🔍

ANS-C01 — questions

Page 8 of 15 · 292 total questions.

ANS-C01 Question 141

Single page →
Topic 1 · Question 141 · Select all that apply

A company uses Amazon Route 53 to register a public domain, example.com, in an AWS account. A central services group manages the account. The company wants to create a subdomain, test.example.com, in another AWS account to offer name services for Amazon EC2 instances that are hosted in the account. The company does not want to migrate the parent domain to the subdomain account. A network engineer creates a new Route 53 hosted zone for the subdomain in the second account. Which combination of steps must the network engineer take to complete the task? (Choose two.)

  • AAdd records for the hosts of the new subdomain to the new Route 53 hosted zone. (correct answer)
  • BUpdate the DNS service for the parent domain by adding name server (NS) records for the subdomain. (correct answer)
  • CUpdate the DNS service for the subdomain by adding name server (NS) records for the parent domain.
  • DCreate an alias record from the parent domain that points to the hosted zone for the subdomain in the second account.
  • EAdd a start of authority (SOA) record in the parent domain for the subdomain.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Add records for the hosts of the new subdomain to the new Route 53 hosted zone. Option B: Update the DNS service for the parent domain by adding name server (NS) records for the subdomain.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

ANS-C01 Question 142

Single page →
Topic 1 · Question 142 · Select all that apply

An IoT company collects data from thousands of sensors that are deployed in the Unites States and South Asia. The sensors use a proprietary communication protocol that is built on UDP to send the data to a fleet of Amazon EC2 instances. The instances are in an Auto Scaling group and run behind a Network Load Balancer (NLB). The instances, Auto Scaling group, and NLB are deployed in the us-west-2 Region. Occasionally, the data from the sensors in South Asia gets lost in transit over the internet and does not reach the EC2 instances. Which solutions will resolve this issue? (Choose two.)

  • AUse AWS Global Accelerator with the existing NLB. (correct answer)
  • BCreate an Amazon CloudFront distribution. Specify the existing NLB as the origin.
  • CCreate a second deployment of the EC2 instances and the NLB in the ap-south-1 Region. Use an Amazon Route 53 latency routing policy to resolve to the Region that provides the least latency. (correct answer)
  • DCreate a second deployment of the EC2 instances and the NLB in the ap-south-1 Region. Use an Amazon Route 53 failover routing policy to resolve to an alternate Region in case packets are dropped.
  • ETurn on enhanced networking on the EC2 instances by using the most recent Elastic Network Adapter (ENA) drivers.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Use AWS Global Accelerator with the existing NLB. Option C: Create a second deployment of the EC2 instances and the NLB in the ap-south-1 Region. Use an Amazon Route 53 latency routing policy to resolve to the Region that provides the least latency.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Global Accelerator routes users over the AWS backbone to the optimal endpoint for lower latency and fast failover. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

ANS-C01 Question 143

Single page →
Topic 1 · Question 143

A company has an application that runs on a fleet of Amazon EC2 instances. A new company regulation mandates that all network traffic to and from the EC2 instances must be sent to a centralized third-party EC2 appliance for content inspection. Which solution will meet these requirements?

  • AConfigure VPC flow logs on each EC2 network interface. Publish the flow logs to an Amazon S3 bucket. Create a third-party EC2 appliance to acquire flow logs from the S3 bucket. Log in to the appliance to monitor network content.
  • BCreate a third-party EC2 appliance in an Auto Scaling group fronted by a Network Load Balancer (NLB). Configure a mirror session. Specify the NLB as the mirror target. Specify a mirror filter to capture inbound and outbound traffic. For the source of the mirror session, specify the EC2 elastic network interfaces for all the instances that host the application. (correct answer)
  • CConfigure a mirror session. Specify an Amazon Kinesis Data Firehose delivery stream as the mirror target. Specify a mirror filter to capture inbound and outbound traffic. For the source of the mirror session, specify the EC2 elastic network interfaces for all the instances that host the application. Create a third-party EC2 appliance. Send all traffic to the appliance through the Kinesis Data Firehose delivery stream for content inspection.
  • DConfigure VPC flow logs on each EC2 network interface. Send the logs to Amazon CloudWatch. Create a third-party EC2 appliance. Configure a CloudWatch filter to send the flow logs to Amazon Kinesis Data Firehose to load the logs into the appliance.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a third-party EC2 appliance in an Auto Scaling group fronted by a Network Load Balancer (NLB). Configure a mirror session. Specify the NLB as the mirror target. Specify a mirror filter to capture inbound and ou...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. A Network Load Balancer handles very high throughput TCP/UDP traffic with ultra-low latency and static IPs.

