ANS-C01 free practice questions — 25-question sample

25 questions in this bank

Question 1 of 25
A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend. Which solution will meet these requirements?
Show answer
Correct answer: A
How others answered
A68%
B31%
Only 68% agreed on this answer — treat it as contested rather than settled.
Explanation
Option B is incorrect because an Application Load Balancer (ALB) does not support TLS passthrough and decrypts the traffic before forwarding it to the backend servers. Option C is incorrect because an Application Load Balancer (ALB) does not support mutual TLS authentication (mTLS), which is required for this use case. Option D is incorrect because a TLS listener is not suitable for this use case. TLS passthrough is required, and the correct listener type for NLB is TCP.
Adapted from community discussion by emmanuelodenyire · 2023-04-28 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 1 Report an issue
Candidate context
Question 1 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
E
emmanuelodenyire
2023-04-28
Selected A13 upvotes
Option B is incorrect because an Application Load Balancer (ALB) does not support TLS passthrough and decrypts the traffic before forwarding it to the backend servers. Option C is incorrect because an Application Load Balancer (ALB) does not support mutual TLS authentication (mTLS), which is required for this use case. Option D is incorrect because a TLS listener is not suitable for this use case. TLS passthrough is required, and the correct listener type for NLB is TCP.
E
emmanuelodenyire
2023-04-28
Selected A5 upvotes
he correct answer is A. Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure a Network Load Balancer with a TCP listener on port 443 to forward traffic to the IP addresses of the backend service Pods. Explanation: The requirements state that traffic must not be decrypted between the client and the backend of the service, and mutual TLS must be used for two-way authentication between the client and the backend. Therefore, a load balancer that supports TLS passthrough is required, and Network Load Balancer (NLB) is a suitable option. Installing the AWS Load Balancer Controller for Kubernetes allows the load balancer to be configured via Kubernetes manifests. By using that controller, a Network Load Balancer with a TCP listener on port 443 can be configured to forward traffic to the IP addresses of the backend service Pods.
F
Fengyu
2023-07-07
Selected A7 upvotes
ALB does not support mutual TLS and will decrypt the traffic https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html
G
geekneek
2023-05-22
Selected A2 upvotes
The company is planning to use the gRPC protocol with mutual TLS, which implies two-way SSL/TLS encryption. Network Load Balancer (NLB) supports TCP traffic but doesn't terminate TLS connections, so the traffic will not be decrypted in transit. Also, the gRPC protocol usually works best with TCP as it has its own built-in mechanisms for handling things like retries, load balancing, etc. This is ideal when mutual TLS is required for traffic between the client and the backend. On the other hand, Application Load Balancer (ALB) does TLS termination at the load balancer level, meaning it decrypts and inspects the incoming requests, which doesn't meet the requirement of not decrypting traffic between the client and backend. So, considering these points, the best solution here would be option (A)
Question 2 of 25
Select 3
A company uses an AWS Direct Connect private VIF with a link aggregation group (LAG) that consists of two 10 Gbps connections. The company's security team has implemented a new requirement for external network connections to provide layer 2 encryption. The company's network team plans to use MACsec support for Direct Connect to meet the new requirement. Which combination of steps should the network team take to implement this functionality? (Choose three.)
Show answer
Correct answer: A, B, E
How others answered
ABE100%
Explanation
Correct:A,B,E To start using MACsec, you must turn the feature on when you create a dedicated connection https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-lag.html https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-mac-sec-getting-started.html https://docs.aws.amazon.com/directconnect/latest/UserGuide/associate-key-lag.html
Adapted from community discussion by trap · 2023-06-25 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 2 Report an issue
Candidate context
Question 2 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
T
trap
2023-06-25
14 upvotes
Correct:A,B,E To start using MACsec, you must turn the feature on when you create a dedicated connection https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-lag.html https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-mac-sec-getting-started.html https://docs.aws.amazon.com/directconnect/latest/UserGuide/associate-key-lag.html
S
shinzor
2023-11-16
1 upvote
While it is true that you can update MacSec mode on an existing LAG. However the MacSec keys in this context are only based on CKN/CAK. So using IKE as an answer is a no and makes all the other "existing" answers invalid.
P
passtest100
2023-10-03
1 upvote
should be C, D,F since LAG can be updated with MacSec mode rather than a new LAG should be created. https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateLag.html
Question 3 of 25
A company recently implemented a security policy that prohibits developers from launching VPC network infrastructure. The policy states that any time a NAT gateway is launched in a VPC, the company's network security team must immediately receive an alert to terminate the NAT gateway. The network security team needs to implement a solution that can be deployed across AWS accounts with the least possible administrative overhead. The solution also must provide the network security team with a simple way to view compliance history. Which solution will meet these requirements?
Show answer
Correct answer: D
How others answered
D86%
Explanation
When in doubt regarding "Deploy the AWS Config rule and the Systems Manager runbooks to each account by using AWS CloudFormation StackSets " check below link: https://docs.aws.amazon.com/config/latest/developerguide/aws-config-managed-rules-cloudformation-templates.html
Adapted from community discussion by Tofu13 · 2023-08-31 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 3 Report an issue
Candidate context
Question 3 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
T
trap
2023-06-25
7 upvotes
Correct: D https://docs.aws.amazon.com/config/latest/developerguide/view-compliance-history.html https://aws.amazon.com/blogs/mt/remediate-noncompliant-aws-config-rules-with-aws-systems-manager-automation-runbooks/
T
Tofu13
2023-08-31
Selected D2 upvotes
When in doubt regarding "Deploy the AWS Config rule and the Systems Manager runbooks to each account by using AWS CloudFormation StackSets " check below link: https://docs.aws.amazon.com/config/latest/developerguide/aws-config-managed-rules-cloudformation-templates.html
W
woorkim
2024-12-02
Selected D1 upvote
The best answer is D: Create a custom AWS Config rule that checks for NAT gateways in an AWS account. Configure the AWS Config rule to perform an AWS Systems Manager Automation remediation action to send an email alert and terminate the NAT gateway if a NAT gateway is detected. Deploy the AWS Config rule and the Systems Manager runbooks to each account by using AWS CloudFormation StackSets.
S
Spaurito
2024-11-01
1 upvote
GaurdDuty can send alerts but is more usable with vulnerability compliance.
Question 4 of 25
Select 2
A company is using custom DNS servers that run BIND for name resolution in its VPCs. The VPCs are deployed across multiple AWS accounts that are part of the same organization in AWS Organizations. All the VPCs are connected to a transit gateway. The BIND servers are running in a central VPC and are configured to forward all queries for an on-premises DNS domain to DNS servers that are hosted in an on-premises data center. To ensure that all the VPCs use the custom DNS servers, a network engineer has configured a VPC DHCP options set in all the VPCs that specifies the custom DNS servers to be used as domain name servers. Multiple development teams in the company want to use Amazon Elastic File System (Amazon EFS). A development team has created a new EFS file system but cannot mount the file system to one of its Amazon EC2 instances. The network engineer discovers that the EC2 instance cannot resolve the IP address for the EFS mount point fs-33444567d.efs.us-east-1.amazonaws.com. The network engineer needs to implement a solution so that development teams throughout the organization can mount EFS file systems. Which combination of steps will meet these requirements? (Choose two.)
Show answer
Correct answer: B, D
How others answered
BD77%
Explanation
Please refer the below extract taken from the link - https://aws.amazon.com/blogs/security/simplify-dns-management-in-a-multiaccount-environment-with-route-53-resolver/ "You can mount an Amazon EFS file system on an Amazon EC2 instance using DNS names. The file system DNS name automatically resolves to the mount target’s IP address in the Availability Zone of the connecting Amazon EC2 instance. To be able to do that, the VPC must use the default DNS provided by Amazon to resolve EFS DNS names. If you plan to use EFS in your environment, I recommend that you resolve EFS DNS names locally and avoid sending these queries to central DNS because clients in that case would not receive answers optimized for their availability zone, which might result in higher operation latencies and less durability." So, option B) answers EFS resolution from VPC. Combination of Option B) and D) explains resolution from on-prem
Adapted from community discussion by study_aws1 · 2023-03-28 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 4 Report an issue
Candidate context
Question 4 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
S
study_aws1
2023-03-28
14 upvotes
Please refer the below extract taken from the link - https://aws.amazon.com/blogs/security/simplify-dns-management-in-a-multiaccount-environment-with-route-53-resolver/ "You can mount an Amazon EFS file system on an Amazon EC2 instance using DNS names. The file system DNS name automatically resolves to the mount target’s IP address in the Availability Zone of the connecting Amazon EC2 instance. To be able to do that, the VPC must use the default DNS provided by Amazon to resolve EFS DNS names. If you plan to use EFS in your environment, I recommend that you resolve EFS DNS names locally and avoid sending these queries to central DNS because clients in that case would not receive answers optimized for their availability zone, which might result in higher operation latencies and less durability." So, option B) answers EFS resolution from VPC. Combination of Option B) and D) explains resolution from on-prem
U
Untamables
2023-04-01
Selected B, D12 upvotes
I vote B and D. What the company want to to is as following. https://docs.aws.amazon.com/whitepapers/latest/hybrid-cloud-dns-options-for-vpc/route-53-resolver-endpoints-and-forwarding-rules.html The combination of A and E also seems to work. But the maintenance overhead for the custom DNS server remains. That is not a good practice.
