A network engineer has configured a private hosted zone using Amazon Route 53. The engineer needs to configure health checks for record sets within the zone that are associated with instances. How can the engineer meet the requirements?

Configure a Route 53 health check to a private IP associated with the instances inside the VPC to be checked.

Configure a Route 53 health check pointing to an Amazon SNS topic that notifies an Amazon CloudWatch alarm when the Amazon EC2 StatusCheckFailed metric fails.

Create a CloudWatch metric that checks the status of the EC2 StatusCheckFailed metric, add an alarm to the metric, and then create a health check that is based on the state of the alarm.

Create a CloudWatch alarm for the StatusCheckFailed metric and choose Recover this instance, selecting a threshold value of 1.

Your company just purchased a domain using another registrar and wants to use the same nameservers as your current domain hosted with AWS. How would this be achieved?

In the API, create a Reusable Delegation Set.

Every domain must have different nameservers.

In the API, create a Reusable Delegation Set.

Import the domain to your account and it will automatically set the same nameservers.

In the console, create a Reusable Delegation Set.

A company is deploying a non-web application on an Elastic Load Balancing. All targets are servers located on-premises that can be accessed by using AWS Direct Connect. The company wants to ensure that the source IP addresses of clients connecting to the application are passed all the way to the end server. How can this requirement be achieved?

Use an Application Load Balancer to automatically preserve the source IP address in the X-Forwarded-For header.

Use a Network Load Balancer to automatically preserve the source IP address.

Use a Network Load Balancer and enable the X-Forwarded-For attribute.

Use a Network Load Balancer and enable the ProxyProtocol attribute.

Use an Application Load Balancer to automatically preserve the source IP address in the X-Forwarded-For header.

Which statement about Elastic IP addresses is incorrect?

Once an EIP is associated with an instance, you must manually change the hostname if you want it to match.

Additional EIPs associated with one instance incur a charge.

Once an EIP is associated with an instance, you must manually change the hostname if you want it to match.

Once you associate an EIP with an instance, the original public IP is released.

Disassociated EIPs incur a charge.

A company has recently established an AWS Direct Connect connection from its on-premises data center to AWS. A Network Engineer has blocked all traffic destined for Amazon S3 over the company's gateway to the internet from its onpremises firewall. S3 traffic should only traverse the Direct Connect connection. Currently, no one in the on-premises data center can access Amazon S3. Which solution will resolve this connectivity issue?

Configure a private virtual interface on the Direct Connect connection. Update the on-premises routing tables to choose Direct Connect as the preferred next hop for traffic destined for Amazon S3.

Establish an S3 VPC endpoint for the company's Amazon VP

Configure a private virtual interface on the Direct Connect connection. Update the on-premises routing tables to choose Direct Connect as the preferred next hop.

Configure a public virtual interface on the Direct Connect connection. Update the on-premises routing tables to choose Direct Connect as the preferred next hop for traffic destined for Amazon S3.

Configure a public virtual interface on the Direct Connect connection. Establish an AWS managed VPN over the connection. Update the on-premises routing tables to choose the VPN connection as the preferred next hop.

A Lambda function needs to access the private address of an Amazon ElastiCache cluster in a VPC. The Lambda function also needs to write messages to Amazon SQS. The Lambda function has been configured to run in a subnet in the VPC.Which of the following actions meet the requirements? (Choose two.)

The Lambda function needs an IAM role to access Amazon SQS

The Lambda function must be assigned a public IP address to access the public Amazon SQS API.

The Lambda function needs an IAM role to access Amazon SQS

The Lambda function must route through a NAT gateway or NAT instance in another subnet to access the public SQS API.

The Lambda function must be assigned a public IP address to access the public Amazon SQS API.

The ElastiCache server outbound security group rules must be configured to permit the Lambda function's security group.

The Lambda function must consume auto-assigned public IP addresses but not elastic IP addresses.

Which of the following physical layer standards is required for connection to AWS Direct Connect over a standard 1 gigabit or 10 gigabit Ethernet fiber-optic cable?

