Courseiva

CCNA Network Management and Operations Questions

75 of 326 questions · Page 3/5 · Network Management and Operations · Answers revealed

Practice these questionsDomain overviewAll questions
151
MCQmedium

A company uses AWS Direct Connect and VPN as backup. The network team notices that during a VPN failover, traffic drops for several minutes. The VPN tunnels are configured with BGP dynamic routing. Which configuration change would MOST likely reduce failover time?

A.Configure static routes over the VPN instead of BGP
B.Increase the BGP keepalive interval and decrease the hold timer
C.Enable BFD on the VPN BGP sessions
D.Decrease the BGP keepalive interval and increase the hold timer
AnswerC

BFD provides sub-second failure detection, reducing failover time.

Why this answer

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for BGP sessions, significantly reducing failover time. Option A is wrong because static routes do not dynamically adapt to failures and would require manual intervention. Option B is wrong because increasing the BGP keepalive interval (making it longer) and decreasing the hold timer (making it shorter) would actually slow down failure detection or cause flapping; the opposite would be needed.

Option D is wrong because decreasing the keepalive interval and increasing the hold timer would also not be as fast as BFD; BFD is the optimal solution for fast failover.

Practice this question →
152
Multi-Selecthard

A company has a Direct Connect connection and wants to use it for both private and public resources. Which TWO components are required to achieve this?

Select 2 answers
A.Transit Gateway
B.Internet gateway
C.VPN connection to the VPC
D.Public virtual interface (VIF)
E.Private virtual interface (VIF)
AnswersD, E

Public VIF connects to public AWS services.

Why this answer

Options D and E are correct. A Direct Connect connection supports multiple virtual interfaces: a private VIF for private IP connectivity to VPCs, and a public VIF for public IP connectivity to AWS public services. Using both enables access to private and public resources.

Option A is incorrect because a Transit Gateway is optional and not required for this setup. Option B is incorrect because an Internet gateway provides internet access through the public internet, not through Direct Connect public VIF. Option C is incorrect because a VPN connection is a separate mechanism and not required for Direct Connect.

Practice this question →
153
Multi-Selecthard

A company has a multi-account AWS environment using AWS Transit Gateway with multiple VPC attachments. The network team wants to centralize logging of all network traffic crossing the Transit Gateway. Which TWO services can be used together to achieve this?

Select 2 answers
A.VPC Flow Logs published to a central Amazon S3 bucket
B.AWS Site-to-Site VPN flow logs
C.AWS Direct Connect Gateway flow logs
D.AWS Transit Gateway Network Manager
E.AWS CloudTrail for Transit Gateway events
AnswersA, D

VPC Flow Logs capture traffic; publishing to a central S3 bucket allows aggregation.

Why this answer

VPC Flow Logs can be published to a central Amazon S3 bucket, aggregating traffic logs from different VPCs attached to the Transit Gateway. Option D is correct because AWS Transit Gateway Network Manager allows centralized monitoring and can integrate flow logs. Option B is incorrect because Site-to-Site VPN does not generate its own flow logs; VPN traffic is captured by VPC Flow Logs on the VPN attachment.

Option C is incorrect because Direct Connect Gateway does not have flow logs; traffic is logged via VPC Flow Logs on the virtual interfaces. Option E is incorrect because AWS CloudTrail records API actions, not network traffic.

Practice this question →
154
Multi-Selecthard

A company is using AWS Direct Connect with a private VIF to connect to multiple VPCs in the same region. The company wants to use AWS Transit Gateway to simplify management. Which three components are required to achieve this? (Choose THREE.)

Select 3 answers
A.Direct Connect private virtual interface
B.AWS Transit Gateway
C.VPC peering connection
D.AWS Site-to-Site VPN connection
E.AWS Direct Connect gateway
AnswersA, B, E

Required for Direct Connect connection.

Why this answer

Options A, B, and E are correct. A Direct Connect private virtual interface provides the physical connection from on-premises to AWS. AWS Transit Gateway serves as the central hub to interconnect multiple VPCs.

A Direct Connect gateway is required to associate the Direct Connect virtual interface with the Transit Gateway, enabling connectivity to multiple VPCs in the same region. Options C and D are incorrect: VPC peering and Site-to-Site VPN are not required when using Transit Gateway with Direct Connect.

Practice this question →
155
MCQeasy

A network engineer needs to capture TCP traffic between an EC2 instance (eni-abc123) and an RDS instance (eni-def456) in the same VPC for troubleshooting. Which AWS service should be used to capture the traffic and store it in S3?

A.Amazon Inspector
B.AWS CloudTrail
C.AWS Config
D.VPC Flow Logs
AnswerD

VPC Flow Logs capture IP traffic information for network interfaces and can be published to S3 or CloudWatch Logs.

Why this answer

VPC Flow Logs capture IP traffic information at the network interface level and can be published to S3. They can filter traffic by ENI, so they can capture traffic between eni-abc123 and eni-def456. Option D is correct.

Amazon Inspector (A) is for vulnerability assessment, not traffic capture. AWS CloudTrail (B) records API activity, not network traffic. AWS Config (C) tracks configuration changes, not packet-level data.

Practice this question →
156
MCQhard

A company uses AWS Direct Connect with multiple virtual interfaces (VIFs) to connect to multiple VPCs. The network team wants to ensure high availability and failover. Which configuration provides the best resiliency?

A.Provision two Direct Connect connections from different providers and configure BGP
B.Use a single Direct Connect connection with a VPN backup over the internet
C.Configure BGP with multiple AS paths on the same Direct Connect connection
D.Create multiple private VIFs on a single Direct Connect connection
AnswerA

Two separate connections from different providers provide physical diversity and high availability.

Why this answer

Using two separate Direct Connect connections from different providers provides path diversity and eliminates single points of failure. If one connection fails, BGP will route traffic through the other connection. Option B is wrong because a single Direct Connect connection with a VPN backup still shares the same physical infrastructure and the internet backup may not provide the same SLA.

Option C is wrong because multiple AS paths on the same connection do not provide physical redundancy; they only affect route selection. Option D is wrong because multiple private VIFs on a single connection still depend on that single physical link.

Practice this question →
157
MCQeasy

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure that if the primary VPN tunnel goes down, traffic automatically fails over to the secondary tunnel. Which configuration is required?

A.Use static routes with equal-cost multipath (ECMP)
B.Enable VPN CloudHub
C.Enable dynamic routing (BGP) on the VPN connection
D.Configure a second customer gateway device
AnswerC

BGP allows dynamic route advertisement and failover.

Why this answer

Dynamic routing with BGP enables automatic failover between VPN tunnels because BGP advertises routes and automatically withdraws them when a tunnel fails, causing the routing table to update and traffic to use the other tunnel. Static routes (A) require manual intervention for failover, as they do not dynamically adapt. VPN CloudHub (B) is designed to interconnect multiple VPN connections, not for failover between tunnels.

Configuring a second customer gateway device (D) is necessary for redundancy but does not itself enable automatic failover without BGP.

Practice this question →
158
MCQmedium

A company has deployed a transit gateway with multiple VPC attachments and VPN attachments. The network team notices that traffic between two VPCs is taking an unexpected path and experiencing high latency. Which tool should be used to trace the path and identify the specific transit gateway route table that is being used?

A.AWS CloudTrail
B.Amazon CloudWatch ServiceLens
C.AWS X-Ray
D.VPC Reachability Analyzer
AnswerD

Reachability Analyzer performs path analysis between resources and shows the route table decisions, including transit gateway routes.

Why this answer

VPC Reachability Analyzer performs connectivity and path analysis between sources and destinations, showing the route table decisions, including the specific transit gateway route table used. Option D is correct. Options A (CloudTrail), B (CloudWatch ServiceLens), and C (X-Ray) are not designed for path tracing.

Practice this question →
159
MCQhard

A company has a multi-account AWS environment with hundreds of VPCs connected via a transit gateway. The network team needs to centrally monitor network traffic and detect anomalies such as unusual outbound data transfers. Which combination of services would provide the most scalable and cost-effective solution?

A.Use AWS Trusted Advisor to check for unusual traffic patterns
B.Enable VPC Flow Logs in each VPC, publish to CloudWatch Logs, and create cross-account CloudWatch dashboards
C.Use AWS Network Manager to monitor all VPCs and Transit Gateway attachments
D.Enable VPC Flow Logs in each VPC, publish to Amazon S3, and use Amazon Athena to query logs from a central account
AnswerD

S3 is cost-effective for storage and Athena allows querying across accounts.

Why this answer

VPC Flow Logs capture IP traffic metadata at scale, and publishing to Amazon S3 provides a cost-effective, durable storage layer. Using Amazon Athena to query the logs from a central account enables serverless, on-demand analysis across hundreds of VPCs without provisioning servers, making it both scalable and cost-effective for anomaly detection.

Exam trap

The trap here is that candidates assume CloudWatch Logs is the only or best destination for VPC Flow Logs, overlooking the cost and scalability advantages of S3 combined with Athena for large-scale, cross-account analysis.

How to eliminate wrong answers

Option A is wrong because AWS Trusted Advisor checks for AWS service limits, security best practices, and cost optimization, but it does not analyze VPC traffic patterns or detect anomalies in outbound data transfers. Option B is wrong because publishing VPC Flow Logs to CloudWatch Logs incurs ingestion and storage costs that become prohibitively expensive at scale across hundreds of VPCs, and cross-account CloudWatch dashboards do not provide a queryable interface for ad-hoc anomaly detection. Option C is wrong because AWS Network Manager provides a global view of transit gateway networks and topology, but it does not perform deep packet inspection or traffic anomaly detection; it lacks the query and analysis capabilities needed to identify unusual outbound data transfers.

Practice this question →
160
MCQmedium

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team notices that traffic is intermittently dropping and the BGP session between the on-premises router and the AWS Direct Connect virtual interface goes down. Which configuration should be checked first to resolve this issue?

A.Ensure the BGP hold timer values are consistent on both ends
B.Increase the BGP keepalive timer on the on-premises router to 90 seconds
C.Disable BGP authentication on the virtual interface
D.Enable BGP MD5 authentication on the on-premises router
AnswerA

Correct. Consistent BGP hold timers on both ends prevent session timeouts due to mismatch.

