ANS-C01 practice questions 21–30

1. Question 21 · 294 in bank

   Two companies are merging. The companies have a large AWS presence with multiple VPCs and are designing connectivity between their AWS networks. Both companies are using AWS Direct Connect with a Direct Connect gateway. Each company also has a transit gateway and multiple AWS Site-to-Site VPN connections from its transit gateway to on-premises resources. The new solution must optimize network visibility, throughput, logging, and monitoring. Which solution will meet these requirements?

   • AConfigure a Site-to-Site VPN connection between each company's transit gateway to establish reachability between the respective networks. Configure VPC Flow Logs for all VPCs. Publish the flow logs to Amazon CloudWatch. Use VPC Reachability Analyzer to monitor connectivity.
   • BConfigure a Site-to-Site VPN connection between each company's transit gateway to establish reachability between the respective networks. Configure VPC Flow Logs for all VPCs. Publish the flow logs to Amazon CloudWatch. Use AWS Transit Gateway Network Manager to monitor the transit gateways and their respective connections.
   • CConfigure transit gateway peering between each company's transit gateway. Configure VPC Flow Logs for all VPCs. Publish the flow logs to Amazon CloudWatch. Use VPC Reachability Analyzer to monitor connectivity.
   • DConfigure transit gateway peering between each company's transit gateway. Configure VPC Flow Logs for all VPCs. Publish the flow logs to Amazon CloudWatch. Use AWS Transit Gateway Network Manager to monitor the transit gateways, their respective connections, and the transit gateway peering link.

   Show answer

   Answer: D

   Explanation

   transit gateway peering will allow the communication between all networks. To monitor the overall infrastructure, AWS Transit Gateway Network Manager is utilized for this purpose. https://aws.amazon.com/transit-gateway/network-manager/

   Source: Adapted from community discussion — albertkr

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 22 · 294 in bank

   A company has a single VPC in the us-east-1 Region. The company is planning to set up a new VPC in the us-east-2 Region. The existing VPC has an AWS Site-to-Site VPN connection to the company's on-premises environment and uses a virtual private gateway. A network engineer needs to implement a solution to establish connectivity between the existing VPC and the new VPC. The solution also must implement support for IPv6 for the new VPC. The company has new on-premises resources that need to connect to VPC resources by using IPv6 addresses. Which solution will meet these requirements?

   • ACreate a new virtual private gateway in us-east-1. Attach the new virtual private gateway to the new VPC. Create two new Site-to-Site VPN connections to the new virtual private gateway with IPv4 and IPv6 support. Configure routing between the VPCs by using VPC peering.
   • BCreate a transit gateway in us-east-1 and in us-east-2. Attach the existing VPC and the new VPC to each transit gateway. Create a new Site-to-Site VPN connection to each transit gateway with IPv4 and IPv6 support. Configure transit gateway peering. Configure routing between the VPCs and the on-premises environment.
   • CCreate a new virtual private gateway in us-east-2. Attach the new virtual private gateway to the new VPCreate two new Site-to-Site VPN connections to the new virtual private gateway with IPv4 and IPv6 support. Configure routing between the VPCs by using VPC peering.
   • DCreate a transit gateway in us-east-1. Attach the existing VPC and the new VPC to the transit gateway. Create two new Site-to-Site VPN connections to the transit gateway with IPv4 and IPv6 support. Configure transit gateway peering. Configure routing between the VPCs and the on-premises environment.

   Show answer

   Answer: B

   Explanation

   B most scalable. However A, is correct if you consider the most effective, but because the question doesn't say that we need to save money, I picked the BEST option B.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 23 · 294 in bank

   A network engineer is working on a private DNS design to integrate AWS workloads and on-premises resources. The AWS deployment consists of five VPCs in the eu-west-1 Region that connect to the on-premises network over AWS Direct Connect. The VPCs communicate with each other by using a transit gateway. Each VPC is associated with a private hosted zone that uses the aws.example.internal domain. The network engineer creates an Amazon Route 53 Resolver outbound endpoint in a shared services VPC and attaches the shared services VPC to the transit gateway. The network engineer is implementing a solution for DNS resolution. Queries for hostnames that end with aws.example.internal must use the private hosted zone. Queries for hostnames that end with all other domains must be forwarded to a private on-premises DNS resolver. Which solution will meet these requirements?

