Free AWS ANS-C02 Practice Questions & Answers 2026 Part4

Question #1

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #2

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #3

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #4

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #5

A company wants to improve visibility into its AWS environment. The AWS environment consists of multiple VPCs that are connected to a transit gateway. The transit gateway connects to an on-premises data center through an AWS Direct Connect gateway and a pair of redundant Direct Connect connections that use transit VIFs. The company must receive notification each time a new route is advertised to AWS from on premises over Direct Connect.What should a network engineer do to meet these requirements?

A. Enable Amazon CloudWatch metrics on Direct Connect to track the received routes

B. Onboard Transit Gateway Network Manager to Amazon CloudWatch Logs Insights

C. Configure an AWS Lambda function to periodically check the routes on the Direct Connect gateway and to send notifications when routes change

D. Enable Amazon CloudWatch Logs on the transit VIFs to track the received routes

View answer

Correct Answer: B

Question #6

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #7

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #8

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #9

A company is running a hybrid cloud environment. The company has multiple AWS accounts as part of an organization in AWS Organizations. The company needs a solution to manage a list of IPv4 on-premises hosts that will be allowed to access resources in AWS. The solution must provide version control for the list of IPv4 addresses and must make the list available to the AWS accounts in the organization.

A. Create a customer-managed prefix list

B. Create a customer-managed prefix list

C. Create a security group

D. Create an Amazon DynamoDB table

View answer

Correct Answer: A

Question #10

A company is hosting an application on Amazon EC2 instances behind a Network Load Balancer (NLB). A solutions architect added EC2 instances in a second Availability Zone to improve the availability of the application. The solutions architect added the instances to the NLB target group.The company's operations team notices that traffic is being routed only to the instances in the first Availability Zone.What is the MOST operationally efficient solution to resolve this issue?

A. Enable the new Availability Zone on the NLB

B. Create a new NLB for the instances in the second Availability Zone

C. Enable proxy protocol on the NLB

D. Create a new target group with the instances in both Availability Zones

View answer

Correct Answer: A

Question #11

A company delivers applications over the internet. An Amazon Route 53 public hosted zone is the authoritative DNS service for the company and its internet applications, all of which are offered from the same domain name.A network engineer is working on a new version of one of the applications. All the application's components are hosted in the AWS Cloud. The application has a three-tier design. The front end is delivered through Amazon EC2 instances that are deployed in public subnets with Elastic IP addresses assigned. The backend components are deployed in private subnets from RFC1918.Components of the application need to be able to access other components of the application within the application's VPC by using the same host names as the host names that are used over the public internet. The network engineer also needs to accommodate future DNS changes, such as the introduction of new host names or the retirement of DNS entries.Which combination of steps will meet these requirements? (Choose three.)

A. Add a geoproximity routing policy in Route 53

B. Create a Route 53 private hosted zone for the same domain name Associate the application's VPC with the new private hosted zone

C. Enable DNS hostnames for the application's VP

D. Create entries in the private hosted zone for each name in the public hosted zone by using the corresponding private IP addresses

E. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that runs when AWS CloudTrail logs a Route 53 API call to the public hosted zone

F. Add the private IP addresses in the existing Route 53 public hosted zone

View answer

Correct Answer: BCD

Question #12

A development team is building a new web application in the AWS Cloud. The main company domain, example.com. is currently hosted in an Amazon Route 53 public hosted zone in one of the company's production AWS accounts.The developers want to test the web application in the company's staging AWS account by using publicly resolvable subdomains under the example.com domain with the ability to create and delete DNS records as needed. Developers have full access to Route 53 hosted zones within the staging account, but they are prohibited from accessing resources in any of the production AWS accounts.Which combination of steps should a network engineer take to allow the developers to create records under the example.com domain? (Select TWO.)

A. Create a public hosted zone for example

B. Create a staging

C. Create a private hosted zone for stagmg

D. Create an example

E. Create a public hosted zone for staging

View answer

Correct Answer: BE

Question #13

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #14

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #15

A company is planning a migration of its critical workloads from an on-premises data center to Amazon EC2 instances. The plan includes a new 10 Gbps AWS Direct Connect dedicated connection from the on-premises data center to a VPC that is attached to a transit gateway. The migration must occur over encrypted paths between the on-premises data center and the AWS Cloud.Which solution will meet these requirements while providing the HIGHEST throughput?

