Courseiva

CCNA Network Management and Operations Questions

26 of 326 questions · Page 5/5 · Network Management and Operations · Answers revealed

Practice these questionsDomain overviewAll questions
301
Multi-Selecthard

A company uses AWS Direct Connect with a public VIF to access S3. The on-premises network uses BGP to advertise a specific prefix to AWS. The company wants to ensure that traffic to S3 from on-premises always uses the Direct Connect connection and not the internet. Which ONE configuration must be in place?

Select 1 answer
A.Set a higher MED value on routes learned from the internet to make them less preferred.
B.Set a higher local preference on the Direct Connect BGP session for the S3 prefixes.
C.Disable the internet gateway for the VPC.
D.Set the AS_PATH prepend on the Direct Connect BGP session.
E.Configure the on-premises router to advertise a more specific route for the S3 CIDR blocks over the Direct Connect BGP session.
AnswersB

Local preference influences outbound route selection; higher value is preferred.

Why this answer

To ensure on-premises traffic to S3 uses Direct Connect (public VIF) instead of the internet, the primary mechanism is to set a higher local preference on the Direct Connect BGP session for the S3 prefixes (B). Local preference is evaluated first in the BGP path selection process, making the Direct Connect path more attractive than internet paths. Option E is incorrect because the on-premises router does not advertise S3 CIDRs; AWS advertises them.

Other methods like MED or AS path prepend are not as effective for this scenario when comparing routes from different ASes.

Practice this question →
302
MCQeasy

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to access the internet. The instance has a route table with a default route to a NAT gateway. However, the instance cannot reach the internet. What is the most likely cause?

A.The NAT gateway is placed in a private subnet.
B.The instance does not have a public IP address assigned.
C.The security group attached to the instance does not allow outbound HTTPS traffic.
D.The network ACL on the private subnet blocks outbound HTTP traffic.
AnswerA

NAT gateway must be in a public subnet with an internet gateway.

Why this answer

The most likely cause is that the NAT gateway is placed in a private subnet (Option A). A NAT gateway must be deployed in a public subnet with an associated Internet Gateway to route traffic to the internet. If it is in a private subnet, it cannot access the internet, thus the instance in the private subnet cannot reach the internet.

Option B is incorrect because an instance in a private subnet does not need a public IP address to access the internet through a NAT gateway; it uses the NAT gateway's public IP. Option C is incorrect because security groups are stateful and allow outbound traffic by default; the security group would not block HTTPS outbound unless explicitly configured. Option D is incorrect because the default network ACL allows all outbound traffic; even if modified, the question says the route table points to the NAT gateway, so the issue is the NAT gateway's placement.

Practice this question →
303
MCQhard

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a VPC, public and private subnets, security groups, and an Application Load Balancer. The network team wants to ensure that the ALB can only accept traffic from a specific set of IP addresses. They add a security group rule that allows inbound traffic on port 443 from the allowed IP CIDR. However, after deployment, the ALB is not responding to requests from the allowed IPs. The team checks the security group and confirms the rule exists. They also verify that the ALB is in the public subnet and has a public DNS name. What is the MOST likely cause?

A.The security group rule is blocking return traffic; security groups are stateful.
B.The ALB listener is not configured to forward traffic to the target group.
C.The public subnet does not have a route to an internet gateway.
D.The ALB is using an internal scheme instead of internet-facing.
AnswerC

For internet-facing ALBs, the subnets must have a default route to an internet gateway. Without it, internet traffic cannot reach the ALB.

Why this answer

The most likely cause is that the public subnet does not have a route to an internet gateway. For an internet-facing ALB to receive traffic from the internet, the subnets where the ALB is deployed must have a default route (0.0.0.0/0) pointing to an internet gateway. Without this route, even if the security group allows the traffic, the ALB cannot be reached because the subnet is not routable from the internet.

Option A is incorrect because security groups are stateful and automatically allow return traffic, so that would not block responses. Option B is incorrect because the listener configuration affects whether traffic is forwarded to targets, not whether the ALB itself accepts incoming connections from allowed IPs. Option D is incorrect because the ALB uses an internet-facing scheme; if it were internal, it would not have a public DNS name.