ANS-C01 Question 144

Single page →
Topic 1 · Question 144

A company has two AWS Direct Connect links. One Direct Connect link terminates in the us-east-1 Region, and the other Direct Connect link terminates in the af-south-1 Region. The company is using BGP to exchange routes with AWS. How should a network engineer configure BGP to ensure that af-south-1 is used as a secondary link to AWS?

  • A• On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 200 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 50
  • B• On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 200 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 50 (correct answer)
  • C• On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 50 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 200
  • D• On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 50 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 200
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect...

Explanation

AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 145

Single page →
Topic 1 · Question 145 · Select all that apply

A team of infrastructure engineers wants to automate the deployment of Application Load Balancer (ALB) components by using the AWS Cloud Development Kit (AWS CDK). The CDK application must deploy an infrastructure stack that is reusable and consistent across multiple environments, AWS Regions, and AWS accounts. The lead network architect on the project has already bootstrapped the target accounts. The lead network architect also has deployed core network components such as VPCs and Amazon Route 53 private hosted zones across the multiple environments and Regions. The infrastructure engineers must design the ALB components in the CDK application to use the existing core network components. Which combination of steps will meet this requirement with the LEAST manual effort between environment deployments? (Choose two.)

  • ADesign the CDK application to read AWS CloudFormation parameters for the values that vary across environments and Regions. Reference these variables in the CDK stack for resources that require the variables.
  • BDesign the CDK application to read environment variables that contain account and Region details at runtime. Use these variables as properties of the CDK stack. Use context methods in the CDK stack to retrieve variable values. (correct answer)
  • CCreate a dedicated account for shared application services in the multi-account environment. Deploy a CDK pipeline to the dedicated account. Create stages in the pipeline that deploy the CDK application across different environments and Regions. (correct answer)
  • DWrite a script that automates the deployment of the CDK application across multiple environments and Regions. Distribute the script to engineers who are working on the project.
  • EUse the CDK toolkit locally to deploy stacks to each environment and Region. Use the --context flag to pass in variables that the CDK application can reference at runtime.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Design the CDK application to read environment variables that contain account and Region details at runtime. Use these variables as properties of the CDK stack. Use context methods in the CDK stack to retrieve variabl... Option C: Create a dedicated account for shared application services in the multi-account environment. Deploy a CDK pipeline to the dedicated account. Create stages in the pipeline that deploy the CDK application across differe...

Explanation

The AWS CDK defines cloud infrastructure as code using familiar programming languages.

ANS-C01 Question 146

Single page →
Topic 1 · Question 146

A company has critical VPC workloads that connect to an on-premises data center through two redundant active-passive AWS Direct Connect connections. However, a recent outage on one Direct Connect connection revealed that it takes more than a minute for traffic to fail over to the secondary Direct Connect connection. The company wants to reduce the failover time from minutes to seconds. Which solution will provide the LARGEST reduction in the BGP failover time?

  • AReduce the BGP hold-down timer that is configured on the BGP sessions on the Direct Connect connection VIFs.
  • BConfigure an Amazon CloudWatch alarm for the Direct Connect connection state to invoke an AWS Lambda function to fail over the traffic.
  • CConfigure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the AWS side.
  • DConfigure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the on-premises router. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the on-premises router.

