Your company needs to leverage Amazon Simple Storage Solution (S3) for backup and archiving. According to company policy, data should not flow on the public Internet even if data is encrypted. You have set up two S3 buckets in useast-1 and us-west-2. Your company data center is located on the West Coast of the United States. The design must be cost-effective and enable minimal latency. Which design should you set up?

An AWS Direct Connect connection to us-east-1 and a Direct Connect connection to us-west-2.

An AWS Direct Connect connection to us-east-1.

An AWS Direct Connect connection to us-west-2.

An AWS Direct Connect connection to us-west-2 and a VPN connection to us-east-1.

A space exploration company owns a series of telescopes that capture a large number of images and data of the night sky.The images and data are processed on an application hosted on AWS Fargate in a target group assigned to an Application Load Balancer (ALB). The application is made available through the address https://space.example.com.Scientists require another custom-built application hosted on several Amazon EC2 instances within an Auto Scaling group.This application will be made available from the address https:// space.example.com/meteor. The company needs a solutionthat can automatically scale from a small number of requests overnight to a large number of requests for a future meteorshower.What is the MOST operationally efficient solution that meets these requirements?

Create a Network Load Balancer (NLB). Configure the NLB to listen on two ports. Configure a target group for one port to deliver all IP traffic to the Auto Scaling group to process the custom images. Configure a target group for thesecond port to deliver all IP traffic to Fargate. Use path-based routing in the ALB to route traffic for the URL prefix /meteor to the first target group. Route all other paths to the second target group.

Update the existing target group with the new EC2 instances. Update the application's ALB by adding a listener rule that redirects /meteor to the newly added EC2 instances.

Create a new target group. Configure the Auto Scaling group of the EC2 instances to use the target group. Update the ALB by adding a listener rule that redirects /meteor to the new target group.

Create a Network Load Balancer (NLB). Configure the NLB to listen on two ports. Configure a target group for one port to deliver all IP traffic to the Auto Scaling group to process the custom images. Configure a target group for thesecond port to deliver all IP traffic to Fargate. Use path-based routing in the ALB to route traffic for the URL prefix /meteor to the first target group. Route all other paths to the second target group.

Place the ALB behind an Amazon CloudFront distribution. Create a Lambda@Edge function that parses the request URI and adds the path-pattern header with the IP addresses of the EC2 instances to any request for /meteor. Add alistener rule to the ALB that looks for the HTTP header and uses the IP addresses of the EC2 instances to forward the traffic.

The Security department has mandated that all outbound traffic from a VPC toward an on-premises datacenter must go through a security appliance that runs on an Amazon EC2 instance.Which of the following maximizes network performance on AWS? (Choose two.)

Support for sending traffic over the Direct Connect connection

The instance sizes and families supported by the security appliance

Support for the enhanced networking drivers

Support for sending traffic over the Direct Connect connection

The instance sizes and families supported by the security appliance

Support for placement groups within the VPC

Security appliance support for multiple elastic network interfaces

A company wants to migrate its production and development applications to the AWS Cloud across multiple VPCs in three AWS Regions: us-east-1 (N. Virginia), eu-west-1 (Ireland), and ap-southeast-1 (Singapore). The company needs a scalable solution that provides connectivity between all three Regions. The solution also must provide private connectivity to the company's on-premises data center in Northern Virginia.Data that is transferred from on premises and data that is transferred between Regions must be encrypted in transit. The company requires predictable network performance and must minimize cost.The company has initiated a solution by deploying a transit gateway with two route tables in each Region. One route table is for the production environment, and one route table is for the development environment. What else must the company do to meet its requirements with the LOWEST latency?

Deploy an AWS Direct Connect connection in us-east-1 to the on-premises data center. Create one transit VIF for each transit gateway route table, and associate each transit VIF with a Direct Connect gateway. Associate all transitgateways with the Direct Connect gateway. Create transit gateway peering connections to route traffic between Regions.

Deploy an AWS Direct Connect connection in us-east-1 and a public VIF to the on-premises data center. On each transit gateway, create a VPN attachment over the public VIF for the production and development route tables. Createtransit gateway peering connections to route traffic between Regions.

Deploy an AWS Direct Connect connection in us-east-1 and a transit VIF to the on-premises data center. Associate all transit gateways and the transit VIF with a different Direct Connect gateway. Create transit gateway peeringconnections to route traffic between Regions.

Deploy an AWS Direct Connect connection in us-east-1 and a public VIF to the on-premises data center. On each transit gateway, create a VPN attachment over the public VIF for the production and development route tables. Routetraffic between Regions through the VPN connections.

