Free AWS ANS-C02 Practice Questions & Answers 2026 Part1

Question #1

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #2

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #3

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #4

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #5

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #6

A company is deploying an application. The application is implemented in a series of containers in an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use the Fargate launch type for its tasks. The containers will run workloads that require connectivity initiated over an SSL connection. Traffic must be able to flow to the application from other AWS accounts over private connectivity. The application must scale in a manageable way as more consumers use the application.Which solution will meet these requirements?

A. hoose a Gateway Load Balancer (GLB) as the type of load balancer for the ECS service

B. hoose an Application Load Balancer (ALB) as the type of load balancer for the ECS service

C. hoose an Application Load Balancer (ALB) as the type of load balancer for the ECS service

D. hoose a Network Load Balancer (NLB) as the type of load balancer for the ECS service

View answer

Correct Answer: D

Question #7

A network engineer must develop an AWS CloudFormation template that can create a virtual private gateway, a customer gateway, a VPN connection, and static routes in a route table. During testing of the template, the network engineer notes that the CloudFormation template has encountered an error and is rolling back.What should the network engineer do to resolve the error?

A. Change the order of resource creation in the CloudFormation template

B. Add the DependsOn attribute to the resource declaration for the virtual private gateway

C. Add a wait condition in the template to wait for the creation of the virtual private gateway

D. Add the DependsOn attribute to the resource declaration for the route table entry

View answer

Correct Answer: D

Question #8

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #9

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #10

A banking company is successfully operating its public mobile banking stack on AWS. The mobile banking stack is deployed in a VPC that includes private subnets and public subnets. The company is using IPv4 networking and has not deployed or supported IPv6 in the environment. The company has decided to adopt a third-party service provider's API and must integrate the API with the existing environment. The service provider's API requires the use of IPv6.A network engineer must turn on IPv6 connectivity for the existing workload that is deployed in a private subnet. The company does not want to permit IPv6 traffic from the public internet and mandates that the company's servers must initiate all IPv6 connectivity. The network engineer turns on IPv6 in the VPC and in the private subnets.Which solution will meet these requirements?

A. Create an internet gateway and a NAT gateway in the VPC

B. Create an internet gateway and a NAT instance in the VPC

C. Create an egress-only Internet gateway in the VP Add a route to the existing subnet route tables to point IPv6 traffic to the egress-only internet gateway

D. Create an egress-only internet gateway in the VPC

View answer

Correct Answer: C

Question #11

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #12

A company uses a hybrid architecture and has an AWS Direct Connect connection between its on-premises data center and AWS. The company has production applications that run in the on-premises data center. The company also has production applications that run in a VPC. The applications that run in the on-premises data center need to communicate with the applications that run in the VPC. The company is using corp.example.com as the domain name for the on-premises resources and is using an Amazon Route 53 private hosted zone for aws.example.com to host the VPC resources.The company is using an open-source recursive DNS resolver in a VPC subnet and is using a DNS resolver in the on-premises data center. The company's on-premises DNS resolver has a forwarder that directs requests for the aws.example.com domain name to the DNS resolver in the VPC. The DNS resolver in the VPC has a forwarder that directs requests for the corp.example.com domain name to the DNS resolver in the on-premises data center. The company has deckled to replace the open-source recursive DNS resolver with Amazon Route 53 Resolver endpoints.Which combination of steps should a network engineer take to make this replacement? (Choose three.)

A. Create a Route 53 Resolver rule to forward aws

B. Configure the on-premises DNS resolver to forward aws

C. Create a Route 53 Resolver inbound endpoint and a Route 53 Resolver outbound endpoint

D. Create a Route 53 Resolver rule to forward aws

E. Create a Route 53 Resolver rule to forward corp

F. Configure the on-premises DNS resolver to forward aws

View answer

Correct Answer: BCE

Question #13

A software-as-a-service (SaaS) provider hosts its solution on Amazon EC2 instances within a VPC in the AWS Cloud. All of the provider's customers also have their environments in the AWS Cloud.A recent design meeting revealed that the customers have IP address overlap with the provider's AWS deployment. The customers have stated that they will not share their internal IP addresses and that they do not want to connect to the provider's SaaS service over the internet.Which combination of steps is part of a solution that meets these requirements? (Choose two.)