Practice this question →
304
MCQhard

A company has a VPC with an AWS Site-to-Site VPN connection to their on-premises network. The VPN uses dynamic routing with BGP. The on-premises network is advertising a specific route to the VPC. However, instances in the VPC cannot reach the on-premises network. The VPN tunnels are up and BGP sessions are established. What should the engineer check?

A.The tunnel options include the correct encryption algorithms.
B.The on-premises router is advertising the route with the correct ASN.
C.Route propagation is enabled on the VPC route tables.
D.The VPN connection's static routes are configured for the on-premises CIDR.
AnswerC

Without route propagation, BGP routes are not added to route tables.

Why this answer

Even if BGP routes are received, they must be propagated to the route tables. If route propagation is not enabled, the routes are not added. Option A is incorrect; static routes are not necessary for dynamic routing.

Option B is incorrect because the VPN connection routes are already configured. Option D is incorrect because the tunnels are up, so the configuration is likely correct.

Practice this question →
305
MCQmedium

A company has a VPC with an AWS Direct Connect private VIF connected to a virtual private gateway. The on-premises network uses BGP to advertise routes to AWS. The network team wants to ensure that only specific prefixes from on-premises are accepted. They configure the virtual private gateway with a BGP community. However, after configuration, they notice that all prefixes are still being accepted. What is the MOST likely reason?

A.The virtual private gateway needs to have the BGP community enabled.
B.The virtual private gateway does not filter routes based on BGP communities; you need to use a prefix list.
C.The BGP community is not being advertised by the on-premises router.
D.The BGP community must be configured on the customer gateway device.
AnswerB

BGP communities are tags, not filters.

Why this answer

BGP communities are tags that can be applied to routes, but the virtual private gateway (VPG) does not filter routes based on BGP communities. To filter which prefixes are accepted, you must use a prefix list or route table filtering. Therefore, simply configuring a BGP community on the VPG will not prevent all prefixes from being accepted; you need to explicitly filter using a prefix list.

Option B is correct. Option A is not needed because BGP communities are already supported. Option C is not the most likely reason because even if the community is advertised, the VPG won't filter based on it.

Option D is false because the community can be configured on either side, but filtering still requires a prefix list.

Practice this question →
306
Multi-Selectmedium

A network engineer is analyzing VPC Flow Logs and notices that some rejected traffic is not logged. Which THREE conditions could cause this?

Select 3 answers
A.The traffic is blocked by a network ACL.
B.The traffic is rejected by the destination network.
C.The Flow Logs capture only accepted traffic due to the filter.
D.The Flow Logs are configured for a specific network interface only.
E.The traffic is blocked by a security group before reaching the network interface.
AnswersC, D, E

Flow Logs can filter by acceptance status.

Why this answer

Correct options are C, D, and E. Option C: If the Flow Logs are configured to capture only accepted traffic (filter: ACCEPT), then rejected traffic is not logged. Option D: Flow Logs are per network interface; if the traffic does not traverse the monitored interface, it won't be logged.

Option E: Security groups operate at the instance level; if a security group blocks traffic before it reaches the network interface, the flow log for that interface will not capture the rejected traffic. Options A and B are incorrect because network ACLs operate at the subnet level and their deny actions are logged by Flow Logs if the traffic reaches the subnet; destination network rejection is also logged as 'REJECT' in the flow log record.

Practice this question →
307
MCQmedium

A company uses AWS Direct Connect with a private VIF to connect to a VPC. The network team notices that traffic from on-premises to an EC2 instance in the VPC is taking a suboptimal path through the internet instead of the Direct Connect. What is the most likely cause?

A.The on-premises router does not have a specific route for the VPC CIDR via the Direct Connect.
B.The VPC route table does not include a route to the Direct Connect gateway.
C.The Direct Connect virtual interface has BGP ASN prepending configured.
D.The VPC route table does not have a prefix list for the on-premises CIDR.
AnswerA

Without a specific route, traffic may default to internet.

Why this answer

If the on-premises network does not have a specific route pointing to the Direct Connect for the VPC CIDR, traffic may use the internet. Option B is wrong because prefix lists are not required. Option C is wrong because ASN prepending would affect outbound traffic, not inbound.

