ExamGecko
Home Home / Amazon / ANS-C00

Amazon ANS-C00 Practice Test - Questions Answers, Page 15

Question list
Search
Search

List of questions

Search

Related questions











A user is trying to understand the detailed CloudWatch monitoring concept. Which of the below mentioned services does not provide detailed monitoring with CloudWatch?

A.
AWS Route53
A.
AWS Route53
Answers
B.
AWS EMR
B.
AWS EMR
Answers
C.
AWS ELB
C.
AWS ELB
Answers
D.
AWS RDS
D.
AWS RDS
Answers
Suggested answer: B

Explanation:

Explanation:

CloudWatch is used to monitor AWS as well as the custom services. It provides either basic or detailed monitoring for the supported AWS products. In basic monitoring, a service sends data points to CloudWatch every five minutes, while in detailed monitoring a service sends data points to CloudWatch every minute. Services, such as RDS, EC2, Auto Scaling, ELB, and Route 53 can provide the monitoring data every minute. Reference: http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/supported_services.html

You have 4 Direct Connect connections from your datacenter. Site A advertises 172.16.0.0/16 AS 65000, Site B advertises 172.16.0.128/25 AS 65000 65000 65000, Site C advertises 172.0.0.0/8 AS 65000 and Site D advertises 172.16.0.0/24 AS 65000. Which site will AWS choose to reach your network?

A.
Site A: 172.16.0.0/16 AS 65000
A.
Site A: 172.16.0.0/16 AS 65000
Answers
B.
Site B: 172.16.0.128/25 AS 65000 65000 65000
B.
Site B: 172.16.0.128/25 AS 65000 65000 65000
Answers
C.
Site C: 172.0.0.0/8 AS 65000
C.
Site C: 172.0.0.0/8 AS 65000
Answers
D.
Site D: 172.16.0.0/24 AS 65000
D.
Site D: 172.16.0.0/24 AS 65000
Answers
Suggested answer: B

Explanation:

Explanation:

172.16.0.128/25 AS 65000 65000 65000. The most specific prefix is always the first choice for BGP routing. Also, AWS will not accept an advertisement of a network less than /16.

A company is migrating a legacy storefront web application to the AWS Cloud. The application is complex and will take several months to refactor. A solutions architect recommended an interim solution of using Amazon CloudFront with a custom origin pointing to the SSL endpoint URL for the legacy web application until the replacement is ready and deployed.

The interim solution has worked for several weeks. However, all browser connections recently began showing an HTTP 502Bad Gateway error with the header "X-Cache: Error from cloudfront." Monitoring services show that the HTTPS port 443 onthe legacy web application is open and responding to requests. What is the likely cause of the error, and what is the solution?

A.
The origin access identity is not correct. Edit the CloudFront distribution and update the identity in the origins settings.
A.
The origin access identity is not correct. Edit the CloudFront distribution and update the identity in the origins settings.
Answers
B.
The SSL certificate on the CloudFront distribution has expired. Use AWS Certificate Manager (ACM) in the us-east-1 Region to replace the SSL certificate in the CloudFront distribution with a new certificate.
B.
The SSL certificate on the CloudFront distribution has expired. Use AWS Certificate Manager (ACM) in the us-east-1 Region to replace the SSL certificate in the CloudFront distribution with a new certificate.
Answers
C.
The SSL certificate on the legacy web application server has expired. Use AWS Certificate Manager (ACM) in the useast- 1 Region to create a new SSL certificate. Export the public and private keys, and install the certificate on thelegacy web application.
C.
The SSL certificate on the legacy web application server has expired. Use AWS Certificate Manager (ACM) in the useast- 1 Region to create a new SSL certificate. Export the public and private keys, and install the certificate on thelegacy web application.
Answers
D.
The SSL certificate on the legacy web application server has expired. Replace the SSL certificate on the web server with one signed by a globally recognized certificate authority (CA). Install the full certificate chain onto the legacy webapplication server.
D.
The SSL certificate on the legacy web application server has expired. Replace the SSL certificate on the web server with one signed by a globally recognized certificate authority (CA). Install the full certificate chain onto the legacy webapplication server.
Answers
Suggested answer: A

You work for a company that has several instances running with automatically assigned public IPs. You performed an upgrade that required you to restart the instances from the console and your DNS records don't work anymore. What happened?

