ANS-C01 practice questions 71–80

1. Question 71 · 294 in bank

   A global company is designing a hybrid architecture to privately access AWS resources in the us-west-2 Region. The company's existing architecture includes a VPC that uses RFC 1918 IP address space. The VPC is connected to an on-premises data center over AWS Direct Connect Amazon Route 53 provides name resolution within the VPC. Locally managed DNS servers in the data center provide DNS services to the on-premises hosts. The company has applications in the data center that need to download objects from an Amazon S3 bucket in us-west-2. Which solution can the company use to access Amazon S3 without using the public IP address space?

   • ACreate an S3 interface endpoint in the VPC. Update the on-premises application configuration to use the Regional VPC endpoint DNS hostname that is mapped to the S3 interface endpoint.
   • BCreate an S3 interface endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.
   • CCreate an S3 gateway endpoint in the VPUpdate the on-premises application configuration to use the hostname that is mapped to the S3 gateway endpoint.
   • DCreate an S3 gateway endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.

   Show answer

   Answer: B

   Explanation

   When you configure an interface VPC endpoint, an elastic network interface (ENI) with a private IP address is deployed in your subnet. An Amazon EC2 instance in the VPC can communicate with an Amazon S3 bucket through the ENI and AWS network. Using the interface endpoint, applications in your on-premises data center can easily query S3 buckets over AWS Direct Connect or Site-to-Site VPN. Interface endpoint supports a growing list of AWS services. Consult our documentation to find AWS services compatible with interface endpoints powered by AWS PrivateLink. https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/

   Source: Adapted from community discussion — Sailor

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • repost.aws documentation

   Next question

2. Question 72 · 294 in bank

   A company is migrating critical applications to AWS. The company has multiple accounts and VPCs that are connected by a transit gateway. A network engineer must design a solution that performs deep packet inspection for any traffic that leaves a VPC network boundary. All inspected traffic and the actions that are taken on the traffic must be logged in a central log account. Which solution will meet these requirements with the LEAST administrative overhead?

   • ACreate a central network VPC that includes an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Gateway Load Balancer that is backed by third-party, next-generation firewall appliances to the central network VPC. Create a policy that contains the rules for deep packet inspection. Attach the policy to the firewall appliances. Create an Amazon S3 bucket in the central log account. Configure the firewall appliances to capture and save the network flow logs to the S3 bucket.
   • BCreate a central network VPC that includes an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Application Load Balancer that is backed by third-party, next-generation firewall appliances to the central network VPC. Create a policy that contains the rules for deep packet inspection. Attach the policy to the firewall appliances. Create a syslog server in the central log account. Configure the firewall appliances to capture and save the network flow logs to the syslog server.
   • CDeploy network ACLs and security groups to each VPAttach the security groups to active network interfaces. Associate the network ACLs with VPC subnets. Create rules for the network ACLs and security groups to allow only the required traffic flows between subnets and network interfaces. Create an Amazon S3 bucket in the central log account. Configure a VPC flow log that captures and saves all traffic flows to the S3 bucket.
   • DCreate a central log VPC and an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Network Load Balancer (NLB) that is backed by third-party, next-generation intrusion detection system (IDS) security appliances to the central VPC. Activate rules on the security appliances to monitor for intrusion signatures. For each network interface, create a VPC Traffic Mirroring session that sends the traffic to the central VPC's NLB.

   Show answer

   Answer: A

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 73 · 294 in bank

   A company has an on-premises data center in the United States. The data center is connected to AWS by an AWS Direct Connect connection. The data center has a private VIF that is connected to a Direct Connect gateway. Recently, the company opened a new data center in Europe and established a new Direct Connect connection between the Europe data center and AWS. A new private VIF connects to the existing Direct Connect gateway. The company wants to use Direct Connect SiteLink to set up a private network between the data center in the United States and the data center in Europe. Which solution will meet these requirements in the MOST operationally efficient manner?

   • ACreate a new public VIF from each data center. Enable SiteLink on the new public VIFs.
   • BCreate a new transit VIF from each data center. Enable SiteLink on the new transit VIFs.
   • CUse the existing VIF from each data center. Enable SiteLink on the existing private VIFs.
   • DCreate a new AWS Site-to-Site VPN connection between the data centers. Configure the new connection to use SiteLink.