   • AAdd a forwarding rule for “*” that targets the on-premises server's DNS IP address. Add a system rule for aws.example.internal that targets Route 53 Resolver.
   • BAdd a forwarding rule for aws.example.internal that targets Route 53 Resolver. Add a system rule for “.” that targets the Route 53 Resolver outbound endpoint.
   • CAdd a forwarding rule for “*” that targets the Route 53 Resolver outbound endpoint.
   • DAdd a forwarding rule for “.” that targets the Route 53 Resolver outbound endpoint.

   Show answer

   Answer: D

   Explanation

   Answer is : D don't need a rules for aws.external. Quote: "If the domain name in a query doesn't match the domain name in any other rules, Resolver forwards the query based on the settings in the autodefined "." (dot) rule. The dot rule applies to all domain names except some AWS internal domain names and record names in private hosted zones" ref : https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html#resolver-overview-forward-vpc-to-network-domain-name-matches

   Source: Adapted from community discussion — JosMo

   References

   • AWS documentation

   Next question

4. Question 24 · 294 in bank

   An ecommerce company is hosting a web application on Amazon EC2 instances to handle continuously changing customer demand. The EC2 instances are part of an Auto Scaling group. The company wants to implement a solution to distribute traffic from customers to the EC2 instances. The company must encrypt all traffic at all stages between the customers and the application servers. No decryption at intermediate points is allowed. Which solution will meet these requirements?

   • ACreate an Application Load Balancer (ALB). Add an HTTPS listener to the ALB. Configure the Auto Scaling group to register instances with the ALB's target group.
   • BCreate an Amazon CloudFront distribution. Configure the distribution with a custom SSL/TLS certificate. Set the Auto Scaling group as the distribution's origin.
   • CCreate a Network Load Balancer (NLB). Add a TCP listener to the NLB. Configure the Auto Scaling group to register instances with the NLB's target group.
   • DCreate a Gateway Load Balancer (GLB). Configure the Auto Scaling group to register instances with the GLB's target group.

   Show answer

   Answer: C

   Explanation

   C If you need to pass encrypted traffic to the targets without the load balancer decrypting it, create a TCP listener on port 443 instead of creating a TLS listener. https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html

   Source: Adapted from community discussion — Untamables

   References

   • AWS documentation

   Next question

5. Question 25 · 294 in bank

   Select 2

   A global film production company uses the AWS Cloud to encode and store its video content before distribution. The company's three global offices are connected to the us-east-1 Region through AWS Site-to-Site VPN links that terminate on a transit gateway with BGP routing activated. The company recently started to produce content at a higher resolution to support 8K streaming. The size of the content files has increased to three times the size of the content files from the previous format. Uploads of files to Amazon EC2 instances are taking 10 times longer than they did with the previous format. Which actions should a network engineer recommend to reduce the upload times? (Choose two.)

   • ACreate a second VPN tunnel from each office location to the transit gateway. Activate equal-cost multi-path (ECMP) routing.
   • BModify the transit gateway to activate Jumbo MTU on the VPN tunnels to each office location.
   • CReplace the existing VPN tunnels with new tunnels that have acceleration activated.
   • DUpgrade each EC2 instance to a modern instance type. Activate Jumbo MTU in the operating system.
   • EReplace the existing VPN tunnels with new tunnels that have IGMP activated.

   Show answer

   Answer: AC

   Explanation

   you can use Equal Cost Multi-Path (ECMP) routing to get a higher VPN bandwidth by aggregating multiple VPN tunnels. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-transit-gateway-vpn.html

   Source: Adapted from community discussion — Neo00

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 26 · 294 in bank

   An application team for a startup company is deploying a new multi-tier application into the AWS Cloud. The application will be hosted on a fleet of Amazon EC2 instances that run in an Auto Scaling group behind a publicly accessible Network Load Balancer (NLB). The application requires the clients to work with UDP traffic and TCP traffic. In the near term, the application will serve only users within the same geographic location. The application team plans to extend the application to a global audience and will move the deployment to multiple AWS Regions around the world to bring the application closer to the end users. The application team wants to use the new Regions to deploy new versions of the application and wants to be able to control the amount of traffic that each Region receives during these rollouts. In addition, the application team must minimize first-byte latency and jitter (randomized delay) for the end users. How should the application team design the network architecture for the application to meet these requirements?

