ANS-C01 practice questions 131–140

1. Question 131 · 294 in bank

   Select 3

   A company is using third-party firewall appliances to monitor and inspect traffic on premises. The company wants to use the same model on AWS. The Company has a single VPC with an internet gateway. The VPC has a fleet of web servers that run on Amazon EC2 instances that are managed by an Auto Scaling group. The company’s network team needs to work with the security team to establish inline inspection of all packets that are sent to and from the web servers. The solution must scale as the fleet of virtual firewall appliances scales Which combination of steps should the network team take to implement this solution? (Choose three.)

   • ACreate a new VPC, and deploy a fleet of firewall appliances. Create a Gateway Load Balancer. Add the firewall appliances as targets.
   • BCreate a security group for use with the firewall appliances, and allow port 443. Allow a port for the Galeway Load Balancer to perform health checks.
   • CCreate a security group for use with the firewall appliances, and allow port 6081. Allow a port for the Gateway Load Balancer to perform health checks.
   • DDeploy a fleet of firewall appliances to the existing VPC. Create a Gateway Load Balancer. Add the firewall appliances as targets.
   • EUpdate the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.
   • FCreate a new route table inside the web server VPC. Create a new edge association with the internet gateway. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.

   Show answer

   Answer: ACE

   Explanation

   ACE is answer! B. Port 443 is for HTTPS traffic, but this does not apply to the Gateway Load Balancer D. Deploying the firewalls in the same VPC as the web servers complicates routing and scaling F. Creating a new edge association with the internet gateway is unnecessary. Updating the existing route tables (as described in Option E) is sufficient to route traffic through the Gateway Load Balancer.

   Source: Adapted from community discussion — woorkim

   References

   • AWS documentation

   Next question

2. Question 132 · 294 in bank

   Select 2

   A financial company offers investment forecasts and recommendations to authorized users through the internet. All the services are hosted in the AWS Cloud. A new compliance requirement states that all the internet service traffic from any host must be logged and retained for 2 years. In its development AWS accounts, the company has designed, tested, and verified a solution that uses Amazon VPC Traffic Mirroring with a Network Load Balancer (NLB) as the traffic mirror target. While the solution runs in one AWS account, the solution mirrors the traffic to another AWS account. A network engineer notices that not all traffic is mirrored when the solution is deployed into the production environment. The network engineer also notices that this behavior is random. Which statements are possible explanations for why not all the traffic is mirrored? (Choose two.)

   • AThe security groups are misconfigured on the production AWS account that hosts the company’s services.
   • BThe Amazon EC2 instance that is being monitored cannot handle the extra traffic that Traffic Mirroring has introduced.
   • CThe IAM policy that allows the creation of traffic mirror sessions is misconfigured
   • DThe mirrored traffic has a lower priority than the production traffic and is being dropped when network congestion occurs.
   • EThe NLB is experiencing warm-up delay because of sudden and significant increases in traffic.

   Show answer

   Answer: DE

   Explanation

   B, D is correct! A. Traffic Mirroring operates at the ENI level and does not depend on security group configurations. This is unlikely to cause random packet drops. C. Since the issue is random and traffic mirroring is partially working, this is not the cause. E. While NLB warm-up delays can occur, they typically affect the ability to handle new connections, not random packet drops.

   Source: Adapted from community discussion — woorkim

   References

   • AWS documentation

   Next question

3. Question 133 · 294 in bank

   A company has a VPC in the AWS Cloud. The company recently acquired a competitor that also has a VPC the AWS Cloud. A network engineer discovers an IP address overlap between the two VPCs. Both VPCs require access to an AWS Marketplace partner service. Which solution will ensure interoperability among the VPC hosted services and the AWS Markelplace partner service?

   • AConfigure VPC peering with static routing between the VPCs. Configure an AWS Site-to-Site VPN connection with static routing to the partner service.
   • BConfigure a NAT gateway in the VPCs. Configure default routes in each VPC to point to the local NAT gateway. Attach each NAT gateway to a transit gateway. Configure an AWS Site-to-Site VPN connection with static routing to the partner service.
   • CConfigure AWS PrivateLink to facilitate connectivity between the VPCs and the partner service. Use the DNS name that is created with the associated interface endpoints to route traffic between the VPCs and the partner service.
   • DConfigure a NAT instance in the VPCs. Configure default routes in each VPC to point to the local NAT instance. Configure an interface endpoint in each VPC to connect to the partner service. Use the DNS name that is created with the associated interface endpoints to route traffic between the VPCs and the partner service.

