

A network engineer is troubleshooting an issue where an EC2 instance in a VPC cannot reach an S3 bucket via a gateway endpoint. The instance is in a private subnet with a route table that has a route for the S3 prefix list pointing to the gateway endpoint. Which TWO actions should the engineer take to diagnose the problem?

Accepted Answer

Verify that the route table for the subnet includes a route for the S3 prefix list (com.amazonaws.region.s3) with target type gateway endpoint.. Option A is correct because the fundamental requirement for a gateway endpoint to work is that the subnet's route table contains a route whose destination is the S3 prefix list (com.amazonaws.region.s3) and whose target is the gateway endpoint (vpce-xxxx); verifying this route exists and is correctly targeted is a primary diagnostic step. Option E is correct because the instance's security group must permit outbound TCP 443 to the S3 prefix list (or 0.0.0.0/0) for HTTPS traffic to reach S3; a missing or restrictive outbound rule would silently block the connection even if routing is correct. Option B is incorrect because S3 gateway endpoints do not use interface endpoints (ENIs); interface endpoints are for services like S3 interface endpoints or other AWS services and are not required for gateway endpoint connectivity. Option C is not the best diagnostic here because VPC Flow Logs capture IP-level traffic metadata but do not show whether the S3 prefix-list route or security group rules are the cause, and gateway endpoint traffic may not appear as expected in flow logs. Option D is incorrect because a public IP address is irrelevant for reaching S3 through a gateway endpoint from a private subnet; private instances use the endpoint route and do not need public addressing.

Answer

Ensure the VPC has an interface endpoint for S3.

Answer

Review VPC Flow Logs for the subnet to see if traffic is being dropped.

Answer

Confirm that the EC2 instance has a public IP address.

Question 4

A network engineer is troubleshooting an AWS Lambda function that needs to create and manage ENIs in a VPC. The Lambda function is unable to create ENIs. The IAM policy attached to the Lambda execution role is shown in the exhibit. What is the issue?

Accepted Answer

The policy is missing the ec2:AttachNetworkInterface action.. When a Lambda function is configured to run inside a VPC, the Lambda service creates an elastic network interface (ENI) in each subnet and must attach it to the function's execution environment. The IAM policy must therefore grant ec2:AttachNetworkInterface in addition to ec2:CreateNetworkInterface and ec2:DeleteNetworkInterface. Without the attach permission, the ENI creation workflow fails, which is why the function cannot create ENIs. The correct fix is to add the missing ec2:AttachNetworkInterface action to the execution role's policy.

Answer

The policy restricts the resource to a specific VPC.

Answer

The policy does not allow the ec2:CreateNetworkInterface action.

Answer

The policy does not allow the ec2:DeleteNetworkInterface action.

Question 5

A network engineer ran the command shown in the exhibit to check VPC peering connections. Two peering connections are active. The engineer wants to verify that routes are correctly configured. What additional step is needed to ensure that instances in vpc-11111111 can communicate with instances in vpc-33333333?

Accepted Answer

Add a route in the route table of vpc-11111111 pointing to vpc-33333333 via the peering connection, and a route in vpc-33333311 pointing to vpc-11111111 via the same peering connection.. VPC peering requires explicit route table entries in both VPCs pointing to the peering connection as the target. Even though the peering connection is active, without a route in vpc-11111111's route table that directs traffic destined for vpc-33333333's CIDR to the peering connection (and a reciprocal route in vpc-33333333), packets will not be forwarded. Option C correctly identifies this bidirectional routing requirement, which is the essential additional step after the peering connection is established.

Answer

Configure security groups to allow traffic between the VPCs.

Answer

Enable DNS resolution for the peering connection.

Answer

Ensure that the peering connection is in the 'active' state.

Question 6

A network team is planning a migration of a legacy application to AWS. The application requires a static IP address for the on-premises firewall whitelist. Which THREE AWS services can provide a static IP address for outbound traffic from a VPC?

