Knowledge + Practice

CCNA Network Management and Operations Questions

75 of 326 questions · Page 1/5 · Network Management and Operations · Answers revealed

Practice these questions Domain overview All questions

1

MCQhard

A company has a production VPC with a public and private subnet across two Availability Zones. The public subnet hosts a Network Load Balancer (NLB) that distributes traffic to EC2 instances in the private subnet. The application experiences periodic failures where the NLB marks all targets as unhealthy for about 2 minutes, then they recover. The health checks are HTTP on port 80 with a 5-second interval, 2 consecutive successes to be healthy, and 2 consecutive failures to be unhealthy. The target group health check timeout is 5 seconds. The EC2 instances are behind an Auto Scaling group with a minimum of 2 instances per AZ. CPU utilization on the instances is stable at 40%. The NLB's CloudWatch metrics show HealthyHostCount drops to zero suddenly. The network engineer suspects a network issue. What is the most likely cause?

A.The security group for the private subnet is blocking inbound traffic from the NLB.

B.The health check timeout is equal to the interval, causing timeouts under transient network delays.

C.The NLB's cross-zone load balancing is disabled, causing all traffic to go to one AZ.

D.The route tables for the private subnets are missing a route to the NLB's subnet.

AnswerB

If timeout equals interval, any delay in response results in consecutive failures, marking the instance unhealthy. Increasing the interval or decreasing the timeout would help.

Why this answer

The health check timeout equals the interval (both 5 seconds). Under transient network delays, a health check response can be delayed beyond the timeout, causing the NLB to count a failure. With 2 consecutive failures required to mark unhealthy, a brief period of latency can cause all targets to be marked unhealthy for about 2 minutes (2 intervals × 5 seconds = 10 seconds of failures, but the recovery requires 2 consecutive successes, leading to the observed ~2-minute duration due to repeated timeouts).

The instances are not overloaded (CPU 40%), and security groups and route tables are configured correctly since normal operation resumes. This configuration violates the best practice of setting the timeout lower than the interval to allow for retries.

Practice this question →

2

MCQmedium

A company has deployed a centralized NAT gateway in a VPC and uses VPC Flow Logs to monitor traffic. The network team notices that traffic from an EC2 instance in a private subnet to the internet is not being logged in the flow logs. The flow logs are configured at the VPC level with the 'ALL' format. What is the most likely cause of this issue?

A.The EC2 instance is using a different VPC than the one where flow logs are configured.

B.The flow log format is set to 'ALL' which excludes NAT gateway traffic.

C.The flow logs are configured to capture only rejected traffic by default.

D.Flow logs must be created specifically for the NAT gateway's elastic network interface to capture its traffic.

AnswerD

VPC-level flow logs do not capture traffic for the NAT gateway's ENI; a separate flow log for the NAT gateway ENI is required.

Why this answer

VPC Flow Logs capture traffic at the elastic network interface (ENI) level. A centralized NAT gateway has its own ENI in the public subnet, and traffic from private instances is routed through that ENI when it reaches the internet. To log that traffic, flow logs must be created specifically for the NAT gateway's ENI, not just at the VPC level, because VPC-level flow logs capture traffic for ENIs within that VPC but do not inherently capture traffic passing through the NAT gateway's ENI unless that ENI is explicitly targeted.

Exam trap

AWS often tests the misconception that VPC-level flow logs automatically capture all traffic traversing the VPC, including traffic through intermediate appliances like NAT gateways, when in fact flow logs must be applied to each specific ENI to log its traffic.

How to eliminate wrong answers

Option A is wrong because if the EC2 instance were in a different VPC, its traffic would not be routed through the centralized NAT gateway in the original VPC at all, and the question states the traffic is not being logged, not that it fails to reach the internet. Option B is wrong because the 'ALL' format includes all traffic metadata (accepted and rejected), and it does not exclude NAT gateway traffic; the format only controls which fields are logged, not which traffic is captured. Option C is wrong because VPC Flow Logs do not have a default setting to capture only rejected traffic; they capture all traffic by default when created, and the 'ALL' format includes both accepted and rejected traffic.

Practice this question →

3

MCQhard

A network engineer is configuring an AWS Site-to-Site VPN connection between a VPC and an on-premises network. The engineer creates a customer gateway, VPN connection, and virtual private gateway. The VPN tunnel status shows 'down'. Which configuration step is most likely missing?

A.Attach the VPN connection to the virtual private gateway

B.Enable route propagation on the virtual private gateway

C.Add a static route to the VPN connection in the route table

D.Configure the on-premises router with the correct pre-shared key and tunnel IP addresses

AnswerD

The on-premises device must have matching parameters.

Why this answer

The VPN tunnel status will remain down if the on-premises router is not configured with the correct pre-shared key and tunnel IP addresses as specified in the AWS VPN tunnel configuration. While attaching the VPN connection to the virtual private gateway (option A) is necessary, it is typically done during creation. Option B (enable route propagation) and option C (add static route) are related to routing, not tunnel establishment.

Therefore, the most likely missing step is configuring the on-premises router.

Practice this question →

4

MCQeasy

A company is using AWS Direct Connect with a private VIF. They want to monitor the BGP session status and receive alerts if the session goes down. Which AWS service should they use?

A.VPC Flow Logs

B.Amazon CloudWatch

C.AWS Config

D.AWS CloudTrail

AnswerB

Direct Connect metrics including BGP status are available in CloudWatch.

Why this answer

Amazon CloudWatch is the correct service because it can monitor the BGP session status of a Direct Connect private VIF by publishing metrics such as 'bgp_session_state' (0=down, 1=up) and 'connection_state' to CloudWatch. You can then create a CloudWatch alarm that triggers an alert (e.g., via SNS) when the BGP session state transitions to 0, providing real-time notification of a session failure.

Exam trap

The trap here is that candidates confuse network monitoring (CloudWatch metrics for BGP state) with logging (Flow Logs, CloudTrail) or configuration tracking (Config), assuming any AWS monitoring service can handle BGP session alerts, but only CloudWatch provides the specific metric and alarm functionality for Direct Connect BGP status.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) at the VPC network interface level, not BGP session state or routing protocol status. Option C is wrong because AWS Config records resource configuration changes and evaluates compliance rules, but it does not monitor real-time BGP session health or provide metric-based alerts. Option D is wrong because AWS CloudTrail logs API calls and management events (e.g., creating a VIF), not the operational state of a BGP session between the customer router and AWS.

Practice this question →

5

MCQhard

A network engineer is designing a multi-region application that requires low-latency traffic between EC2 instances in two different AWS Regions. The engineer needs to ensure that traffic between the instances uses the AWS global network and not the public internet. Which AWS service should be used?

A.AWS Direct Connect

B.AWS Global Accelerator

C.AWS Transit Gateway

D.VPC Peering

AnswerD

Inter-region VPC peering uses the AWS global network backbone to provide low-latency, private connectivity between EC2 instances in different regions, making it the correct choice.

Why this answer

(VPC Peering). Inter-region VPC peering connects VPCs in different regions using the AWS global network backbone, providing low-latency and private connectivity between EC2 instances. Option A (AWS Direct Connect) is used for on-premises to AWS connectivity, not between instances.

Option B (AWS Global Accelerator) optimizes internet-facing traffic and adds unnecessary hops for internal traffic. Option C (AWS Transit Gateway) supports inter-region transit but requires additional configuration and is not the simplest solution for direct instance-to-instance connectivity.

Practice this question →

6

MCQmedium

A company has a global application deployed across multiple AWS regions using Application Load Balancers (ALBs) and AWS Global Accelerator. Users in Asia report high latency. The network team wants to monitor the performance of the Global Accelerator endpoints. Which AWS service should they use to collect and analyze network metrics?

A.Amazon CloudWatch metrics for Global Accelerator

B.AWS VPC Flow Logs

C.AWS X-Ray

D.AWS CloudTrail

AnswerA

CloudWatch provides metrics like endpoint health and latency.

Why this answer

Amazon CloudWatch metrics for Global Accelerator provide endpoint health and performance metrics, such as latency and packet loss, which are essential for monitoring Global Accelerator endpoints. Option B is incorrect because VPC Flow Logs capture IP traffic information but not accelerator-level performance metrics. Option C is incorrect because AWS X-Ray is used for tracing application requests, not network-level metrics.

Option D is incorrect because AWS CloudTrail logs API calls for auditing, not performance monitoring.

Practice this question →

7

MCQmedium

An organization has a multi-account setup using AWS Organizations. The security team wants to centrally manage and enforce security group rules across all VPCs in all accounts. Which solution should they implement?

A.Deploy a centralized network ACL in each VPC.

B.Enable VPC Flow Logs and analyze using Amazon Detective.

C.Use AWS Config rules to remediate non-compliant security groups.

D.Use AWS Firewall Manager to create common security group policies.

AnswerD

Firewall Manager centrally manages security groups across accounts.

Why this answer

AWS Firewall Manager is the correct solution because it centralizes the management and enforcement of security group rules across all VPCs and accounts in an AWS Organization. It allows the security team to create common security group policies that are automatically applied to new and existing resources. Option A is incorrect because network ACLs are stateless and operate at the subnet level, not suitable for security group-like rules.

Option B is incorrect: VPC Flow Logs capture network traffic information for analysis, not enforcement. Option C is incorrect: AWS Config can detect non-compliant security groups but cannot enforce rules; remediation requires additional automation, whereas Firewall Manager provides direct enforcement.

Practice this question →

8

MCQeasy

A company has a VPC with a NAT gateway in a public subnet. The security team wants to log all outbound traffic from private subnets to the internet. Which AWS service should be used to capture this traffic?

A.VPC Flow Logs

B.AWS CloudTrail

C.Amazon S3 Access Logs

D.AWS Config

AnswerA

Flow Logs on the NAT gateway ENI capture all outbound traffic.

Why this answer

VPC Flow Logs can be enabled on the NAT gateway's elastic network interface (ENI) to capture all outbound traffic from private subnets to the internet. Option B is incorrect because AWS CloudTrail logs API calls, not network traffic. Option C is incorrect because Amazon S3 Access Logs only log requests made to S3 buckets, not NAT gateway traffic.

Option D is incorrect because AWS Config records configuration changes, not network traffic.

Practice this question →

9

Multi-Selectmedium

Which THREE are best practices for managing network security in a multi-VPC AWS environment using AWS Transit Gateway?

