Home / Amazon / ANS-C00

Amazon ANS-C00 Practice Test - Questions Answers, Page 37

Question list

List of questions

Question 361

(0)

A company's application runs in a VPC and stores sensitive data in Amazon S3. The application's Amazon EC2 instances are located in a private subnet with a NAT gateway deployed in a public subnet to

Question 362

(0)

A company runs a web application on an Amazon EC2 instance. The application experiences performance issues for a short period at the same time every day. To diagnose the issue, the application vendo

Question 363

(0)

Your company has just deployed IPv6 in a VPC. All of the instances currently use a NAT, but once they configured the instances for IPv6 only, they were unable to access the resources on the instance

Question 364

(0)

The IPsec protocol suite is made up of various components covering aspects such as confidentiality, encryption, and integrity. Select the correct statement below regarding the correct configuration

Question 365

(0)

In AWS, which tool records API calls for a specific AWS account and also delivers the log files for that account?

Question 366

(0)

A company uses AWS Direct Connect to connect its corporate network to multiple VPCs in the same AWS account and the same AWS Region. Each VPC uses its own private VIF and its own virtual LAN on the

Question 367

(0)

A customer has set up multiple VPCs for Dev, Test, Prod, and Management. You need to set up AWS Direct Connect to enable data flow from on-premises to each VPC. The customer has monitoring software

Question 368

(0)

A network engineer is managing two AWS Direct Connect connections. Each connection has a public virtual interface configured with a private ASN. The engineer wants to configure active/passive routin

Question 369

(0)

A network engineer is deploying an application on an Amazon EC2 instance. The instance is reachable within the VPC through its private IP address and from the internet using an elastic IP address.

Question 370

(0)

Select the VPC Peering statement below that is NOT true

Related questions

You have deployed a website that utilizes CloudFront, Elastic Loadbalancer, and S3 to serve content. When users access your site, they receive a "mixed content" security warning. What is most likely the problem?

An organization has multiple applications running in VPCs across multiple AWS accounts. The network engineer has deployed a central VPC with a pair of software VPN instances that run IPSec tunnels with dynamic routing to VGWs of all application VPCs. This central VPC is connected to on-premises resources via a Direct Connect connection using a private VIF. What additional configuration is required to enable the applications in VPCs to communicate with each other and access onpremises resources?

A company is building a hybrid PCI-DSS compliant application that runs in the us-west-2 Region and on-premises. The application sends access logs from all locations to a single Amazon S3 bucket in uswest-2. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses. How should an engineer configure the network to meet these requirements?

You have two VPCs that you've peered. You created a route for VPC A to get to an instance in VPC. You are unable to ping the instance. You have double checked your security groups and NACLs. Why might this be?

You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URLs, the instances should be able to access any Amazon S3 bucket in the same region via any URL. Which of the following solutions should you deploy? (Choose two.)

In Amazon CloudFront, to link to your objects, if your domain name is d111111abcdef8.cloudfront.net and your object is image.jpg, then the URL for the link in your webpage will be _____.

Your website is under attack and a malicious party is stealing large amounts of data. You have default NACL rules. Stopping the attack is the ONLY priority in this case. Which two commands should you use? (Choose two.)

Which element of AWS Config can be used to help maintain internal and external compliance controls?

A bank built a new version of its banking application in AWS using containers that connect to an on-premises database over a VPN connection. This application version requires users to also update their client application. The bank plans to deprecate the earlier client version. However, the company wants to keep supporting earlier clients through their onpremises version of the application to serve a small portion of the customers who haven't yet upgraded. What design will allow the company to serve both newer and earlier clients in the MOST efficient way?

A company is deploying a critical application on two Amazon EC2 instances in a VPC. Failed client connections to the EC2 instances must be logged according to company policy. What is the MOST cost-effective solution to meet these requirements?

Question 361

A company's application runs in a VPC and stores sensitive data in Amazon S3. The application's Amazon EC2 instances are located in a private subnet with a NAT gateway deployed in a public subnet to provide access to Amazon S3. The S3 bucket is located in the same AWS Region as the EC2 instances. The company wants to ensure that this bucket can be accessed only from the VPC where the application resides. Which changes should a network engineer make to the architecture to meet these requirements?

Delete the existing S3 bucket and create a new S3 bucket inside the VPC in the private subnet. Configure the S3 security group to allow only the application instances to access the bucket.

Deploy an S3 VPC endpoint in the VPC where the application resides. Configure an S3 bucket policy with a condition to allow access only from the VPC endpoint.

Configure an S3 bucket policy, and use an IP address condition to restrict access to the bucket. Allow access only from the VPC CIDR range, and deny all other IP address ranges.

Create a new IAM role for the EC2 instances that provides access to the S3 bucket, and assign the role to the application instances. Configure an S3 bucket policy to allow access only from the role.

Show Answer Comment (0)

Question 362

A company runs a web application on an Amazon EC2 instance. The application experiences performance issues for a short period at the same time every day. To diagnose the issue, the application vendor needs a packet capture of the web application network interface. The company's network administrator does not have SSH access to the instance. Which solution will meet these requirements?