Accepted Answer

AWS Direct Connect with a public virtual interface.. Option A is correct because an AWS Direct Connect public virtual interface provides dedicated, static public IP addresses (customer-provided or AWS-assigned) that on-premises firewalls can whitelist for outbound traffic to AWS public services. Option D is correct because an Amazon NAT Gateway is assigned an Elastic IP address, which is a static public IPv4 address used for all outbound traffic from private subnets, making it ideal for firewall whitelisting. Option E is correct because a Network Load Balancer supports associating an Elastic IP address per subnet (one static IP per Availability Zone), giving stable, whitelistable public IPs for outbound traffic. Option B is not correct because a gateway VPC endpoint for S3 only routes traffic privately within AWS and does not provide a public static IP for general outbound internet traffic. Option C is not correct because an Application Load Balancer does not support static IP addresses and its IPs can change, so it cannot satisfy a firewall whitelist requirement.

Answer

VPC endpoint (gateway endpoint) for S3.

Answer

Application Load Balancer without a static IP.

Question 7

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic from on-premises to the VPC is intermittently dropping. You check the Direct Connect virtual interface status and find it is 'down'. Which AWS service should you use to troubleshoot the physical layer connectivity?

Accepted Answer

AWS Direct Connect console. The AWS Direct Connect console is the correct tool because it exposes the physical and link-layer status of the connection, including the virtual interface (VIF) state, BGP session status, LOA-CFA, and port-level details needed to diagnose why the VIF shows 'down'. Since the issue is at the physical layer, the console's connection and VIF diagnostics provide the authoritative view of the Direct Connect endpoint. Amazon CloudWatch only reports metrics and alarms (e.g., connection state, bit rate) and cannot inspect physical-layer connectivity. VPC Flow Logs capture IP traffic metadata within the VPC and are irrelevant to a down Direct Connect VIF. AWS Support can assist with a case, but it is not the service used to directly troubleshoot the physical layer.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Support

Question 8

A company is designing a multi-region active-active architecture using Application Load Balancers (ALBs) and AWS Global Accelerator. They need to ensure that traffic is distributed evenly across regions and that failover happens automatically. Which configuration should they use?

Accepted Answer

Configure Global Accelerator with two endpoints (one per region) and set equal weights. Global Accelerator uses endpoint weights to distribute traffic. Setting equal weights for both regional endpoints ensures even distribution, and health checks automatically route traffic away from unhealthy regions.

Answer

Use Route 53 latency-based routing with health checks

Answer

Configure Global Accelerator with a single endpoint group containing both ALBs

Answer

Use a Network Load Balancer in each region and Route 53 weighted routing

Question 9

A network engineer is designing a multi-region application that requires low-latency traffic between EC2 instances in two different AWS Regions. The engineer needs to ensure that traffic between the instances uses the AWS global network and not the public internet. Which AWS service should be used?

Accepted Answer

VPC Peering. (VPC Peering). Inter-region VPC peering connects VPCs in different regions using the AWS global network backbone, providing low-latency and private connectivity between EC2 instances. Option A (AWS Direct Connect) is used for on-premises to AWS connectivity, not between instances. Option B (AWS Global Accelerator) optimizes internet-facing traffic and adds unnecessary hops for internal traffic. Option C (AWS Transit Gateway) supports inter-region transit but requires additional configuration and is not the simplest solution for direct instance-to-instance connectivity.

Answer

AWS Direct Connect

Answer

AWS Global Accelerator

Answer

AWS Transit Gateway

Question 10

A network engineer is monitoring network performance between an EC2 instance and an on-premises server using AWS VPN. The engineer notices intermittent packet loss. Which AWS service can provide detailed network metrics and path visualization to troubleshoot?

Accepted Answer

AWS Transit Gateway Network Manager. AWS X-Ray is for application tracing, not network path. VPC Flow Logs provide packet metadata but not path visualization. Amazon CloudWatch can monitor VPN tunnels but not path. AWS Transit Gateway Network Manager provides network topology and path visualization.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS X-Ray

Question 11

A company wants to implement a network monitoring solution that provides real-time traffic analysis and anomaly detection. Which THREE AWS services should be used together?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (B) is correct because it continuously monitors for malicious activity and unauthorized behavior using threat intelligence feeds, machine learning, and anomaly detection across CloudTrail, VPC Flow Logs, and DNS logs. VPC Flow Logs (C) is correct because it captures IP traffic metadata going to and from network interfaces in a VPC, providing the raw network telemetry needed for real-time traffic analysis and anomaly detection. Amazon CloudWatch (E) is correct because it collects and tracks metrics, logs, and alarms, enabling real-time visualization, alerting, and automated responses to detected anomalies. AWS Config (A) is not correct because it focuses on recording and evaluating resource configuration changes for compliance, not real-time traffic analysis. AWS CloudTrail (D) is not correct because it records API activity and account actions for auditing, not network traffic flows or anomaly detection.

