Latest Amazon ANS-C01 Actual Free Exam Questions & Community Discussion, Page 3

Question #27

A company runs an application on Amazon EC2 instances. A network engineer implements a NAT gateway in the application's VPC to replace self-managed NAT instances. After the network engineer shifts traffic from the self-managed NAT instances to the NAT gateway, users begin to report issues.
During troubleshooting, the network engineer discovers that the connection to the application is closing after approximately 6 minutes of inactivity.
What should the network engineer do to resolve this issue?

A. Check for increases in the Amazon CloudWatch PacketsDropCount metric for the NAT gateway.
Configure an HTTPS timeout value on the application EC2 instances.

B. Check for decreases in the Amazon CloudWatch ActiveConnectionCount metric for the NAT gateway.Configure UDP keepalive on the application EC2 instances.

C. Check for increases in the Amazon CloudWatch ErrorPortAIlocation metric for the NAT gateway.
Configure an HTTP timeout value on the application EC2 instances.

D. Check for increases in the Amazon CloudWatch IdleTimeoutCount metric for the NAT gateway.
Configure TCP keepalive on the application EC2 instances.

Discussion 0

Correct Answer: D Vote an answer

Question #28

An AWS CloudFormation template is being used to create a VPC peering connection between two existing operational VPCs, each belonging to a different AWS account. All necessary components in the 'Remote' (receiving) account are already in place.
The template below creates the VPC peering connection in the Originating account. It contains these components:
AWSTemplateFormation Version: 2010-09-09
Parameters:
Originating VCId:
Type: String
RemoteVPCId:
Type: String
RemoteVPCAccountId:
Type: String
Resources:
newVPCPeeringConnection:
Type: 'AWS::EC2::VPCPeeringConnection'
Properties:
VpcdId: !Ref OriginatingVPCId
PeerVpcId: !Ref RemoteVPCId
PeerOwnerId: !Ref RemoteVPCAccountId
Which additional AWS CloudFormation components are necessary in the Originating account to create an operational cross-account VPC peering connection with AWS CloudFormation? (Select two.)

A. Resources:NewEC2SecurityGroup:Type: AWS::EC2::SecurityGroup

B. Resources:newEC2Route:Type: AWS::EC2::Route

C. Resources:VPCGatewayToRemoteVPC:Type: "AWS::EC2::VPCGatewayAttachment"

D. Resources:NetworkInterfaceToRemoteVPC:Type: "AWS::EC2NetworkInterface"

E. Resources:newVPCPeeringConnection:Type: 'AWS::EC2VPCPeeringConnection'PeerRoleArn: !Ref PeerRoleArn

Discussion 0

Correct Answer: B,E Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #29

A company is deploying a new stateless web application on AWS. The web application will run on Amazon EC2 instances in private subnets behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The web application has a stateful management application for administration that will run on EC2 instances that are in a separate Auto Scaling group.
The company wants to access the management application by using the same URL as the web application, with a path prefix of /management. The protocol, hostname, and port number must be the same for the web application and the management application. Access to the management application must be restricted to the company's on-premises IP address space. An SSL/TLS certificate from AWS Certificate Manager (ACM) will protect the web application.
Which combination of steps should a network engineer take to meet these requirements? (Select TWO.)

A. Forward all requests to the web application target group. Edit the web application target group and disable stickiness.

B. Modify the default rule for the load balancer HTTPS listener. Configure the rule to check the path- pattern condition type for the /management prefix and to check the source-Ip condition type for the on- premises IP address space. Forward requests to the web application target group if there is not a match.

C. Modify the default rule for the load balancer HTTPS listener. Configure the rule to check the path- pattern condition type for the /management prefix and to check the source-Ip condition type for the on- premises IP address space. Forward requests to the management application target group if there is not a match. Enable group-level stickiness in the rule attributes.

D. Insert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the X-Forwarded-For HTTP header for the on- premises IP address space. Forward requests to the managementapplication target group if there is a match. Enable group-level stickiness in the rule attributes.

E. Insert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the management application target group if there is a match. Edit the management application target group and enable stickiness.

