ANS-C01 practice questions 101–110

1. Question 101 · 294 in bank

   A network engineer must develop an AWS CloudFormation template that can create a virtual private gateway, a customer gateway, a VPN connection, and static routes in a route table. During testing of the template, the network engineer notes that the CloudFormation template has encountered an error and is rolling back. What should the network engineer do to resolve the error?

   • AChange the order of resource creation in the CloudFormation template.
   • BAdd the DependsOn attribute to the resource declaration for the virtual private gateway. Specify the route table entry resource.
   • CAdd a wait condition in the template to wait for the creation of the virtual private gateway.
   • DAdd the DependsOn attribute to the resource declaration for the route table entry. Specify the virtual private gateway resource.

   Show answer

   Answer: D

   Explanation

   D Reading all options, It seems that there is a problem of the run order for creating resources. According to the below AWS document, you must configure your route table to include the routes used by your Site-to-Site VPN connection and point them to your virtual private gateway. https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html That means you must create the virtual private gateway before creating the route table. AWS CloudFormation does not support configuring detailed run order of creating resources. However, when you add a DependsOn attribute to a resource, that resource is created only after the creation of the resource specified in the DependsOn attribute. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html

   Source: Adapted from community discussion — Untamables

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 102 · 294 in bank

   A company is building an API-based application on AWS and is using a microservices architecture for the design. The company is using a multi-account AWS environment that includes a separate AWS account for each microservice development team. Each team hosts its microservice in its own VPC that contains Amazon EC2 instances behind a Network Load Balancer (NLB). A network engineer needs to use Amazon API Gateway in a shared services account to create an HTTP API to expose these microservices to external applications. The network engineer must ensure that access to the microservices can occur only over a private network. Additionally, the company must be able to control which entities from its internal network can connect to the microservices. In the future, the company will create more microservices that the company must be able to integrate with the application. What is the MOST secure solution that meets these requirements?

   • ACreate an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALB. Create a VPC endpoint service in each microservice account. Create an AWS PrivateLink endpoint for those services in the shared services account. Add the elastic network interface IP addresses of the VPC endpoint as targets for the target group of the ALB.
   • BCreate an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALConnect all the VPCs to each other by using a central transit gateway. Add the IP addresses of the NLB as IP-based targets in the ALB target group.
   • CConfigure the integration to the API Gateway API by using HTTP-based integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate HTTP integration to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the HTTP integration.
   • DConfigure the integration to the API Gateway API by using VPC link integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate VPC link to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the VPC link integration.

   Show answer

   Answer: A

   Explanation

   D: incorrect because the API Gateway won't be able to reach the NLBs located in microservices accounts through the VPC Link created in the shared VPC account "To create a private integration, all resources must be owned by the same AWS account (including the load balancer or AWS Cloud Map service, VPC link and HTTP API)." in https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-private.html

   Source: Adapted from community discussion — c1193d4

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 103 · 294 in bank

   Select 2

   A company's VPC has Amazon EC2 instances that are communicating with AWS services over the public internet. The company needs to change the connectivity so that the communication does not occur over the public internet. The company deploys AWS PrivateLink endpoints in the VPC. After the deployment of the PrivateLink endpoints, the EC2 instances can no longer communicate at all with the required AWS services. Which combination of steps should a network engineer take to restore communication with the AWS services? (Choose two.)

   • AIn the VPC route table, add a route that has the PrivateLink endpoints as the destination.
   • BEnsure that the enableDnsSupport attribute is set to True for the VPC. Ensure that each VPC endpoint has DNS support enabled.
   • CEnsure that the VPC endpoint policy allows communication.
   • DCreate an Amazon Route 53 public hosted zone for all services.
   • ECreate an Amazon Route 53 private hosted zone that includes a custom name for each service.

   Show answer

   Answer: BC

   Explanation

   The most effective steps are B and C. Ensuring that DNS support is enabled for both the VPC and the PrivateLink endpoints, along with verifying that the VPC endpoint policy permits the required access, will restore the necessary communication between the EC2 instances and the AWS services over the private network. These steps ensure that the services are correctly resolved and accessible while maintaining security and privacy through the AWS network.

   Source: Adapted from community discussion — Akshay0403

   Next question

4. Question 104 · 294 in bank

   An international company wants to implement a multi-site hybrid infrastructure. The company wants to deploy its cloud computing resources on AWS in the us-east-1 Region and in the eu-west-2 Region, and in on-premises data centers in the United States (US) and in the United Kingdom (UK). The data centers are connected to each other by a private WAN connection. IP routing information is exchanged dynamically through BGP. The company wants to have two AWS Direct Connect connections, one each in the US and the UK. The company expects to have 15 VPCs in each Region with CIDR blocks that do not overlap with each other or with CIDR blocks of the on-premises environment. The VPC CIDR blocks are planned so that the prefix aggregation can be performed both on a Regional level and across the entire AWS environment. The company will deploy a transit gateway in each Region to connect the VPCs. A network engineer plans to use a Direct Connect gateway in each Region. A transit VIF will attach the Direct Connect gateway in each Region to the transit gateway in that Region. The transit gateways will be peered with each other. The network engineer wants to ensure that traffic follows the shortest geographical path from source to destination. Traffic between the on-premises data centers and AWS must travel across a local Direct Connect connection. Traffic between the US data center and eu-west-2 and traffic between the UK data center and us-east-1 must use the private WAN connection to reach the Direct Connect connection to the appropriate Region when the Direct Connect connection is available. The network must be resilient to failures in either the private WAN connection or with the Direct Connect connections. The network also must reroute traffic automatically in the event of any failure. How should the network engineer configure the transit VIF associations on the Direct Connect gateways to meet these requirements?

