Amazon ANS-C00 Practice Test - Questions Answers, Page 14
List of questions
Question 131

Your Amazon Kinesis application receives data streams from thousands of devices. The data is then stored in an onpremises Hadoop cluster. You are concerned about historical data that shows periods of sustained traffic between 1 Gbps and 2 Gbps during peaks. You must ensure that you have secure, fault- tolerant connectivity between Amazon Kinesis and your data center. What should you implement to address these needs?
Explanation:
Explanation:
Three connections are required to provide fault tolerance. All of the other options would be unable to handle the peak loads over 1 Gbps without exceeding the available bandwidth.
Question 132

You ping an Amazon Elastic Compute Cloud (EC2) instance from an on-premises server. VPC Flow Logs record the following:
2 123456789010 eni-1235b8ca 10.123.234.78 172.11.22.33 0 0 1 8 672 1432917027 1432917142 ACCEPT OK
2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917027 1432917082 ACCEPT OK
2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917094 1432917142 REJECT OK
Why are ICMP responses not received by the on-premises system?
Explanation:
Explanation:
An ACCEPT record for the originating ping that was allowed by both the network ACL and the security group, and therefore was allowed to reach your instance. A REJECT record for the response ping that the network ACL denied.
If your network ACL permits outbound ICMP traffic, the flow log displays two ACCEPT records (one for the originating ping and one for the response ping). If your security group denies inbound ICMP traffic, the flow log displays a single REJECT record, because the traffic was not permitted to reach your instance. Reference: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Question 133

Which port range must be allowed through a NACL to ensure all return traffic is successful?
Explanation:
Explanation:
1024 - 65,535 is the full "ephemeral port" range.
Question 134

A media company that is based in Los Angeles, California, closed all of its on-premises data centers due to rising costs and inconsistent utilization. The company has deployed its video editing applications on Amazon EC2 instances in the AWS Cloud. The company has deployed to the us-west-1 Region and uses the internet for delivery of the applications.
Users are reporting high latency from Los Angeles to us-west-1. The company needs to reduce the latency to the EC2 instances while continuing to use the internet for delivery. Which solution meets these requirements?
Explanation:
Explanation:
There is one private VIF from AWS Direct Connect location 2 to the Direct Connect gateway. Reference: https://docs.aws.amazon.com/directconnect/latest/UserGuide/dc-ug.pdf
Question 135

You have several Amazon Glacier vaults you would like to monitor. How might you monitor those vaults?
Explanation:
Explanation:
AWS Config does not currently record Amazon Glacier resources; you must create a custom rule if you wish to monitor such a resource.
Reference: http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.html#creating-custom-rulesfor- additional-resource-types
Question 136

Refer to the image.
You have three VPCs: A, B, and
Question 137

For _______ distributions, CloudFront does not cache cookies in edge caches.
Explanation:
Explanation:
For RTMP distributions, when Amazon CloudFront requests an object from the origin server, it removes any cookies before forwarding the request to your origin. If your origin returns any cookies along with the object, CloudFront removes them before returning the object to the viewer.
For RTMP distributions, CloudFront does not cache cookies in edge caches.
Reference: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html
Question 138

An organization will be expanding its current network design. When fully built out, there will be 99 VPCs spread across 11 AWS accounts (9 VPCs per account). There is currently an AWS Direct Connect connection into one account with 9 VPCs, each with a virtual network interface (VIF) per VPC.
Which of the following designs will minimize cost while allowing the organization to expand?
Question 139

In Amazon CloudFront, while creating a web distribution, which of the following can be used as origin servers?
Explanation:
Explanation:
In Amazon CloudFront, while creating a web distribution, you can create one or more Amazon S3 buckets or configure HTTPservers as your origin servers. An origin is the location where you store the original version of your web content. WhenCloudFront gets a request for your files, it goes to the origin to get the files that it distributes at edge locations. You can useany combination of Amazon S3 buckets and HTTP servers as your origin servers.
Reference: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating.html
Question 140

You run a well-architected, multi-AZ application in the eu-central-1 (Frankfurt) AWS region. The application is hosted in a VPC and is only accessed from the corporate network. To support large volumes of data transfer and administration of the application, you use a single 10-Gbps AWS Direct Connect connection with multiple private virtual interfaces. As part of a review, you decide to improve the resilience of your connection to AWS and make sure that any additional connectivity does not share the same Direct Connect routers at AWS. You need to provide the best levels of resilience to meet the application's needs.
Which two options should you consider? (Choose two.)
Question