ANS-C01 Question Bank · Latest 50 Questions Free Preview (Page 4/5)
Questions 31–40 of the latest 50 ANS-C01 questions (5 pages total), with answers and explanations, no login required. Practice all 690 questions online.
Question 31 · No. 671 · Single choice
A company uses AWS Cloud WAN as a primary connectivity solution to establish communication between VPCs in a multi-account and multi-Region environment. The company has created an attachment policy statement in the AWS Cloud WAN core network policy. The attachment policy requires acceptance for new VPC attachments, regardless of the segment that the new VPC attachment needs to be associated with. The company wants to automate acceptance for new VPC attachments based on specific conditions. The company creates an AWS Lambda function to check for the specific conditions. A network engineer must integrate the Lambda function with the company’s existing architecture. Which solution will meet these requirements in the MOST cost-effective way?
- A. Update the AWS Cloud WAN core network policy to create a network function group. Select the require acceptance option. Create a service insertion segment action that targets the Lambda function.
- B. Create an Amazon EventBridge rule to match AWS Network Manager events for the VPC attachments. Configure the EventBridge rule to invoke the Lambda function when the rule matches.
- C. Use Amazon CloudWatch logs to stream AWS CloudTrail logs to an Amazon Kinesis data stream. Configure an event source mapping to target the Lambda function to process the event stream.
- D. Configure AWS Network Manager as a source for a pipe in Amazon EventBridge Pipes. Create a filter in the pipe for new VPC attachments. Set the Lambda function as the target of the pipe.
Answer: B
Explanation: Option B is the most cost-effective solution because EventBridge rules have a generous free tier (no charge for the first 1.5 million events per month) and only invoke the Lambda function when matching VPC attachment events occur, meaning there are no idle or per-packet costs. Option A is extremely expensive because a network function group with service insertion would invoke Lambda for every network packet flowing through Cloud WAN. Option C is more costly because it involves multiple services (CloudTrail, CloudWatch Logs, Kinesis Data Streams) with separate pricing for each. Option D uses EventBridge Pipes which, while functional, has additional costs compared to standard EventBridge rules. AWS Network Manager publishes events for VPC attachments that EventBridge can natively match, making this an event-driven architecture that minimizes costs by only running the Lambda function when needed.
Question 32 · No. 672 · Single choice
A company has an AWS Direct Connect connection between an on-premises data center and a single private VIF in the company's VPC. The VPC contains resources that the company has secured by using security groups and network ACLs. A network engineer adds a subnet in the company's data center during a maintenance period. The network engineer notices that the BGP status for the private VIF is down after the maintenance activity. The Direct Connect connection was fully operational before the maintenance period. The network team verifies that layer 2 connectivity is working between the company’s router and the Direct Connect router. The networking engineer must resolve this issue. Which solution will meet this requirement?
- A. Use route filters or aggregation on the company's router to limit the routes that are advertised from the company’s router.
- B. Add a route policy to the company's router to ensure that all routes that are advertised from the company's router are tagged with a correct BGP community string that begins in "7224".
- C. Revalidate the physical and logical path between the company's router and the Direct Connect router, including any Direct Connect Partner.
- D. Ensure that security groups and network ACLs allow TCP communications to port 179.
Answer: A
Explanation: When a new subnet is added in the on-premises data center, it results in additional routes being advertised via BGP to AWS through the Direct Connect connection. AWS Direct Connect has a limit on the number of prefixes (routes) that can be advertised over a private VIF (default limit is 100 routes). When this limit is exceeded, the BGP session can go down or routes will be rejected. Since Layer 2 connectivity is confirmed working and the maintenance activity specifically involved adding a new subnet (which means more routes would be advertised), the most likely cause of the BGP session going down is that the route advertisement limit has been exceeded. The solution is to use route filters or route aggregation on the company's router to consolidate and limit the number of routes being advertised to AWS, keeping within the AWS limits.
