ANS-C01 practice questions 271–280

1. Question 271 · 294 in bank

   A company's existing AWS environment contains public application servers that run on Amazon EC2 instances. The application servers run in a VPC subnet. Each server is associated with an Elastic IP address. The company has a new requirement for firewall inspection of all traffic from the internet before the traffic reaches any EC2 instances. A security engineer has deployed and configured a Gateway Load Balancer (GLB) in a standalone VPC with a fleet of third-party firewalls. How should a network engineer update the environment to ensure that the traffic travels across the fleet of firewalls?

   • ADeploy a transit gateway. Attach a GLB endpoint to the transit gateway. Attach the application VPC to the transit gateway. Update the application subnet route table's default route destination to be the GLB endpoint. Ensure that the EC2 instances' security group allows traffic from the GLB endpoint.
   • BUpdate the application subnet route table to have a default route to the GLOn the standalone VPC that contains the firewall fleet, add a route in the route table for the application VPC's CIDR block with the GLB endpoint as the destination. Update the EC2 instances' security group to allow traffic from the GLB.
   • CProvision a GLB endpoint in the application VPC in a new subnet. Create a gateway route table with a route that specifies the application subnet CIDR block as the destination and the GLB endpoint as the target. Associate the gateway route table with the internet gateway in the application VPUpdate the application subnet route table's default route destination to be the GLB endpoint.
   • DInstruct the security engineer to move the GLB into the application VPC. Create a gateway route table. Associate the gateway route table with the application subnet. Add a default route to the gateway route table with the GLB as its destination. Update the route table on the GLB to direct traffic from the internet gateway to the application servers. Ensure that the EC2 instances' security group allows traffic from the GLB.

   Show answer

   Answer: C

   Explanation

   A is ridiculous -> attach a GWLB endpoint to transit gateway??? B is incorrect - need to inspect all traffic FROM the Internet, not the other way D. is incorrect -> IGW needs a route to re-direct traffic to GWLB, you can't do that from GWLB's route table.

   Source: Adapted from community discussion — lygf

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 272 · 294 in bank

   A company has an AWS Site-to-Site VPN connection between its office and its VPC. Users report occasional failure of the connection to the application that is hosted inside the VPC. A network engineer discovers in the customer gateway logs that the Internet Key Exchange (IKE) session ends when the connection to the application fails. What should the network engineer do to bring up the IKE session if the IKE session goes down?

   • ASet the dead peer detection (DPD) timeout action to Clear. Initiate traffic from the VPC to on premises.
   • BSet the dead peer detection (DPD) timeout action to Restart. Initiate traffic from on premises to the VPC.
   • CSet the dead peer detection (DPD) timeout action to None. Initiate traffic from the VPC to on premises.
   • DSet the dead peer detection (DPD) timeout action to Cancel. Initiate traffic from on premises to the VPC.

   Show answer

   Answer: B

   Explanation

   Dead Peer Detection (DPD) is a method used to detect if the peer in a VPN connection is no longer reachable. By setting the DPD timeout action to "Restart," the VPN endpoint will attempt to re-establish the IKE session if it detects that the peer is no longer reachable. Initiating traffic from on premises to the VPC can trigger this process and bring up the IKE session if it has gone down.

   Source: Adapted from community discussion — vikasj1in

   References

   • AWS documentation

   Next question

3. Question 273 · 294 in bank

   A company operates in the us-east-1 Region and the us-west-1 Region. The company is designing a solution to connect an on-premises data center to the company's AWS environment in us-east-1. The solution uses two AWS Direct Connect connections. Traffic from us-west-1 to the data center needs to traverse the Direct Connect connections. A network engineer needs to set up active-passive functionality across the two Direct Connect connections by using a Direct Connect gateway to influence inbound traffic from VPCs that are in us-west-1 to the data center. Which solution will meet these requirements?

   • AAt the data center, set the local preference for the primary connection to be higher than the local preference for the secondary connection.
   • BUse AS path prepending to set the AS path on the primary connection to be longer than the AS path on the secondary connection.
   • CUse local preference BGP community tags to apply the 7224:7300 local preference BGP community tag to the prefixes for the primary connection. Apply the 7224:7100 local preference BGP community tag to the prefixes for the secondary connection.
   • DUse local preference BGP community tags to apply the 7224:9300 local preference BGP community tag to the prefixes for the primary connection. Apply the 7224:9100 local preference BGP community tag to the prefixes for secondary connection.

