Home / Amazon / ANS-C00

Amazon ANS-C00 Practice Test - Questions Answers, Page 34

Question list

List of questions

Question 331

(0)

A network engineer needs to create a public virtual interface on the company's AWS Direct Connect connection and only import routes which originated from the same region as the Direct Connect locati

Question 332

(0)

Your company is working on a transition from IPv4 to IPv6 but is concerned about the security of having public IPv6 addresses attached to instances in a public network. They currently use a NAT to a

Question 333

(0)

A Network Engineer has enabled VPC Flow Logs to troubleshoot an ICMP reachability issue for an echo reply from an Amazon EC2 instance. The flow logs reveal an ACCEPT record for the request from the

Question 334

(0)

DNS name resolution must be provided for services in the following four zones: company.private. emea.company.private. apac.company.private. amer.company.private. The contents of these zones is not

Question 335

(0)

A publishing company recently merged with an ecommerce company. Each company uses a VPC to run compute resources. The two VPCs have overlapping CIDR ranges. The publishing company needs to access a

Question 336

(0)

Your company has two DX locations. You need to configure one link as passive. What should you configure in your router to set that link as the passive link.

Question 337

(0)

You have a website hosted on EC2 that is not serving web pages. You have ensured that the server is running and the site is configured properly. What could be the problem?

Question 338

(0)

A Network Engineer is troubleshooting a network connectivity issue for an instance within a public subnet that cannot connect to the internet. The first step the Engineer takes is to SSH to the inst

Question 339

(0)

An AWS CloudFormation template is being used to create a VPC peering connection between two existing operational VPCs, each belonging to a different AWS account. All necessary components in the Remo

Question 340

(0)

A company has applications running in a single AWS Region and its on-premises data center in a hybrid mode. The company has a 1 Gbps AWS Direct Connect connection from the data center to AWS that is

Related questions

You have deployed a website that utilizes CloudFront, Elastic Loadbalancer, and S3 to serve content. When users access your site, they receive a "mixed content" security warning. What is most likely the problem?

An organization has multiple applications running in VPCs across multiple AWS accounts. The network engineer has deployed a central VPC with a pair of software VPN instances that run IPSec tunnels with dynamic routing to VGWs of all application VPCs. This central VPC is connected to on-premises resources via a Direct Connect connection using a private VIF. What additional configuration is required to enable the applications in VPCs to communicate with each other and access onpremises resources?

A company is building a hybrid PCI-DSS compliant application that runs in the us-west-2 Region and on-premises. The application sends access logs from all locations to a single Amazon S3 bucket in uswest-2. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses. How should an engineer configure the network to meet these requirements?

You have two VPCs that you've peered. You created a route for VPC A to get to an instance in VPC. You are unable to ping the instance. You have double checked your security groups and NACLs. Why might this be?

You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URLs, the instances should be able to access any Amazon S3 bucket in the same region via any URL. Which of the following solutions should you deploy? (Choose two.)

In Amazon CloudFront, to link to your objects, if your domain name is d111111abcdef8.cloudfront.net and your object is image.jpg, then the URL for the link in your webpage will be _____.

Your website is under attack and a malicious party is stealing large amounts of data. You have default NACL rules. Stopping the attack is the ONLY priority in this case. Which two commands should you use? (Choose two.)

Which element of AWS Config can be used to help maintain internal and external compliance controls?

A bank built a new version of its banking application in AWS using containers that connect to an on-premises database over a VPN connection. This application version requires users to also update their client application. The bank plans to deprecate the earlier client version. However, the company wants to keep supporting earlier clients through their onpremises version of the application to serve a small portion of the customers who haven't yet upgraded. What design will allow the company to serve both newer and earlier clients in the MOST efficient way?

A company is deploying a critical application on two Amazon EC2 instances in a VPC. Failed client connections to the EC2 instances must be logged according to company policy. What is the MOST cost-effective solution to meet these requirements?

Question 331

A network engineer needs to create a public virtual interface on the company's AWS Direct Connect connection and only import routes which originated from the same region as the Direct Connect location. What action should accomplish this?

Configure a prefix list on the customer router containing the AWS IP address ranges for the specific Region.

Configure a filter on the company's router to only import routes with the 7224:8100 BGP community tag.

Configure a filter on the company's router to only import routes without a BGP community tag and a maximum path length of 3.

Configure a filter in the AWS console and only allow routes advertised by AWS without a BGP community tag and a maximum path length of 3.

Show Answer Comment (0)

Question 332

Your company is working on a transition from IPv4 to IPv6 but is concerned about the security of having public IPv6 addresses attached to instances in a public network. They currently use a NAT to allow outbound traffic for instances.

Outbound traffic is required for updates. What are two options to alleviate your company's concerns? (Choose two.)

Remove any rules allowing ::/0 inbound in the security group.

Block ::/0 inbound in the NACL.

Create an egress-only internet gateway.

Block 0.0.0.0/0 inbound in the NACL.

Show Answer Comment (0)

Question 333

A Network Engineer has enabled VPC Flow Logs to troubleshoot an ICMP reachability issue for an echo reply from an Amazon EC2 instance. The flow logs reveal an ACCEPT record for the request from the client to the EC2 instance, and a REJECT record for the response from the EC2 instance to the client. What is the MOST likely reason for there to be a REJECT record?

The security group is denying inbound ICMP.

The network ACL is denying inbound ICMP.

The security group is denying outbound ICMP.

The network ACL is denying outbound ICMP.