Z
zaazanuna
2023-03-18
5 upvotes
A, E - correct. Explanation: The issue is that the EC2 instance cannot resolve the IP address for the EFS mount point, which is a host name in the efs.us-east-1.amazonaws.com domain. The company is using custom DNS servers that are forwarding queries for an on-premises domain to on-premises DNS servers. To resolve this issue, the network engineer needs to configure the BIND DNS servers to forward queries for the efs.us-east-1.amazonaws.com domain to the Amazon provided DNS server (169.254.169.253). This will allow the custom DNS servers to resolve the IP address for the EFS mount point. However, this alone is not sufficient for the EC2 instance to be able to mount the EFS file system. The network engineer also needs to create an Amazon Route 53 private hosted zone for the efs.us-east-1.amazonaws.com domain and create an A record for the EFS mount point. The A record should return the mount target of the EFS mount point. This will allow the EC2 instance to resolve the hostname for the EFS mount point using Amazon Route 53.
T
Tofu13
2023-09-08
Selected B, D1 upvote
Not easy to understand question. Question is: The network engineer needs to implement a solution so that development teams throughout the organization can mount EFS file systems. U neither need a Resolver outbound (B) nor inbound (C) endpoint to achieve this. But the second part of (B) "Update all the VPC DHCP options sets to use AmazonProvidedDNS for name resolution." makes it easy to resolve the IP address and therefore mount the EFS file systems. By sharing the rule in AWS RAM (D) u apply the changes to the whole organisation. The Resolver outbound endpoint is used to forward all queries for an on-premises DNS domain to DNS servers that are hosted in an on-premises data center, which, while stated as part of the current solution, is not part of the question, making it a bit confusing. Further, it is true that u cannot modify VPC DHCP options sets (see link), but i think "update" can rather be seen as a language issue then a reason to mark the answer as false. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/dhcp_options_set.html
Question 5 of 25
A company has two on-premises data center locations. There is a company-managed router at each data center. Each data center has a dedicated AWS Direct Connect connection to a Direct Connect gateway through a private virtual interface. The router for the first location is advertising 110 routes to the Direct Connect gateway by using BGP, and the router for the second location is advertising 60 routes to the Direct Connect gateway by using BGP. The Direct Connect gateway is attached to a company VPC through a virtual private gateway. A network engineer receives reports that resources in the VPC are not reachable from various locations in either data center. The network engineer checks the VPC route table and sees that the routes from the first data center location are not being populated into the route table. The network engineer must resolve this issue in the most operationally efficient manner. What should the network engineer do to meet these requirements?
Show answer
Correct answer: B
How others answered
B69%
D29%
Only 69% agreed on this answer — treat it as contested rather than settled.
Explanation
Option B) - You can announce a maximum of 100 prefixes to AWS.These routes can be automatically be propagated into subnet route tables • In order to advertise more than 100 prefixes, you should summarize the prefixes into larger range to reduce number of prefixes
Adapted from community discussion by study_aws1 · 2023-03-19 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
repost.aws documentation
repost.aws documentation
Permanent link to question 5 Report an issue
Candidate context
Question 5 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
S
study_aws1
2023-03-19
12 upvotes
Option B) - You can announce a maximum of 100 prefixes to AWS.These routes can be automatically be propagated into subnet route tables • In order to advertise more than 100 prefixes, you should summarize the prefixes into larger range to reduce number of prefixes
E
emmanuelodenyire
2023-04-29
Selected B8 upvotes
The correct answer to this question is option B: Change the router configurations to summarize the advertised routes. Here's why: The issue described in the question is that the VPC route table is not receiving all of the advertised routes from the on-premises routers. The router at the first location is advertising 110 routes, but those routes are n
V
vikasj1in
2024-02-15
Selected B4 upvotes
The issue appears to be related to the number of routes advertised from each data center location. AWS Direct Connect has a limit on the number of routes that can be advertised to a virtual private gateway in a VPC (100 routes by default). In this case, the router for the first data center is advertising 110 routes, which exceeds the default limit, leading to the routes not being populated into the VPC route table. To resolve this issue in the most operationally efficient manner, the network engineer should consider summarizing the advertised routes. Summarizing routes involves aggregating a set of routes into a single, more general route. In BGP, this is typically done using route summarization. By changing the router configurations to summarize the advertised routes, the network engineer can reduce the number of routes being advertised to the Direct Connect gateway, ensuring that it stays within the route limit imposed by AWS.
E
emmanuelodenyire
2023-04-29
Selected B5 upvotes
The correct answer to this question is option B: Change the router configurations to summarize the advertised routes Option B is the correct answer because it addresses the root cause of the issue, which is that the VPC route table is not receiving all of the advertised routes. By changing the router configurations to summarize the advertised routes, the routers will send fewer, more general routes to the Direct Connect gateway, which will then be propagated to the VPC route table. This is a simple and operationally efficient solution that solves the problem without adding unnecessary complexity to the network.
Question 6 of 25
Select 3
A company's AWS environment has two VPCs. VPC A has a CIDR block of 192.168.0.0/16. VPC B has a CIDR block of 10.0.0.0/16. Each VPC is deployed in a separate AWS Region. The company has remote users who work outside the company's offices. These users need to connect to an application that is running in the VPCs. Traffic to and from the VPCs over the internet must be encrypted. A network engineer must set up connectivity between the remote users and the VPCs. Which combination of steps should the network engineer take to meet these requirements with the LEAST management overhead? (Choose three.)
Show answer
Correct answer: B, D, E
How others answered
BDE86%
Explanation
BDE, i was doubting but here's what I found. Quote: "The procedure for allowing access to a peered VPC outlined below, is only required if the Client VPN endpoint was configured for split-tunnel mode. In full-tunnel mode, access to the peered VPC is allowed by default." https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html
Adapted from community discussion by JosMo · 2024-01-04 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 6 Report an issue
Candidate context
Question 6 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
J
JosMo
2024-01-04
Selected B, D, E8 upvotes
BDE, i was doubting but here's what I found. Quote: "The procedure for allowing access to a peered VPC outlined below, is only required if the Client VPN endpoint was configured for split-tunnel mode. In full-tunnel mode, access to the peered VPC is allowed by default." https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html
B
Balasmaniam
2023-12-13
Selected B, D, E4 upvotes
https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html
H
habros
2024-04-22
Selected B, D, E3 upvotes
BDE. Create VPN endpoint in VPC A -> peer with VPC B -> hence clients will be able to connect to VPC B, via VPC A. Client -> VPC A -> VPC B
D
demoras
2023-12-11
1 upvote
Should it be CEF? https://aws.amazon.com/blogs/networking-and-content-delivery/building-multi-region-aws-client-vpn-with-microsoft-active-directory-and-amazon-route-53/
Question 7 of 25
A company has deployed a multi-VPC environment in the AWS Cloud. The company uses a transit gateway to connect all the VPCs together. In the past, the company has experienced a loss of connectivity between applications after changes to security groups, network ACLs, and route tables in a VPC. When these changes occur, the company wants to automatically verify that connectivity still exists between different resources in a single VPC.