Why this answer

Ensure the BGP hold timer values are consistent on both ends. A mismatch in BGP hold timers can cause the BGP session to flap intermittently. Configuring consistent hold times on both routers stabilizes the session.

Option B is incorrect because increasing the keepalive timer may postpone failure detection but does not fix the root cause. Option C is incorrect because disabling BGP authentication is unnecessary and insecure. Option D is incorrect because enabling MD5 authentication is optional and unrelated to the flapping.

Exam trap

The trap is assuming that simply increasing timers will solve the flapping; the actual fix is ensuring timers match.

Practice this question →
161
MCQmedium

A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC peering connection is active, and the route tables have appropriate routes. However, instances in VPC A cannot reach instances in VPC B. The security groups in both VPCs allow all traffic. What is the most likely issue?

A.The security groups are not allowing ICMP traffic
B.The route tables in both VPCs do not have routes pointing to the peering connection for the other VPC's CIDR
C.The VPC peering connection is not in the 'active' state
D.The instances are in different availability zones
AnswerB

Without these routes, traffic cannot traverse the peering connection.

Why this answer

The most likely issue is that the route tables in both VPCs do not have routes pointing to the VPC peering connection for the other VPC's CIDR. Although the VPC peering connection is active, without explicit routes in the route tables, traffic cannot be directed to the peer VPC. Since security groups allow all traffic, they are not the cause.

Different availability zones do not affect VPC peering. Therefore, the correct answer is B.

Practice this question →
162
MCQmedium

A company is using AWS Client VPN to provide remote access to its VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a single subnet in the VPC, and the authorization rules allow access to the entire VPC CIDR (10.0.0.0/16). The security group assigned to the Client VPN endpoint allows all traffic. What is the most likely cause of this issue?

A.The security group assigned to the Client VPN endpoint does not allow inbound traffic from the client CIDR.
B.The route table associated with the Client VPN subnet does not have a route for the client IP range.
C.The authorization rule is too broad and is blocking traffic.
D.The Client VPN endpoint does not have a security group association group configured.
AnswerB

Without a return route, traffic from instances cannot reach the VPN clients.

Why this answer

The Client VPN endpoint is associated with a single subnet in the VPC. For traffic from the VPN clients to reach resources in the VPC, the route table of that subnet must include a route pointing the client IP range back to the VPN endpoint's network interface. Without this route, the subnet has no path to forward return traffic to the clients, even though the clients can establish the VPN tunnel.

Option B correctly identifies this missing route as the root cause.

Exam trap

AWS often tests the misconception that security groups or authorization rules are the primary cause of connectivity issues after a successful VPN connection, when in reality the missing route in the subnet's route table is the most common culprit for one-way traffic failures in AWS Client VPN.

How to eliminate wrong answers

Option A is wrong because the security group assigned to the Client VPN endpoint controls traffic entering or leaving the endpoint itself, not inbound traffic from the client CIDR; the security group already allows all traffic, so this is not the issue. Option C is wrong because an authorization rule that is too broad (allowing the entire VPC CIDR) would permit traffic, not block it; authorization rules are permissive, not restrictive. Option D is wrong because a 'security group association group' is not a valid AWS Client VPN configuration; the endpoint uses a single security group, and the absence of such a group does not cause connectivity failures.

Practice this question →
163
MCQeasy

A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?

A.VPC peering
B.AWS Route 53 Resolver
C.AWS Network Firewall
D.Transit Gateway with a security appliance in a central VPC
AnswerD

Allows centralized inspection.

Why this answer

Transit Gateway with a security appliance in a central VPC (Option D) is the correct approach because it allows centralized inspection of all traffic between subnets by routing traffic through a central inspection VPC where security appliances are deployed. Option A (VPC peering) is incorrect because it only provides direct connectivity between two VPCs and does not support centralized inspection. Option B (AWS Route 53 Resolver) is a DNS service and has no traffic inspection capability.

Option C (AWS Network Firewall) is a managed firewall service, but it does not provide the multi-VPC architecture needed to centrally route traffic from multiple subnets/VPCs; Transit Gateway is required to route traffic to the firewall.

Practice this question →
164
MCQeasy

A network engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

A.AWS CloudTrail.
B.Amazon CloudWatch Metrics.
C.VPC Flow Logs.
D.AWS Config.
AnswerC

VPC Flow Logs capture IP traffic information for network interfaces, enabling traffic analysis between instances.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces within a VPC, enabling analysis of traffic between EC2 instances. Option A is wrong because CloudTrail logs API calls, not network traffic. Option B is wrong because CloudWatch Metrics provide performance metrics, not packet-level details.

Option D is wrong because AWS Config monitors configuration changes, not traffic.

Practice this question →
165
MCQmedium

A company has a VPC with resources that need to access an S3 bucket in the same region. To minimize latency and avoid internet traffic, which configuration should be used?

A.Use a NAT Gateway in a public subnet and route traffic through it
B.Create a VPC Gateway Endpoint for S3
C.Use VPC peering to connect to an S3 bucket
D.Create a VPC Interface Endpoint for S3
AnswerB

Creating a VPC Gateway Endpoint for S3 is the correct method for private, low-latency access to S3 within the same region. It is free and uses prefix lists in route tables.

Why this answer

A VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet, minimizing latency and avoiding data transfer costs. It is the recommended approach for accessing S3 from a VPC. While VPC Interface Endpoints for S3 also provide private access, they incur hourly charges and additional data processing fees.

In most scenarios, Gateway Endpoints are preferred for S3 and DynamoDB due to their simplicity and cost-effectiveness. NAT Gateway (A) is used for internet-bound traffic, not private S3 access. VPC peering (C) connects VPCs but does not provide direct access to S3.

Exam trap

Some may select VPC Interface Endpoint (D) because it also offers private access to S3; however, AWS recommends Gateway Endpoints for S3 and DynamoDB as they are free and purpose-built for these services. Interface Endpoints are more suitable for other services via PrivateLink.

Practice this question →
166
MCQhard

A company has a hub-and-spoke network architecture using AWS Transit Gateway. The hub VPC contains a central inspection appliance (NVA) for traffic inspection. Spoke VPCs are attached to the Transit Gateway and have routes pointing to the Transit Gateway for all traffic. The Transit Gateway has a default route table that routes traffic to the NVA for inspection. Recently, the network team noticed that traffic between two spoke VPCs is not being inspected. The team verified that the Transit Gateway route tables are correctly configured and that the NVA is healthy. What should the team do to ensure that inter-spoke traffic is inspected?

A.Configure route propagation in the Transit Gateway route tables to propagate routes from the spoke attachments
B.Enable VPC Flow Logs on the spoke VPCs to capture traffic
C.Add static routes in the spoke VPC route tables pointing to the NVA
D.Increase the bandwidth of the Transit Gateway attachments
AnswerA

Propagation ensures that spoke routes are learned and traffic is forwarded to the NVA for inspection.

Why this answer

Configuring route propagation in the Transit Gateway route tables from the spoke attachments allows the Transit Gateway to learn the specific CIDR blocks of each spoke VPC. With these routes, the Transit Gateway can forward inter-spoke traffic to the NVA for inspection. Option B is incorrect because VPC Flow Logs only capture traffic logs and do not affect routing.

Option C is incorrect because adding static routes in the spoke VPC route tables pointing to the NVA would bypass the Transit Gateway and break the hub-and-spoke design. Option D is incorrect because bandwidth increase does not address the routing issue.

Practice this question →
167
Multi-Selectmedium

Which TWO actions should a network engineer take to troubleshoot a BGP session that is not establishing between an on-premises router and AWS Direct Connect? (Select TWO.)

Select 2 answers
A.Verify that the BGP ASN configured on the customer router matches the one provided by AWS.
B.Increase the MTU on the customer router interface.
C.Ensure that the virtual interface is in the 'available' state.
D.Verify that the peer IP addresses on both sides are correct and reachable.
E.Check that the Direct Connect connection is in the 'available' state.
AnswersA, D

Mismatched ASN prevents BGP session establishment.

Why this answer

Common BGP issues include incorrect BGP ASN, incorrect peer IP addresses, missing authentication, and firewall rules blocking TCP port 179. Verifying these settings on both sides is key.

Practice this question →
168
MCQeasy

A company uses AWS Client VPN to provide remote access to its corporate network. Users report that they can connect to the VPN but cannot reach resources in the VPC. The VPN is configured with mutual authentication and authorization rules. What should the network engineer verify first?

A.The security group associated with the VPN endpoint allows inbound traffic from the client CIDR
B.The server certificate is valid and trusted by the client
C.The client CIDR range does not overlap with the VPC CIDR
D.The authorization rules grant access to the target network
AnswerD

Authorization rules are required to allow traffic to the VPC.

Why this answer

AWS Client VPN uses authorization rules to control which groups of clients can access specific target networks (e.g., subnets in the VPC). Even if the VPN connection is established, without proper authorization rules granting access to the target network, traffic will not be forwarded to the VPC resources. Option A is incorrect because the security group associated with the VPN endpoint controls inbound traffic to the endpoint itself, not traffic between clients and VPC resources.

Option B is incorrect because if the client can connect, the server certificate is valid and trusted. Option C is incorrect because while overlapping CIDR ranges can cause routing issues, the fact that the connection succeeds indicates that the client CIDR range is valid and does not overlap with the VPC CIDR.

Practice this question →
169
MCQeasy

A network engineer is troubleshooting intermittent connectivity issues between two VPCs that are peered. The VPC peering connection is in the 'active' state. ICMP ping from an instance in VPC A to an instance in VPC B fails intermittently. What is the most likely cause?

A.The network ACLs are blocking ICMP traffic.
B.The security groups on the instances do not allow inbound ICMP.
C.The VPC peering connection is not in the 'active' state.
D.The route tables in one or both VPCs lack routes to the peer VPC's CIDR via the peering connection.
AnswerD

Intermittent issues could be due to route propagation delays, but typical cause is missing routes.

Why this answer

Since the VPC peering connection is active, the issue is likely that the route tables in one or both VPCs are not correctly configured to route traffic to the peered VPC's CIDR via the peering connection. Without proper routes, traffic is dropped.

