A company uses multiple AWS accounts within AWS Organizations and has services deployed in a single AWS Region. The instances in a private subnet occasionally download patches from the internet through a NAT gateway. The company recently migrated from VPC peering to AWS Transit Gateway. The cumulative traffic through deployed NAT gateways is less than 1 Gbps. The NAT gateway hourly charge contributes to most of the NAT gateway costs across all inked accounts.What should the company do to reduce NAT gateway hourly costs?

Use VPC peering to send traffic through the centralized NAT gateways.

Deploy and use NAT gateways in the same Availability Zone as the heavy-traffic resources.

Move to a centralized NAT gateway architecture with NAT gateways deployed in an egress VP

Use VPC peering to send traffic through the centralized NAT gateways.

Use VPC endpoints to send traffic to AWS services in the same Region.

Move to a centralized NAT gateway architecture with NAT gateways deployed in an egress VPC. Use AWS Transit Gateway to send traffic through the centralized NAT gateways.

A company has an application running in an Amazon VPC that must be able to communicate with on-premises resources in a data center. Network traffic between AWS and the data center will initially be minimal, but will increase to more than 10 Gbps over the next few months. The company's goal is to launch the application as quickly as possible.The network engineer has been asked to design a hybrid IT connectivity solution. What should be done to meet these requirements?

Allocate elastic IPs to Amazon EC2 instances for temporary access to on-premises resources, then provision AWS VPN connections between an Amazon VPC and the data center.

Submit a 1 Gbps AWS Direct Connect connection request, then increase the number of Direct Connect connections, as needed.

Allocate elastic IPs to Amazon EC2 instances for temporary access to on-premises resources, then provision AWS VPN connections between an Amazon VPC and the data center.

Provision an AWS VPN connection between an Amazon VPC and the data center, then submit an AWS Direct Connect connection request. Later, cut over from the VPN connection to one or more Direct Connect connections, as needed.

Provision a 100 Mbps AWS Direct Connect connection between an Amazon VPC and the data center, then submit a Direct Connect connection request. Later, cut over from the hosted connection to one or more Direct Connect connections, as needed.

You are designing the network infrastructure for an application server in Amazon VPC. Users will access all the application instances from the Internet and from an on-premises network. The on-premises network is connected to your VPC over an AWS Direct Connect link.How should you design routing to meet these requirements?

Configure a single routing table with a default route via the IGW. Propagate specific routes for the on-premises networks via BGP on the AWS Direct Connect customer router. Associate the routing table with all VPC subnets.

Configure a single routing table with two default routes: one to the Internet via an IGW, the other to the on-premises network via the VGW. Use this routing table across all subnets in your VPC.

Configure two routing tables: one that has a default route via the IGW, and another that has a default route via the VGW.Associate both routing tables with each VPC subnet.

Configure a single routing table with a default route via the IGW. Propagate a default route via BGP on the AWS Direct Connect customer router. Associate the routing table with all VPC subnet.

Configure a single routing table with a default route via the IGW. Propagate specific routes for the on-premises networks via BGP on the AWS Direct Connect customer router. Associate the routing table with all VPC subnets.

You have a global corporate network with 153 individual IP prefixes in your internal routing table. You establish a private virtual interface over AWS Direct Connect to a VPC that has an Internet gateway (IGW). All instances in the VPC must be able to route to the Internet via an IGW and route to the global corporate network via the VGW. How should you configure your on-premises BGP peer to meet these requirements?

Enable route propagation on the VPC route table

Configure AS-Prepending on your BGP session

Summarize your prefix announcement to less than 100

Announce a default route to the VPC over the BGP session

Enable route propagation on the VPC route table

Your company maintains an Amazon Route 53 private hosted zone. DNS resolution is restricted to a single, pre-existing VPC. For a new application deployment, you create an additional VPC in the same AWS account. Both this new VPC and your on-premises DNS infrastructure must resolve records in the existing private hosted zone. Which two activities are required to enable DNS resolution both within the new VPC and from the on-premises infrastructure? (Choose two.)

Update the DHCP options set for the new VPC with the Route 53 nameserver IP addresses.