Show answer
Correct answer: B
How others answered
B79%
A21%
Explanation
"When a security group change is made, the change event is logged in AWS CloudTrail. CloudTrail then forwards the change event to Amazon EventBridge, which evaluates the change against a series of rules to determine if any actions must be taken. Within EventBridge, a rule will be created to forward all security group change events from CloudTrail to an AWS Lambda function. The Lambda function is responsible for determining if any EC2 instances are impacted by the security group change, and if any Reachability Analyzer paths assessing the connectivity from the internet to the instance exist. " [https://aws.amazon.com/blogs/networking-and-content-delivery/automating-connectivity-assessments-with-vpc-reachability-analyzer/]
Adapted from community discussion by sanalainen · 2023-11-02 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 7 Report an issue
Candidate context
Question 7 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
S
sanalainen
2023-11-02
Selected B3 upvotes
"When a security group change is made, the change event is logged in AWS CloudTrail. CloudTrail then forwards the change event to Amazon EventBridge, which evaluates the change against a series of rules to determine if any actions must be taken. Within EventBridge, a rule will be created to forward all security group change events from CloudTrail to an AWS Lambda function. The Lambda function is responsible for determining if any EC2 instances are impacted by the security group change, and if any Reachability Analyzer paths assessing the connectivity from the internet to the instance exist. " [https://aws.amazon.com/blogs/networking-and-content-delivery/automating-connectivity-assessments-with-vpc-reachability-analyzer/]
C
cerifyme85
2024-04-15
5 upvotes
This is one of the biggest problems with AWS, way too many serivces, that could potentially be doing the same (eg monitoring), and we have know them all and their use cases? Would be a lot easier if their developer just had 2 or 3,and we dont have to remember all these nonsense
C
Certified101
2023-08-03
Selected B4 upvotes
B https://docs.aws.amazon.com/vpc/latest/reachability/what-is-reachability-analyzer.html
W
woorkim
2024-12-08
Selected B2 upvotes
Verify connectivity within a single VPC. This suggests using VPC Reachability Analyzer, which is designed for analyzing paths between resources in a VPC. React automatically to configuration changes. Changes to security groups, NACLs, and route tables are logged in AWS CloudTrail, so monitoring CloudTrail logs is necessary. Automated path validation. Using a Lambda function to invoke the VPC Reachability Analyzer ensures the process is automated.
Question 8 of 25
Select 3
A company is using a NAT gateway to allow internet connectivity for private subnets in a VPC in the us-west-2 Region. After a security audit, the company needs to remove the NAT gateway. In the private subnets, the company has resources that use the unified Amazon CloudWatch agent. A network engineer must create a solution to ensure that the unified CloudWatch agent continues to work after the removal of the NAT gateway. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)
Show answer
Correct answer: A, C, D
How others answered
ACD77%
Explanation
A, C, and D An interface VPC endpoint provides reliable, scalable connectivity to CloudWatch without requiring a NAT gateway. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-interface-VPC.html https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html To use private DNS, you must enable DNS hostnames and DNS resolution for your VPC. The security group for the interface endpoint must allow communication between the endpoint network interface and the resources in your VPC that must communicate with the service. https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html
Adapted from community discussion by Untamables · 2023-04-01 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
repost.aws documentation
repost.aws documentation
Permanent link to question 8 Report an issue
Candidate context
Question 8 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
U
Untamables
2023-04-01
Selected A, C, D9 upvotes
A, C, and D An interface VPC endpoint provides reliable, scalable connectivity to CloudWatch without requiring a NAT gateway. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-interface-VPC.html https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html To use private DNS, you must enable DNS hostnames and DNS resolution for your VPC. The security group for the interface endpoint must allow communication between the endpoint network interface and the resources in your VPC that must communicate with the service. https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html
N
navi7
2023-03-22
Selected A, C, D4 upvotes
B is incorrect as we don't need to create outbound rules for interface endpoint. "Note: You don't need to create a rule in the outbound direction of the security group associated with the interface endpoint." https://repost.aws/knowledge-center/security-network-acl-vpc-endpoint A is also partially correct as normally CloudWatch Agent uses public endpoints but it can be overridden. But since other options are incorrect so A is a right choice here.
S
study_aws1
2023-03-20
6 upvotes
F) will not work. Route table is applicable for gateway endpoints (S3 and DynamoDB), not interface endpoints (controlled through Security Group).
P
patanjali
2024-03-08
Selected A, C, D3 upvotes
https://repost.aws/knowledge-center/cloudwatch-unified-agent-metrics-issues Confirm connectivity to the CloudWatch endpoints When traffic to CloudWatch should not transit the public internet, you can use VPC endpoints instead. If you are using VPC endpoints, check the following: If you are using private nameservers, confirm that DNS resolution provided accurate responses. Confirm that the CloudWatch endpoints resolve to private IP addresses. Confirm the security group associated with the VPC endpoint allows inbound traffic from the host.
Question 9 of 25
A global company is designing a hybrid architecture to privately access AWS resources in the us-west-2 Region. The company's existing architecture includes a VPC that uses RFC 1918 IP address space. The VPC is connected to an on-premises data center over AWS Direct Connect Amazon Route 53 provides name resolution within the VPC. Locally managed DNS servers in the data center provide DNS services to the on-premises hosts. The company has applications in the data center that need to download objects from an Amazon S3 bucket in us-west-2. Which solution can the company use to access Amazon S3 without using the public IP address space?
Show answer
Correct answer: B
How others answered
B62%
A38%
Only 62% agreed on this answer — treat it as contested rather than settled.
Explanation
When you configure an interface VPC endpoint, an elastic network interface (ENI) with a private IP address is deployed in your subnet. An Amazon EC2 instance in the VPC can communicate with an Amazon S3 bucket through the ENI and AWS network. Using the interface endpoint, applications in your on-premises data center can easily query S3 buckets over AWS Direct Connect or Site-to-Site VPN. Interface endpoint supports a growing list of AWS services. Consult our documentation to find AWS services compatible with interface endpoints powered by AWS PrivateLink. https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/
Adapted from community discussion by Sailor · 2024-04-24 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
repost.aws documentation
Permanent link to question 9 Report an issue
Candidate context
Question 9 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
V
vikasj1in
2024-02-16
Selected B4 upvotes
This solution maintains the use of private IP address space and avoids the need for public IP addresses. It ensures that the on-premises applications can securely access Amazon S3 in the us-west-2 Region without relying on public internet connectivity. Options A and D are incorrect because they refer to S3 interface endpoints without involving Route 53 Resolver, which is necessary for DNS resolution. Option C mentions an S3 gateway endpoint, but S3 gateway endpoints are used for accessing S3 from on-premises environments, not for VPC-to-S3 communication.
N
Newbies
2024-03-29
3 upvotes
Ans: A S3 Interface Endpoint: By creating an S3 interface endpoint within the VPC, the company can establish a private connection to S3 buckets without traversing the public internet. Route 53 Resolver (Implicit): VPC endpoint DNS names inherently resolve through Route 53 Resolver within the VPC. No explicit configuration for a separate Route 53 Resolver inbound endpoint is required. On-premises Application Update: Updating the application configuration to utilize the Regional VPC endpoint DNS hostname mapped to the S3 interface endpoint allows the application to connect to S3 through the private connection. B. Route 53 Resolver Inbound Endpoint (Unnecessary): While Route 53 Resolver can be used for DNS resolution within a VPC, in this case, the VPC endpoint DNS name itself resolves through Route 53 Resolver implicitly. Setting up an additional inbound endpoint is not required.
S
Sailor
2024-04-24
Selected B3 upvotes
When you configure an interface VPC endpoint, an elastic network interface (ENI) with a private IP address is deployed in your subnet. An Amazon EC2 instance in the VPC can communicate with an Amazon S3 bucket through the ENI and AWS network. Using the interface endpoint, applications in your on-premises data center can easily query S3 buckets over AWS Direct Connect or Site-to-Site VPN. Interface endpoint supports a growing list of AWS services. Consult our documentation to find AWS services compatible with interface endpoints powered by AWS PrivateLink. https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/
M
Manh
2023-07-27
Selected B3 upvotes
https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html
Question 10 of 25
An international company provides early warning about tsunamis. The company plans to use IoT devices to monitor sea waves around the world. The data that is collected by the IoT devices must reach the company’s infrastructure on AWS as quickly as possible. The company is using three operation centers around the world. Each operation center is connected to AWS through Its own AWS Direct Connect connection. Each operation center is connected to the internet through at least two upstream internet service providers. The company has its own provider-independent (PI) address space. The IoT devices use TCP protocols for reliable transmission of the data they collect. The IoT devices have both landline and mobile internet connectivity. The infrastructure and the solution will be deployed in multiple AWS Regions. The company will use Amazon Route 53 for DNS services. A network engineer needs to design connectivity between the IoT devices and the services that run in the AWS Cloud. Which solution will meet these requirements with the HIGHEST availability?
