ANS-C01 practice questions 61–70

1. Question 61 · 294 in bank

   A company has deployed a multi-VPC environment in the AWS Cloud. The company uses a transit gateway to connect all the VPCs together. In the past, the company has experienced a loss of connectivity between applications after changes to security groups, network ACLs, and route tables in a VPC. When these changes occur, the company wants to automatically verify that connectivity still exists between different resources in a single VPC.

   • ACreate a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
   • BCreate a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS. CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
   • CCreate a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the diffident paths in Route Analyzer.
   • DCreate a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Route Analyzer.

   Show answer

   Answer: B

   Explanation

   "When a security group change is made, the change event is logged in AWS CloudTrail. CloudTrail then forwards the change event to Amazon EventBridge, which evaluates the change against a series of rules to determine if any actions must be taken. Within EventBridge, a rule will be created to forward all security group change events from CloudTrail to an AWS Lambda function. The Lambda function is responsible for determining if any EC2 instances are impacted by the security group change, and if any Reachability Analyzer paths assessing the connectivity from the internet to the instance exist. " [https://aws.amazon.com/blogs/networking-and-content-delivery/automating-connectivity-assessments-with-vpc-reachability-analyzer/]

   Source: Adapted from community discussion — sanalainen

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 62 · 294 in bank

   A company hosts a web application that runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The company uses an Amazon CloudFront distribution with the ALB as an origin. The application recently experienced an attack. In response, the company associated an AWS WAF web ACL with the CloudFront distribution. The company needs to use Amazon Athena to analyze application attacks that AWS WAF detects. Which solution will meet this requirement?

   • AConfigure the ALB and the EC2 instance subnets to produce VPC flow logs. Configure the VPC flow logs to deliver logs to an Amazon S3 bucket for log analysis.
   • BCreate a trail in AWS CloudTrail to capture data events. Configure the trail to deliver logs to an Amazon S3 bucket for log analysis.
   • CConfigure the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon S3 bucket for log analysis.
   • DTurn on access logging for the ALB. Configure the access logs to deliver the logs to an Amazon S3 bucket for log analysis.

   Show answer

   Answer: C

   Explanation

   C To send logs to Amazon Kinesis Data Firehose, you send logs from your web ACL to an Amazon Kinesis Data Firehose with a configured storage destination. After you enable logging, AWS WAF delivers logs to your storage destination through the HTTPS endpoint of Kinesis Data Firehose.

   Source: Adapted from community discussion — Neo00

   References

   • AWS documentation

   Next question

3. Question 63 · 294 in bank

   A real estate company is using Amazon Workspaces to provide corporate managed desktop service to its real estate agents around the world. These Workspaces are deployed in seven VPCs. Each VPC is in a different AWS Region. According to a new requirement, the company’s cloud-hosted security information and events management (SIEM) system needs to analyze DNS queries generated by the Workspaces to identify the target domains that are connected to the Workspaces. The SIEM system supports poll and push methods for data and log collection. Which solution should a network engineer implement to meet these requirements MOST cost-effectively?

   • ACreate VPC flow logs in each VPC that is connected to the Workspaces instances. Publish the log data to a central Amazon S3 bucket. Configure the SIEM system to poll the S3 bucket periodically.
   • BConfigure an Amazon CloudWatch agent to log all DNS requests in Amazon CloudWatch Logs. Configure a subscription filter in CloudWatch Logs. Push the logs to the SIEM system by using Amazon Kinesis Data Firehose.
   • CConfigure VPC Traffic Mirroring to copy network traffic from each Workspace and to send the traffic to the SIEM system probes for analysis.
   • DConfigure Amazon Route 53 query logging. Set the destination as an Amazon Kinesis Data Firehose delivery stream that is configured to push data to the SIEM system.

   Show answer

   Answer: D

   Explanation

   Just like route 53 is not mentioned, it is nowhere mentioned that Workspace is using any custom DNS server. So it is good to assume the AmazonProvidedDNS.

