Home / Amazon / ANS-C00

Amazon ANS-C00 Practice Test - Questions Answers, Page 23

Question list

List of questions

Question 221

(0)

A company's web application is deployed on Amazon EC2 instances behind a public Application Load Balancer. The application flags malicious requests and uses an AWS Lambda function to add the offendi

Question 222

(0)

A company has a hybrid IT architecture with two AWS Direct Connect connections to provide high availability. The services hosted on-premises are accessible using public IPs, and are also on the 172.

Question 223

(0)

Your organization needs to resolve DNS entries stored in an Amazon Route 53 private zone "awscloud:internal" from the corporate network. An AWS Direct Connect connection with a private virtual inter

Question 224

(0)

A company has an AWS Direct Connect connection between its on-premises data center and Amazon VPC. An application running on an Amazon EC2 instance in the VPC needs to access confidential data store

Question 225

(0)

Which service would you use to see the DSCP value in a packet header?

Question 226

(0)

A company deployed its production Amazon VPC using CIDR block 33.16.0.0/16. The company has nearly depleted its addresses and now needs to extend the VPC network. Which CIDR blocks meet the company

Question 227

(0)

What is the IPv6 subnet CIDR used by a VPC?

Question 228

(0)

You have a three-tier web application with separate subnets for Web, Applications, and Database tiers. Your CISO suspects your application will be the target of malicious activity. You are tasked wi

Question 229

(0)

You need to set up an Amazon Elastic Compute Cloud (EC2) instance for an application that requires the lowest latency and the highest packet-per-second network performance. The application will talk

Question 230

(0)

What is the DNS server address for a VPC (10.111.0.0/16) with a subnet of 10.111.4.0/24?

Related questions

You have deployed a website that utilizes CloudFront, Elastic Loadbalancer, and S3 to serve content. When users access your site, they receive a "mixed content" security warning. What is most likely the problem?

An organization has multiple applications running in VPCs across multiple AWS accounts. The network engineer has deployed a central VPC with a pair of software VPN instances that run IPSec tunnels with dynamic routing to VGWs of all application VPCs. This central VPC is connected to on-premises resources via a Direct Connect connection using a private VIF. What additional configuration is required to enable the applications in VPCs to communicate with each other and access onpremises resources?

A company is building a hybrid PCI-DSS compliant application that runs in the us-west-2 Region and on-premises. The application sends access logs from all locations to a single Amazon S3 bucket in uswest-2. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses. How should an engineer configure the network to meet these requirements?

In Amazon CloudFront, to link to your objects, if your domain name is d111111abcdef8.cloudfront.net and your object is image.jpg, then the URL for the link in your webpage will be _____.

You have two VPCs that you've peered. You created a route for VPC A to get to an instance in VPC. You are unable to ping the instance. You have double checked your security groups and NACLs. Why might this be?

You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URLs, the instances should be able to access any Amazon S3 bucket in the same region via any URL. Which of the following solutions should you deploy? (Choose two.)

Your website is under attack and a malicious party is stealing large amounts of data. You have default NACL rules. Stopping the attack is the ONLY priority in this case. Which two commands should you use? (Choose two.)

Which element of AWS Config can be used to help maintain internal and external compliance controls?

A bank built a new version of its banking application in AWS using containers that connect to an on-premises database over a VPN connection. This application version requires users to also update their client application. The bank plans to deprecate the earlier client version. However, the company wants to keep supporting earlier clients through their onpremises version of the application to serve a small portion of the customers who haven't yet upgraded. What design will allow the company to serve both newer and earlier clients in the MOST efficient way?

You are configuring multiple Direct Connect links for your organization and need them to be in an HA Active/Passive configuration with extreme sensitivity to outages in order to encourage very quick failover times. You also need to be able to control which link is active. What two configuration changes should you implement? (Choose two.)

Question 221

A company's web application is deployed on Amazon EC2 instances behind a public Application Load Balancer. The application flags malicious requests and uses an AWS Lambda function to add the offending IP addresses to the network ACL to block any further requests for 24 hours. Recently, the application has been receiving more malicious requests, which causes the network ACL to reach its limit of allowed entries.

Which action should be taken to block more IP addresses, without compromising the existing security requirements?

