ANS-C01 Question Bank · Latest 50 Questions Free Preview (Page 5/5)
Questions 41–50 of the latest 50 ANS-C01 questions (5 pages total), with answers and explanations, no login required. Practice all 690 questions online.
Question 41 · No. 681 · Single choice
A company hosts a corporate website on Amazon EC2 instances behind a Network Load Balancer (NLB). The NLB has one TLS listener. The company wants to use AWS WAF to enhance security for the website. Which solution will meet this requirement?
- A. Attach an Elastic IP address to the NLB. Associate an AWS WAF web ACL with the Elastic IP address.
- B. Replace the NLB with an Application Load Balancer (ALB). Associate an AWS WAF web ACL with the ALB.
- C. Associate an AWS WAF web ACL with the NLB.
- D. Associate an AWS WAF web ACL with the EC2 instances that are behind the NLB.
Answer: B
Explanation: AWS WAF cannot be directly associated with a Network Load Balancer (NLB). AWS WAF only integrates with specific AWS services: CloudFront, Application Load Balancer (ALB), API Gateway, AWS AppSync, and Amazon Cognito. Since the NLB does not support AWS WAF, the correct solution is to replace the NLB with an Application Load Balancer (ALB) and then associate the AWS WAF web ACL with the ALB. Options A, C, and D are incorrect because AWS WAF cannot be associated with Elastic IPs, NLBs, or EC2 instances directly.
Question 42 · No. 682 · Single choice
A network engineer deploys an Application Load Balancer (ALB) in two Availability Zones. There is one target group. There are four Amazon EC2 instance targets in the first Availability Zone and six EC2 instance targets in the second Availability Zone. During testing, the network engineer notices that the targets in the first Availability Zone receive 40% of the traffic. The targets in the second Availability Zone receive 60% of the traffic. The network engineer needs to update the configuration to prevent traffic from crossing Availability Zones. The network engineer wants to achieve a 50% traffic split across the Availability Zones. Which solution will meet these requirements?
- A. Disable cross-zone load balancing for the target group.
- B. Disable cross-zone load balancing for the ALB.
- C. Disable cross-zone load balancing for all the targets in the first Availability Zone.
- D. Disable cross-zone load balancing for all the targets in the second Availability Zone.
Answer: A
Explanation: For Application Load Balancer (ALB), cross-zone load balancing is configured at the target group level, not the ALB level. In the current scenario, cross-zone load balancing is enabled, which distributes traffic proportionally based on the number of targets in each AZ (4:6 ratio = 40%:60%). By disabling cross-zone load balancing on the target group, each ALB node will only route traffic to targets within its own Availability Zone. Since the ALB distributes incoming traffic equally between its enabled AZs, this results in a 50/50 traffic split, preventing traffic from crossing Availability Zones as required.
Question 43 · No. 683 · Single choice
A company uses an organization in AWS Organizations to manage many AWS accounts that host many VPCs and workloads. The company has an AWS Direct Connect connection between a data center and AWS. The company uses a transit gateway in a central network account to connect the workload VPCs to the data center. The company wants to tag each transit gateway attachment automatically with information from tags that are attached to each requester account VPC. The company provisions an IAM role in every account. The company assigns the IAM role permissions to retrieve the required tag data from the VPCs and a trust policy that allows principals in the central network account to invoke the IAM role. Which solution will meet these requirements?
- A. Configure AWS Identity and Access Management Access Analyzer to monitor the transit gateway for new attachments. Configure IAM Access Analyzer to invoke an AWS Systems Manager runbook that assumes the IAM role in the requester account and tags the attachment with the required information.
- B. Configure an SCP to monitor the transit gateway for new attachments. Configure the SCP to invoke an AWS CloudFormation stack template in the account that requests an attachment to tag the attachment.
- C. Configure Amazon VPC IP Address Manager (IPAM) and register the transit gateway. Configure IPAM to run an AWS CDK function when a new IP address is requested from the transit gateway for a new attachment. Configure the CDK function to assume the IAM role in the requester account and to tag the attachment with the required information.