Option D is wrong because VPC route tables are not visible to on-premises.

Practice this question →
308
Multi-Selectmedium

A network engineer is troubleshooting a slow connection between an EC2 instance and an RDS database in the same VPC. The engineer wants to analyze network performance metrics. Which TWO metrics should the engineer examine? (Choose two.)

Select 2 answers
A.Database connections count
B.Disk queue depth
C.Round-trip time between the EC2 instance and RDS
D.RDS instance CPU utilization
E.Network packets dropped by the RDS instance's network interface
AnswersC, E

Direct measure of latency.

Why this answer

(Round-trip time) directly measures latency between the EC2 instance and RDS, which is key for diagnosing slow connections. Option E (Network packets dropped) indicates network congestion or performance issues at the network interface. Option A (Database connections count) is an application-level metric that does not directly measure network performance.

Option B (Disk queue depth) is storage-related. Option D (RDS CPU utilization) is a system metric that may affect database performance but does not directly indicate network latency or packet loss.

Practice this question →
309
MCQhard

A company has a large AWS environment with hundreds of VPCs connected via Transit Gateway. They want to centrally manage network traffic flow and enforce security policies. Which service should they use to create a central network inspection architecture?

A.AWS WAF
B.Security groups
C.AWS Network Firewall
D.AWS Shield Advanced
AnswerC

Network Firewall is designed for centralized network inspection and can be integrated with Transit Gateway.

Why this answer

AWS Network Firewall provides managed firewall services that can be centrally deployed in a dedicated VPC and route traffic through it for inspection.

Practice this question →
310
MCQmedium

A company has a hybrid network with multiple VPCs connected via a Transit Gateway. They want to centralize outbound internet traffic through a single VPC with a NAT gateway. The security team requires that all traffic to the internet must be logged. Which solution is MOST operationally efficient?

A.Enable VPC Flow Logs on the NAT gateway's subnet and publish to Amazon S3
B.Enable VPC Flow Logs on the central VPC and publish to Amazon CloudWatch Logs
C.Deploy a third-party firewall appliance in the central VPC and enable logging
D.Enable AWS CloudTrail to log all network events
AnswerB

Captures all IP traffic and can be analyzed.

Why this answer

The most operationally efficient solution is to enable VPC Flow Logs on the central VPC and publish them to Amazon CloudWatch Logs. This captures all traffic passing through the VPC, including internet-bound traffic routed through the NAT gateway, and provides a centralized logging solution. Option A is incorrect because VPC Flow Logs on the NAT gateway's subnet only capture traffic for that subnet, not all internet-bound traffic from other VPCs routed through the Transit Gateway.

Option C is incorrect because deploying a third-party firewall adds unnecessary complexity and cost. Option D is incorrect because AWS CloudTrail logs API calls, not network traffic.

Practice this question →
311
Multi-Selecthard

A company is using a transit gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that some VPCs can communicate with each other but not with the on-premises network. The transit gateway route tables are configured correctly. Which TWO configurations should the team check?

Select 2 answers
A.Verify that the transit gateway is in a 'available' state
B.Check the security group rules of the EC2 instances in the VPCs
C.Verify that the on-premises router is advertising the on-premises CIDR over BGP to the VPN
D.Check the VPC Flow Logs for dropped packets
E.Confirm that the VPN attachment is associated with the correct transit gateway route table
AnswersC, E

If routes are not advertised, the transit gateway won't have paths to on-premises.

Why this answer

Options C and E are correct. For VPCs to communicate with the on-premises network, the on-premises router must advertise its CIDR over BGP (C) so the transit gateway learns the route. Additionally, the VPN attachment must be associated with the correct transit gateway route table (E) to propagate the learned routes and enable connectivity.

Option A is incorrect because the transit gateway is available if inter-VPC traffic works. Option B is incorrect because security groups are instance-level and do not affect routing; if inter-VPC traffic works, security groups are not the issue. Option D is incorrect because VPC Flow Logs only log traffic, they do not affect routing or configuration.