A. Configure a public VIF on the Direct Connect connection

B. Configure a transit VIF on the Direct Connect connection

C. Configure MACsec for the Direct Connect connection

D. Configure a public VIF on the Direct Connect connection

View answer

Correct Answer: C

Question #16

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #17

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #18

A network engineer must develop an AWS CloudFormation template that can create a virtual private gateway, a customer gateway, a VPN connection, and static routes in a route table. During testing of the template, the network engineer notes that the CloudFormation template has encountered an error and is rolling back.What should the network engineer do to resolve the error?

A. Change the order of resource creation in the CloudFormation template

B. Add the DependsOn attribute to the resource declaration for the virtual private gateway

C. Add a wait condition in the template to wait for the creation of the virtual private gateway

D. Add the DependsOn attribute to the resource declaration for the route table entry

View answer

Correct Answer: D

Question #19

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #20

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #21

A company is planning to migrate an internal application to the AWS Cloud. The application will run on Amazon EC2 instances in one VPC. Users will access the application from thecompany's on-premises data center through AWS VPN or AWS Direct Connect. Users will use private domain names for the application endpoint from a domain name that is reservedexplicitly for use in the AWS Cloud.Each EC2 instance must have automatic failover to another EC2 instance in the same AWS account and the same VPC. A network engineer must design a DNS solution that will not exposethe application to the internet.Which solution will meet these requirements?

A. Assign public IP addresses to the EC2 instances

B. Place the EC2 instances in private subnets

C. Place the EC2 instances in private subnets

D. Place the EC2 instances in private subnets

View answer

Correct Answer: C

Question #22

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #23

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #24

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #25

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #26

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #27

A company is using custom DNS servers that run BIND for name resolution in its VPCs. The VPCs are deployed across multiple AWS accounts that are part of the same organization in AWS Organizations. All the VPCs are connected to a transit gateway. The BIND servers are running in a central VPC and are configured to forward all queries for an on-premises DNS domain to DNS servers that are hosted in an on-premises data center. To ensure that all the VPCs use the custom DNS servers, a network engineer has configured a VPC DHCP options set in all the VPCs that specifies the custom DNS servers to be used as domain name servers.Multiple development teams in the company want to use Amazon Elastic File System (Amazon EFS). A development team has created a new EFS file system but cannot mount the file system to one of its Amazon EC2 instances. The network engineer discovers that the EC2 instance cannot resolve the IP address for theEFS mount point fs-33444567d.efs.us-east-1.amazonaws.com. The network engineer needs to implement a solution so that development teams throughout the organization can mount EFS file systems.Which combination of steps will meet these requirements? (Choose two.)

A. Configure the BIND DNS servers in the central VPC to forward queries for efs

B. Create an Amazon Route 53 Resolver outbound endpoint in the central VPC

C. Create an Amazon Route 53 Resolver inbound endpoint in the central VP Update all the VPC DHCP options sets to use the Route 53 Resolver inbound endpoint in the central VPC for name resolution

D. Create an Amazon Route 53 Resolver rule to forward queries for the on-premises domain to the on- premises DNS servers

E. Create an Amazon Route 53 private hosted zone for the efs

View answer

Correct Answer: BD

Question #28

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #29

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #30

A network engineer needs to set up an Amazon EC2 Auto Scaling group to run a Linux-based network appliance in a highly available architecture. The network engineer is configuring the new launch template for the Auto Scaling group.In addition to the primary network interface the network appliance requires a second network interface that will be used exclusively by the application to exchange traffic with hosts over the internet. The company has set up a Bring Your Own IP (BYOIP) pool that includes an Elastic IP address that should be used as the public IP address for the second network interface.How can the network engineer implement the required architecture?

A. onfigure the two network interfaces in the launch template

B. onfigure the primary network interface in a private subnet in the launch template

C. reate an AWS Lambda function to run as a lifecycle hook of the Auto Scaling group when an instance is launching

D. uring creation of the Auto Scaling group, select subnets for the primary network interface

View answer

Correct Answer: D

Question #31

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #32

A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group (LAG) bundle to connect to five VPCs that are deployed in the us-east-1 Region. Each VPC serves a different business unit and uses its own private VIF for connectivity to the on-premises environment. Users are reporting slowness when they access resources that are hosted on AWS.A network engineer finds that there are sudden increases in throughput and that the Direct Connect connection becomes saturated at the same time for about an hour each business day. The company wants to know which business unit is causing the sudden increase in throughput. The network engineer must find out this information and implement a solution to resolve the problem.Which solution will meet these requirements?