   Source: Adapted from community discussion — Adzz

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 64 · 294 in bank

   A network engineer needs to design the architecture for a high performance computing (HPC) workload. Amazon EC2 instances will require 10 Gbps flows and an aggregate throughput of up to 100 Gbps across many instances with low-latency communication. Which architecture solution will optimize this workload?

   • APlace nodes in a single subnet of a VPC. Configure a cluster placement group. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system.
   • BPlace nodes in multiple subnets in a single VPC. Configure a spread placement group. Ensure that the EC2 instances support Elastic Network Adapters (ENAs) and that the drivers are updated on each instance operating system.
   • CPlace nodes in multiple VPCs Use AWS Transit Gateway to route traffic between the VPCs. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system.
   • DPlace nodes in multiple subnets in multiple Availability Zones. Configure a cluster placement group. Ensure that the EC2 instances support Elastic Network Adapters (ENAs) and that the drivers are updated on each instance operating system.

   Show answer

   Answer: A

   Explanation

   Option A is the most suitable solution for the high-performance computing workload: Cluster Placement Group: A cluster placement group ensures that EC2 instances are placed close together within the same Availability Zone to minimize network latency and provide high-bandwidth, low-latency communication between instances. This is crucial for an HPC workload where low-latency communication is essential. Single Subnet of a VPC: Placing nodes in a single subnet of a VPC ensures that the EC2 instances are closely located within the same subnet, further reducing network latency. Elastic Fabric Adapter (EFA): EFA is a network interface designed specifically for HPC workloads that require low-latency and high-bandwidth communication. Using EFA drivers on EC2 instances ensures optimal performance for communication between instances.

   Source: Adapted from community discussion — Manh

   References

   • AWS documentation

   Next question

5. Question 65 · 294 in bank

   A company uses multiple AWS accounts and VPCs in a single AWS Region. The company must log all network traffic for Amazon EC2 instances and Amazon RDS databases. The company will use the log information to monitor and identify traffic flows in the event of a security incident. The information must be retained for 12 months but will be accessed infrequently after the first 90 days. The company must be able to view metadata that includes the vpc-id, subnet-id: and tcp-flags fields. Which solution will meet these requirements at the LOWEST cost?

   • AConfigure VPC flow logs with the default fields Store the logs in Amazon CloudWatch Logs.
   • BConfigure Traffic Mirroring on all AWS resources to point to a Network Load Balancer that will send the mirrored traffic to monitoring instances.
   • CConfigure VPC flow logs with additional custom format fields Store the logs in Amazon S3.
   • DConfigure VPC flow logs with additional custom format fields Store the logs in Amazon CloudWatch Logs.

   Show answer

   Answer: C

   Explanation

   The other options are less cost-effective: Option A does not allow you to capture the custom fields you need (vpc-id, subnet-id, and tcp-flags). Option B, Traffic Mirroring, would involve a considerable overhead in terms of infrastructure and cost. Traffic Mirroring copies all traffic (not just metadata), which can be massive, and it requires additional resources to capture and process that traffic. Option D is less cost-effective for long-term, infrequently accessed storage because Amazon CloudWatch Logs is more expensive than Amazon S3 for these use cases.

   Source: Adapted from community discussion — Certified101

   References

   • AWS documentation

   Next question

6. Question 66 · 294 in bank

   A network engineer is evaluating a network setup for a global retail company. The company has an AWS Direct Connect connection between its on-premises data center and the AWS Cloud. The company has AWS resources in the eu-west-2 Region. These resources consist of multiple VPCs that are attached to a transit gateway. The company recently provisioned a few AWS resources in the eu-central-1. Region in a single VPC close to its users in this area. The network engineer must connect the resources in eu-central-1 with the on-premises data center and the resources in eu-west-2. The solution must minimize changes to the Direct Connect connection. What should the network engineer do to meet these requirements?