- D. Configure AWS Network Manager and register the transit gateway. Create an Amazon EventBridge rule to receive attachment notifications from Network with the required information. Manager and to invoke an AWS Lambda function that assumes the IAM role in the requester account. Configure the Lambda function to tag the attachment.
Answer: D
Explanation: AWS Network Manager is specifically designed to manage and monitor transit gateways across multiple AWS accounts. When a new transit gateway attachment is created, Network Manager generates events that can be captured by EventBridge rules. The Lambda function can then assume the IAM role in the requester account (using cross-account assume role) to retrieve the VPC tags and apply them to the transit gateway attachment. This is the proper architecture for this use case.
Question 44 · No. 684 · Single choice
A company needs to build an integration with its internal ticketing system. The integration will require an AWS Lambda function. The Lambda function needs to query a REST API that is part of the internal ticketing system. The ticketing system's REST API is accessible only through an Application Load Balancer (ALB) that is in a private subnet in the company's VPC. The company deploys the Lambda function with the following infrastructure as code (IaC): <img src="https://img.examtopics.com/aws-certified-advanced-networking-specialty-ans-c01/image2.png"> The IaC deployment succeeds, but the deployed Lambda function times out when it tries to access the ticketing system. How can the company give the Lambda function the ability to access the ticketing system?
- A. Create an AWS PrivateLink endpoint service. Expose the service to the Lambda function.
- B. Attach the Lambda function to the ALB's target group by creating a new aws_lb_target_group_attachment resource. Configure the resource to reference both the ALB's ARN and the Lambda function's ARN.
- C. Update the Lambda function's security group to include appropriate inbound rules that permit traffic from the VPC.
- D. Add a vpc_config section to the Lambda function resource. Configure the vpc_config section to include one or more security group IDs and one or more private subnet IDs that permit access to the ALB.
Answer: D
Explanation: When a Lambda function needs to access resources within a VPC (such as an ALB in a private subnet), it must be configured with VPC settings. The Lambda function needs to be deployed in a private subnet within the VPC and have appropriate security groups to communicate with the ALB. Option D is correct because adding a vpc_config section to the Lambda function resource with the appropriate security group IDs and private subnet IDs will allow the function to access the ALB. Option A (PrivateLink) is incorrect because PrivateLink is used to expose services, not to enable Lambda to access internal services. Option B is incorrect because attaching a Lambda function to an ALB target group allows the ALB to invoke the Lambda function, not the reverse. Option C is incorrect because inbound rules on the Lambda function's security group would not affect outbound connections to the ALB.
Question 45 · No. 685 · Single choice
A security company has a domain that stores DNS records in an Amazon Route 53 public hosted zone. The company has configured DNS Security Extensions (DNSSEC) signing for the domain. The domain has no subdomains. A network engineer must disable DNSSEC signing for the domain. The network engineer must not cause any DNS outage. Which solution will meet these requirements?
- A. Disable DNSSEC signing. Delete the resource record signature (RRSIG) records. Wait for the TTL of the RSIG records to elapse. Deactivate the key-signing keys (KSKs).
- B. Deactivate the key-signing keys (KSKs). Wait for the TTL of the KSK records to elapse. Disable DNSSEC signing.
- C. Delete the designated signer (DS) record in the parent domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing. Deactivate the key-signing keys (KSKs).
- D. Deactivate the key-signing keys (KSKs). Delete the designated signer (DS) record of the domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing.
Answer: C
Question 46 · No. 686 · Single choice
A global network service provider deploys managed AWS Direct Connect connections for its customers. The company wants to integrate monitoring for the connections into its existing ticketing system. The ticketing system runs in the company's VPC on multiple EC2 instances. The ticketing system uses a REST API. The ticketing system must receive events with minimal latency. The company expects to receive an average of 1 event each day. The company wants to use its existing infrastructure as code (IaC) tooling to configure the monitoring integration solution. Which solution will meet these requirements in the MOST cost-effective way?
- A. Configure an Amazon EventBridge rule to send events to an AWS Lambda function. Configure the Lambda function to process the events and to send events to the ticketing system's REST API.
- B. Configure a scheduled event in Amazon CloudWatch to run an AWS Lambda function once every minute. Configure the function to poll the AWS API to detect changes in the Direct Connect connection state. Configure the function to submit tickets to the ticketing system's REST API when the function detects state changes.
