You deploy an Amazon EC2 instance that runs a web server into a subnet in a VPC. An Internet gateway is attached, and the main route table has a default route (0.0.0.0/0) configured with a target of the Internet gateway. The instance has a security group configured to allow as follows:Protocol: TCPPort: 80 inbound and nothing outboundThe Network ACL for the subnet is configured to allow as follows:Protocol: TCPPort: 80 inbound and nothing outboundWhen you try to browse to the web server, you receive no response.Which additional step should you take to receive a successful response?

Add an entry to the Network ACL outbound rules for Protocol: TCP, Port Range: 80

Add an entry to the security group outbound rules for Protocol: TCP, Port Range: 80

Add an entry to the security group outbound rules for Protocol: TCP, Port Range: 1024-65535

Add an entry to the Network ACL outbound rules for Protocol: TCP, Port Range: 80

Add an entry to the Network ACL outbound rules for Protocol: TCP, Port Range: 1024-65535

An organization processes consumer information submitted through its website. The organization's security policy requires that personally identifiable information (PII) elements are specifically encrypted at all times and as soon as feasible when received. The front-end Amazon EC2 instances should not have access to decrypted PII. A single service within the production VPC must decrypt the PII by leveraging an IAM role.Which combination of services will support these requirements? (Choose two.)

Customer-managed MySQL with Transparent Data Encryption

Amazon Aurora in a private subnet

Amazon CloudFront using AWS Lambda@Edge

Customer-managed MySQL with Transparent Data Encryption

Application Load Balancer using HTTPS listeners and targets

Your boss decides to assign an Elastic IP to a production instance. Once he does this, access to the URL for that website fails. What happened?

The original IP address was released back to AWS when the Elastic IP was assigned.

Your boss only needs to restart the Apache service.

Your boss should have turned off the server before assigning the IP address.

Your boss needs to restart the server.

You can use the ____ command of the AWS Config service CLI to see the compliance state of each of your rules.

describe-compliance-by-config-rule

get-compliance-details-by-resource

describe-compliance-by-config-rule

get-compliance-details-by-config-rule

describe-compliance-by-resource

A company has a hybrid environment across its on-premises network and the AWS Cloud. The company wants to use Amazon Elastic File System (Amazon EFS) to store and share data between onpremises services that are required to resolve DNS queries through on-premises DNS servers. The company wants to use a custom domain name to connect to Amazon EFS. The company also wants to avoid using the Amazon EFS target IP address. What should a network engineer do to meet these requirements?

Create an Amazon Route 53 Resolver outbound endpoint, and configure it for the VPC where Amazon EFS resides.Create a Route 53 public hosted zone, and add a new CNAME record with the value of the Amazon EFS DNS name.Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 public hosted zone.

Create an Amazon Route 53 Resolver inbound endpoint, and configure it for the VPC where Amazon EFS resides. Create a Route 53 private hosted zone, and add a new CNAME record with the value of the Amazon EFS DNS name.Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 Resolver.

Create an Amazon Route 53 Resolver outbound endpoint, and configure it for the VPC where Amazon EFS resides.Create a Route 53 private hosted zone, and add a new CNAME record with the value of the Amazon EFS DNS name.Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 Resolver.

Create an Amazon Route 53 Resolver inbound endpoint, and configure it for the VPC where Amazon EFS resides. Create a Route 53 private hosted zone, and add a new PTR record with the value of the Amazon EFS DNS name.Configure forwarding rules on the on-premises DNS servers to forward queries for the custom domain host to the Route 53 private hosted zone.

A network engineer is using the AWS CLI to provision a VPC and Amazon EC2 instances that use IPv6 addresses. An application that runs on the instances requires access to the internet to pull updates from a software vendor. The VPC ID is vpc-3c02b675. The network engineer uses the following command to provision an egress-only internet gateway: aws ac2 create-egress-only-internet-gateway --vpc-id vpc-3c02b675 What else must the network engineer do so that the EC2 instances can pull the updates?

Create a route with destination 0.0.0.0/0 and the egress-only internet gateway ID as the target.

Replace the egress-only internet gateway with a NAT gateway. Create a route with destination 0.0.0.0/0 and the NAT gateway ID as the target.