Select 3 answers

A.Use separate Transit Gateway route tables for different environments (e.g., production, development).

B.Centralize internet egress traffic through a shared VPC with a NAT gateway or proxy.

C.Attach all VPCs to a single Transit Gateway route table for simplicity.

D.Enable VPC Flow Logs on all VPCs and centralize logs in a security account.

E.Use network ACLs on every subnet to filter traffic between VPCs.

AnswersA, B, D

Separate route tables enable network isolation.

Why this answer

Options A, B, and D are correct. Using separate Transit Gateway route tables for different environments (A) enforces isolation and least privilege. Centralizing egress through a shared VPC with a NAT gateway or proxy (B) provides a controlled exit point for internet-bound traffic.

Enabling VPC Flow Logs on all VPCs and centralizing logs in a security account (D) enables monitoring and auditing of traffic patterns. Option C is incorrect because a single route table would allow all VPCs to communicate, violating environment isolation. Option E is incorrect because network ACLs are stateless and not designed for inter-VPC traffic filtering in a Transit Gateway architecture; security groups and route tables are more appropriate.

Practice this question →

10

MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They want to monitor the number of packets dropped due to route table limits. Which CloudWatch metric should they use?

A.PacketsIn

B.PacketsDroppedByRouteTable

C.BytesOut

D.BytesDroppedByRouteTable

AnswerB

Incorrect. 'PacketsDroppedByRouteTable' is not a valid CloudWatch metric for Transit Gateway; the correct metric is 'BytesDroppedByRouteTable' or similar.

Why this answer

The correct CloudWatch metric to monitor the number of packets dropped due to Transit Gateway route table limits is 'PacketsDroppedByRouteTable'. This metric specifically counts packets dropped because the route table is at capacity. 'BytesDroppedByRouteTable' measures bytes dropped, not packets. Option A ('PacketsIn') tracks incoming packets, not dropped.

Option C ('BytesOut') measures outgoing traffic volume. Option D ('BytesDroppedByRouteTable') is the byte equivalent, but the question asks for the number of packets.

Exam trap

Beware of confusing 'BytesDroppedByRouteTable' with the correct packets metric. While both measure drops due to route table limits, 'PacketsDroppedByRouteTable' is the correct metric for packet counts, not bytes.

Practice this question →

11

MCQhard

A company has a global application deployed across multiple AWS Regions. Users are routed to the nearest Region using Amazon Route 53. The application uses an Application Load Balancer in each Region. The network team wants to ensure that traffic is always routed to a healthy Region in case of a Regional failure. Which Route 53 routing policy should be used?

A.Latency-based routing with health checks

B.Weighted routing

C.Simple routing

D.Failover routing

AnswerA

Latency-based routing with health checks is correct because it routes to the region with the lowest latency and uses health checks to automatically failover to a healthy region.

Why this answer

Latency-based routing with health checks. This policy routes traffic to the region with the lowest latency and can automatically failover to a healthy region if health checks fail. Option B (Weighted routing) distributes traffic based on weights, not latency, and does not provide automatic failover based on health.

Option C (Simple routing) routes to a single resource and cannot automatically failover. Option D (Failover routing) is a primary/backup setup, not latency-based, so it doesn't consider latency.

Practice this question →

12

MCQmedium

A company is experiencing intermittent connectivity issues between a VPC and an on-premises data center over an AWS Direct Connect connection. The network engineer checks the Direct Connect virtual interface status and sees it is 'up'. However, BGP sessions are flapping. Which action should the engineer take to diagnose the issue?

A.Verify the VLAN configuration on the customer router.

B.Enable BFD on the Direct Connect virtual interface.

C.Recreate the virtual interface with a new VLAN ID.

D.Check the BGP keepalive and hold timers on both sides.

AnswerD

Inconsistent BGP timers can cause session flapping.

Why this answer

BGP session flapping is often caused by mismatched keepalive or hold timers between the customer router and AWS. Checking and aligning these timers helps diagnose and resolve the flapping. Option A is incorrect because the virtual interface is already up, indicating VLAN configuration is likely correct.

Option B is incorrect; BFD is used for faster failure detection, not for diagnosing timer mismatches that cause flapping. Option C is excessive; recreating the virtual interface with a new VLAN ID is unnecessary when the issue is BGP-related.

Practice this question →

13

Multi-Selectmedium

A company has a Direct Connect connection with a private VIF to a VPC. The network engineer needs to ensure that traffic from the on-premises network to the VPC uses the Direct Connect path, while internet-bound traffic from the VPC uses an Internet Gateway. Which TWO configurations are required? (Select TWO.)

Select 2 answers

A.Add a route in the VPC route table for the Direct Connect location prefix

B.Deploy a NAT Gateway in the VPC for internet access

C.Configure the on-premises router to send all internet traffic to the VPC

D.Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway (VGW)

E.Add a default route (0.0.0.0/0) in the VPC route table pointing to the Internet Gateway

AnswersD, E

Directs traffic from VPC to on-premises via Direct Connect.

Why this answer

Options D and E are correct. Option D adds a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway (VGW), which ensures traffic destined for the on-premises network uses the Direct Connect private VIF. Option E adds a default route (0.0.0.0/0) in the VPC route table pointing to the Internet Gateway, which directs all internet-bound traffic from the VPC to the IGW.

Option A is incorrect because the Direct Connect location prefix is not a destination in the VPC; the route needed is for the on-premises CIDR. Option B is incorrect because a NAT Gateway is not required for internet access when using an Internet Gateway; the IGW itself provides outbound internet access. Option C is incorrect because the on-premises router should not send internet traffic to the VPC; that would defeat the purpose of using Direct Connect for on-premises-to-VPC traffic only.

Practice this question →

14

MCQhard

A network engineer is troubleshooting high latency on an AWS Transit Gateway attachment to a VPN. The VPN tunnel is established, and traffic flows, but latency spikes are observed during peak hours. The engineer suspects packet loss. Which diagnostic step should be taken first?

A.Run a traceroute from an on-premises host to an EC2 instance.

B.Use Amazon CloudWatch metrics for the Transit Gateway attachment to check for dropped packets.

C.Verify the VPN tunnel status in the AWS Management Console.

D.Review the VPN CloudWatch metrics for tunnel data.

AnswerB

Transit Gateway provides attachment-level metrics like bytes in/out and dropped packets.

Why this answer

The first step in diagnosing packet loss on a Transit Gateway VPN attachment is to check the attachment's CloudWatch metrics, such as DroppedPacketCount or PacketDropRate, which directly indicate packet loss. Option A (traceroute) can show path latency but does not confirm packet loss at the Transit Gateway level. Option C (verify VPN tunnel status) only confirms the tunnel is up, not packet loss.

Option D (VPN CloudWatch metrics) provides tunnel-level metrics but is less specific to the Transit Gateway attachment itself. The attachment metrics are more direct for this issue.

Practice this question →

15

MCQmedium

An EC2 instance with the attached network interface shown above is unable to reach the internet. The instance is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What is the most likely cause?

A.The source/destination check is enabled, which prevents the instance from sending traffic to the internet if it is not the source of the traffic.

B.The network interface's attachment status is 'attached', but the instance may not have a public IP address.

C.The route table for the subnet does not have a 0.0.0.0/0 route pointing to the internet gateway.

D.The security group is not associated with the network interface.

AnswerB

An instance in a public subnet needs a public IP address for the internet gateway to route traffic to and from the internet. Without it, even with proper routes and security groups, internet access fails. This is the most likely cause.

Why this answer

The instance is in a public subnet with a route to an internet gateway, and the security group allows outbound traffic. However, for an instance in a public subnet to reach the internet directly, it must have a public IP address (either assigned automatically or as an Elastic IP). Without a public IP, the internet gateway cannot translate the instance's private IP to a public one, so outbound traffic fails.

The route table is correct (contains 0.0.0.0/0 pointing to the internet gateway), source/destination check enabled is normal and does not block internet access, and the security group is associated and allows outbound traffic. Therefore, the most likely cause is the lack of a public IP address.

Exam trap

The trap is that candidates often overlook the requirement for a public IP address when the route table is correctly configured. They may mistakenly focus on route issues or source/destination check.

Practice this question →

16

MCQmedium

A network engineer is troubleshooting an EC2 instance that cannot connect to S3 via a VPC endpoint. The describe-vpc-endpoints output shows the endpoint is associated with a route table but no subnets. What is the likely issue?

A.The DNS entry for the endpoint is not resolving.

B.The VPC endpoint policy denies access to S3.

C.The VPC endpoint state is not available.

D.The subnet's route table does not include a route for the S3 prefix list via the endpoint.

AnswerD

Gateway Endpoints rely on route table entries; the subnet must have the route.

Why this answer

The VPC endpoint for S3 is a Gateway Endpoint, which is associated with a route table, not a subnet. For the EC2 instance to connect to S3 via the endpoint, the route table associated with the instance's subnet must include a route that directs traffic to the S3 prefix list through the endpoint. If the endpoint is associated with a route table that is different from the subnet's route table, or if the subnet's route table lacks the route, traffic will not use the endpoint.

Therefore, the likely issue is that the subnet's route table does not contain the required route for the S3 prefix list via the endpoint. Option A is incorrect because DNS resolution is not the primary issue; the endpoint DNS names should resolve. Option B is incorrect because the endpoint policy defaults to allow all, and there is no indication of a deny.

Option C is incorrect because the endpoint state is available as per the output.

Practice this question →

17

MCQhard

A company has a VPC with a Transit Gateway (TGW) connected to multiple VPCs and an on-premises network via Direct Connect. The network team wants to implement centralized inspection of all traffic between VPCs and between VPCs and on-premises. Which architecture should they use?

A.Attach a Direct Connect Gateway to the Transit Gateway and configure route propagation.

B.Use AWS Network Firewall in each VPC.

C.Create a Gateway Load Balancer (GWLB) in a dedicated inspection VPC and attach it to the Transit Gateway.

D.Deploy a third-party firewall in each VPC and use VPC peering.

AnswerC

GWLB with appliances allows centralized inspection. TGW routes traffic through the inspection VPC.

Why this answer

Centralized inspection is achieved by using a Gateway Load Balancer with appliances in a dedicated inspection VPC. Transit Gateway route tables direct traffic to the inspection VPC. AWS Network Firewall can also be used but is placed in a VPC.

