ANS-C01 practice questions 281–290

1. Question 281 · 294 in bank

   A company hosts a corporate website on Amazon EC2 instances behind a Network Load Balancer (NLB). The NLB has one TLS listener. The company wants to use AWS WAF to enhance security for the website. Which solution will meet this requirement?

   • AAttach an Elastic IP address to the NLB. Associate an AWS WAF web ACL with the Elastic IP address.
   • BReplace the NLB with an Application Load Balancer (ALB). Associate an AWS WAF web ACL with the ALB.
   • CAssociate an AWS WAF web ACL with the NLB.
   • DAssociate an AWS WAF web ACL with the EC2 instances that are behind the NLB.

   Show answer

   Answer: B

   Next question

2. Question 282 · 294 in bank

   A security company has a domain that stores DNS records in an Amazon Route 53 public hosted zone. The company has configured DNS Security Extensions (DNSSEC) signing for the domain. The domain has no subdomains. A network engineer must disable DNSSEC signing for the domain. The network engineer must not cause any DNS outage. Which solution will meet these requirements?

   • ADisable DNSSEC signing. Delete the resource record signature (RRSIG) records. Wait for the TTL of the RSIG records to elapse. Deactivate the key-signing keys (KSKs).
   • BDeactivate the key-signing keys (KSKs). Wait for the TTL of the KSK records to elapse. Disable DNSSEC signing.
   • CDelete the designated signer (DS) record in the parent domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing. Deactivate the key-signing keys (KSKs).
   • DDeactivate the key-signing keys (KSKs). Delete the designated signer (DS) record of the domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing.

   Show answer

   Answer: C

   Next question

3. Question 283 · 294 in bank

   A company needs to build an integration with its internal ticketing system. The integration will require an AWS Lambda function. The Lambda function needs to query a REST API that is part of the internal ticketing system. The ticketing system's REST API is accessible only through an Application Load Balancer (ALB) that is in a private subnet in the company's VPC. The company deploys the Lambda function with the following infrastructure as code (IaC):

   

   The IaC deployment succeeds, but the deployed Lambda function times out when it tries to access the ticketing system. How can the company give the Lambda function the ability to access the ticketing system?

   • ACreate an AWS PrivateLink endpoint service. Expose the service to the Lambda function.
   • BAttach the Lambda function to the ALB's target group by creating a new aws_lb_target_group_attachment resource. Configure the resource to reference both the ALB's ARN and the Lambda function's ARN.
   • CUpdate the Lambda function's security group to include appropriate inbound rules that permit traffic from the VPC.
   • DAdd a vpc_config section to the Lambda function resource. Configure the vpc_config section to include one or more security group IDs and one or more private subnet IDs that permit access to the ALB.

   Show answer

   Answer: D

   Next question

4. Question 284 · 294 in bank

   A company has several application accounts that include dual-stack VPCs. The company wants to implement a centralized DNS solution that supports IPv6. A network engineer deploys a shared services VPC. The network engineer sets up network connectivity between the company's application VPCs, the shared services VPC, and the company's on-premises environment with support for IPv4 and IPv6 traffic. The network engineer is using Amazon Route 53 to implement a centralized DNS solution. The network engineer needs to ensure that resources in the application VPCs have the ability to perform DNS queries against an on-premises DNS resolver. Which solution will meet this requirement?

   • ACreate a Route 53 Resolver outbound endpoint in the shared services VPC within a dual-stack subnet. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts.
   • BCreate a Route 53 Resolver inbound endpoint in the shared services VPC within a subnet that supports only IPv6. Use AWS Resource Access Manager (AWS RAM) to share the endpoint to the application accounts.
   • CCreate a Route 53 Resolver outbound endpoint within a dual-stack subnet in each application VPUse AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts.
   • DCreate a Route 53 Resolver inbound endpoint within a subnet that supports only IPv4 in each application VPC. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the shared services account.