A. Deploy the SaaS service endpoint behind a Network Load Balancer

B. Configure an endpoint service, and grant the customers permission to create a connection to the endpoint service

C. Deploy the SaaS service endpoint behind an Application Load Balancer

D. Configure a VPC peering connection to the customer VPCs

E. Deploy an AWS Transit Gateway, and connect the SaaS VPC to it

View answer

Correct Answer: AB

Question #14

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #15

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #16

A company is designing infrastructure on AWS with three VPCs connected to a transit gateway. The three VPCs are an application VPC, a backend VPC, and an inspection VPC.The application VPC and the backend VPC have compute instances deployed in Availability Zone A and Availability Zone B. Stateful firewalls are deployed in the same Availability Zones in the inspection VPC, which is a shared services VPC.All traffic is routed through the inspection VPC through the stateful layer 7 virtual firewall appliances to comply with a security policy that mandates traffic inspection. There are no overlapping IP addresses across the three VPCs.A network engineer must ensure that traffic between the application VPC and the backend VPC can route through the inspection VPC's stateful firewalls.Which solution will meet these requirements?

A. Configure the local preference BGP community tag 7224:7300 for the transit VIF connected to Direct Connect connection 1

B. Configure the local preference BGP community tag 7224:9300 for the transit VIF connected to Direct Connect connection 2

C. Use the AS_PATH attribute to prepend the additional hop for the transit VIF connected to Direct Connect connection 2

D. Use the AS_PATH attribute to prepend the additional hop for the transit VIF connected to Direct Connect connection 1

View answer

Correct Answer: a

Question #17

A European car manufacturer wants to migrate its customer-facing services and its analytics platform from two on-premises data centers to the AWS Cloud. The company has a 50-mile (80.4 km) separation between its on-premises data centers and must maintain that separation between its two locations in the cloud. The company also needs failover capabilities between the two locations in the cloud.

A. Create a Direct Connect gateway

B. Create a Direct Connect gateway

C. Create a Direct Connect gateway

D. Create a Direct Connect gateway

View answer

Correct Answer: C

Question #18

A company has expanded its network to the AWS Cloud by using a hybrid architecture with multiple AWS accounts. The company has set up a shared AWS account for the connection to its on-premises data centers and the company offices. The workloads consist of private web-based services for internal use. These services run in different AWS accounts. Office-based employees consume these services by using a DNS name in an on-premises DNS zone that is named example.internal.The process to register a new service that runs on AWS requires a manual and complicated change request to the internal DNS. The process involves many teams.The company wants to update the DNS registration process by giving the service creators access that will allow them to register their DNS records. A network engineer must design a solution that will achieve this goal. The solution must maximize cost-effectiveness and must require the least possible number of configuration changes.Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

A. Create a record for each service in its local private hosted zone (serviceaccount1

B. Create an Amazon Route 53 Resolver inbound endpoint in the shared account VPC

C. Create an Amazon Route 53 Resolver rule to forward any queries made to onprem

D. Create an Amazon Route 53 private hosted zone named aws

E. Launch two Amazon EC2 instances in the shared AWS account

F. Create a private hosted zone in the shared AWS account for each account that runs the service

View answer

Correct Answer: BDF

Question #19

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #20

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #21

A network engineer must provide additional safeguards to protect encrypted data at Application Load Balancers (ALBs) through the use of a unique random session key.What should the network engineer do to meet this requirement?

