ANS-C01 Question Bank · Latest 50 Questions Free Preview (Page 3/5)
Questions 21–30 of the latest 50 ANS-C01 questions (5 pages total), with answers and explanations, no login required. Practice all 690 questions online.
Question 21 · No. 661 · Single choice
A logistics company has multiple VPCs in an AWS Region. The company uses a transit gateway to connect the VPCs. The company has several on-premises offices that connect to the transit gateway by using AWS Site-to-Site VPN connections over the internet. The company has configured one transit gateway VPN attachment for each office. Route propagation is enabled on all route tables. Each Site-to-Site VPN connection uses two tunnels in an active-passive configuration. The company configured each office with appropriate static routes on both the Site-to-Site VPN connection and the office’s customer gateway. The company wants to use both IPsec tunnels of every office to maximize the overall VPN connection bandwidth. Which design changes are necessary to meet these requirements?
- A. Create an AWS Transit Gateway Connect attachment for each office Use the existing VPN attachments as the transport for the new Connect attachments. Set up a Generic Routing
Encapsulation (GRE) tunnel on each customer gateway that terminates on the Connect attachment for each office. Move the static routes from the transit gateway VPN attachment to the customer gateway for the transit gateway Connect attachment.
- B. Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Enable ECMP on the Site-to-Site VPN connection. Ensure static routes on the customer gateways have equal metrics and administrative distance.
- C. Enable equal-cost multi-path (ECMP) routing on the transit gateway. (Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Remove related static routes from the customer gateways.
- D. Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Ensure the customer gateway applies the correct community strings to give the transit gateway the ability to perform ECMP forwarding.
Answer: C
Question 22 · No. 662 · Single choice
A global company is establishing network connections between the company's primary and secondary data centers and a VPC. A network engineer needs to maximize resiliency and fault tolerance for the connections. The network bandwidth must be greater than 10 Gbps. Which solution will meet these requirements MOST cost-effectively?
- A. Set up a 100 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up a second 100 Gbps connection at the secondary data center that terminates at a second Direct Connect location. Ensure the connections are managed by separate providers.
- B. Set up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up a second 10 Gbps connection at the secondary data center that terminates at a second Direct Connect location. Ensure the connections are managed by separate providers.
- C. Set up two 10 Gbps connections at the primary data center that terminate at one AWS Direct Connect location. Ensure the connections are managed by separate providers. Set up two 10 Gbps connections at the secondary data center that terminate at a second Direct Connect location. Ensure the connections are managed by separate providers.
- D. Set up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up an AWS Site-to-Site VPN connection at the secondary data center that terminates at a virtual private gateway in the same Region as the company’s VPC.
Answer: C
Question 23 · No. 663 · Multiple choice
A company has an application VPC and a networking VPC that are connected through VPC peering. The networking VPC contains a Network Load Balancer (NLB). The application VPC contains Amazon EC2 instances that run an application. The EC2 instances are part of a target group that is associated with the NLB in the networking VPC. The company configures a third VPC and peers it to the networking VPC. The new VPC contains a new version of the existing application. The new version of the application runs on new EC2 instances in an application subnet. The new version of the application runs in a different Availability Zone than that original version of the application. The company needs to establish connectivity between the NLB and the new version of the application. Which combination of steps will meet this requirement? (Choose three.)
- A. Register the new application EC2 instances with the NLB by using the instance IDs.
- B. Register the new application EC2 instances with the NLB by using instance IP addresses.
- C. Configure the NLB in the Availability Zone where the new application EC2 instances run.
- D. Configure the NLB to use zonal shift.
- E. Configure the network ACL for the application subnet in the new VPC to allow outbound connections.
- F. Configure the network ACL for the application subnet in the new VPC to allow inbound connections and outbound connections.
Answer: B, C, F
Explanation: To establish connectivity between the Network Load Balancer (NLB) in the networking VPC and the new version of the application running on EC2 instances in the third VPC, we need to follow these steps: First, the NLB must be configured to recognize the new EC2 instances. Since the NLB supports IP-based target registration, the new EC2 instances can be registered using their IP addresses (Choice B). Second, the NLB must be configured in the Availability Zone where the new EC2 instances are running to ensure proper routing of traffic (Choice C). Finally, the network ACL for the application subnet in the new VPC must allow both inbound and outbound connections to ensure the traffic can flow between the NLB and the EC2 instances (Choice F). Choices A, D, and E are incorrect because registering instances by ID is not supported for cross-VPC peering, zonal shift is unrelated to this scenario, and allowing only outbound connections is insufficient.
