AWS Certified Advanced Networking – Specialty294 questions across 30 pages are complete and free, with no account or card.
294 questions in this bank
Free access · progress saved on this device
A company has two AWS Direct Connect links. One Direct Connect link terminates in the us-east-1 Region, and the other Direct Connect link terminates in the af-south-1 Region. The company is using BGP to exchange routes with AWS. How should a network engineer configure BGP to ensure that af-south-1 is used as a secondary link to AWS?
Answer: B
A team of infrastructure engineers wants to automate the deployment of Application Load Balancer (ALB) components by using the AWS Cloud Development Kit (AWS CDK). The CDK application must deploy an infrastructure stack that is reusable and consistent across multiple environments, AWS Regions, and AWS accounts. The lead network architect on the project has already bootstrapped the target accounts. The lead network architect also has deployed core network components such as VPCs and Amazon Route 53 private hosted zones across the multiple environments and Regions. The infrastructure engineers must design the ALB components in the CDK application to use the existing core network components. Which combination of steps will meet this requirement with the LEAST manual effort between environment deployments? (Choose two.)
Answer: BC
BC. https://docs.aws.amazon.com/cdk/v2/guide/environments.html you can use environment variables to pass in values that vary across environments and Regions. You can use the --context flag when running cdk deploy to set environment variables for the CDK application. You can also use the CDK_DEFAULT_ACCOUNT and CDK_DEFAULT_REGION environment variables provided by the AWS CDK CLI to specify the target account and Region for deployment.
Source: Adapted from community discussion — Manh
A company has critical VPC workloads that connect to an on-premises data center through two redundant active-passive AWS Direct Connect connections. However, a recent outage on one Direct Connect connection revealed that it takes more than a minute for traffic to fail over to the secondary Direct Connect connection. The company wants to reduce the failover time from minutes to seconds. Which solution will provide the LARGEST reduction in the BGP failover time?
Answer: D
Asynchronous BFD is automatically turned on for all AWS Direct Connect interfaces on the AWS side. You can't configure BFD settings on the AWS side. When creating a BFD session, the BFD protocol always selects the longer and slower timer.
Source: Adapted from community discussion — Neo00
A European car manufacturer wants to migrate its customer-facing services and its analytics platform from two on-premises data centers to the AWS Cloud. The company has a 50-mile (80.4 km) separation between its on-premises data centers and must maintain that separation between its two locations in the cloud. The company also needs failover capabilities between the two locations in the cloud. The company's infrastructure team creates several accounts to separate workloads and responsibilities. The company provisions resources in the eu-west-3 Region and in the eu-central-1 Region. The company selects an AWS Direct Connect Partner in each Region and requests two resilient 1 Gbps fiber connections from each provider. The company's network engineer must establish a connection between all VPCs in the accounts and between the on-premises network and the AWS Cloud. The solution must provide access to all services in both Regions in case of network issues. Which solution will meet these requirements?
Answer: C
it's C To establish a connection between all VPCs in the accounts and between the on-premises network and the AWS Cloud, you need to create a Direct Connect gateway and a transit gateway in each Region. You also need to create a transit VIF on each of the Direct Connect connections and attach them to the Direct Connect gateway. Then, you need to attach the transit gateways to the Direct Connect gateway and peer them. Finally, you need to attach the transit gateways in each Region to the VPCs in the same Region.
Source: Adapted from community discussion — Manh
A company wants to analyze TCP traffic to the internet. The traffic originates from Amazon EC2 instances in the company's VPC. The EC2 instances initiate connections through a NAT gateway. The required information includes source and destination IP addresses, ports, and the first 8 bytes of payload of TCP segments. The company needs to collect, store, and analyze all the required data points. Which solution will meet these requirements?
Answer: A
VPC Flow Logs capture metadata about the network traffic, such as source and destination IP addresses, source and destination ports, protocol, packet and byte counts, start and end times of the flow, and more. This information is useful for monitoring and troubleshooting network traffic patterns, but it does not include the payload content of TCP segments. If you need to capture and analyze the payload data of TCP segments, you would need to use other monitoring and logging solutions, such as tapping into the network traffic with tools like Traffic Mirroring or using other packet capture mechanisms. These solutions can capture the actual data content for analysis, but they might require more advanced setup and configuration compared to VPC Flow Logs
Source: Adapted from community discussion — Manh
A company has three VPCs in a single AWS Region. Each VPC contains 15 Amazon EC2 instances, and no connectivity exists between the VPCs. The company is deploying a new application across all three VPCs. The application requires high bandwidth between the nodes. A network engineer must implement connectivity between the VPCs. Which solution will meet these requirements with the HIGHEST throughput?