A. eview the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed

B. eview the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed

C. eview the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed

D. eview the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed

View answer

Correct Answer: A

Question #33

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #34

A company has a highly available application that is hosted in multiple VPCs and in two on-premises data centers. All the VPCs reside in the same AWS Region. All the VPCs require access to each other and to the on-premises data centers for the transfer of files that are multiple gigabytes in size.

A. Configure a virtual private gateway and a private VIF in each VPC in the Region

B. Configure a virtual private gateway and a private VIF in each VPC in the Region

C. Configure a transit gateway in the same Region of each VPAttach each VPC to the transit gateway

D. Configure a transit gateway in the same Region of each VPC

View answer

Correct Answer: D

Question #35

A network engineer is designing the architecture for a healthcare company's workload that is moving to the AWS Cloud. All data to and from the on-premises environment must be encrypted in transit. All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premisesenvironment or to the internet.The company will expose components of the workload to the internet so that patients can reserve appointments. The architecture must secure these components and protect them against DDoS attacks. The architecture also must provide protection against financial liability for services that scale out during a DDoS event.Which combination of steps should the network engineer take to meet all these requirements for the workload? (Choose three.)

A. Use Traffic Mirroring to copy all traffic to a fleet of traffic capture appliances

B. Set up AWS WAF on all network components

C. Configure an AWS Lambda function to create Deny rules in security groups to block malicious IP addresses

D. Use AWS Direct Connect with MACsec support for connectivity to the cloud

E. Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection

F. Configure AWS Shield Advanced and ensure that it is configured on all public assets

View answer

Correct Answer: DEF

Question #36

A global company operates all its non-production environments out of three AWS Regions: eu-west-1, us-east- 1, and us-west-1. The company hosts all its production workloads in two on-premises data centers. The company has 60 AWS accounts and each account has two VPCs in each Region. Each VPC has a virtual private gateway where two VPN connections terminate for resilient connectivity to the data centers. The company has 360 VPN tunnels to each data center, resulting in high management overhead. The total VPN throughput for each Region is 500 Mbps.The company wants to migrate the production environments to AWS. The company needs a solution that will simplify the network architecture and allow for future growth. The production environments will generate an additional 2 Gbps of traffic per Region back to the data centers. This traffic will increase over time.Which solution will meet these requirements?

A. Set up an AWS Direct Connect connection from each data center to AWS in each Region

B. Create a single transit gateway with VPN connections from each data center

C. Create a transit gateway in each Region with multiple newly commissioned VPN connections from each data center

D. Peer all the VPCs in each Region to a new VPC in each Region that will function as a centralized transit VPC

View answer

Correct Answer: C

Question #37

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #38

A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway in the required AWS Region. A network engineer needs to deploy the SD-WAN hub virtual appliance into a VPC that is connected to the transit gateway. The solution must support at least 5 Gbps of throughput from the SD-WAN hub virtual appliance to other VPCs that are attached to the transit gateway.Which solution will meet these requirements?

A. reate a new VPC for the SD-WAN hub virtual appliance

B. ssign a new CIDR block to the transit gateway

C. reate a new VPC for the SD-WAN hub virtual appliance

D. ssign a new CIDR block to the transit gateway

View answer

Correct Answer: B

Question #39

A company securely connects resources that are in its VPC to a software as a service (SaaS) solution from a SaaS provider. The SaaS solution is hosted in the AWS Cloud and is powered by AWS PrivateLink. The company uses a PrivateLink endpoint to access the SaaS solution behind the SaaS provider's Network Load Balancer (NLB).

A. The CIDR block of the new subnets conflicts with the SaaS provider's CIDR block

B. The enableDnsHostnames attribute and enableDnsSupport attribute were not configured on the new subnets in the new Availability Zone

C. The SaaS provider does not offer the solution in the new Availability Zone and has not configured cross-zone load balancing for the NLB

D. The new subnets are missing a route to the VPC internet gateway

View answer

Correct Answer: C

Question #40

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #41

A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group (LAG) bundle to connect to five VPCs that are deployed in the us - east - 1 Region. Each VPC serves a different business unit and uses its own private VIF for connectivity to the on - premises environment. Users are reporting slowness when they access resources that are hosted on AWS. A network engineer finds that there are sudden increases in throughput and that the Direct Connect connection becomes saturated at the same time for about an hour each business day. The company wants to know which business unit is causing the sudden increase in throughput. The network engineer must find out this information and implement a solution to resolve the problem. Which solution will meet these requirements?

A. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed

B. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed

C. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed

D. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed

View answer

Correct Answer: A

Question #42

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #43

A company delivers applications over the internet. An Amazon Route 53 public hosted zone is the authoritative DNS service for the company and its internet applications, all of which are offered from the same domain name.A network engineer is working on a new version of one of the applications. All the application's components are hosted in the AWS Cloud. The application has a three-tier design. The front end is delivered through Amazon EC2 instances that are deployed in public subnets with Elastic IP addresses assigned. The backend components are deployed in private subnets from RFC1918.Components of the application need to be able to access other components of the application within the application's VPC by using the same host names as the host names that are used over the public internet. The network engineer also needs to accommodate future DNS changes, such as the introduction of new host names or the retirement of DNS entries.Which combination of steps will meet these requirements? (Choose three.)

A. Add a geoproximity routing policy in Route 53

B. Create a Route 53 private hosted zone for the same domain name Associate the application's VPC with the new private hosted zone

C. Enable DNS hostnames for the application's VP

D. Create entries in the private hosted zone for each name in the public hosted zone by using the corresponding private IP addresses

E. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that runs when AWS CloudTrail logs a Route 53 API call to the public hosted zone

F. Add the private IP addresses in the existing Route 53 public hosted zone

View answer

Correct Answer: BCD

Question #44

A company has developed an application on AWS that will track inventory levels of vending machines and initiate the restocking process automatically. The company plans to integrate this application with vending machines and deploy the vending machines in several markets around the world. The application resides in a VPC in the us-east-1 Region. The application consists of an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). The communication from the vending machines to theapplication happens over HTTPS.The company is planning to use an AWS Global Accelerator accelerator and configure static IP addresses of the accelerator in the vending machines for application endpoint access. The application must be accessible only through the accelerator and not through a direct connection over the internet to the ALB endpoint.Which solution will meet these requirements?

A. Configure the ALB in a private subnet of the VPC

B. Configure the ALB in a private subnet of the VPC

C. Configure the ALB in a public subnet of the VP Attach an internet gateway

D. Configure the ALB in a private subnet of the VPC

View answer

Correct Answer: D

Question #45

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #46

A company is hosting an application on Amazon EC2 instances behind a Network Load Balancer (NLB). A solutions architect added EC2 instances in a second Availability Zone to improve the availability of the application. The solutions architect added the instances to the NLB target group.The company's operations team notices that traffic is being routed only to the instances in the first Availability Zone.What is the MOST operationally efficient solution to resolve this issue?

A. Enable the new Availability Zone on the NLB

B. Create a new NLB for the instances in the second Availability Zone

C. Enable proxy protocol on the NLB

D. Create a new target group with the instances in both Availability Zones

View answer

Correct Answer: A

Question #47

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #48

A company has deployed an AWS Network Firewall firewall into a VPC. A network engineer needs to implement a solution to deliver Network Firewall flow logs to the company's Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster in the shortest possible time.Which solution will meet these requirements?

A. Create an Amazon S3 bucket

B. Create an Amazon Kinesis Data Firehose delivery stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination

C. Configure flow logs for the firewall

D. Create an Amazon Kinesis data stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination

View answer

Correct Answer: B

Question #49

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #50

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #51

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer’s source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. se a Network Load Balancer

B. etrieve client IP addresses by using the X-Forwarded-For header

C. se AWS App Mesh load balancing

D. etrieve client IP addresses by using the X-IP-Source header

E. se an Application Load Balancer

View answer

Correct Answer: BE

Question #52

A global company runs business applications in the us-east-1 Region inside a VPC. One of the company's regional offices in London uses a virtual private gateway for an AWS Site-to-Site VPN connection tom the VPC. The company has configured a transit gateway and has set up peering between the VPC and other VPCs that various departments in the company use. Employees at the London office are experiencing latency issues when they connect to the business applications. What should a network engineer do to reduce this latency? Enabling acceleration for a Site-to-Site VPN connection uses AWS Global Accelerator to route traffic from the on-premises network to an AWS edge location that is closest to the customer gateway device1.AWS Global Accelerator optimizes the network path, using the congestion-free AWS global network to route traffic to the endpoint that provides the best application performance2.Setting the transit gateway as the target gateway enables connectivity between the on-premises network and multiple VPCs that are attached to the transit gateway3.