   Show answer

   Answer: C

   Explanation

   C is right This solution will ensure interoperability among the VPC hosted services and the AWS Marketplace partner service while avoiding any IP address conflicts. By using AWS PrivateLink, both VPCs can connect directly to the partner service without exposing their private IP addresses to the internet. The interface endpoints created for each VPC will have unique, private DNS names that can be used to route traffic between the VPCs and the partner service. This solution does not require any additional network configurations or routing changes, as traffic will be automatically routed through AWS PrivateLink.

   Source: Adapted from community discussion — AzureDP900

   Next question

4. Question 134 · 294 in bank

   A company uses the us-east-1 Region and the ap-south-1 Region for its business units (BUs). The BUS are named BU-1 and BU-Z. For each BU, there are two VPCs in us-east-1 and one VPC in ap-south-1. Because of workload isolation requirements, resources can communicate within the same BU but cannot communicate with resources in the other BU. The company plans to add more BUs and plans to expand into more Regions Which solution will meet these requirements with the MOST operational efficiency?

   • AConfigure an AWS Cloud WAN network that operates in the required Regions. Attach all BU VPCs to the AWS Cloud WAN core network. Update the AWS Cloud WAN segment actions to configure new routes to deny traffic between the different BU segments.
   • BConfigure a transit gateway in each Region. Configure peering between the transit gateways. Attach the BU VPCs to the transit gateway in the corresponding Region. Configure the transit gateway and VPC route tables to isolate traffic between BU VPCs.
   • CConfigure an AWS Cloud WAN network that operates in the required Regions. Attach all BU VPCs to the AWS Cloud WAN core network. Update the core network policy by setting the isolate-attachments parameter for each segment.
   • DConfigure an AWS Cloud WAN network that operates in the required Regions. Create AWS Cloud WAN segments for each BU Configure VPC attachments for each BU’s VPCs to the corresponding BU segment.

   Show answer

   Answer: D

   Explanation

   A. Using segment actions to deny traffic is less efficient and error-prone compared to using segments for isolation. B. Scaling to multiple BUs and Regions would require more peering connections, route table configurations, and ongoing maintenance. C. isolate-attachments parameter only isolates individual VPC attachments within a single segment. It does not provide logical separation between BUs.

   Source: Adapted from community discussion — woorkim

   Next question

5. Question 135 · 294 in bank

   Select 3

   A company uses a hybrid architecture and has an AWS Direct Connect connection between its on-premises data center and AWS. The company has production applications that run in the on-premises data center. The company also has production applications that run in a VPC. The applications that run in the on-premises data center need to communicate with the applications that run in the VPC. The company is using corp.example.com as the domain name for the on-premises resources and is using an Amazon Route 53 private hosted zone for aws.example.com to host the VPC resources. The company is using an open-source recursive DNS resolver in a VPC subnet and is using a DNS resolver in the on-premises data center. The company's on-premises DNS resolver has a forwarder that directs requests for the aws.example.com domain name to the DNS resolver in the VPC. The DNS resolver in the VPC has a forwarder that directs requests for the corp.example.com domain name to the DNS resolver in the on-premises data center. The company has deckled to replace the open-source recursive DNS resolver with Amazon Route 53 Resolver endpoints. Which combination of steps should a network engineer take to make this replacement? (Choose three.)

   • ACreate a Route 53 Resolver rule to forward aws.example.com domain queries to the IP addresses of the outbound endpoint.
   • BConfigure the on-premises DNS resolver to forward aws.example.com domain queries to the IP addresses of the inbound endpoint.
   • CCreate a Route 53 Resolver inbound endpoint and a Route 53 Resolver outbound endpoint.
   • DCreate a Route 53 Resolver rule to forward aws.example.com domain queries to the IP addresses of the inbound endpoint.
   • ECreate a Route 53 Resolver rule to forward corp.example.com domain queries to the IP address of the on-premises DNS resolver.
   • FConfigure the on-premises DNS resolver to forward aws.example.com queries to the IP addresses of the outbound endpoint.