A.
Your network interfaces need to be reinitialized
A.
Your network interfaces need to be reinitialized
Answers
B.
You need to restart Route 53
B.
You need to restart Route 53
Answers
C.
Restarting too many instances at once overloads the system
C.
Restarting too many instances at once overloads the system
Answers
D.
The instances changed their public IP addresses on restart
D.
The instances changed their public IP addresses on restart
Answers
Suggested answer: D

Explanation:

Explanation:

Automatically assigned public IPs change on stop or termination of an instance.

You have been tasked with migrating your company's proprietary massively large dataset sorting application to AWS. The application currently runs on 4 highly spec'd servers that are in a cluster arrangement and runs 24x7, with the average CPU utilisation across any 24hr period being approx 85% - the migration of this cluster once up and running on AWS is expected to run similarly. The servers shuffle data internally and between themselves. Your company's financial performance is entirely dependent on the speed at which it can sort your customers datasets, that is the faster a sorted result can be returned the better your company's bottom line. Of the choices presented below, select the optimal network configuration that will ensure the best financial results for your company.

A.
Disable Jumbo Frames to ensure better data throughput between instances
A.
Disable Jumbo Frames to ensure better data throughput between instances
Answers
B.
Enable Jumbo Frames to ensure better data throughput between instances
B.
Enable Jumbo Frames to ensure better data throughput between instances
Answers
C.
Create an autoscaled group of c4.8xlarge instances - with min 1 and max 4 - this will ensure your operational costs a minimal
C.
Create an autoscaled group of c4.8xlarge instances - with min 1 and max 4 - this will ensure your operational costs a minimal
Answers
D.
Configure a CloudWatch Alarm to add more CPUs to the instances when average cluster CPU utilisation breaches 85%
D.
Configure a CloudWatch Alarm to add more CPUs to the instances when average cluster CPU utilisation breaches 85%
Answers
Suggested answer: B

Explanation:

Explanation:

Answer C does not meet the brief - the question states that the requirement is to run a cluster of 4 servers 24x7 - and that the average CPU utilisation across any 24hr period is 85% - therefore have an ASG with min 1 and max 4 provides no benefit, and if anything scaling down from 4 machines would impact the speed at which sorting results are returned - and therefore this would affect the company's bottom line. We know that of the Answers A and B we need to choose one - Answer B best supports our requirements - to move data faster between servers. Answer D is nonsensical - AWS doesn't support adding or removing CPUs to instances. Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/network_mtu.html

You have 3 VPCs that need to be able to pass traffic. In what two ways can you achieve this? (Choose two.)

A.
Peer each VPC to every other VPC to create a full mesh peering.
A.
Peer each VPC to every other VPC to create a full mesh peering.
Answers
B.
Peer them, VPC peering allows transitive peering as of December 2017.
B.
Peer them, VPC peering allows transitive peering as of December 2017.
Answers
C.
Call AWS to enable transitive peering.
C.
Call AWS to enable transitive peering.
Answers
D.
Create VPNs between them and adjust the routing tables accordingly.
D.
Create VPNs between them and adjust the routing tables accordingly.
Answers
Suggested answer: A, D

Explanation:

Explanation:

VPN instances can be used to create transitive peering. Full mesh peering is the only way to use peering to allow all VPCs to communicate with all other VPCs. Transitive peering is not possible.

Your company runs an HTTPS application using an Elastic Load Balancing (ELB) load balancer/PHP on nginx server/RDS inmultiple Availability Zones. You need to apply Geographic Restriction and identify the client's IP address in your applicationto generate dynamic content.

How should you utilize AWS services in a scalable fashion to perform this task?