Practice this question →
312
MCQeasy

A network engineer is troubleshooting intermittent connectivity issues between two VPCs connected via a VPC peering connection. The engineer notices that the route tables in both VPCs have the correct routes. What should the engineer check next?

A.Check security group and network ACL rules
B.Verify that DNS resolution is enabled for the VPCs
C.Ensure that the VPN connection is active
D.Check the internet gateway configuration
AnswerA

Security groups and NACLs can block traffic even with correct routes.

Why this answer

Security group rules and NACLs can block traffic even if routes are correct. Option B is wrong because DNS resolution is not related to basic connectivity. Option C is wrong because internet gateway is not involved in VPC peering.

Option D is wrong because VPN connection is a different service.

Practice this question →
313
MCQhard

A company is using AWS Client VPN to provide remote access to employees. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a subnet, and authorization rules are configured. What is the most likely cause?

A.The Client VPN endpoint's security group does not allow inbound traffic from the client IP pool.
B.The VPC's network ACLs are blocking traffic.
C.The authorization rules are not associated with the correct groups.
D.The subnet association is missing.
AnswerA

The security group acts as a firewall for the VPN endpoint; if it doesn't allow traffic from the client CIDR, traffic is blocked.

Why this answer

The most likely cause is that the Client VPN endpoint's security group does not allow inbound traffic from the client IP pool. Since users can connect to the VPN, the subnet association and authorization rules are correctly configured. However, the security group attached to the VPN endpoint acts as a virtual firewall for inbound and outbound traffic.

If it does not permit inbound traffic from the client IP range, resources in the VPC will not be reachable. The network ACLs are stateless and default to allowing outbound traffic, so they are less likely to be the issue.

Practice this question →
314
MCQhard

A company has a multi-account AWS environment using AWS Organizations. Each account contains a VPC with a private subnet and a public subnet. The company uses a centralized inspection VPC in the network account with third-party firewall appliances. All internet-bound traffic from the VPCs must be routed through the inspection VPC via an AWS Transit Gateway. The network team has configured the transit gateway with separate route tables: one for the inspection VPC and one for the spoke VPCs. The spoke VPCs have a default route (0.0.0.0/0) pointing to the transit gateway. The inspection VPC has a default route pointing to an egress VPC that has an internet gateway. However, traffic from a spoke VPC is not reaching the internet. The network engineer has verified that the firewall appliances are running and that the security groups and NACLs allow traffic. What is the most likely cause of the issue?

A.The inspection VPC route table does not have a route to the transit gateway for the spoke VPC CIDRs.
B.The inspection VPC route table does not have a route to the spoke VPC CIDRs via the transit gateway.
C.The inspection VPC route table has a blackhole route for the spoke VPC CIDRs.
D.The transit gateway route table for the spoke VPCs does not have a route to the egress VPC.
AnswerA

Correct: Without a route to the transit gateway, the firewall cannot send traffic back to the spoke VPCs.

Why this answer

For traffic from a spoke VPC to reach the internet via the inspection VPC, the inspection VPC must be able to route return traffic back to the spoke VPC. The inspection VPC's route table requires routes for each spoke VPC's CIDR blocks with the Transit Gateway as the target. Without these routes, the firewall cannot forward return traffic, causing the initial connection to time out and internet access to fail.

Option B is similar but misstates the requirement. Options C and D describe different issues that do not align with the described symptoms.

Practice this question →
315
MCQeasy

A network engineer is designing a highly available VPN connection between an on-premises network and AWS. The on-premises network has two internet connections from different ISPs. Which AWS VPN configuration should be used to provide the highest availability?

A.Create a single VPN tunnel from one customer gateway to the virtual private gateway.
B.Create two customer gateways, each with a VPN tunnel to the virtual private gateway.
C.Create one customer gateway with two VPN tunnels, each using different internet connections.
D.Use AWS Direct Connect instead of VPN for higher availability.
AnswerB

Two tunnels from different devices and ISPs provide high availability.

Why this answer

Using two customer gateways with two VPN tunnels each provides redundancy at both the device and ISP level. Option A is wrong because a single VPN tunnel is not redundant. Option C is wrong because a single customer gateway with two tunnels only provides ISP redundancy.