Practice this question →
170
MCQmedium

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel status shows 'UP' but traffic is not passing. The engineer checks the route tables and finds that the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely missing configuration?

A.The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway
B.The security group of the EC2 instances does not allow inbound traffic from on-premises
C.The VPN tunnel is using the wrong pre-shared key
D.The on-premises router is not advertising the VPC CIDR over BGP
AnswerB

Correct. Security groups are stateful and must allow inbound traffic from the on-premises network. Without this rule, traffic can reach the VPC but will be blocked at the instance level.

Why this answer

Since the VPN tunnel status is 'UP', the pre-shared key and Phase 2 parameters are correctly configured. With the VPC route table already pointing to the virtual private gateway for the on-premises CIDR, the most likely missing configuration is that the security group associated with the EC2 instances in the VPC does not allow inbound traffic from the on-premises network. Security groups act as a virtual firewall for instances, and inbound traffic from on-premises must be explicitly allowed.

Option A is incorrect because the stem states the route exists. Option C is incorrect because a tunnel UP status confirms the pre-shared keys match. Option D is less likely because even if the on-premises router is not advertising the VPC CIDR, that would affect return traffic but not necessarily all traffic; also the question does not specify BGP usage.

Practice this question →
171
Multi-Selectmedium

A network engineer is troubleshooting high latency on a Direct Connect connection. The engineer wants to use monitoring tools to identify the source of the latency. Which two AWS services can provide metrics and logs to help diagnose the issue? (Choose TWO.)

Select 2 answers
A.AWS CloudTrail
B.AWS Config
C.Amazon CloudWatch
D.AWS Trusted Advisor
E.VPC Flow Logs
AnswersC, E

Provides Direct Connect metrics.

Why this answer

The correct answers are C (Amazon CloudWatch) and E (VPC Flow Logs). CloudWatch provides metrics for Direct Connect, including connection state, BGP status, packet loss, and latency. VPC Flow Logs capture IP traffic information that can be analyzed to identify latency patterns.

Option A (AWS CloudTrail) is incorrect because it logs API calls, not network metrics. Option B (AWS Config) is incorrect because it tracks configuration changes. Option D (AWS Trusted Advisor) is incorrect because it provides recommendations, not real-time metrics or logs.

Practice this question →
172
Multi-Selectmedium

A company is deploying a new application that requires low latency between EC2 instances. Which THREE placement group strategies should the network engineer consider?

Select 3 answers
A.Cross-zone load balancing
B.Spread placement group
C.Availability Zone placement group
D.Partition placement group
E.Cluster placement group
AnswersB, D, E

Spreads instances across distinct hardware for high availability.

Why this answer

The correct placement group strategies are Cluster placement group (lowest latency, highest throughput), Spread placement group (protects against hardware failures by placing instances on distinct racks), and Partition placement group (reduces likelihood of correlated failures for large distributed and replicated workloads). Option A (Cross-zone load balancing) is a feature of Elastic Load Balancing, not a placement group. Option C (Availability Zone placement group) is not a valid placement group type.

Practice this question →
173
Multi-Selectmedium

Which TWO configuration steps are required to enable VPC Flow Logs to be published to an S3 bucket in a different AWS account? (Select TWO.)

Select 2 answers
A.Attach a resource-based policy to the S3 bucket that grants the source account's Flow Logs service permission to write.
B.Configure the Flow Logs destination as a CloudWatch Logs log group in the source account.
C.Create an IAM role in the source account with a trust policy that allows the Flow Logs service to assume it and grants s3:PutObject to the destination bucket.
D.Create an IAM user in the source account with programmatic access and share the access keys.
E.Enable S3 cross-account replication.
AnswersA, C

The bucket policy must allow cross-account writes.

Why this answer

To publish VPC Flow Logs to an S3 bucket in a different AWS account, two steps are required: (1) Attach a resource-based policy to the destination S3 bucket that grants the source account's Flow Logs service permission to write objects. This is option A. (2) Create an IAM role in the source account with a trust policy that allows the Flow Logs service to assume it and grants s3:PutObject permission to the destination bucket. This is option C.

Option B is incorrect because CloudWatch Logs in the source account would not enable cross-account delivery to S3. Option D is incorrect because sharing IAM user access keys is not a secure or supported method for cross-account flow logs. Option E is incorrect because S3 cross-account replication does not enable the Flow Logs service to write to the bucket.

Practice this question →
174
MCQeasy

A company uses VPC Flow Logs to monitor network traffic. The flow logs are published to Amazon S3. The security team wants to analyze the logs for suspicious traffic patterns using Amazon Athena. After creating the Athena table, queries return zero results. The logs are in the correct S3 bucket. What is the most likely cause?

A.The flow logs are encrypted with SSE-KMS and Athena does not have permission to decrypt
B.The Athena table is in a different AWS Glue database
C.The flow logs are in gzip format, which Athena does not support
D.The Athena table is not configured to read from the correct S3 partition structure
AnswerD

Partition structure must match the log location.

Why this answer

VPC Flow Logs are stored in a partitioned folder structure (e.g., AWSLogs/account-id/vpcflowlogs/region/year/month/day/). If the Athena table does not use partition projection or is not configured to read from the correct partition structure, queries return no data. Option A is wrong because SSE-KMS encryption can be used with Athena if proper permissions are granted.

Option B is wrong because the table can be in any AWS Glue database. Option C is wrong because Athena supports gzip format.

Practice this question →
175
MCQmedium

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team wants to monitor the bandwidth utilization of the Direct Connect connection in real time. Which AWS service should be used?

A.AWS CloudTrail
B.VPC Flow Logs
C.AWS Config
D.Amazon CloudWatch
AnswerD

CloudWatch provides Direct Connect metrics such as ConnectionBandwidthUtilization.

Why this answer

CloudWatch provides metrics for Direct Connect connections including bandwidth utilization. Option A is incorrect because CloudTrail logs API calls. Option B is incorrect because VPC Flow Logs capture traffic per interface, not aggregate bandwidth.

Option C is incorrect because AWS Config records configuration changes.

Practice this question →
176
MCQhard

A company has a Direct Connect connection with two private virtual interfaces (VIFs) to two different VPCs. The company wants to use the same Direct Connect connection for both VPCs, but the on-premises router only has one physical port. The network engineer configures a single BGP session over a VLAN-tagged interface. After configuration, only one VPC is reachable. What is the most likely reason?

A.The on-premises router is using the same BGP ASN for both VIFs, which is not allowed
B.The BGP peer IP addresses must be in the same subnet for both VIFs
C.The VLAN ID must be the same for both VIFs to work over a single physical port
D.Each private VIF requires a separate BGP session, and only one session was configured
AnswerD

Each VIF needs its own BGP session.

Why this answer

Each private VIF requires a separate BGP session. With only one BGP session configured, only one VIF can be established. Option A is incorrect because the same BGP ASN can be used on both VIFs if connecting through a Direct Connect gateway.

Option B is incorrect because the BGP peer IPs can be in different subnets. Option C is incorrect because each VIF requires a unique VLAN ID; they cannot share the same VLAN.

Practice this question →
177
MCQeasy

A company is deploying a web application on EC2 instances behind an ALB. The application must be accessible only over HTTPS. Which security group rule should be added to the ALB security group?

A.Inbound: TCP port 22 from 0.0.0.0/0
B.Inbound: TCP port 443 from 0.0.0.0/0
C.Inbound: TCP port 3306 from 0.0.0.0/0
D.Inbound: TCP port 80 from 0.0.0.0/0
AnswerB

HTTPS uses port 443.

Why this answer

The ALB must terminate HTTPS traffic, which requires an inbound rule allowing TCP port 443 (HTTPS) from 0.0.0.0/0. This ensures clients can establish encrypted TLS connections to the load balancer, as the application is only accessible over HTTPS.

Exam trap

AWS often tests the distinction between the ALB's security group (which needs port 443 for HTTPS) and the EC2 instances' security group (which needs only the ALB's source security group), leading candidates to mistakenly choose port 80 (HTTP) or port 22 (SSH) for the ALB.

How to eliminate wrong answers

Option A is wrong because TCP port 22 (SSH) is used for remote administration of EC2 instances, not for web traffic to an ALB, and opening it to 0.0.0.0/0 would expose management interfaces unnecessarily. Option C is wrong because TCP port 3306 (MySQL) is a database port that should never be exposed to the internet from an ALB; database access should be restricted to application servers via private subnets. Option D is wrong because TCP port 80 (HTTP) would allow unencrypted traffic, which violates the requirement that the application be accessible only over HTTPS; allowing HTTP would bypass the encryption mandate.

Practice this question →
178
Multi-Selecthard

A company has a multi-account AWS environment with hundreds of VPCs interconnected via a transit gateway. The network team needs to centrally monitor VPC reachability and identify asymmetric routing paths. Which THREE services or features should be used together to achieve this? (Choose three.)

Select 3 answers
A.Amazon CloudWatch Contributor Insights
B.VPC Reachability Analyzer
C.AWS Network Manager
D.AWS Config
E.AWS CloudHSM
AnswersA, B, C

Analyzes VPC Flow Logs to detect traffic patterns and anomalies.

Why this answer

VPC Reachability Analyzer can test paths and detect asymmetric routing. AWS Network Manager provides central visibility for transit gateway networks. Amazon CloudWatch Contributor Insights helps analyze VPC Flow Logs to identify traffic patterns.

AWS Config evaluates rules but not real-time path analysis. AWS CloudHSM is for hardware security modules.

Practice this question →
179
MCQhard

A company has a VPC with multiple subnets across Availability Zones. An application load balancer (ALB) is deployed in public subnets. The network team notices that traffic from the ALB to targets in private subnets is intermittently failing. The targets are healthy. What is the MOST likely cause?

A.The ALB is not associated with a public subnet.
B.The target security group does not allow traffic from the ALB's security group.
C.The network ACL for the target subnets blocks outbound traffic.
D.Cross-zone load balancing is disabled.
AnswerB

Correct. The target security group must allow inbound traffic from the ALB's security group. Without this rule, traffic from the ALB will be blocked.