Replace the egress-only internet gateway with a NAT gateway. Create a route with destination ::/0 and the NAT gateway ID as the target.

Create a route with destination 0.0.0.0/0 and the egress-only internet gateway ID as the target.

Create a route with destination ::/0 and the egress-only internet gateway ID as the target.

True or false: A VPC contains multiple subnets, where each subnet can span multiple Availability Zones.

This is true only for US regions.

This is true only if requested during the set-up of VPC.

You wish to access all European regions using your Direct Connect connection. How should you accomplish this?

Peer VPCs in the different regions and connect DX to one of the regions to communicate with the other.

Find the prefix list for the other region and add it to your route table.

One DX connection will connect you to all regions.

A network engineer needs to create a public virtual interface on the company's AWS Direct Connect connection and only import routes which originated from the same region as the Direct Connect location. What action should accomplish this?

Configure a filter on the company's router to only import routes with the 7224:8100 BGP community tag.

Configure a prefix list on the customer router containing the AWS IP address ranges for the specific Region.

Configure a filter on the company's router to only import routes with the 7224:8100 BGP community tag.

Configure a filter on the company's router to only import routes without a BGP community tag and a maximum path length of 3.

Configure a filter in the AWS console and only allow routes advertised by AWS without a BGP community tag and a maximum path length of 3.

Your company is working on a transition from IPv4 to IPv6 but is concerned about the security of having public IPv6 addresses attached to instances in a public network. They currently use a NAT to allow outbound traffic for instances.Outbound traffic is required for updates. What are two options to alleviate your company's concerns? (Choose two.)

Remove any rules allowing ::/0 inbound in the security group.

Create an egress-only internet gateway.

Remove any rules allowing ::/0 inbound in the security group.

Block ::/0 inbound in the NACL.

Create an egress-only internet gateway.

Block 0.0.0.0/0 inbound in the NACL.

A Network Engineer has enabled VPC Flow Logs to troubleshoot an ICMP reachability issue for an echo reply from an Amazon EC2 instance. The flow logs reveal an ACCEPT record for the request from the client to the EC2 instance, and a REJECT record for the response from the EC2 instance to the client. What is the MOST likely reason for there to be a REJECT record?

The network ACL is denying inbound ICMP.

The security group is denying inbound ICMP.

The network ACL is denying inbound ICMP.

The security group is denying outbound ICMP.

The network ACL is denying outbound ICMP.

DNS name resolution must be provided for services in the following four zones: company.private. emea.company.private. apac.company.private. amer.company.private.The contents of these zones is not considered sensitive, however, the zones only need to be used by services hosted in these VPCs, one per geographic region. Each VPC should resolve the names in all zones. How can you use Amazon route 53 to meet these requirements?

Create a single Route 53 Public Hosted Zone for the zone company.private. and configure the VPC DNS Resolver to forward

Create a Route 53 Private Hosted Zone for each of the four zones and associate them with the three VPCs.

Create a single Route 53 Private Hosted Zone for the zone company.private. and associate it with the three VPCs.

Create a Route Public 53 Hosted Zone for each of the four zones and configure the VPC DNS Resolver to forward

Create a single Route 53 Public Hosted Zone for the zone company.private. and configure the VPC DNS Resolver to forward

A publishing company recently merged with an ecommerce company. Each company uses a VPC to run compute resources.The two VPCs have overlapping CIDR ranges. The publishing company needs to access an internal application that runs on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones in the ecommerce company VPC.Which set of actions will provide the needed interconnectivity between the VPCs?

Create a VPC endpoint service configuration, and specify the NLB. Add the publishing company's AWS account as a principal to the allow list.

1. Create a Network Load Balancer (NLB) for the application in the ecommerce company VP

Configure the NLB for the Availability Zones that the target instances use.

Create a VPC endpoint service configuration, and specify the NLB. Add the publishing company's AWS account as a principal to the allow list.

Create interface endpoint connections to the service in the publishing company VPC in the same Availability Zones as the NLB.

1. Create a VPC peering connection between the ecommerce company VPC and the publishing company VPC.

Update the route tables in both VPCs with routes to the attached VPC.

Update security groups to allow traffic from the publishing company VPC to the application in the ecommerce company VPC.