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A network engineer needs to monitor network performance between an on-premises data center and AWS via Direct Connect. Which TWO metrics should the engineer monitor in Amazon CloudWatch?

Accepted Answer

VirtualInterfaceBgpState. Option A, VirtualInterfaceBgpState, is correct because Direct Connect virtual interfaces rely on BGP peering, and CloudWatch exposes this metric to show whether the BGP session is up or down, which directly affects route availability and performance between on-premises and AWS. Option B, ConnectionBandwidthUtilization, is correct because it measures the percentage of the Direct Connect connection's capacity in use, helping the engineer detect saturation or congestion that degrades performance. Options C, D, and E are not part of the standard CloudWatch metrics for AWS Direct Connect; Jitter, PacketLoss, and Latency are typically measured by tools such as Network Monitor or third-party probes rather than native Direct Connect CloudWatch metrics.

Answer

Jitter

Answer

PacketLoss

Answer

Latency

Question 13

Which TWO actions are recommended to troubleshoot asymmetric routing in a VPC with multiple NAT gateways?

Accepted Answer

Use a single NAT gateway per Availability Zone. Option D is correct because asymmetric routing in a VPC with multiple NAT gateways typically occurs when an instance's traffic egresses through a NAT gateway in one AZ but the return path is expected through a different AZ; using a single NAT gateway per Availability Zone keeps traffic flows symmetric within each AZ. Option E is correct because route tables must point to the NAT gateway located in the same Availability Zone as the subnet, ensuring that outbound and return traffic traverse the same NAT gateway and avoiding asymmetric paths. Options A, B, and C are not recommended troubleshooting actions: enabling source/destination check on EC2 instances is unrelated to NAT gateway routing asymmetry (and is normally disabled only for NAT instances or certain appliances), a Network Load Balancer does not resolve NAT gateway path asymmetry, and disabling VPC Flow Logs would remove the diagnostic visibility needed to identify asymmetric routing rather than fix it.

Answer

Enable source/destination check on all EC2 instances

Answer

Use a Network Load Balancer to distribute traffic

Answer

Disable VPC Flow Logs

Question 14

Refer to the exhibit. A company has created a VPC endpoint for S3. However, an EC2 instance in the subnet associated with the route table cannot access S3 via the endpoint. The route table has a route to the endpoint. What is the most likely cause?

Accepted Answer

Private DNS is not enabled. The endpoint policy is set to Allow all, which is fine. However, the PrivateDnsEnabled is false, meaning that DNS resolution for S3 endpoints does not resolve to the endpoint IP. To use the endpoint, either enable Private DNS or use the endpoint-specific DNS name. Option A is wrong because the endpoint state is 'available'. Option B is wrong because the route table is associated. Option D is wrong because the security group is not specified (empty), but default SG allows all outbound traffic.

Answer

The endpoint is in 'pending' state

Answer

The route table is not associated with the subnet

Answer

The security group is blocking traffic

Question 15

Which THREE factors should be considered when designing a highly available AWS Site-to-Site VPN connection?

Accepted Answer

Enable BGP for dynamic route propagation. Option B is correct because enabling BGP allows dynamic route propagation and automatic failover between the two tunnels of a Site-to-Site VPN, which is essential for high availability. Option C is correct because using two VPN tunnels each terminating on a different customer gateway IP ensures that if one customer gateway or its attached tunnel fails, traffic can fail over to the other tunnel endpoint. Option E is correct because redundant customer gateways provide device-level redundancy on the on-premises side, preventing a single customer gateway from becoming a single point of failure. Option A is not ideal because two tunnels terminating on the same customer gateway IP still share that single endpoint, so a failure of that customer gateway or its IP path removes both tunnels. Option D is incorrect because a single tunnel with a static route provides no redundancy and cannot automatically fail over if the tunnel or path fails.

Answer

Use two VPN tunnels with the same customer gateway IP

Answer

Use a single VPN tunnel with a static route