20+ practice questions focused on Network Management and Operations — one of the most tested topics on the AWS Certified Advanced Networking Specialty ANS-C01 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Network Management and Operations PracticeA company uses AWS Client VPN to provide remote access to its VPC resources. Users report that they can connect to the VPN but cannot reach any resources in the VPC. The VPN endpoint is associated with a subnet in VPC A. The VPC's route table has a route for the Client VPN CIDR (10.200.0.0/16) pointing to the VPN endpoint. The security group assigned to the VPN endpoint allows inbound traffic from the VPN clients. What is the most likely cause of the issue?
Explanation: The most likely cause is that the security group associated with the VPN endpoint does not have an inbound rule that permits traffic from the entire Client VPN CIDR range (10.200.0.0/16). Although the stem states that the security group allows inbound traffic from 'the VPN clients', this wording is ambiguous. If the rule only allows traffic from specific client IP addresses (which may change or not cover all VPN clients), then packets from clients within the CIDR range will be dropped before they can be routed to VPC resources. The VPN connection itself may succeed because the security group rule for the VPN tunnel's control traffic is separate. For data traffic to reach resources, the security group must explicitly allow the full client CIDR.
A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over AWS Site-to-Site VPN. The VPN tunnel status is UP, and BGP is established. The engineer can ping the on-premises server's private IP from the EC2 instance, but TCP connections to a specific port (e.g., 443) are timing out. What is the most likely cause?
Explanation: Security groups or network ACLs can block inbound TCP port 443 while allowing ICMP (ping). Since ping succeeds but TCP connections to port 443 time out, this points to a stateful firewall blocking the specific port. Option A is incorrect because incorrect route table entries on the on-premises router would affect all traffic (both ICMP and TCP), not just TCP port 443. Option C is incorrect because an MTU mismatch on the VPN tunnel would cause packet fragmentation issues that typically manifest as connectivity problems for large packets, not exclusively for TCP port 443 while leaving ICMP unaffected. Option D is incorrect because if BGP prefix limits were exceeded, route tables would be incomplete, affecting all traffic; since BGP is established and ICMP works, routing is functioning correctly.
A network engineer needs to monitor traffic between a VPC and an on-premises network over an AWS Site-to-Site VPN. Which AWS service should be used to capture packet-level information for troubleshooting?
Explanation: None of the provided options capture full packet-level information. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) but not the actual packet payload. For full packet capture, VPC Traffic Mirroring should be used, which is not listed as an option.
A network engineer is setting up a site-to-site VPN connection between an on-premises network and AWS. After configuring the customer gateway, virtual private gateway, and VPN tunnel, the tunnel status shows 'DOWN'. Which step should the engineer take FIRST to troubleshoot?
Explanation: The first troubleshooting step when a VPN tunnel is down is to check the on-premises VPN device configuration for mismatched parameters (e.g., pre-shared keys, encryption algorithms, etc.). Option A is incorrect because route propagation is relevant only after the tunnel is up; it does not cause the tunnel to be down. Option B is incorrect because CloudWatch metrics provide monitoring after the tunnel is established, not initial troubleshooting. Option C is incorrect because pinging an EC2 instance requires the tunnel to be up; it will fail if the tunnel is down.
A company has multiple AWS accounts and wants to centrally manage VPC flow logs for compliance. The logs should be published to a central S3 bucket in the logging account. The logging account has an S3 bucket policy that allows cross-account writes. However, flow logs are not being delivered. What is the most likely missing configuration?
Explanation: For cross-account flow log delivery, the source account must have an IAM role that trusts the logging account and allows the flow logs service to assume it. The role must have permissions to write to the S3 bucket. Without this role, logs cannot be delivered.
+15 more Network Management and Operations questions available
Practice all Network Management and Operations questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Network Management and Operations. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Network Management and Operations questions on the ANS-C01 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Network Management and Operations is tested as part of the AWS Certified Advanced Networking Specialty ANS-C01 blueprint. Practicing with targeted Network Management and Operations questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free ANS-C01 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Network Management and Operations is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Network Management and Operations practice session with instant scoring and detailed explanations.
Start Network Management and Operations Practice →