Direct Connect gateway does not provide inspection.

Practice this question →

18

MCQeasy

A network engineer is monitoring network performance and needs to collect and analyze network metrics from multiple AWS services in a centralized dashboard. Which AWS service should be used to aggregate and visualize these metrics?

A.AWS VPC Flow Logs

B.AWS CloudTrail

C.Amazon CloudWatch Dashboards

D.AWS Config

AnswerC

CloudWatch Dashboards aggregate and visualize metrics.

Why this answer

Amazon CloudWatch Dashboards provide a centralized view of metrics from various AWS services, allowing you to create custom dashboards for monitoring and analysis. Option A is wrong because VPC Flow Logs capture IP traffic information but are not designed for aggregating metrics from multiple services. Option B is wrong because AWS CloudTrail logs API activity for auditing, not performance metrics.

Option D is wrong because AWS Config tracks resource configuration changes, not metrics.

Practice this question →

19

MCQeasy

A network engineer is troubleshooting high latency on an AWS Direct Connect connection. The engineer checks the CloudWatch metrics for the virtual interface and sees that 'ConnectionBpsEgress' and 'ConnectionBpsIngress' are both below 50% of the provisioned bandwidth. Which additional metric should be examined to identify potential bufferbloat?

A.CRAM (Challenge-Response Authentication Mechanism) handshake failures

B.Latency metrics from Amazon CloudWatch

C.PauseFrames (802.3x flow control frames)

D.CRC errors on the physical connection

AnswerC

High pause frames indicate congestion and bufferbloat.

Why this answer

(PauseFrames) is correct because PauseFrames indicate that the link is being flow-controlled due to congestion, which can cause bufferbloat. High pause frame counts suggest the local device is forcing the remote device to pause transmission, leading to increased latency. Option A is incorrect because CRAM is a security protocol, not a network metric.

Option B is incorrect because detailed latency metrics are not available for Direct Connect virtual interfaces. Option D is incorrect because CRC errors indicate physical layer issues, not bufferbloat.

Practice this question →

20

MCQeasy

A company has a VPC with public and private subnets. The public subnets have a NAT gateway for outbound internet access. The private subnets route all 0.0.0.0/0 traffic to the NAT gateway. The network team wants to centrally log all outbound internet traffic from the private subnets. They enable VPC Flow Logs and publish them to Amazon S3. However, they notice that the flow logs are capturing only traffic between instances within the VPC, not the NAT gateway traffic. What should the team do to capture outbound internet traffic?

A.Enable VPC Flow Logs specifically for the NAT gateway's elastic network interface.

B.Enable VPC Flow Logs for all subnets in the VPC.

C.Use AWS CloudTrail to log NAT gateway traffic.

D.Enable VPC Flow Logs for the VPC and publish to CloudWatch Logs instead of S3.

AnswerA

Captures traffic through the NAT gateway.

Why this answer

VPC Flow Logs capture traffic at the network interface level. Traffic from private subnets to the NAT gateway is captured by flow logs on the private subnet instances' ENIs, but the NAT gateway's outbound traffic goes through its own ENI. To log the actual outbound internet traffic, you must enable flow logs on the NAT gateway's ENI.

Option A correctly identifies this. Option B would not capture NAT gateway egress because flow logs are per-ENI. Option C (CloudTrail) logs API calls, not network traffic.

Option D is incorrect because the destination (S3 vs CloudWatch) does not affect what traffic is captured.

Practice this question →

21

MCQmedium

A network engineer is configuring AWS Client VPN for remote access. The engineer creates a Client VPN endpoint and associates it with a target network (subnet) in the VPC. After associating, clients can connect to the VPN but cannot access resources in the VPC. The security groups and network ACLs allow all traffic. What is the most likely issue?

A.The Client VPN endpoint is not associated with a subnet in the VPC

B.The client CIDR range overlaps with the VPC CIDR

C.The Client VPN endpoint does not have an authorization rule to allow access to the VPC CIDR

D.The Client VPN endpoint's route table does not include a route to the VPC CIDR

AnswerD

A route must be added to direct traffic to the VPC.

Why this answer

The Client VPN endpoint's route table must include a route to the VPC CIDR for traffic from clients to reach VPC resources. Without this route, packets are not forwarded to the VPC. Option A is incorrect because the subnet association is properly done; the endpoint is associated with a subnet.

Option B is incorrect because a client CIDR overlap would cause routing conflicts, but the question states clients can connect but cannot access resources, indicating the VPN tunnel is established. Option C is incorrect because authorization rules control access to specific networks (e.g., security groups), but if no route exists, traffic won't reach the VPC even with authorization rules.

Practice this question →

22

MCQmedium

A network engineer created an IAM policy for a user to manage VPC Flow Logs. The user reports they cannot create flow logs and receive an 'AccessDenied' error. What is the MOST likely reason?

A.The ec2:CreateFlowLogs action is missing.

B.The logs:CreateLogGroup resource ARN is too restrictive.

C.The logs:PutLogEvents action is missing.

D.The iam:PassRole action is missing for the flow logs role.

AnswerB

The resource ARN limits log group creation to names starting with '/aws/vpc-flow-logs/', but the user might be using a different name.

Why this answer

The logs:CreateLogGroup action is required to create a log group for VPC Flow Logs. If the IAM policy grants this action but restricts the resource ARN to a specific log group name (e.g., arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*), the user will get an AccessDenied error when trying to create a flow log that would create a log group with a different name. Options A, C, and D are less likely because the policy may include those actions but the resource restriction on logs:CreateLogGroup is the most common cause.

Practice this question →

23

Multi-Selectmedium

Which TWO options are valid ways to monitor network traffic in an AWS environment? (Choose 2.)

Select 2 answers

A.AWS Config

B.AWS CloudTrail

C.VPC Traffic Mirroring

D.Amazon Inspector

E.VPC Flow Logs

AnswersC, E

Copies traffic for deep packet inspection.

Why this answer

VPC Traffic Mirroring (Option C) is a valid way to monitor network traffic because it captures and copies network packets from Elastic Network Interfaces (ENIs) in a VPC and forwards them to monitoring appliances for deep packet inspection, security analysis, or troubleshooting. This allows you to inspect traffic content, including payloads, without impacting the source or destination of the traffic.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with network traffic monitoring, but CloudTrail does not capture data-plane packets or payloads, making VPC Flow Logs and VPC Traffic Mirroring the only correct options for actual network traffic monitoring.

Practice this question →

24

MCQmedium

A company uses AWS CloudWAN to build a global network connecting multiple VPCs and on-premises sites. The network team has configured a core network with a segment that includes VPCs in us-east-1 and eu-west-1. The team notices that traffic between VPCs in different regions is taking a suboptimal path, going through the internet instead of staying within the AWS global network. The team has verified that the core network attachments are correctly configured and that the route tables are propagated. What should the team do to ensure traffic stays within the AWS global network?

A.Establish a VPC peering connection between the two VPCs.

B.Set up an AWS Direct Connect gateway to route traffic between regions.

C.Ensure both VPCs are attached to the same CloudWAN segment.

D.Create a transit gateway in each region and peer them together.

AnswerC

Correct: Same segment ensures traffic stays within CloudWAN and uses AWS global backbone.

Why this answer

CloudWAN uses segments to control routing. If both VPCs are attached to the same segment, traffic between them will use the AWS global network. Option A is wrong because VPC peering creates a direct connection but does not leverage CloudWAN's global backbone and may lead to suboptimal routing.

Option B is wrong because AWS Direct Connect is designed for on-premises connectivity, not inter-region VPC traffic. Option D is wrong because transit gateway peering is unnecessary when using CloudWAN, which already provides inter-region routing via its core network.

Practice this question →

25

MCQeasy

A company is using AWS Direct Connect to connect to its VPC. The network team wants to encrypt all traffic between the on-premises data center and the VPC. Which solution provides encryption?

A.Enable MACsec on the Direct Connect connection.

B.Use an IPsec VPN over the Direct Connect virtual interface.

C.Use AWS Client VPN to connect on-premises to VPC.

D.Enable encryption on the Direct Connect virtual interface.

AnswerB

IPsec VPN over Direct Connect provides an encrypted tunnel for all traffic, ensuring end-to-end encryption between on-premises and VPC.

Why this answer

IPsec VPN over Direct Connect provides encryption for all traffic between on-premises and VPC. Direct Connect itself does not encrypt traffic. MACsec is supported on dedicated Direct Connect connections and provides Layer 2 encryption, but it only encrypts the link between the customer device and AWS, not end-to-end traffic.

AWS Client VPN is for individual clients, not site-to-site. Direct Connect virtual interfaces do not support native encryption. Therefore, the correct solution is to use an IPsec VPN over the Direct Connect virtual interface.

Practice this question →

26

MCQmedium

A network engineer is troubleshooting an AWS Lambda function that needs to create and manage ENIs in a VPC. The Lambda function is unable to create ENIs. The IAM policy attached to the Lambda execution role is shown in the exhibit. What is the issue?

A.The policy restricts the resource to a specific VPC.

B.The policy does not allow the ec2:CreateNetworkInterface action.

C.The policy does not allow the ec2:DeleteNetworkInterface action.

D.The policy is missing the ec2:AttachNetworkInterface action.

AnswerD

Lambda also needs ec2:AttachNetworkInterface to attach the ENI.

Why this answer

The policy includes permissions for ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface, but it is missing ec2:AttachNetworkInterface. Without this action, the Lambda function cannot attach an ENI to the VPC, which is necessary for Lambda to manage ENIs. Option A is incorrect because the resource restriction in the policy is not the issue; the actions are allowed on any resource.

Option B is incorrect because the policy does include ec2:CreateNetworkInterface. Option C is incorrect because it states the policy does not allow ec2:DeleteNetworkInterface, but it does.

Practice this question →

27

MCQeasy

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

A.AWS Config

B.AWS CloudTrail

C.AWS X-Ray

D.VPC Flow Logs

AnswerC

X-Ray traces requests and shows latency between components.

Why this answer

Correct answer: C. AWS X-Ray provides end-to-end tracing and can capture network latency between services, including EC2 instances. It can help identify where delays occur.