Show answer
Correct answer: C
How others answered
C92%
Explanation
AWS Global Accelerator is designed to provide a highly available and performant solution for global applications. It uses anycast IP addresses to route traffic to optimal AWS endpoint locations. In this scenario, setting up an accelerator in AWS Global Accelerator with Regional endpoint groups is suitable for the distributed architecture of the IoT devices and the AWS infrastructure. Options A and B involve Amazon CloudFront and Route 53 latency-based routing, respectively, but AWS Global Accelerator is specifically designed to provide highly available, low-latency, and fault-tolerant global routing, making it a more suitable choice for this scenario. Option D, Bring Your Own IP (BYOIP) addresses, is not directly related to optimizing the connectivity for IoT devices and services in AWS, and it doesn't address the global distribution and routing requirements as effectively as AWS Global Accelerator.
Adapted from community discussion by vikasj1in · 2024-02-15 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 10 Report an issue
Candidate context
Question 10 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
U
Untamables
2023-04-01
Selected C10 upvotes
C https://docs.aws.amazon.com/global-accelerator/latest/dg/introduction-benefits-of-migrating.html https://docs.aws.amazon.com/global-accelerator/latest/dg/using-byoip.html
S
study_aws1
2023-03-19
10 upvotes
Should be Option B) as per the architecture given in the link https://aws.amazon.com/blogs/iot/automate-global-device-provisioning-with-aws-iot-core-and-amazon-route-53/
V
vikasj1in
2024-02-15
Selected C4 upvotes
AWS Global Accelerator is designed to provide a highly available and performant solution for global applications. It uses anycast IP addresses to route traffic to optimal AWS endpoint locations. In this scenario, setting up an accelerator in AWS Global Accelerator with Regional endpoint groups is suitable for the distributed architecture of the IoT devices and the AWS infrastructure. Options A and B involve Amazon CloudFront and Route 53 latency-based routing, respectively, but AWS Global Accelerator is specifically designed to provide highly available, low-latency, and fault-tolerant global routing, making it a more suitable choice for this scenario. Option D, Bring Your Own IP (BYOIP) addresses, is not directly related to optimizing the connectivity for IoT devices and services in AWS, and it doesn't address the global distribution and routing requirements as effectively as AWS Global Accelerator.
T
that1guy
2023-03-27
Selected C5 upvotes
should be C, not B AWS Global Accelerator is designed to provide high availability and low latency for TCP and UDP traffic by using Amazon's global network to route traffic to the optimal AWS endpoint. It allows you to create endpoint groups in multiple regions, and AWS Global Accelerator automatically routes traffic to the closest healthy endpoint group by continuously monitoring the health of the endpoints.
Question 11 of 25
A company is planning a migration of its critical workloads from an on-premises data center to Amazon EC2 instances. The plan includes a new 10 Gbps AWS Direct Connect dedicated connection from the on-premises data center to a VPC that is attached to a transit gateway. The migration must occur over encrypted paths between the on-premises data center and the AWS Cloud. Which solution will meet these requirements while providing the HIGHEST throughput?
Show answer
Correct answer: C
How others answered
C97%
Explanation
I really hope not find some question like that, because I only can see mistakes. Macsec is used on L2L using layer 02 or direct connection (collocation feat AWS), like clear channel circuit, because you can see another mac address. But if you're using MPLS connection by AWS partner, it's not possible to use it. You can use VPN over DX, and you'll not suffer with latency or throughput, but it's necessary to use a virtual private gateway. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-site-to-site-vpn.html Related: AWS Direct Connect and AWS Site-to-Site VPN
Adapted from community discussion by ForDummies · 2024-08-15 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 11 Report an issue
Candidate context
Question 11 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
U
Untamables
2023-04-01
Selected C11 upvotes
C https://docs.aws.amazon.com/directconnect/latest/UserGuide/MACsec.html
Z
zaazanuna
2023-03-22
5 upvotes
AWS Site-to-Site VPN connections have bandwidth limitations. Each VPN tunnel supports up to 1.25 Gbps, and even with two VPN tunnels, the maximum throughput would be 2.5 Gbps. This is considerably lower than the 10 Gbps bandwidth offered by the AWS Direct Connect dedicated connection. VPN connections introduce additional overhead due to the encryption and encapsulation process, which can result in higher latency and reduced performance compared to a Direct Connect connection with MACsec.
O
ohcan
2023-03-30
Selected C4 upvotes
MacSEC always provide more throughput than two IPsec tunnels that will reach only 1.5Gb each
W
WMF0187
2023-09-11
1 upvote
Option C is the solution that will provide the highest throughput while meeting the requirement for an encrypted path between the on-premises data center and the AWS Cloud. Here's why: MACsec (Media Access Control Security): MACsec provides a layer 2 encryption mechanism, encrypting the entire Ethernet frame between the on-premises data center and the AWS Cloud. It offers high throughput while encrypting the data at the link layer. Transit VIF and Direct Connect Gateway: By configuring a transit VIF on the Direct Connect connection, you can connect it directly to a Direct Connect gateway associated with the transit gateway. This architecture allows you to efficiently route traffic to multiple VPCs attached to the transit gateway. Option D: While using AWS Site-to-Site VPN connections with ECMP routing can provide redundancy, it may not offer the highest throughput compared to MACsec over a dedicated 10 Gbps Direct Connect connection.
Question 12 of 25
A company’s network engineer needs to design a new solution to help troubleshoot and detect network anomalies. The network engineer has configured Traffic Mirroring. However, the mirrored traffic is overwhelming the Amazon EC2 instance that is the traffic mirror target. The EC2 instance hosts tools that the company’s security team uses to analyze the traffic. The network engineer needs to design a highly available solution that can scale to meet the demand of the mirrored traffic. Which solution will meet these requirements?
Show answer
Correct answer: A
How others answered
A64%
C36%
Only 64% agreed on this answer — treat it as contested rather than settled.
Explanation
Another tricky question and consider the wording in the answers choices - "as the traffic mirror target". I have selected A because the NLB is a valid mirror target, but the GWLB is not (Answer C). Yes, comments supporting Answer C say that GWLB must also mean/include GLWB-E. Then you have two valid answers to the question where you can only select one. Therefore, it is A for me. Ref: https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-targets.html All the best.
Adapted from community discussion by Cheam · 2023-07-23 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 12 Report an issue
Candidate context
Question 12 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
C
Cheam
2023-07-23
Selected A19 upvotes
Another tricky question and consider the wording in the answers choices - "as the traffic mirror target". I have selected A because the NLB is a valid mirror target, but the GWLB is not (Answer C). Yes, comments supporting Answer C say that GWLB must also mean/include GLWB-E. Then you have two valid answers to the question where you can only select one. Therefore, it is A for me. Ref: https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-targets.html All the best.
[
[Removed]
2023-07-16
Selected A4 upvotes
Option A is correct. Option C is not the correct answer because deploying a Gateway Load Balancer (GLB) as the traffic mirror target is not recommended for this scenario. GLB is designed for handling large amounts of traffic and is typically used for load balancing across multiple VPCs or accounts1. However, in this scenario, the network engineer needs to design a highly available solution that can scale to meet the demand of the mirrored traffic. Deploying a Network Load Balancer (NLB) as the traffic mirror target and behind the NLB, deploying a fleet of EC2 instances in an Auto Scaling group is the recommended solution
A
Alabi
2023-09-19
Selected A2 upvotes
A. Deploy a Network Load Balancer (NLB) as the traffic mirror target. Behind the NLB, deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring as necessary. Network Load Balancer (NLB) is designed for handling TCP/UDP traffic and provides high availability, scalability, and low-latency performance. It is suitable for distributing the mirrored traffic to a fleet of EC2 instances. Deploying a fleet of EC2 instances in an Auto Scaling group ensures that you can scale the capacity of your analysis tools dynamically to meet the demand of the mirrored traffic. This addresses the issue of the EC2 instance being overwhelmed. Using Traffic Mirroring as necessary allows you to control when to capture mirrored traffic, reducing the load on the analysis tools during non-critical times.
D
DPDK
2023-07-03
Selected A4 upvotes
Well. Although NLB and GWLB are good to do this. Based on description of options, A is better, because Target should be GWLB ENDPOINT instead of GWLB itself
Question 13 of 25
Select 2
A government contractor is designing a multi-account environment with multiple VPCs for a customer. A network security policy requires all traffic between any two VPCs to be transparently inspected by a third-party appliance. The customer wants a solution that features AWS Transit Gateway. The setup must be highly available across multiple Availability Zones, and the solution needs to support automated failover. Furthermore, asymmetric routing is not supported by the inspection appliances. Which combination of steps is part of a solution that meets these requirements? (Choose two.)
