ANS-C01 practice questions 41–50

1. Question 41 · 294 in bank

   Select 2

   A company deploys an internal website behind an Application Load Balancer (ALB) in a VPC. The VPC has a CIDR block of 172.31.0.0/16. The company creates a private hosted zone for the domain example.com for the website in Amazon Route 53. The company establishes an AWS Site-to-Site VPN connection between its office network and the VPC. A network engineer needs to set up a DNS solution so that employees can visit the internal webpage by accessing a private domain URL (https://example.com) from the office network. Which combination of steps will meet this requirement? (Choose two.)

   • ACreate an alias record that points to the ALB in the Route 53 private hosted zone.
   • BCreate a CNAME record that points to the ALB internal domain in the Route 53 private hosted zone.
   • CCreate a Route 53 Resolver inbound endpoint. On the office DNS server, configure a conditional forwarder to forward the DNS queries to the Route 53 Resolver inbound endpoint.
   • DCreate a Route 53 Resolver outbound endpoint. On the office DNS server, configure a conditional forwarder to forward the DNS queries to the Route 53 Resolver outbound endpoint.
   • EOn the office DNS server, configure a conditional forwarder for the private domain to the VPC DNS at 172.31.0.2.

   Show answer

   Answer: AC

   Explanation

   AC is correct - why would you select A & B ? makes no sense, Alias records are free for AWS resources, you would get charged for lookups for CNAME records.

   Source: Adapted from community discussion — Certified101

   References

   • AWS documentation

   Next question

2. Question 42 · 294 in bank

   A company is deploying AWS Cloud WAN with edge locations in the us-east-1 Region and the ap-southeast-2 Region. Individual AWS Cloud WAN segments are configured for the development environment, the production environment, and the shared services environment at each edge location. Many new VPCs will be deployed for the environments and will be configured as attachments to the AWS Cloud WAN core network. The company's network team wants to ensure that VPC attachments are configured for the correct segment. The network team will tag the VPC attachments by using the Environment key with a value of the corresponding environment segment name. The segment for the production environment in us-east-1 must require acceptance for attachment requests. All other attachment requests must not require acceptance. Which solution will meet these requirements?

   • ACreate a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag:Environment values to their respective segments.
   • BCreate a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag.Environment values to their respective segments.
   • CCreate a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1.
   • DCreate a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1.

   Show answer

   Answer: B

   Explanation

   CD - are not ok because the rules are processed in order and if first rule is matched will not go to second rule ( like in NACL) and we want to enforce attachment acceptance Now discussion is between A and B. Because question is saying: The segment for the production environment in us-east-1 must require acceptance" you basically need an AND between production env and us-east-1. If the question was saying " The segment for the production environment must require acceptance" then the answer will become A because you need to match production env without taking care about region.

   Source: Adapted from community discussion — Blitz1

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 43 · 294 in bank

   A company is migrating applications from a data center to AWS. Many of the applications will need to exchange data with the company's on-premises mainframe. The company needs to achieve 4 Gbps transfer speeds to meet peak traffic demands. A network engineer must design a highly available solution that maximizes resiliency. The solution must be able to withstand the loss of circuits or routers. Which solution will meet these requirements?

   • AOrder four 10 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate one connection from each Direct Connect location to a router at the company location. Terminate the other connection from each Direct Connect location to a different router at the company location.
   • BOrder two 10 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate the connection from each Direct Connect location to a different router at the company location.
   • COrder four 1 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate one connection from each Direct Connect location to a router at the company location. Terminate the other connection from each Direct Connect location to a different router at the company location.
   • DOrder two 1 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate the connection from each Direct Connect location to a different router at the company location.

   Show answer

   Answer: A

   Explanation

   I go with B, Option A suggests ordering four 10 Gbps Direct Connect connections, which may be unnecessary for achieving the required 4 Gbps transfer speeds and could increase costs without providing significant benefits.

   Source: Adapted from community discussion — tcp22

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 44 · 294 in bank

   A company has 10 web server Amazon EC2 instances that run in an Auto Scaling group in a production VPC. The company has 10 other web servers that run in an on-premises data center. The company has a 10 Gbps AWS Direct Connect connection between the on-premises data center and the production VPC. The company needs to implement a load balancing solution that receives HTTPS traffic from thousands of external users. The solution must distribute the traffic across the web servers on AWS and the web servers in the on-premises data center. Regardless of the location of the web servers, HTTPS requests must go to the same web server throughout the entire session. Which solution will meet these requirements?

   • ACreate a Network Load Balancer (NLB) in the production VPC. Create a target group. Specify ip as the target type. Register the EC2 instances and the on-premises servers with the target group Enable connection draining on the NLB
   • BCreate an Application Load Balancer (ALB) in the production VPC. Create a target group Specify ip as the target type. Register the EC2 instances and the on-premises servers with the target group. Enable application-based session affinity (sticky sessions) on the ALB.
   • CCreate a Network Load Balancer (NLB) in the production VPCreate a target group. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target group. Enable session affinity (sticky sessions) on the NLB.
   • DCreate an Application Load Balancer (ALB) in the production VPC. Create a target group. Specify instance as the target type Register the EC2 instances and the on-premises servers with the target group Enable application-based session affinity (sticky sessions) on the ALB.

