Managing Cloud Networks at Scale GCAD Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network operations team is troubleshooting intermittent connectivity issues between two application tiers in a large cloud environment. They need to identify whether packets are being dropped by security rules or routing misconfigurations. Which set of tools should they use?

   • AVPC flow logs and reachability analyzer.
   • BPing and traceroute from the instances.
   • CLoad balancer access logs and CloudWatch metrics.
   • DCloudTrail and AWS Config.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary goal of a disaster recovery plan for cloud networks?

   • ATo reduce the cost of network resources
   • BTo prevent all network failures from occurring
   • CTo restore network services quickly after a major disruption
   • DTo replace the need for network monitoring
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of network access control lists (ACLs) in a cloud network?

   • ATo filter traffic at the subnet level based on rules
   • BTo encrypt traffic between instances
   • CTo replace the need for security groups
   • DTo provide a list of allowed users for administrative access
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company runs a multi-account AWS environment with hundreds of VPCs and thousands of network interfaces. The security team suspects that an attacker is performing port scans from a compromised EC2 instance inside one of the VPCs. They need to quickly identify the source of the suspicious traffic and understand the scope of the scanning activity. Which combination of AWS services should they use?

   • AEnable AWS CloudTrail in all accounts and search for EC2 instance launch events.
   • BEnable VPC Flow Logs in all VPCs and aggregate them in a central S3 bucket, then use Amazon Athena to query for repeated connection attempts.
   • CDeploy AWS Network Firewall in each VPC and review its stateful rule logs.
   • DUse AWS Trusted Advisor to check for open security groups and review its security report.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team needs to enforce micro-segmentation across thousands of workloads in a hybrid cloud environment that includes both VMs and containers. They want to implement zero-trust network access and have the ability to quarantine compromised workloads automatically. Which approach best meets these requirements?

   • ADeploy a perimeter firewall and rely on it to protect all workloads.
   • BUse distributed firewall rules managed by a centralized policy engine that supports both VMs and containers.
   • CUse traditional network segmentation with VLANs and subnet ACLs.
   • DUse security groups in the cloud and network policies in the container platform, managed separately.
   Reveal Solution Discussion Select an answer first