ANS-C01 Network Management and Operations Practice Test 9 — 15 Questions

Question 1

A network engineer created a VPC interface endpoint for a third-party SaaS service using AWS PrivateLink. The endpoint shows 'available' state, but on-premises clients cannot connect to the service via the private endpoint DNS name. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Private DNS is not enabled for the endpoint.. Private DNS for the endpoint must be enabled for the private DNS name to resolve correctly from on-premises. Option A is incorrect because the endpoint is in 'available' state. Option C is incorrect because the subnet IDs are present. Option D is incorrect because the endpoint type is Interface, not Gateway.

Answer

The endpoint is not in the 'available' state.

Answer

The endpoint is not associated with any subnet.

Answer

The endpoint type is Gateway, not Interface.

Question 2

A network engineer needs to monitor network performance between two EC2 instances in different Availability Zones. Which THREE metrics from Amazon CloudWatch should the engineer use?

Accepted Answer

NetworkPacketsIn. Options A, D, and E are correct. NetworkPacketsIn, NetworkOut, and NetworkIn are standard EC2 CloudWatch metrics that measure network traffic volume and packet counts, useful for monitoring network performance between instances. Option B (VolumeQueueLength) is an EBS metric, not network. Option C (NetworkPacketsDropped) is not a standard CloudWatch metric for EC2.

Answer

VolumeQueueLength

Answer

NetworkPacketsDropped

Question 3

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway for outbound internet access. The security team wants to audit all traffic from the private subnets to the internet. Which TWO steps should be taken to capture this traffic?

Accepted Answer

Create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface.. To capture traffic from private subnets to the internet through a NAT gateway, you need to enable VPC Flow Logs on the NAT gateway's elastic network interface (option C). Additionally, you can create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface (option B) to capture the same traffic. Option A is incorrect because VPC Flow Logs on the internet gateway capture traffic that reaches the internet gateway, but traffic from private subnets goes through the NAT gateway, not directly through the internet gateway. Option D is incorrect because a Site-to-Site VPN is not used for outbound internet traffic from private subnets; it is for connecting to on-premises networks. Option E is incorrect because AWS CloudTrail logs API calls, not network traffic.

Answer

Enable VPC Flow Logs on the internet gateway.

Answer

Set up an AWS Site-to-Site VPN to route traffic through a third-party logging appliance.

Answer

Enable AWS CloudTrail for the NAT gateway.

Question 4

A network engineer configured a custom network ACL for a VPC. An EC2 instance in a subnet associated with this ACL cannot receive ping (ICMP) from the internet. The security group allows ICMP. Which rule is causing the issue?

Accepted Answer

Inbound rule 130 allows ICMP, but it is overridden by rule 120.. NACL rules are evaluated in ascending order by rule number. Rule 120 (deny all) has a lower number than rule 130 (allow ICMP), so it is evaluated first. Thus, ICMP traffic from the internet is denied by rule 120 before rule 130 can allow it. Option A is incorrect because the default NACL rules are not missing; the issue is the order. Option B is incorrect because outbound rules are not the problem for inbound ICMP. Option D is incorrect because inbound rule 100 allows HTTPS but does not affect ICMP.

Answer

The default NACL rules are missing.

Answer

Outbound rule 220 blocks all outbound traffic.

Answer

Inbound rule 100 only allows HTTPS.

Question 5

A company is deploying a new application that requires low latency between EC2 instances. Which THREE placement group strategies should the network engineer consider?

Accepted Answer

Spread placement group. The correct placement group strategies are Cluster placement group (lowest latency, highest throughput), Spread placement group (protects against hardware failures by placing instances on distinct racks), and Partition placement group (reduces likelihood of correlated failures for large distributed and replicated workloads). Option A (Cross-zone load balancing) is a feature of Elastic Load Balancing, not a placement group. Option C (Availability Zone placement group) is not a valid placement group type.

Answer

Cross-zone load balancing

Answer

Availability Zone placement group

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team wants to monitor BGP session status for all Transit Gateway attachments. Which AWS service should be used?