   • ACreate a new virtual private gateway. Attach the new virtual private gateway to the VPC in eu-central-1. Use a transit VIF to connect the VPC and the Direct Connect router.
   • BCreate a new transit gateway in eu-central-1. Create a peering attachment request to the transit gateway in eu-west-2. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gateway peering attachment. Accept the peering request. Add a static route in the transit gateway route table in eu-west-2 to point to the new transit gateway peering attachment.
   • CCreate a new transit gateway in eu-central-1. Use an AWS Site-to-Site VPN connection to peer both transit gateways. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gateway VPN attachment. Add a static route in the transit gateway route table in eu-west-2 to point to the new transit gateway peering attachment.
   • DCreate a new virtual private gateway. Attach the new virtual private gateway to the VPC in eu-central-1. Use a public VIF to connect the VPC and the Direct Connect router.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

7. Question 67 · 294 in bank

   A company has a 2 Gbps AWS Direct Connect hosted connection from the company’s office to a VPC in the ap-southeast-2 Region. A network engineer adds a 5 Gbps Direct Connect hosted connection from a different Direct Connect location in the same Region. The hosted connections are connected to different routers from the office with an iBGP session running in between the routers. The network engineer wants to ensure that the VPC uses the 5 Gbps hosted connection to route traffic to the office. Failover to the 2 Gbps hosted connection must occur when the 5 Gbps hosted connection is down. Which solution will meet these requirements?

   • AConfigure an outbound BGP policy from the router that is connected to the 2 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS.
   • BAdvertise a longer prefix route from the router that is connected to the 2 Gbps connection.
   • CAdvertise a less specific route from the router that is connected to the 5 Gbps connection.
   • DConfigure an outbound BGP policy from the router that is connected to the 5 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS.

   Show answer

   Answer: A

   Explanation

   BGP prefers routes with a shorter AS_PATH over routes with a longer AS_PATH. By advertising routes with a longer AS_PATH attribute from the 2 Gbps connection, you can make those routes less preferable than the routes advertised from the 5 Gbps connection. This way, the VPC will use the 5 Gbps connection to route traffic to the office, as long as it is available. If the 5 Gbps connection goes down, BGP will fail over to the 2 Gbps connection.

   Source: Adapted from community discussion — Manh

   References

   • AWS documentation

   Next question

8. Question 68 · 294 in bank

   Select 3

   A company is using a NAT gateway to allow internet connectivity for private subnets in a VPC in the us-west-2 Region. After a security audit, the company needs to remove the NAT gateway. In the private subnets, the company has resources that use the unified Amazon CloudWatch agent. A network engineer must create a solution to ensure that the unified CloudWatch agent continues to work after the removal of the NAT gateway. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

   • AValidate that private DNS is enabled on the VPC by setting the enableDnsHostnames VPC attribute and the enableDnsSupport VPC attribute to true.
   • BCreate a new security group with an entry to allow outbound traffic that uses the TCP protocol on port 443 to destination 0.0.0.0/0
   • CCreate a new security group with entries to allow inbound traffic that uses the TCP protocol on port 443 from the IP prefixes of the private subnets.
   • DCreate the following interface VPC endpoints in the VPC: com.amazonaws.us-west-2.logs and com.amazonaws.us-west-2.monitoring. Associate the new security group with the endpoint network interfaces.
   • ECreate the following interface VPC endpoint in the VPC: com.amazonaws.us-west-2.cloudwatch. Associate the new security group with the endpoint network interfaces.
   • FAssociate the VPC endpoint or endpoints with route tables that the private subnets use.

