You are building an application in AWS that requires Amazon Elastic MapReduce (Amazon EMR). The application needs to resolve hostnames in your internal, on-premises Active Directory domain. You update your DHCP Options Set in the VPC to point to a pair of Active Directory integrated DNS servers running in your VPC. Which action is required to support a successful Amazon EMR cluster launch?

Enable seamless domain join for the Amazon EMR cluster.

Add a conditional forwarder to the Amazon-provided DNS server.

Enable seamless domain join for the Amazon EMR cluster.

Launch an AD connector for the internal domain.

Configure an Amazon Route 53 private zone for the EMR cluster.

An AWS account owner has setup multiple IAM users. One of these IAM users, named John, has CloudWatch access, but no access to EC2 services. John has setup an alarm action which stops EC2 instances when their CPU utilization is below the threshold limit. When an EC2 instance's CPU Utilization rate drops below the threshold John has set, what will happen and why?

Nothing will happen. John can setup the action, but it will not be executed because he does not have EC2 access through IAM policies.

Nothing will happen. John cannot set an alarm on EC2 since he does not have the permission.

CloudWatch will stop the instance when the action is executed

Nothing will happen because it is not possible to stop the instance using the CloudWatch alarm

Nothing will happen. John can setup the action, but it will not be executed because he does not have EC2 access through IAM policies.

You are auditing an AWS infrastructure after you noticed some abnormal charges on the bill. You use AWS Config to monitor your changes. What else is required to find out who made the change?

Use the eventId of the change and reference it with CloudTrail to find the culprit.

There is no information to find this. You will need to sign up for Config Premium.

Use the eventID of the change and reference it with your Flow Logs.

Use the eventId of the change and reference it with CloudTrail to find the culprit.

Use the eventID of the change and reference it with CloudWatch to find the culprit.

An organization has multiple applications running in VPCs across multiple AWS accounts. The network engineer has deployed a central VPC with a pair of software VPN instances that run IPSec tunnels with dynamic routing to VGWs of all application VPCs. This central VPC is connected to on-premises resources via a Direct Connect connection using a private VIF.What additional configuration is required to enable the applications in VPCs to communicate with each other and access onpremises resources?

Configure the central VPC with a static route entry pointing the on-premises CIDR block to local VGWs.

Configure each application VPC with a static route entry pointing the on-premises CIDR block to the software VPN instances.

Configure the central VPC with a static route entry pointing the on-premises CIDR block to local VGWs.

Advertise all application VPC CIDR blocks to on-premises resources via the VGW in the central VPC.

Configure IPSec tunnels from the on-premises router into the software VPN instances with dynamic routing.

In the "start using the AWS Direct Connect steps," when can you complete the Cross Connect step?

After you have received your Letter of Authorization and Connecting Facility Assignment (LOA-CFA) from AWS

After verifying your virtual interface

After you have received your Letter of Authorization and Connecting Facility Assignment (LOA-CFA) from AWS

72 hours after submitting your request for AWS Direct Connect Connection

Immediately after submitting your request for AWS Direct Connect Connection

You have an application that is processing confidential data. The data is currently stored in your data center. You are moving workloads to AWS, and you need to ensure confidentiality and integrity of the data in transit to your VPC. Your company has an existing AWS Direct Connect connection.What combination of steps should you perform to set up the most cost-effective connection between your on-premises data center and AWS? (Choose three.)

Set up a VPC with a virtual private gateway.

Configure a public virtual interface on your Direct Connect connection.

Set up an IPsec tunnel between your customer gateway appliance and the virtual private gateway.

Set up a VPC with a virtual private gateway.

Set up a VPC with an Internet gateway.

Configure a public virtual interface on your Direct Connect connection.

Configure a private virtual interface to the virtual private gateway.

Set up an IPsec tunnel between your customer gateway and a software VPN on Amazon EC2 in the VPC.

Set up an IPsec tunnel between your customer gateway appliance and the virtual private gateway.

You can use the ____ command of the AWS Config service CLI to see the compliance state for each AWS resource of a specific type.

describe-compliance-by-resource

get-compliance-details-by-config-rule

describe-compliance-by-config-rule

get-compliance-details-by-resource

You are moving a two-tier application into an Amazon VPC. An Elastic Load Balancing (ELB) load balancer is configured in front of the application tier. The application tier is driven through RESTful interfaces. The data tier uses relational database service (RDS) MySQL. Company policy requires end-to-end encryption of all data in transit. What ELB configuration complies with the corporate encryption policy?

