ANS-C01 Network Management and Operations — Timed 10 Questions

Question 1

A company uses AWS Client VPN to provide remote access to its VPC resources. Users report that they can connect to the VPN but cannot reach any resources in the VPC. The VPN endpoint is associated with a subnet in VPC A. The VPC's route table has a route for the Client VPN CIDR (10.200.0.0/16) pointing to the VPN endpoint. The security group assigned to the VPN endpoint allows inbound traffic from the VPN clients. What is the most likely cause of the issue?

10 minute time limit — choose an answer to begin.

Accepted Answer

The security group associated with the VPN endpoint does not allow inbound traffic from the VPN client CIDR.. The most likely cause is that the security group associated with the VPN endpoint does not have an inbound rule that permits traffic from the entire Client VPN CIDR range (10.200.0.0/16). Although the stem states that the security group allows inbound traffic from 'the VPN clients', this wording is ambiguous. If the rule only allows traffic from specific client IP addresses (which may change or not cover all VPN clients), then packets from clients within the CIDR range will be dropped before they can be routed to VPC resources. The VPN connection itself may succeed because the security group rule for the VPN tunnel's control traffic is separate. For data traffic to reach resources, the security group must explicitly allow the full client CIDR.

Answer

The Client VPN endpoint's authentication is failing.

Answer

The VPN endpoint is not associated with the correct subnet.

Answer

The route table in VPC A does not have a route for the Client VPN CIDR.

Question 2

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over AWS Site-to-Site VPN. The VPN tunnel status is UP, and BGP is established. The engineer can ping the on-premises server's private IP from the EC2 instance, but TCP connections to a specific port (e.g., 443) are timing out. What is the most likely cause?

Accepted Answer

Security group or network ACL blocking inbound TCP port 443 on the EC2 instance. Security groups or network ACLs can block inbound TCP port 443 while allowing ICMP (ping). Since ping succeeds but TCP connections to port 443 time out, this points to a stateful firewall blocking the specific port. Option A is incorrect because incorrect route table entries on the on-premises router would affect all traffic (both ICMP and TCP), not just TCP port 443. Option C is incorrect because an MTU mismatch on the VPN tunnel would cause packet fragmentation issues that typically manifest as connectivity problems for large packets, not exclusively for TCP port 443 while leaving ICMP unaffected. Option D is incorrect because if BGP prefix limits were exceeded, route tables would be incomplete, affecting all traffic; since BGP is established and ICMP works, routing is functioning correctly.

Answer

Incorrect route table entries on the on-premises router for the VPC CIDR

Answer

MTU mismatch on the VPN tunnel causing packet fragmentation for TCP

Answer

BGP prefix limits exceeded causing route table incompleteness

Question 3

A network engineer needs to monitor traffic between a VPC and an on-premises network over an AWS Site-to-Site VPN. Which AWS service should be used to capture packet-level information for troubleshooting?

Accepted Answer

VPC Flow Logs. None of the provided options capture full packet-level information. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) but not the actual packet payload. For full packet capture, VPC Traffic Mirroring should be used, which is not listed as an option.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Transit Gateway Network Manager

Question 4

A network engineer is setting up a site-to-site VPN connection between an on-premises network and AWS. After configuring the customer gateway, virtual private gateway, and VPN tunnel, the tunnel status shows 'DOWN'. Which step should the engineer take FIRST to troubleshoot?

Accepted Answer

Check the on-premises VPN device configuration for mismatched parameters. The first troubleshooting step when a VPN tunnel is down is to check the on-premises VPN device configuration for mismatched parameters (e.g., pre-shared keys, encryption algorithms, etc.). Option A is incorrect because route propagation is relevant only after the tunnel is up; it does not cause the tunnel to be down. Option B is incorrect because CloudWatch metrics provide monitoring after the tunnel is established, not initial troubleshooting. Option C is incorrect because pinging an EC2 instance requires the tunnel to be up; it will fail if the tunnel is down.

Answer

Verify that route propagation is enabled on the VPC route table

Answer

Enable detailed CloudWatch metrics on the VPN connection

Answer

Test connectivity by pinging an EC2 instance in the VPC

Question 5

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for compliance. The logs should be published to a central S3 bucket in the logging account. The logging account has an S3 bucket policy that allows cross-account writes. However, flow logs are not being delivered. What is the most likely missing configuration?

Accepted Answer

The source account lacks an IAM role that grants the Flow Logs service permission to write to the central S3 bucket.. For cross-account flow log delivery, the source account must have an IAM role that trusts the logging account and allows the flow logs service to assume it. The role must have permissions to write to the S3 bucket. Without this role, logs cannot be delivered.

Answer

The VPC Flow Logs service is not enabled in the source account.

Answer

The S3 bucket policy does not grant 's3:PutObject' to the source account.

Answer

The VPC Flow Logs destination is set to CloudWatch Logs instead of S3.