Show answer
Correct answer: B, C
How others answered
BC90%
Explanation
NLB:To increase the fault tolerance of your applications, you can enable multiple Availability Zones for your load balancer and ensure that each target group has at least one target in each enabled Availability Zone. https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html GLB: Third party appliance https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/#:~:text=Gateway%20Load%20Balancer%20helps%20you,or%20down%2C%20based%20on%20demand. Answers A) B)
Adapted from community discussion by Mandar · 2023-03-30 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 13 Report an issue
Candidate context
Question 13 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
U
Untamables
2023-04-02
Selected B, C7 upvotes
B and C https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/introduction.html https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/using-gwlb-with-tg-for-cns.html
B
bogehad181
2023-04-16
Selected B, C4 upvotes
B & C, GLB better for 3rd party appliance, TGW RT associated to APP VPCs has a single route to the Inspection VPC and second TGW RT for the inspection VPC has all APP VPC CIDRs propagated to it.
M
Mandar
2023-03-30
3 upvotes
NLB:To increase the fault tolerance of your applications, you can enable multiple Availability Zones for your load balancer and ensure that each target group has at least one target in each enabled Availability Zone. https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html GLB: Third party appliance https://aws.amazon.com/elasticloadbalancing/gateway-load-balancer/#:~:text=Gateway%20Load%20Balancer%20helps%20you,or%20down%2C%20based%20on%20demand. Answers A) B)
S
sambb
2023-07-06
Selected B, C3 upvotes
B - as an GWLB is more appropriate for monitoring appliances C - as D and E would allow the VPCs to communicate together directly,
Question 14 of 25
A global company operates all its non-production environments out of three AWS Regions: eu-west-1, us-east-1, and us-west-1. The company hosts all its production workloads in two on-premises data centers. The company has 60 AWS accounts and each account has two VPCs in each Region. Each VPC has a virtual private gateway where two VPN connections terminate for resilient connectivity to the data centers. The company has 360 VPN tunnels to each data center, resulting in high management overhead. The total VPN throughput for each Region is 500 Mbps. The company wants to migrate the production environments to AWS. The company needs a solution that will simplify the network architecture and allow for future growth. The production environments will generate an additional 2 Gbps of traffic per Region back to the data centers. This traffic will increase over time. Which solution will meet these requirements?
Show answer
Correct answer: C
How others answered
C85%
B15%
Explanation
C An AWS Transit Gateway provides the option of creating an IPsec VPN connection between your remote network and the Transit Gateway over the internet. A Transit Gateway is a regional resource. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-transit-gateway-vpn.html You can use AWS Resource Access Manager (RAM) to share a transit gateway for VPC attachments across accounts or across your organization in AWS Organizations. That helps reducing the VPN connections. https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-share.html AWS Transit Gateway can scale up to 50 Gbps throughput aggregating multiple VPN tunnels. https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-quotas.html#bandwidth-quotas
Adapted from community discussion by Untamables · 2023-04-04 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 14 Report an issue
Candidate context
Question 14 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
S
study_aws1
2023-03-19
14 upvotes
Option A) may be a stable solution considering other options, but will not be applicable to this scenario as a single Direct connect gateway can connect only upto 10 VPCs, where as the requirement states total 120 VPCs. This choice would have been applicable had Transit Gateway been introduced to the architecture with Transit VIF (not private VIF). As Transit gateway is a regional resource, a single transit gateway will not function cross-region. Hence, option C)
U
Untamables
2023-04-04
Selected C7 upvotes
C An AWS Transit Gateway provides the option of creating an IPsec VPN connection between your remote network and the Transit Gateway over the internet. A Transit Gateway is a regional resource. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-transit-gateway-vpn.html You can use AWS Resource Access Manager (RAM) to share a transit gateway for VPC attachments across accounts or across your organization in AWS Organizations. That helps reducing the VPN connections. https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-share.html AWS Transit Gateway can scale up to 50 Gbps throughput aggregating multiple VPN tunnels. https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-quotas.html#bandwidth-quotas
Z
zaazanuna
2023-03-26
2 upvotes
Option C would involve creating a transit gateway in each region with multiple newly commissioned VPN connections from each data center, which would result in a high number of VPN tunnels. While AWS Transit Gateway is designed to handle multiple VPN connections, creating a separate transit gateway in each region would not be a scalable solution in the long term. Additionally, each AWS account has two VPCs in each region, so attaching a transit gateway to each VPC would result in a large number of VPC attachments, which would be difficult to manage. wrong?
R
Raphaello
2024-04-02
Selected C1 upvote
There are 120 VPC's in each region. That being said, option A where a single Direct Connect gateway connect to all the VPCs via private VIF's (adnd VGW of course)..simply does not work. DxGW can only connect to 20 Virtual private gateways per AWS Direct Connect gateway. https://docs.aws.amazon.com/directconnect/latest/UserGuide/limits.html Had it had TGW connected to DxGW, it would've been the best choice in terms of sufficient bandwidth. C is the answer.
Question 15 of 25
A company is building its website on AWS in a single VPC. The VPC has public subnets and private subnets in two Availability Zones. The website has static content such as images. The company is using Amazon S3 to store the content. The company has deployed a fleet of Amazon EC2 instances as web servers in a private subnet. The EC2 instances are in an Auto Scaling group behind an Application Load Balancer. The EC2 instances will serve traffic, and they must pull content from an S3 bucket to render the webpages. The company is using AWS Direct Connect with a public VIF for on-premises connectivity to the S3 bucket. A network engineer notices that traffic between the EC2 instances and Amazon S3 is routing through a NAT gateway. As traffic increases, the company's costs are increasing. The network engineer needs to change the connectivity to reduce the NAT gateway costs that result from the traffic between the EC2 instances and Amazon S3. Which solution will meet these requirements?
Show answer
Correct answer: D
How others answered
D100%
Explanation
D To reduce data transfer charges for NAT gateways, you can use an interface endpoint or a gateway endpoint. https://repost.aws/knowledge-center/vpc-reduce-nat-gateway-transfer-costs If your NAT gateway charges are from traffic to Amazon S3 or Amazon DynamoDB in the same Region, you should choose a gateway endpoint. There is no additional charge for using gateway endpoints. On the other hand, An interface endpoint charges apply for each Gigabyte processed through the endpoint. https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html https://aws.amazon.com/privatelink/pricing/
Adapted from community discussion by Untamables · 2023-10-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
repost.aws documentation
AWS documentation
AWS documentation
Permanent link to question 15 Report an issue
Candidate context
Question 15 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
N
navi7
2023-09-21
8 upvotes
I think it should be D https://aws.amazon.com/premiumsupport/knowledge-center/vpc-reduce-nat-gateway-transfer-costs/ Determine whether the majority of your NAT gateway charges are from traffic to Amazon Simple Storage Service or Amazon DynamoDB in the same Region. If they are, then set up a gateway VPC endpoint. Route traffic to and from the AWS resource through the gateway VPC endpoint, rather than through the NAT gateway. There's no processing or hourly charges for using gateway VPC endpoints.
U
Untamables
2023-10-05
Selected D4 upvotes
D To reduce data transfer charges for NAT gateways, you can use an interface endpoint or a gateway endpoint. https://repost.aws/knowledge-center/vpc-reduce-nat-gateway-transfer-costs If your NAT gateway charges are from traffic to Amazon S3 or Amazon DynamoDB in the same Region, you should choose a gateway endpoint. There is no additional charge for using gateway endpoints. On the other hand, An interface endpoint charges apply for each Gigabyte processed through the endpoint. https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html https://aws.amazon.com/privatelink/pricing/
L
linuxek21
2023-10-01
2 upvotes
Correct Answer is D, As per documentation: Amazon S3 supports both gateway endpoints and interface endpoints. With a gateway endpoint, you can access Amazon S3 from your VPC, without requiring an internet gateway or NAT device for your VPC, and with no additional cost. However, gateway endpoints do not allow access from on-premises networks, from peered VPCs in other AWS Regions, or through a transit gateway. For those scenarios, you must use an interface endpoint, which is available for an additional cost. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html For those concerned about on-prem, this is not an issue when you use a public VIF
I
ITgeek
2023-09-29
Selected D2 upvotes
correct answer to this question is D. Implement gateway VPC endpoints for Amazon S3 and update the VPC route table. This solution will allow the EC2 instances to access the S3 bucket directly without having to go through a NAT gateway, reducing costs. Additionally, gateway endpoints provide greater scalability and performance than interface endpoints, making them the preferred solution for high-traffic use cases such as this one.
Question 16 of 25
A company has developed an application on AWS that will track inventory levels of vending machines and initiate the restocking process automatically. The company plans to integrate this application with vending machines and deploy the vending machines in several markets around the world. The application resides in a VPC in the us-east-1 Region. The application consists of an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). The communication from the vending machines to the application happens over HTTPS. The company is planning to use an AWS Global Accelerator accelerator and configure static IP addresses of the accelerator in the vending machines for application endpoint access. The application must be accessible only through the accelerator and not through a direct connection over the internet to the ALB endpoint. Which solution will meet these requirements?
