ANS-C01 practice questions 141–150

1. Question 141 · 294 in bank

   A company is building an internet-facing application that is hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company is using the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes for pod networking connectivity. The company needs to expose its application to the internet by using a Network Load Balancer (NLB). The pods that host the application must have visibility of the source IP address that is contained in the original packet that the NLB receives. How should the network engineer configure the NLB and Amazon EKS settings to achieve these goals?

   • ASpecify the ip target type for the NLB. Set the externalTrafficPolicy attribute to Local in the Kubernetes service specification.
   • BSpecify the instance target type for the NLSet the externalTrafficPolicy attribute to Cluster in the Kubernetes service specification.
   • CSpecify the instance target type for the NLB. Set the externalTrafficPolicy attribute to Local in the Kubernetes service specification.
   • DSpecify the ip target type for the NLB. Set the externalTrafficPolicy attribute to Cluster in the Kubernetes service specification.

   Show answer

   Answer: A

   Explanation

   ip target type make sure that NLB send the traffic to pod ips. externalTrafficPolicy to local will help the pod ips to be shown. Combining both of these options will help to meet the requirements.

   Source: Adapted from community discussion — ArunRav

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 142 · 294 in bank

   A company is running its application servers on Amazon EC2 instances. The EC2 instances run in separate VPCs that are connected by a transit gateway. The EC2 instances launch in a private subnet with a route to the transit gateway for internal and external connectivity. The external connectivity is provided by a VPC with firewall devices that perform an inspection for packets that ingress and egress through an internet gateway. A network engineer needs to help the company’s application team increase the payload size per packet delivery between the EC2 instances. All network connectivity must be through the transit gateway What should the network engineer do to meet these requirements?

   • AEnable jumbo frames on the transit gateway. Instruct the application team to set the maximum transmission unit (MTU) of the system’s network interfaces to 9001 bytes.
   • BInstruct the application team to set the maximum transmission unit (MTU) of the VPC to 8500 bytes.
   • CInstruct the application team to set up enhanced networking on the system by using the enhanced networking adapter. Set the maximum transmission unit (MTU) to 9001 bytes.
   • DInstruct the application team to set the maximum transmission unit (MTU) of the system’s network interfaces to 8500 bytes.

   Show answer

   Answer: D

   Explanation

   D Question: "All network connectivity must be through the transit gateway" Docs: Packets with a size larger than 8500 bytes that arrive at the transit gateway are dropped. https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-quotas.html

   Source: Adapted from community discussion — Momiac5

   References

   • AWS documentation

   Next question

3. Question 143 · 294 in bank

   A network engineer needs to monitor internet metrics for an application that is in a VPC. The metrics include user experiences such as health events, latency, and traffic insights. The network engineer sets up Amazon CloudWatch Internet Monitor for the application. The engineer wants to push the internet health events to a third-party target. Which solution will meet these requirements with the LEAST implementation effort?

   • ACreate a third-party API endpoint in Amazon EventBridge. Configure internet Monitor to send the events to the third-party API endpoint in EventBridge.
   • BCreate a third-party API endpoint in Amazon EventBridge. Create a rule in EventBridge that uses Internet Monitor as the source and the third-party API endpoint in EventBridge as the destination.
   • CCreate a third-party API endpoint in internet Monitor. Configure Internet Monitor to send the events to an Amazon S3 bucket. Configure an AWS Lambda function to send the events to the third-party API endpoint in Internet Monitor.
   • DCreate a third-party API endpoint in Internet Monitor. Configure Internet Monitor to send the events to the third-party API endpoint in Internet Monitor.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

4. Question 144 · 294 in bank

   Select 3

   A company has a web application that runs in eight AWS Regions. In each Region, the application is hosted on multiple compute resources behind an Application Load Balancer (ALB). The different Regions are using different domains. Each ALB is configured to accept only HTTPS traffic. Each ALB uses a certificate from AWS Certificate Manager (ACM). The company wants to simplify the application’s appearance on the web by using a new single domain for all Regions. A network engineer needs to implement this change by designing a solution that also will minimize latency for the application's end users. Which combination of actions will meet these requirements? (Choose three.)

   • AUse ACM to create an SSL/TLS certificate in the us-east-1 Region for the new domain.
   • BSet up latency-based routing in Amazon Route 53 for the new domain. Add the ALBs from all the Regions as targets.
   • CCreate an alias record for the accelerator in Amazon Route 53 for the new domain.
   • DCreate a standard accelerator in AWS Global Accelerator. Configure a listener for TCP traffic. Add all the ALBs as targets for the listener.
   • EUse ACM to create an SSLITLS certificate for each Region. Configure all the ALBs to use the certificate in their respective Regions.
   • FCreate a custom routing accelerator in AWS Global Accelerator. Configure a listener for HTTPS traffic. Add all the ALBs as targets for the listener. Configure the accelerator to terminate TLS by using the SSLITLS certificate from ACM.