   Show answer

   Answer: C

   Explanation

   Direct Connect SiteLink is a feature that allows you to establish private virtual interfaces (VIFs) between Direct Connect gateways in different geographic locations. It enables you to create a private network connection between your on-premises data centers connected via Direct Connect. In this scenario, the company already has private VIFs connecting its on-premises data centers (in the United States and Europe) to the existing Direct Connect gateway. To set up a private network between these data centers using Direct Connect SiteLink, you can enable SiteLink on the existing private VIFs. This is operationally efficient, as it utilizes the existing connections and configurations.

   Source: Adapted from community discussion — vikasj1in

   References

   • AWS documentation

   Next question

4. Question 74 · 294 in bank

   A company has a new AWS Direct Connect connection between its on-premises data center and the AWS Cloud. The company has created a new private VIF on this connection. However, the VIF status is DOWN. A network engineer verifies that the physical connection status is UP and RUNNING based on information from the AWS Management Console. The network engineer checks the customer Direct Connect router and can see the ARP entry for the VLAN interface created for the private VIF at AWS. What could be causing the private VIF to have a DOWN status?

   • AICMP is blocked on the customer Direct Connect router.
   • BTCP port 179 is blocked on the customer Direct Connect router.
   • CThe IEEE 802.1Q VLAN identifier is misconfigured on the customer Direct Connect router.
   • DThe company has configured IEEE 802.1ad instead of 802.1Q on the customer Direct Connect router.

   Show answer

   Answer: B

   Explanation

   Changed to B as the entry is visible for the VLAN interface created for the private VIF at AWS, which means that the Layer 2 connectivity appears to be functioning correctly. BGP is the issue

   Source: Adapted from community discussion — Certified101

   References

   • AWS documentation
   • repost.aws documentation

   Next question

5. Question 75 · 294 in bank

   AnyCompany has acquired Example Corp. AnyCompany's infrastructure is all on premises, and Example Corp's infrastructure is completely in the AWS Cloud. The companies are using AWS Direct Connect with AWS Transit Gateway to establish connectivity between each other. Example Corp has deployed a new application across two Availability Zones in a VPC with no internet gateway. The CIDR range for the VPC is 10.0.0.0/16. Example Corp needs to access an application that is deployed on premises by AnyCompany. Because of compliance requirements, Example Corp must access the application through a limited contiguous block of approved IP addresses (10.1.0.0/24). A network engineer needs to implement a highly available solution to achieve this goal. The network engineer starts by updating the VPC to add a new CIDR range of 10.1.0.0/24. What should the network engineer do next to meet the requirements?

   • AIn each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address range. Create a public NAT gateway in each of the new subnets. Update the route tables that are associated with other subnets to route application traffic to the public NAT gateway in the corresponding Availability Zone. Add a route to the route table that is associated with the subnets of the public NAT gateways to send traffic destined for the application to the transit gateway.
   • BIn each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address range. Create a private NAT gateway in each of the new subnets. Update the route tables that are associated with other subnets to route application traffic to the private NAT gateway in the corresponding Availability Zone. Add a route to the route table that is associated with the subnets of the private NAT gateways to send traffic destined for the application to the transit gateway.
   • CIn the VPC, create a subnet that uses the allowed IP address range. Create a private NAT gateway in the new subnet. Update the route tables that are associated with other subnets to route application traffic to the private NAT gateway. Add a route to the route table that is associated with the subnet of the private NAT gateway to send traffic destined for the application to the transit gateway.
   • DIn the VPC, create a subnet that uses the allowed IP address range. Create a public NAT gateway in the new subnet. Update the route tables that are associated with other subnets to route application traffic to the public NAT gateway. Add a route to the route table that is associated with the subnet of the public NAT gateway to send traffic destined for the application to the transit gateway.

   Show answer

   Answer: B

   Explanation

   Also the VPC uses the subnet 10.1.0.0/24 already. You cannot create a single subnet in that VPC range. Needs to be split up into multiple subnets. "The network engineer starts by updating the VPC to add a new CIDR range of 10.1.0.0/24"

   Source: Adapted from community discussion — Certified101

   References

   • AWS documentation

   Next question

6. Question 76 · 294 in bank

   A company recently experienced an IP address exhaustion event in its VPCs. The event affected service capacity. The VPCs hold two or more subnets in different Availability Zones. A network engineer needs to develop a solution that monitors IP address usage across resources in the VPCs. The company needs to receive notification about possible issues so that the company can act before an incident happens. Which solution will meet these requirements with the LEAST operational overhead?