Explanation

AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 147

Single page →
Topic 1 · Question 147

A European car manufacturer wants to migrate its customer-facing services and its analytics platform from two on-premises data centers to the AWS Cloud. The company has a 50-mile (80.4 km) separation between its on-premises data centers and must maintain that separation between its two locations in the cloud. The company also needs failover capabilities between the two locations in the cloud. The company's infrastructure team creates several accounts to separate workloads and responsibilities. The company provisions resources in the eu-west-3 Region and in the eu-central-1 Region. The company selects an AWS Direct Connect Partner in each Region and requests two resilient 1 Gbps fiber connections from each provider. The company's network engineer must establish a connection between all VPCs in the accounts and between the on-premises network and the AWS Cloud. The solution must provide access to all services in both Regions in case of network issues. Which solution will meet these requirements?

  • ACreate a Direct Connect gateway. Create a private VIF on each of the Direct Connect connections. Attach the private VIFs to the Direct Connect gateway. Use equal-cost multi-path (ECMP) routing to aggregate the four connections across the two Regions. Attach the Direct Connect gateway directly to each VPC's virtual private gateway.
  • BCreate a Direct Connect gateway. Create a transit gateway. Attach the transit gateway to the Direct Connect gateway. Create a transit VIF on each of the Direct Connect connections. Attach the transit VIFs to the Direct Connect gateway. Use a link aggregation group (LAG) to aggregate the four connections across the two Regions. Attach the transit gateway directly to each VPC.
  • CCreate a Direct Connect gateway. Create a transit gateway in each Region. Attach the transit gateways to the Direct Connect gateway. Create a transit VIF on each of the Direct Connect connections. Attach the transit VIFs to the Direct Connect gateway. Peer the transit gateways. Attach the transit gateways in each Region to the VPCs in the same Region. (correct answer)
  • DCreate a Direct Connect gateway. Create a private VIF on each of the Direct Connect connections. Attach the private VIFs to the Direct Connect gateway. Use a link aggregation group (LAG) to aggregate the four connections across the two Regions. Create a transit gateway. Attach the transit gateway to the Direct Connect gateway. Attach the transit gateway directly to each VPC.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a Direct Connect gateway. Create a transit gateway in each Region. Attach the transit gateways to the Direct Connect gateway. Create a transit VIF on each of the Direct Connect connections. Attach the transit V...

Explanation

AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS. AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

ANS-C01 Question 148

Single page →
Topic 1 · Question 148

A company wants to analyze TCP traffic to the internet. The traffic originates from Amazon EC2 instances in the company's VPC. The EC2 instances initiate connections through a NAT gateway. The required information includes source and destination IP addresses, ports, and the first 8 bytes of payload of TCP segments. The company needs to collect, store, and analyze all the required data points. Which solution will meet these requirements?

  • ASet up the EC2 instances as VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights. (correct answer)
  • BSet up the NAT gateway as a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon OpenSearch Service cluster. Analyze the data by using OpenSearch Dashboards.
  • CTurn on VPC Flow Logs on the EC2 instances. Specify the default format and a log destination of Amazon CloudWatch Logs. Analyze the flow log data by using CloudWatch Logs Insights.
  • DTurn on VPC Flow Logs on the EC2 instances. Specify a custom format and a log destination of Amazon S3. Analyze the flow log data by using Amazon Athena.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set up the EC2 instances as VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

ANS-C01 Question 149

Single page →
Topic 1 · Question 149

A company has three VPCs in a single AWS Region. Each VPC contains 15 Amazon EC2 instances, and no connectivity exists between the VPCs. The company is deploying a new application across all three VPCs. The application requires high bandwidth between the nodes. A network engineer must implement connectivity between the VPCs. Which solution will meet these requirements with the HIGHEST throughput?