A. hange the ALB security policy to a policy that supports TLS 1

B. se AWS Key Management Service (AWS KMS) to encrypt session keys

C. ssociate an AWS WAF web ACL with the ALBs

D. hange the ALB security policy to a policy that supports forward secrecy (FS)

View answer

Correct Answer: D

Question #22

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #23

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #24

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #25

A retail company is running its service on AWS. The company's architecture includes Application Load Balancers (ALBs) in public subnets. The ALB target groups are configured to send traffic to backend Amazon EC2 instances in private subnets. These backend EC2 instances can call externally hosted services over the internet by using a NAT gateway.The company has noticed in its billing that NAT gateway usage has increased significantly. A network engineer needs to find out the source of this increased usage.Which options can the network engineer use to investigate the traffic through the NAT gateway? (Choose two.)

A. Enable VPC flow logs on the NAT gateway's elastic network interface

B. Enable NAT gateway access logs

C. Configure Traffic Mirroring on the NAT gateway's elastic network interface

D. Enable VPC flow logs on the NAT gateway's elastic network interface

E. Enable NAT gateway access logs

View answer

Correct Answer: AD

Question #26

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #27

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #28

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #29

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #30

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #31

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #32

A company uses a hybrid architecture and has an AWS Direct Connect connection between its on-premises data center and AWS. The company has production applications that run in the on-premises data center. The company also has production applications that run in a VPC. The applications that run in the on-premises data center need to communicate with the applications that run in the VPC. The company is using corp.example.com as the domain name for the on-premises resources and is using an Amazon Route 53 private hosted zone for aws.example.com to host the VPC resources.The company is using an open-source recursive DNS resolver in a VPC subnet and is using a DNS resolver in the on-premises data center. The company's on-premises DNS resolver has a forwarder that directs requests for the aws.example.com domain name to the DNS resolver in the VPC. The DNS resolver in the VPC has a forwarder that directs requests for the corp.example.com domain name to the DNS resolver in the on-premises data center. The company has deckled to replace the open-source recursive DNS resolver with Amazon Route 53 Resolver endpoints.Which combination of steps should a network engineer take to make this replacement? (Choose three.)

A. Create a Route 53 Resolver rule to forward aws

B. Configure the on-premises DNS resolver to forward aws

C. Create a Route 53 Resolver inbound endpoint and a Route 53 Resolver outbound endpoint

D. Create a Route 53 Resolver rule to forward aws

E. Create a Route 53 Resolver rule to forward corp

F. Configure the on-premises DNS resolver to forward aws

View answer

Correct Answer: BCE

Question #33

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #34

A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway in the required AWS Region. A network engineer needs to deploy the SD-WAN hub virtual appliance into a VPC that is connected to the transit gateway. The solution must support at least 5 Gbps of throughput from the SD-WAN hub virtual appliance to other VPCs that are attached to the transit gateway.Which solution will meet these requirements?

A. Create a new VPC for the SD-WAN hub virtual appliance

B. Assign a new CIDR block to the transit gateway

C. Create a new VPC for the SD-WAN hub virtual appliance

D. Assign a new CIDR block to the transit gateway

View answer

Correct Answer: B

Question #35

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #36

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #37

A company has deployed Amazon EC2 instances in private subnets in a VPC. The EC2 instances must initiate any requests that leave the VPC, including requests to the company's on-premises data center over an AWS Direct Connect connection. No resources outside the VPC can be allowed to open communications directly to the EC2 instances.The on-premises data center's customer gateway is configured with a stateful firewall device that filters for incoming and outgoing requests to and from multiple VPCs. In addition, the company wants to use a single IP match rule to allow all the communications from the EC2 instances to its data center from a single IP address.Which solution will meet these requirements with the LEAST amount of operational overhead?

A. Create a VPN connection over the Direct Connect connection by using the on-premises firewall

B. Configure the on-premises firewall to filter all requests from the on-premises network to the EC2 instances

C. Deploy a NAT gateway into a private subnet in the VPC where the EC2 instances are deployed

D. Deploy a NAT instance into a private subnet in the VPC where the EC2 instances are deployed

View answer

Correct Answer: C

Question #38

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #39

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #40

A company is hosting an application on Amazon EC2 instances behind a Network Load Balancer (NLB). A solutions architect added EC2 instances in a second Availability Zone to improve the availability of the application. The solutions architect added the instances to the NLB target group.The company's operations team notices that traffic is being routed only to the instances in the first Availability Zone.What is the MOST operationally efficient solution to resolve this issue?