Question 33 · No. 673 · Multiple choice
A company has two on-premises data center locations named Data Center 1 and Data Center 2. Each data center has a company-managed customer router. Both data centers have a dedicated AWS Direct Connect connection to the same Direct Connect gateway that uses a private VIF. The company enabled Direct Connect SiteLink when the company created each private VIF. The company uses SiteLink to send data from one Direct Connect location to the other, bypassing AWS Regions. Data Center 2 hosts an application that a partner company needs to access. The partner wants to access the application from the partner's own data center by using the Direct Connect network. The company's network engineer needs to create a separate isolated network for the partner to establish connectivity between Data Center 2 and the partner's data center. Which combination of steps will meet these requirements? (Choose two.)
- A. Create a new Direct Connect gateway for the partner in an AWS account. Share the account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VIF with the new Direct Connect gateway.
- B. Provision a separate transit VIF for the partner on the Direct Connect connection at Data Center 2. Connect the transit VIF to the partner-specific Direct Connect gateway.
- C. Share the company's AWS account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VIF with the existing Direct Connect gateway.
- D. Provision a separate private VIF for the partner on the Direct Connect connection at Data Center 2. Connect the private VIF to the partner-specific Direct Connect gateway. Enable SiteLink.
- E. Provision a separate public VIF for the partner on the Direct Connect connection at Data Center 2. Connect the public VIF to the partner-specific Direct Connect gateway. Enable SiteLink.
Answer: A, D
Explanation: To meet the requirements of providing an isolated network for the partner while establishing connectivity between Data Center 2 and the partner's data center, we need two key components: (1) A new Direct Connect gateway dedicated to the partner to ensure isolation from the company's existing network infrastructure (which has Data Center 1 and Data Center 2 connections). (2) SiteLink-enabled connections on this new DXGW so traffic can flow between Data Center 2 and the partner's data center via AWS backbone, bypassing AWS Regions. Option A creates the partner-specific Direct Connect gateway and allows the partner to create a hosted VIF from their own Direct Connect connection to associate with this new DXGW. Option D provisions a separate private VIF on Data Center 2's Direct Connect connection that associates with the partner-specific DXGW, and enables SiteLink for direct connectivity. Together, A + D create an isolated network where Data Center 2's new VIF and the partner's hosted VIF are both on the same partner-specific DXGW with SiteLink enabled, allowing secure, isolated communication. Option C is incorrect because associating with the existing DXGW breaks isolation. Options B and E are incorrect because transit VIFs typically require a Transit Gateway, and public VIFs cannot be used with SiteLink for private connectivity.
Question 34 · No. 674 · Multiple choice
A company has many VPCs in the us-east-1 Region. The company uses a transit gateway to connect the VPCs to one another. The company recently acquired a smaller company that has a single VPC named VPC-Z. A network engineer needs to onboard VPC-Z to the existing transit gateway. The network engineer notices an IP address overlap between VPC-Z and VPC-A. The network engineer must establish outbound connectivity from VPC-Z to all the company's other VPCs, including VPC-A. Which combination of solutions will meet this requirement? (Choose two.)
- A. Create a new non-overlapping CIDR block in VPC-Z. Create two subnets that use the new CIDR block.
- B. Create a new non-overlapping CIDR block in VPC-A. Create two subnets that use the new CIDR block.
- C. Create a private NAT gateway in VPC-Z in a non-overlapping subnet. Advertise only the non-overlapping VPC-Z CIDR block to the transit gateway route table.
- D. Create a private NAT gateway in VPC-A in a non-overlapping subnet. Advertise only the non-overlapping VPC-A CIDR block to the transit gateway route table.
- E. Create a VPC peering connection between VPC-A and VPC-Z.