Why this answer

The ALB communicates with targets using its private IP addresses. For traffic to reach the targets, the target security group must allow inbound traffic from the ALB's security group. If this rule is missing, traffic from the ALB will be dropped by the target security group, even though the targets are healthy.

Option A is incorrect because the ALB is already deployed in public subnets, so it is associated with a public subnet. Option C is incorrect because network ACLs are stateless and only affect traffic crossing subnet boundaries; if the NACL blocked outbound traffic from targets, there would be issues with response traffic, but the question states traffic from ALB to targets is failing, so the issue is likely inbound to targets. Option D is incorrect because cross-zone load balancing is enabled by default and would not cause intermittent failures; it only affects distribution of traffic across zones.

Practice this question →
180
MCQmedium

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The company has a NAT Gateway in the public subnet. The network team notices that instances in the private subnets cannot reach the internet. The route table for the private subnets has a default route (0.0.0.0/0) pointing to the NAT Gateway. What could be the issue?

A.The NAT Gateway does not have a route to the internet gateway
B.The NAT Gateway is in a private subnet
C.The VPC does not have a VPC endpoint for the software update service
D.The security group attached to the NAT Gateway is blocking traffic
AnswerB

For a NAT Gateway to route traffic from private subnets to the internet, it must reside in a public subnet with an associated route table that includes a default route (0.0.0.0/0) pointing to an internet gateway. Placing the NAT Gateway in a private subnet breaks this requirement, as the gateway itself has no path to the internet, so it cannot forward outbound traffic from the private instances.

Why this answer

The NAT Gateway must be in a public subnet with an internet gateway route to function. Option A is wrong because the NAT Gateway itself does not have a route; the route table of the subnet where it resides needs a route to the internet gateway. Option C is wrong because security groups are for instances, not NAT Gateways.

Option D is wrong because VPC endpoints are for specific AWS services, not general internet access.

Practice this question →
181
MCQmedium

An engineer is troubleshooting connectivity from on-premises to a VPC via Direct Connect private VIF. The BGP session is up, traffic is flowing, but the on-premises network cannot reach some subnets in the VPC. The VPC CIDR is 10.0.0.0/16. What is the most likely cause based on the exhibit?

A.The BGP session is up, but the on-premises router is not receiving the VPC CIDR route due to missing route propagation on the virtual private gateway.
B.The customer router configuration snippet is missing the BGP configuration for those subnets.
C.The security groups or network ACLs in the VPC are blocking traffic to those subnets.
D.The route filter prefixes only allow the VPC CIDR 10.0.0.0/16, but the VPC has additional CIDRs that are not being advertised.
AnswerC

Since the VPC CIDR is advertised, reachability issues within the VPC are more likely due to security group or NACL rules.

Why this answer

The BGP session being up and traffic flowing indicates that routing is properly configured between on-premises and the VPC. The inability to reach only some subnets suggests the issue is at the network security layer within the VPC. Security groups and network ACLs can block traffic to specific subnets while routing remains intact.

Therefore, the most likely cause based on the exhibit is that security groups or NACLs are filtering traffic to those subnets.

Practice this question →
182
MCQhard

A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to a partner VPC with CIDR 10.0.0.0/16. Both VPCs are in the same region. They want to use VPC Peering. After creating the peering connection and adding routes, connectivity fails. What is the most likely cause?

A.The peering connection is not set up for transitive routing.
B.The peering connection status is 'pending-acceptance'.
C.Overlapping CIDR blocks prevent VPC peering connectivity.
D.The route tables do not have a route to the peering connection.
AnswerC

VPC peering does not support overlapping CIDRs.

Why this answer

The most likely cause of connectivity failure is the overlapping CIDR blocks. VPC peering requires non-overlapping IP ranges for proper routing. Even if the peering connection is active and routes are added, the identical CIDR blocks (both 10.0.0.0/16) prevent the route tables from distinguishing the traffic destination, resulting in no connectivity.

Option A is incorrect because VPC peering does not support transitive routing, but that is not the issue here. Option B is incorrect because the status would need to be 'active' for connectivity, but the problem is overlapping CIDRs. Option D is incorrect because although routes may be missing, the primary issue is the overlapping CIDRs.

Practice this question →
183
MCQhard

A network engineer is configuring VPC Flow Logs to deliver to an S3 bucket in a different account. The bucket policy is shown. The flow logs are not being delivered. What is the most likely reason?

A.The Action should be s3:PutObjectAcl instead of s3:PutObject
B.The Principal must be the destination account's log delivery service
C.The aws:SourceArn condition restricts access to a specific account, but the flow logs are from a different account
D.The Resource does not include the bucket ARN itself
AnswerC

The condition limits access to logs from account 123456789012 only.

Why this answer

The bucket policy uses the log delivery service principal from account 123456789012, but the flow logs are from a different account. The policy needs to allow access for the source account's log delivery service. Option A is incorrect because the action is correct.

Option B is incorrect because the resource includes the full path. Option D is incorrect because the Principal is correct for cross-account delivery.

Practice this question →
184
Multi-Selecteasy

A company wants to monitor network traffic in its VPC for security analysis and troubleshooting. Which TWO AWS services can be used to capture and analyze IP traffic information? (Choose TWO.)

Select 2 answers
A.AWS Network Firewall
B.AWS CloudTrail
C.AWS Trusted Advisor
D.Amazon GuardDuty
E.VPC Flow Logs
AnswersA, E

Captures and inspects traffic.

Why this answer

Options A and E are correct. VPC Flow Logs capture IP traffic metadata for analysis, and AWS Network Firewall can capture and inspect network traffic. Option B (CloudTrail) is incorrect because it records API calls, not network traffic.

Option C (Trusted Advisor) is incorrect as it provides best practice checks. Option D (GuardDuty) is incorrect because it is a threat detection service that uses flow logs but does not capture them directly.

Practice this question →
185
MCQmedium

A company uses a VPC with multiple subnets in different Availability Zones. The VPC has a NAT Gateway in a public subnet of us-east-1a, and a second NAT Gateway in us-east-1b for high availability. Each private subnet in us-east-1a routes 0.0.0.0/0 to the NAT Gateway in us-east-1a, and private subnets in us-east-1b route to the NAT Gateway in us-east-1b. The company's EC2 instances in private subnets need to access an external service using IPv6. The VPC is not configured for IPv6. The network engineer needs to enable IPv6 connectivity for these instances. Which solution is the most cost-effective and scalable?

A.Add an IPv6 CIDR block to the VPC and configure a NAT64 gateway to translate IPv6 to IPv4.
B.Add an IPv6 CIDR block to the VPC, assign IPv6 addresses to private subnets, and add a route for ::/0 to an egress-only internet gateway.
C.Attach an internet gateway to the VPC and add a route for ::/0 to the internet gateway in the private subnets.
D.Add an IPv6 CIDR block to the VPC and use the existing NAT Gateways with IPv6.
AnswerB

Egress-only IGW allows outbound IPv6 traffic from private subnets.

Why this answer

Since the VPC is not IPv6-enabled, adding an IPv6 CIDR block assigns IPv6 addresses to subnets. For outbound-only IPv6 access from private subnets, an egress-only internet gateway (EIGW) is the appropriate and most cost-effective solution because it allows outbound traffic to the internet while preventing inbound connections, similar to a NAT gateway for IPv4. A route for ::/0 to the EIGW from the private subnets achieves the goal.

Option A is incorrect because NAT64 translates IPv6 to IPv4, but the target service uses IPv6, so no translation is needed. Option C is incorrect because an internet gateway would permit inbound traffic and instances would need public IPv6 addresses, which is not stated and is less secure. Option D is incorrect because NAT Gateways do not support IPv6.

Practice this question →
186
MCQmedium

A company is migrating from a legacy MPLS network to AWS using Direct Connect. The network team wants to ensure high availability with a backup connection. They have two Direct Connect connections from different providers, both terminating at the same AWS Direct Connect location. Which configuration provides the most resilient setup?

A.Use both connections but from the same provider to simplify management.
B.Use both connections with separate virtual interfaces, each terminating on different customer routers.
C.Use one connection with two virtual interfaces for redundancy.
D.Use both connections with a single virtual interface on each, but terminate on the same router.
AnswerB

Full redundancy with diverse paths.

Why this answer

Using two separate Direct Connect connections with separate virtual interfaces, each terminating on different customer routers, provides high availability by eliminating single points of failure at both the physical and logical levels. Option A is wrong because using the same provider reduces diversity. Option C is wrong because using a single connection with two VIFs still has a single physical link.

Option D is wrong because terminating on the same router creates a single point of failure.

Practice this question →
187
MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. After adding a new VPC attachment, traffic from the on-premises network cannot reach the new VPC. The on-premises BGP route table shows the prefixes of the new VPC as received. What should the engineer check?

A.Verify that the on-premises router is advertising the correct prefix to AWS.
B.Verify that the new VPC has a route to the Transit Gateway in its route table.
C.Verify that the new VPC attachment is associated with the Transit Gateway route table that has the on-premises routes.
D.Verify that the new VPC's DNS resolution is enabled.
AnswerC

Transit Gateway route tables control connectivity between attachments.

Why this answer

For traffic from an on-premises network to reach a new VPC via Transit Gateway, the new VPC attachment must be associated with a Transit Gateway route table that contains a route (static or propagated) pointing to the on-premises network. Without this association, the Transit Gateway will not forward traffic to the new VPC even if the on-premises BGP route table has learned the VPC prefixes. Option A is incorrect because the on-premises router already receives the VPC prefixes via BGP, so advertising is not the issue.

Option B is incorrect: the VPC's route table controls outbound traffic from the VPC, but inbound traffic from on-premises is governed by the Transit Gateway route table. Option D is irrelevant because DNS resolution does not affect IP routing.

Practice this question →
188
Multi-Selecthard

A company has a Direct Connect connection with multiple virtual interfaces (VIFs). The network team notices that traffic to a specific VPC is intermittently failing. The team suspects an issue with BGP routing. Which THREE steps should the team take to troubleshoot the BGP session? (Choose THREE.)