A. nable the new Availability Zone on the NLB

B. reate a new NLB for the instances in the second Availability Zone

C. nable proxy protocol on the NLB

D. reate a new target group with the instances in both Availability Zones

View answer

Correct Answer: A

Question #41

A company's network engineer needs to design a new solution to help troubleshoot and detect network anomalies. The network engineer has configured Traffic Mirroring. However, the mirrored traffic is overwhelming the Amazon EC2 instance that is the traffic mirror target. The EC2 instance hosts tools that the company's security team uses to analyze the traffic. The network engineer needs to design a highly available solution that can scale to meet the demand of the mirrored traffic.Which solution will meet these requirements?

A. Deploy a Network Load Balancer (NLB) as the traffic mirror target

B. Deploy an Application Load Balancer (ALB) as the traffic mirror target

C. Deploy a Gateway Load Balancer (GLB) as the traffic mirror target

D. Deploy an Application Load Balancer (ALB) with an HTTPS listener as the traffic mirror target

View answer

Correct Answer: A

Question #42

A global delivery company is modernizing its fleet management system. The company has several business units. Each business unit designs and maintains applications that are hosted in its own AWS account in separate application VPCs in the same AWS Region. Each business unit's applications are designed to get data from a central shared services VPC.The company wants the network connectivity architecture to provide granular security controls. The architecture also must be able to scale as more business units consume data from the central shared services VPC in the future.Which solution will meet these requirements in the MOST secure manner?

A. Create a central transit gateway

B. Create VPC peering connections between the central shared services VPC and each application VPC in each business unit's AWS account

C. Create VPC endpoint services powered by AWS PrivateLink in the central shared services VP Create VPC endpoints in each application VP

D. Create a central transit VPC with a VPN appliance from AWS Marketplace

View answer

Correct Answer: C

Question #43

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #44

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #45

A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend.Which solution will meet these requirements?

A. Install the AWS Load Balancer Controller for Kubernetes

B. Install the AWS Load Balancer Controller for Kubernetes

C. Create a target group

D. Create a target group

View answer

Correct Answer: A

Question #46

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #47

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #48

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #49

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #50

A network engineer must provide additional safeguards to protect encrypted data at Application Load Balancers (ALBs) through the use of a unique random session key.What should the network engineer do to meet this requirement?

A. Change the ALB security policy to a policy that supports TLS 1

B. Use AWS Key Management Service (AWS KMS) to encrypt session keys

C. Associate an AWS WAF web ACL with the ALBs, and create a security rule to enforce forward secrecy (FS)

D. Change the ALB security policy to a policy that supports forward secrecy (FS)

View answer

Correct Answer: D

Question #51

A company is using Amazon Route 53 Resolver for its hybrid DNS infrastructure. The company is using Route 53 Resolver forwarding rules for authoritative domains that are hosted on on-premises DNS servers.The company achieves hybrid network connectivity by using an AWS Site-to-Site VPN connection. A new governance policy requires logging for DNS traffic that originates in the AWS Cloud.The policy also requires the company to query DNS traffic to identify the source IP address of the resources that the query originated from, along with the DNS name that was requested.Which solution will meet these requirements?