Discussion 0

Correct Answer: A,E Vote an answer

Question #30

A company's AWS environment has two VPCs. VPC A has a CIDR block of 192.168.0.0/16. VPC B has a CIDR block of 10.0.0.0/16. Each VPC is deployed in a separate AWS Region. The company has remote users who work outside the company's offices. These users need to connect to an application that is running in the VPCs.
Traffic to and from the VPCs over the internet must be encrypted. A network engineer must set up connectivity between the remote users and the VPCs.
Which combination of steps should the network engineer take to meet these requirements with the LEAST management overhead? (Choose three.)

A. Establish a VPC peering connection between VPC A and VPC B.

B. Create an AWS Client VPN endpoint in VPC A Add an authorization rule to grant access to VPC A and VPC B.

C. Create an AWS Client VPN endpoint in VPC A and VPC B Add an authorization rule to grant access to VPC A and VPC B.

D. Add a route to the AWS Client VPN endpoint's route table to direct traffic to VPC A.

E. Add a route to the AWS Client VPN endpoint's route table to direct traffic to VPC B.

F. Establish an AWS Site-to-Site VPN connection between VPC A and VPC B.

Discussion 0

Correct Answer: A,B,E Vote an answer

Question #31

A company hosts infrastructure services in multiple VPCs across multiple accounts in the us-west-2 Region.
The VPC CIDR blocks do not overlap. The company wants to connect the VPCs to its data centers by using AWS Site-to-Site VPN tunnels.
The connections must be encrypted in transit. Additionally, the connection from each data center must route to the closest AWS edge location. The connections must be highly available and must accommodate automatic failover.
Which solution will meet these requirements?

A. Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering.

B. Deploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on each account. Add routes to the on-premises subnet in each of the service VPC route tables. Use the VPNs as the gateway. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering.

C. Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure static routing.

D. Deploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on each account. Add routes to the on-premises subnet in each of the service VPC route tables. Use the VPNs as the gateway. Configure the VPN tunnels on the on-premises equipment. Configure static routing.

Discussion 0

Correct Answer: A Vote an answer

Question #32

AnyCompany deploys and manages networking resources in its AWS network account, named Account-A.
AnyCompany acquires Example Corp, which has an application that runs behind an Application Load Balancer (ALB) in Example Corp's AWS account, named Account-B.
Example Corp needs to use AWS Global Accelerator to create an accelerator to publish the application to users. AnyCompany's networking team will manage the accelerator.
Which solution will meet these requirements with the LEAST management overhead?

A. Create an accelerator in Account-A. Use AWS Resource Access Management (AWS RAM) to share the accelerator with Account-#. Associate the ALB in Account-# with the accelerator in Account-A.

B. Create an accelerator in Account-#. Use a cross-account role from Account-A to grant the networking team access to manage the accelerator.

C. Create a cross-account Global Accelerator attachment in Account-# for the Account-A principal. Create an accelerator in Account-A by using the shared attachment.

D. Deploy a Network Load Balancer (NLB) in Account-A to route traffic to the ALB in Account-#. Create an accelerator, and set the NLB as the endpoint in Account-A.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #33

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups.
The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.
The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.
Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in a custom format. Set the application subnets as resources. Include the pkt- srcaddr field and the pkt-dstaddr field in the flow logs.

B. Create VPC flow logs in a custom format. Set the EKS nodes as the resource Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.

C. Create VPC flow logs in a custom format. Create a filter to gather flow logs only from the EKS nodes.Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.

D. Create VPC flow logs in the default format. Create a filter to gather flow logs only from the EKS nodes.
Include the srcaddr field and the dstaddr field in the flow logs.

Discussion 0

Correct Answer: C Vote an answer

Question #34

A company uses Amazon Route 53 to register a public domain, example.com, in an AWS account. A central services group manages the account. The company wants to create a subdomain, test.example.com, in another AWS account to offer name services for Amazon EC2 instances that are hosted in the account. The company does not want to migrate the parent domain to the subdomain account.
A network engineer creates a new Route 53 hosted zone for the subdomain in the second account.
Which combination of steps must the network engineer take to complete the task? (Choose two.)