Configure the ELB load balancer protocol as HTTPS. Offload application instance encryption to the load balancer. Installyour SSL certificate on Amazon RDS, and configure SSL.

Configure the ELB load balancer protocol as HTTP. Configure the application instances for SSL termination. ConfigureAmazon RDS for SSL, and use REQUIRE SSL grants.

Configure the ELB protocols in TCP mode. Configure the application instances for SSL termination. Configure Amazon RDS for SSL, and use REQUIRE SSL grants.

Configure the ELB load balancer protocol as HTTPS. Offload application instance encryption to the load balancer. Installyour SSL certificate on Amazon RDS, and configure SSL.

Configure the ELB protocols in SSL mode. Offload application instance encryption to the load balancer. Install your SSL/TLS certificate on Amazon RDS, and configure SSL.

A company has an application running on Amazon EC2 instances in a VPC. The application must publish custom metrics to Amazon CloudWatch in the same AWS Region. The metrics include proprietary information. All connectivity must be over private IP addresses.Which solution will meet these requirements?

Connect to CloudWatch through an interface endpoint.

Connect to CloudWatch through a NAT gateway.

Connect to CloudWatch through a gateway endpoint.

Connect to CloudWatch through an internet gateway.

Connect to CloudWatch through an interface endpoint.

Use ___________ to get more visibility into the health of your AWS Elastic Beanstalk application and take appropriate actions in case of hardware failure or performance degradation.

Amazon Elastic Beanstalk command line

You use a VPN to extend your corporate network into a VPC. Instances in the VPC are able to resolve resource records in an Amazon Route 53 private hosted zone. Your on-premises DNS server is configured with a forwarder to the VPC DNS server IP address. On-premises users are unable to resolve names in the private hosted zone, although instances in a peered VPC can. What should you do to provide on-premises users with access to the private hosted zone?

Configure the on-premises server as a secondary DNS for the private zone. Update the NS records.

Create a proxy resolver within the VP

Point the on-premises forwarder to the proxy resolver.

Modify the network access control list on the VPC to allow DNS queries from on-premises systems.

Configure the on-premises server as a secondary DNS for the private zone. Update the NS records.

Update the on-premises forwarders with the four name servers assigned to the private hosted zone.

A company is delivering web content from an Amazon EC2 instance in a public subnet with address 2001:db8:1:100::1.Users report they are unable to access the web content. The VPC Flow Logs for the subnet contain the following entries:2 012345678912 eni-0596e500123456789 2001:db8:2:200::2 2001:db8:1:100::1 0 0 58 234 24336 1551299195 1551299434 ACCEPT OK 2 012345678912 eni-0596e500123456789 2001:db8:1:100::1 2001:db8:2:200::2 0 0 58 234 24336 1551299195 1551299434 REJECT OK Which action will restore network reachability to the EC2 instance?

Update the network ACL associated with the subnet to permit inbound traffic.

Update the security group associated with eni-0596e500123456789 to permit inbound traffic.

Update the security group associated with eni-0596e500123456789 to permit outbound traffic.

Update the network ACL associated with the subnet to permit inbound traffic.

Update the network ACL associated with the subnet to permit outbound traffic.

A company hosts its application, example.com, behind Application Load Balancers in the us-east-1 and eu-west-1 Regions.Users should be routed to the resources geographically nearest to them. Users must not be routed to the application when it is considered unhealthy. How should a network engineer configure Amazon Route 53 to route clients to example.com?

Configure latency.example.com alias latency-based records that point to the load balancers, enable the setting used to evaluate target health, and associate an HTTP health check. Configure failover records for example.com. Point theprimary CNAME record to latency.example.com, and associate an HTTP health check. Point the secondary record to a static HTML maintenance page hosted in Amazon S3.

Configure latency.example.com to use a weighted routing policy that points to the load balancers, and associate an HTTPhealth check. Configure failover records for example.com. Point the primary alias record to latency.example.com,and enablethe evaluate target health setting. Point the secondary record to a static HTML maintenance page hosted in Amazon S3.