   Show answer

   Answer: B

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 45 · 294 in bank

   Select 3

   A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company has decided to use AWS Site-to-Site VPN to establish connectivity between its on-premises network and its AWS environment. The company does not have a static public IP address for its on-premises network. A network engineer must implement a solution to initiate the VPN connection on the AWS side of the connection for traffic from the AWS environment to the on-premises network. Which combination of steps should the network engineer take to establish VPN connectivity between the transit gateway and the on-premises network? (Choose three.)

   • AConfigure the Site-to-Site VPN tunnel options to use Internet Key Exchange version 1 (IKEv1).
   • BConfigure the Site-to-Site VPN tunnel options to use Internet Key Exchange version 2 (IKEv2).
   • CUse a private certificate authority (CA) from AWS Private Certificate Authority to create a certificate.
   • DUse a public certificate authority (CA) from AWS Private Certificate Authority to create a certificate.
   • ECreate a customer gateway. Specify the current dynamic IP address of the customer gateway device’s external interface.
   • FCreate a customer gateway without specifying the IP address of the customer gateway device.

   Show answer

   Answer: BCF

   Explanation

   For people who said F is wrong, please read this 'An IP address is not required when you are using a private certificate from AWS Private Certificate Authority.' https://docs.aws.amazon.com/vpn/latest/s2svpn/cgw-options.html

   Source: Adapted from community discussion — Neo00

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 46 · 294 in bank

   Select 3

   A company has expanded its network to the AWS Cloud by using a hybrid architecture with multiple AWS accounts. The company has set up a shared AWS account for the connection to its on-premises data centers and the company offices. The workloads consist of private web-based services for internal use. These services run in different AWS accounts. Office-based employees consume these services by using a DNS name in an on-premises DNS zone that is named example.internal. The process to register a new service that runs on AWS requires a manual and complicated change request to the internal DNS. The process involves many teams. The company wants to update the DNS registration process by giving the service creators access that will allow them to register their DNS records. A network engineer must design a solution that will achieve this goal. The solution must maximize cost-effectiveness and must require the least possible number of configuration changes. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

   • ACreate a record for each service in its local private hosted zone (serviceA.account1.aws.example.internal). Provide this DNS record to the employees who need access.
   • BCreate an Amazon Route 53 Resolver inbound endpoint in the shared account VPC. Create a conditional forwarder for a domain named aws.example.internal on the on-premises DNS servers. Set the forwarding IP addresses to the inbound endpoint's IP addresses that were created.
   • CCreate an Amazon Route 53 Resolver rule to forward any queries made to onprem.example.internal to the on-premises DNS servers.
   • DCreate an Amazon Route 53 private hosted zone named aws.example.internal in the shared AWS account to resolve queries for this domain.
   • ELaunch two Amazon EC2 instances in the shared AWS account. Install BIND on each instance. Create a DNS conditional forwarder on each BIND server to forward queries for each subdomain under aws.example.internal to the appropriate private hosted zone in each AWS account. Create a conditional forwarder for a domain named aws.example.internal on the on-premises DNS servers. Set the forwarding IP addresses to the IP addresses of the BIND servers.
   • FCreate a private hosted zone in the shared AWS account for each account that runs the service. Configure the private hosted zone to contain aws.example.internal in the domain (account1.aws.example.internal). Associate the private hosted zone with the VPC that runs the service and the shared account VPC.

   Show answer

   Answer: BDF

   Explanation

   B. Create an Amazon Route 53 Resolver inbound endpoint in the shared account VPC. Create a conditional forwarder for a domain named aws.example.internal on the on-premises DNS servers. Set the forwarding IP addresses to the inbound endpoint's IP addresses that were created. This will enable DNS resolution between on-premises networks and AWS. D. Create an Amazon Route 53 private hosted zone named aws.example.internal in the shared AWS account to resolve queries for this domain. This allows you to simplify DNS management for your AWS services and resources within your shared account. F. Create a private hosted zone in the shared AWS account for each account that runs the service. Configure the private hosted zone to contain aws.example.internal in the domain (account1.aws.example.internal). Associate the private hosted zone with the VPC that runs the service and the shared account VPC. This allows individual AWS accounts to maintain their DNS entries.

   Source: Adapted from community discussion — AdamWest

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 47 · 294 in bank

   Select 3

   A company's AWS environment has two VPCs. VPC A has a CIDR block of 192.168.0.0/16. VPC B has a CIDR block of 10.0.0.0/16. Each VPC is deployed in a separate AWS Region. The company has remote users who work outside the company's offices. These users need to connect to an application that is running in the VPCs. Traffic to and from the VPCs over the internet must be encrypted. A network engineer must set up connectivity between the remote users and the VPCs. Which combination of steps should the network engineer take to meet these requirements with the LEAST management overhead? (Choose three.)

