Home / Amazon / ANS-C00

Amazon ANS-C00 Practice Test - Questions Answers, Page 30

Question list

List of questions

Question 291

(0)

Your company has a high-availability hybrid solution that utilizes a two Direct Connect connections and a backup VPN connection. For some reason, traffic is preferring the VPN connection instead of

Question 292

(0)

You have set up an S3 endpoint, and you want to restrict some instances from being able to access it. These instances are all in the same subnet, so you cannot simply remove the prefix list from the

Question 293

(0)

You have 99 routes in your dynamic BGP propagated route table and you wish to add 2 more: 10.1.0.0 and 10.3.0.0. You cannot modify or remove routes that have already been announced. What should you

Question 294

(0)

A company needs to allow its remote users to access company resources in the AWS Cloud. The company has two VPCs that are connected through VPC peering. The remote users must be able to access resou

Question 295

(0)

What is the name of the label applied to packets to allow routers to know where to forward in an MPLS network?

Question 296

(0)

What number does the binary number 10101000 correspond to?

Question 297

(0)

Which other AWS service is used to track `Related Events' within the Configuration Item?

Question 298

(0)

With respect to Amazon CloudFront, which one of the following statements is correct?

Question 299

(0)

You have multiple Amazon Elastic Compute Cloud (EC2) instances running a web server in a VPC configured with security groups and NACL. You need to ensure layer 7 protocol level logging of all networ

Question 300

(0)

A company's network engineering team is solely responsible for deploying VPC infrastructure using AWS CloudFormation. The company wants to give its developers the ability to launch applications usi

Related questions

You have deployed a website that utilizes CloudFront, Elastic Loadbalancer, and S3 to serve content. When users access your site, they receive a "mixed content" security warning. What is most likely the problem?

An organization has multiple applications running in VPCs across multiple AWS accounts. The network engineer has deployed a central VPC with a pair of software VPN instances that run IPSec tunnels with dynamic routing to VGWs of all application VPCs. This central VPC is connected to on-premises resources via a Direct Connect connection using a private VIF. What additional configuration is required to enable the applications in VPCs to communicate with each other and access onpremises resources?

A company is building a hybrid PCI-DSS compliant application that runs in the us-west-2 Region and on-premises. The application sends access logs from all locations to a single Amazon S3 bucket in uswest-2. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses. How should an engineer configure the network to meet these requirements?

You have two VPCs that you've peered. You created a route for VPC A to get to an instance in VPC. You are unable to ping the instance. You have double checked your security groups and NACLs. Why might this be?

You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URLs, the instances should be able to access any Amazon S3 bucket in the same region via any URL. Which of the following solutions should you deploy? (Choose two.)

In Amazon CloudFront, to link to your objects, if your domain name is d111111abcdef8.cloudfront.net and your object is image.jpg, then the URL for the link in your webpage will be _____.

Your website is under attack and a malicious party is stealing large amounts of data. You have default NACL rules. Stopping the attack is the ONLY priority in this case. Which two commands should you use? (Choose two.)

Which element of AWS Config can be used to help maintain internal and external compliance controls?

A bank built a new version of its banking application in AWS using containers that connect to an on-premises database over a VPN connection. This application version requires users to also update their client application. The bank plans to deprecate the earlier client version. However, the company wants to keep supporting earlier clients through their onpremises version of the application to serve a small portion of the customers who haven't yet upgraded. What design will allow the company to serve both newer and earlier clients in the MOST efficient way?

A company is deploying a critical application on two Amazon EC2 instances in a VPC. Failed client connections to the EC2 instances must be logged according to company policy. What is the MOST cost-effective solution to meet these requirements?

Question 291

Your company has a high-availability hybrid solution that utilizes a two Direct Connect connections and a backup VPN connection. For some reason, traffic is preferring the VPN connection instead of the direct connection. You have prepended a longer AS_PATH on the VPN connection, but AWS still prefers it over the Direct Connect connections.

What might you be able to do to fix this issue?

Advertise a less specific prefix on the VPN.

Remove the prepended AS_PATH.

Reconfigure the VPN as a static VPN instead of dynamic.

Increase the MED on the VPN.

Show Answer Comment (0)

Question 292

You have set up an S3 endpoint, and you want to restrict some instances from being able to access it. These instances are all in the same subnet, so you cannot simply remove the prefix list from the route table.