Select 3 answers
A.View the BGP route advertisements received by the on-premises router from AWS.
B.Check the Direct Connect endpoint health in the AWS Management Console.
C.Verify the allowed prefixes configuration on the virtual interface in the AWS console.
D.Examine VPC Flow Logs for dropped packets on the virtual interface.
E.Check the BGP session status using the 'bgp session' command on the on-premises router.
AnswersA, C, E

This helps identify if AWS is advertising the expected routes.

Why this answer

Viewing the BGP route advertisements received by the on-premises router from AWS directly reveals whether the expected prefixes are being advertised. If the routes are missing or incorrect, the VPC traffic will fail intermittently, making this a primary troubleshooting step for BGP routing issues.

Exam trap

AWS often tests the distinction between physical connectivity checks (like endpoint health) and BGP-specific troubleshooting steps, leading candidates to select options that address layer 1/2 issues instead of the BGP routing layer.

Practice this question →
189
Multi-Selecthard

A network engineer is troubleshooting a VPN connection that is not passing traffic. The tunnel status shows as 'UP'. Which THREE steps should the engineer take to diagnose the issue?

Select 3 answers
A.Ensure that the security groups for instances allow inbound traffic from the on-premises network
B.Confirm that the on-premises router is advertising the correct routes via BGP
C.Check the IKE and IPSEC settings on the customer gateway
D.Verify that the VPC route table has a route to the on-premises network via the virtual private gateway
E.Check the internet gateway route table for the VPC
AnswersA, B, D

Security groups can block traffic even if the VPN is up.

Why this answer

Security groups act as a virtual firewall for instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up, traffic will be dropped if the security group does not explicitly allow inbound traffic from the on-premises network's IP range. This is a common misconfiguration that prevents traffic flow despite a healthy tunnel.

Exam trap

The trap here is that candidates assume a 'UP' tunnel guarantees traffic flow, but AWS often tests that Layer 3 routing and security group rules are separate from tunnel status and must be verified independently.

Practice this question →
190
MCQeasy

A company wants to monitor network traffic to and from an EC2 instance to detect anomalous outbound traffic. Which AWS service should they use to capture and analyze the traffic?

A.Amazon GuardDuty
B.Amazon CloudWatch Logs
C.AWS Config
D.VPC Traffic Mirroring
AnswerD

Traffic Mirroring captures and copies traffic for analysis.

Why this answer

VPC Traffic Mirroring (option D) is correct because it captures and copies network traffic from EC2 instances for analysis. Amazon GuardDuty (option A) is a threat detection service that analyzes logs and findings but does not capture raw traffic. Amazon CloudWatch Logs (option B) can capture application and system logs, but not full packet-level traffic.

AWS Config (option C) records configuration changes to resources, not network traffic. Therefore, VPC Traffic Mirroring is the appropriate service for capturing and analyzing network traffic to detect anomalous outbound behavior.

Practice this question →
191
MCQhard

A company has multiple AWS accounts and wants to centrally manage network resources using AWS Transit Gateway. Which feature allows sharing the Transit Gateway across accounts?

A.VPC peering
B.AWS Resource Access Manager (RAM)
C.AWS Organizations
D.AWS Service Catalog
AnswerB

RAM enables sharing Transit Gateways across accounts.

Why this answer

AWS Resource Access Manager (RAM). RAM enables sharing of Transit Gateways across multiple AWS accounts within an organization, simplifying centralized network management. Option A (VPC peering) is a separate feature for connecting VPCs, not for sharing resources.

Option C (AWS Organizations) helps manage accounts and policies but does not directly share resources. Option D (AWS Service Catalog) creates standardized products, not for sharing existing resources.

Practice this question →
192
MCQeasy

A network engineer is troubleshooting an issue where an EC2 instance in a public subnet cannot reach the internet. The instance has a public IP, and the route table has a default route to an internet gateway. What is the most likely cause?

A.The network ACL is blocking outbound traffic
B.The internet gateway is not attached to the VPC
C.The security group does not allow outbound HTTP traffic
D.The instance does not have a public IP
AnswerA

Network ACLs are stateless and must explicitly allow outbound traffic and inbound return traffic.

Why this answer

Even with correct routes, if the subnet's network ACL does not allow outbound traffic, the instance cannot reach the internet. Network ACLs are stateless and must allow both outbound and inbound ephemeral ports.

Practice this question →
193
Multi-Selectmedium

Which THREE factors should be considered when designing a highly available AWS Site-to-Site VPN connection?

Select 3 answers
A.Use two VPN tunnels with the same customer gateway IP
B.Enable BGP for dynamic route propagation
C.Use two VPN tunnels each with a different customer gateway IP
D.Use a single VPN tunnel with a static route
E.Configure redundant customer gateways
AnswersB, C, E

BGP provides automatic failover and route propagation.

Why this answer

BGP (Border Gateway Protocol) enables dynamic route propagation across the VPN tunnels, allowing automatic failover and route convergence if one tunnel goes down. This is critical for high availability because it eliminates the need for manual route updates and supports path selection based on BGP attributes, ensuring traffic is rerouted through the remaining healthy tunnel.

Exam trap

AWS often tests the misconception that using two tunnels with the same customer gateway IP (Option A) provides redundancy, but the trap is that this still creates a single point of failure at the customer gateway device itself, whereas true high availability requires separate customer gateway IPs (Option C) and redundant gateways (Option E).

Practice this question →
194
MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. Network engineers report intermittent connectivity issues between VPC A and the on-premises network. The transit gateway route table shows the on-premises CIDR (10.0.0.0/8) propagated from the VPN attachment. VPC A has a subnet route pointing to the transit gateway for 10.0.0.0/8. Which step should the engineer take FIRST to diagnose the issue?

A.Verify that the VPN tunnel status shows as UP on both sides.
B.Enable VPC Flow Logs on VPC A to verify traffic reaching the transit gateway.
C.In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.
D.Check the security group rules on the EC2 instances in VPC A for outbound traffic.
AnswerC

This directly checks whether the transit gateway is correctly routing traffic to the VPN attachment for the on-premises CIDR.

Why this answer

The first diagnostic step for intermittent connectivity through a transit gateway is to verify the route table configuration. The engineer must confirm that the VPN attachment is correctly associated with the transit gateway route table and that the 10.0.0.0/8 route is propagated from the VPN attachment, as a missing or misassociated route would cause traffic to be dropped even if the VPN tunnel is up.

Exam trap

The trap here is that candidates often jump to checking the VPN tunnel status (Option A) first, assuming the tunnel is the root cause, but the question specifically describes intermittent connectivity that is more likely due to a routing misconfiguration in the transit gateway route table rather than a tunnel flap.

How to eliminate wrong answers

Option A is wrong because verifying the VPN tunnel status is a later step; the tunnel can be UP but traffic may still fail if the transit gateway route table lacks the correct route or association. Option B is wrong because enabling VPC Flow Logs on VPC A would confirm traffic reaching the transit gateway, but it does not diagnose whether the transit gateway is correctly routing the traffic to the VPN attachment, which is the core issue. Option D is wrong because security group rules on EC2 instances control host-level filtering, not the transit gateway routing path; the issue is at the network layer, not the instance firewall.

Practice this question →
195
MCQhard

A financial services company uses AWS Direct Connect to connect its data center to multiple VPCs via a transit gateway. They need to meet PCI DSS compliance requirements by encrypting all traffic between the data center and AWS. What solution meets this requirement with the least operational overhead?

A.Enable MACsec on the Direct Connect connection.
B.Use TLS for all application traffic between data center and VPC.
C.Use private VIFs without additional encryption.
D.Create an IPsec VPN tunnel over the Direct Connect VIF to encrypt traffic.
AnswerA

MACsec provides Layer 2 encryption with minimal overhead.

Why this answer

MACsec (Option A) is the correct solution because it provides encryption at Layer 2 directly on the Direct Connect connection, ensuring all traffic is encrypted with minimal overhead and no additional configuration. This meets PCI DSS requirements with the least operational overhead. Option B (TLS) only encrypts application-level traffic, not all traffic.

Option C (private VIFs) does not encrypt traffic by default. Option D (IPsec VPN over Direct Connect) adds complexity and operational overhead compared to MACsec.

Practice this question →
196
MCQhard

A company has a hybrid network with multiple AWS Direct Connect connections to different VPCs. The on-premises network uses BGP to advertise prefixes to AWS. The network team notices that some on-premises prefixes are not being received by the VPCs. What is the MOST likely cause?

A.The on-premises router is advertising more than 100 prefixes over the BGP session
B.The on-premises router is not using BGP communities
C.The on-premises router is using AS_PATH prepending
D.The on-premises router is not setting the MED attribute
AnswerA

AWS limits the number of prefixes per BGP session to 100 by default. Exceeding this causes rejection.

Why this answer

AWS Direct Connect virtual interfaces have a default limit of 100 allowed prefixes. If the on-premises router advertises more than 100 prefixes, BGP will reject the excess routes, causing some prefixes not to be received. Option B is incorrect because BGP communities are optional tags and not required for prefix advertisement.

Option C is incorrect because AS_PATH prepending influences route preference but does not prevent advertisement. Option D is incorrect because the MED attribute affects path selection, not the ability to advertise prefixes.

Practice this question →
197
MCQeasy

A company wants to monitor network traffic between its EC2 instances and determine which IP addresses are generating the most traffic. Which AWS service should be used to capture and analyze this traffic?

A.AWS Trusted Advisor
B.AWS CloudTrail
C.AWS Config
D.VPC Flow Logs
AnswerD

Flow Logs capture IP traffic metadata.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling analysis of traffic patterns and identification of high-traffic IP addresses. AWS Trusted Advisor (Option A) provides best-practice checks, not traffic data. AWS CloudTrail (Option B) records API calls, not network traffic.

AWS Config (Option C) tracks resource configuration changes.

Practice this question →
198
Multi-Selecthard

A company is deploying a multi-tier application across two Availability Zones. The web tier must be highly available and scale based on traffic. The application load balancer (ALB) is internet-facing. Which TWO configurations are required to ensure the ALB can route traffic to the web instances across both AZs?

