Does Amazon VPC support multicast or broadcast?

It doesn't support any of them.

Both, but only outside Amazon VPC.

You manage a website that uses a load balancer. You are noticing one of the servers is receiving more traffic than the other. What is probably the cause of this?

You have sticky sessions configured and there are several power users that happen to be on the other server.

An Elastic Load Balancer sends traffic based on server load. One server must be a larger instance.

You have DNS latency routing set, so it is diverting traffic to a different instance.

You have sticky sessions configured and there are several power users that happen to be on the other server.

The server has more connections available.

Your company just deployed a WAF to protect its resources. You need to create a baseline before you start blocking traffic. How will you achieve this?

Set the WAF to its defaults and let it do its job.

Setup a Lambda function to monitor Flow Logs and analyze the traffic using Elasticsearch.

A WAF is default deny and does not allow this. You need to use an IDS instead.

A logistics company has deployed a hybrid environment that has multiple VPCs in both the us-east-1 Region and the afsouth- 1 Region. The on-premises data center is connected to us-east-1 through an AWS Direct Connect connection. The Direct Connect connection is connected to a Direct Connect gateway that is associated with a transit gateway. The transit gateway is attached to all the VPCs in useast-1. An application that is deployed in af-south-1 requires access to a database in the data center. The application also requires access to file storage in a VPC in us-east-1. Which solution will meet these requirements with the LOWEST latency?

Create a transit gateway in af-south-1, and attach the VPCs. Create a transit gateway peering connection between the transit gateways.

Create a Direct Connect connection in af-south-1, and attach the VPCs with a Direct Connect gateway and a transit gateway. Create an AWS Site-to-Site VPN connection over the internet between the Direct Connect connections.

Create a transit gateway in af-south-1, and attach the VPCs. Associate the transit gateway in af-south-1 with the Direct Connect gateway in us-east-1.

Create inter-Region VPC peering connections between the VPCs in each Region. Use the transit gateway attachments in us-east-1 to access the database in the data center.

A company is building a hybrid PCI-DSS compliant application that runs in the us-west-2 Region and on-premises. The application sends access logs from all locations to a single Amazon S3 bucket in uswest-2. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses. How should an engineer configure the network to meet these requirements?

Configure a Direct Connect connection public virtual interface to us-west-2. Leverage an on-premises HTTPS proxy tosend traffic to Amazon S3 over a Direct Connect connection.

Configure an AWS Direct Connect private virtual interface to the company's AWS VPC in us-west-2. Create a VPC endpoint and configure the on-premises systems to leverage an HTTPS proxy in the VPC to access Amazon S3.

Configure a VPN connection to the company's AWS VPC in us-west-2 and use BGP to advertise routes for Amazon S3.

Configure a Direct Connect connection public virtual interface to us-west-2. Leverage an on-premises HTTPS proxy tosend traffic to Amazon S3 over a Direct Connect connection.

Configure a VPN connection to the company's AWS VPC in us-west-2. Create a NAT gateway and configure the onpremises systems to leverage an HTTPS proxy in the VPC to access Amazon S3.

A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company recently experienced a network security breach. A network engineer must collect and analyze logs that include the client IP address, target IP address, target port, and user agent of each user that accesses the application. What is the MOST operationally efficient solution that meets these requirements?

Configure the ALB to push logs to Amazon Kinesis Data Streams. Use Amazon Kinesis Data Analytics to analyze the logs.

Configure the ALB to store logs in an Amazon S3 bucket. Download the files from Amazon S3, and use a spreadsheet application to analyze the logs.

Configure the ALB to push logs to Amazon Kinesis Data Streams. Use Amazon Kinesis Data Analytics to analyze the logs.

Configure Amazon Kinesis Data Streams to stream data from the ALB to Amazon Elasticsearch Service (Amazon ES).Use search operations in Amazon ES to analyze the data.

Configure the ALB to store logs in an Amazon S3 bucket. Use Amazon Athena to analyze the logs in Amazon S3.

A Systems Administrator is designing a hybrid DNS solution with spilt-view. The apex-domain "example.com" should be served through name servers across multiple top-level domains (TLDs). The name server for subdomain "dev.example.com" should reside on-premises. The administrator has decided to use Amazon Route 53 to achieve this scenario. What procedurals steps must be taken to implement the solution?