   Show answer

   Answer: CDE

   Explanation

   (C) Create an alias record for the accelerator in Route 53 for the new domain • This step stays the same. You want your users to resolve a single domain that leads to Global Accelerator. • (D) Create a standard accelerator in AWS Global Accelerator, configure a listener for TCP (or TLS pass-through), and add all the ALBs as endpoints • Also unchanged. A standard accelerator is how you route traffic at the edge into the correct Region. • (E) Use ACM to create an SSL/TLS certificate for each Region. Configure all the ALBs to use the certificate in their respective Regions • This step is correct if the Region supports ACM for requesting or importing a cert. • If not, you do manual certificate handling (import or direct upload).

   Source: Adapted from community discussion — djangoGroup

   Next question

5. Question 145 · 294 in bank

   A company has a VPC that includes application workloads that run on Amazon EC2 instances in a single AWS Region. The company wants to use AWS Local Zones to deploy an extension of the application workloads that run in the Region. The extended workloads in the Local Zone need to communicate bidirectionally with the workloads in the VPC in the Region. Which solution will meet these requirements MOST cost-effectively?

   • ACreate a new VPC in the Local Zone. Attach all the VPCs to a transit gateway. Configure routing for the transit gateway and the VPCs. Deploy instances in the new VPC.
   • BDeploy a third-party appliance in a new VPC in the Region. Create a new VPC in the Local Zone. Create VPN connections to the appliance for the VPCs. Deploy instances in the new VPC in the Local Zone.
   • CCreate a new subnet in the Local Zone. Deploy a third-party appliance in the VPC with interfaces in each subnet. Configure the new subnet to route the Local Zone through the appliance. Deploy instances in the new subnet.
   • DCreate a new subnet in the Local Zone. Configure the new subnet to use a CIDR block that is within the VPC’s CIDR block. Deploy instances in the new subnet in the Local Zone.

   Show answer

   Answer: D

   Explanation

   D is correct - Enable the local zone via EC2 Console Management. When we create a new subnet in the VPC, the local zone will be shown

   Source: Adapted from community discussion — AtomicNuke

   Next question

6. Question 146 · 294 in bank

   Select 2

   A government contractor is designing a multi-account environment with multiple VPCs for a customer. A network security policy requires all traffic between any two VPCs to be transparently inspected by a third-party appliance. The customer wants a solution that features AWS Transit Gateway. The setup must be highly available across multiple Availability Zones, and the solution needs to support automated failover. Furthermore, asymmetric routing is not supported by the inspection appliances. Which combination of steps is part of a solution that meets these requirements? (Choose two.)

   • ADeploy two clusters that consist of multiple appliances across multiple Availability Zones in a designated inspection VPC. Connect the inspection VPC to the transit gateway by using a VPC attachment. Create a target group, and register the appliances with the target group. Create a Network Load Balancer (NLB), and set it up to forward to the newly created target group. Configure a default route in the inspection VPCs transit gateway subnet toward the NLB.
   • BDeploy two clusters that consist of multiple appliances across multiple Availability Zones in a designated inspection VPC. Connect the inspection VPC to the transit gateway by using a VPC attachment. Create a target group, and register the appliances with the target group. Create a Gateway Load Balancer, and set it up to forward to the newly created target group. Configure a default route in the inspection VPC’s transit gateway subnet toward the Gateway Load Balancer endpoint.
   • CConfigure two route tables on the transit gateway. Associate one route table with all the attachments of the application VPCs. Associate the other route table with the inspection VPC’s attachment. Propagate all VPC attachments into the inspection route table. Define a static default route in the application route table. Enable appliance mode on the attachment that connects the inspection VPC.
   • DConfigure two route tables on the transit gateway. Associate one route table with all the attachments of the application VPCs. Associate the other route table with the inspection VPCs attachment. Propagate all VPC attachments into the application route table. Define a static default route in the inspection route table. Enable appliance mode on the attachment that connects the inspection VPC.
   • EConfigure one route table on the transit gateway. Associate the route table with all the VPCs. Propagate all VPC attachments into the route table. Define a static default route in the route table.

   Show answer

   Answer: BC

   Explanation

   NLB:To increase the fault tolerance of your applications, you can enable multiple Availability Zones for your load balancer and ensure that each target group has at least one target in each enabled Availability Zone. https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html GLB: Third party appliance https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/#:~:text=Gateway%20Load%20Balancer%20helps%20you,or%20down%2C%20based%20on%20demand. Answers A) B)

   Source: Adapted from community discussion — Mandar

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 147 · 294 in bank

   Select 2

   A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edge location in the us-west-1 Region. A shared services segment exists at both edge locations. Each shared services segment has a VPC attachment to each inspection VPC in each Region. The inspection VPCs inspect traffic from a WAN by using AWS Network Firewall. The company creates a new segment for a new business unit (BU) in the us-east-1 edge location. The new BU has three VPCs that are attached to the new BU segment. To comply with regulations, the BU VPCs must not communicate with each other. All internet-bound traffic must be inspected in the inspection VPC. The company updates VPC route tables so any traffic that is bound for internet goes to the AWS Cloud WAN core network. The company plans to add more VPCs for the new BU in the future. All future VPCs must comply with regulations. Which solution will meet these requirements in the MOST operationally efficient way? (Choose two.)

