🔍

ANS-C01 — questions

Page 15 of 15 · 292 total questions.

ANS-C01 Question 281

Single page →
Topic 1 · Question 281

A company hosts a corporate website on Amazon EC2 instances behind a Network Load Balancer (NLB). The NLB has one TLS listener. The company wants to use AWS WAF to enhance security for the website. Which solution will meet this requirement?

  • AAttach an Elastic IP address to the NLB. Associate an AWS WAF web ACL with the Elastic IP address.
  • BReplace the NLB with an Application Load Balancer (ALB). Associate an AWS WAF web ACL with the ALB. (correct answer)
  • CAssociate an AWS WAF web ACL with the NLB.
  • DAssociate an AWS WAF web ACL with the EC2 instances that are behind the NLB.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Replace the NLB with an Application Load Balancer (ALB). Associate an AWS WAF web ACL with the ALB.

Explanation

An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. AWS WAF protects web applications from common exploits and malicious requests.

ANS-C01 Question 282

Single page →
Topic 1 · Question 282

A security company has a domain that stores DNS records in an Amazon Route 53 public hosted zone. The company has configured DNS Security Extensions (DNSSEC) signing for the domain. The domain has no subdomains. A network engineer must disable DNSSEC signing for the domain. The network engineer must not cause any DNS outage. Which solution will meet these requirements?

  • ADisable DNSSEC signing. Delete the resource record signature (RRSIG) records. Wait for the TTL of the RSIG records to elapse. Deactivate the key-signing keys (KSKs).
  • BDeactivate the key-signing keys (KSKs). Wait for the TTL of the KSK records to elapse. Disable DNSSEC signing.
  • CDelete the designated signer (DS) record in the parent domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing. Deactivate the key-signing keys (KSKs). (correct answer)
  • DDeactivate the key-signing keys (KSKs). Delete the designated signer (DS) record of the domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Delete the designated signer (DS) record in the parent domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing. Deactivate the key-signing keys (KSKs).

ANS-C01 Question 283

Single page →
Topic 1 · Question 283

A company needs to build an integration with its internal ticketing system. The integration will require an AWS Lambda function. The Lambda function needs to query a REST API that is part of the internal ticketing system. The ticketing system's REST API is accessible only through an Application Load Balancer (ALB) that is in a private subnet in the company's VPC. The company deploys the Lambda function with the following infrastructure as code (IaC): The IaC deployment succeeds, but the deployed Lambda function times out when it tries to access the ticketing system. How can the company give the Lambda function the ability to access the ticketing system?

  • ACreate an AWS PrivateLink endpoint service. Expose the service to the Lambda function.
  • BAttach the Lambda function to the ALB's target group by creating a new aws_lb_target_group_attachment resource. Configure the resource to reference both the ALB's ARN and the Lambda function's ARN.
  • CUpdate the Lambda function's security group to include appropriate inbound rules that permit traffic from the VPC.
  • DAdd a vpc_config section to the Lambda function resource. Configure the vpc_config section to include one or more security group IDs and one or more private subnet IDs that permit access to the ALB. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Add a vpc_config section to the Lambda function resource. Configure the vpc_config section to include one or more security group IDs and one or more private subnet IDs that permit access to the ALB.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 284

Single page →
Topic 1 · Question 284

A company has several application accounts that include dual-stack VPCs. The company wants to implement a centralized DNS solution that supports IPv6. A network engineer deploys a shared services VPC. The network engineer sets up network connectivity between the company's application VPCs, the shared services VPC, and the company's on-premises environment with support for IPv4 and IPv6 traffic. The network engineer is using Amazon Route 53 to implement a centralized DNS solution. The network engineer needs to ensure that resources in the application VPCs have the ability to perform DNS queries against an on-premises DNS resolver. Which solution will meet this requirement?