A. Create VPC flow logs for all VPCs

B. Modify the existing Route 53 Resolver rules to configure logging

C. Configure DNS logging for the Site-to-Site VPN connection

D. Configure Route 53 Resolver query logging for all VPCs

View answer

Correct Answer: d

Question #52

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #53

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #54

A network engineer needs to update a company's hybrid network to support IPv6 for the upcoming release of a new application. The application is hosted in a VPC in the AWS Cloud. The company's current AWS infrastructure includes VPCs that are connected by a transit gateway. The transit gateway is connected to the on-premises network by AWS Direct Connect and AWS Site-to-Site VPN. The company's on-premises devices have been updated to support the new IPv6 requirements.The company has enabled IPv6 for the existing VPC by assigning a new IPv6 CIDR block to the VPC and by assigning IPv6 to the subnets for dual-stack support. The company has launched new Amazon EC2 instances for the new application in the updated subnets.When updating the hybrid network to support IPv6 the network engineer must avoid making any changes to the current infrastructure. The network engineer also must block direct access to the instances' new IPv6 addresses from the internet. However, the network engineer must allow outbound internet access from the instances.What is the MOST operationally efficient solution that meets these requirements?

A. pdate the Direct Connect transit VIF and configure BGP peering with the AWS assigned IPv6 peering address

B. pdate the Direct Connect transit VIF and configure BGP peering with the AWS assigned IPv6 peering address

C. reate a Direct Connect transit VIF and configure BGP peering with the AWS assigned IPv6 peering address

D. reate a Direct Connect transit VIF and configure BGP peering with the AWS assigned IPv6 peering address

View answer

Correct Answer: C

Question #55

A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend.Which solution will meet these requirements?

A. Install the AWS Load Balancer Controller for Kubernetes

B. Install the AWS Load Balancer Controller for Kubernetes

C. Create a target group

D. Create a target group

View answer

Correct Answer: A

Question #56

A company is building its website on AWS in a single VPC. The VPC has public subnets and private subnets in two Availability Zones. The website has static content such as images. The company is using Amazon S3 to store the content.The company has deployed a fleet of Amazon EC2 instances as web servers in a private subnet. The EC2 instances are in an Auto Scaling group behind an Application Load Balancer. The EC2 instances will serve traffic, and they must pull content from an S3 bucket to render the webpages. The company is using AWS Direct Connect with a public VIF for on-premises connectivity to the S3 bucket.A network engineer notices that traffic between the EC2 instances and Amazon S3 is routing through a NAT gateway. As traffic increases, the company's costs are increasing. The network engineer needs to change theconnectivity to reduce the NAT gateway costs that result from the traffic between the EC2 instances and Amazon S3.Which solution will meet these requirements?

A. Create a Direct Connect private VIF

B. Create an AWS Site-to-Site VPN tunnel over the existing public VIF

C. Implement interface VPC endpoints for Amazon S3

D. Implement gateway VPC endpoints for Amazon S3

View answer

Correct Answer: D

Question #57

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #58

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #59

A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group (LAG) bundle to connect to five VPCs that are deployed in the us-east-1 Region. Each VPC serves a differentbusiness unit and uses its own private VIF for connectivity to the on-premises environment. Users are reporting slowness when they access resources that are hosted on AWS.A network engineer finds that there are sudden increases in throughput and that the Direct Connect connection becomes saturated at the same time for about an hour each business day. The company wants to know which business unit is causing the sudden increase in throughput. The network engineer must find out this information and implement a solution to resolve the problem.Which solution will meet these requirements?

A. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed

B. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed

C. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed

D. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed

View answer

Correct Answer: A

Question #60

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #61

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #62

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #63

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #64

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #65

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #66

A network engineer is working on a private DNS design to integrate AWS workloads and on-premises resources. The AWS deployment consists of five VPCs in the eu-west-1 Region that connect to the on-premises network over AWS Direct Connect. The VPCs communicate with each other by using a transit gateway. Each VPC is associated with a private hosted zone that uses the aws.example.internal domain. The network engineer creates an Amazon Route 53 Resolver outbound endpoint in a shared services VPC and attaches the shared services VPC to the transit gateway. The network engineer is implementing a solution for DNS resolution. Queries for hostnames that end with aws.example.internal must use the private hosted zone. Queries for hostnames that end with all other domains must be forwarded to a private on-premises DNS resolver.

