Network Management and Operations practice questions

The Client VPN endpoint's authentication is failing.

Why wrong: Users can connect, so authentication is successful.

The VPN endpoint is not associated with the correct subnet.

Why wrong: The question states it is associated with a subnet in VPC A, so this is likely not the issue.

The route table in VPC A does not have a route for the Client VPN CIDR.

Why wrong: The question states the route exists.

Incorrect route table entries on the on-premises router for the VPC CIDR

Why wrong: Incorrect routes would cause ping failure as well.

MTU mismatch on the VPN tunnel causing packet fragmentation for TCP

Why wrong: MTU mismatch would affect all traffic, not just TCP.

BGP prefix limits exceeded causing route table incompleteness

Why wrong: BGP is established, so prefix limits are likely not an issue.

Amazon CloudWatch Logs

Why wrong: CloudWatch Logs can store logs but does not capture network packets.

AWS CloudTrail

Why wrong: CloudTrail records API activity, not network traffic.

AWS Transit Gateway Network Manager

Why wrong: Transit Gateway Network Manager provides topology and monitoring but not packet-level capture.

Verify that route propagation is enabled on the VPC route table

Why wrong: Route propagation is for propagating routes to the route table; it does not affect the tunnel status. It is not the first step.

Enable detailed CloudWatch metrics on the VPN connection

Why wrong: Detailed CloudWatch metrics are useful for ongoing monitoring, not for initial tunnel down issue.

Test connectivity by pinging an EC2 instance in the VPC

Why wrong: Pinging an EC2 instance will fail because the VPN tunnel is down; it does not help diagnose the tunnel configuration.

The VPC Flow Logs service is not enabled in the source account.

Why wrong: The VPC Flow Logs service is enabled by default on all VPCs. If it is not enabled, flow logs cannot be created, but the question states that flow logs are not being delivered, not that they cannot be created.

The S3 bucket policy does not grant 's3:PutObject' to the source account.

Why wrong: The bucket policy does grant 's3:PutObject' to the source account? Actually, the policy allows cross-account writes, so this is likely configured correctly.

The VPC Flow Logs destination is set to CloudWatch Logs instead of S3.

Why wrong: If the destination is set to CloudWatch Logs, then logs would be delivered there, not to S3. But the question states the logs should be published to S3, so this configuration is correct.

Use a single VPN connection with static routes.

Why wrong: Static routes do not provide automatic failover.

Configure the VPN connection with a single tunnel and use static routes with a higher metric for backup.

Why wrong: This is complex and not best practice; BGP with multiple tunnels is recommended.

Use only one VPN tunnel with BGP enabled.

Why wrong: Single tunnel does not provide redundancy.

The NAT Gateway's security group does not allow outbound HTTPS traffic.

Why wrong: NAT Gateways do not have security groups; they are not associated with security groups. This option is factually incorrect.

The NACL for the private subnet blocks inbound traffic from S3.

Why wrong: The NACL for the private subnet allows inbound ephemeral ports from 0.0.0.0/0, which covers return traffic from S3. This is not the issue.

The S3 bucket policy denies access from the VPC.

Why wrong: S3 bucket policies are evaluated separately and are not typically the cause if the instance cannot reach S3 at all. The problem is at the network layer.

Verify that the Direct Connect virtual interface is in the 'available' state.

Why wrong: Incorrect. While the virtual interface must be available for connectivity, the stem implies the connection exists but routing is the issue. The VIF state could be 'available' even if BGP is not established.

Verify that the VPC route table has a route to the on-premises CIDR pointing to the virtual private gateway.

Why wrong: Incorrect. The stem states that the VPC route table already has the route to the on-premises CIDR via the VGW. Verifying this route would not resolve the issue as it is already configured.

Verify that the on-premises router is advertising the VPC CIDR.

Why wrong: Incorrect. The on-premises router should be receiving the VPC CIDR route from the VGW via BGP. The issue is likely that the VGW is not advertising the VPC CIDR due to a BGP problem, or the on-premises router is not receiving it. Verification should focus on BGP session status first.

Amazon CloudWatch

Why wrong: CloudWatch metrics do not provide physical layer diagnostics.

VPC Flow Logs

Why wrong: Flow Logs capture IP traffic, not physical layer issues.

AWS Support

Why wrong: AWS Support is not a service to troubleshoot physical layer; it's a support plan.

Configure route propagation in the VPC route tables.

Why wrong: Route propagation does not affect BGP session state.

Check the virtual interface (VIF) status in the AWS console.

Why wrong: VIF status indicates connectivity, but flapping is often due to BGP timer mismatch.