Accepted Answer

AWS Transit Gateway Network Manager. AWS Transit Gateway Network Manager provides monitoring of BGP sessions, network topology, and VPN/Transit Gateway attachment status. Option A is incorrect because AWS Config tracks resource configuration changes but does not monitor real-time BGP session status. Option B is incorrect because VPC Flow Logs capture IP traffic metadata, not routing protocol status. Option D is incorrect because Amazon CloudWatch with Transit Gateway metrics can monitor some metrics (e.g., bytes in/out) but does not directly provide BGP session status.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch with Transit Gateway metrics

Question 7

A network engineer is troubleshooting why an EC2 instance (with the above security group) is not responding to HTTP requests from the internet. The instance is in a public subnet with an Internet Gateway attached. The route table has a default route to the Internet Gateway. What is the most likely cause?

Accepted Answer

The security group only allows traffic from the 10.0.0.0/8 range. The security group only allows inbound HTTP traffic from the 10.0.0.0/8 IP range, which is a private address space. Since the request originates from the internet (a public IP), it does not match the allowed source and is therefore denied. Option A correctly identifies this issue. Options B, C, and D are incorrect: ICMP is not required for HTTP, the route table does have a default route to the IGW, and there is no information about network ACLs blocking HTTP.

Answer

The security group does not allow inbound ICMP traffic

Answer

The route table does not have a route for the internet

Answer

The network ACL is blocking inbound HTTP

Question 8

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The network engineer needs to capture all traffic between the VPC and the internet. Which THREE resources must have VPC Flow Logs enabled?

Accepted Answer

Internet gateway. Options A (Internet gateway), B (NAT gateway), and E (Egress-only internet gateway) are correct because each of these resources has an attached network interface that can have VPC Flow Logs enabled to capture all traffic to and from the internet. Specifically, the internet gateway handles IPv4 and IPv6 traffic, the NAT gateway handles IPv4 traffic from private subnets, and the egress-only internet gateway handles IPv6 traffic from private subnets. Option C (Subnet) is incorrect because flow logs are configured on network interfaces, not on subnets directly. Option D (VPC) is incorrect because flow logs are not attached to the VPC itself; they are attached to individual network interfaces.

Answer

Subnet

Answer

VPC

Question 9

A network engineer has created a VPC endpoint for a VPC endpoint service. The endpoint is 'available' but the application cannot connect to the service using the private DNS name. The engineer checks the Route 53 private hosted zone and finds that no record exists for the endpoint. What is the most likely cause?

Accepted Answer

The 'PrivateDnsEnabled' flag is set to false on the VPC endpoint. When the 'PrivateDnsEnabled' flag is set to false on a VPC endpoint, AWS does not automatically create a Route 53 private hosted zone for the endpoint, so the private DNS name does not resolve. This is the most likely cause given that no DNS record exists. Option D is correct. Options A, B, and C could cause connectivity issues but would not prevent the DNS record from being created.

Answer

The VPC endpoint service is not accepting connections

Answer

The VPC endpoint policy is blocking connectivity

Answer

The security group for the endpoint does not allow inbound traffic

Question 10

A network engineer troubleshoots a VPN connection that shows 'available' state but traffic is not passing. The on-premises firewall logs show that the tunnel is established, but no traffic. The engineer checks the VPN configuration. Based on the exhibit, what is the MOST likely cause of the problem?

Accepted Answer

The VPN is configured for BGP (StaticRoutesOnly: false), but only a static route is added.. The VPN connection has `StaticRoutesOnly` set to `false`, which indicates that dynamic routing (BGP) is expected for route propagation. However, the route shown is a static route, so the VPN will not use it, as BGP is required. Without a proper BGP session or a static route with `StaticRoutesOnly` set to `true`, traffic cannot pass through the VPN. Option A is incorrect because the VPN state is indeed 'available'. Option C is incorrect because the outside IP addresses are routable over the internet. Option D is incorrect because the inside IP addresses (tunnel interfaces) are present in the configuration.

Answer

The VPN connection is not in 'available' state.

Answer

The outside IP addresses are not routable over the internet.

Answer

The inside IP addresses for the tunnels are missing.

Question 11

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The issue occurs only during peak business hours. CloudWatch metrics show increased latency and packet loss at the Direct Connect virtual interface. What is the MOST likely cause?