  • ACreate a Route 53 Resolver outbound endpoint in the shared services VPC within a dual-stack subnet. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts. (correct answer)
  • BCreate a Route 53 Resolver inbound endpoint in the shared services VPC within a subnet that supports only IPv6. Use AWS Resource Access Manager (AWS RAM) to share the endpoint to the application accounts.
  • CCreate a Route 53 Resolver outbound endpoint within a dual-stack subnet in each application VPUse AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts.
  • DCreate a Route 53 Resolver inbound endpoint within a subnet that supports only IPv4 in each application VPC. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the shared services account.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a Route 53 Resolver outbound endpoint in the shared services VPC within a dual-stack subnet. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

ANS-C01 Question 285

Single page →
Topic 1 · Question 285

A company uses an organization in AWS Organizations to manage many AWS accounts that host many VPCs and workloads. The company has an AWS Direct Connect connection between a data center and AWS. The company uses a transit gateway in a central network account to connect the workload VPCs to the data center. The company wants to tag each transit gateway attachment automatically with information from tags that are attached to each requester account VPC. The company provisions an IAM role in every account. The company assigns the IAM role permissions to retrieve the required tag data from the VPCs and a trust policy that allows principals in the central network account to invoke the IAM role. Which solution will meet these requirements?

  • AConfigure AWS Identity and Access Management Access Analyzer to monitor the transit gateway for new attachments. Configure IAM Access Analyzer to invoke an AWS Systems Manager runbook that assumes the IAM role in the requester account and tags the attachment with the required information.
  • BConfigure an SCP to monitor the transit gateway for new attachments. Configure the SCP to invoke an AWS CloudFormation stack template in the account that requests an attachment to tag the attachment.
  • CConfigure Amazon VPC IP Address Manager (IPAM) and register the transit gateway. Configure IPAM to run an AWS CDK function when a new IP address is requested from the transit gateway for a new attachment. Configure the CDK function to assume the IAM role in the requester account and to tag the attachment with the required information.
  • DConfigure AWS Network Manager and register the transit gateway. Create an Amazon EventBridge rule to receive attachment notifications from Network with the required information. Manager and to invoke an AWS Lambda function that assumes the IAM role in the requester account. Configure the Lambda function to tag the attachment. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure AWS Network Manager and register the transit gateway. Create an Amazon EventBridge rule to receive attachment notifications from Network with the required information. Manager and to invoke an AWS Lambda fun...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

ANS-C01 Question 286

Single page →
Topic 1 · Question 286 · Select all that apply

A company is using AWS Fargate to deploy many containerized web applications to a VPC. The applications must all be reachable through various DNS names on the standard port for HTTPS traffic. The company uses an Application Load Balancer (ALB) to handle traffic to each of the applications. The company uses the AWS Cloud Development Kit (AWS CDK) to automate the deployment process. The company uses two types of CDK stacks. The company uses one common stack to build the VPC itself and other shared infrastructure. The company also uses a set of application-specific stacks that contain details and logic for each application. The company needs to correctly allocate ALB-related resources between the two types of stacks. Which combination of solutions will provide a repeatable allocation of resources to the common stack and application-specific stacks? (Choose three.)

  • AALB listener in the common stack (correct answer)
  • BALB listener in the application-specific stacks
  • CALB listener host header rule in the common stack
  • DALB listener host header rule in the application-specific stacks (correct answer)
  • EALB target group in the common stack
  • FALB target group in the application-specific stacks (correct answer)
Reveal answer & explanation
Correct answer: A, D, F

With AWS CDK, shared load-balancing infrastructure belongs in the common stack while per-application routing lives in the application-specific stacks. Place the ALB listener (a single HTTPS listener on port 443 shared by all apps) in the common stack (A). Each application then owns its host-header listener rule (D) and its target group (F) in its application-specific stack, giving a repeatable allocation.

ANS-C01 Question 287

Single page →
Topic 1 · Question 287

A company has a hybrid environment. The company uses AWS Direct Connect with a transit VIF attached to a transit gateway to connect its on-premises location to the AWS Cloud. The company operates from a single AWS account in the us-east-1 Region. The company has a legacy application that runs on premises with the corp.example.com DNS name. The company has created an Amazon Route 53 Resolver outbound endpoint and a Resolver rule in us-east-1 in the AWS account. As part of an expansion, the company creates one more AWS account for a new business unit that operates in us-east-1. The new account has VPCs that are attached to the transit gateway. The new account uses the existing Direct Connect connection to connect to the on-premises location. Applications that run in the new account's VPCs also need to access the on-premises location by using the corp.example.com DNS name. A network engineer needs to identify a solution to resolve the corp.example.com DNS name from the new account. Which solution will meet these requirements MOST cost-effectively?

