Courseiva

ANS-C01 · topic practice

Troubleshooting practice questions

Practise AWS Certified Advanced Networking Specialty ANS-C01 Troubleshooting practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security
20 questionsDomain: Troubleshooting
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Troubleshooting

Troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Troubleshooting exam traps

  • ▸Answering from memory before reading the full scenario.
  • ▸Missing a constraint such as cost, availability, security, scope or command context.
  • ▸Choosing a broad answer when the question asks for the most specific fix.
  • ▸Ignoring why the wrong options are tempting.

Practice set

Troubleshooting questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice
Review the full routing breakdown →

A network engineer is troubleshooting connectivity issues between an EC2 instance in a VPC and an on-premises server over a Direct Connect connection. The engineer has verified that the VPC route tables, Direct Connect virtual interface, and on-premises routing are correctly configured. Which tool should be used to verify the path MTU and identify fragmentation issues?

Question 2easymultiple choice
Read the full Troubleshooting explanation →

A network engineer needs to capture and analyze traffic crossing a VPC peering connection for troubleshooting. Which AWS service should be used?

Question 3mediummultiple choice
Read the full Troubleshooting explanation →

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but in different Availability Zones. The instances are in the same security group and have proper rules. Which configuration is most likely causing the latency?

Question 4hardmultiple choice
Read the full VPN explanation →

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

Network Topology
$ aws ec2 describe-vpn-connectionsvpn-connection-ids vpn-12345678Refer to the exhibit.```"VpnConnections": ["VpnConnectionId": "vpn-12345678","State": "available","CustomerGatewayConfiguration": "...","Type": "ipsec.1","CustomerGatewayId": "cgw-12345678","VpnGatewayId": "vgw-12345678","Options": {"TunnelOptions": ["OutsideIpAddress": "203.0.113.1","TunnelInsideCidr": "169.254.10.0/30"},"OutsideIpAddress": "203.0.113.2","TunnelInsideCidr": "169.254.10.4/30""Routes": ["DestinationCidrBlock": "172.16.0.0/16","Source": "static","State": "available"
Question 5mediummultiple choice
Review the full subnetting walkthrough →

A company has a VPC with multiple subnets. They want to capture and analyze network traffic between EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Question 6mediummulti select
Review the full subnetting walkthrough →

A network engineer is troubleshooting an issue where an EC2 instance in a VPC cannot reach an S3 bucket via a gateway endpoint. The instance is in a private subnet with a route table that has a route for the S3 prefix list pointing to the gateway endpoint. Which TWO actions should the engineer take to diagnose the problem?

Question 7easymultiple choice
Read the full VPN explanation →

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

Question 8easymultiple choice
Read the full Troubleshooting explanation →

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

Question 9mediummulti select
Read the full Troubleshooting explanation →

A company is troubleshooting a slow network connection between two EC2 instances in the same VPC but different Availability Zones. Which TWO tools can be used to measure throughput and diagnose performance issues?

Question 10easymultiple choice
Read the full VPN explanation →

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?

Question 11mediummultiple choice
Read the full Troubleshooting explanation →

A company wants to monitor network traffic in their VPC for troubleshooting and security analysis. They need to capture IP traffic information, including source/destination IPs, ports, and protocol, but not the packet payload. Which AWS service should be used?

Question 12mediummultiple choice
Review the full routing breakdown →

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

Question 13mediummultiple choice
Review the full subnetting walkthrough →

A company has a VPC with multiple subnets. They want to monitor all network traffic to and from an EC2 instance for troubleshooting. Which AWS service should they use?

Question 14mediummultiple choice
Review the full subnetting walkthrough →

A security engineer is troubleshooting connectivity between an EC2 instance in a private subnet and an S3 bucket. The instance has a VPC gateway endpoint for S3, and the route table has a route to the endpoint. The security group for the instance allows all outbound traffic. However, the instance cannot access the S3 bucket. What is the most likely cause?

