ExamGecko
Login
Home / Amazon / ANS-C00 / List of questions
Ask Question

Amazon ANS-C00 Practice Test - Questions Answers, Page 23

List of questions

Question 221

Report
Export
Collapse

A company's web application is deployed on Amazon EC2 instances behind a public Application Load Balancer. The application flags malicious requests and uses an AWS Lambda function to add the offending IP addresses to the network ACL to block any further requests for 24 hours. Recently, the application has been receiving more malicious requests, which causes the network ACL to reach its limit of allowed entries.

Which action should be taken to block more IP addresses, without compromising the existing security requirements?

Update the AWS Lambda function to remove blocked entries from the network ACL after 2 hours.
Update the AWS Lambda function to remove blocked entries from the network ACL after 2 hours.
Update the AWS Lambda function to block malicious IPs in security groups rather than the network ACL.
Update the AWS Lambda function to block malicious IPs in security groups rather than the network ACL.
Update the AWS Lambda function to block malicious IPs in AWS WAF attached to the Application Load Balancer.
Update the AWS Lambda function to block malicious IPs in AWS WAF attached to the Application Load Balancer.
Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached.
Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached.
Suggested answer: D
asked 16/09/2024
Martinho Hinterholz
34 questions

Question 222

Report
Export
Collapse

A company has a hybrid IT architecture with two AWS Direct Connect connections to provide high availability. The services hosted on-premises are accessible using public IPs, and are also on the 172.16.0.0/16 range. The AWS resources are on the 192.168.0.0/18 range. The company wants to use Amazon Elastic Load Balancing for SSL offloading, health checks, and sticky sessions. What should be done to meet these requirements?

Create a Network Load Balancer pointing to the on-premises server's private IP address.
Create a Network Load Balancer pointing to the on-premises server's private IP address.
Create an Amazon CloudFront distribution for the on-premises service and use the public IPs of the on-premises servers as the origin.
Create an Amazon CloudFront distribution for the on-premises service and use the public IPs of the on-premises servers as the origin.
Create a Network Load Balancer pointing to the on-premises server's public IP address.
Create a Network Load Balancer pointing to the on-premises server's public IP address.
Create an Application Load Balancer pointing to the on-premises server's private IP address.
Create an Application Load Balancer pointing to the on-premises server's private IP address.
Suggested answer: A
asked 16/09/2024
Andrew dela Cruz
35 questions

Question 223

Report
Export
Collapse

Your organization needs to resolve DNS entries stored in an Amazon Route 53 private zone "awscloud:internal" from the corporate network. An AWS Direct Connect connection with a private virtual interface is configured to provide access to a VPC with the CIDR block 192.168.0.0/16. A DNS Resolver (BIND) is configured on an Amazon Elastic Compute Cloud (EC2) instance with the IP address 192.168.10.5 within the VPC. The DNS Resolver has standard root server hints configured and conditional forwarding for "awscloud.internal" to the IP address 192.168.0.2.

From your PC on the corporate network, you query the DNS server at 192.168.10.5 for www.amazon.com. The query is successful and returns the appropriate response. When you query for "server.awscloud.internal", the query times out. You receive no response.

How should you enable successful queries for "server.awscloud.internal"?

Attach an internet gateway to the VPC and create a default route.
Attach an internet gateway to the VPC and create a default route.
Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True
Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True
Relocate the BIND DNS Resolver to the corporate network.
Relocate the BIND DNS Resolver to the corporate network.
Update the security group for the EC2 instance at 192.168.10.5 to allow UDP Port 53 outbound.
Update the security group for the EC2 instance at 192.168.10.5 to allow UDP Port 53 outbound.
Suggested answer: B
asked 16/09/2024
Olaf Messerschmidt
31 questions

Question 224

Report
Export
Collapse

A company has an AWS Direct Connect connection between its on-premises data center and Amazon VPC. An application running on an Amazon EC2 instance in the VPC needs to access confidential data stored in the on-premises data center with consistent performance. For compliance purposes, data encryption is required. What should the network engineer do to meet these requirements?

Configure a public virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
Configure a public virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
Configure a private virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
Configure a private virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
Configure an internet gateway in the VPSet up a software VPN between the customer gateway and an EC2 instance in the VPC.
Configure an internet gateway in the VPSet up a software VPN between the customer gateway and an EC2 instance in the VPC.
Configure an internet gateway in the VPC. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
Configure an internet gateway in the VPC. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
Suggested answer: A
asked 16/09/2024
Willians Lima Pereira
45 questions

Question 225

Report
Export
Collapse

Which service would you use to see the DSCP value in a packet header?

CloudTrail
CloudTrail
Config
Config
Flow Logs
Flow Logs
None of the above
None of the above
Suggested answer: D

Explanation:

Explanation:

To perform deep packet inspection, you would need a specialized tool such as Wireshark.

asked 16/09/2024
Hayat Hassan
44 questions

Question 226

Report
Export
Collapse

A company deployed its production Amazon VPC using CIDR block 33.16.0.0/16. The company has nearly depleted its addresses and now needs to extend the VPC network.

