ANS-C01 practice questions 31–40

1. Question 31 · 294 in bank

   A company needs to temporarily scale out capacity for an on-premises application and wants to deploy new servers on Amazon EC2 instances. A network engineer must design the networking solution for the connectivity and for the application on AWS. The EC2 instances need to share data with the existing servers in the on-premises data center. The servers must not be accessible from the internet. All traffic to the internet must route through the firewall in the on-premises data center. The servers must be able to access a third-party web application. Which configuration will meet these requirements?

   • ACreate a VPC that has public subnets and private subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a NAT gateway in a public subnet. Create a route table, and associate the public subnets with the route table. Add a default route to the internet gateway. Create a route table, and associate the private subnets with the route table. Add a default route to the NAT gateway. Add routes for the data center subnets to the virtual private gateway. Deploy the application to the private subnets.
   • BCreate a VPC that has private subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a route table, and associate the private subnets with the route table. Add a default route to the virtual private gateway. Deploy the application to the private subnets.
   • CCreate a VPC that has public subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a route table, and associate the public subnets with the route table. Add a default route to the internet gateway. Add routes for the on-premises data center subnets to the virtual private gateway. Deploy the application to the public subnets.
   • DCreate a VPC that has public subnets and private subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a route table, and associate the public subnets with the route table. Add a default route to the internet gateway. Create a route table, and associate the private subnets with the route table. Add routes for the on-premises data center subnets to the virtual private gateway. Deploy the application to the private subnets.

   Show answer

   Answer: B

   Explanation

   note this requirement : The servers must not be accessible from the internet. All traffic to the internet must route through the firewall in the on-premises data center. So why do we use NAT GW here, if the requirement said ' All traffic to the internet must route through the firewall in the on-premises data center'

   Source: Adapted from community discussion — ryluis

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 32 · 294 in bank

   A company is deploying a web application into two AWS Regions. The company has one VPC in each Region. Each VPC has three Amazon EC2 instances as web servers behind an Application Load Balancer (ALB). The company already has configured an Amazon Route 53 public hosted zone for example.com. Users will access the application by using the fully qualified domain name (FQDN) of app.example.com. The company needs a DNS solution that allows global users to access the application. The solution must route the users' requests to the Region that provides the lowest response time. The solution must fail over to the Region that provides the next-lowest response time if the application is unavailable in the initially intended Region. Which solution will meet these requirements?

   • AFor each ALB, create an A record that has a geolocation routing policy to route app.example.com to the IP addresses of the ALB. Configure a Route 53 HTTP health check that monitors each ALB by IP address. Associate the health check with the A records.
   • BCreate an A record that has a geolocation routing policy to route app.example.com to the IP addresses for both ALBs. Configure a Route 53 health check that monitors TCP port 80 for each ALB by IP address. Associate the health check with the A records.
   • CCreate an A record that has a latency-based routing policy to route app.example.com as an alias to one of the ALBs. Configure a Route 53 health check that monitors TCP port 80 for each ALB by IP address. Associate the health check with the A records.
   • DFor each ALB, create an A record that has a latency-based routing policy to route app.example.com as an alias to the ALB. Set the value for Evaluate Target Health to Yes for the records.

   Show answer

   Answer: D

   Explanation

   Latency-Based Routing Policy: Latency-based routing is suitable for directing traffic to the AWS Region that provides the lowest latency or response time for users. This helps ensure that users are directed to the Region that can deliver the best performance. ALB Configuration: For each ALB, create an A record with a latency-based routing policy. This allows Route 53 to route traffic based on the latency observed from users' locations to the ALBs. Evaluate Target Health: Setting "Evaluate Target Health" to Yes ensures that Route 53 considers the health of the targets (ALBs) when making routing decisions. If the ALB in the initially intended Region becomes unavailable, Route 53 will automatically route traffic to the next healthiest Region.

   Source: Adapted from community discussion — vikasj1in

   References

   • AWS documentation

   Next question

3. Question 33 · 294 in bank

   A consulting company manages AWS accounts for its customers. One of the company's customers needs to add intrusion prevention for its environment without having to re-architect the environment. The customer's environment includes five VPCs in two AWS Regions in the United States. VPC-to-VPC connectivity is achieved through VPC peering. The customer does not plan to increase the number of VPCs within the next 2 years. The solution must accommodate unencrypted traffic. Which solution will meet these requirements?