Answer: B
VPC peering has no bandwidth limit unlike Transit Gateway (50Gb/s per VPC attachment) https://d1.awsstatic.com/whitepapers/building-a-scalable-and-secure-multi-vpc-aws-network-infrastructure.pdf "No bandwidth limits — With Transit Gateway, Maximum bandwidth (burst) per Availability Zone per VPC connection is 50 Gbps. VPC peering has no aggregate bandwidth. "
Source: Adapted from community discussion — sambb
A company has multiple AWS accounts. Each account contains one or more VPCs. A new security guideline requires the inspection of all traffic between VPCs. The company has deployed a transit gateway that provides connectivity between all VPCs. The company also has deployed a shared services VPC with Amazon EC2 instances that include IDS services for stateful inspection. The EC2 instances are deployed across three Availability Zones. The company has set up VPC associations and routing on the transit gateway. The company has migrated a few test VPCs to the new solution for traffic inspection. Soon after the configuration of routing, the company receives reports of intermittent connections for traffic that crosses Availability Zones. What should a network engineer do to resolve this issue?
Answer: B
Please note "IDS services for stateful inspection" - this implies the same appliance is followed for the life of the connection. This is only achieved by on the shared services VPC by enabling appliance mode support
Source: Adapted from community discussion — study_aws1
A network engineer needs to deploy an AWS Network Firewall firewall into an existing AWS environment. The environment consists of the following: • A transit gateway with all VPCs attached to it • Several hundred application VPCs • A centralized egress internet VPC with a NAT gateway and an internet gateway • A centralized ingress internet VPC that hosts public Application Load Balancers • On-premises connectivity through an AWS Direct Connect gateway attachment The application VPCs have workloads deployed across multiple Availability Zones in private subnets with the VPC route table s default route (0.0.0.0/0) pointing to the transit gateway. The Network Firewall firewall needs to inspect east-west (VPC-to-VPC) traffic and north-south (internet-bound and on-premises network) traffic by using Suricata compatible rules. The network engineer must deploy the firewall by using a solution that requires the least possible architectural changes to the existing production environment. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)
Answer: BCF
Option B: A centralized inspection VPC approach would lead to a minimal architectural change and efficiently use Network Firewall resources. Option C: HOME_NET is usually defined as your local network. In this case, it would include all your VPCs and on-premises networks. Option F: Configuring two transit gateway route tables, one associated with all the application VPCs and another with the inspection VPC, will help route traffic effectively for inspection. All outbound traffic from application VPCs would be routed to the inspection VPC for firewall checks, and then the inspected traffic would be routed to its destination (internet or another VPC).
Source: Adapted from community discussion — Certified101
A company is using a shared services VPC with two domain controllers. The domain controllers are deployed in the company's private subnets. The company is deploying a new application into a new VPC in the account. The application will be deployed onto an Amazon EC2 for Windows Server instance in the new VPC. The instance must join the existing Windows domain that is supported by the domain controllers in the shared services VPC. A transit gateway is attached to both the shared services VPC and the new VPC. The company has updated the route tables for the transit gateway, the shared services VPC, and the new VPC. The security groups for the domain controllers and the instance are updated and allow traffic only on the ports that are necessary for domain operations. The instance is unable to join the domain that is hosted on the domain controllers. Which combination of actions will help identify the cause of this issue with the LEAST operational overhead? (Choose two.)
Answer: AC
To identify the cause of this issue with the least operational overhead, you can use AWS Network Manager to perform a route analysis for the transit gateway network. You can specify the existing EC2 instance as the source and one of the domain controllers as the destination. You can repeat the route analysis for the second domain controller. This will help you verify if there is any routing issue between the EC2 instance and the domain controllers through the transit gateway. You can also review the VPC flow logs on the shared services VPC and the new VPC. VPC flow logs capture information about accepted and rejected IP traffic in your VPCs. You can use VPC flow logs to troubleshoot connectivity issues or monitor network traffic in your VPCs. You can view VPC flow logs in Amazon CloudWatch Logs or Amazon S3.
Source: Adapted from community discussion — Manh
A company has an order processing system that needs to keep credit card numbers encrypted. The company's customer-facing application runs as an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon CloudFront distribution is configured with the ALB as the origin. The company uses a third-party trusted certificate authority to provision its certificates. The company is using HTTPS for encryption in transit. The company needs additional field-level encryption to keep sensitive data encrypted during processing so that only certain application components can decrypt the sensitive data. Which combination of steps will meet these requirements? (Choose two.)
Answer: BE
Option A: CloudFront does not use certificates stored in AWS Certificate Manager (ACM) in the us-west-2 region. It uses certificates stored in the us-east-1 region, making this option incorrect. Option C: This is incorrect because the private key should not be uploaded to CloudFront for field-level encryption. Instead, the public key is used. A private key must remain confidential and not exposed or uploaded to public services. Option D: This option incorrectly suggests that the field-level encryption profile should be linked to GET requests. Field-level encryption is used for encrypting sensitive information coming in POST requests (like form submissions with credit card details), not for GET requests. Therefore, this option is incorrect.
Source: Adapted from community discussion — Certified101
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
ANS-C01 practice, question 51. 294 questions available.
Version 1.0.0. How we source questions