A. Add a forwarding rule for "*" that targets the on-premises server's DNS IP address

B. Add a forwarding rule for aws

C. Add a forwarding rule for "*" that targets the Route 53 Resolver outbound endpoint

D. Add a forwarding rule for "

View answer

Correct Answer: D

Question #67

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #68

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #69

A company is deploying a new stateless web application on AWS. The web application will run on Amazon EC2 instances in private subnets behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The web application has a stateful management application for administration that will run on EC2 instances that are in a separate Auto Scaling group.The company wants to access the management application by using the same URL as the web application, with a path prefix of /management. The protocol, hostname, and port number must be the same for the web application and the management application. Access to the management application must be restricted to the company's on-premises IP address space. An SSL/TLS certificate from AWS Certificate Manager (ACM) will protect the web application.Which combination of steps should a network engineer take to meet these requirements? (Select TWO.)

A. Insert a rule for the load balancer HTTPS listener

B. Modify the default rule for the load balancer HTTPS listener

C. Insert a rule for the load balancer HTTPS listener

D. Modify the default rule for the load balancer HTTPS listener

E. Forward all requests to the web application target group

View answer

Correct Answer: AE

Question #70

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #71

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #72

A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group (LAG) bundle to connect to five VPCs that are deployed in the us-east-1 Region. Each VPC serves a differentbusiness unit and uses its own private VIF for connectivity to the on-premises environment. Users are reporting slowness when they access resources that are hosted on AWS.A network engineer finds that there are sudden increases in throughput and that the Direct Connect connection becomes saturated at the same time for about an hour each business day. The company wants to know which business unit is causing the sudden increase in throughput. The network engineer must find out this information and implement a solution to resolve the problem.Which solution will meet these requirements?

A. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed

B. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed

C. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed

D. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed

View answer

Correct Answer: A

Question #73

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #74

A network engineer is designing the architecture for a healthcare company's workload that is moving to the AWS Cloud. All data to and from the on-premises environment must be encrypted in transit. All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premises environment or to the internet.The company will expose components of the workload to the internet so that patients can reserve appointments. The architecture must secure these components and protect them against DDoS attacks. The architecture also must provide protection against financial liability for services that scale out during a DDoS event.Which combination of steps should the network engineer take to meet all these requirements for the workload? (Choose three.)

A. Use Traffic Mirroring to copy all traffic to a fleet of traffic capture appliances

B. Set up AWS WAF on all network components

C. Configure an AWS Lambda function to create Deny rules in security groups to block malicious IP addresses

D. Use AWS Direct Connect with MACsec support for connectivity to the cloud

E. Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection

F. Configure AWS Shield Advanced and ensure that it is configured on all public assets

View answer

Correct Answer: DEF

Question #75

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #76

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #77

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #78

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #79

A company is running its application servers on Amazon EC2 instances. The EC2 instances run in separate VPCs that are connected by a transit gateway. The EC2 instances launch in a private subnet with a route to the transit gateway for internal and external connectivity. The external connectivity is provided by a VPC with firewall devices that perform an inspection for packets that ingress and egress through an internet gateway.A network engineer needs to help the company's application team increase the payload size per packet delivery between the EC2 instances. All network connectivity must be through the transit gatewayWhat should the network engineer do to meet these requirements?

A. Enable jumbo frames on the transit gateway

B. Instruct the application team to set the maximum transmission unit (MTU) of the VPC to 8500 bytes

C. Instruct the application team to set up enhanced networking on the system by using the enhanced networking adapter

D. Instruct the application team to set the maximum transmission unit (MTU) of the system's network interfaces to 8500 bytes

View answer

Correct Answer: D

Question #80

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #81

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #82

A network engineer is designing the architecture for a healthcare company's workload that is moving to the AWS Cloud. All data to and from the on-premises environment must be encrypted in transit. All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premisesenvironment or to the internet.The company will expose components of the workload to the internet so that patients can reserve appointments. The architecture must secure these components and protect them against DDoS attacks. The architecture also must provide protection against financial liability for services that scale out during a DDoS event.Which combination of steps should the network engineer take to meet all these requirements for the workload? (Choose three.)