   • AConfigure VPC security groups and network ACLs.
   • BUse an AWS Network Firewall centralized deployment model in each VPC.
   • CUse an AWS Network Firewall distributed deployment model in each VPC.
   • DDeploy AWS Shield in each VPC.

   Show answer

   Answer: C

   Explanation

   For centralized deployment model, AWS Transit Gateway is a prerequisite. Cannot add a new Shared VPC which is required for Centralized deployment.

   Source: Adapted from community discussion — Josh1217

   References

   • AWS documentation

   Next question

4. Question 34 · 294 in bank

   A company hosts its IT infrastructure in an on-premises data center. The company wants to migrate the infrastructure to the AWS Cloud in phases. A network engineer wants to set up a 10 Gbps AWS Direct Connect dedicated connection between the on-premises data center and VPCs. The company's network provider needs 3 months to provision the Direct Connect connection. In the meantime, the network engineer implements a temporary solution by deploying an AWS Site-to-Site VPN connection that terminates to a virtual private gateway. The network engineer observes that the bandwidth of the Site-to-Site VPN connection is capped at 1.25 Gbps despite a powerful customer gateway device. What should the network engineer do to improve the VPN connection bandwidth before the implementation of the Direct Connect connection?

   • AContact AWS Support to request a bandwidth quota increase for the existing Site-to-Site VPN connection.
   • BDiscuss the issue with the hardware vendor. Buy a bigger and more powerful customer gateway device that has faster encryption and decryption capabilities.
   • CCreate several additional Site-to-Site VPN connections that terminate on the same virtual gateway. Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously.
   • DCreate a transit gateway. Attach the VPCs to the transit gateway. Create several additional Site-to-Site VPN connections that terminate on the transit gateway. Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously.

   Show answer

   Answer: D

   Explanation

   D:- Ans why is high speed is need to below Per VPN connection, you can achieve 1.25 Gbps of throughput and 140,000 packets per second. When terminating the VPN connections in the Transit Gateway, you can use Equal Cost Multi-Path (ECMP) routing to get a higher VPN bandwidth by aggregating multiple VPN tunnels. To use ECMP, you need to configure dynamic routing in the VPN connections – ECMP is not supported using static routing. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-transit-gateway-vpn.html

   Source: Adapted from community discussion — Balasmaniam

   References

   • AWS documentation
   • AWS documentation
   • repost.aws documentation

   Next question

5. Question 35 · 294 in bank

   A company has two on-premises data center locations. There is a company-managed router at each data center. Each data center has a dedicated AWS Direct Connect connection to a Direct Connect gateway through a private virtual interface. The router for the first location is advertising 110 routes to the Direct Connect gateway by using BGP, and the router for the second location is advertising 60 routes to the Direct Connect gateway by using BGP. The Direct Connect gateway is attached to a company VPC through a virtual private gateway. A network engineer receives reports that resources in the VPC are not reachable from various locations in either data center. The network engineer checks the VPC route table and sees that the routes from the first data center location are not being populated into the route table. The network engineer must resolve this issue in the most operationally efficient manner. What should the network engineer do to meet these requirements?

   • ARemove the Direct Connect gateway, and create a new private virtual interface from each company router to the virtual private gateway of the VPC.
   • BChange the router configurations to summarize the advertised routes.
   • COpen a support ticket to increase the quota on advertised routes to the VPC route table.
   • DCreate an AWS Transit Gateway. Attach the transit gateway to the VPC, and connect the Direct Connect gateway to the transit gateway.