Single mode fiber, 1000BASE-LX for 1 gigabit Ethernet, or 10GBASE-LR for 10 gigabit Ethernet

Single mode fiber, 1000BASE-LX for 1 gigabit Ethernet, or 10GBASE-ER for 10 gigabit Ethernet

Multi mode fiber, 1000BASE-LX for 1 gigabit Ethernet, or 10GBASE-ER for 10 gigabit Ethernet

Single mode fiber, 1000BASE-LX for 1 gigabit Ethernet, or 10GBASE-LR for 10 gigabit Ethernet

Multi mode fiber, 1000BASE-SX for 1 gigabit Ethernet, or 10GBASE-SR for 10 gigabit Ethernet

A company uses a single connection to the internet when connecting its on-premises location to AWS. It has selected an AWS Partner Network (APN) Partner to provide a point-to-point circuit for its firstever 10 Gbps AWS Direct Connect connection.What steps must be taken to order the cross-connect at the Direct Connect location?

Obtain one LOA/CFA each from the AWS Management Console and the APN Partner. Provide both to the Facility Operator of the Direct Connect location. The facility operator will ensure that the crossconnect is installed.

Obtain the LOA/CFA from the APN Partner when ordering connectivity. Upload it to the AWS Management Console when creating a new Direct Connect connection. AWS will ensure that the crossconnect is installed.

Obtain the LOA/CFA from the AWS Management Console when ordering the Direct Connect connection. Provide it to the APN Partner when ordering connectivity. The Direct Connect partner will ensure that the cross-connect is installed.

Obtain one LOA/CFA each from the AWS Management Console and the APN Partner. Provide both to the Facility Operator of the Direct Connect location. The facility operator will ensure that the crossconnect is installed.

Identify the APN Partner in the AWS Management Console when creating the Direct Connect connection. Provide the resulting Connection ID to the APN Partner, who will ensure that the cross-connect is installed.

Your company has a high-availability hybrid solution that utilizes a two Direct Connect connections and a backup VPN connection. For some reason, traffic is preferring the VPN connection instead of the direct connection. You have prepended a longer AS_PATH on the VPN connection, but AWS still prefers it over the Direct Connect connections.What might you be able to do to fix this issue?

Advertise a less specific prefix on the VPN.

Reconfigure the VPN as a static VPN instead of dynamic.

You have set up an S3 endpoint, and you want to restrict some instances from being able to access it. These instances are all in the same subnet, so you cannot simply remove the prefix list from the route table.What two approaches can you take to solve this? (Choose two.)

Remove any access to the PL in the security group attached to the instances.

Add A rule in the NACL to block the prefix list ID outbound.

You have 99 routes in your dynamic BGP propagated route table and you wish to add 2 more: 10.1.0.0 and 10.3.0.0. You cannot modify or remove routes that have already been announced. What should you do?

Summarize the two routes to combine them into one and advertise it.

Just advertise them, the 100 route limit is a "soft limit" and will be expanded automatically.

Call AWS support to increase your route limit.

A company needs to allow its remote users to access company resources in the AWS Cloud. The company has two VPCs that are connected through VPC peering. The remote users must be able to access resources in both VPCs by using secure connections from their laptop computers. The company does not want to implement an access management solution that requires additional costs or effort. Which solution meets these requirements?

Update resourcesecurity groups in both VPCs to allow traffic from the security group for the subnet association. Instruct the users to sign in to the AWS Management Console and navigate to Client VPN to connect to the Client VPN endpoint.

Deploy an AWS Client VPN endpoint in one VPC, associate a subnet, and define a target network. Add a rule to authorize client access to the target VPC, and add a rule to authorize client access to the peered VP

Update resourcesecurity groups in both VPCs to allow traffic from the security group for the subnet association. Instruct the users to sign in to the AWS Management Console and navigate to Client VPN to connect to the Client VPN endpoint.

Deploy an AWS Client VPN endpoint in both VPCs, associate subnets, and define a target network. Add a rule to authorize client access to each target VP

Update resource security groups in both VPCs to allow traffic from the securitygroups of each VPC for the subnet associations. Securely send the users the configuration options, and instruct the users to install Client VPN on their laptops. Instruct the users to connect to both Client VPN endpoints at the same time to gain access to the resources.

Deploy a Network Load Balancer in front of the company resources. Set up security groups that contain the IP addresses of each of the user laptops. Instruct the users to connect to the application securely over TCP.