Update the Route 53 private hosted zone's VPC associations to include the new VPC.

Update the DHCP options set for the new VPC with the Route 53 nameserver IP addresses.

Update the Route 53 private hosted zone's VPC associations to include the new VPC.

Launch Amazon EC2-based DNS proxies in the new VPSpecify the proxies as forwarders in the on-premises DNS.

Update the on-premises DNS to include forwarders to the Route 53 nameserver IP addresses.

Launch Amazon EC2-based DNS proxies in the new VPC. Specify the proxies in the DHCP options set.

You deploy your Internet-facing application is the us-west-2(Oregon) region. To manage this application and upload content from your corporate network, you have a 1-Gbps AWS Direct Connect connection with a private virtual interface via one of the associated Direct Connect locations. In normal operation, you use approximately 300 Mbps of the available bandwidth, which is more than your Internet connection from the corporate network.You need to deploy another identical instance of the application is us-east-1(N Virginia) as soon as possible. You need to use the benefits of Direct Connect. Your design must be the most effective solution regarding cost, performance, and time to deploy.Which design should you choose?

Use the inter-region capabilities of Direct Connect to establish a private virtual interface from us-west-2 Direct Connect location to the new VPC in us-east-1.

Deploy an IPsec VPN over your corporate Internet connection to us-east-1 to provide access to the new VPC.

Use the inter-region capabilities of Direct Connect to deploy an IPsec VPN over a public virtual interface to the new VPC in us-east-1.

Use VPC peering to connect the existing VPC in us-west-2 to the new VPC in us-east-1, and then route traffic over Direct Connect and transit the peering connection.

Your Amazon Kinesis application receives data streams from thousands of devices. The data is then stored in an onpremises Hadoop cluster. You are concerned about historical data that shows periods of sustained traffic between 1 Gbps and 2 Gbps during peaks. You must ensure that you have secure, fault- tolerant connectivity between Amazon Kinesis and your data center. What should you implement to address these needs?

Deploy three 1-Gbps Direct Connect connections.

Deploy a single 1-Gbps Direct Connect connection with a VPN backup.

Deploy three 1-Gbps Direct Connect connections.

Deploy two 1-Gbps Direct Connect connections.

Set up an IPsec VPN connection over Direct Connect with two tunnels.

You ping an Amazon Elastic Compute Cloud (EC2) instance from an on-premises server. VPC Flow Logs record the following:2 123456789010 eni-1235b8ca 10.123.234.78 172.11.22.33 0 0 1 8 672 1432917027 1432917142 ACCEPT OK2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917027 1432917082 ACCEPT OK2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917094 1432917142 REJECT OKWhy are ICMP responses not received by the on-premises system?

The outbound network access control list is blocking the traffic

The inbound network access control list is blocking the traffic

The outbound network access control list is blocking the traffic

The inbound security group is blocking the traffic.

The outbound security group is blocking the traffic.

A media company that is based in Los Angeles, California, closed all of its on-premises data centers due to rising costs and inconsistent utilization. The company has deployed its video editing applications on Amazon EC2 instances in the AWS Cloud. The company has deployed to the us-west-1 Region and uses the internet for delivery of the applications.Users are reporting high latency from Los Angeles to us-west-1. The company needs to reduce the latency to the EC2 instances while continuing to use the internet for delivery. Which solution meets these requirements?

Order and deploy an AWS Direct Connect private VIF to us-west-1.

Enable a Los Angeles-based AWS Local Zone. Continue to run the EC2 instances in us-west-1.

Order and deploy an AWS Direct Connect public VIF to us-west-2.

Enable a Los Angeles-based AWS Local Zone. Redeploy the EC2 instances in the Local Zone.

You have several Amazon Glacier vaults you would like to monitor. How might you monitor those vaults?

Create a custom AWS Config rule.

Use an AWS managed Config rule.

Create a KMS policy and attach it to your Amazon Glacier vault.

Refer to the image. You have three VPCs: A, B, and

VPCs A and C are both peered with VPC

VPCs A and C are both peered with VPCChange the IP address of i-2 to 10.0.0.100. Assign it an elastic IP address.