Option A (AWS Config) is incorrect because it monitors configuration changes, not performance. Option B (AWS CloudTrail) is incorrect because it records API calls for auditing, not network metrics. Option D (VPC Flow Logs) is incorrect because it captures IP traffic metadata (packet-level) but does not provide latency or performance metrics.

Practice this question →

28

MCQmedium

A network engineer is troubleshooting an issue where an EC2 instance launched in VPC vpc-0abcd1234efgh5678 cannot resolve DNS names for other instances using their private DNS names. The VPC has DHCP options set with domain-name-servers=AmazonProvidedDNS. What is the most likely cause?

A.The VPC attribute 'enableDnsHostnames' is set to false

B.VPC Flow Logs are not enabled

C.The security group on the instances blocks DNS traffic

D.The DHCP options set is not using AmazonProvidedDNS

AnswerA

Without hostnames, instances cannot resolve private DNS names.

Why this answer

For an EC2 instance to resolve private DNS names using the Amazon-provided DNS server, the VPC must have both enableDnsSupport and enableDnsHostnames set to true. The DHCP options are correctly set to AmazonProvidedDNS, so the most likely cause is that enableDnsHostnames is false. Option B is incorrect because VPC Flow Logs are used for monitoring network traffic, not DNS resolution.

Option C is incorrect because security groups by default allow all outbound traffic, and DNS traffic (UDP/53) is not blocked unless explicitly denied. Option D is incorrect because the DHCP options are already set to AmazonProvidedDNS as stated in the stem.

Practice this question →

29

MCQeasy

A network engineer needs to verify the routing path between two EC2 instances in different subnets within the same VPC. Which AWS tool can provide this information?

A.Amazon CloudWatch Logs

B.VPC Reachability Analyzer

C.AWS Config

D.Run traceroute from one instance to the other

AnswerB

Reachability Analyzer tests connectivity and shows the routing path.

Why this answer

VPC Reachability Analyzer can test connectivity and provide the routing path between two resources in the same VPC. Option A is incorrect because Amazon CloudWatch Logs is used for collecting log data, not for analyzing network paths. Option C is incorrect because AWS Config tracks configuration changes and compliance, not real-time path analysis.

Option D is incorrect because running traceroute is not an AWS tool; it is a manual command-line utility that requires access to the instances and does not provide a holistic view of the VPC routing path.

Exam trap

Candidates often confuse VPC Reachability Analyzer with AWS Config or simply default to using traceroute. Remember that Reachability Analyzer is the dedicated AWS service for path verification without requiring instance access.

Practice this question →

30

Multi-Selectmedium

A company has a VPC with public and private subnets. The private subnets have a route to a NAT gateway for outbound internet access. The security team wants to audit all traffic from the private subnets to the internet. Which TWO steps should be taken to capture this traffic?

Select 2 answers

A.Enable VPC Flow Logs on the internet gateway.

B.Create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface.

C.Enable VPC Flow Logs on the NAT gateway's elastic network interface.

D.Set up an AWS Site-to-Site VPN to route traffic through a third-party logging appliance.

E.Enable AWS CloudTrail for the NAT gateway.

AnswersB, C

Flow logs on the NAT gateway ENI capture outbound traffic from private subnets.

Why this answer

To capture traffic from private subnets to the internet through a NAT gateway, you need to enable VPC Flow Logs on the NAT gateway's elastic network interface (option C). Additionally, you can create a VPC Flow Log for the VPC and filter by the NAT gateway's network interface (option B) to capture the same traffic. Option A is incorrect because VPC Flow Logs on the internet gateway capture traffic that reaches the internet gateway, but traffic from private subnets goes through the NAT gateway, not directly through the internet gateway.

Option D is incorrect because a Site-to-Site VPN is not used for outbound internet traffic from private subnets; it is for connecting to on-premises networks. Option E is incorrect because AWS CloudTrail logs API calls, not network traffic.

Practice this question →

31

MCQhard

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

A.Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.

B.Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.

C.Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.

D.Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.

AnswerC

This provides active-active connectivity with fast failover via BFD, and ECMP allows load balancing across VIFs.

Why this answer

It provides true high availability and fast failover by using two separate Direct Connect connections, each with multiple private VIFs, attached to the same transit gateway. BFD (Bidirectional Forwarding Detection) enables sub-second failure detection, and ECMP (Equal-Cost Multi-Path) routing across the VIFs allows active-active load balancing, minimizing packet loss during failover. This design eliminates single points of failure and meets the requirement for rapid convergence with minimal disruption.

Exam trap

The trap here is that candidates often confuse multiple VIFs on a single connection with true redundancy, failing to recognize that physical diversity requires separate Direct Connect connections, not just separate logical interfaces.

How to eliminate wrong answers

Option A is wrong because a single Direct Connect connection with one private VIF is a single point of failure; even with BFD, if the connection or physical link fails, all traffic is lost. Option B is wrong because using two VIFs on the same Direct Connect connection does not provide physical diversity; a failure of the single connection takes down both VIFs, and the backup connection with a single VIF still introduces a single point of failure at the connection level. Option D is wrong because using AWS Site-to-Site VPN as a backup introduces higher latency, lower bandwidth, and slower failover compared to a second Direct Connect connection, and it does not meet the requirement for minimal packet loss during failover.

Practice this question →

32

MCQmedium

A company is using AWS CloudFormation to deploy a VPC with public and private subnets, an internet gateway, and a NAT gateway. The deployment fails with the error: 'Route table rtb-12345678 already has a route with destination 0.0.0.0/0'. The network engineer reviews the template and sees that the public route table has a route to the internet gateway and the private route table has a route to the NAT gateway. Both route tables are defined in the same template. What is the most likely cause of this error?

A.The internet gateway and NAT gateway cannot exist in the same VPC simultaneously.

B.The public and private route tables are the same resource due to a typo in the template.

C.The public route table already has a route to the internet gateway, and adding another default route is not allowed.

D.The NAT gateway route is missing a destination CIDR block.

AnswerB

Correct: Using the same route table ID for both routes causes duplicate route error.

Why this answer

The error indicates that the same route table is being used for both routes, which happens when both resources reference the same route table ID. Option A is wrong because a route table can have multiple routes, but only one default route. Option C is wrong because the error is specific to duplicate routes, not a missing route.

Option D is wrong because internet and NAT gateways can coexist in the same VPC.

Practice this question →

33

Multi-Selecteasy

A network engineer needs to monitor network performance between two EC2 instances in different Availability Zones. Which THREE metrics from Amazon CloudWatch should the engineer use?

Select 3 answers

A.NetworkPacketsIn

B.VolumeQueueLength

C.NetworkPacketsDropped

D.NetworkOut

E.NetworkIn

AnswersA, D, E

Measures number of incoming packets.

Why this answer

Options A, D, and E are correct. NetworkPacketsIn, NetworkOut, and NetworkIn are standard EC2 CloudWatch metrics that measure network traffic volume and packet counts, useful for monitoring network performance between instances. Option B (VolumeQueueLength) is an EBS metric, not network.

Option C (NetworkPacketsDropped) is not a standard CloudWatch metric for EC2.

Practice this question →

34

Multi-Selecthard

A company is designing a multi-region network with Direct Connect. They have two Direct Connect connections in each region. They want to achieve the HIGHEST availability and lowest latency for cross-region traffic. Which THREE design elements should they include?

Select 3 answers

A.Configure BGP ASN prepending to influence path selection

B.Use different Direct Connect providers in each region

C.Use different Direct Connect locations within each region

D.Use multiple virtual interfaces per Direct Connect connection

E.Use the same BGP ASN for all Direct Connect connections

AnswersA, B, C

Helps control traffic flow.

Why this answer

Options A, B, and C are correct. Using different Direct Connect providers in each region avoids a single point of failure and enhances availability. Using different Direct Connect locations within each region provides physical diversity, further increasing resilience.

ASN prepending allows you to influence BGP path selection, enabling you to choose lower-latency paths for cross-region traffic. Option D is incorrect because multiple virtual interfaces per connection are not necessary for the highest availability; they would still share the same underlying physical connection. Option E is incorrect because using the same BGP ASN for all connections can cause routing issues and does not improve availability or latency.

Practice this question →

35

MCQmedium

A company uses AWS Global Accelerator to improve performance for a global application. The application is deployed in two AWS regions behind Network Load Balancers. Users in Asia report high latency even though the accelerator should route them to the nearest endpoint. What is the most likely reason?

A.The endpoint in the closer region is marked unhealthy

B.Traffic Dial is set to 100% for the distant region

C.The accelerator is configured with on-premises endpoints

D.Client affinity is set to source IP

AnswerA

Global Accelerator routes traffic away from unhealthy endpoints.

Why this answer

If the endpoint in the closer region is marked unhealthy, Global Accelerator will automatically route traffic to the next nearest healthy endpoint, which may be in a distant region, causing high latency. Option B is incorrect because if Traffic Dial were set to 100% for the distant region, traffic would be intentionally routed there, so users would not expect routing to the nearest endpoint. Option C is incorrect because on-premises endpoints are not typical for Global Accelerator, and even if used, they would not cause high latency specifically for Asian users if the closer region has healthy endpoints.

Option D is incorrect because client affinity affects stickiness, not overall latency; it would not cause all Asian users to experience high latency.

Practice this question →

36

MCQhard

A company is migrating its on-premises data center to AWS and wants to use AWS Direct Connect for private connectivity. The network team plans to advertise the company's public IP prefixes to AWS via BGP. Which AWS resource must be configured to allow advertisement of these prefixes?

A.A VPN CloudHub topology

B.A public virtual interface on the Direct Connect connection

C.A private virtual interface on the Direct Connect connection

D.A transit virtual interface on the Direct Connect connection

AnswerB

Public VIF is used to advertise public IP prefixes.

Why this answer

A public virtual interface (VIF) on AWS Direct Connect allows BGP peering where you can advertise your public IP prefixes to AWS, enabling private connectivity to public AWS services. Private and transit VIFs do not support customer-originated public prefix advertisements.

Exam trap

The trap here is that candidates often confuse private VIFs (used for VPC connectivity) with public VIFs (used for public IP reachability), assuming that any BGP session on Direct Connect can advertise public prefixes, but only the public VIF is designed for that purpose.