Question 24 · No. 664 · Single choice
A company is planning to use an AWS Transit Gateway hub and spoke architecture to migrate to AWS. The current on-premises multi-protocol label switching (MPLS) network has strict controls that enforce network segmentation by using MPLS VPNs. The company has provisioned two 10 Gbps AWS Direct Connect connections to provide resilient, high-speed, low-latency connectivity to AWS. A security engineer needs to apply the concept of network segmentation to the AWS environment to ensure that virtual routing and forwarding (VRF) is logically separated for each of the company's software development environments. The number of MPLS VPNs will increase in the future. On-premises MPLS VPNs will have overlapping address space. The company's AWS network design must support overlapping address space for the VPNs. Which solution will meet these requirements with the LEAST operational overhead?
- A. Deploy a software-defined WAN (SD-WAN) head-end virtual appliance and an SD-WAN controller into a Transit Gateway Connect VPC. Configure the company's edge routers to be managed by the new SD-WAN controller and to use SD-WAN to segment the traffic into the defined segments for each of the company's development environments.
- B. Configure IPsec VPNs on the company edge routers for each MPLS VPN for each of the company's development environments. Attach each IPsec VPN tunnel to a discrete MPLS VPN. Configure AWS Site-to-Site VPN connections that terminate at a transit gateway for each MPLS VPN. Configure a transit gateway route table that matches the MPLS VPN for each Transit Gateway VPN attachment.
- C. Create a transit VPC that terminates at the AWS Site-to-Site VRF-aware IPsec VPN. Configure IPsec VPN connections to each VPC for each of the company's development environment VRFs.
- D. Configure a Transit Gateway Connect attachment for each MPLS VPN between the company's edge routers and Transit Gateway. Configure a transit gateway route table that matches the MPLS VPN for each of the company's development environments.
Answer: D
Explanation: The correct solution is to configure a Transit Gateway Connect attachment for each MPLS VPN. This allows the company to maintain network segmentation by mapping each MPLS VPN to a corresponding Transit Gateway route table, ensuring logical separation of VRFs for each development environment. This approach also supports overlapping address spaces and minimizes operational overhead by leveraging AWS Transit Gateway’s native capabilities for managing multiple VPN connections efficiently.
Question 25 · No. 665 · Single choice
A company is planning to host a secure web application across multiple Amazon EC2 instances. The application will have an associated DNS domain in an Amazon Route 53 hosted zone. The company wants to protect the domain from DNS poisoning attacks. The company also wants to allow web browsers to authenticate into the application by using a trusted third party. Which combination of actions will meet these requirements?
- A. Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install self-signed X.509 certificates on the EC2 instances.
- B. Configure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install X 509 certificates that are signed by a public certificate authority on the EC2 instances.
- C. Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install X.509 certificates that are signed by a public certificate authority on the EC2 instances.
- D. Configure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install self-signed X.509 certificates on the EC2 instances.
Answer: C
Explanation: To protect the domain from DNS poisoning attacks, DNSSEC (Domain Name System Security Extensions) is required. This eliminates options B and D, which do not mention DNSSEC. Additionally, to allow web browsers to authenticate using a trusted third party, the EC2 instances need X.509 certificates signed by a public certificate authority (CA), as self-signed certificates are not trusted by browsers. This eliminates option A. Therefore, the correct choice is C.
Question 26 · No. 666 · Single choice
A company has multiple AWS Site-to-Site VPN connections between an on-premises environment and multiple VPCs. The Site-to-Site VPN connections use virtual private gateways and are configured with IPv4 addresses. The company hosts several internal applications in the VPCs. Application users have reported that the applications are performing slowly. A network engineer notices excessive latency in the network path that the VPN connections use. The network engineer needs to resolve the excessive latency. Which solution will meet this requirement?