VPCs A and C are both peered with VPC

The IP address ranges are as follows:VPC A: 10.0.0.0/16VPC B: 192.168.0.0/16VPC C: 10.0.0.0/16Instance i-1 in VPC A has the IP address 10.0.0.10. Instance i-2 in VPC C has the IP address 10.0.0.10. Instances i-3 and i- 4 in VPC B have the IP addresses 192.168.1.10 and 192.168.1.20, respectively, i-3 and i-4 are in the subnet 192.168.1.0/24. i-3 must be able to communicate with i-1 i-4 must be able to communicate with i-2 i-3 and i-4 are able to communicate with i-1, but not with i-2.Which two steps will fix this problem? (Choose two.)

Create subnets 192.168.1.0/28 and 192.168.1.16/28. Move i-3 and i-4 to these subnets, respectively.

Create subnets 192.168.1.0/27 and 192.168.1.16/27. Move i-3 and i-4 to these subnets, respectively.

VPCs A and C are both peered with VPCChange the IP address of i-2 to 10.0.0.100. Assign it an elastic IP address.

Create a new route table for VPC B, with unique route entries for destination VPC A and destination VPC C.

Create two route tables: one with a route for destination VPC A, and another for destination VPC C.

An organization will be expanding its current network design. When fully built out, there will be 99 VPCs spread across 11 AWS accounts (9 VPCs per account). There is currently an AWS Direct Connect connection into one account with 9 VPCs, each with a virtual network interface (VIF) per VPC.Which of the following designs will minimize cost while allowing the organization to expand?

Create a transit VPC in the existing account that consists of two routers in separate Availability Zones. Connect each VPC to the two routers in the transit VPC by using VPN.

Order 10 new Direct Connect connections, one from each of the accounts that will be provisioned. Create private VIFs in each account. Attach one private VIF per VPC.

Create a public VIF on the Direct Connect connection. Leverage the public VIF to create a VPN connection to each VPC.

Create hosted private VIFs in the existing account. Connect a private VIF to an AWS Direct Connect gateway in each account. Connect the gateway in each account to the VPCs.

Create a transit VPC in the existing account that consists of two routers in separate Availability Zones. Connect each VPC to the two routers in the transit VPC by using VPN.

In Amazon CloudFront, while creating a web distribution, which of the following can be used as origin servers?

Any combination of Amazon S3 buckets and HTTP servers

Any combination AWS Glacier archives and Oracle server

Any combination of Amazon DB intances and XML servers

Any combination of Amazon S3 buckets and HTTP servers

Any combination of Amazon Data Insights and PHP servers

You run a well-architected, multi-AZ application in the eu-central-1 (Frankfurt) AWS region. The application is hosted in a VPC and is only accessed from the corporate network. To support large volumes of data transfer and administration of the application, you use a single 10-Gbps AWS Direct Connect connection with multiple private virtual interfaces. As part of a review, you decide to improve the resilience of your connection to AWS and make sure that any additional connectivity does not share the same Direct Connect routers at AWS. You need to provide the best levels of resilience to meet the application's needs.Which two options should you consider? (Choose two.)

Deploy an IPsec VPN over a public virtual interface on a new 10-Gbps Direct Connect connection.

Install a second 10-Gbps Direct Connect connection to a Direct Connect location in eu-west-1.

Install a second 10-Gbps Direct Connect connection to the same Direct Connection location.

Deploy an IPsec VPN over a public virtual interface on a new 10-Gbps Direct Connect connection.

Install a second 10-Gbps Direct Connect connection to a Direct Connect location in eu-west-1.

Deploy an IPsec VPN over the Internet to the eu-west-1 region for diversity.

Install a second 10-Gbps Direct Connect connection to a second Direct Connect location for eu-central-1.

You have 4 Direct Connect connections from your datacenter. Site A advertises 172.16.0.0/16 AS 65000, Site B advertises 172.16.0.128/25 AS 65000 65000 65000, Site C advertises 172.0.0.0/8 AS 65000 and Site D advertises 172.16.0.0/24 AS 65000. Which site will AWS choose to reach your network?