- C. Write a script to poll the AWS API to detect changes in Direct Connect connection state and to submit tickets to the ticketing system's REST API. Deploy the script to the ticketing system's EC2 instance. Schedule the script to run once every minute by using the operating system configuration.
- D. Configure an Amazon EventBridge rule to send events directly to an Amazon DynamoDB table. Use Amazon DynamoDB Streams to send the events to an AWS Lambda function. Configure the function to process the events and to send the events to the ticketing system's REST API.
Answer: A
Explanation: Option A is the most cost-effective and meets the latency requirement. EventBridge provides event-driven, near real-time processing, so latency is minimal. Since only 1 event is expected per day, Lambda will only be invoked once per day, making it extremely cost-effective. EventBridge rules and Lambda functions can both be configured via IaC tools like CloudFormation or Terraform. Option B and C involve polling every minute, which is wasteful and increases costs (1440 invocations per day vs 1). Option D adds unnecessary complexity with DynamoDB, increasing both cost and latency.
Question 47 · No. 687 · Single choice
A network engineer maintains a company's AWS infrastructure. The network engineer used AWS Transit Gateway to set up a hub and spoke architecture. The network engineer created a shared services VPC to centralize access to interface VPC endpoints. The company uses AWS Organizations to manage AWS accounts for multiple teams in a single organization. Each team in the company has a separate account and VPC. All the team accounts require access to the interface VPC endpoints. The network engineer needs a solution to grant each account the minimum required access. Each team's account must have access only to a list of authorized interface VPC endpoints. The solution must have minimal effect on the current architecture. Which solution will meet these requirements with the LEAST operational overhead?
- A. Create a separate shared services VPC for each team account. Include the interface VPC endpoints that the team is authorized to use in each VPC. Use a unique transit gateway route table to connect each team's spoke VPC to the team's shared services VPC.
- B. Apply security groups to the interface VPC endpoints that are in the shared services VPC. Configure each security group to allow only the CIDR block of the team spoke VPCs that are authorized to use the endpoints included in the security group.
- C. Create a unique interface VPC endpoint for each team that is authorized to access a service. Update routing for the shared services VPC so that the CIDR block for each team can access only the set of endpoints the team is authorized to access.
- D. Associate an endpoint policy with each interface VPC endpoint. In each policy, deny all the traffic except for traffic from accounts that are authorized to access the corresponding service.
Answer: D
Explanation: Option D is the best choice because VPC endpoint policies are the most operationally efficient way to control access to interface VPC endpoints. Endpoint policies are resource-based policies directly attached to each endpoint, allowing the network engineer to specify exactly which AWS accounts (principals) are authorized to access each service through deny-by-default rules. This approach requires no additional infrastructure (no extra VPCs, endpoints, or transit gateway route tables), scales well with team accounts via AWS Organizations, and has minimal impact on the existing architecture. Compared to other options: A requires creating multiple VPCs and complex routing (high overhead); B relies on security groups which use CIDR-based rules (less granular and harder to scale); C requires duplicating endpoints (extremely high overhead and cost). Endpoint policies are purpose-built for this exact scenario of granting minimum required access.
Question 48 · No. 688 · Multiple choice
A company is setting up an AWS Direct Connect connection between the company's on-premises data center and AWS. The company currently has a single VPC in its AWS account. The on-premises data center uses the 172.16.0.0/16 CIDR block, and the VPC uses the 10.1.1.0/24 CIDR block. The company associates the Direct Connect connection to one private VIF. A network engineer receives reports that SSH communication from hosts that are in the company's on-premises data center to Amazon EC2 instances that are deployed in the company's VPC is failing. The network engineer investigates and finds that the VIF is up and a BGP peering session has been established properly. Which steps should the engineer take to troubleshoot this issue? (Choose three.)
- A. Ensure that the advertised route for the on-premises network is present in the VPC route tables. Ensure that the VPC's subnets are present in the route tables of the on-premises network equipment.
- B. Ensure that BGP community tags announcements from the customer gateway router are configured properly.
- C. Ensure that the customer gateway router accepts BGP community tags in the prefixes the router receives.