   • AUpdate the network policy to share the shared services segment with the BU segment.
   • BCreate a network policy to share the inspection service segment with the BU segment.
   • CSet the isolate-attachments field to True for the BU segment.
   • DSet the isolate-attachments field to False for the BU segment.
   • EUpdate the network policy to add static routes for the BU segment. Configure the shared services segment to route traffic related to VPC CIDR blocks to each respective VPC attachment.

   Show answer

   Answer: AC

   Explanation

   Options A + C provide the most scalable solution No need to update routes for each new VPC Automatic handling of traffic flows Maintains compliance automatically for future VPCs

   Source: Adapted from community discussion — woorkim

   Next question

8. Question 148 · 294 in bank

   A company hosts a highly available, scalable, and resilient application on Amazon EC2 instances that are part of an Auto Scaling group. A network engineer is planning to integrate IPv6 support with the application deployment in phases. The first phase is to enable IPv6 service consumption on the public Network Load Balancers (NLBs) that are deployed across the infrastructure. The target groups for the NLBS are configured as the Auto Scaling groups of the EC2 instances that host the application. The NLBs are configured for dual-stack operation. During the testing of the first phase, the IPv6 application queries are not reaching the backend servers. What is the cause of this issue?

   • AThe subnets where the EC2 instances are deployed do not have IPv6 addresses configured.
   • BThe route tables for the NLB subnets do not have IPV6 routing configured.
   • CThe route tables for the EC2 subnets do not have IPV6 routing configured.
   • DThe security groups that are associated with the NLBs do not allow IPv6 traffic.

   Show answer

   Answer: A

   Explanation

   The EC2 subnets (where the Auto Scaling group instances run) do not have IPv6 addresses configured. Therefore, even though the Network Load Balancer (NLB) is operating in dual-stack mode and can accept IPv6 connections, it cannot forward IPv6 traffic to instances that do not themselves have IPv6 addresses in the same subnet.

   Source: Adapted from community discussion — djangoGroup

   Next question

9. Question 149 · 294 in bank

   A company wants to implement a distributed architecture on AWS that uses a Gateway Load Balancer (GWLB) and GWLB endpoints. The company has chosen a hub-and-spoke model. The model includes a GWLB and virtual appliances that are deployed into a centralized appliance VPC and GWLB endpoints. The model also includes internet gateways that are configured in spoke VPCs. Which sequence of traffic flow to the internet from the spoke VPC is correct?

   • A1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration. 2. Traffic is delivered securely and privately to the GWLB. 3. The GWLB sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway.
   • B1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration. 2. Traffic is delivered securely and privately to the GWLB endpoint. 3. The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB and out to the internet through an internet gateway.
   • C1. An application in a spoke VPC sends traffic to the GWLB endpoint. 2. Traffic is delivered securely and privately to the GWLB. 3. The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway.
   • D1. An application in a spoke VPC sends traffic to the GWLB. 2. Traffic is delivered securely and privately to the GWLB endpoint. 3. The GWLB sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB and out to the internet through an internet gateway.

   Show answer

   Answer: A

   Explanation

   Option A: 1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration. 2. Traffic is delivered securely and privately to the GWLB. 3. The GWLB sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway. • Step 1: Correct. The spoke VPC route table points default (or other relevant prefixes) to the GWLB endpoint. • Step 2: Correct. The GWLB endpoint is an interface endpoint that privately and securely forwards packets to the GWLB in the appliance VPC. • Step 3: Correct. The GWLB passes traffic to the attached virtual appliance (e.g., a firewall) for inspection. • Step 4: Correct. After inspection, the traffic returns to the spoke VPC through the GWLB endpoint and finally exits via the spoke VPC’s internet gateway.

   Source: Adapted from community discussion — djangoGroup

   Next question

10. Question 150 · 294 in bank

    A network engineer needs to provide a list of IP addresses that are sending traffic to an Amazon EC2 instance. VPC flow logs are enabled. The EC2 instance has a single network interface and two assigned IP addresses. However, the flow logs are logging traffic only for the primary IP address. The network engineer needs to determine whether any traffic is being sent to the second IP address of the EC2 instance. What should the network engineer do to locate the traffic flow for the second IP address?

    • ACreate a new flow log that includes the pkt-dstaddr field to capture the original destination IP address of the traffic.
    • BCreate a new flow log that includes the dstaddr field to capture the original destination IP address of the traffic.
    • CCreate a new flow log that includes the pkt-srcaddr field to capture the original destination IP address of the traffic.
    • DCreate a new flow log that includes the srcaddr field to capture the original destination IP address of the traffic.

    Show answer

    Answer: A

    Explanation

    https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-limitations.html If your network interface has multiple IPv4 addresses and traffic is sent to a secondary private IPv4 address, the flow log displays the primary private IPv4 address in the dstaddr field. To capture the original destination IP address, create a flow log with the pkt-dstaddr field.

    Source: Adapted from community discussion — woorkim

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 141. 294 questions available.