Select 2 answers
A.Register the ALB with subnets in at least two Availability Zones.
B.Configure the VPC route tables to allow cross-AZ traffic.
C.Create a target group that includes instances from both Availability Zones.
D.Assign a security group that allows traffic from both AZs.
E.Place the ALB in a single subnet for simplicity and attach multiple ENIs.
AnswersA, C

ALB requires multiple AZs for HA.

Why this answer

Options A and C are correct. The ALB must be associated with subnets in at least two Availability Zones to achieve high availability. Additionally, the target group must contain instances from both AZs to allow the ALB to route traffic across zones.

Option B is incorrect because VPC route tables already allow cross-AZ traffic by default; no special configuration is needed. Option D is incorrect because security groups are applied to instances, not to AZs, and ALBs use security groups to control inbound traffic. Option E is incorrect because placing the ALB in a single subnet would limit its availability to one AZ, defeating high availability.

Practice this question →
199
MCQeasy

A company is using AWS Global Accelerator to improve performance for a web application hosted in two AWS Regions. The application uses an Application Load Balancer (ALB) in each region. The company wants to ensure that traffic is directed to the closest healthy endpoint. Which routing configuration should be used?

A.Global Accelerator endpoint groups with health checks and traffic dials
B.Global Accelerator with weighted endpoint groups
C.Route 53 latency-based routing with health checks
D.Route 53 geolocation routing with Global Accelerator
AnswerA

Global Accelerator automatically routes to the closest healthy endpoint.

Why this answer

Global Accelerator uses anycast IPs to route traffic to the closest healthy endpoint based on latency and health checks. Endpoint groups contain regional endpoints (e.g., ALBs), and health checks ensure only healthy endpoints receive traffic. Traffic dials allow controlling the proportion of traffic sent to each region but are optional.

Option B is incorrect because Global Accelerator does not use weighted routing; it uses latency-based routing. Option C is incorrect because Route 53 latency-based routing is a separate service and not the routing configuration for Global Accelerator; Global Accelerator itself handles proximity. Option D is incorrect because Route 53 geolocation routing is not used with Global Accelerator; Global Accelerator automatically routes to the nearest healthy endpoint without geolocation.

Practice this question →
200
Multi-Selectmedium

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The network team needs to monitor the Direct Connect connection for performance issues and receive alerts when latency exceeds a certain threshold. Which TWO actions should the team take to meet these requirements? (Choose TWO.)

Select 2 answers
A.Create a CloudWatch alarm on the Direct Connect latency metric to send notifications when latency exceeds the threshold.
B.Subscribe to AWS Health Dashboard events for Direct Connect.
C.Enable CloudWatch metrics on the Direct Connect virtual interface to monitor latency.
D.Enable VPC Flow Logs to capture traffic patterns and latency.
E.Configure a VPN CloudWatch metric to monitor the Direct Connect connection.
AnswersA, C

CloudWatch alarms can be set on latency metrics to trigger notifications.

Why this answer

AWS Direct Connect provides a built-in 'Latency' metric in CloudWatch that measures the round-trip time between the Direct Connect location and the AWS region. By creating a CloudWatch alarm on this metric, the team can trigger an SNS notification when latency exceeds a defined threshold, enabling proactive monitoring of performance issues.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (which capture traffic metadata) with performance monitoring tools, or assume that AWS Health Dashboard provides real-time latency metrics, when in fact only the Direct Connect latency metric in CloudWatch directly measures and alerts on latency.

Practice this question →
201
MCQmedium

A company is using AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon VPC with public and private subnets, NAT gateways, and route tables. After deployment, the EC2 instances in the private subnet cannot access the internet. The NAT gateway is in a public subnet with an Internet Gateway attached. What is the most likely cause?

A.The route table of the private subnet does not have a default route pointing to the NAT Gateway
B.The Internet Gateway is not attached to the VPC
C.The security group of the EC2 instances blocks outbound traffic to the internet
D.The network ACL of the private subnet blocks outbound traffic
AnswerA

Without a route to the NAT Gateway, traffic to the internet fails.

Why this answer

The most likely cause is that the route table of the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. For EC2 instances in a private subnet to access the internet, the private subnet's route table must contain a route that directs internet-bound traffic to the NAT Gateway. Option B is incorrect because the Internet Gateway is already attached to the VPC as stated.

Option C is incorrect because security groups are stateful and by default allow all outbound traffic; the question does not indicate any security group changes. Option D is incorrect because network ACLs are stateless and by default allow all outbound traffic; the scenario does not mention any NACL modifications.

Practice this question →
202
Multi-Selectmedium

A network engineer is configuring a site-to-site VPN connection between an on-premises network and AWS. The VPN tunnel is established, but traffic is not flowing. Which THREE components should the engineer check?

Select 3 answers
A.Security group rules on the VPC resources to allow inbound traffic from on-premises
B.On-premises firewall rules to allow IPsec traffic
C.Network ACLs for the subnet to allow return traffic
D.Internet Gateway attachment to the VPC
E.VPC route table for a route to the on-premises CIDR pointing to the virtual private gateway
AnswersA, B, E

Security groups control traffic flow.

Why this answer

Options A, B, and E are correct. Security group rules must allow inbound traffic from the on-premises network (A). On-premises firewall rules must permit IPsec traffic (B).

The VPC route table must have a route to the on-premises CIDR pointing to the virtual private gateway (E). Option C is incorrect because Network ACLs are stateless and require explicit inbound rules for return traffic; however, they are not the primary components to check when troubleshooting a site-to-site VPN that is established but not passing traffic. Option D is incorrect because an Internet Gateway is not used for VPN traffic; VPN traffic goes through the virtual private gateway.

Practice this question →
203
MCQhard

A company is using AWS Direct Connect with a private VIF to connect to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses but cannot establish TCP connections to an EC2 instance's private IP. The security groups and NACLs are configured to allow the traffic. What is the most likely cause of this issue?

A.The EC2 instance's operating system firewall is blocking TCP traffic
B.The Direct Connect virtual interface is in a down state
C.The on-premises firewall is blocking ICMP but not TCP
D.The VPC route table is missing a route for the on-premises CIDR
AnswerA

OS firewall can block TCP while allowing ICMP.

Why this answer

Since ICMP echo requests (pings) are working but TCP connections fail, the issue lies at Layer 4 or above. The EC2 instance's operating system firewall (e.g., iptables, Windows Firewall) can be configured to allow ICMP while blocking inbound TCP, which matches the reported symptoms. Security groups and NACLs are correctly configured, so they are not the cause.

Option A is correct. Option B is incorrect because a down VIF would block all traffic, including pings. Option C is the opposite—if the on-premises firewall were blocking ICMP, pings would fail.

Option D is incorrect because a missing route would break all traffic, not just TCP.

Practice this question →
204
MCQhard

A media company streams live video to viewers worldwide. The application runs on EC2 instances behind an Application Load Balancer in two AWS regions, us-east-1 and eu-west-1. The company uses Amazon CloudFront as a CDN with origins pointing to both regional ALBs. The network team recently deployed AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. However, after enabling Global Accelerator, viewers in Europe report buffering issues, while viewers in the US have no issues. The team has verified that the Global Accelerator endpoints are healthy and the ALBs are functioning correctly. The application uses a custom domain name. The DNS is managed by Route 53. What is the most likely cause of the buffering issues for European viewers?

A.Global Accelerator is directing European traffic to the us-east-1 endpoint due to endpoint weight misconfiguration.
B.The Route 53 DNS record is not pointing to Global Accelerator but to CloudFront, bypassing Global Accelerator.
C.CloudFront is caching content from the us-east-1 origin only, causing high latency for European viewers.
D.The eu-west-1 ALB is not configured to accept traffic from Global Accelerator IPs.
AnswerA

If weights are not set to distribute traffic, all traffic may go to one region.

Why this answer

Global Accelerator provides static IP addresses that are anycast from edge locations. If viewers' DNS queries resolve to the Global Accelerator DNS name, they get IPs that may route to the us-east-1 endpoint if the eu-west-1 endpoint is not properly configured or weighted, causing high latency. The most common issue is that the DNS resolution for the custom domain points to Global Accelerator, but the routing within Global Accelerator may not be directing European traffic to the eu-west-1 endpoint if the endpoint weights are misconfigured or if one endpoint is unhealthy.

Option B is wrong because CloudFront origins are separate; Global Accelerator is used instead of CloudFront? Actually, they use both, but the issue is after enabling Global Accelerator. Option C is wrong because CloudFront would not cause issues when Global Accelerator is used. Option D is wrong because the application is not on-premises.

Practice this question →
205
MCQhard

A company uses AWS Direct Connect and VPN as backup. They have a Transit Gateway with multiple VPC attachments. The network engineer wants to ensure that traffic uses Direct Connect when available and fails over to VPN. Which configuration should be applied?

A.Set a higher MED value on the VPN BGP advertisements.
B.Prepend AS_PATH on the VPN BGP advertisements to make them less preferred.
C.Apply BGP community tags from Direct Connect to set a higher local preference.
D.Configure BFD on both Direct Connect and VPN interfaces.
AnswerC

AWS uses BGP community tags to influence local preference.

Why this answer

AWS Direct Connect can apply BGP community tags that allow you to set a higher local preference for routes learned via Direct Connect compared to VPN routes. This ensures traffic prefers Direct Connect when available. Option A is incorrect because MED is used for influencing inbound route selection from multiple AS paths, not for preferring Direct Connect over VPN.

Option B is incorrect because AS_PATH prepending affects how routes are advertised to neighbors, not how they are preferred locally. Option D is incorrect because BFD (Bidirectional Forwarding Detection) provides fast failure detection but does not influence route preference; it would be used in conjunction with routing policies, not as a standalone solution.

Practice this question →
206
MCQeasy

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team wants to monitor the amount of data transferred between VPCs for cost allocation. Which AWS feature should they use?

A.CloudWatch Metrics for Transit Gateway.
B.VPC Flow Logs for each VPC.
C.AWS Config rules.
D.AWS CloudTrail logs.
AnswerB

Flow Logs capture individual flow data including byte counts.

Why this answer

VPC Flow Logs can be published to CloudWatch Logs or S3 and provide network traffic logs that include source/destination IP, ports, and byte counts, which can be used for cost allocation. Option A is wrong because CloudWatch Metrics for Transit Gateway only show aggregate metrics like bytes in/out per attachment, not per-flow. Option C is wrong because AWS Config records resource configuration changes, not traffic.

