Question 1

You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URLs, the instances should be able to access any Amazon S3 bucket in the same region via any URL. Which of the following solutions should you deploy? (Choose two.)

Accepted Answer

C,D

Question 2

Your organization needs to resolve DNS entries stored in an Amazon Route 53 private zone "awscloud:internal" from the corporate network. An AWS Direct Connect connection with a private virtual interface is configured to provide access to a VPC with the CIDR block 192.168.0.0/16. A DNS Resolver (BIND) is configured on an Amazon Elastic Compute Cloud (EC2) instance with the IP address 192.168.10.5 within the VPC. The DNS Resolver has standard root server hints configured and conditional forwarding for "awscloud.internal" to the IP address 192.168.0.2. From your PC on the corporate network, you query the DNS server at 192.168.10.5 for www.amazon.com. The query is successful and returns the appropriate response. When you query for "server.awscloud.internal", the query times out. You receive no response. How should you enable successful queries for "server.awscloud.internal"?

Accepted Answer

The VPC settings for enableDnsHostnames and enableDnsSupport must be set to True to allow DNS resolution within the VPC, which is necessary for resolving private DNS entries in a Route 53 private hosted zone.

Question 3

You need to set up a VPN between AWS VPC and your on-premises network. You create a VPN connection in the AWS Management Console, download the configuration file, and install it on your on-premises router. The tunnel is not coming up because of firewall restrictions on your router. Which two network traffic options should you allow through the firewall? (Choose two.)

Accepted Answer

UDP port 500 is used for IKE (Internet Key Exchange) and IP protocol 50 is used for ESP (Encapsulating Security Payload), both of which are necessary for establishing a VPN connection.

Question 4

Your company runs an HTTPS application using an Elastic Load Balancing (ELB) load balancer/PHP on nginx server/RDS in multiple Availability Zones. You need to apply Geographic Restriction and identify the client's IP address in your application to generate dynamic content. How should you utilize AWS services in a scalable fashion to perform this task?

Accepted Answer

CloudFront can be used to apply Geographic Restriction and X-Forwarded-For can be used to identify the client's IP address.

Question 5

Your company decides to use Amazon S3 to augment its on-premises data store. Instead of using the company's highly controlled, on-premises Internet gateway, a Direct Connect connection is ordered to provide high bandwidth, low latency access to S3. Since the company does not own a publically routable IPv4 address block, a request was made to AWS for an AWS-owned address for a Public Virtual Interface (VIF). The security team is calling this new connection a "backdoor", and you have been asked to clarify the risk to the company. Which concern from the security team is valid and should be addressed?

Accepted Answer

AWS advertises its aggregate routes to the Internet, which could potentially allow anyone on the Internet to reach the router, posing a security risk.

Question 6

Under increased cybersecurity concerns, a company is deploying a near real-time intrusion detection system (IDS) solution. A system must be put in place as soon as possible. The architecture consists of many AWS accounts, and all results must be delivered to a central location. Which solution will meet this requirement, while minimizing downtime and costs?

Accepted Answer

Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior. It can be enabled quickly across multiple AWS accounts and delivers findings to a central account, minimizing downtime and costs.

Question 7

You have been asked to monitor traffic flows on your Amazon EC2 instance. You will be performing deep packet inspection, looking for atypical patterns. Which tool will enable you to look at this data?

Accepted Answer

Wireshark is a network protocol analyzer that allows for deep packet inspection, enabling you to capture and interactively browse the traffic running on a computer network.

Question 8

You have to set up an AWS Direct Connect connection to connect your on-premises to an AWS VPC. Due to budget requirements, you can only provision a single Direct Connect port. You have two border gateway routers at your on-premises data center that can peer with the Direct Connect routers for redundancy. Which two design methodologies, in combination, will achieve this connectivity? (Choose two.)

Accepted Answer

The answer of You have to set up an AWS...

Question 9

You are designing an AWS Direct Connect solution into your VPC. You need to consider requirements for the customer router to terminate the Direct Connect link at the Direct Connect location. Which three factors that must be supported should you consider when choosing the customer router? (Choose three.)

Accepted Answer

The customer router must support 802.1q trunking for VLAN tagging, BGP for routing, and single-mode optical fiber connectivity for the physical connection to AWS Direct Connect.

Question 10

You have a three-tier web application with separate subnets for Web, Applications, and Database tiers. Your CISO suspects your application will be the target of malicious activity. You are tasked with notifying the security team in the event your application is port scanned by external systems. Which two AWS Services cloud you leverage to build an automated notification system? (Choose two.)

Accepted Answer

The answer of You have a three-tier web application with...

Question 11

Your organization uses a VPN to connect to your VPC but must upgrade to a 1-G AWS Direct Connect connection for stability and performance. Your telecommunications provider has provisioned the circuit from your data center to an AWS Direct Connect facility and needs information on how to cross-connect (e.g., which rack/port to connect). What is the AWS-recommended procedure for providing this information?

Accepted Answer

AWS recommends creating a support ticket to provide cross-connect information to your telecommunications provider. This ensures that the information is securely and accurately communicated.