Configure latency.example.com CNAME latency-based records that point to the load balancers, and associate an HTTPhealth check. Configure failover records for example.com. Point the primary alias record to latency.example.com,and enablethe setting used to evaluate target health. Point the secondary record to a static HTML maintenance page hosted in AmazonS3.

Configure latency.example.com to use a geoproximity routing policy that points to the load balancers, and associate an HTTP health check. Configure failover records for example com. Point the primary alias record tolatency.example.com, and enable the evaluate target health setting. Point the secondary record to a static HTML maintenance page hosted in Amazon S3.

Configure latency.example.com alias latency-based records that point to the load balancers, enable the setting used to evaluate target health, and associate an HTTP health check. Configure failover records for example.com. Point theprimary CNAME record to latency.example.com, and associate an HTTP health check. Point the secondary record to a static HTML maintenance page hosted in Amazon S3.

A Network Engineer needs to be automatically notified when a certain TCP port is accessed on a fleet of Amazon EC2 instances running in an Amazon VPC. Which of the following is the MOST reliable solution?

Create an inbound rule in the VPC's network ACL that matches the TCP port. Create an Amazon CloudWatch alarm on the NetworkPackets metric for the ACL that uses Amazon SNS to notify the Administrator when the metric is greaterthan zero.

Install intrusion detection software on each Amazon EC2 instance and configure it to use the AWS CLI to notify the Administrator with Amazon SNS each time the TCP port is accessed.

Create VPC Flow Logs that write to Amazon CloudWatch Logs, with a metric filter matching connections on the required port. Create a CloudWatch alarm on the resulting metric that uses Amazon SNS to notify the Administrator whenthe metric is greater than zero.

Install intrusion detection software on each Amazon EC2 instance and configure it to use the AWS CLI to publish to a custom Amazon CloudWatch metric each time the TCP port is accessed. Create a CloudWatch alarm on the resultingmetric that uses Amazon SNS to notify the Administrator when the metric is greater than zero.

A company has 20 AWS accounts and has hundreds of VPCs within those accounts. Each account has several security groups. Most of the security groups share a common set of CIDR range rules.The company wants to simplify the management of these CIDR ranges that the security groups use. The company's network team does not have full access to all the accounts. The common CIDR ranges are 10.10.0.0/16, 10.8.0.0/16, and 192.168.128.0/24.Which solution should a network engineer recommend to meet these requirements?

Use AWS CloudFormation to configure a VPC prefix list, and share the prefix list with all the accounts in AWS Resource Access Manager.

Use AWS CloudFormation and AWS CloudFormation StackSets to configure all the accounts and VPCs with the same security groups.

Use a CLI and a shell script to configure all the accounts and VPCs with the same security groups.

Use AWS CloudFormation to configure a VPC prefix list, and share the prefix list with all the accounts in AWS Resource Access Manager.

Use a CLI and a shell script to configure all the accounts and VPCs with the same network ACLs.

An organization runs a consumer-facing website on AWS. The Amazon EC2-based web fleet is load balanced using the AWS Application Load Balancer; Amazon Route 53 is used to provide the public DNS services. The following URLs need to server content to end users: test.example.com web.example.com example.com Based on this information, what combination of services must be used to meet the requirement? (Choose two.)

Path condition in ALB listener to route example.com to appropriate target groups.

Host condition in ALB listener to route example.com to appropriate target groups.

Path condition in ALB listener to route example.com to appropriate target groups.

Host condition in ALB listener to route *.example.com to appropriate target groups.

Host condition in ALB listener to route example.com to appropriate target groups.

Path condition in ALB listener to route *.example.com to appropriate target groups.

Host condition in ALB listener to route $$$$.example.com to appropriate target groups.

Under increased cybersecurity concerns, a company is deploying a near real-time intrusion detection system (IDS) solution.A system must be put in place as soon as possible. The architecture consists of many AWS accounts, and all results must be delivered to a central location. Which solution will meet this requirement, while minimizing downtime and costs?

Enable Amazon Macie on each AWS account and configure central reporting.

Deploy a third-party vendor solution to perform deep packet inspection in a transit VPC.

Enable VPC Flow Logs on each VP

Set up a stream of the flow logs to a central Amazon Elasticsearch cluster.