A.
Modify the nginx log configuration to record value in X-Forwarded-For and use CloudFront to apply the Geographic Restriction.
A.
Modify the nginx log configuration to record value in X-Forwarded-For and use CloudFront to apply the Geographic Restriction.
Answers
B.
Enable ELB access logs to store the client IP address and parse these to dynamically modify a blacklist.
B.
Enable ELB access logs to store the client IP address and parse these to dynamically modify a blacklist.
Answers
C.
Use X-Forwarded-For with security groups to apply the Geographic Restriction.
C.
Use X-Forwarded-For with security groups to apply the Geographic Restriction.
Answers
D.
Modify the application code to use value of X-Forwarded-For and CloudFront to apply the Geographic Restriction.
D.
Modify the application code to use value of X-Forwarded-For and CloudFront to apply the Geographic Restriction.
Answers
Suggested answer: A

You have created a custom VPC. What are two things you may need to do in order to SSH directly into your instance?

(Choose two.)

A.
Enable SSH on the instance
A.
Enable SSH on the instance
Answers
B.
Attach a NAT Gateway
B.
Attach a NAT Gateway
Answers
C.
Enable Public IP addresses
C.
Enable Public IP addresses
Answers
D.
Attach an Internet Gateway
D.
Attach an Internet Gateway
Answers
Suggested answer: C, D

Explanation:

Explanation:

Public IP addresses are not enabled by default in a custom VPC. An Internet Gateway is also required.

A company installed an AWS Site-to-Site VPN and configured it to use two tunnels. The company has learned that the VPN connectivity is unstable. During a ping test from the on-premises data center to AWS, a network engineer notices that the first few ICMP replies time out but that subsequent requests are successful. The AWS Management Console shows that the status for both tunnels last changed at the same time the ping responses were successfully received.

Which steps should the network engineer take to resolve the instability? (Choose two.)

A.
Enable dead peer detection (DPD) on the customer gateway device.
A.
Enable dead peer detection (DPD) on the customer gateway device.
Answers
B.
Change the tunnel configuration to active/standby on the virtual private gateway.
B.
Change the tunnel configuration to active/standby on the virtual private gateway.
Answers
C.
Use AS PATH prepending on one path to cause all traffic to prefer that tunnel.
C.
Use AS PATH prepending on one path to cause all traffic to prefer that tunnel.
Answers
D.
Send ICMP requests to an instance in the VPC every 5 seconds from the on-premises network.
D.
Send ICMP requests to an instance in the VPC every 5 seconds from the on-premises network.
Answers
E.
Use a higher multi-exit discriminator (MED) value on the preferred path to prefer that tunnel.
E.
Use a higher multi-exit discriminator (MED) value on the preferred path to prefer that tunnel.
Answers
Suggested answer: C, E

Your company decides to use Amazon S3 to augment its on-premises data store. Instead of using the company's highly controlled, on-premises Internet gateway, a Direct Connect connection is ordered to provide high bandwidth, low latency access to S3. Since the company does not own a publically routable IPv4 address block, a request was made to AWS for an AWS-owned address for a Public Virtual Interface (VIF).

The security team is calling this new connection a "backdoor", and you have been asked to clarify the risk to the company. Which concern from the security team is valid and should be addressed?

A.
AWS advertises its aggregate routes to the Internet allowing anyone on the Internet to reach the router.
A.
AWS advertises its aggregate routes to the Internet allowing anyone on the Internet to reach the router.
Answers
B.
Direct Connect customers with a Public VIF in the same region could directly reach the router.
B.
Direct Connect customers with a Public VIF in the same region could directly reach the router.
Answers
C.
EC2 instances in the same region with access to the Internet could directly reach the router.
C.
EC2 instances in the same region with access to the Internet could directly reach the router.
Answers
D.
The S3 service could reach the router through a pre-configured VPC Endpoint.
D.
The S3 service could reach the router through a pre-configured VPC Endpoint.
Answers
Suggested answer: A
Total 414 questions
Go to page: of 42