What two approaches can you take to solve this? (Choose two.)

Remove any access to the PL in the security group attached to the instances.

Add A rule in the NACL to block the prefix list ID outbound.

This is not possible.

Modify the endpoint policy.

Show Answer Comment (0)

Question 293

You have 99 routes in your dynamic BGP propagated route table and you wish to add 2 more: 10.1.0.0 and 10.3.0.0. You cannot modify or remove routes that have already been announced. What should you do?

Summarize the two routes to combine them into one and advertise it.

Just advertise them, the 100 route limit is a "soft limit" and will be expanded automatically.

You cannot add these routes.

Call AWS support to increase your route limit.

Show Answer Comment (0)

Question 294

A company needs to allow its remote users to access company resources in the AWS Cloud. The company has two VPCs that are connected through VPC peering. The remote users must be able to access resources in both VPCs by using secure connections from their laptop computers. The company does not want to implement an access management solution that requires additional costs or effort. Which solution meets these requirements?

Update resourcesecurity groups in both VPCs to allow traffic from the security group for the subnet association. Instruct the users to sign in to the AWS Management Console and navigate to Client VPN to connect to the Client VPN endpoint.

Deploy an AWS Client VPN endpoint in both VPCs, associate subnets, and define a target network. Add a rule to authorize client access to each target VP

Update resource security groups in both VPCs to allow traffic from the securitygroups of each VPC for the subnet associations. Securely send the users the configuration options, and instruct the users to install Client VPN on their laptops. Instruct the users to connect to both Client VPN endpoints at the same time to gain access to the resources.

Deploy a Network Load Balancer in front of the company resources. Set up security groups that contain the IP addresses of each of the user laptops. Instruct the users to connect to the application securely over TCP.

Deploy an AWS Client VPN endpoint in one VPC, associate a subnet, and define a target network. Add a rule to authorize client access to the target VPC, and add a rule to authorize client access to the peered VPC. Update resourcesecurity groups in both VPCs to allow traffic from the security group for the subnet association. Securely send the users the configuration options, and instruct the users to install Client VPN on their laptops. Instruct the users to connect to the Client VPN endpoint to gain access to the resources.

Show Answer Comment (0)

Question 295

What is the name of the label applied to packets to allow routers to know where to forward in an MPLS network?

BFD

BGP

FEC

ABC

Show Answer Comment (0)

Question 296

What number does the binary number 10101000 correspond to?

168

128 C. 192

160

Show Answer Comment (0)

Question 297

Which other AWS service is used to track `Related Events' within the Configuration Item?

AWS WAF

SQS

AWS CloudTrail

Show Answer Comment (0)

Question 298

With respect to Amazon CloudFront, which one of the following statements is correct?

For HTTPS web distributions, you cannot forward cookies to your origin.

For both HTTP and HTTPS web distributions, you can choose to forward cookies to your origin.

For HTTP web distributions, you cannot forward cookies to your origin.

For Real Time Messaging Protocol (RTMP) distributions, you can configure CloudFront to process cookies.

Show Answer Comment (0)

Question 299

You have multiple Amazon Elastic Compute Cloud (EC2) instances running a web server in a VPC configured with security groups and NACL. You need to ensure layer 7 protocol level logging of all network traffic (ACCEPT/REJECT) on the instances. What should be enabled to complete this task?

CloudWatch Logs at the VPC level

Packet sniffing at the instance level

VPC flow logs at the subnet level

Packet sniffing at the VPC level

Show Answer Comment (0)

Question 300

A company's network engineering team is solely responsible for deploying VPC infrastructure using AWS CloudFormation.

The company wants to give its developers the ability to launch applications using CloudFormation templates so that subnets can be created using available CIDR ranges. What should be done to meet these requirements?

Create a CloudFormation template with Amazon EC2 resources that rely on cfn-init and cfn-signals to inform the stack of available CIDR ranges.

Create a CloudFormation template with a custom resource that analyzes traffic activity in VPC Flow Logs and reports on available CIDR ranges.

Create a CloudFormation template that references the Fn::Cidr intrinsic function within a subnet resource to select an available CIDR range.

Create a CloudFormation template with a custom resource that uses AWS Lambda and Amazon DynamoDB to manage available CIDR ranges.

Show Answer Comment (0)

Total 414 questions

28 29 30 31 32

Go to page: of 42