Deploy an AWS Direct Connect connection in us-east-1 to the on-premises data center. Create one transit VIF for each transit gateway route table, and associate each transit VIF with a Direct Connect gateway. Associate all transitgateways with the Direct Connect gateway. Create transit gateway peering connections to route traffic between Regions.

A company wants to use thin clients running virtual desktops to replace 500 desktop computers used by its call center employees. The company is evaluating Amazon WorkSpaces as a solution.A network engineer who is testing with a thin client is unable to connect to Amazon WorkSpaces. After entering credentials, the network engineer receives the following error: "An error occurred while launching your WorkSpace. Please try again." What should the network engineer do to resolve this issue?

Update the inbound rules on the security group assigned to Amazon WorkSpaces to allow UDP on port 4172 and TCP on port 4172.

Update the inbound rules on the network ACL on the subnets used for Amazon WorkSpaces to allow UDP on port 4172 and TCP on port 4172.

Update the company's corporate firewall to allow outbound access to UDP on port 4172 and TCP on port 4172. Open inbound ephemeral ports explicitly to allow return communication.

Update the inbound rules on the security group assigned to Amazon WorkSpaces to allow UDP on port 4172 and TCP on port 4172.

Update the company's corporate firewall to allow inbound access to UDP on port 4172 and TCP on port 4172. Open outbound ephemeral ports explicitly to allow return communication.

A company's network engineer needs to evaluate and monitor DNS traffic. The company uses Amazon Route 53 as the DNS service for its public hosted zone. All DNS queries must be captured for future analysis. What should the network engineer do to meet these requirements?

Use Route 53 query logging to log information to Amazon CloudWatch Logs about the queries that Route 53 receives.

Use AWS WAF to log information to Amazon CloudWatch Logs about the queries that Route 53 receives.

Use VPC Flow Logs to log information to Amazon CloudWatch Logs Insights about the queries that Route 53 receives.

Use Route 53 query logging to log information to Amazon CloudWatch Logs about the queries that Route 53 receives.

Use AWS CloudTrail to log information to Amazon CloudWatch Logs Insights about the queries that Route 53 receives.

You have configured a dynamic VPN between your datacenter and your VPC. Your router says the tunnel is up and BGP is active, but for some reason, you are not seeing your routes propagate. What is most likely the issue?

You forgot to set route propagation to "yes" in the route table.

You need to configure the firewall for BGP.

Your router does not support BFD.

You need to obtain a new BGP MD5 key.

You forgot to set route propagation to "yes" in the route table.

Considering the rules of IPv4 subnetting, how many subnets and hosts per subnet are possible given the following network 192.168.130.130/28? (in this question ignore the fact that AWS reserves 5 IP addresses)

16 subnets and 14 hosts per subnet

8 subnets and 30 hosts per subnet

16 subnets and 14 hosts per subnet

32 subnets and 30 hosts per subnet

8 subnets and 14 hosts per subnet

You need to find the public IP address of an instance that you're logged in to. What command would you use?

curl http://169.254.169.254/latest/meta-data/public-ipv4

curl ftp://169.254.169.254/latest/meta-data/public-ipv4

scp localhost/latest/meta-data/public-ipv4

curl http://127.0.0.1/latest/meta-data/public-ipv4

curl http://169.254.169.254/latest/meta-data/public-ipv4

A company is deploying a critical application on two Amazon EC2 instances in a VPC. Failed client connections to the EC2 instances must be logged according to company policy. What is the MOST cost-effective solution to meet these requirements?

Move the EC2 instances to a dedicated VP

Enable VPC Flow Logs with a filter on the deny action. Publish the flow logs to Amazon CloudWatch Logs.

Move the EC2 instances to a dedicated VPC subnet. Enable VPC Flow Logs for the subnet with a filter on the reject action. Publish the flow logs to an Amazon Kinesis Data Firehose stream with a data delivery to an Amazon S3 bucket.

Enable VPC Flow Logs, filtered for rejected traffic, for the elastic network interfaces associated with the instances. Publish the flow logs to an Amazon Kinesis Data Firehose stream with a data delivery to an Amazon S3 bucket.

Enable VPC Flow Logs, filtered for rejected traffic, for the elastic network interfaces associated with the instances. Publish the flow logs to Amazon CloudWatch Logs.