Use a Route 53 public hosted zone for example.com and a private hosted zone for dev.example.com

Use a Route 53 public and private hosted zone for example.com, and perform subdomain delegation for dev.example.com

Use a Route 53 public hosted zone for example.com, and perform subdomain delegation for dev.example.com

Use a Route 53 private hosted zone for example.com, and perform subdomain delegation for dev.example.com

In AWS Direct Connect, to provide for failover, AWS recommends that you request and configure two dedicated connections to AWS. These connections can terminate on one or two routers in your network. You can do this while __________________ with AWS Direct Connect step.

configuring redundant connections

verifying your Virtual Interface

You work for an international corporation that uses AWS. Due to regulations, you are now required to route the US and China to two different websites. You set up the records and now no other countries can access your site. Why is this?

You forgot to set a default geolocation record.

You must have a geolocation in place for every country.

Geolocation features are only available in CloudFront.

A network engineer must provide additional safeguards to protect encrypted data at Application Load Balancers (ALBs) through the use of a unique random session key. What should the network engineer do to meet this requirement?

Change the ALB security policy to a policy that supports forward secrecy (FS).

Change the ALB security policy to a policy that supports TLS 1.2 protocol only.

Use AWS Key Management Service (AWS KMS) to encrypt session keys.

Associate an AWS WAF web ACL with the ALBs, and create a security rule to enforce forward secrecy (FS).

Change the ALB security policy to a policy that supports forward secrecy (FS).

A company uses an AWS Site-to-Site VPN to connect its corporate network. The company recently added an AWS Direct Connect connection. A network engineer wants all traffic to use the Direct Connect connection, and for the VPN to be used as backup. However, after the Direct Connect connection was added, traffic continued to pass through the VPN connection. What should the network engineer do to route the traffic through the Direct Connect connection?

Advertise the same network routes over the Direct Connect connection and VPN connection.

Add routes to the VPC route tables that specify the Direct Connect connection.

Set local preference BGP community tags on the on-premises router.

Advertise the same network routes over the Direct Connect connection and VPN connection.

Ensure the Direct Connect connection AS_PATH is longer than the VPN connection AS_PATH.

A company recently migrated its Amazon EC2 instances to VPC private subnets to satisfy a security compliance requirement. The EC2 instances now use a NAT gateway for internet access. After the migration, some long-running database queries from private EC2 instances to a publicly accessible third-party database no longer receive responses. The database query logs reveal that the queries successfully completed after 7 minutes but that the client EC2 instances never received the response.Which configuration change should a network engineer implement to resolve this issue?

Enable TCP keepalive on the client EC2 instances with a value of less than 300 seconds

Configure the NAT gateway timeout to allow connections for up to 600 seconds

Enable enhanced networking on the client EC2 instances

Enable TCP keepalive on the client EC2 instances with a value of less than 300 seconds

Close idle TCP connections though the NAT gateway

An insurance company is planning the migration of workloads from its on-premises data center to the AWS Cloud. The company requires end-to-end domain name resolution. Bi-directional DNS resolution between AWS and the existing onpremises environments must be established. The workloads will be migrated into multiple VPCs. The workloads also have dependencies on each other, and not all the workloads will be migrated at the same time. Which solution meets these requirements?

Define Route 53 Resolver rules to forwardrequests for the on-premises domains to the on-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC, and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager.Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints.

Configure a private hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VP

Define Route 53 Resolver rules to forwardrequests for the on-premises domains to the on-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC, and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager.Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints.

Configure a public hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VP

Define Route 53 Resolver rules to forwardrequests for the on-premises domains to the on-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC, and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager.Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints.

Configure a private hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VPDefine Route 53 Resolver rules to forward requestsfor the on-premises domains to the on-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC, and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager.Configure the on-premises DNS servers to forward the cloud domains to the Route 53 outbound endpoints.

Configure a private hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VPC. Define Route 53 Resolver rules to forwardrequests for the on-premises domains to the on-premises DNS resolver. Associate the Route 53 outbound rules with the application VPCs, and share the private hosted zones with the application accounts by using AWS Resource Access Manager.Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints.

A customer is using ABC Telecom as a network provider. The customer has 10 different offices connected to ABC Telecom's MPLS backbone. The customer is setting up an AWS Direct Connect connection to AWS and has provided the LOA-CFA to ABC Telecom. ABC Telecom has terminated the Direct Connect circuit into their MPLS backbone. To uniquely identify the customer's traffic over the MPLS backbone, the customer must encapsulate all traffic with VLAN tag 100. The customer wants to send traffic to multiple VPCs.Which two steps should be taken to meet the customer's requirement? (Choose two.)

Send the traffic for all VPCs with the same VLAN tag 100 and use BGP to ensure that proper routing takes place to the appropriate VPC.

ABC Telecom creates a support ticket with AWS to exchange MPLS labels and include the AWS port as part of their MPLS network.

The customer performs Q-in-Q tunneling, with the AWS-required VLAN tag in the inside and VLAN 100 as the outside tag.