Deploy an AWS Client VPN endpoint in one VPC, associate a subnet, and define a target network. Add a rule to authorize client access to the target VPC, and add a rule to authorize client access to the peered VPC. Update resourcesecurity groups in both VPCs to allow traffic from the security group for the subnet association. Securely send the users the configuration options, and instruct the users to install Client VPN on their laptops. Instruct the users to connect to the Client VPN endpoint to gain access to the resources.

With respect to Amazon CloudFront, which one of the following statements is correct?

For both HTTP and HTTPS web distributions, you can choose to forward cookies to your origin.

For HTTPS web distributions, you cannot forward cookies to your origin.

For both HTTP and HTTPS web distributions, you can choose to forward cookies to your origin.

For HTTP web distributions, you cannot forward cookies to your origin.

For Real Time Messaging Protocol (RTMP) distributions, you can configure CloudFront to process cookies.

You have multiple Amazon Elastic Compute Cloud (EC2) instances running a web server in a VPC configured with security groups and NACL. You need to ensure layer 7 protocol level logging of all network traffic (ACCEPT/REJECT) on the instances. What should be enabled to complete this task?

CloudWatch Logs at the VPC level

Packet sniffing at the instance level

VPC flow logs at the subnet level

Packet sniffing at the VPC level

A company's network engineering team is solely responsible for deploying VPC infrastructure using AWS CloudFormation.The company wants to give its developers the ability to launch applications using CloudFormation templates so that subnets can be created using available CIDR ranges. What should be done to meet these requirements?

Create a CloudFormation template that references the Fn::Cidr intrinsic function within a subnet resource to select an available CIDR range.

Create a CloudFormation template with Amazon EC2 resources that rely on cfn-init and cfn-signals to inform the stack of available CIDR ranges.

Create a CloudFormation template with a custom resource that analyzes traffic activity in VPC Flow Logs and reports on available CIDR ranges.

Create a CloudFormation template that references the Fn::Cidr intrinsic function within a subnet resource to select an available CIDR range.

Create a CloudFormation template with a custom resource that uses AWS Lambda and Amazon DynamoDB to manage available CIDR ranges.

An organization is deploying an application in a VPC that requires SSL mutual authentication with a client-side certificate, as that is the primary method of identifying clients. The Network Engineer has been tasked with defining the mechanism used within AWS to provide the SSL mutual authentication. Which of the following options meets the organization's requirements?

Use an Application Load Balancer and upload the client certificate private keys to it by using the native server name indication (SNI) features with smart certificate selection to handle multiple calling applications.

Use a Classic Load Balancer and upload the client certificate private keys to it. Perform SSL mutual authentication of the client-side certificate there.

Use a Network Load Balancer with a TCP listener on port 443, and pass the request through for the SSL mutual authentication to be handled by a backend instance.

Use an Application Load Balancer and upload the client certificate private keys to it by using the native server name indication (SNI) features with smart certificate selection to handle multiple calling applications.

Front the application with Amazon API Gateway, and use its client-side SSL mutual authentication feature that uses the backend instances to verify the source of the request.

A network architect is designing a website. It has web, application, and database tiers that will run in AWS. The website uses Amazon DynamoDB. Which architecture will minimize public exposure of the backend instances?

A VPC with public subnets for the NLB, private subnets for the web tier, and public subnets for the application tier. The application tier connects DynamoDB through a VPC endpoint.

A VPC with public subnets for the NLB, public subnets for the web tier, private subnets for the application tier, and private subnets for DynamoDB.

A VPC with public subnets for the ALB, private subnets for the web tier, and private subnets for the application tier. The application tier connects DynamoDB through a VPC endpoint.

A VPC with public subnets for the ALB, public subnets for the web tier, private subnets for the application tier, and private subnets for DynamoDB.

A VPC with public subnets for the NLB, private subnets for the web tier, and public subnets for the application tier. The application tier connects DynamoDB through a VPC endpoint.

Your company has installed an AWS Direct Connect connection in an ap-southeast-1 Direct Connect location. A public virtual interface is configured through a router to a dedicated firewall. You advertise your company's public /24 CIDR block to AWS with AS 65500. The company maintains a separate, corporate Internet firewall to map all outbound traffic to a single IP.This firewall maintains a BGP relationship with an upstream Internet provider that has delegated the public IP block your company uses. When the BGP session for the public virtual interface is up, corporate network users cannot access Amazon S3 resources in the ap-southeast-1 region.Which step should you take to provide concurrent AWS and Internet access?