   • AEstablish an AWS Site-to-Site VPN connection between VPC A and VPC B.
   • BEstablish a VPC peering connection between VPC A and VPC B.
   • CCreate an AWS Client VPN endpoint in VPC A and VPC B Add an authorization rule to grant access to VPC A and VPC B.
   • DCreate an AWS Client VPN endpoint in VPC A Add an authorization rule to grant access to VPC A and VPC B.
   • EAdd a route to the AWS Client VPN endpoint’s route table to direct traffic to VPC B.
   • FAdd a route to the AWS Client VPN endpoint's route table to direct traffic to VPC A.

   Show answer

   Answer: BDE

   Explanation

   BDE, i was doubting but here's what I found. Quote: "The procedure for allowing access to a peered VPC outlined below, is only required if the Client VPN endpoint was configured for split-tunnel mode. In full-tunnel mode, access to the peered VPC is allowed by default." https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html

   Source: Adapted from community discussion — JosMo

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 48 · 294 in bank

   Select 2

   A company uses Amazon Route 53 to register a public domain, example.com, in an AWS account. A central services group manages the account. The company wants to create a subdomain, test.example.com, in another AWS account to offer name services for Amazon EC2 instances that are hosted in the account. The company does not want to migrate the parent domain to the subdomain account. A network engineer creates a new Route 53 hosted zone for the subdomain in the second account. Which combination of steps must the network engineer take to complete the task? (Choose two.)

   • AAdd records for the hosts of the new subdomain to the new Route 53 hosted zone.
   • BUpdate the DNS service for the parent domain by adding name server (NS) records for the subdomain.
   • CUpdate the DNS service for the subdomain by adding name server (NS) records for the parent domain.
   • DCreate an alias record from the parent domain that points to the hosted zone for the subdomain in the second account.
   • EAdd a start of authority (SOA) record in the parent domain for the subdomain.

   Show answer

   Answer: AB

   References

   • AWS documentation

   Next question

9. Question 49 · 294 in bank

   Select 2

   An IoT company collects data from thousands of sensors that are deployed in the Unites States and South Asia. The sensors use a proprietary communication protocol that is built on UDP to send the data to a fleet of Amazon EC2 instances. The instances are in an Auto Scaling group and run behind a Network Load Balancer (NLB). The instances, Auto Scaling group, and NLB are deployed in the us-west-2 Region. Occasionally, the data from the sensors in South Asia gets lost in transit over the internet and does not reach the EC2 instances. Which solutions will resolve this issue? (Choose two.)

   • AUse AWS Global Accelerator with the existing NLB.
   • BCreate an Amazon CloudFront distribution. Specify the existing NLB as the origin.
   • CCreate a second deployment of the EC2 instances and the NLB in the ap-south-1 Region. Use an Amazon Route 53 latency routing policy to resolve to the Region that provides the least latency.
   • DCreate a second deployment of the EC2 instances and the NLB in the ap-south-1 Region. Use an Amazon Route 53 failover routing policy to resolve to an alternate Region in case packets are dropped.
   • ETurn on enhanced networking on the EC2 instances by using the most recent Elastic Network Adapter (ENA) drivers.

   Show answer

   Answer: AC

   Explanation

   Global Accelerator is one option Another option is to have a second fleet of ec2 instances deployed in South Asia region and then have Route 53 latency based routing policy enabled Hence A and C are the right answers

   Source: Adapted from community discussion — Pratap

   References

   • AWS documentation

   Next question

10. Question 50 · 294 in bank

    A company has an application that runs on a fleet of Amazon EC2 instances. A new company regulation mandates that all network traffic to and from the EC2 instances must be sent to a centralized third-party EC2 appliance for content inspection. Which solution will meet these requirements?

    • AConfigure VPC flow logs on each EC2 network interface. Publish the flow logs to an Amazon S3 bucket. Create a third-party EC2 appliance to acquire flow logs from the S3 bucket. Log in to the appliance to monitor network content.
    • BCreate a third-party EC2 appliance in an Auto Scaling group fronted by a Network Load Balancer (NLB). Configure a mirror session. Specify the NLB as the mirror target. Specify a mirror filter to capture inbound and outbound traffic. For the source of the mirror session, specify the EC2 elastic network interfaces for all the instances that host the application.
    • CConfigure a mirror session. Specify an Amazon Kinesis Data Firehose delivery stream as the mirror target. Specify a mirror filter to capture inbound and outbound traffic. For the source of the mirror session, specify the EC2 elastic network interfaces for all the instances that host the application. Create a third-party EC2 appliance. Send all traffic to the appliance through the Kinesis Data Firehose delivery stream for content inspection.
    • DConfigure VPC flow logs on each EC2 network interface. Send the logs to Amazon CloudWatch. Create a third-party EC2 appliance. Configure a CloudWatch filter to send the flow logs to Amazon Kinesis Data Firehose to load the logs into the appliance.

    Show answer

    Answer: B

    Explanation

    You can use the following resources as traffic mirror targets: Network interfaces of type interface Network Load Balancers Gateway Load Balancer endpoints https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-targets.html

    Source: Adapted from community discussion — Wiss7

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 41. 294 questions available.