Show answer
Correct answer: A
How others answered
A61%
D39%
Only 61% agreed on this answer — treat it as contested rather than settled.
Explanation
This is not a normal scenario of attaching IGW to EC2 instance by creating a route in subnet. Please read the below link typically describing ELB integration with AWS Global accelator (and the last line of the extract) - https://docs.aws.amazon.com/global-accelerator/latest/dg/secure-vpc-connections.html "When you add an internal Application Load Balancer or an Amazon EC2 instance endpoint in AWS Global Accelerator, you enable internet traffic to flow directly to and from the endpoint in Virtual Private Clouds (VPCs) by targeting it in a private subnet. The VPC that contains the load balancer or EC2 instance must have an internet gateway attached to it, to indicate that the VPC accepts internet traffic. However, you don't need public IP addresses on the load balancer or EC2 instance. You also don't need an associated internet gateway route for the subnet."
Adapted from community discussion by study_aws1 · 2023-03-19 · 29 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 16 Report an issue
Candidate context
Question 16 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
S
study_aws1
2023-03-19
29 upvotes
This is not a normal scenario of attaching IGW to EC2 instance by creating a route in subnet. Please read the below link typically describing ELB integration with AWS Global accelator (and the last line of the extract) - https://docs.aws.amazon.com/global-accelerator/latest/dg/secure-vpc-connections.html "When you add an internal Application Load Balancer or an Amazon EC2 instance endpoint in AWS Global Accelerator, you enable internet traffic to flow directly to and from the endpoint in Virtual Private Clouds (VPCs) by targeting it in a private subnet. The VPC that contains the load balancer or EC2 instance must have an internet gateway attached to it, to indicate that the VPC accepts internet traffic. However, you don't need public IP addresses on the load balancer or EC2 instance. You also don't need an associated internet gateway route for the subnet."
P
PhilMultiCloud
2023-07-25
4 upvotes
The requirement here is that the application must be accessible only through the Global Accelerator, and not via a direct connection over the internet to the ALB endpoint. Hence, the ALB should be placed in a private subnet and should be configured such that only traffic coming from the Global Accelerator can reach the ALB. Option A: This won't work because we're allowing inbound traffic from the internet on the ALB listener port. We need to restrict the traffic to the ALB only from the Global Accelerator's IP addresses. Option B: This won't work for the same reason as option A - we're allowing traffic from the entire internet to reach the ALB. Option C: This won't work because placing the ALB in a public subnet will allow it to be accessible from the internet, which we don't want. Option D: This is the correct option. Here, we're placing the ALB in a private subnet, which prevents direct access from the internet. The traffic is allowed only from the IP addresses of the Global Accelerator. Thus, access to the ALB is only possible through the Global Accelerator, fulfilling the requirement.
O
ohcan
2023-03-25
Selected A5 upvotes
Agree with https://docs.aws.amazon.com/global-accelerator/latest/dg/secure-vpc-connections.html
A
Andrea13
2023-09-28
4 upvotes
The correct answer is C. Configure the ALB in a public subnet of the VPC. Attach an internet gateway. Add routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB’s security group to only allow inbound traffic from the accelerator’s IP addresses on the ALB listener port.
Question 17 of 25
Select 3
A media company is implementing a news website for a global audience. The website uses Amazon CloudFront as its content delivery network. The backend runs on Amazon EC2 Windows instances behind an Application Load Balancer (ALB). The instances are part of an Auto Scaling group. The company's customers access the website by using service example com as the CloudFront custom domain name. The CloudFront origin points to an ALB that uses service-alb.example.com as the domain name. The company’s security policy requires the traffic to be encrypted in transit at all times between the users and the backend. Which combination of changes must the company make to meet this security requirement? (Choose three.)
Show answer
Correct answer: B, D, E
How others answered
BDE85%
BCE15%
Explanation
B, D, E ACM removes the time-consuming manual process of purchasing, uploading, and renewing SSL/TLS certificates. https://aws.amazon.com/certificate-manager/ https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html You can configure one or more cache behaviors in your CloudFront distribution to require HTTPS for communication between viewers and CloudFront. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html Option C is wrong. You cannot associate ACM certificates with an EC2 instance that is not connected to a Nitro Enclave. https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html
Adapted from community discussion by Untamables · 2023-10-05 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 17 Report an issue
Candidate context
Question 17 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
S
study_aws1
2023-09-20
12 upvotes
Yes it is B, D, E. C is not correct as - Public ACM certificates can be installed on Amazon EC2 instances that are connected to a Nitro Enclave, but not to other Amazon EC2 instances. The question does not mention any use of Nitro enclave here
U
Untamables
2023-10-05
Selected B, D, E6 upvotes
B, D, E ACM removes the time-consuming manual process of purchasing, uploading, and renewing SSL/TLS certificates. https://aws.amazon.com/certificate-manager/ https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html You can configure one or more cache behaviors in your CloudFront distribution to require HTTPS for communication between viewers and CloudFront. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html Option C is wrong. You cannot associate ACM certificates with an EC2 instance that is not connected to a Nitro Enclave. https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html
M
Mishranihal737
2024-01-30
5 upvotes
Yes Correct ans is B,D,E. A-> Incorrect as self signed certs are not supported for Cloud Front C-> Incorrect as ACM doesnot support Certificate export, ACM is not supported on EC2 F-> Incorrect as self signed certs are not supported for Cloud Front.
1
168cd9d
2025-03-26
Selected B, D, E1 upvote
Cloudfront doesn't work with self-signed certs. ALB needs a cert provided by ACM. ACM is not supported on EC2 or either 3rd party or self signed cert can be used.
Question 18 of 25
A company has deployed a software-defined WAN (SD-WAN) solution to interconnect all of its offices. The company is migrating workloads to AWS and needs to extend its SD-WAN solution to support connectivity to these workloads. A network engineer plans to deploy AWS Transit Gateway Connect and two SD-WAN virtual appliances to provide this connectivity. According to company policies, only a single SD-WAN virtual appliance can handle traffic from AWS workloads at a given time. How should the network engineer configure routing to meet these requirements?
Show answer
Correct answer: C
How others answered
C58%
A32%
Only 58% agreed on this answer — treat it as contested rather than settled.
Explanation
A - incorrect , static routes are not possible in TGW B- incorrect, these BGP communities are used for BGP over DX C- correct , AS_PATH prepending is a standard BGP way of influencing return traffic for advertised prefixes and SDWAN supports this. D- incorrect, disabling ECMP will make sure the SDWAN>TGW traffic is not load shared, but the return traffic TGW>SDWAN is not affected and therefore both appliances will process traffic.
Adapted from community discussion by dremm · 2023-04-02 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 18 Report an issue
Candidate context
Question 18 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
D
dremm
2023-04-02
21 upvotes
A - incorrect , static routes are not possible in TGW B- incorrect, these BGP communities are used for BGP over DX C- correct , AS_PATH prepending is a standard BGP way of influencing return traffic for advertised prefixes and SDWAN supports this. D- incorrect, disabling ECMP will make sure the SDWAN>TGW traffic is not load shared, but the return traffic TGW>SDWAN is not affected and therefore both appliances will process traffic.
Z
zaazanuna
2023-03-26
11 upvotes
Option C - focuses specifically on the SD-WAN virtual appliances. By configuring the AS_PATH prepend attribute on the secondary SD-WAN virtual appliance for BGP routes toward the transit gateway, the network engineer can influence routing preferences, making the primary SD-WAN virtual appliance the preferred path while keeping the secondary appliance as a backup. This approach meets the company's requirement of having only a single SD-WAN virtual appliance handle traffic from AWS workloads at a given time without impacting other connections.
S
symplesims
2023-05-30
3 upvotes
My choice is A. Adding a static default route in the transit gateway route table to point to the secondary SD-WAN virtual appliance and adding more specific routes to point to the primary SD-WAN virtual appliance. This approach allows you to have control over the traffic flow and specify the primary SD-WAN virtual appliance as the preferred path for more specific routes. By configuring a static default route to the secondary SD-WAN virtual appliance, you ensure that traffic is only directed to it when there is no more specific route available. You can also add static routes to the transit gateway route tables. https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html
L
leotoras
2024-01-14
4 upvotes
static routes are possible in TGW as per the documentation: You can create a static route for a VPC, VPN, or transit gateway peering attachment, or you can create a blackhole route that drops traffic that matches the route.