A. Create a new Site-to-Site VPN connection

B. Modify the existing Site-to-Site VPN connection by setting the transit gateway as the target gateway

C. Create a new transit gateway in the eu-west-2 (London) Region

D. Create a new AWS Global Accelerator standard accelerator that has an endpoint of the Site-to-Site VPN connection

View answer

Correct Answer: A

Question #53

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #54

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #55

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. he stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. ppliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. he stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VPC

D. ppliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #56

A global company operates all its non-production environments out of three AWS Regions: eu-west-1, us-east- 1, and us-west-1. The company hosts all its production workloads in two on-premises data centers. The company has 60 AWS accounts and each account has two VPCs in each Region. Each VPC has a virtual private gateway where two VPN connections terminate for resilient connectivity to the data centers. The company has 360 VPN tunnels to each data center, resulting in high management overhead. The total VPN throughput for each Region is 500 Mbps.The company wants to migrate the production environments to AWS. The company needs a solution that will simplify the network architecture and allow for future growth. The production environments will generate an additional 2 Gbps of traffic per Region back to the data centers. This traffic will increase over time.Which solution will meet these requirements?

A. Set up an AWS Direct Connect connection from each data center to AWS in each Region

B. Create a single transit gateway with VPN connections from each data center

C. Create a transit gateway in each Region with multiple newly commissioned VPN connections from each data center

D. Peer all the VPCs in each Region to a new VPC in each Region that will function as a centralized transit VPC

View answer

Correct Answer: C

Question #57

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #58

A global delivery company is modernizing its fleet management system. The company has several business units. Each business unit designs and maintains applications that are hosted in its own AWS account in separate application VPCs in the same AWS Region. Each business unit's applications are designed to get data from a central shared services VPC. The company wants the network connectivity architecture to provide granular security controls. The architecture also must be able to scale as more business units consume data from the central shared services VPC in the future. Which solution will meet these requirements in the MOST secure manner?

A. Create a central transit gateway

B. Create VPC peering connections between the central shared services VPC and each application VPC in each business unit's AWS account

C. Create VPC endpoint services powered by AWS PrivateLink in the central shared services VPCreate VPC endpoints in each application VPC

D. Create a central transit VPC with a VPN appliance from AWS Marketplace

View answer

Correct Answer: C

Question #59

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #60

A company has developed an application on AWS that will track inventory levels of vending machines and initiate the restocking process automatically. The company plans to integrate this application with vending machines and deploy the vending machines in several markets around the world. The application resides in a VPC in the us-east-1 Region. The application consists of an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). The communication from the vending machines to the application happens over HTTPS.The company is planning to use an AWS Global Accelerator accelerator and configure static IP addresses of the accelerator in the vending machines for application endpoint access. The application must be accessible only through the accelerator and not through a direct connection over the internet to the ALB endpoint.Which solution will meet these requirements?

A. Configure the ALB in a private subnet of the VPC

B. Configure the ALB in a private subnet of the VPC

C. Configure the ALB in a public subnet of the VPAttach an internet gateway

D. Configure the ALB in a private subnet of the VPC

View answer

Correct Answer: D

Question #61

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #62

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #63

A retail company is running its service on AWS. The company's architecture includes Application Load Balancers (ALBs) in public subnets. The ALB target groups are configured to send traffic to backend Amazon EC2 instances in private subnets. These backend EC2 instances can call externally hosted services over the internet by using a NAT gateway.The company has noticed in its billing that NAT gateway usage has increased significantly. A network engineer needs to find out the source of this increased usage.Which options can the network engineer use to investigate the traffic through the NAT gateway? (Choose two.)

A. Enable VPC flow logs on the NAT gateway's elastic network interface

B. Enable NAT gateway access logs

C. Configure Traffic Mirroring on the NAT gateway's elastic network interface

D. Enable VPC flow logs on the NAT gateway's elastic network interface

E. Enable NAT gateway access logs

View answer

Correct Answer: AD

Question #64

A software company offers a software-as-a-service (SaaS) accounting application that is hosted in the AWS Cloud The application requires connectivity to the company's on-premises network. The company has two redundant 10 GB AWS Direct Connect connections between AWS and its on-premises network to accommodate the growing demand for the application.The company already has encryption between its on-premises network and the colocation. The company needs to encrypt traffic between AWS and the edge routers in the colocation within the next few months. The company must maintain its current bandwidth.What should a network engineer do to meet these requirements with the LEAST operational overhead?