How to eliminate wrong answers

Option A is wrong because a VPN CloudHub topology is used for connecting multiple VPN sites together over AWS VPN, not for advertising public IP prefixes over Direct Connect. Option C is wrong because a private virtual interface is used for connecting to a VPC via private IP addresses and does not support the advertisement of public IP prefixes. Option D is wrong because a transit virtual interface is used for connecting a Direct Connect gateway to a transit gateway, enabling connectivity to multiple VPCs, but it does not handle public prefix advertisements; that is the role of a public VIF.

Practice this question →

37

MCQeasy

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network engineer is troubleshooting connectivity issues and notices that the BGP session between the on-premises router and the AWS Direct Connect virtual interface is down. The engineer has verified the physical connectivity and the VLAN configuration. What should the engineer check next?

A.Ensure the virtual interface type is set to 'public'.

B.Verify that the on-premises router is advertising a CIDR block smaller than /24.

C.Confirm that the BGP ASN configured on the on-premises router matches the one provided by AWS.

D.Check the VPC CIDR range in the route table.

AnswerC

Correct: BGP ASN mismatch prevents session establishment.

Why this answer

Correct answer is C. BGP session establishment requires matching BGP ASN on both sides; if they don't match, the session fails. Option A is incorrect because the virtual interface type (private or public) does not prevent BGP from coming up; it affects routing scope.

Option B is incorrect because the route size advertised does not affect the BGP session itself; AWS accepts routes of any size within limits. Option D is incorrect because the VPC CIDR is used for routing, but not for BGP session establishment; the session can be up even if no routes are propagated.

Practice this question →

38

Multi-Selecthard

A company has a hybrid network with an AWS Direct Connect connection and an AWS Site-to-Site VPN as a backup. The network team notices that traffic is asymmetrically routing through both connections, causing performance issues. Which TWO steps should the team take to ensure traffic uses the primary Direct Connect and only fails over to the VPN? (Choose two.)

Select 2 answers

A.Increase the BGP MED value on the VPN connection to make it less preferred.

B.Enable VPN automatic failover using AWS VPN CloudHub.

C.Configure BGP communities on the Direct Connect to influence route preference.

D.Disable AS path prepend on the Direct Connect BGP session.

E.Advertise a more specific prefix over Direct Connect compared to the VPN.

AnswersC, E

Configuring BGP communities on the Direct Connect connection allows you to influence the local preference, making routes learned via Direct Connect preferred over those from the VPN. This is a reliable method to ensure Direct Connect is the primary path.

Why this answer

BGP communities can be used on the Direct Connect connection to set a higher local preference, making the routes learned via Direct Connect preferred over those from the VPN. Option E is correct: Advertising a more specific prefix over Direct Connect ensures that traffic selects the more specific route, preferring Direct Connect. Option A is incorrect because increasing BGP MED on the VPN would make VPN less preferred, but this is not as effective or reliable as using BGP communities or more specific prefixes for ensuring primary use.

Option B is incorrect because AWS VPN CloudHub is designed for interconnecting multiple VPN sites, not for failover from Direct Connect to VPN. Option D is incorrect because disabling AS path prepend on Direct Connect would actually make Direct Connect more preferred (shorter AS path), but this is not a recommended step to ensure primary use; it may also disrupt existing routing policies. The best practice is to use BGP communities and specific prefix advertisements to achieve the desired traffic flow.

Practice this question →

39

MCQeasy

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?

A.The VPN tunnel is not properly configured with the correct pre-shared key.

B.The security groups on the EC2 instances are blocking inbound traffic from the on-premises network.

C.The virtual private gateway has its own security group that blocks traffic.

D.The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.

AnswerD

Without a route back, return traffic is dropped.

Why this answer

The VPC route tables must have a route to the on-premises network pointing to the virtual private gateway (VGW) for traffic to reach the EC2 instances. Without this route, the VPC has no way to send return traffic or allow inbound traffic from on-premises. Option A is incorrect because the VPN tunnel status is UP, indicating the pre-shared key is correct.

Option B is plausible but less likely; security groups can block traffic, but they are stateful and automatically allow return traffic. The first step in troubleshooting is to verify routes. Option C is incorrect because the VGW does not have security groups; it uses route tables for forwarding decisions.

Practice this question →

40

Drag & Dropmedium

Arrange the steps to configure BGP on a Cisco router for a Direct Connect private virtual interface:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First enter config mode, enable BGP, define the neighbor, advertise prefixes, then verify.

Practice this question →

41

MCQmedium

A company is using AWS Direct Connect with a private VIF to connect to a VPC. They want to ensure high availability by having a second Direct Connect connection. Which configuration provides the most resilient setup?

A.Two Direct Connect connections from the same provider to the same Direct Connect location with separate VIFs.

B.Two Direct Connect connections from different providers to different Direct Connect locations.

C.One Direct Connect connection and one Site-to-Site VPN as backup.

D.One Direct Connect connection with two private VIFs.

AnswerB

Diverse paths provide maximum resilience.

Why this answer

Using two Direct Connect connections from different providers to different AWS Direct Connect locations eliminates single points of failure. A single provider outage or location failure will not disrupt connectivity. Option A is incorrect because two connections from the same provider to the same location share the same physical infrastructure, so a single failure can affect both.

Option C is incorrect because a Site-to-Site VPN backup typically offers lower bandwidth and higher latency compared to Direct Connect, and it relies on the public internet, which is less reliable than a dedicated connection. Option D is incorrect because two private VIFs on a single Direct Connect connection still share the same physical link; a link failure impacts both VIFs.

Practice this question →

42

MCQmedium

A network engineer is monitoring network performance between an EC2 instance and an on-premises server using AWS VPN. The engineer notices intermittent packet loss. Which AWS service can provide detailed network metrics and path visualization to troubleshoot?

A.Amazon CloudWatch

B.VPC Flow Logs

C.AWS Transit Gateway Network Manager

D.AWS X-Ray

AnswerC

Network Manager provides topology and monitoring for VPN and Direct Connect.

Why this answer

AWS X-Ray is for application tracing, not network path. VPC Flow Logs provide packet metadata but not path visualization. Amazon CloudWatch can monitor VPN tunnels but not path.

AWS Transit Gateway Network Manager provides network topology and path visualization.

Practice this question →

43

Multi-Selectmedium

A network engineer is troubleshooting a VPN connectivity issue. The VPN tunnel is up, but traffic is not passing. Which TWO AWS services should the engineer use to diagnose the problem?

Select 2 answers

A.AWS Config

B.VPC Flow Logs

C.AWS CloudTrail

D.AWS Direct Connect

E.Amazon CloudWatch

AnswersB, E

Flow Logs can show traffic flow to the VPN endpoint.

Why this answer

The correct answers are B and E. VPC Flow Logs capture IP traffic information for network interfaces, which can show if traffic is reaching the VPN endpoint. Amazon CloudWatch provides VPN tunnel metrics (e.g., tunnel state, data in/out) and logs, helping to diagnose connectivity issues.

Option A (AWS Config) is incorrect because it tracks resource configuration changes, not network traffic. Option C (AWS CloudTrail) is incorrect because it logs API calls, not data plane traffic. Option D (AWS Direct Connect) is incorrect because it is a dedicated connection service, not a diagnostic tool for VPN.

Practice this question →

44

Multi-Selectmedium

A company is designing a multi-VPC architecture using AWS Transit Gateway. They need to ensure that traffic between VPCs is encrypted and that only specific VPCs can communicate with each other. Which two services should they use together? (Choose TWO.)

Select 2 answers

A.AWS PrivateLink

B.AWS Direct Connect

C.AWS Transit Gateway

D.AWS VPN CloudHub

E.AWS Network Firewall

AnswersC, E

AWS Transit Gateway provides transitive routing between VPCs, forming the connectivity backbone.

Why this answer

AWS Transit Gateway provides transitive routing between VPCs, enabling scalable connectivity. AWS Network Firewall provides centralized stateful inspection and filtering of traffic between VPCs, allowing you to enforce policies that require traffic to be encrypted (e.g., by blocking non-encrypted flows). While Network Firewall itself does not perform encryption, it can inspect and drop unencrypted traffic to meet encryption requirements.

Practice this question →

45

MCQhard

A company is using AWS Client VPN for remote access. Users can authenticate and establish a VPN connection, but they cannot access resources in the VPC. The Client VPN endpoint is associated with a subnet in the VPC. The security group for the Client VPN endpoint allows all traffic. What is the most likely cause?

A.There is no authorization rule to allow access to the VPC CIDR.

B.The Client VPN endpoint is not associated with the correct subnet.

C.The route table for the subnet does not have a route to the Client VPN endpoint.

D.The Client VPN endpoint's server certificate is expired.

AnswerA

Authorization rules define which networks VPN clients can access; without it, traffic is blocked.

Why this answer

AWS Client VPN requires an authorization rule to specify which networks clients can access. Without an authorization rule allowing access to the VPC CIDR, traffic from clients is dropped even if the security group allows all traffic. The endpoint is associated with a subnet, so option B is incorrect.

The subnet's route table automatically has a route for the VPC CIDR locally, so option C is incorrect. Since users can authenticate and establish a connection, the server certificate is valid, making option D incorrect.

Practice this question →

46

MCQmedium

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices intermittent packet loss and latency spikes during peak hours. Which action should the team take to diagnose the issue?

A.Increase the bandwidth of the Direct Connect connection

B.Enable Bidirectional Forwarding Detection (BFD) on the virtual interfaces

C.Apply a tag to the Direct Connect connection for monitoring

D.Change the private ASN on the customer router

AnswerB

Enabling Bidirectional Forwarding Detection (BFD) on the virtual interfaces allows rapid detection of connectivity failures, which can help isolate whether the issue is on the AWS side or the customer side.

Why this answer

Enabling Bidirectional Forwarding Detection (BFD) on the virtual interfaces allows rapid detection of connectivity failures, which can help isolate whether the issue is on the AWS side or the customer side. Option A is wrong because increasing bandwidth may not resolve intermittent issues caused by routing problems. Option C is wrong because tagging does not impact network performance.

Option D is wrong because changing the private ASN does not affect performance.

Practice this question →

47

MCQhard

A network engineer troubleshoots a VPN connection that shows 'available' state but traffic is not passing. The on-premises firewall logs show that the tunnel is established, but no traffic. The engineer checks the VPN configuration. Based on the exhibit, what is the MOST likely cause of the problem?

A.The VPN connection is not in 'available' state.