Question 19 of 25
A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway in the required AWS Region. A network engineer needs to deploy the SD-WAN hub virtual appliance into a VPC that is connected to the transit gateway. The solution must support at least 5 Gbps of throughput from the SD-WAN hub virtual appliance to other VPCs that are attached to the transit gateway. Which solution will meet these requirements?
Show answer
Correct answer: B
How others answered
B100%
Explanation
Should be B) A Connect attachment uses an existing VPC or AWS Direct Connect attachment as the underlying transport mechanism. • Supports Generic Routing Encapsulation (GRE) tunnel protocol for high performance, and Border Gateway Protocol (BGP) for dynamic routing.
Adapted from community discussion by study_aws1 · 2023-09-22 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 19 Report an issue
Candidate context
Question 19 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
S
study_aws1
2023-09-22
14 upvotes
Should be B) A Connect attachment uses an existing VPC or AWS Direct Connect attachment as the underlying transport mechanism. • Supports Generic Routing Encapsulation (GRE) tunnel protocol for high performance, and Border Gateway Protocol (BGP) for dynamic routing.
R
Raphaello
2024-10-03
Selected B4 upvotes
B is the correct answer. TGW Connect attachment over VPC attachment, with GRE and BGP used.
S
silviahdz
2023-10-16
Selected B3 upvotes
B is the correct answer, TGW Connect is setup with GRE and BGP no mention of VXLAN: https://aws.amazon.com/transit-gateway/faqs/
S
symplesims
2023-11-29
3 upvotes
Exactly B https://aws.amazon.com/blogs/networking-and-content-delivery/simplify-sd-wan-connectivity-with-aws-transit-gateway-connect/
Question 20 of 25
A company is migrating its containerized application to AWS. For the architecture the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster. The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs. Which solution will meet these requirements at the LOWEST cost?
Show answer
Correct answer: C
How others answered
C95%
Explanation
C - seems the right one. VPC peering offers the lowest overall cost when compared to other options for inter-VPC connectivity. https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/vpc-to-vpc-connectivity.html There is no such thing as "TG peering"; there are VPC peering and TG attachments.
Adapted from community discussion by titi_r · 2023-03-26 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 20 Report an issue
Candidate context
Question 20 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
T
titi_r
2023-03-26
Selected C13 upvotes
C - seems the right one. VPC peering offers the lowest overall cost when compared to other options for inter-VPC connectivity. https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/vpc-to-vpc-connectivity.html There is no such thing as "TG peering"; there are VPC peering and TG attachments.
S
study_aws1
2023-03-22
4 upvotes
VPC cannot be peered but attached to Transit Gateway (Either it can be VPC peering or Transit Gateway peering). Additionally, Transit Gateway has its own cost including hourly cost of attachment + Data transfer. PrivateLink resolves the cost problem of high volume of data transfer & is a easy way for ingress VPC to route traffic based on Endpoint service exposed. Also, minimize cross-AZ traffic by using zonal DNS names for the NLB is addressed in this scenario. It should be Option B)
S
study_aws1
2023-03-29
3 upvotes
After careful review, changed to C) considering cost. With Privatelink Endpoint in each AZ in Ingress VPC, it would turn up to 30 Zonal endpoints with 3 AZ - not effective from cost consideration./
D
devopsbro
2023-03-24
2 upvotes
Though transit gateway solves works here, but it comes with running cost per hours+data transfer costs. In case of VPC peering, it comes with free of cost. Only need to pay the data transfer cost. So I think VPC peering is most cost effective option.
Question 21 of 25
A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group. A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection. Which solution will meet these requirements?
Show answer
Correct answer: D
How others answered
D93%
Explanation
It should be option D) The question requires - "automate a way to verify the network connectivity between the public internet and the EC2 instances", not just on failed connections. By implementing automated reachability assessment using Reachability Analyzer, application issues due to connectivity problems are detected quickly. Below post demonstrates an automated method to verify network connectivity between VPC elements after an infrastructure change is made, and alert administrators in the event reachability has been affected. https://aws.amazon.com/blogs/networking-and-content-delivery/automating-connectivity-assessments-with-vpc-reachability-analyzer/ Application load Balancer is supported as intermediary path in the reachability analyzer It is option D)
Adapted from community discussion by study_aws1 · 2023-03-22 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 21 Report an issue
Candidate context
Question 21 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
R
rhinozD
2023-04-27
Selected D8 upvotes
refer this link. https://aws.amazon.com/blogs/networking-and-content-delivery/automating-connectivity-assessments-with-vpc-reachability-analyzer/
S
study_aws1
2023-03-22
4 upvotes
It should be option D) The question requires - "automate a way to verify the network connectivity between the public internet and the EC2 instances", not just on failed connections. By implementing automated reachability assessment using Reachability Analyzer, application issues due to connectivity problems are detected quickly. Below post demonstrates an automated method to verify network connectivity between VPC elements after an infrastructure change is made, and alert administrators in the event reachability has been affected. https://aws.amazon.com/blogs/networking-and-content-delivery/automating-connectivity-assessments-with-vpc-reachability-analyzer/ Application load Balancer is supported as intermediary path in the reachability analyzer It is option D)
C
cutedragonster
2023-03-26
Selected D6 upvotes
C is not correct because security group is not a valid source
J
Jotoval
2023-03-26
5 upvotes
should be D, c is not possible the sources are Instances Internet gateways Network interfaces Transit gateways Transit gateway attachments VPC endpoint services VPC endpoints VPC peering connections VPN gateways
Question 22 of 25
A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group (LAG) bundle to connect to five VPCs that are deployed in the us-east-1 Region. Each VPC serves a different business unit and uses its own private VIF for connectivity to the on-premises environment. Users are reporting slowness when they access resources that are hosted on AWS. A network engineer finds that there are sudden increases in throughput and that the Direct Connect connection becomes saturated at the same time for about an hour each business day. The company wants to know which business unit is causing the sudden increase in throughput. The network engineer must find out this information and implement a solution to resolve the problem. Which solution will meet these requirements?
Show answer
Correct answer: A
How others answered
A82%
B18%
Explanation
A The company has configured the Direct Connect connection stacked with LAG like the below AWS document in this scenario. It seems that there are 4 1-GB dedicated connections. https://docs.aws.amazon.com/directconnect/latest/UserGuide/lags.html Hence, you must monitor the entire traffic, not each dedicated connection traffic. Option C and D are wrong for this reason. https://docs.aws.amazon.com/directconnect/latest/UserGuide/monitoring-cloudwatch.html Option B is wrong. To change the port speed, you must create and configure a new connection. https://docs.aws.amazon.com/directconnect/latest/UserGuide/dedicated_connection.html
Adapted from community discussion by Untamables · 2024-09-25 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
repost.aws documentation
Permanent link to question 22 Report an issue
Candidate context
Question 22 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
T
that1guy
2023-03-25
Selected A7 upvotes
A, From: https://docs.aws.amazon.com/directconnect/latest/UserGuide/dedicated_connection.html > "You cannot change the port speed after you create the connection request. To change the port speed, you must create and configure a new connection."
U
Untamables
2024-09-25
Selected A3 upvotes
A The company has configured the Direct Connect connection stacked with LAG like the below AWS document in this scenario. It seems that there are 4 1-GB dedicated connections. https://docs.aws.amazon.com/directconnect/latest/UserGuide/lags.html Hence, you must monitor the entire traffic, not each dedicated connection traffic. Option C and D are wrong for this reason. https://docs.aws.amazon.com/directconnect/latest/UserGuide/monitoring-cloudwatch.html Option B is wrong. To change the port speed, you must create and configure a new connection. https://docs.aws.amazon.com/directconnect/latest/UserGuide/dedicated_connection.html
S
SIX
2023-03-22
2 upvotes
A-Correct Answer In AWS Direct Connect, you cannot upgrade an existing 4 x 1Gbps connection to a 10Gbps connection. Instead, you will need to create a new 10Gbps connection and move the traffic to the new connection. https://repost.aws/questions/QUxprf4oUTRHyvs-SylrzNRw/can-aws-direct-connect-ports-be-upgraded-from-1-gbps-to-10-gbps.
S
slackbot
2023-04-04
Selected A2 upvotes
Obviously - DX connections cannot be upgraded. They can migrate the VIFs to the new DX conn
Question 23 of 25
Select 2
A software-as-a-service (SaaS) provider hosts its solution on Amazon EC2 instances within a VPC in the AWS Cloud. All of the provider's customers also have their environments in the AWS Cloud. A recent design meeting revealed that the customers have IP address overlap with the provider's AWS deployment. The customers have stated that they will not share their internal IP addresses and that they do not want to connect to the provider's SaaS service over the internet. Which combination of steps is part of a solution that meets these requirements? (Choose two.)