A. Deploy a new public VIF with encryption on the existing Direct Connect connections

B. Create a virtual private gateway Deploy new AWS Site-to-Site VPN connections from on premises to the virtual private gateway Reroute traffic from the Direct Connect private VIF to the new VPNs

C. Deploy a new pair of 10 GB Direct Connect connections with MACsec

D. Deploy a new pair of 10 GB Direct Connect connections with MACsec

View answer

Correct Answer: C

Question #65

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #66

A banking company is successfully operating its public mobile banking stack on AWS. The mobile banking stack is deployed in a VPC that includes private subnets and public subnets. The company is using IPv4 networking and has not deployed or supported IPv6 in the environment. The company has decided to adopt a third-party service provider's API and must integrate the API with the existing environment. The service provider's API requires the use of IPv6.A network engineer must turn on IPv6 connectivity for the existing workload that is deployed in a private subnet. The company does not want to permit IPv6 traffic from the public internet and mandates that the company's servers must initiate all IPv6 connectivity. The network engineer turns on IPv6 in the VPC and in the private subnets.Which solution will meet these requirements?

A. Create an internet gateway and a NAT gateway in the VPC

B. Create an internet gateway and a NAT instance in the VPC

C. Create an egress-only Internet gateway in the VP Add a route to the existing subnet route tables to point IPv6 traffic to the egress-only internet gateway

D. Create an egress-only internet gateway in the VPC

View answer

Correct Answer: C

Question #67

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #68

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application LoadBalancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.Which solution will meet these requirements?

A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443

B. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443

C. Create a VPC Reachability Analyzer path on port 443

D. Create a VPC Reachability Analyzer path on port 443

View answer

Correct Answer: D

Question #69

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are namedVPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. n the shared VPC, replace the VPC attachment with a VPN attachment

B. nable transit gateway appliance mode on the VPC attachment in VPC A and VPC B

C. nable transit gateway appliance mode on the VPC attachment in the shared VPC

D. n the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #70

A data analytics company has a 100-node high performance computing (HPC) cluster. The HPC cluster is for parallel data processing and is hosted in a VPC in the AWS Cloud. As part of the data processing workflow, the HPC cluster needs to perform several DNS queries to resolve and connect to Amazon RDS databases, Amazon S3 buckets, and on-premises data stores that are accessible through AWS Direct Connect. The HPC cluster can increase in size by five to seven times during the company's peak event at the end of the year.The company is using two Amazon EC2 instances as primary DNS servers for the VPC. The EC2 instances are configured to forward queries to the default VPC resolver for Amazon Route 53 hosted domains and to the on- premises DNS servers for other on-premises hosted domain names. The company notices job failures and finds that DNS queries from the HPC cluster nodes failed when the nodes tried to resolve RDS and S3 bucket endpoints.Which architectural change should a network engineer implement to provide the DNS service in the MOST scalable way?

A. Scale out the DNS service by adding two additional EC2 instances in the VPC

B. Scale up the existing EC2 instances that the company is using as DNS servers

C. Create Route 53 Resolver outbound endpoints

D. Create Route 53 Resolver inbound endpoints

View answer

Correct Answer: C

Question #71

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #72

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #73

A company's development team has created a new product recommendation web service. The web service is hosted in a VPC with a CIDR block of 192.168.224.0/19. The company has deployed the web service on Amazon EC2 instances and has configured an Auto Scaling group as the target of a Network Load Balancer (NLB).The company wants to perform testing to determine whether users who receive product recommendations spend more money than users who do not receive product recommendations. The company has a big sales event in 5 days and needs to integrate its existing production environment with the recommendation engine by then. The existing production environment is hosted in a VPC with a CIDR block of 192.168.128.A network engineer must integrate the systems by designing a solution that results in the least possible disruption to the existing environments.Which solution will meet these requirements?

A. Create a VPC peering connection between the web service VPC and the existing production VPC

B. Ask the development team of the web service to redeploy the web service into the production VPC and integrate the systems there

C. Create a VPC endpoint service

D. Create a transit gateway in the existing production environment

View answer

Correct Answer: C

Question #74

A marketing company is using hybrid infrastructure through AWS Direct Connect links and a software- defined wide area network (SD-WAN) overlay to connect its branch offices. The company connects multiple VPCs to a third-party SD-WAN appliance transit VPC within the same account by using AWS Site-to-Site VPNs.The company is planning to connect more VPCs to the SD-WAN appliance transit VPC. However, the company faces challenges of scalability, route table limitations, and higher costs with the existing architecture. A network engineer must design a solution to resolve these issues and remove dependencies.Which solution will meet these requirements with the LEAST amount of operational overhead?