1. Create an Application Load Balancer (ALB) for the application in the ecommerce company VPConfigure the ALB for all Availability Zones.

Create a VPC endpoint service configuration, and specify the ALB. Add the publishing company's AWS account as a principal to the allow list.

Create an interface endpoint connection from the publishing company VPC to the service.

Your company has two DX locations. You need to configure one link as passive. What should you configure in your router to set that link as the passive link.

Configure AS_PATH Prepending on the link.

Advertise a network with a higher CIDR.

Call your service provider and have the ASN changed for that link.

You have a website hosted on EC2 that is not serving web pages. You have ensured that the server is running and the site is configured properly. What could be the problem?

Your NACL does not allow ports 1024 - 65535 outbound.

Your NACL does not allow port 80 outbound.

Your NACL does not allow ports 1024 - 65535 outbound.

Your NACL does not allow ports 1024 - 65535 inbound.

Your security group does not allow outbound traffic.

A Network Engineer is troubleshooting a network connectivity issue for an instance within a public subnet that cannot connect to the internet. The first step the Engineer takes is to SSH to the instance via a local bastion within the VPC and runs an ifconfig command to inspect the IP addresses configured on the instance. The output is as follows: The Engineer notices that the command output does not contain a public IP address. In the AWS Management Console, the public subnet has a route to the internet gateway. The instance also has a public IP address associated with it.What should the Engineer do next to troubleshoot this situation?

Disable source/destination checking for the instance.

Configure the public IP on the interface.

Disable source/destination checking for the instance.

Associate an Elastic IP address to the interface.

Evaluate the security groups and the network access control list.

A company has applications running in a single AWS Region and its on-premises data center in a hybrid mode. The company has a 1 Gbps AWS Direct Connect connection from the data center to AWS that is 65% utilized. The company has an AWS Enterprise Support plan.The company is planning to deploy a new critical application on AWS that will connect with existing applications running in the data center. The application SLA requires a minimum of 99.9% network uptime between the data center andAWS.What is the MOST cost-effective way to meet this SLA requirement?

Use BGP for load balancing between the VIFs in active/active mode.

Create a second virtual interface (VIF) on the existing Direct Connect connection, and terminate this VIF in the existing VP

Use BGP for load balancing between the VIFs in active/active mode.

Purchase an additional 1 Gbps Direct Connect connection from AWS in a different cross-connect location terminated in the associated Region. Provision a new virtual interface (VIF) to the existing VPC, and use BGP for load balancing.

Set up two new hosted Direct Connect connections of 500 Mbps each through an AWS Direct Connect partner. Provision two virtual interfaces (VIFs) to the existing VPC on both Direct Connect connections, and use BGP for load balancing.Terminate the existing 1 Gbps Direct Connect connection.

Purchase an additional 1 Gbps Direct Connect connection from AWS in the existing cross-connect location. Ask AWS to terminate this new connection in a different router. Provision two virtual interfaces (VIFs) to the same VPC on both Direct Connect connections, and use BGP for load balancing.

What are two reasons that could cause an HTTP health check to fail? (Choose two.)

Security group blocking port 80 to the instance

NACL blocking port 443 to the instance

A department in your company has created a new account that is not part of the organization's consolidated billing family.The department has also created a VPC for its workload. Access is restricted by network access control lists to the department's on-premises private IP allocation. An AWS Direct Connect private virtual interface for this VPC advertises a default route to the company network. When the department downloads data from an Amazon EC2 instance in its new VPC, what are the associated charges?

The department pays AWS Direct Connect Data Out charges.

The company pays Internet Data Out charges.

The company pays AWS Direct Connect Data Out charges.

The department pays Internet Data Out charges.

The department pays AWS Direct Connect Data Out charges.

All IP addresses within a 10.0.0.0/16 VPC are fully utilized with application servers across two Availability Zones. The application servers need to send frequent UDP probes to a single central authentication server on the Internet to confirm that it is running up-to-date packages. The network is designed for application servers to use a single NAT gateway for internal access. Testing reveals that a few of the servers are unable to communicate with the authentication server. What is the reason for this failure?

The NAT gateway cannot allocate more ports.

The NAT gateway does not support UDP traffic.

The authentication server is not accepting traffic.

The NAT gateway cannot allocate more ports.

