Question 1

What two items are required for all AWS VPNs? (Choose two.)

Accepted Answer

A)  Virtual Private Gateway 
B)  ASN 
C)  A hardware router 
D)  Customer Gateway 
A)  Virtual Private Gateway 
B)  ASN 
C)  A hardware router 
D)  Customer Gateway

Question 2

A company has a VPC in the us-west-1 Region and another VPC in the ap-southeast-2 Region. Network engineers set up an AWS Direct Connect connection from their data center to the us-east-1 Region. They create a private virtual interface (VIF) that references a Direct Connect gateway, which is then connected to virtual private gateways in both VPCs. When the setup is complete, the engineers cannot access resources in us-west-1 from ap-southeast-2. What should the network engineers do to resolve this issue?

Accepted Answer

A)  Add the subnet range for the VPCs in us-west-1 and ap-southeast-2 to the route tables for both VPCs. Add the Direct Connect gateway as a target. 
B)  Configure the Direct Connect gateway to route traffic between the VPCs in ap-southeast-2 and us-west-2. 
C)  Establish a VPC peering connection between the VPCs in ap-southeast-2 and us-west-2. Add the subnet ranges to the routing tables. 
D)  Create static routes in each VPC that point to the destination VPC with the virtual private gateway as the route target. 
A)  Add the subnet range for the VPCs in us-west-1 and ap-southeast-2 to the route tables for both VPCs. Add the Direct Connect gateway as a target. 
B)  Configure the Direct Connect gateway to route traffic between the VPCs in ap-southeast-2 and us-west-2. 
C)  Establish a VPC peering connection between the VPCs in ap-southeast-2 and us-west-2. Add the subnet ranges to the routing tables. 
D)  Create static routes in each VPC that point to the destination VPC with the virtual private gateway as the route target.

Question 3

A company provisions an AWS Direct Connect connection to permit access to Amazon EC2 resources in several Amazon VPCs and to data stored in private Amazon S3 buckets. The Network Engineer needs to configure the company's on-premises router for this Direct Connect connection. Which of the following actions will require the LEAST amount of configuration overhead on the customer router?

Accepted Answer

A)  Configure private virtual interfaces for the VPC resources and for Amazon S3. 
B)  Configure private virtual interfaces for the VPC resources and a public virtual interface for Amazon S3. 
C)  Configure a private virtual interface to a Direct Connect gateway for the VPC resources and for Amazon S3. 
D)  Configure a private virtual interface to a Direct Connect gateway for the VPC resources and a public virtual interface for Amazon S3. 
A)  Configure private virtual interfaces for the VPC resources and for Amazon S3. 
B)  Configure private virtual interfaces for the VPC resources and a public virtual interface for Amazon S3. 
C)  Configure a private virtual interface to a Direct Connect gateway for the VPC resources and for Amazon S3. 
D)  Configure a private virtual interface to a Direct Connect gateway for the VPC resources and a public virtual interface for Amazon S3.

Question 4

You manage a webserver that serves a webpage on AWS infrastructure. You utilize an Application Load Balancer, CloudFront, S3, and some other AWS services for this site. You are only responsible for the server and you don't have access to the AWS console or API. You need to find out what IPs are accessing your website. What is the best way to achieve this?

Accepted Answer

A)  Ask someone with IAM permissions to view the Flow Logs to give you access. 
B)  View the access logs. They already show this information. 
C)  Run "curl http://169.254.169.254/latest/meta-data/access_log 
D)  Add "X-Forwarded For" to the access logs and view the access logs. 
A)  Ask someone with IAM permissions to view the Flow Logs to give you access. 
B)  View the access logs. They already show this information. 
C)  Run "curl http://169.254.169.254/latest/meta-data/access_log 
D)  Add "X-Forwarded For" to the access logs and view the access logs.

Question 5

Your company is expanding its cloud infrastructure and moving many of its flat files and static assets to S3. You currently use a VPN to access your compute infrastructure, but you require more reliability for your static files as you are offloading all of your important data to AWS. What is your best course of action while keeping costs low?

