ANS-C01 practice questions 231–240

1. Question 231 · 294 in bank

   A company has deployed an application in a VPC that uses a NAT gateway for outbound traffic to the internet. A network engineer notices a large quantity of suspicious network traffic that is traveling from the VPC over the internet to IP addresses that are included on a deny list. The network engineer must implement a solution to determine which AWS resources are generating the suspicious traffic. The solution must minimize cost and administrative overhead. Which solution will meet these requirements?

   • ALaunch an Amazon EC2 instance in the VPC. Use Traffic Mirroring by specifying the NAT gateway as the source and the EC2 instance as the destination. Analyze the captured traffic by using open-source tools to identify the AWS resources that are generating the suspicious traffic.
   • BUse VPC flow logs. Launch a security information and event management (SIEM) solution in the VPC. Configure the SIEM solution to ingest the VPC flow logs. Run queries on the SIEM solution to identify the AWS resources that are generating the suspicious traffic.
   • CUse VPC flow logs. Publish the flow logs to a log group in Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the flow logs to identify the AWS resources that are generating the suspicious traffic.
   • DConfigure the VPC to stream the network traffic directly to an Amazon Kinesis data stream. Send the data from the Kinesis data stream to an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use Amazon Athena to query the data to identify the AWS resources that are generating the suspicious traffic.

   Show answer

   Answer: C

   Explanation

   VPC flow logs capture information about the IP traffic going to and from network interfaces in a VPC. They provide details such as source and destination IP addresses, ports, and protocols. Publishing the VPC flow logs to a log group in Amazon CloudWatch Logs (Option C) allows for centralized and easy access to the flow log data. CloudWatch Logs Insights can be used to query the flow logs efficiently and identify the AWS resources that are generating the suspicious traffic. This solution minimizes cost by leveraging existing AWS services (CloudWatch Logs) and has lower administrative overhead compared to setting up custom streaming solutions (such as Amazon Kinesis) or deploying additional instances (as in Option A). Options A, B, and D introduce additional complexity and may have higher associated costs or administrative overhead compared to using CloudWatch Logs Insights for analyzing VPC flow logs.

   Source: Adapted from community discussion — vikasj1in

   Next question

2. Question 232 · 294 in bank

   Select 2

   A company has its production VPC (VPC-A) in the eu-west-1 Region in Account 1. VPC-A is attached to a transit gateway (TGW-A) that is connected to an on-premises data center in Dublin, Ireland, by an AWS Direct Connect transit VIF that is configured for an AWS Direct Connect gateway. The company also has a staging VPC (VPC-B) that is attached to another transit gateway (TGW-B) in the eu-west-2 Region in Account 2. A network engineer must implement connectivity between VPC-B and the on-premises data center in Dublin. Which solutions will meet these requirements? (Choose two.)

   • AConfigure inter-Region VPC peering between VPC-A and VPC-B. Add the required VPC peering routes. Add the VPC-B CIDR block in the allowed prefixes on the Direct Connect gateway association.
   • BAssociate TGW-B with the Direct Connect gateway. Advertise the VPC-B CIDR block under the allowed prefixes.
   • CConfigure another transit VIF on the Direct Connect connection and associate TGW-B. Advertise the VPC-B CIDR block under the allowed prefixes.
   • DConfigure inter-Region transit gateway peering between TGW-A and TGW-B. Add the peering routes in the transit gateway route tables. Add both the VPC-A and the VPC-B CIDR block under the allowed prefix list in the Direct Connect gateway association.
   • EConfigure an AWS Site-to-Site VPN connection over the transit VIF to TGW-B as a VPN attachment.

   Show answer

   Answer: BD

   Explanation

   Only one Transit VIF is possible with one Direct connection. With DX gateway, 3 Transit Gateways (same or different regions) can be added. Option B) and D) are correct, though B) itself fulfils the requirement in the question.