   • ASet up Amazon VPC IP Address Manager (IPAM) with a new top-level pool. In the top-level pool, create a pool for each VPC. In each VPC pool, create a pool for each subnet in that VPC. Turn on the auto-import option for the VPC pools and the subnet pools. Configure an Amazon CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
   • BSet up a log group in Amazon CloudWatch Logs for each subnet. Create an AWS Lambda function that reads each subnet's IP address usage and publishes metrics to the log group. Configure an Amazon CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
   • CSet up a custom Amazon CloudWatch metric for IP address usage for each subnet. Create an AWS Lambda function that reads each subnet's IP address usage and publishes a CloudWatch metric dimension. Schedule the Lambda function to run every 5 minutes. Configure a CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
   • DSet up Amazon VPC IP Address Manager (IPAM) with a new top-level pool. In the top-level pool, create a pool for each VPC. In each VPC pool, create a pool for each subnet in that VPC. Turn on the auto-import option for the VPC pools and the subnet pools. Configure an Amazon EventBridge rule that monitors each pool availability limit threshold and sends an Amazon Simple Notification Service (Amazon SNS) notification if the limit threshold is reached.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

7. Question 77 · 294 in bank

   Select 2

   A company has a hybrid IT setup that includes services that run in an on-premises data center and in the AWS Cloud. The company is using AWS Direct Connect to connect its data center to AWS. The company is using one AWS Site-to-Site VPN connection as backup and requires a backup connectivity option to always be present. The company is transitioning to IPv6 by implementing dual-stack architectures. Which combination of steps will transition the data center's connectivity to AWS in the LEAST amount of time? (Choose two.)

   • ACreate a new Site-to-Site VPN tunnel for the IPv6 traffic.
   • BCreate a new dual-stack Site-to-Site VPN connection between the data center and AWS. Provision routing. Delete the original Site-to-Site VPN connection.
   • CAssociate a new dual-stack public VIF with the Direct Connect connection. Migrate the Direct Connect traffic to the new VIF.
   • DAdd a new IPv6 peer in the existing VIF. Use the IPv6 address provided by Amazon on the peer router.
   • ESend IPv6 traffic between the data center and AWS in a tunnel inside the existing IPv4 tunnels.

   Show answer

   Answer: AD

   Explanation

   AD are correct since a new vpn is needed and a new IPv6 peer can be added to the existing vif BE are wrong - since you cannot add iPv6 to an existing s2s and a s2s cannot be dual stack (https://docs.aws.amazon.com/vpn/latest/s2svpn/ipv4-ipv6.html) C is good but not fulfil the least amount of time requirement

   Source: Adapted from community discussion — tromyunpak

   References

   • AWS documentation

   Next question

8. Question 78 · 294 in bank

   A company is developing a new application that is deployed in multiple VPCs across multiple AWS Regions. The VPCs are connected through AWS Transit Gateway. The VPCs contain private subnets and public subnets. All outbound internet traffic in the private subnets must be audited and logged. The company's network engineer plans to use AWS Network Firewall and must ensure that all traffic through Network Firewall is completely logged for auditing and alerting. How should the network engineer configure Network Firewall logging to meet these requirements?

   • AConfigure Network Firewall logging in Amazon CloudWatch to capture all alerts. Send the logs to a log group in Amazon CloudWatch Logs.
   • BConfigure Network Firewall logging in Network Firewall to capture all alerts and flow logs.
   • CConfigure Network Firewall logging by configuring VPC Flow Logs for the firewall endpoint. Send the logs to a log group in Amazon CloudWatch Logs.
   • DConfigure Network Firewall logging by configuring AWS CloudTrail to capture data events.