Which CIDR blocks meet the company's requirement to extend the VPC network with a secondary CIDR? (Choose two.)

33.17.0.0/16
33.17.0.0/16
172.16.0.0/18
172.16.0.0/18
100.70.0.0/17
100.70.0.0/17
192.168.1.0/24
192.168.1.0/24
10.0.0.0/8
10.0.0.0/8
Suggested answer: A, C
asked 16/09/2024
Jesse Moisio
43 questions

Question 227

Report
Export
Collapse

What is the IPv6 subnet CIDR used by a VPC?

/128
/128
/56
/56
/48
/48
/16
/16
Suggested answer: B

Explanation:

Explanation:

A VPC will always use /56 as its CIDR

asked 16/09/2024
chalapathy naidu
39 questions

Question 228

Report
Export
Collapse

You have a three-tier web application with separate subnets for Web, Applications, and Database tiers. Your CISO suspects your application will be the target of malicious activity. You are tasked with notifying the security team in the event your application is port scanned by external systems.

Which two AWS Services cloud you leverage to build an automated notification system? (Choose two.)

Internet gateway
Internet gateway
VPC Flow Logs
VPC Flow Logs
AWS CloudTrail
AWS CloudTrail
Lambda
Lambda
AWS Inspector
AWS Inspector
Suggested answer: C, D

Explanation:

Explanation:

References: https://aws.amazon.com/blogs/security/how-to-receive-alerts-when-specific-apis-are-called-by-using-awscloudtrail-amazon-sns-and-aws-lambda/

asked 16/09/2024
L Zsolt
38 questions

Question 229

Report
Export
Collapse

You need to set up an Amazon Elastic Compute Cloud (EC2) instance for an application that requires the lowest latency and the highest packet-per-second network performance. The application will talk to other servers in a peered VPC.

Which two of the following components should be part of the design? (Choose two.)

Select an instance with support for single root I/O virtualization.
Select an instance with support for single root I/O virtualization.
Select an instance that has support for multiple ENAs.
Select an instance that has support for multiple ENAs.
Ensure that the instance supports jumbo frames and set 9001 MTU.
Ensure that the instance supports jumbo frames and set 9001 MTU.
Select an instance with Amazon Elastic Block Store (EBS)-optimization.
Select an instance with Amazon Elastic Block Store (EBS)-optimization.
Ensure that proper OS drivers are installed.
Ensure that proper OS drivers are installed.
Suggested answer: A, B

Explanation:

Explanation:

References: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking.html

asked 16/09/2024
Yan Wei
35 questions

Question 230

Report
Export
Collapse

What is the DNS server address for a VPC (10.111.0.0/16) with a subnet of 10.111.4.0/24?

10.111.0.2
10.111.0.2
10.111.4.2
10.111.4.2
10.111.1.2
10.111.1.2
10.111.4.1
10.111.4.1
Suggested answer: A

Explanation:

Explanation:

The DNS server is the base VPC CIDR + 2.

asked 16/09/2024
Adriano Costa
36 questions
Total 414 questions
Go to page: of 42
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

You have two VPCs that you've peered. You created a route for VPC A to get to an instance in VPC. You are unable to ping the instance. You have double checked your security groups and NACLs. Why might this be?
In Amazon CloudFront, to link to your objects, if your domain name is d111111abcdef8.cloudfront.net and your object is image.jpg, then the URL for the link in your webpage will be _____.
Which of these modes is not a configuration mode for a WAF?
Your organization runs a popular e-commerce application deployed on AWS that uses auto scaling in conjunction with an Elastic Load balancing (ELB) service with an HTTPS listener. Your security team reports that an exploitable vulnerability has been discovered in the encryption protocol and cipher that your site uses. Which step should you take to fix this problem?
You are configuring multiple Direct Connect links for your organization and need them to be in an HA Active/Passive configuration with extreme sensitivity to outages in order to encourage very quick failover times. You also need to be able to control which link is active. What two configuration changes should you implement? (Choose two.)
You have deployed a website that utilizes CloudFront, Elastic Loadbalancer, and S3 to serve content. When users access your site, they receive a "mixed content" security warning. What is most likely the problem?
Which service would you use to see who changed your infrastructure?
A company is building a hybrid PCI-DSS compliant application that runs in the us-west-2 Region and on-premises. The application sends access logs from all locations to a single Amazon S3 bucket in uswest-2. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses. How should an engineer configure the network to meet these requirements?
An organization has multiple applications running in VPCs across multiple AWS accounts. The network engineer has deployed a central VPC with a pair of software VPN instances that run IPSec tunnels with dynamic routing to VGWs of all application VPCs. This central VPC is connected to on-premises resources via a Direct Connect connection using a private VIF. What additional configuration is required to enable the applications in VPCs to communicate with each other and access onpremises resources?
Under increased cybersecurity concerns, a company is deploying a near real-time intrusion detection system (IDS) solution. A system must be put in place as soon as possible. The architecture consists of many AWS accounts, and all results must be delivered to a central location. Which solution will meet this requirement, while minimizing downtime and costs?