  • ACreate a hosted transit VIF for the new account on the existing Direct Connect connection. In the new account, create a new Route 53 Resolver outbound endpoint. Also in the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the new rule with the VPCs in the new account.
  • BShare the Resolver rule from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). Associate the shared rule with the VPCs in the new account. (correct answer)
  • CShare the Route 53 Resolver outbound endpoint from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). In the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the new rule with the VPCs in the new account.
  • DCreate an AWS Site-to-Site VPN connection between the new account and the on-premises location. Attach the Site-to-Site VPN connection to the existing transit gateway. In the new account, create a new Route 53 Resolver outbound endpoint. Also in the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the rule with the VPCs in the new account.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Share the Resolver rule from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). Associate the shared rule with the VPCs in the new account. This option delivers the requirement at the lowest cost.

ANS-C01 Question 288

Single page →
Topic 1 · Question 288 · Select all that apply

A company has many VPCs in the us-east-1 Region. The company uses a transit gateway to connect the VPCs to one another. The company recently acquired a smaller company that has a single VPC named VPC-Z. A network engineer needs to onboard VPC-Z to the existing transit gateway. The network engineer notices an IP address overlap between VPC-Z and VPC-A. The network engineer must establish outbound connectivity from VPC-Z to all the company's other VPCs, including VPC-A. Which combination of solutions will meet this requirement? (Choose two.)

  • ACreate a new non-overlapping CIDR block in VPC-Z. Create two subnets that use the new CIDR block. (correct answer)
  • BCreate a new non-overlapping CIDR block in VPC-A. Create two subnets that use the new CIDR block.
  • CCreate a private NAT gateway in VPC-Z in a non-overlapping subnet. Advertise only the non-overlapping VPC-Z CIDR block to the transit gateway route table. (correct answer)
  • DCreate a private NAT gateway in VPC-A in a non-overlapping subnet. Advertise only the non-overlapping VPC-A CIDR block to the transit gateway route table.
  • ECreate a VPC peering connection between VPC-A and VPC-Z.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Create a new non-overlapping CIDR block in VPC-Z. Create two subnets that use the new CIDR block. Option C: Create a private NAT gateway in VPC-Z in a non-overlapping subnet. Advertise only the non-overlapping VPC-Z CIDR block to the transit gateway route table.

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale. A NAT gateway lets private subnet resources reach the internet for outbound traffic only.

ANS-C01 Question 289

Single page →
Topic 1 · Question 289 · Select all that apply

A company has two on-premises data center locations named Data Center 1 and Data Center 2. Each data center has a company-managed customer router. Both data centers have a dedicated AWS Direct Connect connection to the same Direct Connect gateway that uses a private VIF. The company enabled Direct Connect SiteLink when the company created each private VIF. The company uses SiteLink to send data from one Direct Connect location to the other, bypassing AWS Regions. Data Center 2 hosts an application that a partner company needs to access. The partner wants to access the application from the partner's own data center by using the Direct Connect network. The company's network engineer needs to create a separate isolated network for the partner to establish connectivity between Data Center 2 and the partner's data center. Which combination of steps will meet these requirements? (Choose two.)

  • ACreate a new Direct Connect gateway for the partner in an AWS account. Share the account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VIF with the new Direct Connect gateway. (correct answer)
  • BProvision a separate transit VIF for the partner on the Direct Connect connection at Data Center 2. Connect the transit VIF to the partner-specific Direct Connect gateway.
  • CShare the company's AWS account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VIF with the existing Direct Connect gateway.
  • DProvision a separate private VIF for the partner on the Direct Connect connection at Data Center 2. Connect the private VIF to the partner-specific Direct Connect gateway. Enable SiteLink. (correct answer)
  • EProvision a separate public VIF for the partner on the Direct Connect connection at Data Center 2. Connect the public VIF to the partner-specific Direct Connect gateway. Enable SiteLink.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Create a new Direct Connect gateway for the partner in an AWS account. Share the account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VI... Option D: Provision a separate private VIF for the partner on the Direct Connect connection at Data Center 2. Connect the private VIF to the partner-specific Direct Connect gateway. Enable SiteLink.

Explanation

AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS.