Site B: 172.16.0.128/25 AS 65000 65000 65000

A company is migrating a legacy storefront web application to the AWS Cloud. The application is complex and will take several months to refactor. A solutions architect recommended an interim solution of using Amazon CloudFront with a custom origin pointing to the SSL endpoint URL for the legacy web application until the replacement is ready and deployed.The interim solution has worked for several weeks. However, all browser connections recently began showing an HTTP 502Bad Gateway error with the header "X-Cache: Error from cloudfront." Monitoring services show that the HTTPS port 443 onthe legacy web application is open and responding to requests. What is the likely cause of the error, and what is the solution?

The origin access identity is not correct. Edit the CloudFront distribution and update the identity in the origins settings.

The SSL certificate on the CloudFront distribution has expired. Use AWS Certificate Manager (ACM) in the us-east-1 Region to replace the SSL certificate in the CloudFront distribution with a new certificate.

The SSL certificate on the legacy web application server has expired. Use AWS Certificate Manager (ACM) in the useast- 1 Region to create a new SSL certificate. Export the public and private keys, and install the certificate on thelegacy web application.

The SSL certificate on the legacy web application server has expired. Replace the SSL certificate on the web server with one signed by a globally recognized certificate authority (CA). Install the full certificate chain onto the legacy webapplication server.

You work for a company that has several instances running with automatically assigned public IPs. You performed an upgrade that required you to restart the instances from the console and your DNS records don't work anymore. What happened?

The instances changed their public IP addresses on restart

Your network interfaces need to be reinitialized

Restarting too many instances at once overloads the system

The instances changed their public IP addresses on restart

You have been tasked with migrating your company's proprietary massively large dataset sorting application to AWS. The application currently runs on 4 highly spec'd servers that are in a cluster arrangement and runs 24x7, with the average CPU utilisation across any 24hr period being approx 85% - the migration of this cluster once up and running on AWS is expected to run similarly. The servers shuffle data internally and between themselves. Your company's financial performance is entirely dependent on the speed at which it can sort your customers datasets, that is the faster a sorted result can be returned the better your company's bottom line. Of the choices presented below, select the optimal network configuration that will ensure the best financial results for your company.

Enable Jumbo Frames to ensure better data throughput between instances

Disable Jumbo Frames to ensure better data throughput between instances

Enable Jumbo Frames to ensure better data throughput between instances

Create an autoscaled group of c4.8xlarge instances - with min 1 and max 4 - this will ensure your operational costs a minimal

Configure a CloudWatch Alarm to add more CPUs to the instances when average cluster CPU utilisation breaches 85%

You have 3 VPCs that need to be able to pass traffic. In what two ways can you achieve this? (Choose two.)

Peer each VPC to every other VPC to create a full mesh peering.

Create VPNs between them and adjust the routing tables accordingly.

Peer each VPC to every other VPC to create a full mesh peering.

Peer them, VPC peering allows transitive peering as of December 2017.

Call AWS to enable transitive peering.

Create VPNs between them and adjust the routing tables accordingly.

Your company runs an HTTPS application using an Elastic Load Balancing (ELB) load balancer/PHP on nginx server/RDS inmultiple Availability Zones. You need to apply Geographic Restriction and identify the client's IP address in your applicationto generate dynamic content.How should you utilize AWS services in a scalable fashion to perform this task?

Modify the nginx log configuration to record value in X-Forwarded-For and use CloudFront to apply the Geographic Restriction.

Enable ELB access logs to store the client IP address and parse these to dynamically modify a blacklist.

Use X-Forwarded-For with security groups to apply the Geographic Restriction.

Modify the application code to use value of X-Forwarded-For and CloudFront to apply the Geographic Restriction.

A company installed an AWS Site-to-Site VPN and configured it to use two tunnels. The company has learned that the VPN connectivity is unstable. During a ping test from the on-premises data center to AWS, a network engineer notices that the first few ICMP replies time out but that subsequent requests are successful. The AWS Management Console shows that the status for both tunnels last changed at the same time the ping responses were successfully received.Which steps should the network engineer take to resolve the instability? (Choose two.)

Use AS PATH prepending on one path to cause all traffic to prefer that tunnel.

Use a higher multi-exit discriminator (MED) value on the preferred path to prefer that tunnel.