   • ACreate an Amazon CloudFront distribution to align to each Regional deployment. Set the NLB for each Region as the origin for each CloudFront distribution. Use an Amazon Route 53 weighted routing policy to control traffic to the newer Regional deployments.
   • BCreate an AWS Global Accelerator accelerator and listeners for the required ports. Configure endpoint groups for each Region. Configure a traffic dial for the endpoint groups to control traffic to the newer Regional deployments. Register the NLBs with the endpoint groups.
   • CUse Amazon S3 Transfer Acceleration for the application in each Region. Adjust the amount of traffic that each Region receives from the Transfer Acceleration endpoints to the Regional NLBs.
   • DCreate an Amazon CloudFront distribution that includes an origin group. Set the NLB for each Region as the origins for the origin group. Use an Amazon Route 53 latency routing policy to control traffic to the new Regional deployments.

   Show answer

   Answer: B

   Explanation

   AWS Global Accelerator: It is a service that uses static IP addresses as Anycast, which provides a fixed entry point for your applications. Global Accelerator directs traffic over the AWS global network to optimal AWS endpoint based on health, geography, and routing policies you configure. Listeners and Endpoint Groups: Global Accelerator allows you to configure listeners for the required ports and endpoint groups for each Region where your application is deployed. Traffic Dial: The traffic dial allows you to control the percentage of traffic that is directed to each endpoint group. This is particularly useful during rollouts or canary deployments, where you want to gradually shift traffic to a new version of the application. Minimizing Latency: AWS Global Accelerator is designed to provide low-latency, high-throughput, and fault-tolerant access to your applications.

   Source: Adapted from community discussion — vikasj1in

   References

   • AWS documentation

   Next question

7. Question 27 · 294 in bank

   Select 2

   A company is deploying a new stateless web application on AWS. The web application will run on Amazon EC2 instances in private subnets behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The web application has a stateful management application for administration that will run on EC2 instances that are in a separate Auto Scaling group. The company wants to access the management application by using the same URL as the web application, with a path prefix of/management. The protocol, hostname, and port number must be the same for the web application and the management application. Access to the management application must be restricted to the company's on-premises IP address space. An SSL/TLS certificate from AWS Certificate Manager (ACM) will protect the web application. Which combination of steps should a network engineer take to meet these requirements? (Choose two.)

   • AInsert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the management application target group if there is a match. Edit the management application target group and enable stickiness.
   • BModify the default rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the management application target group if there is not a match. Enable group-level stickiness in the rule attributes.
   • CInsert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the X-Forwarded-For HTTP header for the on-premises IP address space. Forward requests to the management application target group if there is a match. Enable group-level stickiness in the rule attributes.
   • DModify the default rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the web application target group if there is not a match.
   • EForward all requests to the web application target group. Edit the web application target group and disable stickiness.

   Show answer

   Answer: AE

   Explanation

   DEFAULT RULES CANNOT HAVE CONDITIONS so B & D are out. Changing to A & E. A to forward people to managment with stickiness E to forward people to the web application without stickiness https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

   Source: Adapted from community discussion — Certified101

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 28 · 294 in bank

   Select 2

   A company deploys a software solution on Amazon EC2 instances that are in a cluster placement group. The solution's UI is a single HTML page. The HTML file size is 1,024 bytes. The software processes files that exceed 1,024 MB in size. The software shares files over the network to clients upon request. The files are shared with the Don't Fragment flag set. Elastic network interfaces of the EC2 instances are set up with jumbo frames. The UI is always accessible from all allowed source IP addresses, regardless of whether the source IP addresses are within a VPC, on the internet, or on premises. However, clients sometimes do not receive files that they request because the files fail to travel successfully from the software to the clients. Which options provide a possible root cause of these failures? (Choose two.)

   • AThe source IP addresses are from on-premises hosts that are routed over AWS Direct Connect.
   • BThe source IP addresses are from on-premises hosts that are routed over AWS Site-to-Site VPN.
   • CThe source IP addresses are from hosts that connect over the public internet.
   • DThe security group of the EC2 instances does not allow ICMP traffic.
   • EThe operating system of the EC2 instances does not support jumbo frames.