ANS-C01 Question 290

Single page →
Topic 1 · Question 290

A company has an AWS Direct Connect connection between an on-premises data center and a single private VIF in the company's VPC. The VPC contains resources that the company has secured by using security groups and network ACLs. A network engineer adds a subnet in the company's data center during a maintenance period. The network engineer notices that the BGP status for the private VIF is down after the maintenance activity. The Direct Connect connection was fully operational before the maintenance period. The network team verifies that layer 2 connectivity is working between the company’s router and the Direct Connect router. The networking engineer must resolve this issue. Which solution will meet this requirement?

  • AUse route filters or aggregation on the company's router to limit the routes that are advertised from the company’s router. (correct answer)
  • BAdd a route policy to the company's router to ensure that all routes that are advertised from the company's router are tagged with a correct BGP community string that begins in "7224".
  • CRevalidate the physical and logical path between the company's router and the Direct Connect router, including any Direct Connect Partner.
  • DEnsure that security groups and network ACLs allow TCP communications to port 179.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use route filters or aggregation on the company's router to limit the routes that are advertised from the company’s router.

ANS-C01 Question 291

Single page →
Topic 1 · Question 291

A company uses AWS Cloud WAN as a primary connectivity solution to establish communication between VPCs in a multi-account and multi-Region environment. The company has created an attachment policy statement in the AWS Cloud WAN core network policy. The attachment policy requires acceptance for new VPC attachments, regardless of the segment that the new VPC attachment needs to be associated with. The company wants to automate acceptance for new VPC attachments based on specific conditions. The company creates an AWS Lambda function to check for the specific conditions. A network engineer must integrate the Lambda function with the company’s existing architecture. Which solution will meet these requirements in the MOST cost-effective way?

  • AUpdate the AWS Cloud WAN core network policy to create a network function group. Select the require acceptance option. Create a service insertion segment action that targets the Lambda function.
  • BCreate an Amazon EventBridge rule to match AWS Network Manager events for the VPC attachments. Configure the EventBridge rule to invoke the Lambda function when the rule matches. (correct answer)
  • CUse Amazon CloudWatch logs to stream AWS CloudTrail logs to an Amazon Kinesis data stream. Configure an event source mapping to target the Lambda function to process the event stream.
  • DConfigure AWS Network Manager as a source for a pipe in Amazon EventBridge Pipes. Create a filter in the pipe for new VPC attachments. Set the Lambda function as the target of the pipe.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Amazon EventBridge rule to match AWS Network Manager events for the VPC attachments. Configure the EventBridge rule to invoke the Lambda function when the rule matches.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

ANS-C01 Question 292

Single page →
Topic 1 · Question 292

A company hosts multiple workloads in a single VPC that has public subnets and private subnets. The company establishes an AWS Direct Connect connection to provide connectivity between the company’s on-premises network and the VPC. The company purchases a domain in its AWS account. The domain needs to resolve to a private Application Load Balancer (ALB) for requests that originate from the company's network. The domain needs to resolve to a public ALB for requests that originate from the internet. Which solution will meet these requirements?

  • ACreate an Amazon CloudFront distribution for the domain. Create an AWS Lambda@Edge function that inspects each request and routes requests from the internet to the public ALB. Configure the Lambda@Edge function to route requests from the company’s network to the private ALB. Create an Amazon Route 53 public hosted zone for the domain. Include an A record that is configured as an alias that points to the CloudFront distribution.
  • BCreate an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALCreate a Route 53 private hosted zone for the domain. Include an alias record that points to the private ALConfigure a Route 53 inbound resolver endpoint on the VPC. Configure the company's network DNS to forward queries for the domain to the endpoint. (correct answer)
  • CCreate an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALB. Create an additional alias record for the domain that routes to the private ALB. Associate a geolocation routing policy with the CIDR range of the company’s network.
  • DDeploy new Amazon EC2 instances that host DNS servers in each of the private subnets. Configure the DNS servers to return the IP address of the public ALB for requests from the internet. Configure the DNS servers to return the IP address of the private ALB for requests from the company’s network. Configure a public Amazon Route 53 inbound resolver to forward all requests for the domain to the EC2 instances. Enable client IP preservation.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALCreate a Route 53 private hosted zone for the domain. Include an alias record that points to the private...

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance.

Showing questions 281–292 of 292 · Page 15 of 15