Enable dead peer detection (DPD) on the customer gateway device.

Change the tunnel configuration to active/standby on the virtual private gateway.

Use AS PATH prepending on one path to cause all traffic to prefer that tunnel.

Send ICMP requests to an instance in the VPC every 5 seconds from the on-premises network.

Use a higher multi-exit discriminator (MED) value on the preferred path to prefer that tunnel.

Your company decides to use Amazon S3 to augment its on-premises data store. Instead of using the company's highly controlled, on-premises Internet gateway, a Direct Connect connection is ordered to provide high bandwidth, low latency access to S3. Since the company does not own a publically routable IPv4 address block, a request was made to AWS for an AWS-owned address for a Public Virtual Interface (VIF).The security team is calling this new connection a "backdoor", and you have been asked to clarify the risk to the company. Which concern from the security team is valid and should be addressed?

AWS advertises its aggregate routes to the Internet allowing anyone on the Internet to reach the router.

Direct Connect customers with a Public VIF in the same region could directly reach the router.

EC2 instances in the same region with access to the Internet could directly reach the router.

The S3 service could reach the router through a pre-configured VPC Endpoint.

Select the answer/s that correctly state how Jumbo Frames work

Jumbo Frames can assist with application performance

Jumbo Frames assist with application disk storage

Jumbo Frames can assist with application performance

Jumbo Frames are supported across Virtual Private Gateway connections

Jumbo Frames are enabled by increasing the MTU size to 9000 kilobytes

A company's website is hosted on an Amazon EC2 instance. The website delivers dynamic content through Amazon CloudFront to users. After instance maintenance, users receive HTTP 502 (Bad Gateway) errors while attempting to access the website.What is the MOST likely cause of this issue?

The origin does not support the ciphers or protocols in the SSL/TLS exchange with CloudFront.

The security group configuration on the origin is blocking traffic from CloudFront.

The origin does not support the ciphers or protocols in the SSL/TLS exchange with CloudFront.

There are resource constraints, and CloudFront cannot route requests to an available edge location.

The origin does not have enough capacity to support the request rate.

You would like to ensure that all Amazon S3 buckets going forward, current and newly created ones, have logging enabled. What type of trigger(s) should you use?

only a configuration change trigger

both configuration change and periodic triggers

You need to ensure the files served by your CloudFront distribution are only accessible to authorized users. You hope to serve thousands of users. What two steps should you take? (Choose two.)

Configure a bucket policy restricting the bucket to only CloudFront OAI.

Configure an SSL on the distribution.

Your organization's corporate website must be available on www.acme.com and acme.com. How should you configure Amazon Route 53 to meet this requirement?

Configure acme.com with an ALIAS record targeting the EL

www.acme.com with an ALIAS record targeting the ELB.

Configure acme.com with an A record targeting the ELwww.acme.com with a CNAME record targeting the acme.com record.

Configure acme.com with a CNAME record targeting the ELB. www.acme.com with a CNAME record targeting the acme.com record.

Configure acme.com using a second ALIAS record with the ELB target. www.acme.com using a PTR record with the acme.com record target.

You are architecting your e-business application for PCI compliance. To meet the compliance requirements, you need to monitor web application logs to identify any malicious activity. You also need to monitor for remote attempts to change the network interface of web instances.Which two AWS services will be helpful to achieve this goal?

AWS CloudTrail and CloudWatch Logs

Amazon CloudWatch Logs and VPC Flow Logs

AWS CloudTrail and VPC Flow Logs

AWS CloudTrail and CloudWatch Logs

Amazon ANS-C00 Practice Test 4 - Free Online Exam Prep & Questions

The Payment Card Industry Data Security Standard (PCI DSS) merchants that handle credit card data must use strong cryptography. These merchants must also use security protocols to protect sensitive data during transmission over public networks.

A team will migrate the PCI DSS application from on-premises SSL appliance and Apache to a VPC behind Amazon CloudFront. How should you configure CloudFront to meet this requirement?

Become a Premium Member for full access

Unlock Premium Member

Amazon ANS-C00 Practice Test 4

Question

Amazon ANS-C00 Practice Tests

Practice Tests