Accepted Answer

A)  Create a Direct Connect connection using a Private VIF to access both compute and S3 resources. 
B)  Create an S3 endpoint and create a route to the endpoint prefix list for your VPN to allow access to your S3 resources. 
C)  Create two Direct Connect connections. Each connected to a Private VIF to ensure maximum resiliency. 
D)  Create a Direct Connect connection using a Public VIF and route your VPN over the DX connection to your VPN endpoint. 
A)  Create a Direct Connect connection using a Private VIF to access both compute and S3 resources. 
B)  Create an S3 endpoint and create a route to the endpoint prefix list for your VPN to allow access to your S3 resources. 
C)  Create two Direct Connect connections. Each connected to a Private VIF to ensure maximum resiliency. 
D)  Create a Direct Connect connection using a Public VIF and route your VPN over the DX connection to your VPN endpoint.

Question 6

Which of the following statements is true of AWS Elastic Beanstalk?

Accepted Answer

A)  AWS Elastic Beanstalk uses CloudWatch for monitoring and alarms, meaning CloudWatch costs are applied to your AWS account for any alarms that you use. 
B)  AWS Elastic Beanstalk uses CloudWatch for monitoring and alarms, and both are free of charge. 
C)  AWS Elastic Beanstalk doesn't use CloudWatch for monitoring and alarms, but you pay extra for any AWS Elastic Beanstalk Alarm you set in the monitoring tool. 
D)  AWS Elastic Beanstalk has its own free-of-charge monitoring tool, and you are not charged for the alarm you set. 
A)  AWS Elastic Beanstalk uses CloudWatch for monitoring and alarms, meaning CloudWatch costs are applied to your AWS account for any alarms that you use. 
B)  AWS Elastic Beanstalk uses CloudWatch for monitoring and alarms, and both are free of charge. 
C)  AWS Elastic Beanstalk doesn't use CloudWatch for monitoring and alarms, but you pay extra for any AWS Elastic Beanstalk Alarm you set in the monitoring tool. 
D)  AWS Elastic Beanstalk has its own free-of-charge monitoring tool, and you are not charged for the alarm you set.

Question 7

You currently use a single security group assigned to all nodes in a clustered NoSQL database. Only your cluster members in one region must be able to connect to each other. This security group uses a self-referencing rule using the cluster security group's group-id to make it easier to add or remove nodes from the cluster. You need to make this database comply with out-of-region disaster recovery requirements and ensure that the network traffic between the nodes is encrypted when travelling between regions. How should you enable secure cluster communication while deploying additional cluster members in another AWS region?

Accepted Answer

A)  Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group rules that reference each other's security group-id in each region. 
B)  Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region. 
C)  Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region. 
D)  Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group rules that reference each other's security group-id in each region. 
A)  Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group rules that reference each other's security group-id in each region. 
B)  Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region. 
C)  Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region. 
D)  Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group rules that reference each other's security group-id in each region.

Question 8

A gaming company is running an online multiplayer game in multiple AWS Regions. The company needs traffic from its end users to be routed to the Region that is closest to the end users geographically. When maintenance occurs in a Region, traffic must be routed to the next closest Region with no changes to the IP addresses being used as connections by the end users. Which solution will meet these requirements?

Accepted Answer

A)  Create an Amazon CloudFront distribution in front of all the Regions. 
B)  Use an Amazon Route 53 geoproximity routing policy to navigate traffic to the closest Region. 
C)  Use an Amazon Route 53 geolocation routing policy to navigate traffic to the closest Region. 
D)  Configure AWS Global Accelerator in front of all the Regions. 
A)  Create an Amazon CloudFront distribution in front of all the Regions. 
B)  Use an Amazon Route 53 geoproximity routing policy to navigate traffic to the closest Region. 
C)  Use an Amazon Route 53 geolocation routing policy to navigate traffic to the closest Region. 
D)  Configure AWS Global Accelerator in front of all the Regions.

Question 9

Your company has two DX locations. You need to configure one link as passive. What should you configure in your router to set that link as the passive link.

Accepted Answer

A)  Set a higher MED. 
B)  Configure AS_PATH Prepending on the link. 
C)  Advertise a network with a higher CIDR. 
D)  Call your service provider and have the ASN changed for that link. 
A)  Set a higher MED. 
B)  Configure AS_PATH Prepending on the link. 
C)  Advertise a network with a higher CIDR. 
D)  Call your service provider and have the ASN changed for that link.