- D. Ensure that the VPC network ACLs allow inbound and outbound traffic for the on-premises network prefix.
- E. Ensure that the security groups for the EC2 instances allow inbound SSH communication from the on-premises network prefix.
- F. Ensure that the security groups for the EC2 instances allow outbound SSH communication from the on-premises network prefix.
Answer: A, D, E
Explanation: The three correct steps are A, D, and E. Option A is critical because with AWS Direct Connect using BGP, both the VPC route tables must contain the on-premises network (172.16.0.0/16), and the on-premises equipment must have routes back to the VPC subnets (10.1.1.0/24). Without these routes, traffic cannot flow in either direction. Option D is necessary because VPC Network ACLs are stateless and must explicitly allow both inbound and outbound SSH (port 22) traffic for the on-premises CIDR block. Option E is required because security groups must permit inbound SSH access from the on-premises network prefix (172.16.0.0/16) to the EC2 instances. Options B and C relate to BGP community tags, which are used for advanced traffic engineering but are not essential for basic SSH connectivity. Option F is incorrect because security groups are stateful—if inbound SSH is allowed, return traffic is automatically permitted, and the issue here is inbound SSH to EC2, not outbound.
Question 49 · No. 689 · Multiple choice
A gaming company operates in one AWS Region. The company's architecture includes an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group that support a frontend application. The company uses AWS WAF integrated with the ALB. The ALB has one security group attached to it. The company uses AWS Network Firewall with stateful rules. The company has set up Network ACLs. The company wants to automatically block access for game users who violate specific rules. The company wants to temporarily block access for problematic users for 1 to 2 hours. The company's software can identify the source IP addresses of problematic users. The company has created a serverless solution to store the IP addresses in Amazon DynamoDB. The company wants to use its existing serverless architecture to automatically block the problematic users. Which solution will meet these requirements in the MOST scalable way? (Choose two.)
- A. Create a new AWS WAF IP set that the serverless solution updates. Introduce an AWS WAF deny rule to block traffic from any address in the IP set.
- B. Configure the serverless solution to modify the network ACLs to block traffic from the IP addresses of the problematic users.
- C. Configure the serverless solution to modify the ALB security group to block traffic from the IP addresses of the problematic users.
- D. Create a new AWS WAF IP set that is updated by the serverless solution. Create an AWS WAF rule to redirect traffic from sources that match the IP set to a new API for the serverless solution.
- E. Create an AWS Network Firewall stateless rule to drop traffic from the IP addresses of the problematic users. Configure the serverless solution to update the new rule with the IP addresses of the problematic users.
Answer: A, E
Explanation: Option A is correct because AWS WAF IP sets are the most scalable and standard way to block IP addresses, and the company already has AWS WAF integrated with the ALB. The serverless solution can automatically update the IP set to add problematic IP addresses, and the deny rule will block traffic from those addresses. Option E is correct because AWS Network Firewall supports IP sets and stateless rules that can drop traffic from specific IP addresses. Since the company already uses AWS Network Firewall, adding a stateless rule updated by the serverless solution is highly scalable. Option B is not scalable because Network ACLs have limits on rules and modifying them frequently is inefficient. Option C is incorrect because security groups cannot block traffic based on specific IP addresses (they are stateful and associated with instances, not for IP blocking). Option D is incorrect because the company wants to block access, not redirect traffic to another API.
Question 50 · No. 690 · Single choice
A company needs to connect its on-premises network to a VPC in the us-east-1 Region. The connection must support a maximum transmission unit (MTU) of 9,000 bytes and must be highly available. Which solution will meet these requirements MOST cost-effectively?
- A. Use AWS Site-to-Site VPN to create two VPNs. Use two connections to two virtual private gateways that are in the same VPC.
- B. Use AWS Site-to-Site VPN to create two VPNs. Use two connections to a single transit gateway that has a VPC attachment.
- C. Create a multi-site, nonredundant AWS Direct Connect deployment. Use two Direct Connect connections to two separate Direct Connect locations.
- D. Create a multi-site, redundant AWS Direct Connect deployment. Use two Direct Connect connections to one Direct Connect location and two connections to a second Direct Connect location.
Answer: C