B.The VPN is configured for BGP (StaticRoutesOnly: false), but only a static route is added.

C.The outside IP addresses are not routable over the internet.

D.The inside IP addresses for the tunnels are missing.

AnswerB

With StaticRoutesOnly: false, BGP is required for route propagation; static routes are ignored.

Why this answer

The VPN connection has `StaticRoutesOnly` set to `false`, which indicates that dynamic routing (BGP) is expected for route propagation. However, the route shown is a static route, so the VPN will not use it, as BGP is required. Without a proper BGP session or a static route with `StaticRoutesOnly` set to `true`, traffic cannot pass through the VPN.

Option A is incorrect because the VPN state is indeed 'available'. Option C is incorrect because the outside IP addresses are routable over the internet. Option D is incorrect because the inside IP addresses (tunnel interfaces) are present in the configuration.

Practice this question →

48

MCQhard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that some VPCs cannot communicate with each other even though they are attached to the same transit gateway. What is the most likely cause?

A.The security groups on the instances are not allowing inbound traffic from the other VPCs.

B.The transit gateway route tables are missing routes to the other VPCs.

C.The VPC attachments are not in the 'available' state.

D.The VPCs' network ACLs are blocking traffic.

AnswerB

Proper routing configuration is essential for inter-VPC communication.

Why this answer

Transit Gateway uses route tables to control inter-VPC traffic. If the route tables do not have routes to the other VPCs, or if the VPCs are in different route tables that are not associated or propagated correctly, communication fails. The most common issue is that the transit gateway route tables are not properly configured with routes to the other VPC attachments.

Practice this question →

49

MCQeasy

A network engineer needs to monitor the number of bytes dropped by a VPC flow log for a specific network interface. Which Amazon CloudWatch metric should be used?

A.NetworkPacketsDropped

B.VPCFlowLogsDroppedPackets

C.ENIDroppedPackets

D.FlowLogsBytesDropped

AnswerD

Correct. This is the option that corresponds to the 'BytesDropped' metric under the AWS/FlowLogs namespace, which tracks bytes dropped by flow logs.

Why this answer

The correct CloudWatch metric for monitoring dropped bytes from VPC Flow Logs is 'BytesDropped' under the AWS/FlowLogs namespace. While option D uses the name 'FlowLogsBytesDropped', this is a common but non-standard variation. The intended correct answer is D as it is the only option that references dropped data from VPC Flow Logs.

Practice this question →

50

MCQhard

A company has a Direct Connect connection with a public VIF to access AWS public services. The on-premises network team reports that they can reach S3 but not DynamoDB. The route table on the customer router shows a default route to the public VIF. What is the most likely cause?

A.The Direct Connect connection is degraded and only supports S3 traffic.

B.The BGP session between the customer router and AWS is down.

C.The on-premises firewall is blocking outbound traffic to the DynamoDB IP ranges.

D.The VPC route table does not have a route to the DynamoDB endpoint.

AnswerC

Different AWS services have different IP ranges; firewall may block DynamoDB.

Why this answer

DynamoDB uses a different set of public IP ranges than S3, and the on-premises firewall might block access to those ranges. Option A is wrong because the Direct Connect connection is a single physical link; if it were degraded, it would affect all traffic, not just DynamoDB. Option B is wrong because the public VIF does use BGP, but the customer router has a default route to the public VIF, indicating the BGP session is established and routes are being received.

Option D is wrong because the public VIF accesses AWS public services directly, not through the VPC route table.

Practice this question →

51

MCQhard

A company has a Direct Connect connection with a private VIF to a VPC. The on-premises router is advertising a default route (0.0.0.0/0) via BGP. The VPC has an internet gateway attached, and the route table has a default route to the internet gateway. The network team notices that traffic from on-premises to the internet is not working as expected. What is the most likely cause?

A.The BGP session is not established.

B.The on-premises router is advertising a default route, causing a routing conflict.

C.The VPC route table does not have a route to the internet gateway for the on-premises traffic.

D.The private VIF is associated with the wrong VLAN.

AnswerB

The default route from Direct Connect may override the internet gateway route, breaking internet access for on-premises traffic.

Why this answer

The on-premises router advertising a default route (0.0.0.0/0) via BGP over the private VIF causes a routing conflict because the VPC route table already has a default route pointing to the internet gateway. When traffic from on-premises destined for the internet enters the VPC, it matches the more specific BGP-learned default route and is forwarded back toward the on-premises router (or black-holed), rather than being sent to the internet gateway. This creates a routing loop or asymmetric routing, breaking internet connectivity from on-premises.

Exam trap

AWS often tests the misconception that a default route advertised via BGP over Direct Connect is harmless or that the internet gateway route will always take precedence, but in reality, the VPC route table matches the most specific route (both are /0), and the BGP-learned route over the virtual private gateway is preferred for traffic entering the VPC from on-premises, causing the conflict.

How to eliminate wrong answers

Option A is wrong because if the BGP session were not established, the on-premises router would not be advertising any routes, and the issue described (traffic not working) would be due to a lack of routing, not a conflict; the scenario explicitly states the on-premises router is advertising a default route, implying BGP is established. Option C is wrong because the VPC route table does have a default route to the internet gateway (as stated in the question), so the absence of such a route is not the cause. Option D is wrong because a private VIF associated with the wrong VLAN would prevent the VIF from functioning at Layer 2, causing complete loss of connectivity (not just internet traffic), and the question indicates that the BGP session is established and routes are being exchanged, which requires correct VLAN association.

Practice this question →

52

MCQmedium

A company uses AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They notice that traffic between two VPCs is taking a suboptimal path through the on-premises network instead of staying within AWS. What configuration change should be made to ensure optimal routing?

A.Enable route propagation from the VPC attachments into the Transit Gateway route table.

B.Disable cross-zone load balancing on the Transit Gateway.

C.Add static routes to the Transit Gateway route table pointing to the VPN attachment.

D.Modify the VPC route tables to add routes to the other VPC via the Transit Gateway.

AnswerA

Route propagation allows VPC routes to be exchanged, enabling direct routing.

Why this answer

Transit Gateway route tables control the path; enabling route propagation from VPC attachments will add routes for direct VPC-to-VPC communication. Option B is incorrect because cross-zone load balancing is a feature of load balancers, not Transit Gateway routing. Option C is incorrect because adding static routes to the VPN attachment would force traffic through the VPN, which is suboptimal.

Option D is incorrect because modifying VPC route tables to point to the Transit Gateway is necessary for VPCs to send traffic to the Transit Gateway, but it does not control the Transit Gateway's internal path selection; the issue is about the Transit Gateway route table, not VPC route tables.

Practice this question →

53

MCQeasy

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect but cannot access any resources. The VPN is configured with a security group that allows all traffic. What should the administrator check?

A.The client VPN security group inbound rules

B.The client VPN endpoint certificate

C.The client VPN route table

D.The client VPN authorization rules

AnswerD

Authorization rules define which networks clients can access.

Why this answer

Client VPN uses an authorization rule to allow access to specific networks. Without an authorization rule, even if the security group allows traffic, the VPN will not forward traffic.

Practice this question →

54

MCQmedium

A company has a VPC with public and private subnets. The security team wants to detect and alert on any SSH traffic (port 22) that originates from the internet to any EC2 instance in the VPC. Which solution achieves this with minimal operational overhead?

A.Enable VPC Flow Logs, publish to CloudWatch Logs, and create a metric filter for SSH traffic.

B.Configure a security group rule to deny inbound SSH and enable security group logging.

C.Use AWS Config to detect security group rules that allow SSH from 0.0.0.0/0.

D.Enable Amazon GuardDuty and rely on its threat detection.

AnswerA

This approach logs traffic and alerts on SSH without manual inspection.

Why this answer

VPC Flow Logs can be published to CloudWatch Logs, and a CloudWatch Logs filter metric can detect SSH traffic. Security Groups can deny traffic but not alert. AWS Config can track configuration changes.

GuardDuty detects threats but not specifically SSH traffic alerts.

Practice this question →

55

MCQmedium

A company has a multi-account AWS environment using AWS Transit Gateway with a centralized network account. The network team wants to ensure that only specific VPCs can communicate with each other. What is the best practice to achieve this?

A.Configure security groups in each VPC to allow traffic only from specific VPC CIDRs.

B.Use VPC peering connections between the VPCs that need to communicate.

C.Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.

D.Use AWS Network Manager to create routing policies.

AnswerC

Multiple Transit Gateway route tables allow you to isolate VPC attachments and control which VPCs can communicate by managing route propagation and static routes.

Why this answer

Transit Gateway route tables allow you to control routing between VPC attachments. By creating multiple route tables and associating each VPC attachment with the appropriate one, you can isolate or allow communication as needed. Option A is wrong because security groups operate at the instance/ENI level, not at the transit gateway level, so they cannot control VPC-to-VPC communication via Transit Gateway.

Option B is wrong because VPC peering is point-to-point and does not scale well, nor does it leverage the centralized Transit Gateway. Option D is wrong because AWS Network Manager is used for monitoring and visualizing global networks, not for defining routing policies.

Practice this question →

56

MCQmedium

A company is using AWS Site-to-Site VPN connections to connect multiple branch offices to a central VPC. The network team wants to ensure high availability and automatic failover if one VPN tunnel goes down. Which configuration should be implemented?

A.Configure a second VPN connection to the same customer gateway and use BGP with equal-cost multipath

B.Use the two tunnels provided by the VPN connection with dynamic routing (BGP)

C.Use a single tunnel and rely on AWS automatic recovery

D.Configure static routes with a higher metric for the secondary tunnel

AnswerB

Two tunnels with BGP provide automatic failover.

Why this answer

Each AWS Site-to-Site VPN connection provides two tunnels for high availability. By using dynamic routing (BGP) with both tunnels, the VPN automatically fails over to the second tunnel if the first goes down, without manual intervention. This meets the requirement for automatic failover and high availability.

Exam trap

The trap here is that candidates assume a single VPN connection with two tunnels is not enough, and they over-engineer by adding a second VPN connection or using static routes, missing that AWS's built-in dual-tunnel design with BGP already provides automatic failover.