The NAT gateway is launched in a private subnet.

A customer has set up multiple VPCs for Dev, Test, Prod, and Management. You need to set up AWS Direct Connect to enable data flow from on-premises to each VPC. The customer has monitoring software running in the Management VPC that collects metrics from the instances in all the other VPCs. Due to budget requirements, data transfer charges should be kept at minimum. Which design should be recommended?

Create a total of four private VIFs, one for each VPC owned by the customer, and route traffic between VPCs using the Direct Connect link.

Create a private VIF to the Management VPC, and peer this VPC to all other VPCs.

Create a private VIF to the Management VPC, and peer this VPC to all other VPCs; enable source/destination NAT in the Management VPC.

Create a total of four private VIFs, and enable VPC peering between all VPCs.

A user is having data generated randomly based on a certain event. The user wants to upload that data to CloudWatch. It may happen that event may not have data generated for some period due to randomness. Which of the below mentioned options is a recommended option for this case?

For the period when there is no data the user should send the value as 0

For the period when there is no data, the user should not send the data at all

The user must upload the data to CloudWatch as having no data for some period will cause an error at CloudWatch monitoring

For the period when there is no data the user should send the value as 0

For the period when there is no data the user should send a blank value

Due to security requirements, all traffic must be encrypted between your VPC and your on-premises data center. You also want to maintain reliability. What two options will allow you to achieve this? (Choose two.)

A Direct Connect connection with a Public VIF

A Direct Connect connection with a Private VIF

A Direct Connect connection with a Hosted VIF

A Direct Connect connection with a Public VIF

In your current role as the corporate network architect - you have decided to replace your existing hardware firewall appliances with a pair of Juniper SRX-Series Services Gateways. You have chosen these as AWS lists these as supportable devices for establishing IPsec connections. With this in mind, select the minimum set of options to ensure that you can establish IPsec connectivity between your on premise private corporate network and your AWS hosted VPC.Select which option is NOT required.

Deploy a Customer Gateway within your corporate network

Initiate network connections from somewhere within your corporate network, this is required to bring the tunnels UP

Deploy a Customer Gateway within your corporate network

Deploy a Customer Gateway within your VPC

Deploy a Virtual Private Gateway within your VPC

An organization wants to process sensitive information using the Amazon EMR service. The information is stored in onpremises databases. The output of processing will be encrypted using AWS KMS before it is uploaded to a customerowned Amazon S3 bucket. The current configuration includes a VPS with public and private subnets, with VPN connectivity to the on-premises network. The security organization does not allow Amazon EC2 instances to run in the public subnet.What is the MOST simple and secure architecture that will achieve the organization's goal?

Use the existing VPS and a NAT gateway, and configure Amazon EMR in a private subnet with an Amazon S3 endpoint.

Use the existing VPC and configure Amazon EMR in a private subnet with an Amazon S3 endpoint.

Use the existing VPS and a NAT gateway, and configure Amazon EMR in a private subnet with an Amazon S3 endpoint.

Create a new VPS without an IGW and configure the VPN and Amazon EMR in a private subnet with an Amazon S3 endpoint.

Create a new VPS without an IGW and configure the VPN and Amazon EMR in a private subnet with an Amazon S3 endpoint and a NAT gateway.

An organization is migrating its on-premises applications to AWS by using a lift-and-shift approach, taking advantage of managed AWS services wherever possible. The company must be able to edit the application code during the migration phase. One application is a traditional three-tier application, consisting of a web presentation tier, an application tier, and a database tier. The external calling client applications need their sessions to remain sticky to both the web and application nodes that they initially connect to.Which load balancing solution would allow the web and application tiers to scale horizontally independent from one another other?

Use an Application Load Balancer at both the web and application tiers, setting session stickiness at the target group level for both tiers.

Use an Application Load Balancer at the web tier and a Classic Load Balancer at the application tier. Set session stickiness on both, but update the application code to create an application-controlled cookie on the Classic Load Balancer.

Use an Application Load Balancer at both the web and application tiers, setting session stickiness at the target group level for both tiers.

Deploy a web node and an application node as separate containers on the same host, using task linking to create a relationship between the pair. Add an Application Load Balancer with session stickiness in front of all web nodecontainers.