  • AConfigure a transit gateway. Attach each VPC to the transit gateway. Configure static routing in each VPC to route traffic to the transit gateway.
  • BConfigure VPC peering between the three VPCs. Configure static routing to route traffic between the three VPCs. (correct answer)
  • CConfigure a transit VPConfigure a VPN gateway in each VPCreate an AWS Site-to-Site VPN tunnel from each VPC to the transit VPUse BGP routing to route traffic between the VPCs and the transit VPC.
  • DConfigure AWS Site-to-Site VPN connections between each VPC. Enable route propagation for each Site-to-Site VPN connection to route traffic between the VPCs.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure VPC peering between the three VPCs. Configure static routing to route traffic between the three VPCs.

Explanation

VPC peering privately connects two VPCs without a gateway. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 150

Single page →
Topic 1 · Question 150 · Select all that apply

A network engineer needs to deploy an AWS Network Firewall firewall into an existing AWS environment. The environment consists of the following: • A transit gateway with all VPCs attached to it • Several hundred application VPCs • A centralized egress internet VPC with a NAT gateway and an internet gateway • A centralized ingress internet VPC that hosts public Application Load Balancers • On-premises connectivity through an AWS Direct Connect gateway attachment The application VPCs have workloads deployed across multiple Availability Zones in private subnets with the VPC route table s default route (0.0.0.0/0) pointing to the transit gateway. The Network Firewall firewall needs to inspect east-west (VPC-to-VPC) traffic and north-south (internet-bound and on-premises network) traffic by using Suricata compatible rules. The network engineer must deploy the firewall by using a solution that requires the least possible architectural changes to the existing production environment. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

  • ADeploy Network Firewall in all Availability Zones in each application VPC.
  • BDeploy Network Firewall in all Availability Zones in a centralized inspection VPC. (correct answer)
  • CUpdate the HOME_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks. (correct answer)
  • DUpdate the EXTERNAL_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
  • EConfigure a single transit gateway route table. Associate all application VPCs and the centralized inspection VPC with this route table.
  • FConfigure two transit gateway route tables. Associate all application VPCs with one transit gateway route table. Associate the centralized inspection VPC with the other transit gateway route table. (correct answer)
Reveal answer & explanation
Correct answer: B, C, F

The correct answer is B, C, F. Option B: Deploy Network Firewall in all Availability Zones in a centralized inspection VPC. Option C: Update the HOME_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks. Option F: Configure two transit gateway route tables. Associate all application VPCs with one transit gateway route table. Associate the centralized inspection VPC with the other transit gateway route table.

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

ANS-C01 Question 151

Single page →
Topic 1 · Question 151 · Select all that apply

A company is using a shared services VPC with two domain controllers. The domain controllers are deployed in the company's private subnets. The company is deploying a new application into a new VPC in the account. The application will be deployed onto an Amazon EC2 for Windows Server instance in the new VPC. The instance must join the existing Windows domain that is supported by the domain controllers in the shared services VPC. A transit gateway is attached to both the shared services VPC and the new VPC. The company has updated the route tables for the transit gateway, the shared services VPC, and the new VPC. The security groups for the domain controllers and the instance are updated and allow traffic only on the ports that are necessary for domain operations. The instance is unable to join the domain that is hosted on the domain controllers. Which combination of actions will help identify the cause of this issue with the LEAST operational overhead? (Choose two.)

  • AUse AWS Network Manager to perform a route analysis for the transit gateway network. Specify the existing EC2 instance as the source. Specify the first domain controller as the destination. Repeat the route analysis for the second domain controller. (correct answer)
  • BUse port mirroring with the existing EC2 instance as the source and another EC2 instance as the target to obtain packet captures of the connection attempts.
  • CReview the VPC flow logs on the shared services VPC and the new VPC. (correct answer)
  • DIssue a ping command from one of the domain controllers to the existing EC2 instance.
  • EEnsure that route propagation is turned off on the shared services VPC.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Use AWS Network Manager to perform a route analysis for the transit gateway network. Specify the existing EC2 instance as the source. Specify the first domain controller as the destination. Repeat the route analysis f... Option C: Review the VPC flow logs on the shared services VPC and the new VPC.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale.