You need to find the subnet, the security group and the VPC that your instance is associated with. You only have access to the terminal of an instance with an admin role attached. What is the first part of the command you would use?

aws ec2 describe-security-groups

Your company runs an application for the US market in the us-east-1 AWS region. This application uses proprietary TCP and UDP protocols on Amazon Elastic Compute Cloud (EC2) instances. End users run a real-time, front-end application on their local PCs. This front-end application knows the DNS hostname of the service.You must prepare the system for global expansion. The end users must access the application with lowest latency. How should you use AWS services to meet these requirements?

Set the Elastic Load Balancing (ELB) load balancer in front of the hosts of the service, and register the ELB name of the main service host as an ALIAS record with a latency-based routing policy in Route 53.

Register the IP addresses of the service hosts as "A" records with latency-based routing policy in Amazon Route 53, and set a Route 53 health check for these hosts.

Set the Elastic Load Balancing (ELB) load balancer in front of the hosts of the service, and register the ELB name of the main service host as an ALIAS record with a latency-based routing policy in Route 53.

Set Amazon CloudFront in front of the host of the service, and register the CloudFront name of the main service as an ALIAS record in Route 53.

Set the Amazon API gateway in front of the service, and register the API gateway name of the main service as an ALIAS record in Route 53.

A legacy, on-premises web application cannot be load balanced effectively. There are both planned and unplanned events that cause usage spikes to millions of concurrent users. The existing infrastructure cannot handle the usage spikes. The CIO has mandated that the application be moved to the cloud to avoid further disruptions, with the additional requirement that source IP addresses be unaltered to support network traffic-monitoring needs. Which of the following designs will meet these requirements?

Use an Auto Scaling group of EC2 instances in a target group behind a Network Load Balancer.

Use an Auto Scaling group of Amazon EC2 instances behind a Classic Load Balancer.

Use an Auto Scaling group of EC2 instances in a target group behind an Application Load Balancer.

Use an Auto Scaling group of EC2 instances in a target group behind a Classic Load Balancer.

Use an Auto Scaling group of EC2 instances in a target group behind a Network Load Balancer.

You have a DX connection and a VPN connection as backup for your 10.0.0.0/16 network. You just received a letter indicating that the colocation provider hosting the DX connection will be undergoing maintenance soon. It is critical that you do not experience any downtime or latency during this period. What is the best course of action?

Configure the VPN as a static VPN instead of dynamic.

Configure AS_PATH Prepending on the DX connection to make it the less preferred path.

Advertise 10.0.0.0/9 and 10.128.0.0/9 over your VPN connection.

You are your company's AWS cloud architect. You have created a VPC topology that consists of 3 VPCs. You have a centralised VPC (VPC-Shared) that provides shared services to the remaining 2 departmental dedicated VPCs (VPCDept1 and VPC-Dept2). The centralised VPC is VPC peered to both of the departmental VPCs, that is a VPC peering connection exists between VPC-Shared and VPCDept1, and a VPC peering connection exists between VPC-Shared and VPC-Dept2.Select the correct option from the list below.

Instances within VPC-Dept1 can communicate directly with instances in VPC-Shared, as long as the appropriate routes and security groups are in place, and vice versa regardless of who initiates communication

Network traffic is possible between VPC-Shared instances and VPC-Dept1 and VPC-Dept2 instances as long as the appropriate routes and security groups are in place, but only for communication that is initiated from VPC1-Sharedinstances as the default peering bi-directional communication flag has been disabled.

Instances within VPC-Dept1 can communicate directly with instances in VPC-Shared, as long as the appropriate routes and security groups are in place, and vice versa regardless of who initiates communication

All network communication remains blocked between all VPCs until the respective peering bi-directional communication flags are set to the appropriate setting that allows traffic to flow.

Network traffic is possible between VPC-Shared instances and VPC-Dept1 and VPC-Dept2 instances as long as the appropriate routes and security groups are in place, but only for communication that is initiated from VPC1-Sharedinstances as the default peering bi-directional communication flag has been enabled.

You have a hybrid environment in which your VPC queries your on-premises DNS server for up resources in your environment. The EC2 instances in your VPC are unable to resolve on-premises resources. What are two possible reasons for this problem? (Choose two.)

Your NACL is blocking UDP port 53 outbound

Your NACL is blocking TCP port 53 outbound.

Your NACL is blocking UDP port 53 outbound

Your security group is blocking port 53 inbound

Your NACL is blocking TCP port 53 outbound.

Your on-premises firewall is blocking port 443

To get started using AWS Direct Connect, in which of the following steps do you configure Border Gateway Protocol (BGP)?

Submit AWS Direct Connect Connection Request

You want to send a broadcast message to your 10.0.0.0/24 subnet, which one of these addresses should you use?