Use a Network Load Balancer at the web tier, and an Application Load Balancer at the application tier. Enable session stickiness on the Application Load Balancer, but take advantage of the native WebSockets protocols available to theNetwork Load Balancer.

You have a static VPN connecting your data center and your VPC. You currently have 50 routes added to your route table. You want to add more; how should you do this?

Convert your VPN to a dynamic VPN and use BGP.

50 is the most you can have for any connection.

Just add them, you have a maximum of 100 static routes per route table.

Set up Direct Connect. A VPN will not support more routes.

Convert your VPN to a dynamic VPN and use BGP.

A company uses an Application Load Balancer (ALB) to provide access to a multi-tenant web application for 25 customers.The company creates a unique hostname for each customer to use to access the application. Hostnames use the format customer-name.example.com.Each customer has a dedicated group of Amazon EC2 instances that run their own version of the web application. When a customer visits customer-name.example.com, the ALB should route the request to the correct group of EC2 instances. The company requires a highly available solution that is easy to maintain. Which solution meets these requirements at the LOWEST cost?

Create one ALB for all customers. Create a listener rule that includes an HTTP header condition to match the URL. Add aforward action to route the request to the customer target group. Use Amazon Route 53 to create an alias recordfor eachcustomer-name.example.com hostname that points to the ALB.

Create one ALB for each customer. Configure the listener to route requests to the customer target group. Configure an NGINX proxy server to manage connections to each ALUse Amazon Route 53 to create a CNAME record for eachcustomer-name.example.com hostname that points to the NGINX proxy server.

Create one ALB for all customers. Create a listener rule that includes a Host header condition to match the hostname.Add a forward action to route the request to the customer target group. Use Amazon Route 53 to create an alias record for each customer-name.example.com hostname that points to the ALB.

Create one ALB for each customer. Configure the listener to route requests to the customer target group. Create an Amazon CloudFront distribution. Add each ALB to the distribution as a custom origin. Use Amazon Route 53 to create analias for each customer-name.example.com hostname that points to the CloudFront distribution.

A company is deploying a new web application that uses a three-tier model with a public-facing Network Load Balancer and web servers in an Amazon VPC. The application servers are hosted in the company's data center. There is an AWS Direct Connect connection between the VPC and the company's data center. Load testing results indicate that up to 100 servers, equally distributed across multiple Availability Zones, are required to handle peak loads. The network engineer needs to design a VPC that has a /24 CIDR assigned to it.How should the engineer allocate subnets across three Availability Zones for each tier?

Network Load Balancer: /28 per subnet Web: /26 per subnet

Network Load Balancer: /29 per subnet Web: /26 per subnet

Network Load Balancer: /28 per subnet Web: /25 per subnet

Network Load Balancer: /28 per subnet Web: /27 per subnet

Network Load Balancer: /28 per subnet Web: /26 per subnet

A financial company is designing a secure AWS network architecture to support a hybrid cloud strategy. Systems deployed in the AWS Cloud are mission critical and have strict availability requirements. The company anticipates the need for hundreds of VPCs. Instances will be transient and rely heavily on DNS resolution. The applications must be designed to have Availability Zone isolation and tolerate the loss of an Availability Zone. What is the MOST reliable way to implement DNS in this scenario?

Use Amazon Route 53 Resolver for hybrid DNS.

Create a new DHCP options set with DNS settings with on-premises DNS servers that traverse an AWS Direct Connect connection.

Create private hosted zones and share them with each VP

Use Amazon Route 53 Resolver for hybrid DNS.

Modify the default DHCP options set with a fleet of proxy DNS servers that are deployed in each VPC.

Create a fleet of DNS proxy servers in a central VPC. Share the proxy fleet with each VPC using AWS PrivateLink.

Which of the following types of contents cannot serve over HTTP or HTTPS in Amazon CloudFront?

Static and dynamic download content

Amazon ANS-C00 Practice Test 9 - Free Online Exam Prep & Questions

You wish to host a mailserver on an EC2 instance. What two steps must you take to ensure utmost reliability?

Become a Premium Member for full access

Unlock Premium Member

Amazon ANS-C00 Practice Test 9

Question

Amazon ANS-C00 Practice Tests

Practice Tests