Option D is wrong because Direct Connect is not a VPN.

Practice this question →
316
Multi-Selectmedium

A network team is planning a migration of a legacy application to AWS. The application requires a static IP address for the on-premises firewall whitelist. Which THREE AWS services can provide a static IP address for outbound traffic from a VPC?

Select 3 answers
A.AWS Direct Connect with a public virtual interface.
B.VPC endpoint (gateway endpoint) for S3.
C.Application Load Balancer without a static IP.
D.Amazon NAT Gateway with an Elastic IP address.
E.Network Load Balancer with an Elastic IP address per subnet.
AnswersA, D, E

Traffic over a public VIF comes from a static public IP (the Direct Connect public IP).

Why this answer

Options A, D, and E are correct. A Direct Connect public virtual interface uses a static public IP address for outbound traffic. A NAT Gateway with an Elastic IP provides a static IP for outbound traffic from private subnets.

A Network Load Balancer with Elastic IPs per subnet provides static IPs for inbound and outbound traffic. Option B (VPC endpoint for S3) does not provide a static IP; it uses a prefix list. Option C (Application Load Balancer) does not have a static IP by default; it uses dynamic IPs.

Practice this question →
317
MCQmedium

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

A.The connection was fluctuating between up and down.
B.The connection was down for most of the day.
C.The metric data is incomplete.
D.The connection was up and stable.
AnswerB

0 means down.

Why this answer

The ConnectionState metric indicates the state of the Direct Connect connection, where 0 means down and 1 means up. An average value of 0.0 for most of the day indicates the connection was down. Therefore, option B is correct.

Option A is incorrect because the metric shows a consistent value of 0, not fluctuating. Option C is incorrect because the data is complete and clearly shows the connection was down. Option D is incorrect because a value of 0 means the connection was not up and stable.

Practice this question →
318
MCQhard

A network engineer configured a custom network ACL for a VPC. An EC2 instance in a subnet associated with this ACL cannot receive ping (ICMP) from the internet. The security group allows ICMP. Which rule is causing the issue?

A.The default NACL rules are missing.
B.Outbound rule 220 blocks all outbound traffic.
C.Inbound rule 130 allows ICMP, but it is overridden by rule 120.
D.Inbound rule 100 only allows HTTPS.
AnswerC

Rule 120 (deny all) is evaluated before rule 130 (allow ICMP), so ICMP is denied.

Why this answer

NACL rules are evaluated in ascending order by rule number. Rule 120 (deny all) has a lower number than rule 130 (allow ICMP), so it is evaluated first. Thus, ICMP traffic from the internet is denied by rule 120 before rule 130 can allow it.

Option A is incorrect because the default NACL rules are not missing; the issue is the order. Option B is incorrect because outbound rules are not the problem for inbound ICMP. Option D is incorrect because inbound rule 100 allows HTTPS but does not affect ICMP.

Practice this question →
319
Multi-Selectmedium

A network engineer is troubleshooting an issue where an EC2 instance in a VPC cannot reach an S3 bucket via a gateway endpoint. The instance is in a private subnet with a route table that has a route for the S3 prefix list pointing to the gateway endpoint. Which TWO actions should the engineer take to diagnose the problem?

Select 2 answers
A.Verify that the route table for the subnet includes a route for the S3 prefix list (com.amazonaws.region.s3) with target type gateway endpoint.
B.Ensure the VPC has an interface endpoint for S3.
C.Review VPC Flow Logs for the subnet to see if traffic is being dropped.
D.Confirm that the EC2 instance has a public IP address.
E.Check the security group associated with the EC2 instance to ensure it allows outbound HTTPS (443) traffic.
AnswersA, E

Without this route, traffic goes to NAT/IGW.

Why this answer

The correct diagnostic steps are A (verify the route table has the S3 prefix list route to the gateway endpoint) and E (check the security group allows outbound HTTPS). The route table must include the prefix list route for the gateway endpoint to work, and the security group must permit HTTPS (443) outbound because S3 API calls use HTTPS. Option B is incorrect because gateway endpoints are used for S3, not interface endpoints (which are for other services).

