A network engineer is troubleshooting a performance issue between an on-premises data center and an EC2 instance in AWS. The connection uses a VPN over the internet. Users report slow file transfers. The engineer captures packets on the on-premises side and sees many TCP retransmissions. The engineer also checks VPC Flow Logs and sees that the traffic is accepted. Which analysis is most likely to identify the root cause?

Enable Traffic Mirroring on the EC2 instance to capture the traffic and compare it with the on-premises capture.

Use the 'ping' command with a large packet size to test for packet loss.

Check the MTU settings on the VPN connection and the EC2 instance to see if packets are being fragmented.

Check the CloudWatch metrics for the VPN connection to see if the tunnel is experiencing high packet loss.

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. Users report intermittent timeouts. You enable VPC Flow Logs and publish them to CloudWatch Logs. After a few hours, you query the logs and notice that for the affected instances, the flow log records show 'ACCEPT' for both the 'action' field and the 'tcp-flags' field, but the 'packets' field shows a higher count for the response direction than the request direction. Which next step is most appropriate to diagnose the issue?

Review the flow log records for the security group and network ACL rules to see if any 'REJECT' records appear for the same connection.

Enable Traffic Mirroring on the affected instances and capture packets to analyze the TCP handshake and retransmissions.

Check the ALB access logs to see if the target instances are returning 5xx errors.

Create a CloudWatch alarm on the ALB's 'TargetResponseTime' metric to alert when it exceeds a threshold.

A company has a hybrid network with an AWS Direct Connect connection to its on-premises data center. The network team wants to be alerted when the link utilization exceeds 80% for more than 10 minutes. They have enabled VPC Flow Logs and published them to CloudWatch Logs. Which solution will meet the requirement with the least operational overhead?

Enable Traffic Mirroring on the Direct Connect gateway and send mirrored traffic to a network appliance that calculates utilization.

Create a CloudWatch alarm on the 'AWS/DX' namespace metric 'VirtualInterfaceBps' with a threshold of 80% of the provisioned bandwidth.

Create a CloudWatch Logs metric filter on the flow logs to count bytes for the Direct Connect virtual interface, then create a CloudWatch alarm on that metric.

Use the AWS Direct Connect console to enable CloudWatch metrics for the virtual interface, then create a CloudWatch alarm on the 'ConnectionBpsEgress' metric.

AWSCertified Advanced Networking - Specialty

Domain 3Objective 2

Task 3.2: Monitor and Analyze Network Traffic to Troubleshoot and Optimize Connectivity Patterns ANS-C01 Practice Questions (Page 3)

Part of the Content Domain 3: Network Management and Operation domain, which accounts for 20% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~14–23 in this domain), expect 5–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

20%of the exam

Questions 11–15

11expert · hard
A network engineer is troubleshooting a performance issue between an on-premises data center and an EC2 instance in AWS. The connection uses a VPN over the internet. Users report slow file transfers. The engineer captures packets on the on-premises side and sees many TCP retransmissions. The engineer also checks VPC Flow Logs and sees that the traffic is accepted. Which analysis is most likely to identify the root cause?
Select an answer first
12application · medium
A company runs a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. Users report intermittent timeouts. You enable VPC Flow Logs and publish them to CloudWatch Logs. After a few hours, you query the logs and notice that for the affected instances, the flow log records show 'ACCEPT' for both the 'action' field and the 'tcp-flags' field, but the 'packets' field shows a higher count for the response direction than the request direction. Which next step is most appropriate to diagnose the issue?
Select an answer first
13application · medium
A company has a hybrid network with an AWS Direct Connect connection to its on-premises data center. The network team wants to be alerted when the link utilization exceeds 80% for more than 10 minutes. They have enabled VPC Flow Logs and published them to CloudWatch Logs. Which solution will meet the requirement with the least operational overhead?
Select an answer first
14foundation · easy
Which AWS service can be used to capture packets from an EC2 instance and forward them to a monitoring appliance for analysis?
Select an answer first
15foundation · easy
A network engineer needs to inspect the actual contents of packets (including payloads) to diagnose a protocol-level issue. Which tool or service is best suited for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 3.2: Monitor and Analyze Network Traffic to Troubleshoot and Optimize Connectivity Patterns ANS-C01 Practice Questions (Page 3)

Questions 11–15

Which AWS service can be used to capture packets from an EC2 instance and forward them to a monitoring appliance for analysis?

A network engineer needs to inspect the actual contents of packets (including payloads) to diagnose a protocol-level issue. Which tool or service is best suited for this task?

Keep studying — Content Domain 3: Network Management and Operation