NAT the traffic destined for AWS from the dedicated firewall using the public virtual interface.

Configure AS-PATH prepending for the public virtual interface.

Advertise a host route for the corporate firewall on the public virtual interface.

Advertise a host route for the corporate firewall to the upstream Internet provider.

NAT the traffic destined for AWS from the dedicated firewall using the public virtual interface.

Which of the following is true when you don't configure Amazon CloudFront to forward cookies to your origin?

CloudFront removes the Cookie header from requests that it forwards to your origin.

CloudFront disables viewer requests to your origin, including all cookies.

CloudFront caches your objects based on cookie values.

CloudFront automates code deployments to any instance.

To connect to public AWS products such as Amazon EC2 and Amazon S3 through the AWS Direct Link, which step is NOT required?

Allocate a Private IP address to your network in 172.x.x.x range.

Provide public IP address (/31) for each Border Gateway Protocol (BGP) session.

Allocate a Private IP address to your network in 172.x.x.x range.

Provide the public routes that you will advertise over Border Gateway Protocol (BGP).

Provide a public Autonomous System Number (ASN) that you own or a private one to identify your network on the Internet.

Your company currently has a LAG to AWS with two 1Gbps connections. What is the best way to increase throughput on this LAG?

Add two 1Gbps connections to the LAG.

Add three 1Gbps connections to the LAG.

Add one 10Gbps connections to the LAG.

Configure your router to use "jumbo frames" with an MTU of 9001.

Add two 1Gbps connections to the LAG.

Your company needs to directly update an S3 bucket that serves as a CloudFront origin with the most reliability possible.Your company also has a set of private EC2 servers that it needs to access with the same reliability. Which combination will provide the best solution?

A Virtual Gateway and a Public VIF

A Private VIF is all you need to access all AWS resources.

You have several VPCs that are peered. Each VPC has several routes to different subnets. Over the years, your company has acquired many companies. You find that traffic destined for one VPC ends up going to another. What is the best way to remedy this?

Adjust your routes so the proper VPC has a higher CIDR.

Move the route table entry for the proper VPC higher in the list.

Adjust your routes so the proper VPC has a higher CIDR.

Move the route table entry for the proper VPC lower in the list.

Adjust your routes so the proper VPC has a lower CIDR.

Which of the following statements is true of AWS Elastic Beanstalk?

AWS Elastic Beanstalk uses CloudWatch for monitoring and alarms, meaning CloudWatch costs are applied to your AWS account for any alarms that you use.

AWS Elastic Beanstalk uses CloudWatch for monitoring and alarms, and both are free of charge.

AWS Elastic Beanstalk doesn't use CloudWatch for monitoring and alarms, but you pay extra for any AWS Elastic Beanstalk Alarm you set in the monitoring tool.

AWS Elastic Beanstalk has its own free-of-charge monitoring tool, and you are not charged for the alarm you set.

A company wants to migrate a proprietary application from on premises to the AWS Cloud. The application implements segregation of different types of network traffic.The application uses services that listen to multiple ports on two different IP addresses. One IP address is used for customer-facing traffic, and the other IP address is used for management traffic. The application requires the IP addresses to belong to different subnets.How can the company deploy the application with the LEAST management overhead?

Deploy the application to an Amazon EC2 instances that has a secondary elastic network interface attached. Select different subnets for each network interface.

Deploy the application to Amazon Elastic Container Service (Amazon ECS). Configure two elastic network interfaces in the task definition.

Deploy the application to Amazon Elastic Container Service (Amazon ECS). Create an AWS Lambda function to attach a second elastic network interface. Use an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the function.

Deploy the application to an Amazon EC2 instances that has a secondary elastic network interface attached. Select different subnets for each network interface.

Deploy the application to Amazon Elastic Container Service (Amazon ECS). Create an AWS Lambda function to attach a second elastic network interface. Use an AWS Step Functions workflow to invoke the function.

You have two VPCs that you need to connect to an on-premises datacenter using VPNs. When you create the tunnels, you find that both tunnels use the same addresses. What two things can you do to overcome this? (Choose two.)

Delete the VPN, create a "dummy VPN", recreate the VPN, then delete the "dummy" VPN.