A. Update the DNS service for the parent domain by adding name server (NS) records for the subdomain.

B. Update the DNS service for the subdomain by adding name server (NS) records for theparent domain.

C. Create an alias record from the parent domain that points to the hosted zone for the subdomain in the second account.

D. Add records for the hosts of the new subdomain to the new Route 53 hosted zone.

E. Add a start of authority (SOA) record in the parent domain for the subdomain.

Discussion 0

Correct Answer: A,D Vote an answer

Question #35

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customer's source IP addresses.
A network engineer must implement a load balancing strategy that meets these requirements.
Which combination of actions should the network engineer take to accomplish this goal? (Choose two.)

A. Use a Network Load Balancer

B. Retrieve client IP addresses by using the X-Forwarded-For header

C. Retrieve client IP addresses by using the X-IP-Source header

D. Use AWS App Mesh load balancing

E. Use an Application Load Balancer.

Discussion 0

Correct Answer: B,E Vote an answer

Question #36

A company has created three VPCs: a production VPC, a nonproduction VPC, and a shared services VPC.
The production VPC and the nonproduction VPC must each have communication with the shared services VPC. There must be no communication between the production VPC and the nonproduction VPC. A transit gateway is deployed to facilitate communication between VPCs.
Which route table configurations on the transit gateway will meet these requirements?

A. Configure a route table with all the VPC attachments associated with propagated routes for only the shared services VPCreate an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.

B. Configure a route table with the production and nonproduction VPC attachments associated with propagated routes for only the shared services VPC. Create an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.

C. Configure a route table with the production and nonproduction VPC attachments associated with propagated routes for each VPC. Create an additional route table with only the shared services VPC attachment associated with propagated routes from each VPC.

D. Configure a route table with the production and nonproduction VPC attachments associated with propagated routes disabled. Create an additional route table with only the shared services VPC attachment associated with propagated routes from the production and nonproduction VPCs.

Discussion 0

Correct Answer: B Vote an answer

Question #37

An organization is replacing a tape backup system with a storage gateway. there is currently no connectivity to AWS. Initial testing is needed.
What connection option should the organization use to get up and running at minimal cost?

A. Provision a Direct Connect public virtual interface.

B. Provision an AWS Direct Connection private virtual interface.

C. Set up an AWS VPN connection.

D. Use an internet connection.

Discussion 0

Correct Answer: D Vote an answer

Question #38

An online retail company is running a web application in the us-west-2 Region and serves consumers in the United States. The company plans to expand across several countries in Europe and wants to provide low latency for all its users.
The application needs to identify the users' IP addresses and provide localized content based on the users' geographic location. The application uses HTTP GET and POST methods for its functionality. The company also needs to develop a failover mechanism that works for GET and POST methods and is based on health checks. The failover must occur in less than 1 minute for all clients.
Which solution will meet these requirements?

A. Configure an Application Load Balancer (ALB) for the application in each environment in the new AWS Regions. Create Amazon Route 53 public hosted zones that have failover routing policies.

B. Configure a Network Load Balancer (NLB) for the application in each environment In the new AWS Regions. Create an AWS Global Accelerator accelerator that has endpoint groups that point to the NLBs in each Region.

C. Configure a Network Load Balancer (NLB) for the application in each environment in the new AWS Regions. Create an Amazon CloudFront distribution. Configure an origin group with origin failover options.

D. Configure an Application Load Balancer (ALB) for the application in each environment in the new AWS Regions. Create an AWS Global Accelerator accelerator that has endpoint groups that point to the ALBs in each Region.

Discussion 0

Correct Answer: D Vote an answer

Question #39

A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all inbound traffic to the ALB to come from CloudFront. The network engineer must implement the solution at the network layer rather than in the application.
Which solution will meet these requirements in the MOST operationally efficient way?

A. Associate an AWS WAF web ACL with the ALB. Configure the AWS WAF rules to allow traffic from the CloudFront IP set. Automatically update the CloudFront IP set by using an AWS Lambda function.

B. Configure CloudFront to add a custom HTTP header to the requests that CloudFront sends to the ALB.

C. Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.

D. Add an inbound rule to the network ACLs that are associated with the ALB's subnets. Use the AWS managed prefix list for CloudFront as the source in the rule.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Amazon ANS-C01 Actual Free Exam Questions & Community Discussion

Download Free Amazon ANS-C01 Demo