ANS-C01 practice questions 151–160

1. Question 151 · 294 in bank

   A company has configured an AWS Cloud WAN core network with edge locations in the us-east-1 Region and the us-west-1 Region. Each edge location has two segments: development and staging. The segments use the default core network policy. The company has attached VPCs to the core network. A development VPC is attached to the development segment in us-east-1 and is configured to use the 10.0.0.0/16 CIDR block. A staging VPC is attached to the staging segment in us-west-1 and is configured to use the 10.5.0.0/16 CIDR block. The company has updated the route tables for both VPCs with a route that directs any traffic for 0.0.0.0/0 to the core network. The company’s network team needs to establish communication between the two VPCs by using the AWS Cloud WAN core network. The network team is not receiving a response during tests of communication between the VPCs. The network team has verified that security groups and network ACLs are not blocking the traffic. What should the network team do to establish this communication?

   • AUpdate both VPC route tables to have a new static route. Configure a route on the development VPC to direct the traffic for 10.0.0.0/16 to the development VPC attachment. Configure a route on the staging VPC to direct the traffic for 10.5.0.0/16 to the staging VPC attachment.
   • BUpdate the segment filter to allow traffic on the development and staging segments.
   • CSet the isolate-attachments parameter to False for the development and staging segments.
   • DUpdate the core network policy to add a static route for each segment. Configure a route to direct the traffic for 10.0.0.0/16 to the development VPC attachment. Configure a route to direct the traffic for 10.5.0.0/16 to the staging VPC attachment.

   Show answer

   Answer: D

   Explanation

   A. Adding static routes to VPC route tables wouldn't help because the segments themselves are isolated B. Segment filters control what attachments can join a segment, not inter-segment communication C. The isolate-attachments parameter controls isolation within a segment, not between segments D. Updating the core network policy with static routes would define how traffic should flow between segments

   Source: Adapted from community discussion — woorkim

   Next question

2. Question 152 · 294 in bank

   Select 3

   A company has VPCs in the us-east-1 Region that are connected to each other through a transit gateway. A network engineer needs to establish an AWS Direct Connect connection between the company's on-premises data center and the transit gateway for the migration of a workload. The Direct Connect connection is UP according to the ConnectionState metric in Amazon CloudWatch. However, the VIF is DOWN. The network engineer has verified the transit VIF and BGP configurations on the on-premises router and has found no issues. However, the network engineer is unable to ping the Amazon peer IP address. Which combination of steps should the network engineer take to troubleshoot this issue? (Choose three.)

   • AVerify that the correct IP address and subnet mask are in use for the subinterface on the router.
   • BEnsure that VLAN trunking is disabled on the router.
   • CVerify that the router has a MAC address entry from the AWS endpoint in the Address Resolution Protocol (ARP) table.
   • DVerify that the optical signal that is received over the cross connect is optimal.
   • EEnsure that the correct VLAN tag is applied on the subinterface configuration on the router.
   • FEnsure that TCP port 179 is not being blocked at the on-premises router.

   Show answer

   Answer: ACE

   Explanation

   A. Correct IP address and subnet mask: This is crucial for establishing the connection. If these are incorrect, the VIF won't be able to establish a connection with the AWS side. C. MAC address entry in ARP table: If the router doesn't have the MAC address of the AWS endpoint in its ARP table, it won't be able to communicate at the link layer. This could explain why the network engineer is unable to ping the Amazon peer IP address. E. Correct VLAN tag: The VLAN tag must match between the AWS configuration and the router's subinterface. If this is misconfigured, the traffic won't be properly tagged and routed.

   Source: Adapted from community discussion — dspd

   References

   • AWS documentation

   Next question

3. Question 153 · 294 in bank

   A logistics company has multiple VPCs in an AWS Region. The company uses a transit gateway to connect the VPCs. The company has several on-premises offices that connect to the transit gateway by using AWS Site-to-Site VPN connections over the internet. The company has configured one transit gateway VPN attachment for each office. Route propagation is enabled on all route tables. Each Site-to-Site VPN connection uses two tunnels in an active-passive configuration. The company configured each office with appropriate static routes on both the Site-to-Site VPN connection and the office’s customer gateway. The company wants to use both IPsec tunnels of every office to maximize the overall VPN connection bandwidth. Which design changes are necessary to meet these requirements?