Create a support ticket with AWS to request the removal of the outer VLAN tag 100 as the traffic reaches AWS routers.

Send the traffic for all VPCs with the same VLAN tag 100 and use BGP to ensure that proper routing takes place to the appropriate VPC.

ABC Telecom removes the outer tag before sending the packet to AWS.

ABC Telecom creates a support ticket with AWS to exchange MPLS labels and include the AWS port as part of their MPLS network.

A company has an application running on Amazon EC2 instances in a private subnet that connects to a third-party service provider's public HTTP endpoint through a NAT gateway. As request rates increase, new connections are starting to fail. At the same time, the ErrorPortAllocation Amazon CloudWatch metric count for the NAT gateway is increasing. Which of the following actions should improve the connectivity issues? (Choose two.)

Implement TCP keepalive on the client instances.

Create additional NAT gateways and update the private subnet route table to introduce the new NAT gateways.

Allocate additional Elastic IP addresses to the NAT gateway.

Request that the third-party service provider implement HTTP keepalive.

Implement TCP keepalive on the client instances.

Create additional NAT gateways and update the private subnet route table to introduce the new NAT gateways.

Create additional NAT gateways in the public subnet and split client instances into multiple private subnets, each with a route to a different NAT gateway.

You have two VPCs that require DNS resolution from your on-premises data center. You want to have a DNS server in the cloud, but you don't want to have multiple DNS servers. What two steps should you take? (Choose two.)

Peer the VPCs and set up routes between them.

Configure DHCP option sets in both VPCs to point to the DNS server.

Peer the VPCs and set up routes between them.

Create a VPN between the two VPCs

Configure DHCP option sets in both VPCs to point to the DNS server.

Configure a Route 53 record to forward all DNS requests to the DNS server.

What are two reasons to have multiple IP addresses or interfaces on one server? (Choose two.)

Teaming multiple NICs for more throughput

A user has enabled detailed CloudWatch monitoring with the AWS Simple Notification Service. Which of the below mentioned statements helps the user understand detailed monitoring better?

SNS cannot provide data every minute

There is no need to enable since SNS provides data every minute

SNS will send data every minute after configuration

AWS CloudWatch does not support monitoring for SNS

A company's web application is deployed on Amazon EC2 instances behind a public Application Load Balancer. The application flags malicious requests and uses an AWS Lambda function to add the offending IP addresses to the network ACL to block any further requests for 24 hours. Recently, the application has been receiving more malicious requests, which causes the network ACL to reach its limit of allowed entries.Which action should be taken to block more IP addresses, without compromising the existing security requirements?

Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached.

Update the AWS Lambda function to remove blocked entries from the network ACL after 2 hours.

Update the AWS Lambda function to block malicious IPs in security groups rather than the network ACL.

Update the AWS Lambda function to block malicious IPs in AWS WAF attached to the Application Load Balancer.

Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached.

A company has a hybrid IT architecture with two AWS Direct Connect connections to provide high availability. The services hosted on-premises are accessible using public IPs, and are also on the 172.16.0.0/16 range. The AWS resources are on the 192.168.0.0/18 range. The company wants to use Amazon Elastic Load Balancing for SSL offloading, health checks, and sticky sessions. What should be done to meet these requirements?

Create a Network Load Balancer pointing to the on-premises server's private IP address.

Create an Amazon CloudFront distribution for the on-premises service and use the public IPs of the on-premises servers as the origin.

Create a Network Load Balancer pointing to the on-premises server's public IP address.

Create an Application Load Balancer pointing to the on-premises server's private IP address.

Your organization needs to resolve DNS entries stored in an Amazon Route 53 private zone "awscloud:internal" from the corporate network. An AWS Direct Connect connection with a private virtual interface is configured to provide access to a VPC with the CIDR block 192.168.0.0/16. A DNS Resolver (BIND) is configured on an Amazon Elastic Compute Cloud (EC2) instance with the IP address 192.168.10.5 within the VPC. The DNS Resolver has standard root server hints configured and conditional forwarding for "awscloud.internal" to the IP address 192.168.0.2.From your PC on the corporate network, you query the DNS server at 192.168.10.5 for www.amazon.com. The query is successful and returns the appropriate response. When you query for "server.awscloud.internal", the query times out. You receive no response.How should you enable successful queries for "server.awscloud.internal"?

Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True

Attach an internet gateway to the VPC and create a default route.

Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True

Relocate the BIND DNS Resolver to the corporate network.

Update the security group for the EC2 instance at 192.168.10.5 to allow UDP Port 53 outbound.