Option C is incorrect; although VPC Flow Logs can help analyze traffic after initial checks, they are not the first diagnostic step. Option D is incorrect because the instance does not need a public IP; gateway endpoints route traffic within the AWS network without leaving the VPC directly.

Practice this question →
320
Multi-Selectmedium

A company is designing a VPN connection between an on-premises network and AWS. The network engineer wants to ensure high availability and fast failover. Which TWO actions should the engineer take? (Select TWO.)

Select 2 answers
A.Use the same customer gateway IP address for both tunnels
B.Use static routes instead of BGP to simplify configuration
C.Create two separate VPN connections to the same VPC
D.Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels
E.Configure two VPN tunnels to two different AWS endpoint IP addresses
AnswersD, E

Enabling BGP with BFD provides dynamic route exchange and fast failure detection (<1 second), enabling quick failover and high availability.

Why this answer

To ensure high availability and fast failover for a VPN connection between on-premises and AWS, the correct actions are D and E. Option D: Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels. BGP provides dynamic route exchange and automatic failover, while BFD offers fast failure detection (<1 second).

Option E: Configure two VPN tunnels to two different AWS endpoint IP addresses. This provides redundancy at the AWS side, so if one endpoint fails, the other tunnel remains active. Option A is incorrect because using the same customer gateway IP for both tunnels creates a single point of failure; if that IP becomes unreachable, both tunnels go down.

Option B is incorrect because static routes cannot dynamically adapt to failures, and BGP is needed for automatic failover. Option C is incorrect because creating two separate VPN connections to the same VPC is unnecessary and more complex; a single VPN connection with two tunnels to different endpoints achieves the same redundancy with simpler management.

Practice this question →
321
Multi-Selecthard

A company has a VPC with multiple subnets. The network engineer wants to monitor network traffic between two specific EC2 instances in different subnets. Which THREE methods can be used to capture and analyze this traffic?

Select 3 answers
A.Enable VPC Flow Logs for the subnets containing the instances.
B.Configure Traffic Mirroring on one of the instances' ENI.
C.Use AWS CloudTrail to log network traffic.
D.Create a VPC peering connection between the two subnets' VPCs.
E.Set up AWS Network Firewall and route traffic through it.
AnswersA, B, E

Flow logs will show metadata of all traffic, including between the instances.

Why this answer

VPC Flow Logs capture metadata, Traffic Mirroring captures full packets, and AWS Network Firewall can inspect traffic. VPC Peering is for connectivity, not monitoring.

Practice this question →
322
Multi-Selecteasy

A network engineer is setting up a VPC peering connection between two VPCs in the same AWS account and Region. Which TWO steps are required to enable communication between instances in the peered VPCs? (Choose two.)

Select 2 answers
A.Attach an internet gateway to each VPC
B.Establish a VPN connection between the VPCs
C.Add routes in each VPC's route table pointing to the CIDR of the other VPC
D.Configure a NAT gateway in each VPC
E.Update security group rules to allow traffic from the peered VPC CIDR
AnswersC, E

Routes are needed for traffic to traverse the peering connection.

Why this answer

VPC peering requires adding routes in both VPC route tables to direct traffic to the peered VPC's CIDR. Option E is correct because security group rules must be updated to allow inbound traffic from the peered VPC's CIDR. Option A is incorrect because VPC peering does not require an internet gateway.

Option B is incorrect because VPC peering does not use a VPN connection. Option D is incorrect because a NAT gateway is not required for VPC peering.

Practice this question →
323
Multi-Selectmedium

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. The network team wants to log and monitor all traffic flows across the Transit Gateway for security analysis. Which TWO actions should the team take? (Choose TWO.)

Select 2 answers
A.Use AWS Config rules to evaluate the Transit Gateway route tables.
B.Send the flow logs to Amazon CloudWatch Logs for monitoring and alerting.
C.Enable VPC Flow Logs on each Transit Gateway attachment.
D.Enable VPC Flow Logs on the Transit Gateway itself.
E.Configure VPC Traffic Mirroring on the Transit Gateway.
AnswersB, C

CloudWatch Logs can aggregate and analyze flow logs for security monitoring.