You cannot send a broadcast in an AWS VPC.

Accompany has a public domain, company.com, that is hosted by a DNS provider. The company creates a public hosted zone, cloud.company.com, in Amazon Route 53. The company wants to keep all public AWS application DNS records under this hosted zone.The company recently deployed its first public application behind an Elastic Load Balancer in its AWS environment. The domain name app1.cloud.company.com needs to access the application. Which solution will meet these requirements?

On the DNS provider, create A records for cloud under company.com. Point these records to Route 53 name server IP addresses of the public hosted zone. In Route 53, create an ALIAS (A) record for app1 under cloud.company.com.Point this record to the Elastic Load Balancer.

On the DNS provider, create a subdomain for cloud under company.com. Create a CNAME record for app1 under cloud.company.com. Point this record to the Elastic Load Balancer public DNS name. In Route 53, create NS records forcloud.company.com. Point these records to the DNS provider name servers.

On the DNS provider, create NS records for cloud under company.com. Point these records to Route 53 name servers of the public hosted zone. In Route 53, create an ALIAS (A) record for app1 under cloud.company.com. Point thisrecord to the Elastic Load Balancer.

On the DNS provider, create a subdomain for cloud under company.com. Create a CNAME record for app1 under cloud.company.com. Point this record to the Elastic Load Balancer public DNS name. In Route 53, create A records forcloud.company.com. Point these records to the DNS provider name servers.

You are using the CLI to assign multiple IP addresses to interfaces. The operation fails. What is the most likely reason?

One or more of the IP addresses could not be assigned.

You cannot assign IP addresses in the CLI.

You can only assign 5 IP addresses at a time through the CLI.

One or more of the IP addresses could not be assigned.

All of the IP addresses could not be assigned.

You are building an application that provides real-time audio and video services to customers on the Internet. The application requires high throughput. To ensure proper audio and video transmission, minimal latency is required. Which of the following will improve transmission quality?

Use multiple elastic network interfaces

A company has two redundant AWS Direct Connect connections to a VPC. The VPC is configured using BGP metrics so that one Direct Connect connection is used as the primary traffic path. The company wants the primary Direct Connect connection to fail to the secondary in less than one second. What should be done to meet this requirement?

Enable Bidirectional Forwarding Detection (BFD) on the company's router with a detection minimum interval of 300 ms and a BFD liveness detection multiplier of 3.

Configure BGP on the company's router with a keep-alive to 300 ms and the BGP hold timer to 900 ms.

Enable Bidirectional Forwarding Detection (BFD) on the company's router with a detection minimum interval of 300 ms and a BFD liveness detection multiplier of 3.

Enable Dead Peer Detection (DPD) on the company's router with a detection minimum interval of 300 ms and a DPD liveliness detection multiplier of 3.

Enable Bidirectional Forwarding Detection (BFD) echo mode on the company's router and disable sending the Internet Control Message Protocol (ICMP) IP packet requests.

Your application server instances reside in the private subnet of your VPC. These instances need to access a Git repository on the Internet. You create a NAT gateway in the public subnet of your VPC. The NAT gateway can reach the Git repository, but instances in the private subnet cannot. You confirm that a default route in the private subnet route table points to the NAT gateway. The security group for your application server instances permits all traffic to the NAT gateway.What configuration change should you make to ensure that these instances can reach the patch server?

Configure an outbound rule on the application server instance security group for the Git repository.

Assign public IP addresses to the instances and route 0.0.0.0/0 to the Internet gateway.

Configure an outbound rule on the application server instance security group for the Git repository.

Configure inbound network access control lists (network ACLs) to allow traffic from the Git repository to the public subnet.

Configure an inbound rule on the application server instance security group for the Git repository.

Considering your knowledge of both the OSI and TCP/IP models - select the following statement which you consider to NOT be true.

The TCP/IP Application layer maps to 2 of the OSI Layers

The top layer in the OSI model is named the Application layer

The TCP/IP Application layer maps to 3 of the OSI Layers

The top layer in the TCP/IP model is named the Application layer

A user is running a batch process on EBS backed EC2 instances. The batch process launches few EC2 instances to process hadoop Map reduce jobs which can run between 50-600 minutes or sometimes for even more time. The user wants a configuration that can terminate the instance only when the process is completed. How can the user configure this with CloudWatch?

