Home / Amazon / ANS-C00

Amazon ANS-C00 Practice Test - Questions Answers, Page 3

Question list

List of questions

Question 21

(0)

A company runs its applications on Amazon EC2 instances. A network engineer must deny specific ports for all applications and must allow only approved ports for each application. All outbound traffi

Question 22

(0)

Your AWS WorkSpaces users are unable to authenticate. What could be one reason for this?

Question 23

(0)

Your organization requires strict adherence to a change control process for its Amazon Elastic Compute Cloud (EC2) and VPC environments. The organization uses AWS CloudFormation as the AWS service t

Question 24

(0)

A bank built a new version of its banking application in AWS using containers that connect to an on-premises database over a VPN connection. This application version requires users to also update th

Question 25

(0)

You have two Direct Connect connections and two VPN connections to your network. Site A is VPN 10.1.0.0/24 AS 65000 65000, Site B is VPN 10.1.0.252/30 AS 65000, Site C is DX 10.0.0.0/8 AS 65000 and

Question 26

(0)

Fill in the blanks: One of the basic characteristics of security groups for your VPC is that you ______ .

Question 27

(0)

You are configuring a VPN to AWS for your company. You have configured the VGW and CGW. You have created the VPN. You have also run the necessary commands on your router. You allowed all TCP and UD

Question 28

(0)

An organization with a growing ecommerce presence uses the AWS CloudHSM to offload the SSL/TLS processing of its web server fleet. The company leverages Amazon EC2 Auto Scaling for web servers to ha

Question 29

(0)

A user has created a VPC with CIDR 20.0.0.0/16 with only a private subnet and VPN connection using the VPC wizard. The user wants to connect to the instance in a private subnet over SSH. How should

Question 30

(0)

Which statement about placement groups is incorrect?

Related questions

You have deployed a website that utilizes CloudFront, Elastic Loadbalancer, and S3 to serve content. When users access your site, they receive a "mixed content" security warning. What is most likely the problem?

You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URLs, the instances should be able to access any Amazon S3 bucket in the same region via any URL. Which of the following solutions should you deploy? (Choose two.)

An organization has multiple applications running in VPCs across multiple AWS accounts. The network engineer has deployed a central VPC with a pair of software VPN instances that run IPSec tunnels with dynamic routing to VGWs of all application VPCs. This central VPC is connected to on-premises resources via a Direct Connect connection using a private VIF. What additional configuration is required to enable the applications in VPCs to communicate with each other and access onpremises resources?

A company is building a hybrid PCI-DSS compliant application that runs in the us-west-2 Region and on-premises. The application sends access logs from all locations to a single Amazon S3 bucket in uswest-2. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses. How should an engineer configure the network to meet these requirements?

You have two VPCs that you've peered. You created a route for VPC A to get to an instance in VPC. You are unable to ping the instance. You have double checked your security groups and NACLs. Why might this be?

In Amazon CloudFront, to link to your objects, if your domain name is d111111abcdef8.cloudfront.net and your object is image.jpg, then the URL for the link in your webpage will be _____.

Your website is under attack and a malicious party is stealing large amounts of data. You have default NACL rules. Stopping the attack is the ONLY priority in this case. Which two commands should you use? (Choose two.)

Which element of AWS Config can be used to help maintain internal and external compliance controls?

A bank built a new version of its banking application in AWS using containers that connect to an on-premises database over a VPN connection. This application version requires users to also update their client application. The bank plans to deprecate the earlier client version. However, the company wants to keep supporting earlier clients through their onpremises version of the application to serve a small portion of the customers who haven't yet upgraded. What design will allow the company to serve both newer and earlier clients in the MOST efficient way?

A company is deploying a critical application on two Amazon EC2 instances in a VPC. Failed client connections to the EC2 instances must be logged according to company policy. What is the MOST cost-effective solution to meet these requirements?

Question 21

A company runs its applications on Amazon EC2 instances. A network engineer must deny specific ports for all applications and must allow only approved ports for each application. All outbound traffic from the instances must be allowed. Which solution will meet these requirements?

Create a network ACL for each application to allow the application's approved ports. Associate the network ACL with the appropriate instances. Create a security group that denies the required specific ports. Associate the security groupwith the appropriate subnets.

Create a security group for each application to allow the application's approved ports. Associate the security group with the appropriate instances. Create a network ACL that denies the required specific ports. Associate the network ACLwith the appropriate subnets.