Answer: A, C
Explanation: The correct answers are A and C. The issue is that VPC-Z and VPC-A have overlapping CIDR blocks, which prevents direct routing between them via the transit gateway. To solve this: (A) Add a new non-overlapping CIDR block to VPC-Z and create subnets using this CIDR—this provides the address space needed for the NAT gateway. (C) Create a private NAT gateway in VPC-Z using a non-overlapping subnet, and advertise only the non-overlapping VPC-Z CIDR to the transit gateway route table. This way, when resources in VPC-Z (using the overlapping CIDR) initiate outbound traffic to VPC-A or other VPCs, the traffic is routed through the private NAT gateway, which translates the source IP to a non-overlapping VPC-Z address. Other VPCs can then correctly route return traffic back through the NAT gateway. Options B and D focus on VPC-A, but the requirement is outbound connectivity from VPC-Z, so changes to VPC-A don't solve the routing problem from VPC-Z's side. Option E (VPC peering) does not resolve the CIDR overlap issue.
Question 35 · No. 675 · Single choice
A company has a hybrid environment. The company uses AWS Direct Connect with a transit VIF attached to a transit gateway to connect its on-premises location to the AWS Cloud. The company operates from a single AWS account in the us-east-1 Region. The company has a legacy application that runs on premises with the corp.example.com DNS name. The company has created an Amazon Route 53 Resolver outbound endpoint and a Resolver rule in us-east-1 in the AWS account. As part of an expansion, the company creates one more AWS account for a new business unit that operates in us-east-1. The new account has VPCs that are attached to the transit gateway. The new account uses the existing Direct Connect connection to connect to the on-premises location. Applications that run in the new account's VPCs also need to access the on-premises location by using the corp.example.com DNS name. A network engineer needs to identify a solution to resolve the corp.example.com DNS name from the new account. Which solution will meet these requirements MOST cost-effectively?
- A. Create a hosted transit VIF for the new account on the existing Direct Connect connection. In the new account, create a new Route 53 Resolver outbound endpoint. Also in the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the new rule with the VPCs in the new account.
- B. Share the Resolver rule from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). Associate the shared rule with the VPCs in the new account.
- C. Share the Route 53 Resolver outbound endpoint from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). In the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the new rule with the VPCs in the new account.
- D. Create an AWS Site-to-Site VPN connection between the new account and the on-premises location. Attach the Site-to-Site VPN connection to the existing transit gateway. In the new account, create a new Route 53 Resolver outbound endpoint. Also in the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the rule with the VPCs in the new account.
Answer: B
Explanation: Option B is the most cost-effective solution because Route 53 Resolver rules can be shared across AWS accounts using AWS Resource Access Manager (AWS RAM). By sharing the existing Resolver rule from the original account with the new account and associating it with the VPCs in the new account, DNS queries for corp.example.com from the new account's VPCs will be forwarded to the existing outbound endpoint in the original account. Since both VPCs are in the same region (us-east-1) and connected through the transit gateway, the new VPCs can reach the existing outbound endpoint via the transit gateway. This avoids the cost of creating additional infrastructure such as new Resolver endpoints, new Direct Connect connections, or VPN connections.
Question 36 · No. 676 · Multiple choice
A company is using AWS Fargate to deploy many containerized web applications to a VPC. The applications must all be reachable through various DNS names on the standard port for HTTPS traffic. The company uses an Application Load Balancer (ALB) to handle traffic to each of the applications. The company uses the AWS Cloud Development Kit (AWS CDK) to automate the deployment process. The company uses two types of CDK stacks. The company uses one common stack to build the VPC itself and other shared infrastructure. The company also uses a set of application-specific stacks that contain details and logic for each application. The company needs to correctly allocate ALB-related resources between the two types of stacks. Which combination of solutions will provide a repeatable allocation of resources to the common stack and application-specific stacks? (Choose three.)