A. onfigure a transit gateway to attach the VPCs

B. onfigure a transit gateway to attach the VPCs

C. onfigure VPC peering between the VPCs and the third-party SD-WAN appliance transit VPC

D. onfigure a transit gateway to attach the VPCs

View answer

Correct Answer: A

Question #75

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #76

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #77

A company hosts a public hosted zone in Amazon Route 53. The company wants to configure DNS Security Extensions (DNSSEC) signing for the public hosted zone. All the company's business-critical applications are running in the us-west-2 Region.The company has created a symmetric, customer managed, single-Region key in us-west-2 by using AWS Key Management Service (AWS KMS). A network engineer finds that the existing AWS KMS key cannot be used to create a key-signing key (KSK).How can the network engineer resolve this issue?

A. Recreate a symmetric, customer managed, multi-Region key in the us-east-1 Region

B. Recreate a symmetric, customer managed, single-Region key in us-west-2

C. Recreate an asymmetric, customer managed key with an ECC_NIST_P256 key spec in the us-east-1 Region

D. Recreate an asymmetric, customer managed key with an ECC_NIST_P256 key spec in us-west-2

View answer

Correct Answer: c

Question #78

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #79

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic.Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic.What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC

B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC

C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VP

D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs

View answer

Correct Answer: B

Question #80

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.A network engineer must implement a load balancing strategy that meets these requirements.Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Use AWS App Mesh load balancing

D. Retrieve client IP addresses by using the X-IP-Source header

E. Use an Application Load Balancer

View answer

Correct Answer: BE

Question #81

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #82

A company wants to improve visibility into its AWS environment. The AWS environment consists of multiple VPCs that are connected to atransit gateway. The transit gateway connects to an on-premises data center through an AWS Direct Connect gateway and a pair of redundant Direct Connect connections that use transit VIFs. The company must receive notification each time a new route is advertised to AWS from on premises over Direct Connect.

A. Enable Amazon CloudWatch metrics on Direct Connect to track the received routes

B. Onboard Transit Gateway Network Manager to Amazon CloudWatch Logs Insights

C. Configure an AWS Lambda function to periodically check the routes on the Direct Connect gateway and to send notifications when routes change

D. Enable Amazon CloudWatch Logs on the transit VIFs to track the received routes

View answer

Correct Answer: B

Question #83

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #84

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #85

A company's network engineer is designing an active-passive connection to AWS from two on-premises data centers. The company has set up AWS Direct Connect connections between the on-premises data centers and AWS. From each location, the company is using a transit VIF that connects to a Direct Connect gateway that is associated with a transit gateway.The network engineer must ensure that traffic from AWS to the data centers is routed first to the primary data center. The traffic should be routed to the failover data center only in the case of an outage.Which solution will meet these requirements?

A. Set the BGP community tag for all prefixes from the primary data center to 7224:7100

B. Set the BGP community tag for all prefixes from the primary data center to 7224:7300

C. Set the BGP community tag for all prefixes from the primary data center to 7224:9300

D. Set the BGP community tag for all prefixes from the primary data center to 7224:9100

View answer

Correct Answer: B

Question #86

A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company recently experienced a network security breach. A network engineer must collect and analyze logs that include the client IP address, target IP address, target port, and user agent of each user that accesses the application.What is the MOST operationally efficient solution that meets these requirements?

A. Configure the ALB to store logs in an Amazon S3 bucket

B. Configure the ALB to push logs to Amazon Kinesis Data Streams

C. Configure Amazon Kinesis Data Streams to stream data from the ALB to Amazon OpenSearch Service (Amazon Elasticsearch Service)

D. Configure the ALB to store logs in an Amazon S3 bucket

View answer

Correct Answer: C

Question #87

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #88

A company is using a NAT gateway to allow internet connectivity for private subnets in a VPC in the us-west-2 Region. After a security audit, the company needs to remove the NAT gateway.In the private subnets, the company has resources that use the unified Amazon CloudWatch agent. A network engineer must create a solution to ensure that the unified CloudWatch agent continues to work after the removal of the NAT gateway.Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

A. Validate that private DNS is enabled on the VPC by setting the enableDnsHostnames VPC attribute and the enableDnsSupport VPC attribute to true

B. Create a new security group with an entry to allow outbound traffic that uses the TCP protocol on port 443 to destination 0

C. Create a new security group with entries to allow inbound traffic that uses the TCP protocol on port 443 from the IP prefixes of the private subnets

D. Create the following interface VPC endpoints in the VPC: com

E. Create the following interface VPC endpoint in the VPC: com

F. Associate the VPC endpoint or endpoints with route tables that the private subnets use

View answer

Correct Answer: ACD

Question #89

A company has a data center in the us-west-1 Region with a 10 Gbps AWS Direct Connect dedicated connection to a Direct Connect gateway. There are two private VIFs from the same data center location in us-west-1 that are attached to the same Direct Connect gateway.VIF 1 advertises 172.16.0.0/16 with an AS PATH attribute value of 65000. VIF 2 advertises 172.16.1.0/24 with an AS PATH attribute value of 65000 65000 65000.How will AWS route traffic to the data center for traffic that has a destination address within the 172.16.1.0/24 network range?