   Show answer

   Answer: ACD

   Explanation

   A, C, and D An interface VPC endpoint provides reliable, scalable connectivity to CloudWatch without requiring a NAT gateway. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-interface-VPC.html https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html To use private DNS, you must enable DNS hostnames and DNS resolution for your VPC. The security group for the interface endpoint must allow communication between the endpoint network interface and the resources in your VPC that must communicate with the service. https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

   Source: Adapted from community discussion — Untamables

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • repost.aws documentation

   Next question

9. Question 69 · 294 in bank

   Select 3

   An ecommerce company needs to implement additional security controls on all its domain names that are hosted in Amazon Route 53. The company's new policy requires data authentication and data integrity verification for all queries to the company’s domain names. The current Route 53 architecture has four public hosted zones. A network engineer needs to implement DNS Security Extensions (DNSSEC) signing and validation on the hosted zones. The solution must include an alert capability. Which combination of steps will meet these requirements? (Choose three.)

   • AEnable DNSSEC signing for Route 53 Request that Route 53 create a key-signing key (KSK) based on a customer managed key in AWS Key Management Service (AWS KMS).
   • BEnable DNSSEC signing for Route 53 Request that Route 53 create a zone-signing key (ZSK) based on a customer managed key in AWS Key Management Service (AWS KMS).
   • CCreate a chain of trust for the hosted zones by adding a Delegation Signer (DS) record for each subdomain
   • DCreate a chain of trust for the hosted zones by adding a Delegation Signer (DS) record to the parent zone.
   • ESet up an Amazon CloudWatch alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected.
   • FSet up an AWS CloudTrail alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected.

   Show answer

   Answer: ADE

   Explanation

   Option B: While it is true that DNSSEC uses zone-signing keys (ZSKs) in addition to KSKs, AWS Key Management Service (KMS) is not involved in creating ZSKs for DNSSEC in Route 53. Option C: Delegation Signer (DS) records are used to establish a chain of trust from a parent zone to a child zone, not between subdomains within a zone.

   Source: Adapted from community discussion — Certified101

   References

   • AWS documentation

   Next question

10. Question 70 · 294 in bank

    Select 2

    A financial company that is located in the us-east-1 Region needs to establish secure connectivity to AWS. The company has two on-premises data centers, each located within the same Region. The company's network team needs to establish hybrid connectivity to its AWS environment with reliable and consistent connectivity. The connection must provide access to the company's private resources inside its AWS environment. The resources are located in the us-east-1 and us-west-2 Regions. The connection must allow resources from the corporate networks to send large amounts of data to Amazon S3 over the same connection. To meet compliance requirements, the connection must be highly available and must provide encryption for all packets that are sent between the on-premises location and any services on AWS. Which combination of steps should the network team take to meet these requirements? (Choose two.)

    • ASet up a private VIF to send data to Amazon S3. Use an AWS Site-to-Site VPN connection over the private VIF to encrypt data in transit to the VPCs in us-east-1 and us-west-2.
    • BSet up an AWS Direct Connect connection to each of the company's data centers.
    • CSet up an AWS Direct Connect connection from one of the company's data centers to us-east-1 and us-west-2.
    • DSet up a public VIF to send data to Amazon S3. Use an AWS Site-to-Site VPN connection over the public VIF to encrypt data in transit to the VPCs in us-east-1 and us-west-2.
    • ESet up a transit VIF for an AWS Direct Connect gateway to send data to Amazon S3. Create a transit gateway. Associate the transit gateway with the Direct Connect gateway to provide secure communications from the company’s data centers to the VPCs in us-east-1 and us-west-2.

    Show answer

    Answer: BD

    Explanation

    Option B: Establishing an AWS Direct Connect connection to each of the company's data centers ensures a reliable, consistent connection. This setup also addresses the requirement for high availability. If there are problems with one connection, the other connection can maintain the data flow. Option D: A public VIF can provide direct access to AWS services, including Amazon S3, across the Direct Connect link. By using an AWS Site-to-Site VPN connection over the public VIF, you can encrypt data in transit between the on-premises location and the VPCs in us-east-1 and us-west-2, thereby meeting the company's compliance requirements.

    Source: Adapted from community discussion — Certified101

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 61. 294 questions available.