   • AAdvertise only the aggregate route for the company's entire AWS environment.
   • BAdvertise VPC-specific CIDR prefixes from only the local Region. Additionally, advertise the aggregate route for the company’s entire AWS environment.
   • CAdvertise all the specific VPC CIDR blocks from both Regions.
   • DAdvertise both Regional aggregate prefixes. Configure custom BGP communities on the routes advertised toward the data center.

   Show answer

   Answer: B

   Explanation

   To meet the requirements of ensuring traffic follows the shortest geographical path, using the private WAN connection when Direct Connect is unavailable, and ensuring resilience to failures, the network engineer should configure the transit VIF associations on the Direct Connect gateways as follows: B. Advertise VPC-specific CIDR prefixes from only the local Region. Additionally, advertise the aggregate route for the company’s entire AWS environment. This option allows for the most efficient routing by advertising VPC-specific CIDR prefixes from the local Region, ensuring traffic takes the shortest path within the AWS network. Additionally, advertising the aggregate route for the entire AWS environment ensures that in case of any failures or unavailability of Direct Connect connections, traffic can still reach its destination via other available paths, such as the private WAN connection.

   Source: Adapted from community discussion — strike3test

   Next question

5. Question 105 · 294 in bank

   Select 3

   A company's AWS infrastructure is spread across more than 50 accounts and across five AWS Regions. The company needs to manage its security posture with simplified administration and maintenance for all the AWS accounts. The company wants to use AWS Firewall Manager to manage the firewall rules and requirements. The company creates an organization with all features enabled in AWS Organizations. Which combination of steps should the company take next to meet the requirements? (Choose three.)

   • AConfigure only the Firewall Manager administrator account to join the organization.
   • BConfigure all the accounts to join the organization.
   • CSet an account as the Firewall Manager administrator account.
   • DSet an account as the Firewall Manager child account.
   • ESet up AWS Config for all the accounts and all the Regions where the company has resources.
   • FSet up AWS Config for only the organization's management account.

   Show answer

   Answer: BCE

   Explanation

   Option B ensures that all 50+ AWS accounts are under the same management, making it easier to manage security posture. Option C sets up an administrator account within one of these accounts, which can manage all Firewall Manager configurations across the organization. Option E enables centralized monitoring and compliance for resources across all Regions, allowing the company to maintain consistency in their AWS security posture.

   Source: Adapted from community discussion — AzureDP900

   Next question

6. Question 106 · 294 in bank

   A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all inbound traffic to the ALB to come from CloudFront. The network engineer must implement the solution at the network layer rather than in the application. Which solution will meet these requirements in the MOST operationally efficient way?

   • AAdd an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.
   • BAdd an inbound rule to the network ACLs that are associated with the ALB's subnets. Use the AWS managed prefix list for CloudFront as the source in the rule.
   • CConfigure CloudFront to add a custom HTTP header to the requests that CloudFront sends to the ALB.
   • DAssociate an AWS WAF web ACL with the ALB. Configure the AWS WAF rules to allow traffic from the CloudFront IP set. Automatically update the CloudFront IP set by using an AWS Lambda function.

   Show answer

   Answer: A

   Explanation

   It is asking a solution at network layer rather than application layer. Therefore it is A in my opinion. A managed prefix list is a set of one or more CIDR blocks. You can use prefix lists to make it easier to configure and maintain your security groups and route tables.

   Source: Adapted from community discussion — veyisceylan

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 107 · 294 in bank

   A company has AWS accounts in an organization in AWS Organizations. The company has implemented Amazon VPC IP Address Manager (IPAM) in its networking AWS account. The company is using AWS Resource Access Manager (AWS RAM) to share IPAM pools with other AWS accounts. The company has created a top-level pool with a CIDR block of 10.0.0.0/8. For each AWS account, the company has created an IPAM pool within the top-level pool. A network engineer needs to implement a solution to ensure that users in each AWS account cannot create new VPCs. The solution also must prevent users from associating a CIDR block with existing VPCs unless the CIDR block is from the IPAM pool for that account. Which solution will meet these requirements?