Why this answer

VPC Flow Logs can be published to Amazon CloudWatch Logs, enabling real-time monitoring, alerting, and integration with AWS Lambda or third-party tools for security analysis. This allows the network team to capture IP traffic information for all flows across Transit Gateway attachments when flow logs are enabled on those attachments. Option C is correct because VPC Flow Logs must be enabled at the Transit Gateway attachment level (not on the Transit Gateway itself) to capture traffic traversing the Transit Gateway, as the Transit Gateway is a network transit hub and does not generate its own flow logs.

Exam trap

The trap here is that candidates mistakenly think VPC Flow Logs can be enabled directly on the Transit Gateway itself (Option D), but AWS only supports flow logs on Transit Gateway attachments, not the Transit Gateway as a resource.

Practice this question →
324
MCQeasy

A network engineer needs to analyze network traffic between EC2 instances in the same VPC to troubleshoot a performance issue. Which AWS feature should they use?

A.AWS Config.
B.AWS CloudTrail.
C.AWS X-Ray.
D.VPC Flow Logs.
AnswerD

Flow logs capture IP traffic metadata.

Why this answer

VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC, making them the correct tool for analyzing network traffic between EC2 instances to troubleshoot performance issues. Unlike other options, Flow Logs operate at the network layer (Layer 3/4) and can be published to CloudWatch Logs or S3 for detailed traffic analysis.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (network-level traffic metadata) with CloudTrail (API-level logging) or X-Ray (application tracing), failing to recognize that only Flow Logs provide the raw IP flow data needed for network performance analysis.

How to eliminate wrong answers

Option A is wrong because AWS Config is a resource inventory and compliance auditing service that tracks configuration changes, not network traffic flows. Option B is wrong because AWS CloudTrail records API calls and management events (control plane), not data plane network traffic between instances. Option C is wrong because AWS X-Ray is a distributed tracing service for application-level request analysis (Layer 7), not for raw network packet metadata analysis.

Practice this question →
325
MCQmedium

A company has a VPC with a NAT Gateway in a public subnet. The network team notices that instances in private subnets cannot access the internet. Reviewing the route tables, the private subnet route table has a default route (0.0.0.0/0) pointing to the NAT Gateway. What is the most likely cause of the issue?

A.The network ACL in the private subnet blocks outbound traffic.
B.The NAT Gateway's subnet route table does not have a default route pointing to an Internet Gateway.
C.The NAT Gateway does not have an Elastic IP address attached.
D.The security group attached to the NAT Gateway blocks outbound traffic.
AnswerB

Without a route to IGW, NAT Gateway cannot forward traffic to the internet.

Why this answer

The NAT Gateway must have a route to an Internet Gateway. If the NAT Gateway's subnet route table does not have a default route pointing to an IGW, it cannot route traffic to the internet. Security groups, NACLs, or EIP are less likely to be the issue.

Practice this question →
326
Multi-Selectmedium

A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure high availability by using two tunnels. Which two components must be configured to achieve this? (Choose TWO.)

Select 1 answer
A.A single customer gateway with two IP addresses
B.An AWS Transit Gateway
C.Two customer gateways, each with a unique public IP address
D.Two VPN connections
E.A virtual private gateway with two BGP sessions
AnswersE

Two BGP sessions for two tunnels.

Why this answer

For high availability with two tunnels in an AWS Site-to-Site VPN, a single VPN connection provides two tunnels by default, terminating on two different AWS endpoints. This requires only one customer gateway with a single public IP address. The virtual private gateway must be configured with two BGP sessions (one per tunnel) to support dynamic routing and automatic failover.

Option C is incorrect because two customer gateways are unnecessary; one customer gateway with one IP suffices. Option D is incorrect because two VPN connections are not required—a single VPN connection already provides two tunnels. Option A is incorrect because a customer gateway cannot have two IP addresses.

Option B is incorrect because an AWS Transit Gateway is optional and not required for a basic HA VPN setup.

Practice this question →
← PreviousPage 5 of 5 · 326 questions total

Ready to test yourself?

Try a timed practice session using only Network Management and Operations questions.

Start 20-question session