Increase the MTU on the Direct Connect link.

Why wrong: MTU affects throughput, not BGP session stability.

Use a Lambda function in each account to copy flow logs from CloudWatch to a central S3 bucket.

Why wrong: Lambda introduces complexity and potential for data loss.

Deliver flow logs to Kinesis Data Firehose in each account and then to a central S3 bucket.

Why wrong: VPC Flow Logs cannot be delivered to Kinesis Data Firehose directly.

Create flow logs in each account and export them to a central CloudWatch Logs destination.

Why wrong: Exporting from CloudWatch Logs is less efficient and more costly.

A security group must be associated with the Client VPN endpoint.

Why wrong: Security groups are optional; you can use network ACLs instead.

The client CIDR range must be within the VPC CIDR.

Why wrong: It must not overlap with the VPC CIDR.

The Client VPN endpoint must use certificate-based server authentication only.

Why wrong: Client VPN supports mutual authentication; client certificates are also required.

AWS Config

Why wrong: AWS Config monitors resource configurations and compliance, not network traffic.

AWS CloudTrail

Why wrong: AWS CloudTrail records API calls, not network traffic.

Amazon Inspector

Why wrong: Amazon Inspector performs vulnerability assessments based on configurations and does not capture or analyze network traffic.

AWS Shield

Why wrong: AWS Shield provides DDoS protection, but does not capture or analyze general network traffic.

Update security group rules to allow IPv6 traffic.

Why wrong: Security groups support both IPv4 and IPv6; no special update required.

Configure a NAT64 gateway for IPv6 to IPv4 translation.

Why wrong: NAT64 is not needed; egress-only IGW is used for outbound IPv6.

The VPC route tables do not have a route to the on-premises network for the ALB's subnet.

Why wrong: The route tables include routes for 10.1.0.0/16 via VGW.

The security group on the ALB blocks inbound traffic from the on-premises CIDR.

Why wrong: Security groups are configured to allow traffic from on-premises.

The ALB is deployed in private subnets instead of public subnets.

Why wrong: The stem says ALB is in public subnets.

Set up a VPN connection between the logging account and each member account.

Why wrong: A VPN connection is not required because VPC Flow Logs are delivered directly to S3 using AWS APIs, not over a VPN.

Create a VPC peering connection between all accounts to allow log delivery.

Why wrong: VPC peering is not required; flow logs are delivered to S3 using API calls, not over a peering connection.

Use 'PropagateTags' property in the VPC.

Why wrong: 'PropagateTags' is not a CloudFormation resource property; it is an AWS Organizations feature for propagating tags from the root account. Incorrect.

Use a separate AWS::ResourceGroups::Tagging resource.

Why wrong: While AWS::ResourceGroups::Tagging can tag existing resources, it is not the intended method for tagging during CloudFormation stack creation. The correct approach is to use the resource's own 'Tags' property.

Use the 'TagSpecifications' property of the AWS::EC2::Subnet resource.

Why wrong: 'TagSpecifications' is used for EC2 instances and some other EC2 resources, but for 'AWS::EC2::Subnet', the correct property is 'Tags'. This is a common point of confusion.

The route table for the subnet does not have a route to the internet gateway.

Why wrong: The question states the route table has a route to the IGW.

The internet gateway is not properly attached to the VPC.

Why wrong: If the IGW were not attached, no traffic would reach the server.

The security group's outbound rule is blocking the HTTP response.

Why wrong: Security groups are stateful, so outbound rules do not affect established connections.

S3 Transfer Acceleration is enabled on the bucket.

Why wrong: S3 Transfer Acceleration is unrelated to connectivity; it only improves transfer speed over the internet, not through VPC endpoints.

The VPC has an Internet Gateway attached.

Why wrong: An Internet Gateway is not required because the VPC endpoint provides private connectivity to S3 without needing internet access.

Create a gateway VPC endpoint for SQS in the VPC and update the route tables for the private subnets to include a route for the SQS prefix list pointing to the endpoint.

Why wrong: Incorrect. SQS does not support gateway VPC endpoints; gateway endpoints are only for Amazon S3 and DynamoDB.

Set up an AWS Direct Connect connection to route SQS traffic directly.

Why wrong: Incorrect. AWS Direct Connect is used to connect on-premises networks to AWS, not for VPC-to-SQS traffic.

Modify the network ACLs and security groups to allow traffic to SQS without going through the NAT gateway.

Why wrong: Incorrect. Network ACLs and security groups control traffic filtering but do not change the network path; traffic would still go through the NAT gateway.