Your company has just completed a transition to IPv6 and has deployed a website on a server. You were able to download software on the instance without an issue. This website is deployed using IPv6, but the public is not able to access it. What should you do to fix this problem?

Add an inbound rule to your security group that allows inbound traffic on port 80 for ::/0.

Add an internet gateway for the instance.

Add an egress-only internet gateway.

Add an inbound rule to your security group that allows inbound traffic on port 80 for ::/0.

Add an inbound rule to your security group that allows inbound traffic on port 80 for 0.0.0.0/0.

A company provisions an AWS Direct Connect connection to permit access to Amazon EC2 resources in several Amazon VPCs and to data stored in private Amazon S3 buckets. The Network Engineer needs to configure the company's onpremises router for this Direct Connect connection.Which of the following actions will require the LEAST amount of configuration overhead on the customer router?

Configure private virtual interfaces for the VPC resources and for Amazon S3.

Configure private virtual interfaces for the VPC resources and a public virtual interface for Amazon S3.

Configure a private virtual interface to a Direct Connect gateway for the VPC resources and for Amazon S3.

Configure a private virtual interface to a Direct Connect gateway for the VPC resources and a public virtual interface for Amazon S3.

You are a holdings company that buys many businesses and must integrate their VPCs into your network. You are constantly encountering networks with similar or overlapping subnets. What is the best way to manage this.

A standby router for the overlapping subnets.

A strict IP addressing policy that forces new companies to change the IP addresses of their VPCs.

Your website is under attack and a malicious party is stealing large amounts of data. You have default NACL rules. Stopping the attack is the ONLY priority in this case. Which two commands should you use? (Choose two.)

aws ec2 delete-network-acl-entry -network-acl-id acl-5fb84d47 -egress rule-number 100

aws ec2 delete-network-acl-entry -network-acl-id acl-5fb84d47 -ingress rule-number 100

aws ec2 delete-network-acl-entry -network-acl-id acl-5fb84d47 -ingress -rule-number 32768

aws ec2 delete-network-acl-entry -network-acl-id acl-5fb84d47 -egress rule-number 100

aws ec2 delete-network-acl-entry -network-acl-id acl-5fb84d47 -ingress rule-number 100

aws ec2 create-network-acl-entry -network-acl-id acl-5fb84d47 -ingress rule-number 100 -protocol -1 -port-range From =- 1,To =-1 -cidr-block 0.0.0.0/0 -rule-action deny

You manage a webserver that serves a webpage on AWS infrastructure. You utilize an Application Load Balancer, CloudFront, S3, and some other AWS services for this site. You are only responsible for the server and you don't have access to the AWS console or API.You need to find out what IPs are accessing your website. What is the best way to achieve this?

Add "X-Forwarded For" to the access logs and view the access logs.

Ask someone with IAM permissions to view the Flow Logs to give you access.

View the access logs. They already show this information.

Run "curl http://169.254.169.254/latest/meta-data/access_log

Add "X-Forwarded For" to the access logs and view the access logs.

An organization is using a VPC endpoint for Amazon S3. When the security group rules for a set of instances were initially configured, access was restricted to allow traffic only to the IP addresses of the Amazon S3 API endpoints in the region from the published JSON file. The application was working properly, but now is logging a growing number of timeouts when connecting with Amazon S3. No internet gateway is configured for the VPC. Which solution will fix the connectivity failures with the LEAST amount of effort?

Update the application server's outbound security group to use the prefix-list for Amazon S3 in the same region.

Create a Lambda function to update the security group based on AmazonIPSpaceChanged notifications.

Update the VPC routing to direct Amazon S3 prefix-list traffic to the VPC endpoint using the route table APIs.

Update the application server's outbound security group to use the prefix-list for Amazon S3 in the same region.

Create an additional VPC endpoint for Amazon S3 in the same route table to scale the concurrent connections to Amazon S3.

A company is about to migrate an application from its on-premises data center to AWS. As part of the planning process, the following requirements involving DNS have been identified.On-premises systems must be able to resolve the entries in an Amazon Route 53 private hosted zone.Amazon EC2 instances running in the organization's VPC must be able to resolve the DNS names of on-premises systems The organization's VPC uses the CIDR block 172.16.0.0/16. Assuming that there is no DNS namespace overlap, how can these requirements be met?