A. AWS will route all traffic by using VIF 1

B. AWS will route all traffic by using VIF 2

C. AWS will use both VIFs for routing by using a round-robin policy

D. AWS will use flow control to balance the traffic between the two VIFs

View answer

Correct Answer: B

Question #90

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups.The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. reate VPC flow logs in a custom format

B. reate VPC flow logs in a custom format

C. reate VPC flow logs in the default format

D. reate VPC flow logs in a custom format

View answer

Correct Answer: D

Question #91

A company has a single VPC in the us-east-1 Region. The company is planning to set up a new VPC in the us-east-2 Region. The existing VPC has an AWS Site-to-Site VPN connection to the company's on-premises environment and uses a

A. Create a new virtual private gateway in us-east-1

B. Create a transit gateway in us-east-1 and in us-east-2

C. Create a new virtual private gateway in us-east-2

D. Create a transit gateway in us-east-1

View answer

Correct Answer: B

Question #92

A media company is implementing a news website for a global audience. The website uses Amazon CloudFront as its content delivery network. The backend runs on Amazon EC2 Windows instances behind an Application Load Balancer (ALB). The instances are part of an Auto Scaling group. The company's customers access the website by using service example com as the CloudFront custom domain name. The CloudFront origin points to an ALB that uses service-alb.example.com as the domain name.The company's security policy requires the traffic to be encrypted in transit at all times between the users and the backend.Which combination of changes must the company make to meet this security requirement? (Choose three.)

A. Create a self-signed certificate for service

B. Create a certificate for service

C. Create a certificate with any domain name by using AWS Certificate Manager (ACM) for the EC2 instances

D. Create a public certificate from a third-party certificate provider with any domain name for the EC2 instances

E. Create a certificate for service-alb

F. Create a self-signed certificate for service-alb

View answer

Correct Answer: BDE

Question #93

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #94

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #95

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

Question #96

A company wants to migrate its DNS registrar and DNS hosting to Amazon Route 53. The company website receives tens of thousands of visits each day, and the company's current DNS provider cannot keep up. The company wants to migrate as quickly as possible but cannot tolerate any downtime.Which solution will meet these requirements?

A. Transfer the domain name to Route 53

B. Copy all DNS records from the existing DNS servers to a Route 53 private hosted zone

C. Transfer the domain name to Route 53

D. Copy all DNS records from the existing DNS servers to a Route 53 public hosted zone

View answer

Correct Answer: D

Question #97

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format

B. Create VPC flow logs in a custom format

C. Create VPC flow logs in a custom format

D. Create VPC flow logs in a custom format

View answer

Correct Answer: C

Question #98

A company has hundreds of Amazon EC2 instances that are running in two production VPCs across all Availability Zones in the us-east-1 Region. The production VPCs are named VPC A and VPC B.A new security regulation requires all traffic between production VPCs to be inspected before the traffic is routed to its final destination. The company deploys a new shared VPC that contains a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs to route traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company notices that the transit gateway is dropping the traffic whenever the traffic is between two Availability Zones.What should a network engineer do to fix this issue with the LEAST management overhead?

A. In the shared VPC, replace the VPC attachment with a VPN attachment

B. Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC

C. Enable transit gateway appliance mode on the VPC attachment in the shared VP

D. In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B

View answer

Correct Answer: C

Question #99

A company has deployed an AWS Network Firewall firewall into a VPC. A network engineer needs to implement a solution to deliver Network Firewall flow logs to the company's Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster in the shortest possible time.Which solution will meet these requirements?

A. Create an Amazon S3 bucket

B. Create an Amazon Kinesis Data Firehose delivery stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination

C. Configure flow logs for the firewall

D. Create an Amazon Kinesis data stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination

View answer

Correct Answer: B

Question #100

A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway

B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC

C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs

D. Create a transit gateway

View answer

Correct Answer: C

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free AWS ANS-C02 Practice Questions & Answers 2026 Part4

View The Updated AWS Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free AWS ANS-C02 Practice Questions & Answers 2026 Part4

View The Updated AWS Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now