- A. ALB listener in the common stack
- B. ALB listener in the application-specific stacks
- C. ALB listener host header rule in the common stack
- D. ALB listener host header rule in the application-specific stacks
- E. ALB target group in the common stack
- F. ALB target group in the application-specific stacks
Answer: A, D, F
Explanation: The correct allocation follows the principle of separating shared infrastructure from application-specific resources. The ALB listener should be in the common stack (A) because it represents shared infrastructure - a single HTTPS listener on port 443 that handles traffic for all applications. The ALB listener host header rule should be in the application-specific stacks (D) because each application has its own unique DNS name requiring its own routing rule. The ALB target group should be in the application-specific stacks (F) because each application's Fargate tasks are unique and require their own target group. This separation enables repeatable deployment where common infrastructure is built once and shared, while each application's specific routing logic and targets are defined within their own stack.
Question 37 · No. 677 · Single choice
A company wants to use SSL/TLS certificates that are issued by AWS Certificate Manager (ACM) to secure the company's social media web application. The application runs on backend Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 to manage DNS records. The company needs to integrate ACM with the EC2 instances and Route 53. Which solution will meet this requirement?
- A. Request a public certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the public certificate Configure the A record in Route 53 to point to the ALB alias.
- B. Request a private certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the private certificate. Configure the A record in Route 53 to point to the ALB domain name.
- C. Request two private certificates from ACM for the domain name that is configured in Route 53. Configure the ALB to use one private certificate. Configure the A record in Route 53 to point to the ALB alias. Configure the backend EC2 instances to use the second private certificate.
- D. Request a private certificate and a public certificate from ACM for the domain name that is configured in Route 53. Configure the ALB to use the public certificate. Configure the A record in Route 53 to point to the ALB domain name. Configure the backend EC2 instances to use the private certificate.
Answer: A
Explanation: For a public-facing social media web application, a public SSL/TLS certificate from ACM is required. The ALB should be configured with this public certificate to handle HTTPS connections from external users. The Route 53 A record should point to the ALB alias (not the domain name), as this is the AWS recommended best practice for ALB integration with Route 53. EC2 backend instances behind an ALB do not need ACM certificates because the ALB handles SSL/TLS termination. Private certificates (options B, C, D) are only for internal resources and cannot be used to secure public-facing web applications.
Question 38 · No. 678 · Single choice
A company has several application accounts that include dual-stack VPCs. The company wants to implement a centralized DNS solution that supports IPv6. A network engineer deploys a shared services VPC. The network engineer sets up network connectivity between the company's application VPCs, the shared services VPC, and the company's on-premises environment with support for IPv4 and IPv6 traffic. The network engineer is using Amazon Route 53 to implement a centralized DNS solution. The network engineer needs to ensure that resources in the application VPCs have the ability to perform DNS queries against an on-premises DNS resolver. Which solution will meet this requirement?
- A. Create a Route 53 Resolver outbound endpoint in the shared services VPC within a dual-stack subnet. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts.
- B. Create a Route 53 Resolver inbound endpoint in the shared services VPC within a subnet that supports only IPv6. Use AWS Resource Access Manager (AWS RAM) to share the endpoint to the application accounts.
- C. Create a Route 53 Resolver outbound endpoint within a dual-stack subnet in each application VPUse AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts.
- D. Create a Route 53 Resolver inbound endpoint within a subnet that supports only IPv4 in each application VPC. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the shared services account.
Answer: A
Explanation: The correct answer is A because the requirement is for resources in application VPCs to perform DNS queries against an on-premises DNS resolver. To forward DNS queries FROM AWS VPCs TO an on-premises DNS resolver, a Route 53 Resolver OUTBOUND endpoint is needed. The endpoint must be deployed in the shared services VPC for centralized DNS architecture, within a dual-stack subnet to support both IPv4 and IPv6 traffic as required. AWS Resource Access Manager (AWS RAM) should be used to share the resolver rules with the application accounts so they can forward DNS queries through the centralized outbound endpoint. Option B is incorrect because inbound endpoints allow on-premises to query AWS VPCs (opposite direction), and it specifies IPv6-only subnet. Option C is incorrect because creating endpoints in each application VPC defeats the purpose of a centralized solution. Option D is incorrect for multiple reasons: wrong endpoint type (inbound), IPv4-only subnet (no IPv6 support), and not centralized.