Accepted Answer

Insufficient bandwidth on the Direct Connect connection. Insufficient bandwidth leads to congestion during peak hours, causing increased latency and packet loss. Option A is incorrect because VPN over Direct Connect is not a common configuration and would not cause these symptoms. Option B is incorrect because asymmetric routing would cause persistent connectivity issues, not intermittent latency and packet loss. Option C is incorrect because BGP peering session flapping would result in complete loss of connectivity, not just increased latency and packet loss.

Answer

VPN tunnel misconfiguration over Direct Connect

Answer

Asymmetric routing between on-premises and AWS

Answer

BGP peering session flapping

Question 12

A company needs to centrally manage network security policies across multiple VPCs and on-premises networks. Which AWS service provides a centralized dashboard for managing firewall rules?

Accepted Answer

AWS Network Firewall. AWS Network Firewall offers a centralized dashboard for managing network-level firewall rules across multiple VPCs and on-premises networks, with policy-based management. Option A is incorrect because Network ACLs are stateless, applied at the subnet level, and lack centralized management capabilities. Option B is incorrect because Security Groups are stateful, applied at the ENI level, and not designed for centralized cross-VPC management. Option C is incorrect because AWS WAF protects web applications at the application layer (HTTP/S), not network-layer firewall rules.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF

Question 13

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They want to centralize outbound internet traffic through a single VPC with a NAT gateway. The security team requires that all traffic to the internet must be logged. Which solution is MOST operationally efficient?

Accepted Answer

Enable VPC Flow Logs on the central VPC and publish to Amazon CloudWatch Logs. The most operationally efficient solution is to enable VPC Flow Logs on the central VPC and publish them to Amazon CloudWatch Logs. This captures all traffic passing through the VPC, including internet-bound traffic routed through the NAT gateway, and provides a centralized logging solution. Option A is incorrect because VPC Flow Logs on the NAT gateway's subnet only capture traffic for that subnet, not all internet-bound traffic from other VPCs routed through the Transit Gateway. Option C is incorrect because deploying a third-party firewall adds unnecessary complexity and cost. Option D is incorrect because AWS CloudTrail logs API calls, not network traffic.

Answer

Enable VPC Flow Logs on the NAT gateway's subnet and publish to Amazon S3

Answer

Deploy a third-party firewall appliance in the central VPC and enable logging

Answer

Enable AWS CloudTrail to log all network events

Question 14

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway. The network team wants to monitor DNS queries from EC2 instances in private subnets to a custom DNS resolver on-premises over a VPN. Which TWO services can capture this traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic at the network interface level, including DNS queries (port 53) to any destination, such as a custom on-premises resolver over VPN. AWS Network Firewall can inspect and log DNS traffic that passes through it, including queries to custom resolvers. Option A (Route 53 Resolver query logs) is incorrect because it only logs queries made to Amazon Route 53 Resolver, not to custom on-premises resolvers. Option B (CloudWatch) is incorrect because CloudWatch does not directly capture network traffic; it can aggregate logs but cannot capture raw DNS packets. Option E (CloudTrail) is incorrect because it logs API calls to AWS services, not network traffic.

Answer

Amazon Route 53 Resolver query logs

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Question 15

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). They notice that traffic from on-premises to a VPC is being dropped. The VPC is associated with a private VIF. The on-premises router has a BGP route to the VPC's CIDR. The VPC's route table has a route to the virtual private gateway. What is the MOST likely cause of the dropped traffic?

Accepted Answer

The VPC route table does not have a route pointing to the virtual private gateway for the on-premises CIDR. For traffic to flow from on-premises to the VPC, the VPC must have a route back to the on-premises CIDR pointing to the virtual private gateway. Without that route, the return traffic will be dropped. Option B is incorrect because MTU issues typically cause packet fragmentation or loss, not complete drop due to missing routes. Option C is incorrect because the BGP session is established (as indicated by the BGP route being present). Option D is incorrect because allowed prefixes on the virtual private gateway control which routes can be advertised over BGP, not the return path in the VPC route table.

Answer

The MTU size on the Direct Connect connection is too small

Answer

The BGP session is not established

Answer

The allowed prefixes on the virtual private gateway do not include the on-premises CIDR