   Show answer

   Answer: BCE

   Explanation

   CEB in THAT order. C: create bidirectional resolver endpoints E: DNS queries from VPC are forwarded to On-prem B: DNS queries from On-prem are forwarded to VPC

   Source: Adapted from community discussion — Snape

   References

   • AWS documentation

   Next question

6. Question 136 · 294 in bank

   Select 3

   A company has many application VPCs that use AWS Site-to-Site VPN connections for connectivity to an on-premises location. The company’s network team wants to gradually migrate to AWS Transit Gateway to provide VPC-to-VPC connectivity. The network team sets up a transit gateway that uses equal-cost multi-path (ECMP) routing. The network team attaches two temporary VPCs to the transit gateway for testing. The test VPCs contain Amazon EC2 instances to confirm connectivity over the transit gateway between the on-premises location and the VPCs. The network team creates two new Site-to-Site VPN connections to the transit gateway. During testing, the network team cannot reach the required bandwidth of 2.5 Gbps over the pair of new Site-o-Site VPN connections. Which combination of steps should the network team take to improve bandwidth performance and minimize network congestion? (Choose three.)

   • AEnable acceleration for the existing Site-to-Site VPN connections to the transit gateway.
   • BCreate new accelerated Site-to-Site VPN connections to the transit gateway.
   • CAdvertise the on-premises prefix to AWS with the same BGP AS_PATH attribute across all the Site-to-Site VPN connections.
   • DAdvertise the on-premises prefix to AWS with a different BGP AS_PATH attribute across all the Site-to-Site VPN connections.
   • EVerify that the transit gateway attachments are present in the Availability Zones of the test VPC.
   • FVerify that the on-premises location is sending traffic by using multiple lows.

   Show answer

   Answer: BCF

   References

   • repost.aws documentation

   Next question

7. Question 137 · 294 in bank

   A company is migrating its on-premises network from its data center in Virginia to its data center in New York. The AWS Direct Connect connections for the Virginia and New York data center locations are both associated to the us-east-1 Region. The company needs to migrate a private VIF on an existing Direct Connect hosted connection from Virginia to New York. The company's on-premises network uses the connection to access VPCs through a Direct Connect gateway in us-east-1. The company has already requested a new Direct Connect hosted connection from the new data center to the New York Direct Connect location. Which solution will meet these requirements with the LEAST downtime?

   • ACreate a new private VIF on the new Direct Connect hosted connection. Create a new Direct Connect gateway and attach the gateway to the new private VIF. Configure BGP routing on the new private VIF as a backup route. Perform the switchover during a maintenance window by shutting down BGP on the existing private VIF. Decommission the existing Direct Connect connection.
   • BCreate a new private VIF on the new Direct Connect hosted connection. Attach the new private VIF to the existing Direct Connect gateway. Configure BGP routing on the new private VIF as a backup route. Perform the switchover during a maintenance window by shutting down BGP on the existing private VIF. Decommission the existing Direct Connect connection.
   • CDuring a maintenance window, migrate the existing private VIF to the new Direct Connect hosted connection. Attach the existing private VIF to the existing Direct Connect gateway. Decommission the existing Direct Connect connection.
   • DDuring a maintenance window, delete the existing private VIF and create a new private VIF to the new Direct Connect hosted connection. Attach the new private VIF to the existing Direct Connect gateway. Decommission the existing Direct Connect hosted connection.

   Show answer

   Answer: B

   Explanation

   Since we are setting a new connection as a backup route before we disable the old connection, it provide a lowest downtime.

   Source: Adapted from community discussion — ArunRav

   Next question

8. Question 138 · 294 in bank

   Select 2

   A retail company is migrating its on-premises application to the AWS Cloud. Currently, the company has two on-premises data center locations. One data center is on the east coast of the United States, and one data center is on the west coast. Each data center hosts four database systems. The largest database system stores 500 GB of data. The data centers are interconnected by two 10 GbE circuits for data synchronization. Each data center has two separate 1 GbE upstream internet connections. The company plans to have eight total VPCs to service its multiple business units. Four VPCs will be in the us-east-1 Region, and four will be in the us-west-2 Region. A network engineer needs to design a connectivity solution that allows VPC-to-VPC connectivity. The solution must also allow secure connections between the on-premises data centers and AWS during the migration process. The company expects spikes in traffic among the VPCs during database synchronization. The company wants to run the migration plan during one weekend and as soon as technically possible. The company also wants to minimize long-term operational and human resources costs. Which combination of steps will meet these requirements? (Choose two.)