How to eliminate wrong answers

Option A is wrong because configuring a second VPN connection to the same customer gateway with BGP and ECMP does not provide automatic failover within a single VPN connection; it adds complexity and is not the standard AWS HA design. Option C is wrong because a single tunnel lacks redundancy; AWS automatic recovery only restores a failed tunnel, but there is no failover path during the recovery period, causing downtime. Option D is wrong because static routes with a higher metric for the secondary tunnel do not support automatic failover with BGP; static routing requires manual intervention or additional scripting to detect failure and switch routes, and it does not leverage BGP's dynamic path selection.

Practice this question →

57

Multi-Selecthard

Which THREE are best practices for designing a highly available AWS Direct Connect connection? (Choose 3.)

Select 3 answers

A.Use a single Direct Connect connection with redundant virtual interfaces

B.Use multiple Direct Connect connections to different AWS Direct Connect locations

C.Configure BGP with graceful restart and fast failover timers

D.Connect to multiple AWS Direct Connect routers in the same location

E.Use a single large Direct Connect connection instead of multiple smaller ones

AnswersB, C, D

Diverse locations provide geographical redundancy.

Why this answer

Using multiple Direct Connect connections to different AWS Direct Connect locations provides geographic redundancy. If one location experiences an outage, traffic can fail over to the other location, ensuring high availability. This aligns with AWS best practices for resilient hybrid networking.

Exam trap

AWS often tests the misconception that redundant virtual interfaces on a single physical connection provide high availability, but the physical link itself remains a single point of failure.

Practice this question →

58

MCQhard

An engineer is trying to create a VPC Flow Log that delivers to a CloudWatch Logs log group in the same account. The IAM role used has the above trust policy. However, the flow log creation fails with an error. What is the most likely reason?

A.The log group does not exist yet.

B.The trust policy incorrectly specifies the service principal; it should be 'ec2.amazonaws.com'.

C.The IAM role lacks a permissions policy that grants the actions on the log group.

D.The resource ARN in the trust policy does not include the log group name.

AnswerC

The trust policy allows the service to assume the role, but the role needs a permissions policy to perform the actions.

Why this answer

The trust policy shown trusts the VPC Flow Logs service principal, but the IAM role itself must have a permissions policy that allows the actions on the log group. The exhibit only shows the trust policy; the permissions policy is missing. The error likely indicates that the role does not have the necessary permissions to perform the actions.

Practice this question →

59

MCQmedium

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that S3 traffic is taking a suboptimal path over the internet instead of the Direct Connect. Which configuration is MOST likely missing?

A.The VPC route tables are not updated to include the Direct Connect route

B.The public VIF is not associated with the VPC

C.A Direct Connect gateway is not attached to the VPC

D.A VPC endpoint for S3 is not configured

AnswerD

Correct. If S3 traffic originates from a VPC, a VPC endpoint for S3 is needed to keep traffic private. Without it, traffic may take a suboptimal path over the internet.

Why this answer

For a public VIF, S3 traffic from on-premises should use Direct Connect if the on-premises router is configured to route S3 prefixes to the Direct Connect connection. The provided options do not address this missing configuration. None of the options (VPC route tables, VIF association, Direct Connect gateway, or VPC endpoint) are correct for this scenario.

The question may need to be revised to include an appropriate option.

Exam trap

Candidates often think VPC route tables need updating for public VIF, but the real issue is on-premises routing or, in this case, missing VPC endpoint for S3.

Practice this question →

60

MCQeasy

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). An EC2 instance in the private subnet needs to download patches from the internet. The team creates a NAT gateway in the public subnet and updates the private subnet route table to route 0.0.0.0/0 to the NAT gateway. The EC2 instance still cannot reach the internet. The team confirms the NAT gateway has an elastic IP and the public subnet has an internet gateway. What is the MOST likely cause?

A.The private subnet route table does not have a route for the NAT gateway's IP.

B.The network ACL for the private subnet denies outbound traffic to the internet.

C.The public subnet does not have a route to the internet gateway.

D.The NAT gateway does not have source/destination check disabled.

AnswerB

Network ACL must allow outbound ephemeral ports and inbound return traffic.

Why this answer

The most likely cause is that the network ACL (NACL) for the private subnet denies outbound traffic to the internet. Even though the route table correctly points 0.0.0.0/0 to the NAT gateway, the NACL is a stateless firewall that can block outbound traffic if it doesn't allow the necessary ephemeral ports. It must also allow inbound return traffic.

Option A is incorrect because the private subnet route table already has a route to the NAT gateway. Option C is incorrect because the public subnet already has a route to the internet gateway. Option D is incorrect because the NAT gateway is a managed service with source/destination check automatically disabled.

Practice this question →

61

MCQeasy

A company wants to monitor network traffic between VPCs in the same AWS Region that are connected via VPC Peering. Which AWS service can provide visibility into the traffic?

A.VPC Flow Logs

B.AWS Config

C.AWS Direct Connect

D.AWS CloudTrail

AnswerA

VPC Flow Logs captures IP traffic for network interfaces, including those involved in VPC peering connections.

Why this answer

VPC Flow Logs can be enabled on the peering connection to capture traffic. Option B is wrong because AWS Config does not capture network traffic. Option C is wrong because AWS Direct Connect is for on-premises connectivity, not VPC traffic monitoring.

Option D is wrong because AWS CloudTrail does not capture network traffic (it logs API calls).

Practice this question →

62

MCQmedium

A company has multiple VPCs connected via VPC peering. They want to simplify network management and reduce the number of peering connections. Which AWS service should they use?

A.AWS PrivateLink

B.AWS VPN CloudHub

C.AWS Transit Gateway

D.AWS Direct Connect Gateway

AnswerC

Transit Gateway provides hub-and-spoke connectivity.

Why this answer

Transit Gateway acts as a hub to connect multiple VPCs and on-premises networks, reducing the need for full mesh peering.

Practice this question →

63

MCQeasy

A company has a Direct Connect connection with a private virtual interface to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection. They have enabled VPC Flow Logs for the VPC, but the flow logs do not show traffic that traverses the Direct Connect. The team needs a solution to capture the bandwidth usage of the Direct Connect connection. Which solution should they implement?

A.Use CloudWatch metrics for the Direct Connect connection.

B.Enable AWS CloudTrail for the Direct Connect connection.

C.Enable VPC Flow Logs on the Direct Connect virtual interface.

D.Use AWS Config rules to monitor bandwidth.

AnswerA

CloudWatch provides Direct Connect metrics.

Why this answer

Direct Connect publishes metrics to CloudWatch, including bandwidth utilization, connection state, and BGP status. These metrics can be used to monitor the bandwidth usage of the Direct Connect connection. VPC Flow Logs capture IP traffic within the VPC, not traffic on the Direct Connect physical connection.

Option B is wrong because CloudTrail logs API calls, not bandwidth metrics. Option C is wrong because flow logs cannot be enabled on a Direct Connect virtual interface; they only capture traffic on VPC network interfaces. Option D is wrong because AWS Config rules are used for compliance and configuration monitoring, not for bandwidth metrics.

Practice this question →

64

MCQhard

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a private subnet and an RDS database in another VPC connected via a VPC peering connection. The connection works for a few minutes and then drops. CloudWatch logs show no errors on the peering connection. What should the engineer check first?

A.The DNS resolution settings of the VPC peering connection.

B.The network ACL of the subnet where the EC2 instance resides.

C.The security group attached to the RDS database allowing traffic from the EC2 instance.

D.The route tables in both VPCs to ensure they have routes pointing to the peering connection for the respective CIDR blocks.

AnswerD

Missing or incorrect routes can cause asymmetric routing and drops.

Why this answer

Intermittent connectivity over a VPC peering connection is often caused by missing or incorrect route table entries. Traffic must be able to return from the RDS database VPC to the EC2 instance VPC, so both VPCs need routes pointing to the peering connection for the respective CIDR blocks. Option A is incorrect because DNS resolution settings affect name resolution, not connectivity drops.

Option B is incorrect because network ACLs are stateless and would cause consistent blocking, not intermittent drops. Option C is incorrect because security groups are stateful and allow return traffic automatically; they would not cause intermittent issues once allowed.

Practice this question →

65

Multi-Selecthard

A company is using AWS Transit Gateway with multiple VPCs and Direct Connect Gateway. They want to ensure that traffic between VPCs and on-premises is encrypted. Which TWO solutions can achieve this?

Select 2 answers

A.Enable MACsec on the Direct Connect connection

B.Create a VPN attachment on the Transit Gateway and configure IPsec VPN to on-premises

C.Use Transit Gateway IPsec VPN to encrypt traffic between VPCs

D.Enable IPsec on the private virtual interface

E.Use VPC peering with encryption

AnswersA, B

MACsec encrypts at Layer 2 between customer router and AWS.

Why this answer

The correct answers are A and B. MACsec (802.1ae) encrypts traffic at Layer 2 on the Direct Connect connection, providing encryption between the on-premises device and AWS. A VPN attachment on the Transit Gateway establishes an IPsec VPN between the Transit Gateway and an on-premises VPN device, encrypting traffic at Layer 3.

Option C is incorrect because Transit Gateway does not have native IPsec capabilities; it relies on VPN attachments for IPsec. Option D is incorrect because IPsec is not supported over a private virtual interface; IPsec is typically used over a public virtual interface or a VPN connection. Option E is incorrect because VPC peering does not extend to on-premises traffic; it is only between VPCs.

Practice this question →

66

Multi-Selecthard

Which TWO actions are recommended to troubleshoot asymmetric routing in a VPC with multiple NAT gateways?

Select 2 answers

A.Enable source/destination check on all EC2 instances

B.Use a Network Load Balancer to distribute traffic

C.Disable VPC Flow Logs

D.Use a single NAT gateway per Availability Zone

E.Ensure route tables point to the NAT gateway in the same subnet's Availability Zone

AnswersD, E

This ensures consistent routing within an AZ.

Why this answer

Asymmetric routing occurs when traffic takes different paths. Using a single NAT gateway per AZ and ensuring route tables point to the NAT gateway in the same subnet's AZ can prevent this. Additionally, disabling source/destination check on instances that do not need it can help, but for NAT gateways, this is not configurable.

Practice this question →

67

Multi-Selecthard

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The network engineer needs to capture all traffic between the VPC and the internet. Which THREE resources must have VPC Flow Logs enabled?