Show answer
Correct answer: A, B
How others answered
AB100%
Explanation
The correct answer is A and B. Option A, deploying the SaaS service endpoint behind a Network Load Balancer (NLB), allows the provider to present a single IP address to customers, while maintaining a highly available and scalable architecture. This is achieved by mapping the NLB's IP address to the SaaS service endpoint. Option B, configuring an endpoint service, enables customers to connect to the SaaS service endpoint using their own private IP addresses. This allows customers to avoid IP address overlap with the provider's AWS deployment and provides a secure, private connection to the SaaS service without traversing the internet.
Adapted from community discussion by emmanuelodenyire · 2023-10-29 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 23 Report an issue
Candidate context
Question 23 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
E
emmanuelodenyire
2023-10-29
Selected A, B11 upvotes
The correct answer is A and B. Option A, deploying the SaaS service endpoint behind a Network Load Balancer (NLB), allows the provider to present a single IP address to customers, while maintaining a highly available and scalable architecture. This is achieved by mapping the NLB's IP address to the SaaS service endpoint. Option B, configuring an endpoint service, enables customers to connect to the SaaS service endpoint using their own private IP addresses. This allows customers to avoid IP address overlap with the provider's AWS deployment and provides a secure, private connection to the SaaS service without traversing the internet.
B
bogehad181
2023-10-15
Selected A, B8 upvotes
A&B: https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-saas.html
T
that1guy
2023-09-25
Selected A, B4 upvotes
From: https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-share-your-services.html > " As the service provider, you create a Network Load Balancer in your VPC as the service front end. You then select this load balancer when you create the VPC endpoint service configuration. You grant permission to specific AWS principals so that they can connect to your service. As a service consumer, the customer creates an interface VPC endpoint, which establishes connections between the subnets that they select from their VPC and your endpoint service." ALB (C) isn't an option offered by AWS because private link requires NLB. VPC peering (D) and Transit Gateway (E) requires knowing the customers IP addresses that the customer is not willing to share.
G
gpt_test
2023-10-04
Selected A, B4 upvotes
Deploying the SaaS service endpoint behind a Network Load Balancer (NLB) allows for better scalability and performance, while also supporting connections from AWS PrivateLink, which can provide secure access to the SaaS service without crossing the public internet. Configuring an endpoint service and granting the customers permission to create a connection to the endpoint service allows the customers to access the SaaS service securely and privately through AWS PrivateLink. This ensures that the traffic does not traverse the public internet and does not require sharing internal IP addresses, while also handling IP address overlaps.
Question 24 of 25
Select 3
A network engineer is designing the architecture for a healthcare company's workload that is moving to the AWS Cloud. All data to and from the on-premises environment must be encrypted in transit. All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premises environment or to the internet. The company will expose components of the workload to the internet so that patients can reserve appointments. The architecture must secure these components and protect them against DDoS attacks. The architecture also must provide protection against financial liability for services that scale out during a DDoS event. Which combination of steps should the network engineer take to meet all these requirements for the workload? (Choose three.)
Show answer
Correct answer: D, E, F
How others answered
DEF88%
Explanation
D) - All data to and from the on-premises environment must be encrypted in transit. (Use AWS Direct Connect with MACsec support for connectivity to the cloud.) E) - All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premises environment (Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection.) F) - The architecture also must provide protection against financial liability for services that scale out during a DDoS event.(Configure AWS Shield Advanced and ensure that it is configured on all public assets) F) -
Adapted from community discussion by study_aws1 · 2023-03-19 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 24 Report an issue
Candidate context
Question 24 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
S
study_aws1
2023-03-19
19 upvotes
D) - All data to and from the on-premises environment must be encrypted in transit. (Use AWS Direct Connect with MACsec support for connectivity to the cloud.) E) - All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premises environment (Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection.) F) - The architecture also must provide protection against financial liability for services that scale out during a DDoS event.(Configure AWS Shield Advanced and ensure that it is configured on all public assets) F) -
U
Untamables
2023-04-01
Selected D, E, F10 upvotes
D https://docs.aws.amazon.com/directconnect/latest/UserGuide/MACsec.html E https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/introduction.html F https://docs.aws.amazon.com/waf/latest/developerguide/ddos-advanced-summary.html
N
Narayan
2023-03-19
6 upvotes
DEF - DX doesnt natively provide encryption - you would need to run mac-sec or vpn over the DX connection
P
PhilMultiCloud
2023-07-25
1 upvote
D. Use AWS Direct Connect with MACsec support for connectivity to the cloud. MACsec (Media Access Control Security) provides encryption in transit over the network for the Direct Connect link between the on-premises environment and AWS, ensuring that all data is encrypted as required. E. Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection. AWS Gateway Load Balancer makes it easy to deploy, scale, and manage third-party virtual network appliances. Using Gateway Load Balancer, you can easily insert, scale, and manage firewalls in the path of internet traffic for inspection purposes. F. Configure AWS Shield Advanced and ensure that it is configured on all public assets. AWS Shield Advanced provides advanced DDoS (Distributed Denial of Service) protection. It not only defends your application against DDoS attacks but also provides cost protection, which can protect your business from additional charges incurred during a DDoS attack. Therefore, the answers are D, E, and F.
Question 25 of 25
A company has hundreds of VPCs on AWS. All the VPCs access the public endpoints of Amazon S3 and AWS Systems Manager through NAT gateways. All the traffic from the VPCs to Amazon S3 and Systems Manager travels through the NAT gateways. The company's network engineer must centralize access to these services and must eliminate the need to use public endpoints. Which solution will meet these requirements with the LEAST operational overhead?
Show answer
Correct answer: C
How others answered
C60%
D40%
Only 60% agreed on this answer — treat it as contested rather than settled.
Explanation
This option uses interface VPC endpoints to centralize access to Amazon S3 and Systems Manager in a shared services VPC, eliminating the need for public endpoints. Private DNS is turned off to ensure that the fully qualified domain names (FQDNs) of the services are resolved to their public IP addresses. The use of Amazon Route 53 private hosted zones provides a centralized and scalable DNS solution, and alias records are created to point to the interface VPC endpoints in the shared services VPC. AWS Transit Gateway is used to connect all the VPCs to the central shared services VPC, reducing the operational overhead of managing direct VPC-to-VPC connections. Options A, B, and D either have higher operational overhead or do not provide an optimal solution for centralizing access to Amazon S3 and Systems Manager.
Adapted from community discussion by vikasj1in · 2024-02-14 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
AWS documentation
AWS documentation
AWS documentation
Permanent link to question 25 Report an issue
Candidate context
Question 25 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ANS-C01 or CertExamHQ.
G
grc1979
2023-04-29
Selected C7 upvotes
https://aws.amazon.com/es/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ see Sharing PrivateLink endpoints between VPCs point
V
vikasj1in
2024-02-14
Selected C4 upvotes
This option uses interface VPC endpoints to centralize access to Amazon S3 and Systems Manager in a shared services VPC, eliminating the need for public endpoints. Private DNS is turned off to ensure that the fully qualified domain names (FQDNs) of the services are resolved to their public IP addresses. The use of Amazon Route 53 private hosted zones provides a centralized and scalable DNS solution, and alias records are created to point to the interface VPC endpoints in the shared services VPC. AWS Transit Gateway is used to connect all the VPCs to the central shared services VPC, reducing the operational overhead of managing direct VPC-to-VPC connections. Options A, B, and D either have higher operational overhead or do not provide an optimal solution for centralizing access to Amazon S3 and Systems Manager.
E
evargasbrz
2023-08-17
Selected C4 upvotes
When you create a VPC endpoint to an AWS service, you can enable private DNS. When enabled, the setting creates an AWS managed Route 53 private hosted zone (PHZ) which enables the resolution of public AWS service endpoint to the private IP of the interface endpoint. The managed PHZ only works within the VPC with the interface endpoint. In our setup, when we want spoke VPCs to be able to resolve VPC endpoint DNS hosted in a centralized VPC, the managed PHZ won’t work. To overcome this, disable the option that automatically creates the private DNS when an interface endpoint is created. Next, manually create a Route 53 PHZ and add an Alias record with the full AWS service endpoint name pointing to the interface endpoint, as shown in the following figure.
R
rhinozD
2023-04-29
Selected C4 upvotes
https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AWS Certified Advanced Networking – Specialty practice questions

25 of 294 questions are open

What is available on this page

About this question bank