ANS-C01 Network Management and Operations Practice Question
A network engineer is troubleshooting high latency on an AWS Transit Gateway attachment to a VPN. The VPN tunnel is established, and traffic flows, but latency spikes are observed during peak hours. The engineer suspects packet loss. Which diagnostic step should be taken first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Amazon CloudWatch metrics for the Transit Gateway attachment to check for dropped packets.
The first step in diagnosing packet loss on a Transit Gateway VPN attachment is to check the attachment's CloudWatch metrics, such as DroppedPacketCount or PacketDropRate, which directly indicate packet loss. Option A (traceroute) can show path latency but does not confirm packet loss at the Transit Gateway level. Option C (verify VPN tunnel status) only confirms the tunnel is up, not packet loss. Option D (VPN CloudWatch metrics) provides tunnel-level metrics but is less specific to the Transit Gateway attachment itself. The attachment metrics are more direct for this issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a traceroute from an on-premises host to an EC2 instance.
Why it's wrong here
Traceroute can show latency but not packet loss directly.
- ✓
Use Amazon CloudWatch metrics for the Transit Gateway attachment to check for dropped packets.
Why this is correct
Transit Gateway provides attachment-level metrics like bytes in/out and dropped packets.
- ✗
Verify the VPN tunnel status in the AWS Management Console.
Why it's wrong here
Tunnel status only shows if it's up, not packet loss.
- ✗
Review the VPN CloudWatch metrics for tunnel data.
Why it's wrong here
VPN metrics are at tunnel level, not attachment level.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.