Question 10

Your on-premises network has an IP address range of 11.11.0.0/16. Only IPs within this network range can be used for inter-server communication. The IP address range 11.11.253.0/24 has been allocated for the cloud. You need to design a VPC in AWS. The servers within the VPC should be able to communicate with hosts both on the Internet and on-premises through a VPN connection. What combination of configuration steps meets your needs? (Choose two)

Accepted Answer

A)  Set up the VPC with an IP address range of 11.11.253.0/24. 
B)  Set up the VPC with an RFC 1918 private IP address range (e.g., 10.10.10.0/24), and set up a NAT gateway to do translation between 10.10.10.0/24 and 11.11.253.0/24 for all outbound traffic. 
C)  Set up a VPN connection between a VGW and an on-premises router, set the VGW as the default gateway for all traffic, and configure the on-premises router to forward traffic to the Internet. 
D)  Set up a VPN connection between a VGW and an on-premises router, set the VGW as the default gateway for traffic destined to 11.11.0.0/24, and add a VPC subnet route to point the default gateway to an Internet gateway for Internet traffic. 
E)  Set up the VPC with an RFC 1918 private IP address range (e.g., 10.10.10.0/24), and set the VGW to do a source IP translation of all outbound packets to 11.11.0.0/16. 
A)  Set up the VPC with an IP address range of 11.11.253.0/24. 
B)  Set up the VPC with an RFC 1918 private IP address range (e.g., 10.10.10.0/24), and set up a NAT gateway to do translation between 10.10.10.0/24 and 11.11.253.0/24 for all outbound traffic. 
C)  Set up a VPN connection between a VGW and an on-premises router, set the VGW as the default gateway for all traffic, and configure the on-premises router to forward traffic to the Internet. 
D)  Set up a VPN connection between a VGW and an on-premises router, set the VGW as the default gateway for traffic destined to 11.11.0.0/24, and add a VPC subnet route to point the default gateway to an Internet gateway for Internet traffic. 
E)  Set up the VPC with an RFC 1918 private IP address range (e.g., 10.10.10.0/24), and set the VGW to do a source IP translation of all outbound packets to 11.11.0.0/16.

Question 11

A legacy, on-premises web application cannot be load balanced effectively. There are both planned and unplanned events that cause usage spikes to millions of concurrent users. The existing infrastructure cannot handle the usage spikes. The CIO has mandated that the application be moved to the cloud to avoid further disruptions, with the additional requirement that source IP addresses be unaltered to support network traffic-monitoring needs. Which of the following designs will meet these requirements?

Accepted Answer

A)  Use an Auto Scaling group of Amazon EC2 instances behind a Classic Load Balancer. 
B)  Use an Auto Scaling group of EC2 instances in a target group behind an Application Load Balancer. 
C)  Use an Auto Scaling group of EC2 instances in a target group behind a Classic Load Balancer. 
D)  Use an Auto Scaling group of EC2 instances in a target group behind a Network Load Balancer. 
A)  Use an Auto Scaling group of Amazon EC2 instances behind a Classic Load Balancer. 
B)  Use an Auto Scaling group of EC2 instances in a target group behind an Application Load Balancer. 
C)  Use an Auto Scaling group of EC2 instances in a target group behind a Classic Load Balancer. 
D)  Use an Auto Scaling group of EC2 instances in a target group behind a Network Load Balancer.

Question 12

A department in your company has created a new account that is not part of the organization's consolidated billing family. The department has also created a VPC for its workload. Access is restricted by network access control lists to the department's on-premises private IP allocation. An AWS Direct Connect private virtual interface for this VPC advertises a default route to the company network. When the department downloads data from an Amazon EC2 instance in its new VPC, what are the associated charges?

Accepted Answer

A)  The company pays Internet Data Out charges. 
B)  The company pays AWS Direct Connect Data Out charges. 
C)  The department pays Internet Data Out charges. 
D)  The department pays AWS Direct Connect Data Out charges. 
A)  The company pays Internet Data Out charges. 
B)  The company pays AWS Direct Connect Data Out charges. 
C)  The department pays Internet Data Out charges. 
D)  The department pays AWS Direct Connect Data Out charges.