   Show answer

   Answer: C

   Next question

4. Question 274 · 294 in bank

   A company has multiple firewalls and ISPs for its on-premises data center. The company has a single AWS Site-to-Site VPN connection from the company's on-premises data center to a transit gateway. A single ISP services the Site-to-Site VPN connection. Multiple VPCs are attached to the transit gateway. A customer gateway that the Site-to-Site VPN connection uses fails. Connectivity is completely lost, but the company's network team does not receive a notification. The network team needs to implement redundancy within a week in case a single customer gateway fails again. The team wants to use an Amazon CloudWatch alarm to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic if any tunnel of the Site-to-Site VPN connection fails. Which solution will meet these requirements MOST cost-effectively?

   • AReplace the existing customer gateway with a new router. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of 0 for the alarm.
   • BUse a second customer gateway and a second ISP. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of less than 1 for the alarm.
   • CAdd an AWS Direct Connect connection to the existing Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of failed for the alarm.
   • DUse a second customer gateway with the existing ISP. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of unavailable for the alarm.

   Show answer

   Answer: B

   Next question

5. Question 275 · 294 in bank

   Select 2

   A gaming company operates in one AWS Region. The company's architecture includes an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group that support a frontend application. The company uses AWS WAF integrated with the ALB. The ALB has one security group attached to it. The company uses AWS Network Firewall with stateful rules. The company has set up Network ACLs. The company wants to automatically block access for game users who violate specific rules. The company wants to temporarily block access for problematic users for 1 to 2 hours. The company's software can identify the source IP addresses of problematic users. The company has created a serverless solution to store the IP addresses in Amazon DynamoDB. The company wants to use its existing serverless architecture to automatically block the problematic users. Which solution will meet these requirements in the MOST scalable way? (Choose two.)

   • ACreate a new AWS WAF IP set that the serverless solution updates. Introduce an AWS WAF deny rule to block traffic from any address in the IP set.
   • BConfigure the serverless solution to modify the network ACLs to block traffic from the IP addresses of the problematic users.
   • CConfigure the serverless solution to modify the ALB security group to block traffic from the IP addresses of the problematic users.
   • DCreate a new AWS WAF IP set that is updated by the serverless solution. Create an AWS WAF rule to redirect traffic from sources that match the IP set to a new API for the serverless solution.
   • ECreate an AWS Network Firewall stateless rule to drop traffic from the IP addresses of the problematic users. Configure the serverless solution to update the new rule with the IP addresses of the problematic users.

   Show answer

   Answer: AE

   Next question

6. Question 276 · 294 in bank

   Select 3

   A company is setting up an AWS Direct Connect connection between the company's on-premises data center and AWS. The company currently has a single VPC in its AWS account. The on-premises data center uses the 172.16.0.0/16 CIDR block, and the VPC uses the 10.1.1.0/24 CIDR block. The company associates the Direct Connect connection to one private VIF. A network engineer receives reports that SSH communication from hosts that are in the company's on-premises data center to Amazon EC2 instances that are deployed in the company's VPC is failing. The network engineer investigates and finds that the VIF is up and a BGP peering session has been established properly. Which steps should the engineer take to troubleshoot this issue? (Choose three.)

   • AEnsure that the advertised route for the on-premises network is present in the VPC route tables. Ensure that the VPC's subnets are present in the route tables of the on-premises network equipment.
   • BEnsure that BGP community tags announcements from the customer gateway router are configured properly.
   • CEnsure that the customer gateway router accepts BGP community tags in the prefixes the router receives.
   • DEnsure that the VPC network ACLs allow inbound and outbound traffic for the on-premises network prefix.
   • EEnsure that the security groups for the EC2 instances allow inbound SSH communication from the on-premises network prefix.
   • FEnsure that the security groups for the EC2 instances allow outbound SSH communication from the on-premises network prefix.

   Show answer

   Answer: ADE

   Next question

7. Question 277 · 294 in bank

   A company needs to connect its on-premises network to a VPC in the us-east-1 Region. The connection must support a maximum transmission unit (MTU) of 9,000 bytes and must be highly available. Which solution will meet these requirements MOST cost-effectively?