ANS-C01 Question 152

Single page →
Topic 1 · Question 152 · Select all that apply

A company has an order processing system that needs to keep credit card numbers encrypted. The company's customer-facing application runs as an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon CloudFront distribution is configured with the ALB as the origin. The company uses a third-party trusted certificate authority to provision its certificates. The company is using HTTPS for encryption in transit. The company needs additional field-level encryption to keep sensitive data encrypted during processing so that only certain application components can decrypt the sensitive data. Which combination of steps will meet these requirements? (Choose two.)

  • AImport the third-party certificate for the ALB. Associate the certificate with the ALB. Upload the certificate for the CloudFront distribution into AWS Certificate Manager (ACM) in us-west-2.
  • BImport the third-party certificate for the ALB into AWS Certificate Manager (ACM) in us-west-2. Associate the certificate with the ALUpload the certificate for the CloudFront distribution into ACM in the us-east-1 Region. (correct answer)
  • CUpload the private key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption profile and specify the fields that contain sensitive information. Create a field-level encryption configuration, and choose the newly created profile. Link the configuration to the appropriate cache behavior that is associated with sensitive POST requests.
  • DUpload the public key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption configuration, and specify the fields that contain sensitive information. Create a field-level encryption profile, and choose the newly created configuration. Link the profile to the appropriate cache behavior that is associated with sensitive GET requests.
  • EUpload the public key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption profile and specify the fields that contain sensitive information. Create a field-level encryption configuration, and choose the newly created profile. Link the configuration to the appropriate cache behavior that is associated with sensitive POST requests. (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Import the third-party certificate for the ALB into AWS Certificate Manager (ACM) in us-west-2. Associate the certificate with the ALUpload the certificate for the CloudFront distribution into ACM in the us-east-1 Reg... Option E: Upload the public key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption profile and specify the fields that contain sensitive information. Create a field...

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS Certificate Manager provisions and renews TLS certificates automatically. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 153

Single page →
Topic 1 · Question 153

A company has deployed a multi-VPC environment in the AWS Cloud. The company uses a transit gateway to connect all the VPCs together. In the past, the company has experienced a loss of connectivity between applications after changes to security groups, network ACLs, and route tables in a VPC. When these changes occur, the company wants to automatically verify that connectivity still exists between different resources in a single VPC.

  • ACreate a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
  • BCreate a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS. CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer. (correct answer)
  • CCreate a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the diffident paths in Route Analyzer.
  • DCreate a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Route Analyzer.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS. CloudTrail. Configure the rule to invoke...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS CloudTrail records API activity for auditing and governance.

ANS-C01 Question 154

Single page →
Topic 1 · Question 154

A company hosts a web application that runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The company uses an Amazon CloudFront distribution with the ALB as an origin. The application recently experienced an attack. In response, the company associated an AWS WAF web ACL with the CloudFront distribution. The company needs to use Amazon Athena to analyze application attacks that AWS WAF detects. Which solution will meet this requirement?

  • AConfigure the ALB and the EC2 instance subnets to produce VPC flow logs. Configure the VPC flow logs to deliver logs to an Amazon S3 bucket for log analysis.
  • BCreate a trail in AWS CloudTrail to capture data events. Configure the trail to deliver logs to an Amazon S3 bucket for log analysis.
  • CConfigure the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon S3 bucket for log analysis. (correct answer)
  • DTurn on access logging for the ALB. Configure the access logs to deliver the logs to an Amazon S3 bucket for log analysis.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon S3 bucket for log analysis.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Kinesis Data Firehose delivers streaming data to destinations like S3/Redshift with no servers to manage. Amazon Kinesis ingests and processes real-time streaming data at scale.