   Show answer

   Answer: B

   Explanation

   A: Since only all alerts are captured, the requirement to capture all traffic logs cannot be met. B: The Network Firewall log settings are configured for logging from the Network Firewall's Firewall Details screen. When configuring the logging settings, select either the alert log or the traffic log, or both, and configure the output settings. C: The requirement is not met because alerts cannot be captured. D: Network Firewall alerts and traffic logs cannot be captured by CloudTrail.

   Source: Adapted from community discussion — kupo777

   References

   • AWS documentation

   Next question

9. Question 79 · 294 in bank

   An international company provides early warning about tsunamis. The company plans to use IoT devices to monitor sea waves around the world. The data that is collected by the IoT devices must reach the company’s infrastructure on AWS as quickly as possible. The company is using three operation centers around the world. Each operation center is connected to AWS through Its own AWS Direct Connect connection. Each operation center is connected to the internet through at least two upstream internet service providers. The company has its own provider-independent (PI) address space. The IoT devices use TCP protocols for reliable transmission of the data they collect. The IoT devices have both landline and mobile internet connectivity. The infrastructure and the solution will be deployed in multiple AWS Regions. The company will use Amazon Route 53 for DNS services. A network engineer needs to design connectivity between the IoT devices and the services that run in the AWS Cloud. Which solution will meet these requirements with the HIGHEST availability?

   • ASet up an Amazon CloudFront distribution with origin failover. Create an origin group for each Region where the solution is deployed.
   • BSet up Route 53 latency-based routing. Add latency alias records. For the latency alias records, set the value of Evaluate Target Health to Yes.
   • CSet up an accelerator in AWS Global Accelerator. Configure Regional endpoint groups and health checks.
   • DSet up Bring Your Own IP (BYOIP) addresses. Use the same PI addresses for each Region where the solution is deployed.

   Show answer

   Answer: C

   Explanation

   AWS Global Accelerator is designed to provide a highly available and performant solution for global applications. It uses anycast IP addresses to route traffic to optimal AWS endpoint locations. In this scenario, setting up an accelerator in AWS Global Accelerator with Regional endpoint groups is suitable for the distributed architecture of the IoT devices and the AWS infrastructure. Options A and B involve Amazon CloudFront and Route 53 latency-based routing, respectively, but AWS Global Accelerator is specifically designed to provide highly available, low-latency, and fault-tolerant global routing, making it a more suitable choice for this scenario. Option D, Bring Your Own IP (BYOIP) addresses, is not directly related to optimizing the connectivity for IoT devices and services in AWS, and it doesn't address the global distribution and routing requirements as effectively as AWS Global Accelerator.

   Source: Adapted from community discussion — vikasj1in

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 80 · 294 in bank

    A company has set up a NAT gateway in a single Availability Zone (AZ1) in a VPC (VPC1) to access the internet from Amazon EC2 workloads in the VPC. The EC2 workloads are running in private subnets in three Availability Zones (AZ1, AZ2, AZ3). The route table for each subnet is configured to use the NAT gateway to access the internet. Recently during an outage, internet access stopped working for the EC2 workloads because of the NAT gateway's unavailability. A network engineer must implement a solution to remove the single point of failure from the architecture and provide built-in redundancy. Which solution will meet these requirements?

    • ASet up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table for private subnets to route traffic to the virtual IP addresses of the two NAT gateways.
    • BSet up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table to point the AZ2 private subnets to the NAT gateway in AZ2. Configure the same route table to point the AZ3 private subnets to the NAT gateway in AZ3.
    • CCreate a second VPC (VPC2). Set up two NAT gateways. Place each NAT gateway in a different VPC (VPC1 and VPC2) and in the same Availability Zone (AZ2). Configure a route table in VPC1 to point the AZ2 private subnets to one NAT gateway. Configure a route table in VPC2 to point the AZ2 private subnets to the second NAT gateway.
    • DSet up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table to point the AZ2 private subnets to the NAT gateway in AZ2. Configure a second route table to point the AZ3 private subnets to the NAT gateway in AZ3.

    Show answer

    Answer: D

    Explanation

    D is correct - as you will have 1 NAT per AZ with each subnet has its own route table A is wrong since you cannot use virtual IP of the NAT gateway (feature not available) C is wrong due to the fact that a new vpc is not required B is wrong since AZ2 & AZ3 are sharing the same nat gatweway

    Source: Adapted from community discussion — tromyunpak

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 71. 294 questions available.