   Source: Adapted from community discussion — study_aws1

   Next question

3. Question 233 · 294 in bank

   Select 3

   A company’s network engineer is designing a hybrid DNS solution for an AWS Cloud workload. Individual teams want to manage their own DNS hostnames for their applications in their development environment. The solution must integrate the application-specific hostnames with the centrally managed DNS hostnames from the on-premises network and must provide bidirectional name resolution. The solution also must minimize management overhead. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

   • AUse an Amazon Route 53 Resolver inbound endpoint.
   • BModify the DHCP options set by setting a custom DNS server value.
   • CUse an Amazon Route 53 Resolver outbound endpoint.
   • DCreate DNS proxy servers.
   • ECreate Amazon Route 53 private hosted zones.
   • FSet up a zone transfer between Amazon Route 53 and the on-premises DNS.

   Show answer

   Answer: ACE

   Explanation

   ACE are the correct answers. To ensure bidirectional name resolution, both resolver inbound and outbound endpoints are required, and private hosted zone for individual team to be able to manage their DNS records. +forwarding rules.

   Source: Adapted from community discussion — Raphaello

   References

   • AWS documentation

   Next question

4. Question 234 · 294 in bank

   A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is the origin in an Amazon CloudFront distribution. The company wants to implement a custom authentication system that will provide a token for its authenticated customers. The web application must ensure that the GET/POST requests come from authenticated customers before it delivers the content. A network engineer must design a solution that gives the web application the ability to identify authorized customers. What is the MOST operationally efficient solution that meets these requirements?

   • AUse the ALB to inspect the authorized token inside the GET/POST request payload. Use an AWS Lambda function to insert a customized header to inform the web application of an authenticated customer request.
   • BIntegrate AWS WAF with the ALB to inspect the authorized token inside the GET/POST request payload. Configure the ALB listener to insert a customized header to inform the web application of an authenticated customer request.
   • CUse an AWS Lambda@Edge function to inspect the authorized token inside the GET/POST request payload. Use the Lambda@Edge function also to insert a customized header to inform the web application of an authenticated customer request.
   • DSet up an EC2 instance that has a third-party packet inspection tool to inspect the authorized token inside the GET/POST request payload. Configure the tool to insert a customized header to inform the web application of an authenticated customer request.

   Show answer

   Answer: C

   Explanation

   C it the correct answer. Lambda@Edge (after viewer request/before origin request) can inspect cookies/authentication token, and perform function logic and redirection (to login page when needed).

   Source: Adapted from community discussion — Raphaello

   References

   • AWS documentation

   Next question

5. Question 235 · 294 in bank

   A company has created three VPCs: a production VPC, a nonproduction VPC, and a shared services VPC. The production VPC and the nonproduction VPC must each have communication with the shared services VPC. There must be no communication between the production VPC and the nonproduction VPC. A transit gateway is deployed to facilitate communication between VPCs. Which route table configurations on the transit gateway will meet these requirements?

   • AConfigure a route table with the production and nonproduction VPC attachments associated with propagated routes for only the shared services VPC. Create an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.
   • BConfigure a route table with the production and nonproduction VPC attachments associated with propagated routes for each VPC. Create an additional route table with only the shared services VPC attachment associated with propagated routes from each VPC.
   • CConfigure a route table with all the VPC attachments associated with propagated routes for only the shared services VPCreate an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.
   • DConfigure a route table with the production and nonproduction VPC attachments associated with propagated routes disabled. Create an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.

   Show answer

   Answer: A

   Explanation

   A is the correct answer. Instead of the TGW default route table, we now need to create 3 separate route tables. 1. prod with its route(s) propagated into it (via prod VPC attachment) 2. non-prod with its route(s) propagated into it (via non-prod VPC attachment) 3. shared with prod and non-prod route(s) propagated into it each via its respective attachment.

   Source: Adapted from community discussion — Raphaello

   Next question

6. Question 236 · 294 in bank

   A company is using an AWS Site-to-Site VPN connection from the company's on-premises data center to a virtual private gateway in the AWS Cloud Because of congestion, the company is experiencing availability and performance issues as traffic travels across the internet before the traffic reaches AWS. A network engineer must reduce these issues for the connection as quickly as possible with minimum administration effort. Which solution will meet these requirements?