   Show answer

   Answer: A

   Next question

5. Question 285 · 294 in bank

   A company uses an organization in AWS Organizations to manage many AWS accounts that host many VPCs and workloads. The company has an AWS Direct Connect connection between a data center and AWS. The company uses a transit gateway in a central network account to connect the workload VPCs to the data center. The company wants to tag each transit gateway attachment automatically with information from tags that are attached to each requester account VPC. The company provisions an IAM role in every account. The company assigns the IAM role permissions to retrieve the required tag data from the VPCs and a trust policy that allows principals in the central network account to invoke the IAM role. Which solution will meet these requirements?

   • AConfigure AWS Identity and Access Management Access Analyzer to monitor the transit gateway for new attachments. Configure IAM Access Analyzer to invoke an AWS Systems Manager runbook that assumes the IAM role in the requester account and tags the attachment with the required information.
   • BConfigure an SCP to monitor the transit gateway for new attachments. Configure the SCP to invoke an AWS CloudFormation stack template in the account that requests an attachment to tag the attachment.
   • CConfigure Amazon VPC IP Address Manager (IPAM) and register the transit gateway. Configure IPAM to run an AWS CDK function when a new IP address is requested from the transit gateway for a new attachment. Configure the CDK function to assume the IAM role in the requester account and to tag the attachment with the required information.
   • DConfigure AWS Network Manager and register the transit gateway. Create an Amazon EventBridge rule to receive attachment notifications from Network with the required information. Manager and to invoke an AWS Lambda function that assumes the IAM role in the requester account. Configure the Lambda function to tag the attachment.

   Show answer

   Answer: D

   Next question

6. Question 286 · 294 in bank

   Select 3

   A company is using AWS Fargate to deploy many containerized web applications to a VPC. The applications must all be reachable through various DNS names on the standard port for HTTPS traffic. The company uses an Application Load Balancer (ALB) to handle traffic to each of the applications. The company uses the AWS Cloud Development Kit (AWS CDK) to automate the deployment process. The company uses two types of CDK stacks. The company uses one common stack to build the VPC itself and other shared infrastructure. The company also uses a set of application-specific stacks that contain details and logic for each application. The company needs to correctly allocate ALB-related resources between the two types of stacks. Which combination of solutions will provide a repeatable allocation of resources to the common stack and application-specific stacks? (Choose three.)

   • AALB listener in the common stack
   • BALB listener in the application-specific stacks
   • CALB listener host header rule in the common stack
   • DALB listener host header rule in the application-specific stacks
   • EALB target group in the common stack
   • FALB target group in the application-specific stacks

   Show answer

   Answer: ADF

   Next question

7. Question 287 · 294 in bank

   A company notices VPC flow log data that shows some company traffic is going to malicious websites. The company identifies the Amazon EC2 instance that is sending traffic to the malicious websites and determines that the application that runs on the instance is compromised. Similar security events have happened multiple times at the company in the past. The company reacted to previous security events by blocking the malicious websites. The company needs a scalable solution to prevent similar security events in the future. Which solution will meet this requirement with the LEAST operational overhead?

   • ASet up an EC2 instance to run firewall software in the VPC. Route all traffic through the firewall EC2 instance. Maintain a list of known malicious websites on the firewall instance. Disable the source and destination checks for the firewall instance.
   • BSet up an Application Load Balancer (ALB) in front of the problematic EC2 instance. Enable AWS WAF on the EC2 instance.
   • CSet up an Application Load Balancer (ALB) in front of the problematic EC2 instance. Enable AWS WAF on the ALB.
   • DSet up an Amazon Route 53 DNS Firewall rule group. Create a domain list that contains only the domains the application must communicate with to function. Add the domain list to the rule group. Associate the rule group with the VPC.