Create a security group for each application to allow the application's approved ports. Associate the security group with the appropriate instances. Create a network ACL that denies the required specific ports inbound and denies all portsoutbound. Associate the network ACL with the appropriate subnets.

Create a security group for each application to allow the application's approved ports. Associate the security group with the appropriate instances. Create an additional security group that denies the required specific ports. Associate theadditional security group with the appropriate instances.

Show Answer Comment (0)

Question 22

Your AWS WorkSpaces users are unable to authenticate. What could be one reason for this?

Your AD server is running Windows Server 2016

Port 3389 is not open to your AD server.

Port 389 is not open to your AD server.

Your AD server is running Windows Server 2012 Core Edition.

Show Answer Comment (0)

Question 23

Your organization requires strict adherence to a change control process for its Amazon Elastic Compute Cloud (EC2) and VPC environments. The organization uses AWS CloudFormation as the AWS service to control and implement changes.

Which combination of three services provides an alert for changes made outside of AWS CloudFormation? (Choose three.)

AWS Config

AWS Simple Notification Service

AWS CloudWatch metrics

AWS Lambda

AWS CloudFormation

AWS Identify and Access Management

Show Answer Comment (0)

Question 24

Use an Amazon Route 53 multivalue answer routing policy to route older client traffic to the on-premises application version and the rest of the traffic to the new AWS based version.

Use a Classic Load Balancer for the new application. Route all traffic to the new application by using an Elastic Load Balancing (ELB) load balancer DNS. Define a user-agent-based rule on the backend servers to redirect earlier clients tothe on-premises application.

Use an Application Load Balancer for the new application. Register both the new and earlier applications as separate target groups and use path-based routing to route traffic based on the application version.

Use an Application Load Balancer for the new application. Register both the new and earlier application backends as separate target groups. Use host header-based routing to route traffic based on the application version.

Show Answer Comment (0)

Question 25

You have two Direct Connect connections and two VPN connections to your network. Site A is VPN 10.1.0.0/24 AS 65000 65000, Site B is VPN 10.1.0.252/30 AS 65000, Site C is DX 10.0.0.0/8 AS 65000 and Site D is DX 10.0.0.0/16 AS 65000 65000 65000. Which site will AWS choose to reach your network?

Site A: VPN 10.0.1.0/24 AS 65000 65000

Site B: VPN 10.0.1.252/30 AS 65000 65000 65000

Site C: DX 10.0.0.0/8 AS 65000

Site D: DX 10.0.0.0/16

Show Answer Comment (0)

Question 26

Fill in the blanks: One of the basic characteristics of security groups for your VPC is that you ______ .

can specify allow rules, but not deny rules

can specify deny rules, but not allow rules

can specify allow rules as well as deny rules

can neither specify allow rules nor deny rules

Show Answer Comment (0)

Question 27

You are configuring a VPN to AWS for your company. You have configured the VGW and CGW. You have created the VPN.

You have also run the necessary commands on your router. You allowed all TCP and UDP traffic between your datacenter and your VPC. The tunnel still doesn't come up. What is the most likely reason?

You forgot to turn on route propagation in the route table.

You do not have a public ASN.

Your advertised subnet is too large.

You haven't added protocol 50 to your firewall.

Show Answer Comment (0)

Question 28

An organization with a growing ecommerce presence uses the AWS CloudHSM to offload the SSL/TLS processing of its web server fleet. The company leverages Amazon EC2 Auto Scaling for web servers to handle the growth. What architectural approach is optimal to scale the encryption operation?

Use multiple CloudHSM instances, and load balance them using a Network Load Balancer.

Use multiple CloudHSM instances to the cluster; request to it will automatically load balance.

Enable Auto Scaling on the CloudHSM instance, with similar configuration to the web tier Auto Scaling group.

Use multiple CloudHSM instances, and load balance them using an Application Load Balancer.

Show Answer Comment (0)

Question 29

A user has created a VPC with CIDR 20.0.0.0/16 with only a private subnet and VPN connection using the VPC wizard. The user wants to connect to the instance in a private subnet over SSH. How should the user define the security rule for SSH?

The user can connect to a instance in a private subnet using the NAT instance

The user has to create an instance in EC2 Classic with an elastic IP and configure the security group of a private subnet to allow SSH from that elastic IP

Allow Inbound traffic on port 22 from the user's network

Allow Inbound traffic on port 80 and 22 to allow the user to connect to a private subnet over the internet

Show Answer Comment (0)