ANS-C01 Question 155

Single page →
Topic 1 · Question 155

A real estate company is using Amazon Workspaces to provide corporate managed desktop service to its real estate agents around the world. These Workspaces are deployed in seven VPCs. Each VPC is in a different AWS Region. According to a new requirement, the company’s cloud-hosted security information and events management (SIEM) system needs to analyze DNS queries generated by the Workspaces to identify the target domains that are connected to the Workspaces. The SIEM system supports poll and push methods for data and log collection. Which solution should a network engineer implement to meet these requirements MOST cost-effectively?

  • ACreate VPC flow logs in each VPC that is connected to the Workspaces instances. Publish the log data to a central Amazon S3 bucket. Configure the SIEM system to poll the S3 bucket periodically.
  • BConfigure an Amazon CloudWatch agent to log all DNS requests in Amazon CloudWatch Logs. Configure a subscription filter in CloudWatch Logs. Push the logs to the SIEM system by using Amazon Kinesis Data Firehose.
  • CConfigure VPC Traffic Mirroring to copy network traffic from each Workspace and to send the traffic to the SIEM system probes for analysis.
  • DConfigure Amazon Route 53 query logging. Set the destination as an Amazon Kinesis Data Firehose delivery stream that is configured to push data to the SIEM system. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Amazon Route 53 query logging. Set the destination as an Amazon Kinesis Data Firehose delivery stream that is configured to push data to the SIEM system.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. Kinesis Data Firehose delivers streaming data to destinations like S3/Redshift with no servers to manage. Amazon Kinesis ingests and processes real-time streaming data at scale. This option delivers the requirement at the lowest cost.

ANS-C01 Question 156

Single page →
Topic 1 · Question 156

A network engineer needs to design the architecture for a high performance computing (HPC) workload. Amazon EC2 instances will require 10 Gbps flows and an aggregate throughput of up to 100 Gbps across many instances with low-latency communication. Which architecture solution will optimize this workload?

  • APlace nodes in a single subnet of a VPC. Configure a cluster placement group. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system. (correct answer)
  • BPlace nodes in multiple subnets in a single VPC. Configure a spread placement group. Ensure that the EC2 instances support Elastic Network Adapters (ENAs) and that the drivers are updated on each instance operating system.
  • CPlace nodes in multiple VPCs Use AWS Transit Gateway to route traffic between the VPCs. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system.
  • DPlace nodes in multiple subnets in multiple Availability Zones. Configure a cluster placement group. Ensure that the EC2 instances support Elastic Network Adapters (ENAs) and that the drivers are updated on each instance operating system.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Place nodes in a single subnet of a VPC. Configure a cluster placement group. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance. This option meets the real-time / low-latency performance requirement.

ANS-C01 Question 157

Single page →
Topic 1 · Question 157

A company uses multiple AWS accounts and VPCs in a single AWS Region. The company must log all network traffic for Amazon EC2 instances and Amazon RDS databases. The company will use the log information to monitor and identify traffic flows in the event of a security incident. The information must be retained for 12 months but will be accessed infrequently after the first 90 days. The company must be able to view metadata that includes the vpc-id, subnet-id: and tcp-flags fields. Which solution will meet these requirements at the LOWEST cost?

  • AConfigure VPC flow logs with the default fields Store the logs in Amazon CloudWatch Logs.
  • BConfigure Traffic Mirroring on all AWS resources to point to a Network Load Balancer that will send the mirrored traffic to monitoring instances.
  • CConfigure VPC flow logs with additional custom format fields Store the logs in Amazon S3. (correct answer)
  • DConfigure VPC flow logs with additional custom format fields Store the logs in Amazon CloudWatch Logs.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure VPC flow logs with additional custom format fields Store the logs in Amazon S3.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

ANS-C01 Question 158

Single page →
Topic 1 · Question 158

A network engineer is evaluating a network setup for a global retail company. The company has an AWS Direct Connect connection between its on-premises data center and the AWS Cloud. The company has AWS resources in the eu-west-2 Region. These resources consist of multiple VPCs that are attached to a transit gateway. The company recently provisioned a few AWS resources in the eu-central-1. Region in a single VPC close to its users in this area. The network engineer must connect the resources in eu-central-1 with the on-premises data center and the resources in eu-west-2. The solution must minimize changes to the Direct Connect connection. What should the network engineer do to meet these requirements?