   Show answer

   Answer: D

   Next question

8. Question 288 · 294 in bank

   A company has a hybrid environment. The company uses AWS Direct Connect with a transit VIF attached to a transit gateway to connect its on-premises location to the AWS Cloud. The company operates from a single AWS account in the us-east-1 Region. The company has a legacy application that runs on premises with the corp.example.com DNS name. The company has created an Amazon Route 53 Resolver outbound endpoint and a Resolver rule in us-east-1 in the AWS account. As part of an expansion, the company creates one more AWS account for a new business unit that operates in us-east-1. The new account has VPCs that are attached to the transit gateway. The new account uses the existing Direct Connect connection to connect to the on-premises location. Applications that run in the new account's VPCs also need to access the on-premises location by using the corp.example.com DNS name. A network engineer needs to identify a solution to resolve the corp.example.com DNS name from the new account. Which solution will meet these requirements MOST cost-effectively?

   • ACreate a hosted transit VIF for the new account on the existing Direct Connect connection. In the new account, create a new Route 53 Resolver outbound endpoint. Also in the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the new rule with the VPCs in the new account.
   • BShare the Resolver rule from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). Associate the shared rule with the VPCs in the new account.
   • CShare the Route 53 Resolver outbound endpoint from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). In the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the new rule with the VPCs in the new account.
   • DCreate an AWS Site-to-Site VPN connection between the new account and the on-premises location. Attach the Site-to-Site VPN connection to the existing transit gateway. In the new account, create a new Route 53 Resolver outbound endpoint. Also in the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the rule with the VPCs in the new account.

   Show answer

   Answer: B

   Next question

9. Question 289 · 294 in bank

   Select 2

   A company has many VPCs in the us-east-1 Region. The company uses a transit gateway to connect the VPCs to one another. The company recently acquired a smaller company that has a single VPC named VPC-Z. A network engineer needs to onboard VPC-Z to the existing transit gateway. The network engineer notices an IP address overlap between VPC-Z and VPC-A. The network engineer must establish outbound connectivity from VPC-Z to all the company's other VPCs, including VPC-A. Which combination of solutions will meet this requirement? (Choose two.)

   • ACreate a new non-overlapping CIDR block in VPC-Z. Create two subnets that use the new CIDR block.
   • BCreate a new non-overlapping CIDR block in VPC-A. Create two subnets that use the new CIDR block.
   • CCreate a private NAT gateway in VPC-Z in a non-overlapping subnet. Advertise only the non-overlapping VPC-Z CIDR block to the transit gateway route table.
   • DCreate a private NAT gateway in VPC-A in a non-overlapping subnet. Advertise only the non-overlapping VPC-A CIDR block to the transit gateway route table.
   • ECreate a VPC peering connection between VPC-A and VPC-Z.

   Show answer

   Answer: AC

   Next question

10. Question 290 · 294 in bank

    Select 2

    A company has two on-premises data center locations named Data Center 1 and Data Center 2. Each data center has a company-managed customer router. Both data centers have a dedicated AWS Direct Connect connection to the same Direct Connect gateway that uses a private VIF. The company enabled Direct Connect SiteLink when the company created each private VIF. The company uses SiteLink to send data from one Direct Connect location to the other, bypassing AWS Regions. Data Center 2 hosts an application that a partner company needs to access. The partner wants to access the application from the partner's own data center by using the Direct Connect network. The company's network engineer needs to create a separate isolated network for the partner to establish connectivity between Data Center 2 and the partner's data center. Which combination of steps will meet these requirements? (Choose two.)

    • ACreate a new Direct Connect gateway for the partner in an AWS account. Share the account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VIF with the new Direct Connect gateway.
    • BProvision a separate transit VIF for the partner on the Direct Connect connection at Data Center 2. Connect the transit VIF to the partner-specific Direct Connect gateway.
    • CShare the company's AWS account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VIF with the existing Direct Connect gateway.
    • DProvision a separate private VIF for the partner on the Direct Connect connection at Data Center 2. Connect the private VIF to the partner-specific Direct Connect gateway. Enable SiteLink.
    • EProvision a separate public VIF for the partner on the Direct Connect connection at Data Center 2. Connect the public VIF to the partner-specific Direct Connect gateway. Enable SiteLink.

    Show answer

    Answer: AD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 281. 294 questions available.