Configure the CloudWatch action to terminate the instance when the CPU utilization falls below 5%

Configure a job which terminates all instances after 600 minutes

It is not possible to terminate instances automatically

Set up the CloudWatch with Auto Scaling to terminate all the instances

Configure the CloudWatch action to terminate the instance when the CPU utilization falls below 5%

You are under a DDoS attack and you have added a deny all TCP rule to your NACL, but traffic is still coming. What did you do wrong?

You configured the rule number to be too low.

A NACL can't protect against a DDoS.

You need to add a deny rule outbound also since NACLs are stateful.

Imagine you are using AWS Direct Connect with just one connection from your router to the AWS Direct Connect router. If your connection becomes unavailable, the communication with AWS cloud is lost. What is the best method to prevent this from happening?

AWS Direct Connect recommends that you request and configure two dedicated connections to AWS either using BGP Multipath (Active/Active) connection or the failover (Active/Passive) connection.

AWS Direct Connect neither provides BGP nor provides the failover.

AWS Direct Connect recommends to have the same configuration set up in a multi AZ zone to prevent such loss in connections.

AWS Direct Connect recommends that you request and configure two dedicated connections to AWS either using BGP Multipath (Active/Active) connection or the failover (Active/Passive) connection.

AWS Direct connect does not have a provision to prevent the situation but when you design the system, it is recommended to request a back-up instance to which the traffic can be re-routed.

A company wants to enforce a compliance requirement that its Amazon EC2 instances use only on-premises DNS servers for name resolution. Outbound DNS requests to all other name servers must be denied. A network engineer configures the following set of outbound rules for a security group: The network engineer discovers that the EC2 instances are still able to resolve DNS requests by using Amazon DNS servers inside the VPC. Why is the solution failing to meet the compliance requirement?

The EC2 instances are using the HTTPS port to send DNS queries to Amazon DNS servers.

The security group cannot filer outbound traffic to the Amazon DNS servers.

The security group must have inbound rules to prevent DNS requests from coming back to EC2 instances.

The EC2 instances are using the HTTPS port to send DNS queries to Amazon DNS servers.

The security group cannot filter outbound traffic to destinations within the same VPC.

You have just peered two VPCs, and you need to improve performance for instances you plan on deploying. What are two steps you would take to do this? (Choose two.)

Create two subnets in the same AZ and create a placement group.

Ensure you choose instances that use enhanced networking.

Create two subnets in the same AZ and create a placement group.

Set the MTU of your instances to 1500.

Create two subnets in different AZs and create a placement group.

Ensure you choose instances that use enhanced networking.

You can use the ____ command of the AWS Config service CLI to see the compliance state of each resource that AWS Config evaluates for a specific rule.

get-compliance-details-by-config-rule

describe-compliance-by-resource

describe-compliance-by-config-rule

get-compliance-details-by-config-rule

get-compliance-details-by-resource

A company has deployed a production environment in the AWS Cloud. The environment is contained in a VPC and includes a virtual private gateway. The company has established an AWS Direct Connect connection. which includes aprivate Virtual Interface (VIF), and a VPN connection to the on-premises data center.For traffic originating in the VPC, what is the order of BGP path selection from MOST preferred to LEAST preferred?

Longest prefix match, static routes, Direct-Connect BGP routes, VPN BGP routes.

Direct Connect BGP routes, static routes, longest prefix match, VPN BGP routes.

Static routes, longest prefix match, Direct Connect BGP routes, VPN BGP routes.

Longest prefix match, static routes, Direct-Connect BGP routes, VPN BGP routes.

Longest prefix match, VPN BGP routes, static routes, Direct Connect BGP routes.

Your company has a 1-Gbps AWS Direct Connect connection to AWS. Your company needs to send traffic from onpremises to a VPC owned by a partner company. The connectivity must have minimal latency at the lowest price. Which of the following connectivity options should you choose?

Enable VPC peering and use your VPC as a transitive point to reach the partner VPC.

Create a new Direct Connect connection, and set up a new circuit to connect to the partner VPC using a private virtual interface.

Create a new Direct Connect connection, and leverage the existing circuit to connect to the partner VPC.

Create a new private virtual interface, and leverage the existing connection to connect to the partner VPC.

Enable VPC peering and use your VPC as a transitive point to reach the partner VPC.

Amazon ANS-C00 Practice Test 3 - Free Online Exam Prep & Questions

What must be added to your web server configuration to view the true requesting IP address?

X-Actual-IP

X-Forwarded-Proto

X-Amzn-Trace-ID

X-Forwarded-For

Comment (0)

Amazon ANS-C00 Practice Test 3

Question

Amazon ANS-C00 Practice Tests

Practice Tests