ANS-C01 practice questions 291–294

1. Question 291 · 294 in bank

   A company wants to use SSL/TLS certificates that are issued by AWS Certificate Manager (ACM) to secure the company's social media web application. The application runs on backend Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 to manage DNS records. The company needs to integrate ACM with the EC2 instances and Route 53. Which solution will meet this requirement?

   • ARequest a public certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the public certificate Configure the A record in Route 53 to point to the ALB alias.
   • BRequest a private certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the private certificate. Configure the A record in Route 53 to point to the ALB domain name.
   • CRequest two private certificates from ACM for the domain name that is configured in Route 53. Configure the ALB to use one private certificate. Configure the A record in Route 53 to point to the ALB alias. Configure the backend EC2 instances to use the second private certificate.
   • DRequest a private certificate and a public certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the public certificate. Configure the A record in Route 53 to point to the ALB domain name. Configure the backend EC2 instances to use the private certificate.

   Show answer

   Answer: A

   Next question

2. Question 292 · 294 in bank

   A company has an AWS Direct Connect connection between an on-premises data center and a single private VIF in the company's VPC. The VPC contains resources that the company has secured by using security groups and network ACLs. A network engineer adds a subnet in the company's data center during a maintenance period. The network engineer notices that the BGP status for the private VIF is down after the maintenance activity. The Direct Connect connection was fully operational before the maintenance period. The network team verifies that layer 2 connectivity is working between the company’s router and the Direct Connect router. The networking engineer must resolve this issue. Which solution will meet this requirement?

   • AUse route filters or aggregation on the company's router to limit the routes that are advertised from the company’s router.
   • BAdd a route policy to the company's router to ensure that all routes that are advertised from the company's router are tagged with a correct BGP community string that begins in "7224".
   • CRevalidate the physical and logical path between the company's router and the Direct Connect router, including any Direct Connect Partner.
   • DEnsure that security groups and network ACLs allow TCP communications to port 179.

   Show answer

   Answer: A

   Next question

3. Question 293 · 294 in bank

   A company uses AWS Cloud WAN as a primary connectivity solution to establish communication between VPCs in a multi-account and multi-Region environment. The company has created an attachment policy statement in the AWS Cloud WAN core network policy. The attachment policy requires acceptance for new VPC attachments, regardless of the segment that the new VPC attachment needs to be associated with. The company wants to automate acceptance for new VPC attachments based on specific conditions. The company creates an AWS Lambda function to check for the specific conditions. A network engineer must integrate the Lambda function with the company’s existing architecture. Which solution will meet these requirements in the MOST cost-effective way?

   • AUpdate the AWS Cloud WAN core network policy to create a network function group. Select the require acceptance option. Create a service insertion segment action that targets the Lambda function.
   • BCreate an Amazon EventBridge rule to match AWS Network Manager events for the VPC attachments. Configure the EventBridge rule to invoke the Lambda function when the rule matches.
   • CUse Amazon CloudWatch logs to stream AWS CloudTrail logs to an Amazon Kinesis data stream. Configure an event source mapping to target the Lambda function to process the event stream.
   • DConfigure AWS Network Manager as a source for a pipe in Amazon EventBridge Pipes. Create a filter in the pipe for new VPC attachments. Set the Lambda function as the target of the pipe.

   Show answer

   Answer: B

   Next question

4. Question 294 · 294 in bank

   A company hosts multiple workloads in a single VPC that has public subnets and private subnets. The company establishes an AWS Direct Connect connection to provide connectivity between the company’s on-premises network and the VPC. The company purchases a domain in its AWS account. The domain needs to resolve to a private Application Load Balancer (ALB) for requests that originate from the company's network. The domain needs to resolve to a public ALB for requests that originate from the internet. Which solution will meet these requirements?

   • ACreate an Amazon CloudFront distribution for the domain. Create an AWS Lambda@Edge function that inspects each request and routes requests from the internet to the public ALB. Configure the Lambda@Edge function to route requests from the company’s network to the private ALB. Create an Amazon Route 53 public hosted zone for the domain. Include an A record that is configured as an alias that points to the CloudFront distribution.
   • BCreate an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALCreate a Route 53 private hosted zone for the domain. Include an alias record that points to the private ALConfigure a Route 53 inbound resolver endpoint on the VPC. Configure the company's network DNS to forward queries for the domain to the endpoint.
   • CCreate an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALB. Create an additional alias record for the domain that routes to the private ALB. Associate a geolocation routing policy with the CIDR range of the company’s network.
   • DDeploy new Amazon EC2 instances that host DNS servers in each of the private subnets. Configure the DNS servers to return the IP address of the public ALB for requests from the internet. Configure the DNS servers to return the IP address of the private ALB for requests from the company’s network. Configure a public Amazon Route 53 inbound resolver to forward all requests for the domain to the EC2 instances. Enable client IP preservation.

   Show answer

   Answer: B

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 291. 294 questions available.