   • ACreate a new AWS Config rule to find all VPCs that are not configured to allocate their CIDR block from an IPAM pool. Invoke an AWS Lambda function to delete these VPCs.
   • BCreate a new SCP in Organizations. Add a condition that denies the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions if the Ipv4IpamPoolId context key value is not the ID of an IPAM pool.
   • CCreate an AWS Lambda function to check for and delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool. Invoke the Lambda function at regular intervals.
   • DCreate an Amazon EventBridge rule to check for AWS CloudTrail events for the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions. Use the rule to invoke an AWS Lambda function to delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool.

   Show answer

   Answer: B

   Explanation

   The most suitable option for enforcing the policy at the point of action (creating or associating CIDR blocks) across all AWS accounts in the organization is option B. Therefore, the correct answer is: B. Create a new SCP in Organizations. Add a condition that denies the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions if the Ipv4IpamPoolId context key value is not the ID of an IPAM pool.

   Source: Adapted from community discussion — strike3test

   Next question

8. Question 108 · 294 in bank

   A company has an application that runs on premises. The application needs to communicate with an application that runs in a VPC on AWS. The communication between the applications must be encrypted and must use private IP addresses. The communication cannot travel across the public internet. The company has established a 1 Gbps AWS Direct Connect connection between the on-premises location and AWS. Which solution will meet the connectivity requirements with the LEAST operational overhead?

   • AConfigure a private VIF on the Direct Connect connection. Associate the private VIF with the VPC's virtual private gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the virtual private gateway.
   • BCreate a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.
   • CConfigure a public VIF on the Direct Connect connection. Associate the public VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.
   • DCreate a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up a third-party firewall in a new VPC that is attached to the transit gateway. Set up a VPN connection to the third-party firewall.

   Show answer

   Answer: B

   Explanation

   Private VIFs are used to establish private connectivity between your on-premises network and your VPCs in AWS without traversing the public internet. They are typically used for scenarios where you need dedicated, private communication between your on-premises infrastructure and your AWS resources. However, to establish a Site-to-Site VPN connection, you need to configure a virtual private gateway (VGW) in your VPC. The VGW acts as the VPN endpoint in the AWS cloud. Site-to-Site VPN connections are established between the VGW and your on-premises VPN device or network. Option B is correct

   Source: Adapted from community discussion — strike3test

   References

   • AWS documentation

   Next question

9. Question 109 · 294 in bank

   A company has established connectivity between its on-premises data center in Paris. France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway. The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center. In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet. Which set of steps should a network engineer take to meet these requirements?

   • A1. Create public subnets in the Tokyo VPC to migrate the workloads into. 2. Configure an internet gateway for the Tokyo office to reach the Tokyo VPC. 3. Configure security groups on the Tokyo workloads to only allow traffic from the Tokyo office and the Paris workloads. 4. Create peering connections between the Tokyo VPC and the Paris VPCs. 5. Configure a VPN connection between the Paris data center and the Tokyo office by using existing routers.
   • B1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC. 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Set up a new Direct Connect connection from the Tokyo office to the Tokyo transit gateway. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
   • C1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC. 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Configure an AWS Site-to-Site VPN connection from the Tokyo office. Set the Tokyo transit gateway as the target. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
   • D1. Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit gateway. 2. Create an association between the Paris transit gateway and the Tokyo VPC. 3. Configure routing on the Paris transit gateway to allow data to flow between sites and the VPC.

   Show answer

   Answer: C

   Explanation

   Option C offers the best solution by efficiently integrating Tokyo and Paris regions through transit gateways and a VPN connection while adhering to the requirement of avoiding direct internet access. This approach is both secure and operationally efficient, ensuring private and encrypted communication between on-premises and AWS resources.

   Source: Adapted from community discussion — Akshay0403

   Next question

10. Question 110 · 294 in bank

    Company A recently acquired Company B. Company A has a hybrid AWS and on-premises environment that uses a hosted AWS Direct Connect connection, a Direct Connect gateway, and a transit gateway. Company A has a transit VIF to access the resources in its production environment in the us-east-1 Region. Company B has applications that run across multiple VPCs in the us-west-2 Region in a single AWS account. A transit gateway connects all Company B's application VPCs. The CIDR blocks for both companies do not overlap. Company A needs to use the existing Direct Connect connection to access Company B’s applications from the on-premises environment. Which solution will meet these requirements?

    • ACreate a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a transit VIF on the existing hosted connection for Company B.
    • BCreate an association proposal from the Company B account to associate the Company B transit gateway with the Company A Direct Connect gateway. Accept the transit gateway association proposal by logging into the Company A account.
    • CCreate multiple virtual private gateways. Attach the virtual private gateways to each of Company B's application VPCs. Create a hosted private VIF for each virtual private gateway.
    • DCreate a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a hosted private VIF for Company B.

    Show answer

    Answer: B

    Explanation

    Option B is the most efficient solution for connecting Company A’s on-premises environment to Company B’s applications. It leverages the existing Direct Connect infrastructure, minimizing the need for additional hardware and configuration, and uses Direct Connect gateway and transit gateway association for seamless integration between the two companies’ environments.

    Source: Adapted from community discussion — Akshay0403

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 101. 294 questions available.