Update the AWS Lambda function to remove blocked entries from the network ACL after 2 hours.

Update the AWS Lambda function to block malicious IPs in security groups rather than the network ACL.

Update the AWS Lambda function to block malicious IPs in AWS WAF attached to the Application Load Balancer.

Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached.

Show Answer Comment (0)

Question 222

A company has a hybrid IT architecture with two AWS Direct Connect connections to provide high availability. The services hosted on-premises are accessible using public IPs, and are also on the 172.16.0.0/16 range. The AWS resources are on the 192.168.0.0/18 range. The company wants to use Amazon Elastic Load Balancing for SSL offloading, health checks, and sticky sessions. What should be done to meet these requirements?

Create a Network Load Balancer pointing to the on-premises server's private IP address.

Create an Amazon CloudFront distribution for the on-premises service and use the public IPs of the on-premises servers as the origin.

Create a Network Load Balancer pointing to the on-premises server's public IP address.

Create an Application Load Balancer pointing to the on-premises server's private IP address.

Show Answer Comment (0)

Question 223

Your organization needs to resolve DNS entries stored in an Amazon Route 53 private zone "awscloud:internal" from the corporate network. An AWS Direct Connect connection with a private virtual interface is configured to provide access to a VPC with the CIDR block 192.168.0.0/16. A DNS Resolver (BIND) is configured on an Amazon Elastic Compute Cloud (EC2) instance with the IP address 192.168.10.5 within the VPC. The DNS Resolver has standard root server hints configured and conditional forwarding for "awscloud.internal" to the IP address 192.168.0.2.

From your PC on the corporate network, you query the DNS server at 192.168.10.5 for www.amazon.com. The query is successful and returns the appropriate response. When you query for "server.awscloud.internal", the query times out. You receive no response.

How should you enable successful queries for "server.awscloud.internal"?

Attach an internet gateway to the VPC and create a default route.

Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True

Relocate the BIND DNS Resolver to the corporate network.

Update the security group for the EC2 instance at 192.168.10.5 to allow UDP Port 53 outbound.

Show Answer Comment (0)

Question 224

A company has an AWS Direct Connect connection between its on-premises data center and Amazon VPC. An application running on an Amazon EC2 instance in the VPC needs to access confidential data stored in the on-premises data center with consistent performance. For compliance purposes, data encryption is required. What should the network engineer do to meet these requirements?

Configure a public virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.

Configure a private virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.

Configure an internet gateway in the VPSet up a software VPN between the customer gateway and an EC2 instance in the VPC.

Configure an internet gateway in the VPC. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.

Show Answer Comment (0)

Question 225

Which service would you use to see the DSCP value in a packet header?

CloudTrail

Config

Flow Logs

None of the above

Show Answer Comment (0)

Question 226

A company deployed its production Amazon VPC using CIDR block 33.16.0.0/16. The company has nearly depleted its addresses and now needs to extend the VPC network.

Which CIDR blocks meet the company's requirement to extend the VPC network with a secondary CIDR? (Choose two.)

33.17.0.0/16

172.16.0.0/18

100.70.0.0/17

192.168.1.0/24

10.0.0.0/8

Show Answer Comment (0)

Question 227

What is the IPv6 subnet CIDR used by a VPC?

/128

/56

/48

/16

Show Answer Comment (0)

Question 228

You have a three-tier web application with separate subnets for Web, Applications, and Database tiers. Your CISO suspects your application will be the target of malicious activity. You are tasked with notifying the security team in the event your application is port scanned by external systems.

Which two AWS Services cloud you leverage to build an automated notification system? (Choose two.)

Internet gateway

VPC Flow Logs

AWS CloudTrail

Lambda

AWS Inspector

Show Answer Comment (0)

Question 229

You need to set up an Amazon Elastic Compute Cloud (EC2) instance for an application that requires the lowest latency and the highest packet-per-second network performance. The application will talk to other servers in a peered VPC.

Which two of the following components should be part of the design? (Choose two.)

Select an instance with support for single root I/O virtualization.

Select an instance that has support for multiple ENAs.

Ensure that the instance supports jumbo frames and set 9001 MTU.

Select an instance with Amazon Elastic Block Store (EBS)-optimization.

Ensure that proper OS drivers are installed.

Show Answer Comment (0)