   Show answer

   Answer: BC

   Explanation

   Jumbo frames allow more than 1500 bytes of data by increasing the payload size per packet, and thus increasing the percentage of the packet that is not packet overhead. Fewer packets are needed to send the same amount of usable data. However, traffic is limited to a maximum MTU of 1500 in the following cases: Traffic over an internet gateway Traffic over an inter-region VPC peering connection Traffic over VPN connections Traffic outside of a given AWS Region for EC2-Classic If packets are over 1500 bytes, they are fragmented, or they are dropped if the Don't Fragment flag is set in the IP header. regardless the security group allows icmp traffic to enable pmtud or not, the oversized packets will be dropped anyway due to don't fragment flag set.

   Source: Adapted from community discussion — albertkr

   References

   • AWS documentation

   Next question

9. Question 29 · 294 in bank

   A company has users who work from home. The company wants to move these users to Amazon WorkSpaces for additional security visibility. The company has deployed WorkSpaces in its own AWS account in VPC A. A network engineer decides to provide the security visibility by using two firewall appliances behind a Gateway Load Balancer (GWLB). The network engineer provisions another VPC, VPC B, in a separate account and deploys the two firewall appliances in separate Availability Zones. What should the network engineer do to configure the network connectivity for this solution?

   • ACreate a GWLB in VPC A with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the WorkSpaces account to the principal allow list of the GWLB endpoint. In the WorkSpaces account, create a VPC endpoint and specify the service name that the AWS Management Console provides for the GWLB endpoint. Modify the route tables of VPC A to point the default route to the VPC endpoint.
   • BCreate a GWLB in VPC B with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the WorkSpaces account to the principal allow list of the GWLB endpoint. In the WorkSpaces account, create a VPC endpoint and specify the service name that the AWS Management Console provides for the GWLB endpoint. Modify the route tables of VPC A to point the default route to the GWLB endpoint.
   • CCreate a GWLB in VPC B with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the WorkSpaces account to the principal allow list of the GWLB endpoint. In the WorkSpaces account, create a VPC endpoint and specify the service name that the AWS Management Console provides for the GWLB endpoint. Modify the route tables of VPC A to point the WorkSpaces subnet to the VPC endpoint.
   • DCreate a GWLB in VPC B with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the account that contains the firewall appliances to the principal allow list of the GWLB endpoint. In the WorkSpaces account, create a VPC endpoint and specify the service name that the AWS Management Console provides for the GWLB endpoint. Modify the route tables of VPC A to point the default route to the VPC endpoint.

   Show answer

   Answer: B

   Explanation

   i think workspace subnet will be used to point to local vpc communication. default route can be used for inspection vpc communication other than more specific route. 10.1.0.0 ---> local 0.0.0.0/0 ---> GWLBE

   Source: Adapted from community discussion — Balasmaniam

   Next question

10. Question 30 · 294 in bank

    A company plans to run a computationally intensive data processing application on AWS. The data is highly sensitive. The VPC must have no direct internet access, and the company has applied strict network security to control access. Data scientists will transfer data from the company's on-premises data center to the instances by using an AWS Site-to-Site VPN connection. The on-premises data center uses the network range 172.31.0.0/20 and will use the network range 172.31.16.0/20 in the application VPC. The data scientists report that they can start new instances of the application but that they cannot transfer any data from the on-premises data center. A network engineer enables VPC flow logs and sends a ping to one of the instances to test reachability. The flow logs show the following:

    

    The network engineer must recommend a solution that will give the data scientists the ability to transfer data from the on-premises data center. Which solution will meet these requirements?

    • AModify the security group for the application. Add an inbound rule to allow traffic from the on-premises data center network range to the application.
    • BModify the network ACLs for the VPC subnet. Add an inbound rule to allow traffic from the on-premises data center network range to the VPC subnet range.
    • CModify the network ACLs for the VPC subnet. Add an outbound rule to allow traffic from the VPC subnet range to the on-premises data center network range.
    • DModify the security group for the application. Add an outbound rule to allow traffic from the application to the on-premises data center network range.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 21. 294 questions available.