   Show answer

   Answer: B

   Explanation

   Option B) - You can announce a maximum of 100 prefixes to AWS.These routes can be automatically be propagated into subnet route tables • In order to advertise more than 100 prefixes, you should summarize the prefixes into larger range to reduce number of prefixes

   Source: Adapted from community discussion — study_aws1

   References

   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • repost.aws documentation

   Next question

6. Question 36 · 294 in bank

   A company has business operations in the United States and in Europe. The company's public applications are running on AWS and use three transit gateways. The transit gateways are located in the us-west-2, us-east-1, and eu-central-1 Regions. All the transit gateways are connected to each other in a full mesh configuration. The company accidentally removes the route to the eu-central-1 VPCs from the us-west-2 transit gateway route table. The company also accidentally removes the route to the us-west-2 VPCs from the eu-central-1 transit gateway route table. How can a network engineer identify the misconfiguration with the LEAST operational overhead?

   • AUse the Route Analyzer feature for AWS Transit Gateway Network Manager.
   • BUse the AWSSupport-SetupIPMonitoringFromVPC AWS Systems Manager Automation runbook. Push network telemetry data to Amazon CloudWatch Logs for analysis.
   • CUse VPC flow logs in eu-central-1 and us-west-2 to analyze the missing routes.
   • DUse Amazon VPC Traffic Mirroring in eu-central-1 or us-west-2 to take packet captures and troubleshoot the connectivity issues.

   Show answer

   Answer: A

   Explanation

   Route Analyzer to perform an analysis of the routes in your transit gateway route tables. Through AWS Network Manager, Route Analyzer analyzes the routing path between a specified source and destination, and returns information about the connectivity between components. You can use the Route Analyzer to do the following: Verify that the transit gateway route table configuration will work as expected before you start sending traffic. Validate your existing route configuration. Diagnose route-related issues that are causing traffic disruption in your global network.

   Source: Adapted from community discussion — woorkim

   References

   • AWS documentation

   Next question

7. Question 37 · 294 in bank

   A marketing company is using hybrid infrastructure through AWS Direct Connect links and a software-defined wide area network (SD-WAN) overlay to connect its branch offices. The company connects multiple VPCs to a third-party SD-WAN appliance transit VPC within the same account by using AWS Site-to-Site VPNs. The company is planning to connect more VPCs to the SD-WAN appliance transit VPC. However, the company faces challenges of scalability, route table limitations, and higher costs with the existing architecture. A network engineer must design a solution to resolve these issues and remove dependencies. Which solution will meet these requirements with the LEAST amount of operational overhead?

   • AConfigure a transit gateway to attach the VPCs. Configure a Site-to-Site VPN connection between the transit gateway and the third-party SD-WAN appliance transit VPC. Use the SD-WAN overlay links to connect to the branch offices.
   • BConfigure a transit gateway to attach the VPCs. Configure a transit gateway Connect attachment for the third-party SD-WAN appliance transit VPC. Use transit gateway Connect native integration of SD-WAN virtual hubs with AWS Transit Gateway.
   • CConfigure a transit gateway to attach the VPCs. Configure VPC peering between the VPCs and the third-party SD-WAN appliance transit VPUse the SD-WAN overlay links to connect to the branch offices.
   • DConfigure VPC peering between the VPCs and the third-party SD-WAN appliance transit VPC. Use transit gateway Connect native integration of SD-WAN virtual hubs with AWS Transit Gateway.

   Show answer

   Answer: B

   Explanation

   the use of AWS Transit Gateway with Transit Gateway Connect is a scalable and cost-effective solution to address the challenges of scalability, route table limitations, and higher costs associated with the existing architecture.

   Source: Adapted from community discussion — vikasj1in

   References

   • AWS documentation

   Next question

8. Question 38 · 294 in bank

   A company is running a hybrid cloud environment. The company has multiple AWS accounts as part of an organization in AWS Organizations. The company needs a solution to manage a list of IPv4 on-premises hosts that will be allowed to access resources in AWS. The solution must provide version control for the list of IPv4 addresses and must make the list available to the AWS accounts in the organization. Which solution will meet these requirements?