Use Traffic Mirroring. Create a new EC2 instance, and use its network interface as the traffic mirror target. Add a rule to the new instance's security group to allow UDP port 4789 inbound traffic.

Use Traffic Mirroring. Enable enhanced networking support on the elastic network interface. Stream the packet capture to an Amazon Kinesis data stream.

Use VPC Flow Logs. Enable enhanced networking support on the elastic network interface. Stream packets to Amazon CloudWatch Logs.

Use VPC Flow Logs. Disable source/destination checks on the instance. Stream packets to Amazon CloudWatch Logs.

Show Answer Comment (0)

Question 363

Your company has just deployed IPv6 in a VPC. All of the instances currently use a NAT, but once they configured the instances for IPv6 only, they were unable to access the resources on the instances via IPv6. What is the best option to fix this?

Configure the NAT for IPv6.

Configure an egress-only internet gateway.

Add a route for ::/0 to the NAT.

Add an internet gateway.

Show Answer Comment (0)

Question 364

The IPsec protocol suite is made up of various components covering aspects such as confidentiality, encryption, and integrity. Select the correct statement below regarding the correct configuration options for ensure IPsec confidentiality:

The following protocols may be used to configure IPsec confidentiality, DES, 3DES, MD5

The following protocols may be used to configure IPsec confidentiality, DES, 3DES, AES

The following protocols may be used to configure IPsec confidentiality, PSK, RSA

The following protocols may be used to configure IPsec confidentiality, PSK, MD5

The following protocols may be used to configure IPsec confidentiality, PSK, RSA

Show Answer Comment (0)

Question 365

In AWS, which tool records API calls for a specific AWS account and also delivers the log files for that account?

CloudTrail

Redshift

Beanstalk

Cognito

Show Answer Comment (0)

Question 366

A company uses AWS Direct Connect to connect its corporate network to multiple VPCs in the same AWS account and the same AWS Region. Each VPC uses its own private VIF and its own virtual LAN on the Direct Connect connection. The company has grown and will soon surpass the limit of VPCs and private VIFs for each connection. What is the MOST scalable way to add VPCs with on-premises connectivity?

Provision a new Direct Connect connection to handle the additional VPCs. Use the new connection to connect additional VPCs.

Create virtual private gateways for each VPC that is over the service quota. Use AWS Site-to-Site VPN to connect the virtual private gateways to the corporate network.

Create a Direct Connect gateway, and add virtual private gateway associations to the VPCs. Configure a private VIF to connect to the corporate network.

Create a transit gateway, and attach the VPCs. Create a Direct Connect gateway, and associate it with the transit gateway. Create a transit VIF to the Direct Connect gateway.

Show Answer Comment (0)

Question 367

A customer has set up multiple VPCs for Dev, Test, Prod, and Management. You need to set up AWS Direct Connect to enable data flow from on-premises to each VPC. The customer has monitoring software running in the Management VPC that collects metrics from the instances in all the other VPCs. Due to budget requirements, data transfer charges should be kept at minimum. Which design should be recommended?

Create a total of four private VIFs, one for each VPC owned by the customer, and route traffic between VPCs using the Direct Connect link.

Create a private VIF to the Management VPC, and peer this VPC to all other VPCs.

Create a private VIF to the Management VPC, and peer this VPC to all other VPCs; enable source/destination NAT in the Management VPC.

Create a total of four private VIFs, and enable VPC peering between all VPCs.

Show Answer Comment (0)

Question 368

A network engineer is managing two AWS Direct Connect connections. Each connection has a public virtual interface configured with a private ASN. The engineer wants to configure active/passive routing between the Direct Connect connections to access Amazon public endpoints. What BGP configuration is required for the on-premises equipment?

(Choose two.)

Use Local Pref to control outbound traffic.

Use AS Prepending to control inbound traffic.

Use eBGP multi-hop between loopback interfaces.

Use BGP Communities to control outbound traffic.

Advertise more specific prefixes over one Direct Connect connection.

Show Answer Comment (0)

Question 369

A network engineer is deploying an application on an Amazon EC2 instance. The instance is reachable within the VPC through its private IP address and from the internet using an elastic IP address.

Clients are connecting to the instance over the Internet and within the VPC, and the application needs to be identified by a single custom Fully Qualified Domain Name that is publicly resolvable -'app.example.com'. Instances within the VPC should always connect to the private IP to minimize data transfer costs. How should the engineer configure DNS to support these requirements?

Use Amazon Route 53 to create a geo-based routing entry for the hostname 'app' in the DNS zone 'example.com'.

Create two A record entries for 'app' in the DNS zone 'example.com' - one for the public IP and one for the private IP.

Use Route 53 to create an ALIAS record to the public DNS name for the instance.

Create a CNAME for 'app' in the DNS zone 'example.com' to the public DNS name for the Amazon EC2 instance.

Show Answer Comment (0)

Question 370

Select the VPC Peering statement below that is NOT true

VPC peering supports transitive peering relationships for IPv6 traffic but not IPv4

VPC peering can be performed between VPCs in different AWS accounts in the same region

TCP connections can be performed between peered VPCs

UDP connections can be performed between peered VPCs

Show Answer Comment (0)

Total 414 questions

35 36 37 38 39

Go to page: of 42