Deploy and configure a set of EC2 instances into the company VPC to act as DNS proxies. Configure the proxies to forward queries for the on-premises domain to the on-premises DNS systems, and forward all other queries to theAmazonprovided DNS server (172.16.0.2). Change the DHCP options set for the VPC to use the new DNS proxies. Configure the on-premises DNS systems with a stubzone, delegating the proxies as authoritative for the Route 53 private hosted zone.

Change the DHCP options set for the VPC to use both the Amazon-provided DNS server and the on-premises DNS systems. Configure the on-premises DNS systems with a stub-zone, delegating the name server 172.16.0.2 asauthoritative for the Route 53 private hosted zone.

Deploy and configure a set of EC2 instances into the company VPC to act as DNS proxies. Configure the proxies to forward queries for the on-premises domain to the on-premises DNS systems, and forward all other queries to172.16.0.2.Change the DHCP options set for the VPC to use the new DNS proxies. Configure the on-premises DNS systems with a stub-zone, delegating the name server 172.16.0.2 as authoritative for the Route 53 private hosted zone.

Deploy and configure a set of EC2 instances into the company VPC to act as DNS proxies. Configure the proxies to forward queries for the on-premises domain to the on-premises DNS systems, and forward all other queries to theAmazonprovided DNS server (172.16.0.2). Change the DHCP options set for the VPC to use the new DNS proxies. Configure the on-premises DNS systems with a stubzone, delegating the proxies as authoritative for the Route 53 private hosted zone.

Change the DHCP options set for the VPC to use both the on-premises DNS systems. Configure the on-premises DNS systems with a stub-zone, delegating the Route 53 private hosted zone's name servers as authoritative for the Route53 private hosted zone.

An organization is replacing a tape backup system with a storage gateway. there is currently no connectivity to AWS. Initial testing is needed.What connection option should the organization use to get up and running at minimal cost?

Provision an AWS Direct Connection private virtual interface.

Provision a Direct Connect public virtual interface.

A company that provides a RESTful API is designing a network architecture for deployment to the AWS Cloud. The company needs a scalable design that is cost-optimized and secure. The company is conducting pre-release testing with some of its customers, but the company expects to expand to several hundred customers when the final version is released.The data that is exchanged through the API is confidential. All data must be exchanged on private IP addresses that are not accessible through the internet. All customers who use the API operate on AWS in VPCs. What should the company do with its architecture to meet these requirements?

Use an Amazon API Gateway API with an edge-optimized API endpoint as the front end for all API interactions that invoke AWS Lambda functions.

Use a Network Load Balancer (NLB) as the front end to the API. Use a transit VPC with VPC peering to each customer's VPC.

Use AWS PrivateLink endpoints in customer VPCs as the front end for an AWS Fargate containers deployment with auto scaling enabled.

Use an Amazon API Gateway API with a regional API endpoint as the front end for all API interactions that invoke AWS Lambda functions.

Use an Amazon API Gateway API with an edge-optimized API endpoint as the front end for all API interactions that invoke AWS Lambda functions.

An organization has created a web application inside a VPC and wants to make it available to 200 client VPCs. The client VPCs are in the same Region but are owned by other business units within the organization. What is the best way to meet this requirement, without making the application publicly available?

Deploy the web application behind an internet-facing Application Load Balancer and control which clients have access by using security groups.

Configure the application as an AWS PrivateLink-powered service, and have the client VPCs connect to the endpoint service by using an interface VPC endpoint.

Enable VPC peering between the web application VPC and all client VPCs.

Deploy the web application behind an internet-facing Application Load Balancer and control which clients have access by using security groups.

Deploy the web application behind an internal Application Load Balancer and control which clients have access by using security groups.

Your company was recently acquired and a Direct Connection connection was extended from your new parent corporation to your AWS VPC using a hosted VIF. What data charges are billed to your account for that connection?