   • ACreate a customer-managed prefix list. Add entries for the initial list of on-premises IPv4 hosts. Create a resource share in AWS Resource Access Manager. Add the managed prefix list to the resource share. Share the resource with the organization.
   • BCreate a customer-managed prefix list. Add entries for the initial list of on-premises IPv4 hosts. Use AWS Firewall Manager to share the managed prefix list with the organization.
   • CCreate a security group. Add inbound rule entries for the initial list of on-premises IPv4 hosts. Create a resource share in AWS Resource Access Manager. Add the security group to the resource share. Share the resource with the organization.
   • DCreate an Amazon DynamoDB table. Add entries for the initial list of on-premises IPv4 hosts. Create an AWS Lambda function that assumes a role in each AWS account in the organization to authorize inbound rules on security groups based on entries from the DynamoDB table.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

9. Question 39 · 294 in bank

   Select 2

   A company's application is deployed on Amazon EC2 instances in a single VPC in an AWS Region. The EC2 instances are running in two Availability Zones. The company decides to use a fleet of traffic inspection instances from AWS Marketplace to inspect traffic between the VPC and the internet. The company is performing tests before the company deploys the architecture into production. The fleet is located in a shared inspection VPC behind a Gateway Load Balancer (GWLB). To minimize the cost of the solution, the company deployed only one inspection instance in each Availability Zone that the application uses. During tests, a network engineer notices that traffic inspection works as expected when the network is stable. However, during maintenance of the inspection instances, the internet sessions time out for some application instances. The application instances are not able to establish new sessions. Which combination of steps will remediate these issues? (Choose two.)

   • ADeploy one inspection instance in the Availability Zones that do not have inspection instances deployed.
   • BDeploy one additional inspection instance in each Availability Zone where the inspection instances are deployed.
   • CEnable the cross-zone load balancing attribute for the GWLB.
   • DDeploy inspection instances in an Auto Scaling group. Define a scaling policy that is based on CPU load.
   • EAttach the GWLB to all Availability Zones in the Region.

   Show answer

   Answer: BC

   Explanation

   A and E wrong. It's between B C D. Should be correct D but autoscaling gruop with CPU load not solve the issue, you have to detach the instance, make maintenance and after re-attach to ASG. It's complicated. Finally B C correct.

   Source: Adapted from community discussion — michele_scar

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 40 · 294 in bank

    A company has developed a new web application on AWS. The application runs on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate behind an Application Load Balancer (ALB) in the us-east-1 Region. The application uses Amazon Route 53 to host the DNS records for the domain. The content that is served from the website is mostly static images and files that are not updated frequently. Most of the traffic to the website from end users will originate from the United States. Some traffic will originate from Canada and Europe. A network engineer needs to design a solution that will reduce latency for end users at the lowest cost. The solution also must ensure that all traffic is encrypted in transit until the traffic reaches the ALB. Which solution will meet these requirements?

    • AConfigure the ALB to use an AWS Global Accelerator accelerator in us-east-1. Create a secure HTTPS listener. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the DNS name that is assigned to the accelerator for the ALB.
    • BConfigure the ALB to use a secure HTTPS listener. Create an Amazon CloudFront distribution. Set the origin domain name to point to the DNS record that is assigned to the ALConfigure the CloudFront distribution to use an SSL certificate. Set all behaviors to force HTTPS. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the DNS name that is assigned to the ALB.
    • CConfigure the ALB to use a secure HTTPS listener. Create an Amazon CloudFront distribution. Set the origin domain name to point to the DNS record that is assigned to the ALB. Configure the CloudFront distribution to use an SSL certificate and redirect HTTP to HTTPS. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the CloudFront distribution.
    • DConfigure the ALB to use an AWS Global Accelerator accelerator in us-east-1. Create a secure HTTPS listener. Create a second application stack on Amazon ECS on Fargate in the eu-west-1 Region. Create another secure HTTPS listener. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to use a latency-based routing policy to route to the DNS name that is assigned to the accelerator for the ALBs.

    Show answer

    Answer: C

    Explanation

    Global Accelerator needs NLB and static IP address which ALB won't have. A & D is out. When you create a distribution, CloudFront assigns a domain name to the distribution, such as d111111abcdef8.cloudfront.net. You can use this domain name in the URLs for your content. When you use a Route 53 domain name with a CloudFront distribution, use Amazon Route 53 to create an alias record that points to your CloudFront distribution. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html

    Source: Adapted from community discussion — lygf

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 31. 294 questions available.