Enable Amazon Macie on each AWS account and configure central reporting.

Enable Amazon GuardDuty on each account as members of a central account.

You have two public applications on different domains that use two front-end servers and two back-end servers each. You wish to achieve high availability for both applications. What two options should you configure? (Choose two.)

Route 53: 2 public zones and 2 private zones.

4 load balancers: 2 public and 2 internal.

Route 53: 2 public zones and 2 private zones.

Route 53: 2 public zones and 1 private zone.

3 load balancers: 2 public and 1 internal.

4 load balancers: 2 public and 2 internal.

A company has a VPC in the us-west-1 Region and another VPC in the ap-southeast-2 Region. Network engineers set up an AWS Direct Connect connection from their data center to the us-east-1 Region. They create a private virtual interface (VIF) that references a Direct Connect gateway, which is then connected to virtual private gateways in both VPCs. When the setup is complete, the engineers cannot access resources in us-west-1 from ap-southeast-2. What should the network engineers do to resolve this issue?

Configure the Direct Connect gateway to route traffic between the VPCs in ap-southeast-2 and us-west-2.

Add the subnet range for the VPCs in us-west-1 and ap-southeast-2 to the route tables for both VPCs. Add the Direct Connect gateway as a target.

Configure the Direct Connect gateway to route traffic between the VPCs in ap-southeast-2 and us-west-2.

Establish a VPC peering connection between the VPCs in ap-southeast-2 and us-west-2. Add the subnet ranges to the routing tables.

Create static routes in each VPC that point to the destination VPC with the virtual private gateway as the route target.

An architecture is being designed to support an Amazon WorkSpaces deployment of 1,000 desktops. Which architecture will support this deployment while allowing for future expansion?

A VPC with a /16 CIDR and one /22 subnet

A VPC with a /16 CIDR and one /21 subnet

A VPC with a /20 CIDR and two /21 subnets

A VPC with a /16 CIDR and one /22 subnet

A VPC with a /20 CIDR and two /23 subnets

You are the network engineer at your company, and you are noticing issues with QoS in you're the traffic to your instances hosting a VOIP program. You need to inspect the network packets to determine if it is a programming error or a networking error. How should you do this?

Configure a network monitoring program on every instance and stream the logs to an S3 bucket to be parsed.

Set up another instance with an ENI added to act as a monitoring interface. Set the port to "promiscuous mode" and sniff the traffic to analyze the packets. Then output this single stream to an S3 bucket to be parsed.

You are a network admin of a US company called Webby Widgets that is expanding to Europe. The company has a website that serves dynamic and static content.You have been instructed to ensure the European clients receive the least latency possible, no matter where in Europe they live, while still allowing the US clients to receive the same user experience and performance they have been accustomed to.You have also been instructed to ensure both countries use the same URL to access the site and keep costs low.What two things should you do? (Choose two.)

Use the Traffic Flow policy creator to create the perfect routing policy.

Create a CloudFront distribution to serve the static content from an S3 bucket.

Deploy three VPCs; one for the US, one for the EU, and one as a central VPC that hosts an Elastic Load Balancer that will distribute traffic between the US and EU VPCs.

Create two A records: eu.webbywidgets.com that points to the EU resources and us.webbywidgets.com that points to the US resources.

Use the Traffic Flow policy creator to create the perfect routing policy.

Create a CloudFront distribution to serve the static content from an S3 bucket.

Your VPC has a DX connection that is advertising 99 routes. You have two more prefixes to add: 10.223.1.0/24 and 10.223.2.0/24. You have several locations, so you need to be as exact as possible with your routing. How would you do this?

Summarize the routes into a 10.223.0.0/22 and advertise that route instead.

Add the prefixes; AWS allows for as many BGP routes as you need but not static.

Contact AWS to extend the number of prefixes you are allowed to advertise.

Summarize the routes into a 10.223.0.0/22 and advertise that route instead.

Summarize the routes into a 10.223.0.0/12 and advertise that route instead.

Your customer's internal security teams receive requests to allow Amazon S3 access from inside the corporate network. All external traffic must be explicitly whitelisted through your corporate firewalls. How can your security team grant this access?

Obtain the list of IP prefixes from ip-ranges.json, and use those prefixes in firewall rules.