Question 39 · No. 679 · Single choice
A company has multiple firewalls and ISPs for its on-premises data center. The company has a single AWS Site-to-Site VPN connection from the company's on-premises data center to a transit gateway. A single ISP services the Site-to-Site VPN connection. Multiple VPCs are attached to the transit gateway. A customer gateway that the Site-to-Site VPN connection uses fails. Connectivity is completely lost, but the company's network team does not receive a notification. The network team needs to implement redundancy within a week in case a single customer gateway fails again. The team wants to use an Amazon CloudWatch alarm to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic if any tunnel of the Site-to-Site VPN connection fails. Which solution will meet these requirements MOST cost-effectively?
- A. Replace the existing customer gateway with a new router. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of 0 for the alarm.
- B. Use a second customer gateway and a second ISP. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of less than 1 for the alarm.
- C. Add an AWS Direct Connect connection to the existing Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of failed for the alarm.
- D. Use a second customer gateway with the existing ISP. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of unavailable for the alarm.
Answer: B
Explanation: Option B is the correct answer because it meets all requirements. The TunnelState metric for AWS Site-to-Site VPN has values of 0 (DOWN) or 1 (UP), so 'less than 1' is the correct alarm threshold to detect tunnel failures. Option B provides true redundancy with a second customer gateway AND a second ISP, ensuring that if any single customer gateway or ISP fails, connectivity is maintained. Option A only replaces the existing customer gateway, so it doesn't provide true redundancy (still only one physical device). Option C uses AWS Direct Connect, which is much more expensive than VPN and not cost-effective. Option D uses 'unavailable' as the TunnelState alarm value, which is not a valid value for the TunnelState metric (only 0 and 1 are valid). Therefore, Option B is the most cost-effective solution that meets all the requirements: redundancy, CloudWatch alarm for tunnel failures, and SNS notification.
Question 40 · No. 680 · Single choice
A company operates in the us-east-1 Region and the us-west-1 Region. The company is designing a solution to connect an on-premises data center to the company's AWS environment in us-east-1. The solution uses two AWS Direct Connect connections. Traffic from us-west-1 to the data center needs to traverse the Direct Connect connections. A network engineer needs to set up active-passive functionality across the two Direct Connect connections by using a Direct Connect gateway to influence inbound traffic from VPCs that are in us-west-1 to the data center. Which solution will meet these requirements?
- A. At the data center, set the local preference for the primary connection to be higher than the local preference for the secondary connection.
- B. Use AS path prepending to set the AS path on the primary connection to be longer than the AS path on the secondary connection.
- C. Use local preference BGP community tags to apply the 7224:7300 local preference BGP community tag to the prefixes for the primary connection. Apply the 7224:7100 local preference BGP community tag to the prefixes for the secondary connection.
- D. Use local preference BGP community tags to apply the 7224:9300 local preference BGP community tag to the prefixes for the primary connection. Apply the 7224:9100 local preference BGP community tag to the prefixes for secondary connection.
Answer: C
Explanation: Option C uses the correct local preference BGP community tags for active-passive Direct Connect gateway setup. The 7224:7300 community sets a higher local preference (300) for the primary connection, while 7224:7100 sets a lower local preference (100) for the secondary connection. This makes the primary connection preferred for inbound traffic from VPCs in us-west-1 to the data center, achieving the required active-passive functionality. Option A affects outbound traffic from the data center (not inbound from VPCs). Option B (AS path prepending) influences inbound routing but cannot guarantee active-passive behavior with a Direct Connect gateway. Option D uses incorrect community tags (7224:9xxx series), which are not used for local preference configuration in this scenario.