Question 6

A solutions architect is designing a hybrid network using AWS Transit Gateway with multiple VPN attachments. The on-premises network uses BGP dynamic routing. What is the best practice to achieve high availability and fast failover?

Accepted Answer

Create two VPN connections from two different customer gateways to two different AWS VPN endpoints, and enable BGP on both.. The best practice for high availability and fast failover is to establish two VPN connections from two separate on-premises customer gateways to two different AWS VPN endpoints in different Availability Zones. Enabling BGP on both connections allows dynamic route advertisement and automatic failover. This design eliminates single points of failure at both the on-premises and AWS sides, providing faster convergence than a single gateway or tunnel.

Answer

Use a single VPN connection with static routes.

Answer

Configure the VPN connection with a single tunnel and use static routes with a higher metric for backup.

Answer

Use only one VPN tunnel with BGP enabled.

Question 7

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket. The VPC has a NAT Gateway in the public subnet. The security group for the EC2 instance allows outbound HTTPS to 0.0.0.0/0. The NACL for the private subnet allows outbound HTTPS to 0.0.0.0/0 and inbound ephemeral ports from 0.0.0.0/0. The instance still cannot reach S3. What is the most likely cause?

Accepted Answer

The private subnet's route table does not have a route to the NAT Gateway.. The most likely cause is that the private subnet's route table does not have a route to the NAT Gateway. Without a default route (0.0.0.0/0) pointing to the NAT Gateway, traffic destined for the internet (including S3) will not be forwarded to the NAT Gateway and will be dropped. Option A is incorrect because NAT Gateways do not have security groups; they are managed by network ACLs and route tables. Option B is incorrect because the NACL inbound rule allows ephemeral ports, which is sufficient for return traffic from S3. Option D is incorrect as there is no indication the bucket policy is restrictive.

Answer

The NAT Gateway's security group does not allow outbound HTTPS traffic.

Answer

The NACL for the private subnet blocks inbound traffic from S3.

Answer

The S3 bucket policy denies access from the VPC.

Question 8

A company has a Direct Connect connection with a private virtual interface. The on-premises network team reports that they cannot reach EC2 instances in a VPC. The VPC has a virtual private gateway attached. The route table in the VPC has a route to the on-premises CIDR via the virtual private gateway. What should the network engineer verify?

Accepted Answer

Verify that the BGP session between the on-premises router and the VGW is established.. Even though the VPC route table has the route to the on-premises CIDR via the virtual private gateway, the on-premises router cannot reach EC2 instances if the BGP session between the on-premises router and the VGW is not established. Without a functioning BGP session, the VGW cannot exchange routes with the on-premises router, causing connectivity failure. Options A and B are not the primary issue: A checks the virtual interface state, but the VIF could be available yet BGP down; B is already stated as present. Option D is incorrect because the on-premises router needs to receive the VPC CIDR route from the VGW via BGP, not advertise it back.

Answer

Verify that the Direct Connect virtual interface is in the 'available' state.

Answer

Verify that the VPC route table has a route to the on-premises CIDR pointing to the virtual private gateway.

Answer

Verify that the on-premises router is advertising the VPC CIDR.

Question 9

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic from on-premises to the VPC is intermittently dropping. You check the Direct Connect virtual interface status and find it is 'down'. Which AWS service should you use to troubleshoot the physical layer connectivity?

Accepted Answer

AWS Direct Connect console. The AWS Direct Connect console provides visibility into the physical layer status, including virtual interface state and LOA-CFA details. Option A (Amazon CloudWatch) is incorrect because CloudWatch monitors logical metrics (e.g., bandwidth, packet loss) but cannot directly report physical layer issues like a down virtual interface. Option B (VPC Flow Logs) is incorrect because flow logs capture IP traffic metadata, not physical connectivity status. Option C (AWS Support) is incorrect because although AWS Support can assist, it is a support plan, not a service that directly provides physical layer troubleshooting data; the console itself should be checked first.

Answer

Amazon CloudWatch

Answer

VPC Flow Logs

Answer

AWS Support

Question 10

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The engineer notices that BGP sessions are flapping. What should the engineer check first?

Accepted Answer

Verify BGP timers and ensure they match on both sides.. Mismatched BGP timers (e.g., hold timer, keepalive interval) are a common cause of BGP session flapping on AWS Direct Connect. Option A is incorrect because route propagation in VPC route tables affects route advertisement, not BGP session stability. Option C is incorrect because while VIF status indicates the link is up or down, flapping is often due to configuration mismatches like timers rather than VIF status alone. Option D is incorrect because increasing MTU can address packet fragmentation but does not directly prevent BGP flapping.

Answer

Configure route propagation in the VPC route tables.

Answer

Check the virtual interface (VIF) status in the AWS console.

Answer

Increase the MTU on the Direct Connect link.