Create a VRF within your router for each network.

Delete the VPN, create a "dummy VPN", recreate the VPN, then delete the "dummy" VPN.

Delete your AWS account and create a new one since the VPN tunnel addresses are created from a hash of your account number and a proprietary algorithm.

Create a VHF within you router for each network.

Create a VRF within your router for each network.

A company wants to conduct a proof of concept for an SAP HANA application with a key objective to automate the provisioning of infrastructure and the application. The company operates a hybrid cloud infrastructure with AWS Direct Connect between its data center and VPC. Security policy dictates that all traffic from AWS be routed through on-premises data center firewalls. Security policy also prohibits the use of a VPC internet gateway for internet access. The company enforces use of a forward proxy server for all outbound network traffic. All resources inside the VPC are able to reach onpremises servers.All Amazon EC2 Linux instances require package updates over the internet. However, the updates are falling and sending errors. What would cause these errors?

The EC2 instances are not configured to use the proxy running in the data center for traffic on TCP port 80.

Inbound security groups are configured incorrectly on the EC2 instances running in the VPC.

The VPC route table does not have entries for the proxy server in the data center.

The EC2 instances are not configured to use the proxy running in the data center for traffic on TCP port 80.

The data center firewall is blocking all traffic sent from the VPC CIDR range destined for 0.0.0.0/0.

A company with several VPCs in the us-east-1 Region wants to reduce the cost of its workloads. A network engineer has identified that all traffic bound to Amazon services is flowing through a NAT gateway. Additionally, all the VPCs are peered to a hub VPC for access to common services.What should the network engineer do to reduce data transfer costs to Amazon Simple Queue Service (Amazon SQS)?

Disable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain useast- 1.sqs.amazonaws.com. Create a CNAME record to the DNS name of the SQS endpoint. Share the privatehosted zone with all other VPCs.

Disable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain sqs.us-east-1.amazonaws.com. Create an alias record to the DNS name of the SQS endpoint. Share the privatehosted zone with all other VPCs.

Enable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain sqs.us-east-1.amazonaws.com. Create a CNAME record to the DNS name of the SQS endpoint. Share the privatehosted zone with all other VPCs.

Enable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain useast- 1.sqs.amazonaws.com. Create an alias record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs.

To allow all traffic to access an instance in "Subnet 1" that uses "Security Group 1", what two options need to be configured?(Choose two.)

NACL rule allowing 0.0.0.0/0 to access "Subnet 1"

Security Group rule in "Security Group 1" that allows 0.0.0.0/0 inbound

NACL rule allowing 0.0.0.0/0 to access "Subnet 1"

Security Group rule in "Security Group 1" that allows 0.0.0.0/0 inbound

Security Group rule in "Security Group 1" that allows outbound traffic to 0.0.0.0/0

NACL rule allowing 0.0.0.0/0 to access "Security Group 1"

Your on-premises network has an IP address range of 11.11.0.0/16. Only IPs within this network range can be used for interserver communication. The IP address range 11.11.253.0/24 has been allocated for the cloud.You need to design a VPC in AWS. The servers within the VPC should be able to communicate with hosts both on the Internet and on-premises through a VPN connection. What combination of configuration steps meets your needs?(Choose two)

Set up the VPC with an IP address range of 11.11.253.0/24.

Set up a VPN connection between a VGW and an on-premises router, set the VGW as the default gateway for all traffic, and configure the on-premises router to forward traffic to the Internet.

Set up the VPC with an IP address range of 11.11.253.0/24.

Set up the VPC with an RFC 1918 private IP address range (e.g., 10.10.10.0/24), and set up a NAT gateway to do translation between 10.10.10.0/24 and 11.11.253.0/24 for all outbound traffic.

Set up a VPN connection between a VGW and an on-premises router, set the VGW as the default gateway for all traffic, and configure the on-premises router to forward traffic to the Internet.

Set up a VPN connection between a VGW and an on-premises router, set the VGW as the default gateway for traffic destined to 11.11.0.0/24, and add a VPC subnet route to point the default gateway to an Internet gateway for Internettraffic.

Set up the VPC with an RFC 1918 private IP address range (e.g., 10.10.10.0/24), and set the VGW to do a source IP translation of all outbound packets to 11.11.0.0/16.