You are responsible for all data transfer out.

You are only responsible for the port hours of the VIF.

You are responsible for all data transfer out.

You are responsible for all data transfer in.

Your company has set up AWS Direct Connect to connect on-premises to an Amazon VPC instance. Two Direct Connect connections terminate at two different Direct Connect locations. You are using two routers, R1 and R2, at your end (one of each Direct Connect connection). R1 and R2 do NOT have connectivity between them. Both routers advertise the same routers over BGP to the VGW. You have a stateful firewall on each router. The routers drop some of the traffic coming from the VPC.Which two actions should you take to fix this problem? (Choose two.)

Use BGP AS prepend attribute to prepend additional AS numbers while advertising routers from R1 to VGW.

Use BGP local preference attribute to assign R1 a higher local preference number than R2.

Use BGP AS prepend attribute to prepend additional AS numbers while advertising routers from R1 to VGW.

Use BGP local preference attribute to assign R1 to a lower local preference number than R2.

Use BGP local preference attribute to assign R1 a higher local preference number than R2.

Use BGP MED attribute to assign a higher MED value to the routes advertised R1 to VGW.

Use BGP MED attribute to assign a higher MED value to the routes advertised from R2 to VGW.

A user is trying to send custom metrics to CloudWatch using the PutMetricData APIs. Which of the below mentioned points should the user needs to take care while sending the data to CloudWatch?

The size of a request is limited to 8KB for HTTP GET requests and 40KB for HTTP POST requests

The size of a request is limited to 128KB for HTTP GET requests and 64KB for HTTP POST requests

The size of a request is limited to 40KB for HTTP GET requests and 8KB for HTTP POST requests

The size of a request is limited to 16KB for HTTP GET requests and 80KB for HTTP POST requests

The size of a request is limited to 8KB for HTTP GET requests and 40KB for HTTP POST requests

You have a hybrid infrastructure, and you need AWS resources to be able to resolve your on-premises DNS names. You have configured a DNS server on an EC2 instance in your 10.1.3.0/24 subnet. This subnet resides on the VPC 10.1.0.0/16.What step should you take to accomplish this?

Configure the DHCP option set in the VPC to point to the EC2 DNS server.

Configure your DNS server to forward queries for the private hosted zone to 10.1.3.2.

Configure the DHCP option set in the VPC to point to the EC2 DNS server.

Configure your DNS server to forward queries for the private hosted zone to 10.1.0.2.

Disable the source/destination check flag for the DNS instance.

You are the AWS cloud architect and have been tasked with designing an appropriate subnetting design for your production VPC. Your production VPC requires secure communications back to the corporate private network. Quality of Service (QoS) is very important 24 ◊ 7 for this particular connection, as real-time data is passed continually backwards and forwards between your on-prem bioinformatics enterprise application, and the number crunching servers deployed in the cloud. Any potential latency incurred on this connection will have a direct impact on the company's ability to attract investors and expansion into new markets. Select the correct network configuration that best facilitates your company's continued growth plans.

Provision a Direct Connect connection - between your existing service provider's data center and the AWS region that your cloud compute resources exist in. Configure a Virtual Private Gateway and Private Virtual InterfaceReference: https://aws.amazon.com/directconnect/faqs/

Provision a Direct Connect connection - between your service provider's data center and the AWS region that your cloud compute resources exist in. Configure just a Private Virtual Interface. As this is a Direct Connection, a Virtual Private Gateway is not required

Configure a site-to-site layer 2 software router using OpenVPN within your VPC and ensure that QoS enabled - this is a secure and cheap option

Configure a site-to-site layer 3 software router using OpenVPN within your VPC and ensure that QoS enabled - this is a secure and cheap option

Provision a Direct Connect connection - between your existing service provider's data center and the AWS region that your cloud compute resources exist in. Configure a Virtual Private Gateway and Private Virtual InterfaceReference: https://aws.amazon.com/directconnect/faqs/

The Web Application Development team is worried about malicious activity from 200 random IP addresses. Which action will ensure security and scalability from this type of threat?

Use inbound network ACL rules to block the IP addresses.