- A. Use AWS Global Accelerator to deploy an accelerator on the existing Site-to-Site VPN connections.
- B. Deploy a transit gateway and a new accelerated Site-to-Site VPN connection.
- C. Replace the existing Site-to-Site VPN connections with new Site-to-Site VPN connections that use IPv6.
- D. Replace the existing Site-to-Site VPN connections with AWS PrivateLink connections.
Answer: B
Explanation: The problem involves excessive latency in the network path used by the Site-to-Site VPN connections. AWS recommends using a transit gateway with an accelerated Site-to-Site VPN connection to improve performance and reduce latency. This solution centralizes connectivity and provides a more efficient routing mechanism for multiple VPCs and on-premises networks. The other options do not directly address the issue of latency or are not suitable replacements for the existing setup.
Question 27 · No. 667 · Multiple choice
A company uses AWS Site-to-Site VPN connections to encrypt traffic between the company's on-premises location and a single VPC. The Site-to-Site VPN connections use two 1 Gbps AWS Direct Connect connections with public VIFs. The company plans to add 15 additional VPCs in the same AWS Region. The company must maintain the same level of encryption that the Site-to-Site VPN connections currently provide for each connection between the on-premises location and the new VPCs. The new connections must not use public IP addresses. The bandwidth of the Site-to-Site VPN connections will remain less than the current provisioned speed. Which combination of steps will meet these requirements with LEAST operational overhead? (Choose three.)
- A. Create a transit gateway and a Direct Connect gateway. Associate the transit gateway with the Direct Connect gateway. Attach all the new VPCs to the transit gateway.
- B. For each new VPC, create a new Direct Connect private VIF to a Direct Connect gateway. Associate all VPCs with the Direct Connect gateway.
- C. Assign a private IP CIDR block to the transit gateway.
- D. Assign a public IP CIDR block to the transit gateway.
- E. Create a transit VIF to the Direct Connect gateway. Create a Site-to-Site VPN private IP VPN connection.
- F. Create a public VICreate a Site-to-Site VPN public IP VPN connection.
Answer: A, C, E
Explanation: To meet the requirements with the least operational overhead, the best solution is to use a transit gateway and Direct Connect gateway combination. This will ensure secure and scalable connectivity between the on-premises location and multiple VPCs. Additionally, assigning a private IP CIDR block ensures the connections do not use public IPs, as required. Finally, creating a transit VIF and a Site-to-Site VPN with private IP addresses ensures traffic encryption without relying on public IPs. Options A, C, and E fulfill these conditions by providing a scalable, secure, and operationally efficient solution that avoids public IPs while minimizing management complexity.
Question 28 · No. 668 · Single choice
A company wants to analyze TCP internet traffic. The traffic originates from Amazon EC2 instances in the company’s VPC. The EC2 instances initiate connections through a NAT gateway. The company wants to capture data about the traffic including source and destination IP addresses ports, and the first 8 bytes of the TCP segments of the traffic. The company needs to collect, store, and analyze all the required data points. Which solution will meet these requirements?
- A. Configure the EC2 instances to be VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights
- B. Configure the NAT gateway to be a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon S3 bucket. Analyze the data by using Amazon Athena.
- C. Turn on VPC Flow Logs for the EC2 instances. Specify the default format and set Amazon CloudWatch Logs as the log destination. Analyze the flow log data by using CloudWatch Logs Insights.
- D. Turn on VPC Flow Logs for the EC2 instances. Specify a custom format and set Amazon S3 as the log destination. Analyze the flow log data by using Amazon Athena.
Answer: B
Explanation: The requirement is to capture detailed TCP traffic data, including source and destination IP addresses, ports, and the first 8 bytes of the TCP segments. VPC Traffic Mirroring is specifically designed for capturing such detailed network traffic. Among the options, only option B configures the NAT gateway as a traffic mirror source and deploys software on the traffic mirror target to forward the captured data to an Amazon S3 bucket, which can then be analyzed using Amazon Athena. This solution meets all the specified requirements for capturing, storing, and analyzing the TCP traffic data.