Question 13

Which service would you use to see who changed your infrastructure?

Accepted Answer

A)  Config 
B)  CloudTrail 
C)  Flow Logs 
A)  Config 
B)  CloudTrail 
C)  Flow Logs

Question 14

Which one of the following options is not true about WorkSpaces?

Accepted Answer

A)  WorkSpaces allows integration with Microsoft AD. 
B)  WorkSpaces is great for running Linux applications. 
C)  WorkSpaces is a fully managed, secure desktop computing service. 
D)  WorkSpaces can query on-premises domains for authentication. 
A)  WorkSpaces allows integration with Microsoft AD. 
B)  WorkSpaces is great for running Linux applications. 
C)  WorkSpaces is a fully managed, secure desktop computing service. 
D)  WorkSpaces can query on-premises domains for authentication.

Question 15

A company has an application running on Amazon EC2 instances in a private subnet that connects to a third-party service provider's public HTTP endpoint through a NAT gateway. As request rates increase, new connections are starting to fail. At the same time, the ErrorPortAllocation Amazon CloudWatch metric count for the NAT gateway is increasing. Which of the following actions should improve the connectivity issues? (Choose two.)

Accepted Answer

A)  Allocate additional elastic IP addresses to the NAT gateway. 
B)  Request that the third-party service provider implement HTTP keepalive. 
C)  Implement TCP keepalive on the client instances. 
D)  Create additional NAT gateways and update the private subnet route table to introduce the new NAT gateways. 
E)  Create additional NAT gateways in the public subnet and split client instances into multiple private subnets, each with a route to a different NAT gateway. 
A)  Allocate additional elastic IP addresses to the NAT gateway. 
B)  Request that the third-party service provider implement HTTP keepalive. 
C)  Implement TCP keepalive on the client instances. 
D)  Create additional NAT gateways and update the private subnet route table to introduce the new NAT gateways. 
E)  Create additional NAT gateways in the public subnet and split client instances into multiple private subnets, each with a route to a different NAT gateway.

Question 16

You are a network engineer at a company that just purchased a DX connection. You ensured your equipment met all of the technical requirements, you have verified with your AWS account manager and your colocation provider that everything is connected, and all of your information is correct. For some reason, the link does not operate correctly. What could be the problem?

Accepted Answer

A)  The CAT6 cable is frayed. 
B)  Autonegotiation is enabled. 
C)  You are using 802.1q VLANs instead of 802.1w. 
D)  BFD is disabled. 
A)  The CAT6 cable is frayed. 
B)  Autonegotiation is enabled. 
C)  You are using 802.1q VLANs instead of 802.1w. 
D)  BFD is disabled.

Question 17

A network engineer is managing two AWS Direct Connect connections. Each connection has a public virtual interface configured with a private ASN. The engineer wants to configure active/passive routing between the Direct Connect connections to access Amazon public endpoints. What BGP configuration is required for the on-premises equipment? (Select two.)

Accepted Answer

A)  Use Local Pref to control outbound traffic. 
B)  Use AS Prepending to control inbound traffic. 
C)  Use eBGP multi-hop between loopback interfaces. 
D)  Use BGP Communities to control outbound traffic. 
E)  Advertise more specific prefixes over one Direct Connect connection. 
A)  Use Local Pref to control outbound traffic. 
B)  Use AS Prepending to control inbound traffic. 
C)  Use eBGP multi-hop between loopback interfaces. 
D)  Use BGP Communities to control outbound traffic. 
E)  Advertise more specific prefixes over one Direct Connect connection.

Question 18

Your organization runs a popular e-commerce application deployed on AWS that uses autoscaling in conjunction with an Elastic Load balancing (ELB) service with an HTTPS listener. Your security team reports that an exploitable vulnerability has been discovered in the encryption protocol and cipher that your site uses. Which step should you take to fix this problem?