Use inbound security group rules to block the IP addresses.

Use inbound network ACL rules to block the IP addresses.

Use AWS WAF to block the IP addresses.

Write iptables rules on the instance to block the IP addresses.

After setting an AWS Direct Connect, which of the following cannot be done with an AWS Direct Connect Virtual Interface?

You can exchange traffic between the two ports in the same region connecting to different Virtual Private Gateways (VGWs) if you have more than one virtual interface.

You can delete a virtual interface; if its connection has no other virtual interfaces, you can delete the connection.

You can change the region of your virtual interface.

You can create a hosted virtual interface.

You can exchange traffic between the two ports in the same region connecting to different Virtual Private Gateways (VGWs) if you have more than one virtual interface.

A global film production company uses the AWS Cloud to encode and store its video content before distribution. The company's three global offices are connected to the us-east-1 Region through AWS Site-to-Site VPN links that terminate on a transit gateway with BGP routing activated.The company recently started to produce content at a higher resolution to support 8K streaming. The size of the content files has increased to three times the size of the content files from the previous format. Uploads of files to Amazon EC2 instances are taking 10 times longer than they did with the previous format.Which actions should a network engineer recommend to reduce the upload times? (Choose two.)

Create a second VPN tunnel from each office location to the transit gateway. Activate equal-cost multi-path (ECMP) routing.

Upgrade each EC2 instance to a modern instance type. Activate Jumbo MTU in the operating system.

Create a second VPN tunnel from each office location to the transit gateway. Activate equal-cost multi-path (ECMP) routing.

Modify the transit gateway to activate Jumbo MTU on the VPN tunnels to each office location.

Replace the existing VPN tunnels with new tunnels that have acceleration activated.

Upgrade each EC2 instance to a modern instance type. Activate Jumbo MTU in the operating system.

Replace the existing VPN tunnels with new tunnels that have IGMP activated.

A company's IT Security team needs to ensure that all servers within an Amazon VPC can communicate with a list of five approved external IPs only. The team also wants to receive a notification every time any server tries to open a connection with a non-approved endpoint.What is the MOST cost-effective solution that meets these requirements?

Add allowed IPs to the network ACL for the application server subnets. Enable VPC Flow Logs with a filter set to ALL.Create an Amazon CloudWatch Logs filter on the VPC Flow Logs log group filtered by REJECT. Create an alarm for this metric to notify the security team.

Enable Amazon GuardDuty on the account and the specific Region. Upload a list of allowed IPs to Amazon S3 and link the S3 object to the GuardDuty trusted IP list. Configure an Amazon CloudWatch Events rule on all GuardDuty findings to trigger an Amazon SNS notification to the security team.

Add allowed IPs to the network ACL for the application server subnets. Enable VPC Flow Logs with a filter set to REJECT. Set an Amazon CloudWatch Logs filter for the log group on every event. Create an alarm for this metric to notifythe security team.

Enable Amazon GuardDuty on the account and specific Region. Upload a list of allowed IPs to Amazon S3 and link the S3 object to the GuardDuty threat IP list. Integrate GuardDuty with a compatible SIEM to report on every alarm fromGuardDuty.

You operate a production VPC with both a public and a private subnet. Your organization maintains a restricted Amazon S3 bucket to support this production workload. Only Amazon EC2 instances in the private subnet should access the bucket. You implement VPC endpoints (VPC-E) for Amazon S3 and remove the NAT that previously provided a network path to Amazon S3. The default VPC-E policy is applied. Neither EC2 instances in the public or private subnets are able to access the S3 bucket.What should you do to enable Amazon S3 access from EC2 instances in the private subnet?

Add the CIDR address range of the private subnet to the S3 bucket policy.

Add the VPC-E identifier to the S3 bucket policy.

Add the VPC identifier for the production VPC to the S3 bucket policy.

Add the VPC-E identifier for the production VPC to endpoint policy.

A company is connecting to a VPC over an AWS Direct Connect using a private VIF, and a dynamic VPN connection as a backup. The company's Reliability Engineering team has been running failover and resiliency tests on the network and the existing VPC by simulating an outage situation on the Direct Connect connection. During the resiliency tests, traffic failed to switch over to the backup VPN connection. How can this failure be troubleshot?