Question 12

A Lambda function needs to access the private address of an Amazon ElastiCache cluster in a VPC. The Lambda function also needs to write messages to Amazon SQS. The Lambda function has been configured to run in a subnet in the VPC. Which of the following actions meet the requirements? (Choose two.)

Accepted Answer

The answer of A Lambda function needs to access the...

Question 13

Your organization leverages an IP Address Management (IPAM) product to manage IP address distribution. The IPAM exposes an API. Development teams use CloudFormation to provision approved reference architectures. At deployment time, IP addresses must be allocated to the VPC. When the VPC is deleted, the IPAM must reclaim the VPC's IP allocation. Which method allows for efficient, automated integration of the IPAM with CloudFormation?

Accepted Answer

The answer of Your organization leverages an IP Address Management...

Question 14

You ping an Amazon Elastic Compute Cloud (EC2) instance from an on-premises server. VPC Flow Logs record the following: 2 123456789010 eni-1235b8ca 10.123.234.78 172.11.22.33 0 0 1 8 672 1432917027 1432917142 ACCEPT OK 2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917027 1432917082 ACCEPT OK 2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917094 1432917142 REJECT OK Why are ICMP responses not received by the on-premises system?

Accepted Answer

The VPC Flow Logs show that the ICMP response packets from the EC2 instance to the on-premises server are being rejected, indicating that the outbound network access control list (NACL) is blocking the traffic.

Question 15

You run a well-architected, multi-AZ application in the eu-central-1 (Frankfurt) AWS region. The application is hosted in a VPC and is only accessed from the corporate network. To support large volumes of data transfer and administration of the application, you use a single 10-Gbps AWS Direct Connect connection with multiple private virtual interfaces. As part of a review, you decide to improve the resilience of your connection to AWS and make sure that any additional connectivity does not share the same Direct Connect routers at AWS. You need to provide the best levels of resilience to meet the application's needs. Which two options should you consider? (Choose two.)

Accepted Answer

The answer of You run a well-architected, multi-AZ application in...

Question 16

Your organization runs a popular e-commerce application deployed on AWS that uses autoscaling in conjunction with an Elastic Load balancing (ELB) service with an HTTPS listener. Your security team reports that an exploitable vulnerability has been discovered in the encryption protocol and cipher that your site uses. Which step should you take to fix this problem?

Accepted Answer

The answer of Your organization runs a popular e-commerce application...

Question 17

You are designing the network infrastructure for an application server in Amazon VPC. Users will access all the application instances from the Internet and from an on-premises network. The on-premises network is connected to your VPC over an AWS Direct Connect link. How should you design routing to meet these requirements?

Accepted Answer

Propagating specific routes for the on-premises networks via BGP on the AWS Direct Connect customer router allows the VPC to route traffic to the on-premises network correctly, while the default route via the IGW handles Internet traffic. This setup ensures that traffic is routed appropriately based on its destination.

Question 18

Your company's policy requires that all VPCs peer with a "common services: VPC. This VPC contains a fleet of layer 7 proxies and an Internet gateway. No other VPC is allowed to provision an Internet gateway. You configure a new VPC and peer with the common service VPC as required by policy. You launch an Amazon EC2. Windows instance configured to forward all traffic to the layer 7 proxies in the common services VPC. The application on this server should successfully interact with Amazon S3 using its properly configured AWS Identity and Access Management (IAM) role. However, Amazon S3 is returning 403 errors to the application. Which step should you take to enable access to Amazon S3?

Accepted Answer

The answer of Your company's policy requires that all VPCs...

Question 19

You need to set up an Amazon Elastic Compute Cloud (EC2) instance for an application that requires the lowest latency and the highest packet-per-second network performance. The application will talk to other servers in a peered VPC. Which two of the following components should be part of the design? (Choose two.)

Accepted Answer

Single root I/O virtualization (SR-IOV) allows multiple virtual functions (VFs) to share a single physical function (PF) on a network interface card (NIC). This can reduce latency and improve packet-per-second performance. Multiple ENIs can also improve network performance by providing more bandwidth and reducing congestion.

Question 20

An organization runs a consumer-facing website on AWS. The Amazon EC2-based web fleet is load balanced using the AWS Application Load Balancer, Amazon Route 53 is used to provide the public DNS services. The following URLs need to server content to end users: test.example.com web.example.com example.com Based on this information, what combination of services must be used to meet the requirement? (Choose two.)

Accepted Answer

The answer of An organization runs a consumer-facing website on...

Exam 1: AWS Certified Advanced Networking - Specialty (ANS-C00)

You have been asked to monitor traffic flows on your Amazon EC2 instance. You will be performing deep packet inspection, looking for atypical patterns. Which tool will enable you to look at this data?

A Lambda function needs to access the private address of an Amazon ElastiCache cluster in a VPC. The Lambda function also needs to write messages to Amazon SQS. The Lambda function has been configured to run in a subnet in the VPC. Which of the following actions meet the requirements? (Choose two.)