Show Answer Comment (0)

Question 334

DNS name resolution must be provided for services in the following four zones: company.private. emea.company.private. apac.company.private. amer.company.private.

The contents of these zones is not considered sensitive, however, the zones only need to be used by services hosted in these VPCs, one per geographic region. Each VPC should resolve the names in all zones. How can you use Amazon route 53 to meet these requirements?

Create a Route 53 Private Hosted Zone for each of the four zones and associate them with the three VPCs.

Create a single Route 53 Private Hosted Zone for the zone company.private. and associate it with the three VPCs.

Create a Route Public 53 Hosted Zone for each of the four zones and configure the VPC DNS Resolver to forward

Create a single Route 53 Public Hosted Zone for the zone company.private. and configure the VPC DNS Resolver to forward

Show Answer Comment (0)

Question 335

A publishing company recently merged with an ecommerce company. Each company uses a VPC to run compute resources.

The two VPCs have overlapping CIDR ranges. The publishing company needs to access an internal application that runs on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones in the ecommerce company VPC.

Which set of actions will provide the needed interconnectivity between the VPCs?

1. Create a Network Load Balancer (NLB) for the application in the ecommerce company VP

Configure the NLB for the Availability Zones that the target instances use.

Create a VPC endpoint service configuration, and specify the NLB. Add the publishing company's AWS account as a principal to the allow list.

Create interface endpoint connections to the service in the publishing company VPC in the same Availability Zones as the NLB.

1. Create a VPC peering connection between the ecommerce company VPC and the publishing company VPC.

Update the route tables in both VPCs with routes to the attached VPC.

Update security groups to allow traffic from the publishing company VPC to the application in the ecommerce company VPC.

1. Create an Application Load Balancer (ALB) for the application in the ecommerce company VPConfigure the ALB for all Availability Zones.

Create a VPC endpoint service configuration, and specify the ALB. Add the publishing company's AWS account as a principal to the allow list.

Create an interface endpoint connection from the publishing company VPC to the service.

1. Create a VPC peering connection between the ecommerce company VPC and the publishing company VPC.

Update the route tables in both VPCs with routes to the attached VPC.

Update the network ACLs to allow traffic between subnets in the publishing company VPC and subnets in the ecommerce company VPC.

Show Answer Comment (0)

Question 336

Your company has two DX locations. You need to configure one link as passive. What should you configure in your router to set that link as the passive link.

Set a higher MED.

Configure AS_PATH Prepending on the link.

Advertise a network with a higher CIDR.

Call your service provider and have the ASN changed for that link.

Show Answer Comment (0)

Question 337

You have a website hosted on EC2 that is not serving web pages. You have ensured that the server is running and the site is configured properly. What could be the problem?

Your NACL does not allow port 80 outbound.

Your NACL does not allow ports 1024 - 65535 outbound.

Your NACL does not allow ports 1024 - 65535 inbound.

Your security group does not allow outbound traffic.

Show Answer Comment (0)

Question 338

A Network Engineer is troubleshooting a network connectivity issue for an instance within a public subnet that cannot connect to the internet. The first step the Engineer takes is to SSH to the instance via a local bastion within the VPC and runs an ifconfig command to inspect the IP addresses configured on the instance. The output is as follows:

The Engineer notices that the command output does not contain a public IP address. In the AWS Management Console, the public subnet has a route to the internet gateway. The instance also has a public IP address associated with it.

What should the Engineer do next to troubleshoot this situation?

Configure the public IP on the interface.

Disable source/destination checking for the instance.

Associate an Elastic IP address to the interface.

Evaluate the security groups and the network access control list.

Show Answer Comment (0)

Question 339

An AWS CloudFormation template is being used to create a VPC peering connection between two existing operational VPCs, each belonging to a different AWS account. All necessary components in the Remote (receiving) account are already in place.

The template below creates the VPC peering connection in the Originating account. It contains these components:

Which additional AWS CloudFormation components are necessary in the Originating account to create an operational crossaccount VPC peering connection with AWS CloudFormation? (Choose two.)

Option A

Option B

Option C

Option D

Option E

Show Answer Comment (0)

Question 340

A company has applications running in a single AWS Region and its on-premises data center in a hybrid mode. The company has a 1 Gbps AWS Direct Connect connection from the data center to AWS that is 65% utilized. The company has an AWS Enterprise Support plan.

The company is planning to deploy a new critical application on AWS that will connect with existing applications running in the data center. The application SLA requires a minimum of 99.9% network uptime between the data center and

AWS.

What is the MOST cost-effective way to meet this SLA requirement?

Create a second virtual interface (VIF) on the existing Direct Connect connection, and terminate this VIF in the existing VP

Use BGP for load balancing between the VIFs in active/active mode.

Purchase an additional 1 Gbps Direct Connect connection from AWS in a different cross-connect location terminated in the associated Region. Provision a new virtual interface (VIF) to the existing VPC, and use BGP for load balancing.

Set up two new hosted Direct Connect connections of 500 Mbps each through an AWS Direct Connect partner. Provision two virtual interfaces (VIFs) to the existing VPC on both Direct Connect connections, and use BGP for load balancing.Terminate the existing 1 Gbps Direct Connect connection.

Purchase an additional 1 Gbps Direct Connect connection from AWS in the existing cross-connect location. Ask AWS to terminate this new connection in a different router. Provision two virtual interfaces (VIFs) to the same VPC on both Direct Connect connections, and use BGP for load balancing.

Show Answer Comment (0)

Total 414 questions

32 33 34 35 36

Go to page: of 42