Reconfigure the Direct Connect session from static routes to Border Gateway Protocol (BGP) peering.

Ensure that Bidirectional Forwarding Detection is enabled on the Direct Connect connection

Confirm that the same routes are being advertised over both the VPN and Direct Connect.

Reconfigure the Direct Connect session from static routes to Border Gateway Protocol (BGP) peering.

Configure a virtual private gateway for the VPN and another virtual private gateway for Direct Connect.

You have a management server that needs to be able to communicate with two subnets. One of these subnets is private. This subnet must remain private and must not pass any traffic back to other subnets. How would you configure this?

Add an ENI to the management server that resides in the subnet of the private server.

Configure a NACL to allow access from the management server to the private server.

Add an ENI to the management server that resides in the subnet of the private server.

You can't do this without allowing traffic back through the other subnet.

Configure a security group rule to allow access from the management server to the private server.

What does the term "statistics" mean with respect to CloudWatch metrics?

Data aggregation over a specific period of time

Your application is hosted behind an Elastic Load Balancer (ELB) within an autoscaling group. The autoscaling group is configured with a minimum of 2, a maximum of 14, and a desired value of 2. The autoscaling cooldown and the termination policies are set to the default value.CloudWatch reports that the site typically requires just two servers, but spikes at the start and end of the business day can require eight to ten servers. You receive intermittent reports of timeouts and partially loaded web pages.Which configuration change should you make to address this issue?

Configure connection draining on the ELB.

Configure the autoscaling cooldown to 600 seconds.

Configure the termination policy to oldest instance.

Configure a Terminating: Wait lifecycle hook on a scale in event.

A company has two AWS accounts: one for Production and one for Connectivity. A network engineer needs to connect the Production account VPC to a transit gateway in the Connectivity account. The feature to auto accept shared attachments is not enabled on the transit gateway.Which set of steps should the network engineer follow in each AWS account to meet these requirements?

1. In the Production account: Create a resource share in AWS Resource Access Manager for the transit gateway. Provide the Connectivity account ID. Enable the feature to allow external accounts.

In the Connectivity account: Accept the resource.

In the Connectivity account: Create an attachment to the VPC subnets.

In the Production account: Accept the attachment. Associate a route table with the attachment.

1. In the Production account: Create a resource share in AWS Resource Access Manager for the VPC subnets. Provide the Connectivity account ID. Enable the feature to allow external accounts.

In the Connectivity account: Accept the resource.

In the Production account: Create an attachment on the transit gateway to the VPC subnets.

In the Connectivity account: Accept the attachment. Associate a route table with the attachment.

1. In the Connectivity account: Create a resource share in AWS Resource Access Manager for the VPC subnets. Provide the Production account ID. Enable the feature to allow external accounts.

In the Production account: Accept the resource.

You are preparing to launch Amazon WorkSpaces and need to configure the appropriate networking resources. What must be configured to meet this requirement?

At least two subnets in different Availability Zones.

Network address translation for outbound traffic.

At least two subnets in different Availability Zones.

A dedicated VPC with Active Directory Services.

An IPsec VPN to on-premises Active Directory.

Network address translation for outbound traffic.

What is NOT a benefit of CloudFront?

Distributes traffic evenly to EC2 instances

Helps ease the strain on your web servers

Distributes traffic evenly to EC2 instances

Speeds up distribution of RTMP content

Speeds up distribution of static and dynamic web content

Amazon ANS-C00 Practice Test 5 - Free Online Exam Prep & Questions

A company needs to set up a VPN between AWS VPC and its on-premises network. A team creates a VPN connection in the AWS Management Console, downloads the configuration file, and installs it on the on-premises router. The tunnel is not coming up because of firewall restrictions on the router. Which two network traffic options should you allow through the firewall? (Choose two.)

Become a Premium Member for full access

Unlock Premium Member

Amazon ANS-C00 Practice Test 5

Question

Amazon ANS-C00 Practice Tests

Practice Tests