Obtain the list of IP prefixes from AWS Forum announcements, and use those prefixes in firewall rules.

Obtain the list of IP prefixes from ip-ranges.json, and use those prefixes in firewall rules.

Obtain the list of IP prefixes by performing a DNS lookup on Amazon S3 endpoints, and use those prefixes in firewall rules.

Connect your data center to a VPC via Direct Connect. Create routes that forward traffic from your data center to an S3 private endpoint.

In the context of Amazon CloudFront, when you configure the media player, the path you specify to the media file must contain the characters _____________.

cfx/st immediately after the domain name

flv/std just before the domain name

flv/std immediately after the domain name

cfx/st just before the domain name

cfx/st immediately after the domain name

Your company needs an inexpensive solution to host their AD data in the cloud. They do not need all of the features of AD but do need to be able to use it with WorkSpaces. What is the best solution?

Deploy an AD server on an M3.large instance

A company is deploying a network security product that is based on virtual appliances that run on Amazon EC2 instances.The appliances are stateful and inspect request traffic and return traffic. The appliances require visibility to a network flow's bidirectional transaction.The central appliance VPC is connected to a transit gateway.A network administrator notices that connections to the appliances are dropped when the traffic crosses Availability Zones.The appliances run behind a Gateway Load Balancer. The appliances are deployed across multiple Availability zones in a central VPC. What is MOST likely causing the connections to drop?

The transit gateway VPC attachment of the appliance is not configured for appliance mode

The transit gateway VPC attachment of the central appliance VPC is configured only for a subnet in a single Availability Zone

The transit gateway VPC attachment of the appliance is not configured for appliance mode

The route table that is attached to the subnet in one of the Availability Zones is missing a return route to the originating VPC

The security group that is attached to one of the appliance instances is blocking traffic to port 6081

An organization launched an IPv6-only web portal to support IPv6-native mobile clients. Front-end instances launch in an Amazon VPC associated with an appropriate IPv6 CIDR. The VPC IPv4 CIDR is fully utilized. A single subnet exists in each of two Availability Zones with appropriately configured IPv6 CIDR associations. Auto Scaling is properly configured, and no Elastic Load Balancing is used.Customers say the service is unavailable during peak load times. The network engineer attempts to launch an instance manually and receives the following message: "There are not enough free addresses in subnet 'subnet-12345678' to satisfy the requested number of instances." What action will resolve the availability problem?

Create a new subnet using a VPC secondary IPv4 CIDR, and associate an IPv6 CIDR. Include the new subnet in the Auto Scaling group.

Create a new subnet using a VPC secondary IPv6 CIDR, and associate an IPv6 CIDR. Include the new subnet in the Auto Scaling group.

Create a new subnet using a VPC secondary IPv4 CIDR, and associate an IPv6 CIDR. Include the new subnet in the Auto Scaling group.

Resize the IPv6 CIDR on each of the existing subnets. Modify the Auto Scaling group maximum number of instances.

Add a secondary IPv4 CIDR to the Amazon VPC. Assign secondary IPv4 address space to each of the existing subnets.

An unfortunate situation has just come to your attention. A business critical application with sensitive data running on-prem will run out of storage disk space in 24hrs. This business critical application is dependent a very large set of routes - required for integration with other system. You make a quick but well informed decision to migrate this application quickly to AWS. You are able to quickly launch a new VPC and within it equivalent infrastructure to re-home the application. In order to complete the replication of application data and ensure the application remains operational beyond the next 24hrs, select the best implementation.

Within the new VPC - deploy a Virtual Private Gateway, Customer Gateway, and establish a new IPsec VPN Connection with BGP dynamic routing

Within the new VPC - establish a Direct Connect connection with max 10Gbps port speed for data replication. Establish a 802.1Q VLAN and configure a Virtual Private Gateway and Private Virtual Interface, and ensure Jumbo Frames isenabled.

Within the new VPC - deploy a Virtual Private Gateway, Customer Gateway, and establish a new IPsec VPN Connection with BGP dynamic routing

Within the new VPC - deploy a Virtual Private Gateway, Customer Gateway, and establish a new IPsec VPN Connection with static routing, and ensure Jumbo Frames is enabled.