A. Use Traffic Mirroring to copy all traffic to a fleet of traffic capture appliances

B. Set up AWS WAF on all network components

C. Configure an AWS Lambda function to create Deny rules in security groups to block malicious IP addresses

D. Use AWS Direct Connect with MACsec support for connectivity to the cloud

E. Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection

F. Configure AWS Shield Advanced and ensure that it is configured on all public assets

View answer

Correct Answer: DEF

Question #83

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #84

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #85

A company manages resources across VPCs in multiple AWS Regions. The company needs to connect to the resources by using its internal domain name. A network engineer needs to apply the aws.example.com DNS suffix to all resources.

A. Create an Amazon Route 53 private hosted zone for aws

B. Create one Amazon Route 53 private hosted zone for aws

C. Create one Amazon Route 53 private hosted zone for example

D. Create one Amazon Route 53 private hosted zone for aws

View answer

Correct Answer: D

Question #86

A company is deploying an application. The application is implemented in a series of containers in an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use the Fargate launch type for its tasks. The containers will run workloads that require connectivity initiated over an SSL connection. Traffic must be able to flow to the application from other AWS accounts over private connectivity. The application must scale in a manageable way as more consumers use the application.Which solution will meet these requirements?

A. Choose a Gateway Load Balancer (GLB) as the type of load balancer for the ECS service

B. Choose an Application Load Balancer (ALB) as the type of load balancer for the ECS service

C. Choose an Application Load Balancer (ALB) as the type of load balancer for the ECS service

D. Choose a Network Load Balancer (NLB) as the type of load balancer for the ECS service

View answer

Correct Answer: A

Question #87

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #88

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #89

A company has a highly available application that is hosted in multiple VPCs and in two on-premises data centers. All the VPCs reside in the same AWS Region. All the VPCs require access to each other and to the on-premises data centers for the transfer of files that are multiple gigabytes in size. A network engineer is designing an AWS Direct Connect solution to connect the on-premises data centers to each VPC. Which architecture will meet the company's requirements with the LEAST operational overhead?

A. Configure a virtual private gateway and a private VIF in each VPC in the Region

B. Configure a virtual private gateway and a private VIF in each VPC in the Region

C. Configure a transit gateway in the same Region of each VPC

D. Configure a transit gateway in the same Region of each VPC

View answer

Correct Answer: D

Question #90

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #91

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #92

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #93

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #94

A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway in the required AWS Region. A network engineer needs to deploy the SD-WAN hub virtual appliance into a VPC that is connected to the transit gateway. The solution must support at least 5 Gbps of throughput from the SD-WAN hub virtual appliance to other VPCs that are attached to the transit gateway.Which solution will meet these requirements?

A. Create a new VPC for the SD-WAN hub virtual appliance

B. Assign a new CIDR block to the transit gateway

C. Create a new VPC for the SD-WAN hub virtual appliance

D. Assign a new CIDR block to the transit gateway

View answer

Correct Answer: B

Question #95

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #96

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #97

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #98

A retail company is running its service on AWS. The company's architecture includes Application Load Balancers (ALBs) in public subnets. The ALB target groups are configured to send traffic to backend Amazon EC2 instances in private subnets. These backend EC2 instances can call externally hosted services over the internet by using a NAT gateway.The company has noticed in its billing that NAT gateway usage has increased significantly. A network engineer needs to find out the source of this increased usage.Which options can the network engineer use to investigate the traffic through the NAT gateway? (Choose two.)

A. Enable VPC flow logs on the NAT gateway's elastic network interface

B. Enable NAT gateway access logs

C. Configure Traffic Mirroring on the NAT gateway's elastic network interface

D. Enable VPC flow logs on the NAT gateway's elastic network interface

E. Enable NAT gateway access logs

View answer

Correct Answer: AD

Question #99

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #100

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free AWS ANS-C02 Practice Questions & Answers 2026 Part1

View The Updated AWS Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free AWS ANS-C02 Practice Questions & Answers 2026 Part1

View The Updated AWS Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now