   • ADeploy one transit gateway and attach all VPCs to it. Update the transit gateway and VPC route tables to allow any VPC to connect to any other VPC.
   • BConfigure VPC peering between all the VPCs. Update the VPC route tables to allow connectivity.
   • CProvision two AWS Direct Connect connections from two Direct Connect locations that serve us-east-1 and us-west-2 to provide connectivity between the data centers and AWS.
   • DProvision one transit gateway VPN attachment for each data center to build connectivity between the on-premises data centers and AWS VPCs.
   • EProvision one AWS Site-to-Site VPN connection for each data center and for each VPC to build connectivity between the on-premises data centers and AWS VPCs.

   Show answer

   Answer: CD

   Explanation

   This looks like only possible explanation. A is definitely wrong option. TGW won't allow the cross region vpc attachment. And DX is slow , not cost effective. VPN is faster to deploy and plus it is cost effective. Correct option is BE.

   Source: Adapted from community discussion — 49ca6f2

   Next question

9. Question 139 · 294 in bank

   A company is developing an API-based application on AWS for its process workflow requirements. The API will be invoked by clients in the company’s on-premises data centers. The company has set up an AWS Direct Connect connection between on premises and AWS. A network engineer decides to implement the API as a private REST API in Amazon API Gateway. The network engineer wants to ensure that clients can reach the API endpoint through private communication. Which solution can the network engineer use to invoke the API without any additional infrastructure setup?

   • ACreate an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the private DNS name of the endpoint.
   • BCreate an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using an Amazon Route 53 alias of the endpoint.
   • CCreate an interface VPC endpoint for API Gateway. Associate the endpoint with the private REST API, Access the API by using an Amazon Route 53 alias of the endpoint.
   • DCreate an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the public DNS name of the endpoint.

   Show answer

   Answer: D

   Explanation

   D is the correct answer here as we don't want to setup additional infra(inbound endpoints) here as asked in the question. Only through inbound endpoints we will be able to use private DNS. Below is from AWS documentation : its a tricky question. Invoke a private API using AWS Direct Connect You can use AWS Direct Connect to establish a dedicated private connection from an on-premises network to Amazon VPC and access your private API endpoint over that connection by using public DNS names. You can also use private DNS names to access your private API from an on-premises network by setting up an Amazon Route 53 Resolver inbound endpoint and forwarding it all DNS queries of the private DNS from your remote network. For more information, see Forwarding inbound DNS queries to your VPCs in the Amazon Route 53 Developer Guide

   Source: Adapted from community discussion — 304faa7

   References

   • AWS documentation

   Next question

10. Question 140 · 294 in bank

    A banking company has an application that must connect to specific public IP addresses from a VPC. A network engineer has configured routes in the route table that is associated with the application’s subnet to the required public IP addresses through an internet gateway. The network engineer needs to set up email notifications that will alert the network engineer when a user adds a default route to the application subnet's route table with the internet gateway as a target. Which solution will meet these requirements with the LEAST implementation effort?

    • ACreate an AWS Lambda function that reads the routes in the route table and sends an email notification. Configure the Lambda function to send an email notification if any route is configured with 0.0.0.0/0 or ::/0 CIDRs to the internet gateway. Configure the Lambda function to run every minute.
    • BCreate an AWS Lambda function that will be invoked by an Amazon EC2 CreateRoute API call. Configure the Lambda function to send an email notification. Configure the Lambda function to send an email notification if any route is configured with 0.0.0.0/0 or ::/0 CIDRs to the internet gateway.
    • CCreate AWS Config rules for the route table by using the internet-gateway-authorized-vpc-only managed rule. Create an Amazon EventBridge rule to match the AWS Config rule and to route to an Amazon Simple Notification Service (Amazon SNS) topic to send an email notification.
    • DCreate an AWS Config rule for the route table by using the no-unrestricted-route-to-igw managed rule. Create an Amazon EventBridge rule to match the AWS Config rule and to route to an Amazon Simple Notification Service (Amazon SNS) topic to send an email notification.

    Show answer

    Answer: D

    Explanation

    answer is cleary D https://docs.aws.amazon.com/config/latest/developerguide/no-unrestricted-route-to-igw.html ''Checks if there are public routes in the route table to an Internet gateway (IGW). The rule is NON_COMPLIANT if a route to an IGW has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.''

    Source: Adapted from community discussion — meseerie

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 131. 294 questions available.