Within the new VPC - deploy a software based virtual router (for example a Cisco CSR). Configure with dual ENIs (external and internal), create and attach an EIP to the external ENI, Configure and setup IPsec VPN tunnels, and ensureJumbo Frames is enabled.

A company has 225 mobile and desktop devices and 300 partner VPNs that need access to an AWS VPC. VPN users should not be able to reach one another. Which approach will meet the technical and security requirements while minimizing costs?

Use the AWS IPsec VPN for the partner VPN connections. Use an Amazon EC2 instance VPN for the mobile and desktop devices. Use Network ACLs and security groups to maintain routing separation.

Use the AWS IPsec VPN for the mobile, desktop, and partner VPN connections. Use network access control lists (Network ACLs) and security groups to maintain routing separation.

Use the AWS IPsec VPN for the partner VPN connections. Use an Amazon EC2 instance VPN for the mobile and desktop devices. Use Network ACLs and security groups to maintain routing separation.

Create an AWS Direct Connect connection between on-premises and AWS Use a public virtual interface to connect to the AWS IPsec VPN for the mobile, desktop, and partner VPN connections.

Use an Amazon EC2 instance VPN for the desktop, mobile, and partner VPN connections. Use features of the VPN instance to limit routing and connectivity.

You have to set up an AWS Direct Connect connection to connect your on-premises to an AWS VPC. Due to budget requirements, you can only provision a single Direct Connect port. You have two border gateway routers at your onpremises data center that can peer with the Direct Connect routers for redundancy.Which two design methodologies, in combination, will achieve this connectivity? (Choose two.)

Terminate the Direct Connect circuit on a L2 border switch, which in turn has trunk connections to the two routers.

Create one Direct Connect private VIF for the VPC with two customer peer IPs.

Terminate the Direct Connect circuit on a L2 border switch, which in turn has trunk connections to the two routers.

Create two Direct Connect private VIFs for the same VPC, each with a different peer IP.

Terminate the Direct Connect circuit on any of the one routers, which in turn will have an IBGP session with the other router.

Create one Direct Connect private VIF for the VPC with two customer peer IPs.

Provision two VGWs for the VPC and create one Direct Connect private VIF per VGW.

A company is using AWS to host all of its applications. Each application is isolated in its own Amazon VPC. Different environments such as Development, Test, and Production are also isolated in their own VPCs. The network engineer needs to automate VPC creation to enforce the company's network and security standards. Additionally, the CIDR range used in each VPC needs to be unique. Which solution meets all of these requirements?

Use AWS CloudFormation to deploy the VPC infrastructure and a custom resource to request a CIDR range from an external IP address management (IPAM) service.

Use AWS OpsWorks to deploy the VPC infrastructure and a custom resource to request a CIDR range from an external IP address management (IPAM) service.

Use the VPC wizard in the AWS Management Console. Type in the CIDR blocks for the VPC and subnets.

Create the VPCs using AWS CLI and use the dry-run flag to validate if the current CIDR range is in use.

A company runs a large-scale application on a fleet of Amazon EC2 instances that are distributed across several VPCs. A Network Load Balancer (NLB) in a separate VPC routes traffic to the EC2 instances. The NLB's VPC is peered to all the application VPCs.The application must process millions of requests each minute during times of peak utilization. Users are reporting that the connections to the application are failing during peak times. Monitoring shows an increase in port allocation errors on the NLB.Which action will solve this issue with the LEAST change to the architecture?

Add a new target group to the same NLB listener.

Increase the number of EC2 instances in the target group.

Create an Application Load Balancer for the target group.

Add a new target group to the same NLB listener.

Change the target group type to "instance."

A company is running services in a VPC with a CIDR block of 10.5.0.0/22. End users report that they no longer can provision new resources because some of the subnets in the VPC have run out of IP addresses. How should a network engineer resolve this issue?

Assign a second network from this CIDR block to the existing subnets that have run out of IP addresses.

Add 10.5.2.0/23 as a second CIDR block to the VP

Create a new subnet with a new CIDR block, and provision new resources in the new subnet.

Add 10.5.4.0/21 as a second CIDR block to the VP

Assign a second network from this CIDR block to the existing subnets that have run out of IP addresses.

Add 10.5.4.0/22 as a second CIDR block to the VPAssign a second network from this CIDR block to the existing subnets that have run out of IP addresses.