   • AEdit the existing Site-to-Site VPN connection by enabling acceleration. Stop and start the VPN service on the customer gateway for the new setting to take effect.
   • BConfigure a transit gateway in the same AWS Region as the existing virtual private gateway. Create a new accelerated Site-to-Site VPN connection. Connect the new connection to the transit gateway by using a VPN attachment. Update the customer gateway device to use the new Site to Site VPN connection. Delete the existing Site-to-Site VPN connection
   • CCreate a new accelerated Site-to-Site VPN connection. Connect the new Site-to-Site VPN connection to the existing virtual private gateway. Update the customer gateway device to use the new Site-to-Site VPN connection. Delete the existing Site-to-Site VPN connection.
   • DCreate a new AWS Direct Connect connection with a private VIF between the on-premises data center and the AWS Cloud. Update the customer gateway device to use the new Direct Connect connection. Delete the existing Site-to-Site VPN connection.

   Show answer

   Answer: B

   Explanation

   B - correct Acceleration is only supported for Site-to-Site VPN connections that are attached to a transit gateway. Virtual private gateways do not support accelerated VPN connections. https://docs.aws.amazon.com/vpn/latest/s2svpn/accelerated-vpn.html

   Source: Adapted from community discussion — study_aws1

   References

   • AWS documentation

   Next question

7. Question 237 · 294 in bank

   An Australian ecommerce company hosts all of its services in the AWS Cloud and wants to expand its customer base to the United States (US). The company is targeting the western US for the expansion. The company’s existing AWS architecture consists of four AWS accounts with multiple VPCs deployed in the ap-southeast-2 Region. All VPCs are attached to a transit gateway in ap-southeast-2. There are dedicated VPCs for each application service. The company also has VPCs for centralized security features such as proxies, firewalls, and logging. The company plans to duplicate the infrastructure from ap-southeast-2 to the us-west-1 Region. A network engineer must establish connectivity between the various applications in the two Regions. The solution must maximize bandwidth, minimize latency and minimize operational overhead. Which solution will meet these requirements?

   • ACreate VPN attachments between the two transit gateways. Configure the VPN attachments to use BGP routing between the two transit gateways.
   • BPeer the transit gateways in each Region. Configure routing between the two transit gateways for each Region's IP addresses.
   • CCreate a VPN server in a VPC in each Region. Update the routing to point to the VPN servers for the IP addresses in alternate Regions.
   • DAttach the VPCs in us-west-1 to the transit gateway in ap-southeast-2.

   Show answer

   Answer: B

   Explanation

   B - seems to be more appropriate. Option B could be a possible solution, but it depends on the specific requirements and constraints of the company. Peering the transit gateways in each region would establish a private network connection between the two regions, allowing the company to route traffic between the VPCs in different regions without going over the public internet. This would help minimize latency and maximize bandwidth while reducing the operational overhead of managing multiple VPN connections.

   Source: Adapted from community discussion — zaazanuna

   Next question

8. Question 238 · 294 in bank

   An IoT company sells hardware sensor modules that periodically send out temperature, humidity, pressure, and location data through the MQTT messaging protocol. The hardware sensor modules send this data to the company's on-premises MQTT brokers that run on Linux servers behind a load balancer. The hardware sensor modules have been hardcoded with public IP addresses to reach the brokers. The company is growing and is acquiring customers across the world. The existing solution can no longer scale and is introducing additional latency because of the company's global presence. As a result, the company decides to migrate its entire infrastructure from on premises to the AWS Cloud. The company needs to migrate without reconfiguring the hardware sensor modules that are already deployed across the world. The solution also must minimize latency. The company migrates the MQTT brokers to run on Amazon EC2 instances. What should the company do next to meet these requirements?

   • APlace the EC2 instances behind a Network Load Balancer (NLB). Configure TCP listeners. Use Bring Your Own IP (BYOIP) from the on-premises network with the NLB.
   • BPlace the EC2 instances behind a Network Load Balancer (NLB). Configure TCP listeners. Create an AWS Global Accelerator accelerator in front of the NLUse Bring Your Own IP (BYOIP) from the on-premises network with Global Accelerator.
   • CPlace the EC2 instances behind an Application Load Balancer (ALB). Configure TCP listeners. Create an AWS Global Accelerator accelerator in front of the ALB. Use Bring Your Own IP (BYOIP) from the on-premises network with Global Accelerator
   • DPlace the EC2 instances behind an Amazon CloudFront distribution. Use Bring Your Own IP (BYOIP) from the on-premises network with CloudFront.