   • AUse AWS Site-to-Site VPN to create two VPNs. Use two connections to two virtual private gateways that are in the same VPC.
   • BUse AWS Site-to-Site VPN to create two VPNs. Use two connections to a single transit gateway that has a VPC attachment.
   • CCreate a multi-site, nonredundant AWS Direct Connect deployment. Use two Direct Connect connections to two separate Direct Connect locations.
   • DCreate a multi-site, redundant AWS Direct Connect deployment. Use two Direct Connect connections to one Direct Connect location and two connections to a second Direct Connect location.

   Show answer

   Answer: C

   Next question

8. Question 278 · 294 in bank

   A network engineer maintains a company's AWS infrastructure. The network engineer used AWS Transit Gateway to set up a hub and spoke architecture. The network engineer created a shared services VPC to centralize access to interface VPC endpoints. The company uses AWS Organizations to manage AWS accounts for multiple teams in a single organization. Each team in the company has a separate account and VPC. All the team accounts require access to the interface VPC endpoints. The network engineer needs a solution to grant each account the minimum required access. Each team's account must have access only to a list of authorized interface VPC endpoints. The solution must have minimal effect on the current architecture. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate a separate shared services VPC for each team account. Include the interface VPC endpoints that the team is authorized to use in each VPC. Use a unique transit gateway route table to connect each team's spoke VPC to the team's shared services VPC.
   • BApply security groups to the interface VPC endpoints that are in the shared services VPC. Configure each security group to allow only the CIDR block of the team spoke VPCs that are authorized to use the endpoints included in the security group.
   • CCreate a unique interface VPC endpoint for each team that is authorized to access a service. Update routing for the shared services VPC so that the CIDR block for each team can access only the set of endpoints the team is authorized to access.
   • DAssociate an endpoint policy with each interface VPC endpoint. In each policy, deny all the traffic except for traffic from accounts that are authorized to access the corresponding service.

   Show answer

   Answer: D

   Next question

9. Question 279 · 294 in bank

   A global network service provider deploys managed AWS Direct Connect connections for its customers. The company wants to integrate monitoring for the connections into its existing ticketing system. The ticketing system runs in the company's VPC on multiple EC2 instances. The ticketing system uses a REST API. The ticketing system must receive events with minimal latency. The company expects to receive an average of 1 event each day. The company wants to use its existing infrastructure as code (IaC) tooling to configure the monitoring integration solution. Which solution will meet these requirements in the MOST cost-effective way?

   • AConfigure an Amazon EventBridge rule to send events to an AWS Lambda function. Configure the Lambda function to process the events and to send events to the ticketing system's REST API.
   • BConfigure a scheduled event in Amazon CloudWatch to run an AWS Lambda function once every minute. Configure the function to poll the AWS API to detect changes in the Direct Connect connection state. Configure the function to submit tickets to the ticketing system's REST API when the function detects state changes.
   • CWrite a script to poll the AWS API to detect changes in Direct Connect connection state and to submit tickets to the ticketing system's REST API. Deploy the script to the ticketing system's EC2 instance. Schedule the script to run once every minute by using the operating system configuration.
   • DConfigure an Amazon EventBridge rule to send events directly to an Amazon DynamoDB table. Use Amazon DynamoDB Streams to send the events to an AWS Lambda function. Configure the function to process the events and to send the events to the ticketing system's REST API.

   Show answer

   Answer: A

   Next question

10. Question 280 · 294 in bank

    A network engineer deploys an Application Load Balancer (ALB) in two Availability Zones. There is one target group. There are four Amazon EC2 instance targets in the first Availability Zone and six EC2 instance targets in the second Availability Zone. During testing, the network engineer notices that the targets in the first Availability Zone receive 40% of the traffic. The targets in the second Availability Zone receive 60% of the traffic. The network engineer needs to update the configuration to prevent traffic from crossing Availability Zones. The network engineer wants to achieve a 50% traffic split across the Availability Zones. Which solution will meet these requirements?

    • ADisable cross-zone load balancing for the target group.
    • BDisable cross-zone load balancing for the ALB.
    • CDisable cross-zone load balancing for all the targets in the first Availability Zone.
    • DDisable cross-zone load balancing for all the targets in the second Availability Zone.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 271. 294 questions available.