  • ACreate a new virtual private gateway. Attach the new virtual private gateway to the VPC in eu-central-1. Use a transit VIF to connect the VPC and the Direct Connect router.
  • BCreate a new transit gateway in eu-central-1. Create a peering attachment request to the transit gateway in eu-west-2. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gateway peering attachment. Accept the peering request. Add a static route in the transit gateway route table in eu-west-2 to point to the new transit gateway peering attachment. (correct answer)
  • CCreate a new transit gateway in eu-central-1. Use an AWS Site-to-Site VPN connection to peer both transit gateways. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gateway VPN attachment. Add a static route in the transit gateway route table in eu-west-2 to point to the new transit gateway peering attachment.
  • DCreate a new virtual private gateway. Attach the new virtual private gateway to the VPC in eu-central-1. Use a public VIF to connect the VPC and the Direct Connect router.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a new transit gateway in eu-central-1. Create a peering attachment request to the transit gateway in eu-west-2. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gate...

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale.

ANS-C01 Question 159

Single page →
Topic 1 · Question 159

A company has a 2 Gbps AWS Direct Connect hosted connection from the company’s office to a VPC in the ap-southeast-2 Region. A network engineer adds a 5 Gbps Direct Connect hosted connection from a different Direct Connect location in the same Region. The hosted connections are connected to different routers from the office with an iBGP session running in between the routers. The network engineer wants to ensure that the VPC uses the 5 Gbps hosted connection to route traffic to the office. Failover to the 2 Gbps hosted connection must occur when the 5 Gbps hosted connection is down. Which solution will meet these requirements?

  • AConfigure an outbound BGP policy from the router that is connected to the 2 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS. (correct answer)
  • BAdvertise a longer prefix route from the router that is connected to the 2 Gbps connection.
  • CAdvertise a less specific route from the router that is connected to the 5 Gbps connection.
  • DConfigure an outbound BGP policy from the router that is connected to the 5 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure an outbound BGP policy from the router that is connected to the 2 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 160

Single page →
Topic 1 · Question 160 · Select all that apply

An ecommerce company needs to implement additional security controls on all its domain names that are hosted in Amazon Route 53. The company's new policy requires data authentication and data integrity verification for all queries to the company’s domain names. The current Route 53 architecture has four public hosted zones. A network engineer needs to implement DNS Security Extensions (DNSSEC) signing and validation on the hosted zones. The solution must include an alert capability. Which combination of steps will meet these requirements? (Choose three.)

  • AEnable DNSSEC signing for Route 53 Request that Route 53 create a key-signing key (KSK) based on a customer managed key in AWS Key Management Service (AWS KMS). (correct answer)
  • BEnable DNSSEC signing for Route 53 Request that Route 53 create a zone-signing key (ZSK) based on a customer managed key in AWS Key Management Service (AWS KMS).
  • CCreate a chain of trust for the hosted zones by adding a Delegation Signer (DS) record for each subdomain
  • DCreate a chain of trust for the hosted zones by adding a Delegation Signer (DS) record to the parent zone. (correct answer)
  • ESet up an Amazon CloudWatch alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected. (correct answer)
  • FSet up an AWS CloudTrail alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected.
Reveal answer & explanation
Correct answer: A, D, E

The correct answer is A, D, E. Option A: Enable DNSSEC signing for Route 53 Request that Route 53 create a key-signing key (KSK) based on a customer managed key in AWS Key Management Service (AWS KMS). Option D: Create a chain of trust for the hosted zones by adding a Delegation Signer (DS) record to the parent zone. Option E: Set up an Amazon CloudWatch alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

Showing questions 141–160 of 292 · Page 8 of 15