Option D is wrong because CloudTrail records API calls.

Practice this question →
207
Multi-Selectmedium

A network engineer is troubleshooting network connectivity issues in a VPC. The engineer suspects that the network ACL is blocking traffic. Which TWO actions should the engineer take to verify this?

Select 2 answers
A.Review the inbound and outbound rules of the network ACL.
B.Check the security group rules for the affected instances.
C.Use AWS CloudTrail to view network traffic logs.
D.Enable VPC Flow Logs and filter for 'ACCEPT' or 'REJECT' status.
E.Test connectivity using AWS Direct Connect.
AnswersA, D

NACL rules explicitly allow or deny traffic.

Why this answer

Options A and D are correct because reviewing the inbound and outbound rules of the network ACL allows the engineer to check if traffic is explicitly blocked by the ACL, and enabling VPC Flow Logs with 'ACCEPT' or 'REJECT' status provides insight into whether the ACL is actually blocking the traffic. Option B is incorrect because security groups are stateful and work at the instance level, not at the subnet level like NACLs. Option C is incorrect because AWS CloudTrail records API activity, not network traffic.

Option E is incorrect because AWS Direct Connect establishes a dedicated network connection but does not help verify if a NACL is blocking traffic.

Practice this question →
208
MCQhard

A company has a multi-VPC architecture using AWS Transit Gateway (TGW). They have a central inspection VPC with a Gateway Load Balancer (GWLB) and third-party firewall appliances. All other VPCs are attached to the TGW and have route tables that send traffic to the inspection VPC for inspection. Recently, the network team deployed a new VPC (VPC-D) and attached it to the TGW. They configured the VPC-D route table to send all inter-VPC traffic to the TGW. However, traffic from VPC-D to other VPCs is not being inspected. The team confirmed that the firewall appliances are healthy and the GWLB is correctly configured. Which action should the network team take to ensure traffic from VPC-D is inspected?

A.Enable route propagation on VPC-D's TGW attachment.
B.Add a route in VPC-D's subnet route tables pointing to the TGW for all traffic.
C.Create a new TGW route table and associate all VPC attachments to it.
D.Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.
AnswerD

This ensures TGW forwards traffic from VPC-D through the inspection VPC.

Why this answer

Each VPC attached to a Transit Gateway is associated with a specific TGW route table. This route table controls how traffic from that VPC is forwarded to other attachments. For traffic from VPC-D to be inspected, the TGW route table associated with VPC-D's attachment must include routes that direct traffic to the inspection VPC's attachment (where the Gateway Load Balancer and firewall appliances reside).

Simply attaching VPC-D does not automatically associate it with the correct route table; the network team must explicitly associate VPC-D's attachment with the existing route table that routes traffic to the inspection VPC. Option D correctly describes this action.

Practice this question →
209
Multi-Selecteasy

A company is using AWS CloudWatch to monitor network metrics. They want to create a dashboard that shows the total number of bytes sent and received by all EC2 instances in a specific VPC. Which two metrics should they use? (Choose TWO.)

Select 2 answers
A.TotalNetworkBytes
B.NetworkPacketsOut
C.NetworkOut
D.NetworkPacketsIn
E.NetworkIn
AnswersC, E

Bytes sent.

Why this answer

The question asks for metrics that measure total bytes sent and received. AWS CloudWatch provides `NetworkIn` (bytes received) and `NetworkOut` (bytes sent) for EC2 instances. These are the only two metrics that directly measure bytes.

The option `NetworkPacketsIn` and `NetworkPacketsOut` measure packets, not bytes, and `TotalNetworkBytes` is not a valid CloudWatch metric. Therefore, the correct answers are NetworkOut and NetworkIn.

Practice this question →
210
MCQhard

A company uses AWS Direct Connect with a public VIF to access Amazon S3. The network team notices that the latency to S3 increases significantly during peak hours. They have tested the connection and confirmed that the physical link is not saturated. The company uses a single Direct Connect connection. The S3 traffic is routed over the public VIF. The team wants to improve performance without adding a new Direct Connect connection. Which action should the team take to reduce latency?

A.Use an AWS Site-to-Site VPN connection over the Direct Connect to access S3 via private IP.
B.Add a second Direct Connect connection to load balance traffic.
C.Configure the Direct Connect public VIF to use a different AWS region closer to the on-premises location.
D.Create an S3 Gateway Endpoint in the VPC and route S3 traffic through a private VIF attached to the VPC.
AnswerD

Gateway Endpoint keeps traffic within AWS and reduces latency compared to public VIF.

Why this answer

Using a Direct Connect gateway allows you to connect to multiple VPCs and also to AWS public services via a private VIF. However, for S3, you can use a private VIF with a VPC interface endpoint (Gateway Endpoint for S3) to keep traffic within the AWS network and avoid internet transit. This reduces latency because traffic goes from Direct Connect to the VPC and then to S3 via the gateway endpoint.

Option B (adding VPN) adds IPSec overhead. Option C uses a different AWS region, which may increase latency. Option D (adding a second Direct Connect) is not allowed per the question.

Practice this question →
211
Matchingmedium

Match each VPN term to its correct description in the context of AWS Site-to-Site VPN.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

VPN concentrator on the AWS side attached to a VPC

VPN device on the on-premises side

Encrypted IPsec connection between VGW and CGW

Secret key used to authenticate the VPN tunnel endpoints

Dynamic routing protocol used to exchange routes over VPN tunnels

Why these pairings

The correct matches are: VPN Connection → logical connection, VPN Tunnel → encrypted tunnel, Transit Gateway → central hub. Common confusions involve swapping the definitions of Virtual Private Gateway (AWS-side) and Customer Gateway (customer-side).

Practice this question →
212
MCQeasy

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

A.AWS Site-to-Site VPN is not established.
B.MACsec encryption is misconfigured on the customer router.
C.BGP session between the customer router and AWS is down.
D.Jumbo frames are enabled on the VIF but not supported by the customer router.
AnswerC

A private VIF requires an active BGP session; if BGP is down, the VIF state becomes down.

Why this answer

A private VIF relies on a BGP session between the customer router and the AWS Direct Connect router to exchange routes and maintain the virtual interface state. When the BGP session goes down, the VIF state transitions to 'down' because no routing information is being exchanged, causing connectivity loss. This is the most direct and common cause of a VIF being in the 'down' state.

Exam trap

The trap here is that candidates often assume a VIF 'down' state is caused by physical or Layer 1 issues (like MACsec or jumbo frames), but the VIF state is directly tied to the BGP session status, not the underlying physical link.

How to eliminate wrong answers

Option A is wrong because AWS Site-to-Site VPN is a separate connectivity option and is not required for a Direct Connect private VIF to function; the VIF state is independent of any VPN. Option B is wrong because MACsec encryption, when misconfigured, would cause link-level encryption failures but would not directly cause the BGP session or VIF state to go down; the VIF would remain 'up' at the Layer 1/2 level. Option D is wrong because jumbo frame misconfiguration would cause packet loss or MTU issues but would not bring the BGP session or VIF state down; the VIF would still show as 'up' if the BGP session is established.

Practice this question →
213
Multi-Selectmedium

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. They notice that traffic between VPCs is being dropped intermittently. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Select 2 answers
A.Monitor the Transit Gateway's CloudWatch metrics for packets dropped due to route table limits
B.Review the security group rules on the Transit Gateway
C.Enable VPC Flow Logs on the VPCs
D.Check if the VPC CIDRs are overlapping
E.Create a VPN connection for backup
AnswersA, C

Correct. Monitoring Transit Gateway CloudWatch metrics can show packets dropped due to route table limits or throttling.

Why this answer

Monitoring Transit Gateway CloudWatch metrics for dropped packets can identify route table limits or throttling issues. Option C is correct because enabling VPC Flow Logs helps analyze traffic patterns and identify dropped packets. Option B is incorrect because security groups do not apply to Transit Gateway; they apply to ENIs.

Option D is incorrect because overlapping VPC CIDRs can be handled with proper routing and do not cause intermittent drops by themselves. Option E is incorrect because creating a VPN connection is a solution, not a diagnostic step.

Practice this question →
214
MCQmedium

Refer to the exhibit. A network engineer is creating an IAM policy to allow a user to manage VPC Peering connections. The user reports that they cannot delete a VPC Peering connection. What should the engineer add to the policy?

A.ec2:DeleteVpcPeeringConnection
B.ec2:DescribeVpcPeeringConnectionRouteTables
C.ec2:ModifyVpcPeeringConnectionOptions
D.ec2:RejectVpcPeeringConnection
AnswerA

This action allows deleting peering connections.

Why this answer

Ec2:DeleteVpcPeeringConnection. The user cannot delete a VPC peering connection because the policy does not include this action. Option B, ec2:DescribeVpcPeeringConnectionRouteTables, is not a valid action and does not relate to deletion.

Option C, ec2:ModifyVpcPeeringConnectionOptions, is for modifying options, not deletion. Option D, ec2:RejectVpcPeeringConnection, is for rejecting pending connections, not deleting an existing one. Therefore, adding ec2:DeleteVpcPeeringConnection to the policy will resolve the issue.

Practice this question →
215
MCQeasy

A network engineer is setting up an AWS Site-to-Site VPN connection. The customer gateway device is behind a NAT device that performs PAT. The VPN tunnel fails to come up. What is the most likely cause?

A.The tunnel options (DPD, encryption algorithms) must match exactly.
B.Dead peer detection (DPD) is disabled.
C.The VPN connection does not have route propagation enabled.
D.The NAT device is not forwarding UDP 500 and UDP 4500 traffic.
AnswerD

IPsec requires these ports for IKE and NAT traversal.

Why this answer

IPsec requires UDP ports 500 and 4500, which must be forwarded through the NAT device. Option A is incorrect because tunnel options such as DPD and encryption algorithms do not need to match exactly for the tunnel to come up. Option B is incorrect because disabling DPD does not prevent tunnel establishment; it only affects detection of peer failure.