   • ACreate an AWS Transit Gateway Connect attachment for each office Use the existing VPN attachments as the transport for the new Connect attachments. Set up a Generic Routing Encapsulation (GRE) tunnel on each customer gateway that terminates on the Connect attachment for each office. Move the static routes from the transit gateway VPN attachment to the customer gateway for the transit gateway Connect attachment.
   • BEnable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Enable ECMP on the Site-to-Site VPN connection. Ensure static routes on the customer gateways have equal metrics and administrative distance.
   • CEnable equal-cost multi-path (ECMP) routing on the transit gateway. (Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Remove related static routes from the customer gateways.
   • DEnable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Ensure the customer gateway applies the correct community strings to give the transit gateway the ability to perform ECMP forwarding.

   Show answer

   Answer: C

   Next question

4. Question 154 · 294 in bank

   Select 2

   A finance company runs multiple applications on Amazon EC2 instances in two VPCs that are within a single AWS Region. The company uses one VPC for stock trading applications. The company uses the second VPC for financial applications. Both VPCs are connected to a transit gateway that is configured as a multicast router. In the stock trading VPC, an EC2 instance that has an IP address of 10.128.10.2 sends trading data over a multicast network to the 239.10.10.10 IP address on UDP Port 5102. The company recently launched two new EC2 instances in the financial application VPC. The new EC2 instances need to receive the multicast stock trading data from the EC2 instance that is in the stock trading VPC. Which combination of steps should the company take to meet this requirement? (Choose three.)

   • AAdd the elastic network interfaces of the two new EC2 instances as members of the multicast group by using the group IP address of 239.10.10.10.
   • BAdd an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows: Protocol: IGMP Version 2. Port: 5102, and Source: 239 10.10.10/32
   • CCreate associations to two EC2 instance IDs on the financial application VPC transit gateway attachment under the transit gateway multicast domain.
   • DCreate an association to EC2 instance subnets on the financial application VPC transit gateway attachment under the transit gateway multicast domain. D. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows: Protocol: IGMP Version 2. Port: All, and Source: 0 0.0.0/32
   • EAdd an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows. Protocol: UDP, Port: 5102, and Source: 10.128.10.2/32

   Show answer

   Answer: AD

   Next question

5. Question 155 · 294 in bank

   A company runs workloads in multiple VPCs in the us-east-1 Region. The VPCs are connected to a transit gateway. An AWS Direct Connect connection provides private connectivity between a data center that is in the US and the transit gateway. A Direct Connect gateway is associated with the transit gateway. The company has recently opened a new office location in London. The company plans to launch cloud services in multiple VPCs in the eu-west-2 Region. Users in the new London office must have private access to the workloads that run in us-east-1. Users in the US data center must have access to any workloads that are created in eu-west-2. A network engineer must implement a flexible solution that provides users the required access. The solution must be able to accommodate future growth. Which solution will meet these requirements with the LEAST operational effort?

   • ACreate an AWS Site-to-Site VPN connection from the London office to the Direct Connect gateway in us-east-1.
   • BEstablish a new Direct Connect connection for the London office. Attach the new Direct Connect connection to the existing Direct Connect gateway. Create a transit gateway in eu-west-2. Associate the new transit gateway with the existing Direct Connect gateway. Create a peering connection between the transit gateways in us-east-1 and eu-west-2.
   • CCreate an AWS Site-to-Site VPN connection from the London office to each of the VPCs that are in us-east-1.
   • DEstablish a new AWS Direct Connect connection for the London office Create a new Direct Connect gateway and a transit gateway in eu-west-2. Attach the new Direct Connect connection to the new Direct Connect gateway. Create a peering connection between the transit gateways in us-east-1 and eu-west-2.

   Show answer

   Answer: B

   Explanation

   Since the Direct Connect gateway (DXGW) is global, it can be used to connect the new DX connection in London to the existing transit gateway in us-east-1. This simplifies routing and minimizes operational complexity.

   Source: Adapted from community discussion — woorkim

   Next question

6. Question 156 · 294 in bank

   A company has 10 Amazon EC2 instances that run web server software in a production VPC. The company also has 10 web servers that run in an on-premises data center. The company has a 10 Gbps AWS Direct Connect connection between the on-premises data center and the production VPC. The data center uses the 10.100.0.0/20 CIDR block. The company needs to implement a load balancing solution that receives HTTPS traffic from thousands of external users. The solution must distribute the traffic across the web servers on AWS and the web servers in the data center. Regardless of the location of the web servers, HTTPS requests must go to the same web server for the duration of the session. Which solution will meet these requirements?

   • ADeploy a Network Load Balancer (NLB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify IP as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable connection draining on the NLB.
   • BDeploy an Application Load Balancer (ALB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify IP as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable application-based sticky sessions on the ALB.
   • CDeploy a Network Load Balancer (NLB) in the production VPCreate one target group for the EC2 Instances and a second target group for the on-premises servers. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable sticky sessions on the NLB.
   • DDeploy an Application Load Balancer (ALB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable application-based sticky sessions on the ALB.