Accepted Answer

A)  Generate new SSL certificates for all web servers and replace current certificates. 
B)  Change the security policy on the ELB to disable vulnerable protocols and ciphers. 
C)  Generate new SSL certificates and use ELB to front-end the encrypted traffic for all web servers. 
D)  Leverage your current configuration management system to update SSL policy on all web servers. 
A)  Generate new SSL certificates for all web servers and replace current certificates. 
B)  Change the security policy on the ELB to disable vulnerable protocols and ciphers. 
C)  Generate new SSL certificates and use ELB to front-end the encrypted traffic for all web servers. 
D)  Leverage your current configuration management system to update SSL policy on all web servers.

Question 19

Which of the following types of contents cannot serve over HTTP or HTTPS in Amazon CloudFront?

Accepted Answer

A)  Apple HTTP Live Streaming 
B)  Static and dynamic download content 
C)  Adobe Flash multimedia content 
D)  CloudFront RTMP distribution 
A)  Apple HTTP Live Streaming 
B)  Static and dynamic download content 
C)  Adobe Flash multimedia content 
D)  CloudFront RTMP distribution

Question 20

From the following options, select the answer that correctly describes the implementation of the HTTP protocol

Accepted Answer

A)  By definition, HTTP is a connection-less oriented protocol and therefore utilises TCP 
B)  By definition, HTTP is a connection orientated protocol and therefore utilises TCP 
C)  By definition, HTTP is a connection-less oriented protocol and therefore utilises UDP 
D)  By definition, HTTP can be configured to be either connection or connection-less oriented - by specifying the appropriate HTTP header. 
A)  By definition, HTTP is a connection-less oriented protocol and therefore utilises TCP 
B)  By definition, HTTP is a connection orientated protocol and therefore utilises TCP 
C)  By definition, HTTP is a connection-less oriented protocol and therefore utilises UDP 
D)  By definition, HTTP can be configured to be either connection or connection-less oriented - by specifying the appropriate HTTP header.

What two items are required for all AWS VPNs? (Choose two.)

Which of the following statements is true of AWS Elastic Beanstalk?

Your company has two DX locations. You need to configure one link as passive. What should you configure in your router to set that link as the passive link.

Which service would you use to see who changed your infrastructure?

Which one of the following options is not true about WorkSpaces?

Which of the following types of contents cannot serve over HTTP or HTTPS in Amazon CloudFront?

From the following options, select the answer that correctly describes the implementation of the HTTP protocol

AWS Certified Alexa Skill Builder - Specialty

AWS Certified Cloud Practitioner (CLF-C01)

AWS Certified Data Analytics - Specialty (DAS-C01)

AWS Certified Database - Specialty

AWS Certified Developer Associate (DVA-C01)

AWS Certified Machine Learning - Specialty (MLS-C01)

AWS Certified Security - Specialty (SCS-C01)

AWS Certified Solutions Architect - Associate SAA-C02

AWS Certified Solutions Architect - Professional (SAP-C01)

AWS Certified SysOps Administrator - Associate (SOA-C02)

AWS DevOps Engineer - Professional (DOP-C01)

AWS Certified SysOps Administrator (SOA-C01)

Filters

Exam 1: AWS Certified Advanced Networking - Specialty (ANS-C00)

What two items are required for all AWS VPNs? (Choose two.)

Which of the following statements is true of AWS Elastic Beanstalk?

Your company has two DX locations. You need to configure one link as passive. What should you configure in your router to set that link as the passive link.

Which service would you use to see who changed your infrastructure?

Which one of the following options is not true about WorkSpaces?

Which of the following types of contents cannot serve over HTTP or HTTPS in Amazon CloudFront?

From the following options, select the answer that correctly describes the implementation of the HTTP protocol

AWS Certified Alexa Skill Builder - Specialty

AWS Certified Cloud Practitioner (CLF-C01)

AWS Certified Data Analytics - Specialty (DAS-C01)

AWS Certified Database - Specialty

AWS Certified Developer Associate (DVA-C01)

AWS Certified Machine Learning - Specialty (MLS-C01)

AWS Certified Security - Specialty (SCS-C01)

AWS Certified Solutions Architect - Associate SAA-C02

AWS Certified Solutions Architect - Professional (SAP-C01)

AWS Certified SysOps Administrator - Associate (SOA-C02)

AWS DevOps Engineer - Professional (DOP-C01)

AWS Certified SysOps Administrator (SOA-C01)

Filters