Option C is incorrect because route propagation does not affect the establishment of the VPN tunnel itself; it affects routing of traffic once the tunnel is up.

Practice this question →
216
MCQmedium

A company has a Direct Connect connection with a private VIF to a VPC. The network team notices intermittent packet loss on the link. CloudWatch metrics show no errors on the connection. What should the team do next to isolate the issue?

A.Run a traceroute from an on-premises device to an EC2 instance in the VPC.
B.Check the BGP session status on the customer router.
C.Enable VPC Flow Logs on the VPC.
D.Increase the bandwidth of the Direct Connect connection.
AnswerA

Traceroute helps pinpoint where packet loss occurs along the path.

Why this answer

Running a traceroute from an on-premises device to an EC2 instance in the VPC helps identify where packets are being dropped along the path. Option B is incorrect because checking BGP session status only verifies routing adjacency, not packet loss. Option C is incorrect because VPC Flow Logs capture metadata but do not indicate packet loss on the Direct Connect link.

Option D is incorrect because increasing bandwidth does not resolve packet loss; it only adds capacity.

Practice this question →
217
MCQmedium

A company has an AWS Site-to-Site VPN connection between an on-premises network and a VPC. The VPN uses virtual private gateways and static routes. The network team reports that the VPN tunnel is up, but traffic from the on-premises network cannot reach some EC2 instances in the VPC. The EC2 instances have security groups that allow inbound traffic from the on-premises network. The VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. The tunnel status shows 'UP' from both sides. What is the MOST likely cause of the connectivity issue?

A.The VPC route table does not have a route for the on-premises subnet that the traffic originates from, but only for a larger CIDR.
B.The VPC has a network ACL that denies inbound traffic from the on-premises CIDR.
C.The customer gateway device is using a different pre-shared key than configured in AWS.
D.The virtual private gateway is not attached to the correct VPC.
AnswerA

If the route is for a different CIDR, traffic may not be routed correctly.

Why this answer

The security group may be allowing traffic from the on-premises CIDR but not from the tunnel endpoint IP. However, the more common issue is that the on-premises network's source IP is being translated or the VPC route table is missing a route for the specific subnet. Option A is a typical cause: if the on-premises CIDR is not exactly matched, the VPC may not route traffic back.

Option C could cause issues if the VPN is not in the main route table. Option D would cause tunnel issues.

Practice this question →
218
MCQmedium

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway, and the private subnet has EC2 instances that need internet access. The private instances can reach the internet, but cannot access an S3 bucket in the same region using the S3 gateway endpoint. What is the most likely cause?

A.The S3 gateway endpoint is not in the same VPC.
B.The S3 bucket policy does not allow access from the VPC.
C.The NAT Gateway is in a different availability zone than the private instances.
D.The private subnet's route table does not have a route to the S3 gateway endpoint.
AnswerD

Without a route to the endpoint, traffic to S3 goes through the NAT Gateway or is dropped.

Why this answer

For private instances to use a gateway endpoint, the route table for the private subnet must have a route pointing to the S3 endpoint. Additionally, the endpoint's policy must allow the traffic. The NAT Gateway is not used for gateway endpoints.

Practice this question →
219
MCQhard

A company has a multi-account AWS environment using AWS Transit Gateway. The network team wants to centralize network logging from all accounts into a single account for analysis. Which combination of services should be used to achieve this?

A.AWS CloudTrail and Amazon CloudWatch Logs
B.Amazon Kinesis Data Streams and Amazon Redshift
C.Amazon S3 and Amazon Athena
D.AWS Config and Amazon DynamoDB
AnswerC

VPC Flow Logs can be published to a central S3 bucket, and Athena can query them.

Why this answer

VPC Flow Logs from each account's VPCs can be published to a centralized Amazon S3 bucket using cross-account permissions. Amazon Athena can then be used to query and analyze the flow logs directly from S3 using standard SQL. This approach provides a cost-effective and scalable solution for centralizing network logging across multiple accounts.

Option A is incorrect because AWS CloudTrail logs API activity, not network traffic; CloudWatch Logs can aggregate logs but require additional subscription filters for cross-account. Option B is incorrect because Kinesis Data Streams is designed for real-time streaming and requires additional processing to store and analyze logs, making it less suitable for historical analysis. Option D is incorrect because AWS Config records configuration changes and resource compliance, not network traffic logs.

Practice this question →
220
MCQhard

A network engineer has created a VPC endpoint for a VPC endpoint service. The endpoint is 'available' but the application cannot connect to the service using the private DNS name. The engineer checks the Route 53 private hosted zone and finds that no record exists for the endpoint. What is the most likely cause?

A.The VPC endpoint service is not accepting connections
B.The VPC endpoint policy is blocking connectivity
C.The security group for the endpoint does not allow inbound traffic
D.The 'PrivateDnsEnabled' flag is set to false on the VPC endpoint
AnswerD

If private DNS is not enabled, Route 53 does not automatically create records for the endpoint.

Why this answer

When the 'PrivateDnsEnabled' flag is set to false on a VPC endpoint, AWS does not automatically create a Route 53 private hosted zone for the endpoint, so the private DNS name does not resolve. This is the most likely cause given that no DNS record exists. Option D is correct.

Options A, B, and C could cause connectivity issues but would not prevent the DNS record from being created.

Practice this question →
221
Multi-Selectmedium

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Select 2 answers
A.iperf
B.tcpdump
C.traceroute
D.nslookup
E.ping
AnswersA, C

iperf measures network throughput.

Why this answer

Options A and C are correct. iperf is a tool used to measure network throughput between two hosts. Traceroute diagnoses network path and latency, which can help identify performance bottlenecks. Options B, D, and E are incorrect: tcpdump captures packets but does not measure throughput; nslookup is a DNS lookup tool that does not measure network performance; ping measures latency but not throughput.

Practice this question →
222
Multi-Selectmedium

A company is designing a highly available Direct Connect connection. Which THREE components should be deployed to meet this requirement? (Select THREE.)

Select 3 answers
A.A single BGP session over one of the virtual interfaces.
B.Two Direct Connect connections to two different AWS Direct Connect locations.
C.A VPN connection as a backup to Direct Connect.
D.Two customer routers (or one router with two physical interfaces) connecting to the two Direct Connect connections.
E.Two virtual interfaces (VIFs) configured on the Direct Connect connections.
AnswersB, D, E

Provides physical diversity.

Why this answer

For high availability, you need at least two Direct Connect connections (preferably to different AWS locations), two customer routers (or one router with two interfaces), and two virtual interfaces (VIFs) to provide redundancy. Using BGP with multiple sessions ensures automatic failover.

Practice this question →
223
MCQhard

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?

A.Network ACLs are not configured to allow inbound ICMP
B.The route tables in VPC A point to a VPN gateway instead of the VPC peering connection
C.Security groups are stateful and block return traffic
D.The VPC peering connection is in the 'failed' state
AnswerB

Correct. The route tables in each VPC must have an entry for the other VPC's CIDR with the VPC peering connection as the target. If the route points to a VPN gateway instead, traffic will not use the peering connection.

Why this answer

For VPC peering to work, each VPC must have routes in their route tables that point to the peering connection as the target for the other VPC's CIDR. If the route table in VPC A points to a VPN gateway instead of the VPC peering connection, traffic will not traverse the peering connection, causing connectivity failure. Option A is incorrect because Network ACLs are stateless and must allow both inbound and outbound ICMP; if they were misconfigured, they could block traffic, but the question states that route tables and security groups are correctly configured, not NACLs.

Option C is incorrect because security groups are stateful and automatically allow return traffic; they would not block return traffic. Option D is incorrect because the VPC peering connection being in 'failed' state would prevent connectivity, but the question implies the connection is established (as the engineer verified route tables and security groups, not the peering state).

Exam trap

A common trap is assuming that security group statefulness automatically allows all traffic; however, statefulness only applies to return traffic, not initial traffic. Another trap is focusing on NACLs instead of route tables for inter-VPC connectivity.

Practice this question →
224
MCQeasy

A network engineer needs to troubleshoot high latency between two EC2 instances in the same VPC but in different Availability Zones. Which tool should be used to measure network performance?

A.Use traceroute to identify the path
B.Use ping to test connectivity
C.Use iperf to measure throughput and latency
D.Use netstat to check network statistics
AnswerC

iperf is designed for active network performance measurement.

Why this answer

Iperf is the correct tool because it can measure both throughput and latency between two points, making it ideal for troubleshooting high latency. Traceroute (A) shows the network path but does not measure performance. Ping (B) measures round-trip time but not throughput.

Netstat (D) displays network connections and statistics but does not actively measure performance.

Practice this question →
225
MCQmedium

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over a Direct Connect connection. The engineer has verified that the VPC route tables, Direct Connect virtual interface, and on-premises routing are correctly configured. Which tool should be used to verify the path MTU and identify fragmentation issues?

A.Use the netstat command
B.Use the ping command with the DF flag set to test MTU
C.Use the nslookup command
D.Use the traceroute command
AnswerB

ping with 'do not fragment' flag can detect MTU issues.

Why this answer

The ping command with the Don't Fragment (DF) flag set (e.g., `ping -M do -s <size>` on Linux) is the correct tool to verify path MTU because it forces the packet not to be fragmented. If the packet size exceeds the MTU of any link along the path, the router will drop the packet and send an ICMP Fragmentation Needed message back, allowing the engineer to pinpoint the maximum supported MTU and identify fragmentation issues.

Exam trap

The trap here is that candidates often choose traceroute (option D) thinking it shows MTU along the path, but traceroute does not set the DF flag or control payload size to test fragmentation; it only measures hop latency and path, not MTU boundaries.

How to eliminate wrong answers

Option A is wrong because netstat displays network connections, routing tables, and interface statistics, but it cannot test path MTU or detect fragmentation. Option C is wrong because nslookup is a DNS resolution tool that queries name servers and has no relevance to MTU or fragmentation testing. Option D is wrong because traceroute shows the hop-by-hop path and latency but does not allow you to set the DF flag or control packet size to specifically test MTU thresholds; it can indicate path changes but not fragmentation boundaries.

Practice this question →
← PreviousPage 3 of 5 · 326 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Network Management and Operations questions.

Start 20-question session