A company has an AWS Direct Connect connection between its on-premises data center and Amazon VPC. An application running on an Amazon EC2 instance in the VPC needs to access confidential data stored in the on-premises data center with consistent performance. For compliance purposes, data encryption is required. What should the network engineer do to meet these requirements?

Configure a public virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.

Configure a private virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.

Configure an internet gateway in the VPSet up a software VPN between the customer gateway and an EC2 instance in the VPC.

Configure an internet gateway in the VPC. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.

You need to set up an Amazon Elastic Compute Cloud (EC2) instance for an application that requires the lowest latency and the highest packet-per-second network performance. The application will talk to other servers in a peered VPC.Which two of the following components should be part of the design? (Choose two.)

Select an instance with support for single root I/O virtualization.

Select an instance that has support for multiple ENAs.

Select an instance with support for single root I/O virtualization.

Select an instance that has support for multiple ENAs.

Ensure that the instance supports jumbo frames and set 9001 MTU.

Select an instance with Amazon Elastic Block Store (EBS)-optimization.

Ensure that proper OS drivers are installed.

Your organization uses a VPN to connect to your VPC but must upgrade to a 1-G AWS Direct Connect connection for stability and performance. Your telecommunications provider has provisioned the circuit from your data center to an AWS Direct Connect facility and needs information on how to cross-connect (e.g., which rack/port to connect). What is the AWS-recommended procedure for providing this information?

Create a support ticket. Provide your AWS account number and telecommunications company's name and where you need the Direct Connect connection to terminate.

Create a new connection through your AWS Management Console and wait for an email from AWS with information.

Ask your telecommunications provider to contact AWS through an AWS Partner Channel. Provide your AWS account number.

Contact an AWS Account Manager and provide your AWS account number, telecommunications company's name, and where you need the Direct Connect connection to terminate.

Which one of the following options is not true about WorkSpaces?

WorkSpaces can query on-premises domains for authentication.

WorkSpaces allows integration with Microsoft AD.

WorkSpaces is great for running Linux applications.

WorkSpaces is a fully managed, secure desktop computing service.

WorkSpaces can query on-premises domains for authentication.

You have a server that serves www, FTP, and mail. You need to access this server using www.yourname.com, ftp.yourname.com, and mail.yourname.com. You want to ensure an IP change results in the least number of other changes. What is the best solution?

Create an A record pointing to the server's IP address and create CNAME records for www, ftp, and mail and point those to the A record.

Create PTR records and point the IP address of the server back to www, ftp, and mail.

Create an A record pointing to the server's IP address and create CNAME records for www, ftp, and mail and point those to the A record.

Create an A record for www, ftp and mail, and point it to the ALIAS of the server.

Create CNAME records for www, ftp, and mail and point those to the A record already provided to the instance by AWS.

You have a web application (app.mycompany.com) running on an EC2 instance with a single elastic network interface in a subnet in a VPC. Because of a network redesign, you need to move the web application to a different subnet in the same Availability Zone.Which of the following migration strategies meets the requirements?

Launch a new instance in the subnet via an AMI created from the instance, and redirect new connections to this new instance using DNS. Decommission the old instance.

Create an elastic network interface in the new subnet. Attach this interface to the instance, and detach the old interface.

Launch a new instance in the subnet via an AMI created from the instance, and redirect new connections to this new instance using DNS. Decommission the old instance.

Make an API call to change the subnet association of the elastic network interface.

Change the IP addresses manually to another subnet within the server operating system.

Your company is expanding its cloud infrastructure and moving many of its flat files and static assets to S3. You currently use a VPN to access your compute infrastructure, but you require more reliability for your static files as you are offloading all of your important data to AWS. What is your best course of action while keeping costs low?

Create a Direct Connect connection using a Public VIF and route your VPN over the DX connection to your VPN endpoint.

Create a Direct Connect connection using a Private VIF to access both compute and S3 resources.

Create an S3 endpoint and create a route to the endpoint prefix list for your VPN to allow access to your S3 resources.

Create two Direct Connect connections. Each connected to a Private VIF to ensure maximum resiliency.

Create a Direct Connect connection using a Public VIF and route your VPN over the DX connection to your VPN endpoint.

Amazon ANS-C00 Practice Test 6 - Free Online Exam Prep & Questions

Question 1 / 40

You are responsible for several EC2 instances deployed from Amazon AMIs that are required to upload information to an S3 bucket. This information must not traverse the public internet. You must also be able to update the instances. Which option is your best solution?

An S3 endpoint and a NAT

An S3 endpoint

A VPN to the IP addresses specified in the AWS official S3 prefix list

A NACL with the AWS prefix list added to it and a VPN.

Comment (0)

Amazon ANS-C00 Practice Test 6

Question

Amazon ANS-C00 Practice Tests

Practice Tests