   Show answer

   Answer: B

   Explanation

   Using a Network Load Balancer (NLB) with TCP listeners allows the company to maintain compatibility with the existing hardware sensor modules that are already configured to send data via the MQTT protocol using public IP addresses. Creating an AWS Global Accelerator accelerator in front of the NLB provides a global anycast IP address, which can help minimize latency for the global user base. Using Bring Your Own IP (BYOIP) from the on-premises network with Global Accelerator allows the company to retain the public IP addresses hardcoded in the existing hardware sensor modules, eliminating the need for reconfiguration. Options A, C, and D do not provide the same level of compatibility with existing hardware sensor modules or may introduce unnecessary complexity.

   Source: Adapted from community discussion — vikasj1in

   References

   • AWS documentation

   Next question

9. Question 239 · 294 in bank

   A company has deployed a web application on AWS. The web application uses an Application Load Balancer (ALB) across multiple Availability Zones. The targets of the ALB are AWS Lambda functions. The web application also uses Amazon CloudWatch metrics for monitoring. Users report that parts of the web application are not loading properly. A network engineer needs to troubleshoot the problem. The network engineer enables access logging for the ALB. What should the network engineer do next to determine which errors the ALB is receiving?

   • ASend the logs to Amazon CloudWatch Logs. Review the ALB logs in CloudWatch Insights to determine which error messages the ALB is receiving.
   • BConfigure the Amazon S3 bucket destination. Use Amazon Athena to determine which error messages the ALB is receiving.
   • CConfigure the Amazon S3 bucket destination. After Amazon CloudWatch Logs pulls the ALB logs from the S3 bucket automatically, review the logs in CloudWatch Logs to determine which error messages the ALB is receiving.
   • DSend the logs to Amazon CloudWatch Logs. Use the Amazon Athena CloudWatch Connector to determine which error messages the ALB is receiving.

   Show answer

   Answer: B

   Explanation

   Option B) is correct Access logs is an optional feature of Elastic Load Balancing that is disabled by default. After you enable access logs for your load balancer, Elastic Load Balancing captures the logs and stores them in the Amazon S3 bucket that you specify as compressed files. You can disable access logs at any time. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

   Source: Adapted from community discussion — study_aws1

   References

   • AWS documentation

   Next question

10. Question 240 · 294 in bank

    Select 3

    A network engineer is designing the architecture for a healthcare company's workload that is moving to the AWS Cloud. All data to and from the on-premises environment must be encrypted in transit. All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premises environment or to the internet. The company will expose components of the workload to the internet so that patients can reserve appointments. The architecture must secure these components and protect them against DDoS attacks. The architecture also must provide protection against financial liability for services that scale out during a DDoS event. Which combination of steps should the network engineer take to meet all these requirements for the workload? (Choose three.)

    • AUse Traffic Mirroring to copy all traffic to a fleet of traffic capture appliances.
    • BSet up AWS WAF on all network components.
    • CConfigure an AWS Lambda function to create Deny rules in security groups to block malicious IP addresses.
    • DUse AWS Direct Connect with MACsec support for connectivity to the cloud.
    • EUse Gateway Load Balancers to insert third-party firewalls for inline traffic inspection.
    • FConfigure AWS Shield Advanced and ensure that it is configured on all public assets.

    Show answer

    Answer: DEF

    Explanation

    D) - All data to and from the on-premises environment must be encrypted in transit. (Use AWS Direct Connect with MACsec support for connectivity to the cloud.) E) - All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premises environment (Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection.) F) - The architecture also must provide protection against financial liability for services that scale out during a DDoS event.(Configure AWS Shield Advanced and ensure that it is configured on all public assets) F) -

    Source: Adapted from community discussion — study_aws1

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 231. 294 questions available.