Question 29 · No. 669 · Single choice
A company notices VPC flow log data that shows some company traffic is going to malicious websites. The company identifies the Amazon EC2 instance that is sending traffic to the malicious websites and determines that the application that runs on the instance is compromised. Similar security events have happened multiple times at the company in the past. The company reacted to previous security events by blocking the malicious websites. The company needs a scalable solution to prevent similar security events in the future. Which solution will meet this requirement with the LEAST operational overhead?
- A. Set up an EC2 instance to run firewall software in the VPC. Route all traffic through the firewall EC2 instance. Maintain a list of known malicious websites on the firewall instance. Disable the source and destination checks for the firewall instance.
- B. Set up an Application Load Balancer (ALB) in front of the problematic EC2 instance. Enable AWS WAF on the EC2 instance.
- C. Set up an Application Load Balancer (ALB) in front of the problematic EC2 instance. Enable AWS WAF on the ALB.
- D. Set up an Amazon Route 53 DNS Firewall rule group. Create a domain list that contains only the domains the application must communicate with to function. Add the domain list to the rule group. Associate the rule group with the VPC.
Answer: D
Explanation: Option D is the best choice because Amazon Route 53 DNS Firewall is a managed service that provides scalable protection with the least operational overhead. By creating a domain list containing only the domains the application needs to communicate with (allowlist approach) and associating it with the VPC, all DNS queries from EC2 instances to malicious websites will be blocked at the DNS level. This prevents instances from resolving and connecting to malicious domains. Option A requires maintaining firewall instances and lists manually (high overhead). Option B is technically incorrect as AWS WAF cannot be enabled directly on EC2 instances. Option C enables WAF on ALB but only protects HTTP/HTTPS traffic at the application layer and doesn't prevent all outbound traffic to malicious sites. DNS Firewall works at the VPC level, scales automatically, and requires no infrastructure maintenance.
Question 30 · No. 670 · Single choice
A company hosts multiple workloads in a single VPC that has public subnets and private subnets. The company establishes an AWS Direct Connect connection to provide connectivity between the company’s on-premises network and the VPC. The company purchases a domain in its AWS account. The domain needs to resolve to a private Application Load Balancer (ALB) for requests that originate from the company's network. The domain needs to resolve to a public ALB for requests that originate from the internet. Which solution will meet these requirements?
- A. Create an Amazon CloudFront distribution for the domain. Create an AWS Lambda@Edge function that inspects each request and routes requests from the internet to the public ALB. Configure the Lambda@Edge function to route requests from the company’s network to the private ALB. Create an Amazon Route 53 public hosted zone for the domain. Include an A record that is configured as an alias that points to the CloudFront distribution.
- B. Create an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALCreate a Route 53 private hosted zone for the domain. Include an alias record that points to the private ALConfigure a Route 53 inbound resolver endpoint on the VPC. Configure the company's network DNS to forward queries for the domain to the endpoint.
- C. Create an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALB. Create an additional alias record for the domain that routes to the private ALB. Associate a geolocation routing policy with the CIDR range of the company’s network.
- D. Deploy new Amazon EC2 instances that host DNS servers in each of the private subnets. Configure the DNS servers to return the IP address of the public ALB for requests from the internet. Configure the DNS servers to return the IP address of the private ALB for requests from the company’s network. Configure a public Amazon Route 53 inbound resolver to forward all requests for the domain to the EC2 instances. Enable client IP preservation.
Answer: B
Explanation: Option B is the correct answer because it implements split-horizon DNS using AWS Route 53, which is the standard AWS pattern for this scenario. It creates two hosted zones: a public hosted zone with an alias to the public ALB (for internet requests), and a private hosted zone with an alias to the private ALB (for internal requests). The Route 53 inbound resolver endpoint on the VPC allows the company's on-premises network (via Direct Connect) to forward DNS queries to AWS and receive answers from the private hosted zone. This way, on-premises users get the private ALB's IP, while internet users get the public ALB's IP. Option A adds unnecessary complexity with CloudFront and Lambda@Edge. Option C incorrectly uses geolocation routing with CIDR ranges, which doesn't work for split-horizon DNS. Option D is overly complex and uses non-standard custom DNS server architecture when native Route 53 features can solve this.