Question 15easymultiple choice
Open the full BGP breakdown →

A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a VPC and an on-premises data center over a Direct Connect virtual interface. The engineer notices that the BGP session is flapping. Which configuration should the engineer verify first?

Question 16mediummultiple choice
Read the full Troubleshooting explanation →

A network engineer is troubleshooting a Direct Connect private VIF. The VIF is in 'available' state but traffic is not flowing to the VPC. The VGW is attached to the VPC. What is the most likely cause?

Network Topology
$ aws directconnect describe-virtual-interfacesvirtual-interface-id dxvif-12345678Refer to the exhibit.```"virtualInterfaces": ["ownerAccount": "123456789012","virtualInterfaceId": "dxvif-12345678","location": "EqDC1","connectionId": "dxcon-12345678","virtualInterfaceType": "private","virtualInterfaceName": "MyPrivateVIF","vlan": 100,"asn": 64512,"authKey": "abc123","amazonAddress": "169.254.10.1/30","customerAddress": "169.254.10.2/30","addressFamily": "ipv4","virtualInterfaceState": "available","customerRouterConfig": "...","virtualGatewayId": "vgw-12345678","directConnectGatewayId": null,"routeFilterPrefixes": [{"cidr": "10.0.0.0/16"}
Question 17hardmultiple choice
Read the full Troubleshooting explanation →

Refer to the exhibit. An AWS administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile is associated with an IAM role that has the above trust policy. The S3 bucket policy allows s3:GetObject only for the role's ARN. What is the most likely cause of the access failure?

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
Question 18hardmultiple choice
Read the full Troubleshooting explanation →

A company is troubleshooting high latency on an AWS Direct Connect connection. The network team notices that the latency increases during peak hours. The connection uses a single virtual interface (VIF) with a 1 Gbps capacity. What is the MOST likely cause of the latency?

Question 19hardmulti select
Review the full subnetting walkthrough →

A company is troubleshooting connectivity issues between two VPCs that are peered using an inter-region VPC peering connection. The VPCs have the following CIDR blocks: VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). Which THREE of the following are possible reasons for the connectivity failure?

Question 20hardmultiple choice
Review the full subnetting walkthrough →

A network engineer is troubleshooting connectivity issues between an on-premises network and a VPC over a Direct Connect private VIF. The on-premises network can reach EC2 instances in the VPC, but cannot reach an RDS database in the same VPC. The VPC has a single subnet. What is the MOST likely cause?

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Troubleshooting sessions

Start a Troubleshooting only practice session

Every question in these sessions is drawn from the Troubleshooting domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Troubleshooting questions →Mixed ANS-C01 session

Related practice questions

Related ANS-C01 topic practice pages

Move into related areas when this topic feels solid.

Network Management and Operations practice questions

Practise ANS-C01 questions linked to Network Management and Operations.

Network Security, Compliance and Governance practice questions

Targeted ANS-C01 practice covering Network Security, Compliance and Governance.

Network Design practice questions

Work through ANS-C01 questions on Network Design.

Network Implementation practice questions

Sharpen your ANS-C01 knowledge of Network Implementation.

ANS-C01 fundamentals practice questions

Targeted ANS-C01 practice covering ANS-C01 fundamentals.

ANS-C01 scenario practice questions

Sharpen your ANS-C01 knowledge of ANS-C01 scenario.

ANS-C01 troubleshooting practice questions

Sharpen your ANS-C01 knowledge of ANS-C01 troubleshooting.

Frequently asked questions

What does the ANS-C01 exam test about Troubleshooting?
Troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Troubleshooting questions in a focused session?
Yes — the session launcher on this page draws every question from the Troubleshooting domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other ANS-C01 topics?
Use the topic links above to move to related areas, or go back to the ANS-C01 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the ANS-C01 exam covers. They are not copied from any real exam or dump site.