   Show answer

   Answer: B

   Next question

7. Question 157 · 294 in bank

   A company has deployed Amazon EC2 instances in private subnets in a VPC. The EC2 instances must initiate any requests that leave the VPC, including requests to the company's on-premises data center over an AWS Direct Connect connection. No resources outside the VPC can be allowed to open communications directly to the EC2 instances. The on-premises data center's customer gateway is configured with a stateful firewall device that filters for incoming and outgoing requests to and from multiple VPCs. In addition, the company wants to use a single IP match rule to allow all the communications from the EC2 instances to its data center from a single IP address. Which solution will meet these requirements with the LEAST amount of operational overhead?

   • ACreate a VPN connection over the Direct Connect connection by using the on-premises firewall. Use the firewall to block all traffic from on premises to AWS. Allow a stateful connection from the EC2 instances to initiate the requests.
   • BConfigure the on-premises firewall to filter all requests from the on-premises network to the EC2 instances. Allow a stateful connection if the EC2 instances in the VPC initiate the traffic.
   • CDeploy a NAT gateway into a private subnet in the VPC where the EC2 instances are deployed. Specify the NAT gateway type as private. Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT gateway.
   • DDeploy a NAT instance into a private subnet in the VPC where the EC2 instances are deployed. Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT instance.

   Show answer

   Answer: C

   Explanation

   It is C. Why? NAT Gateway is managed, hence it is LEAST operational effort. Not D. Why? NAT Instance is self-managed, self-patched.

   Source: Adapted from community discussion — habros

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 158 · 294 in bank

   A global company is establishing network connections between the company's primary and secondary data centers and a VPC. A network engineer needs to maximize resiliency and fault tolerance for the connections. The network bandwidth must be greater than 10 Gbps. Which solution will meet these requirements MOST cost-effectively?

   • ASet up a 100 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up a second 100 Gbps connection at the secondary data center that terminates at a second Direct Connect location. Ensure the connections are managed by separate providers.
   • BSet up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up a second 10 Gbps connection at the secondary data center that terminates at a second Direct Connect location. Ensure the connections are managed by separate providers.
   • CSet up two 10 Gbps connections at the primary data center that terminate at one AWS Direct Connect location. Ensure the connections are managed by separate providers. Set up two 10 Gbps connections at the secondary data center that terminate at a second Direct Connect location. Ensure the connections are managed by separate providers.
   • DSet up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up an AWS Site-to-Site VPN connection at the secondary data center that terminates at a virtual private gateway in the same Region as the company’s VPC.

   Show answer

   Answer: C

   Explanation

   The answer is C. Provides >10 Gbps bandwidth through multiple 10 Gbps connections Maximizes resiliency with redundant connections at separate locations Uses separate providers for additional fault tolerance More cost-effective than 100 Gbps connections while meeting requirements

   Source: Adapted from community discussion — woorkim

   References

   • AWS documentation

   Next question

9. Question 159 · 294 in bank

   A company’s data center is connected to a single AWS Region by an AWS Direct Connect dedicated connection. The company has a single VPC in the Region. The company stores logs for all its applications locally in the data center. The company must keep all application logs for 7 years. The company decides to copy all application logs to an Amazon S3 bucket. Which solution will meet these requirements?

   • ACreate a public VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint in the VPC.
   • BCreate a private VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint in the VPC.
   • CCreate a private VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VPC.
   • DCreate a public VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VPC.

   Show answer

   Answer: C

   Explanation

   https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html you allow in-VPC applications to continue accessing Amazon S3 through the gateway endpoint, which is not billed. Then, only your on-premises applications would use interface endpoints to access Amazon S3.

   Source: Adapted from community discussion — woorkim

   References

   • AWS documentation

   Next question

10. Question 160 · 294 in bank

    A company is planning to host a secure web application across multiple Amazon EC2 instances. The application will have an associated DNS domain in an Amazon Route 53 hosted zone. The company wants to protect the domain from DNS poisoning attacks. The company also wants to allow web browsers to authenticate into the application by using a trusted third party. Which combination of actions will meet these requirements?

    • AConfigure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install self-signed X.509 certificates on the EC2 instances.
    • BConfigure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install X 509 certificates that are signed by a public certificate authority on the EC2 instances.
    • CConfigure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install X.509 certificates that are signed by a public certificate authority on the EC2 instances.
    • DConfigure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install self-signed X.509 certificates on the EC2 instances.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 151. 294 questions available.