Select 3 answers

A.Internet gateway

B.NAT gateway

C.Subnet

D.VPC

E.Egress-only internet gateway

AnswersA, B, E

The internet gateway's ENI captures traffic to/from the internet.

Why this answer

Options A (Internet gateway), B (NAT gateway), and E (Egress-only internet gateway) are correct because each of these resources has an attached network interface that can have VPC Flow Logs enabled to capture all traffic to and from the internet. Specifically, the internet gateway handles IPv4 and IPv6 traffic, the NAT gateway handles IPv4 traffic from private subnets, and the egress-only internet gateway handles IPv6 traffic from private subnets. Option C (Subnet) is incorrect because flow logs are configured on network interfaces, not on subnets directly.

Option D (VPC) is incorrect because flow logs are not attached to the VPC itself; they are attached to individual network interfaces.

Practice this question →

68

MCQhard

A network engineer is troubleshooting connectivity issues between two VPCs that are connected via VPC peering. The VPCs are in the same region and have overlapping CIDR blocks. The engineer can ping the private IP of an instance in the peered VPC from an instance in the first VPC. However, traffic on TCP port 443 (HTTPS) fails. Which is the most likely cause?

A.The network ACL in the target subnet is blocking inbound HTTPS traffic

B.The security group of the target instance does not allow inbound HTTPS traffic from the source

C.The VPC peering connection is not in the 'active' state

D.The route tables in both VPCs do not have routes to the peered VPC's CIDR

AnswerB

Security groups are stateful; ICMP may be allowed but HTTPS not.

Why this answer

The security group of the target instance must allow inbound HTTPS traffic from the source instance's security group or CIDR. Option A is incorrect because ICMP works, indicating that network ACLs are allowing traffic; network ACLs are stateless and would block ICMP if misconfigured. Option C is incorrect because the VPC peering connection must be active for any traffic to pass, and ICMP works.

Option D is incorrect because route tables must have routes to the peered VPC's CIDR for traffic to flow, and ICMP works.

Practice this question →

69

Multi-Selecthard

A company has a global application deployed across multiple AWS regions. The application uses Application Load Balancers (ALBs) and Auto Scaling groups. The network team wants to route traffic to the nearest region based on latency, and also wants to failover to another region if the primary region becomes unhealthy. Which THREE services should be used together to achieve this? (Choose THREE.)

Select 3 answers

A.Amazon CloudFront with origin failover

B.Amazon Route 53 latency-based routing

C.Amazon CloudWatch alarms to detect regional health

D.AWS Lambda to update Route 53 records on failover

E.AWS Global Accelerator

AnswersB, C, D

Routes based on latency.

Why this answer

Route 53 latency-based routing (B) directs traffic to the region with the lowest latency. CloudWatch alarms (C) can monitor health metrics like ALB 5xx errors or instance health to detect regional failure. AWS Lambda (D) can be triggered by CloudWatch alarms to automatically update Route 53 records (e.g., change failover records or disable unhealthy records) to redirect traffic to a healthy region.

Option A (CloudFront with origin failover) is for content delivery and static origin failover, not dynamic routing based on latency and regional health. Option E (Global Accelerator) provides anycast IP and global traffic optimization but does not natively support latency-based routing to the nearest region with automatic failover based on CloudWatch alarms in the same manner; it has different health check mechanisms and is not the standard combination described.

Practice this question →

70

MCQeasy

A network engineer is troubleshooting high latency to an application hosted in Amazon EC2. The application uses an Application Load Balancer. Which metrics in Amazon CloudWatch should be examined to identify if the load balancer is causing latency?

A.HTTP 5XX Count

B.ActiveConnectionCount

C.TargetResponseTime

D.RequestCount

AnswerC

TargetResponseTime measures the time taken by the target to respond, which directly indicates backend latency.

Why this answer

TargetResponseTime measures the time taken by the target to respond, which directly indicates backend latency. Option A (HTTP 5XX Count) is wrong because it indicates errors, not latency. Option B (ActiveConnectionCount) is wrong because it measures concurrent connections, not latency.

Option D (RequestCount) is wrong because it is a count of requests, not latency.

Practice this question →

71

MCQmedium

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones in a VPC. The application communicates with an on-premises database over an AWS Direct Connect private VIF. The network team has configured a VPN connection as a backup. Recently, the application experienced intermittent timeouts when accessing the database. The team suspects asymmetric routing because the primary Direct Connect and backup VPN are both active. The network team wants to ensure that all traffic to the on-premises network uses the Direct Connect when it is available, and only fails over to the VPN if Direct Connect goes down. The BGP sessions are configured on both connections. The Direct Connect advertises the on-premises CIDR of 10.0.0.0/16, and the VPN advertises the same CIDR. The team has access to the on-premises router configuration and AWS console. Which action should the team take to resolve the issue?

A.Add a static route in the VPC route table pointing to the Direct Connect virtual interface for the on-premises CIDR.

B.Configure the on-premises router to prepend one or more AS numbers to the routes advertised over the VPN BGP session.

C.Advertise a more specific prefix (e.g., 10.0.0.0/24) over the VPN BGP session to attract traffic.

D.Disable BGP on the VPN connection and use static routes instead.

AnswerB

AS path prepending on the VPN makes the VPN path less preferred, so Direct Connect is used when available.

Why this answer

AS path prepending on the VPN BGP session makes the VPN path less preferred by BGP (longer AS path). Since the Direct Connect path has a shorter AS path, BGP will select the Direct Connect path for all traffic to the on-premises CIDR, ensuring symmetric routing. Option A is incorrect because static routes do not provide dynamic failover and can cause routing issues.

Option C is incorrect because advertising a more specific prefix over VPN would make the VPN path more specific (longest prefix match), causing traffic to prefer the VPN, exacerbating the problem. Option D is incorrect because disabling BGP on the VPN removes dynamic routing and reduces redundancy.

Practice this question →

72

MCQhard

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The template includes an Internet Gateway and a NAT Gateway. After deployment, instances in the private subnet cannot access the internet. The network engineer checks the route tables and finds that the private subnet route table has a default route pointing to the NAT Gateway. What is the most likely cause of the issue?

A.The NAT Gateway is deployed in the private subnet instead of the public subnet.

B.The security group attached to the NAT Gateway blocks outbound traffic.

C.The private subnet route table does not have a default route (0.0.0.0/0) to the NAT Gateway.

D.The NAT Gateway is in a private subnet and has no route to the internet gateway.

AnswerA

NAT Gateway must be in a public subnet with a route to IGW to function.

Why this answer

The NAT Gateway must be deployed in a public subnet with a route to the Internet Gateway. If it is in a private subnet, it cannot reach the internet, so instances in the private subnet cannot use it for outbound traffic. Option B is incorrect because security groups by default allow outbound traffic.

Option C is incorrect because the question states the private subnet route table has a default route pointing to the NAT Gateway. Option D is incorrect because while the NAT Gateway being in a private subnet and lacking a route to the IGW is a related issue, the most direct cause is that the NAT Gateway itself is in the wrong subnet, as stated in option A.

Practice this question →

73

Multi-Selectmedium

A network engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a public subnet and an on-premises server over AWS Direct Connect. The instance can reach the internet but cannot reach the on-premises server. Which TWO actions should the engineer take to diagnose the issue?

Select 2 answers

A.Check the VPC route table to ensure a route exists for the on-premises CIDR pointing to the virtual private gateway

B.Check the VPN connection status to ensure the tunnel is up

C.Check the security group attached to the EC2 instance to ensure it allows inbound traffic from the on-premises CIDR

D.Enable VPC Flow Logs and analyze them for dropped packets

E.Check the network ACLs for the subnet to ensure they allow inbound traffic from on-premises

AnswersA, C

Correct. The VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway to route traffic over Direct Connect.

Why this answer

The correct answers are A and C. For connectivity between an EC2 instance in a public subnet and an on-premises server over AWS Direct Connect, two key checks are: (1) The VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway (VGW) to route traffic to the Direct Connect connection. (2) The security group attached to the EC2 instance must allow inbound traffic from the on-premises CIDR, as security groups act as a stateful firewall for the instance. Option B is incorrect because Direct Connect uses a virtual private gateway, not a VPN tunnel.

Option D is incorrect because VPC Flow Logs are used for analysis, not real-time diagnosis. Option E is incorrect because network ACLs are stateless; outbound traffic does not automatically allow return traffic, so explicit inbound rules are required for the return traffic.

Practice this question →

74

MCQhard

A network engineer is configuring an AWS Site-to-Site VPN with dynamic routing (BGP). The customer gateway device is a Cisco router. The VPN tunnel is established, but BGP is not forming. Which configuration on the Cisco router is most likely missing?

A.The VPN connection's local IP address.

B.The correct IP address for the tunnel interface.

C.The pre-shared key for IKE phase 1.

D.The BGP neighbor statement with the correct Amazon ASN (64512).

AnswerD

ASN mismatch is a common cause of BGP not forming.

Why this answer

The VPN tunnel is established, indicating IKE phase 1 and IPsec are functioning, so options A, B, and C are not the issue. For BGP to form, the Cisco router must have a BGP neighbor statement pointing to the correct Amazon ASN (64512) and the tunnel interface IP. Without this, BGP will not establish a session.

Options A, B, and C are incorrect because the tunnel is up, so local IP, tunnel interface IP, and pre-shared key are properly configured.

Practice this question →

75

MCQeasy

A network engineer is troubleshooting intermittent connectivity issues between an on-premises data center and AWS over a Direct Connect connection. The issue occurs only during peak business hours. CloudWatch metrics show increased latency and packet loss at the Direct Connect virtual interface. What is the MOST likely cause?

A.VPN tunnel misconfiguration over Direct Connect

B.Asymmetric routing between on-premises and AWS

C.BGP peering session flapping

D.Insufficient bandwidth on the Direct Connect connection

AnswerD

Congestion during peak hours causes latency and packet loss.

Why this answer

Insufficient bandwidth leads to congestion during peak hours, causing increased latency and packet loss. Option A is incorrect because VPN over Direct Connect is not a common configuration and would not cause these symptoms. Option B is incorrect because asymmetric routing would cause persistent connectivity issues, not intermittent latency and packet loss.

Option C is incorrect because BGP peering session flapping would result in complete loss of connectivity, not just increased latency and packet loss.

Practice this question →

Page 1 of 5 · 326 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Network Management and Operations questions.

Start 20-question session