A company needs to manage Amazon EC2 instances through command line interfaces for Linux hosts and Windows hosts. The EC2 instances are deployed in an environment in which there is no route to the internet. The company must implement role-based access control for management of the instances. The company has a standalone on-premises environment.
Which approach will meet these requirements with the LEAST maintenance overhead?
A. Set up an AWS Direct Connect connection between the on-premises environment and the VPC where the instances are deployed. Configure routing, security groups, and ACLs. Connect to the instances by using the Direct Connect connection.
B. Deploy and configure AWS Systems Manager Agent (SSM Agent) on each instance. Deploy VPC endpoints for Systems Manager Session Manager. Connect to the instances by using Session Manager.
C. Establish an AWS Site-to-Site VPN connection between the on-premises environment and the VPC where the instances are deployed. Configure routing, security groups, and ACLs. Connect to the instances by using the Site-to-Site VPN connection.
D. Deploy an appliance to the VPC where the instances are deployed. Assign a public IP address to the appliance. Configure security groups and ACLs. Connect to the instances by using the appliance as an intermediary.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Session Manager allows command-line access to EC2 instances without any internet connectivity by using VPC endpoints. It integrates natively with IAM for role-based access control, works for both Linux and Windows hosts, and avoids managing network connectivity like VPNs or Direct Connect. This results in the least maintenance overhead compared to network-based access solutions or bastion appliances.
Question 93
A company has a public application. The application uses an Application Load Balancer (ALB) that has a target group of Amazon EC2 instances.
The company wants to protect the application from security issues in web requests. The traffic to the application must have end-to-end encryption.
Which solution will meet these requirements?
A. Configure a Network Load Balancer (NLB) that has a target group of the existing EC2 instances. Configure TLS connections to terminate on the EC2 instances that use a public certificate. Configure an AWS WAF web ACL. Associate the web ACL with the NLB.
B. Configure TLS connections to terminate at the ALB that uses a public certificate. Configure AWS Certificate Manager (ACM) certificates for the communication between the ALB and the EC2 instances. Configure an AWS WAF web ACL. Associate the web ACL with the AL
C. Configure a Network Load Balancer (NLB) that has a target group of the existing EC2 instances. Configure TLS connections to terminate at the EC2 instances by creating a TLS listener. Configure self-signed certificates on the EC2 instances for the communication between the NLB and the EC2 instances. Configure an AWS WAF web ACL. Associate the web ACL with the NLB.
D. Configure a third-party certificate on the EC2 instances for the communication between the ALB and the EC2 instances. Import the third-party certificate into AWS Certificate Manager (ACM). Associate the imported certificate with the ALB. Configure TLS connections to terminate at the ALB. Configure an AWS WAF web ACL. Associate the web ACL with the ALB.
Show Answer
Correct Answer: B
Explanation: The application already uses an Application Load Balancer, and AWS WAF can be associated only with ALB, CloudFront, or API Gateway (not NLB), so options A and C are invalid. End-to-end encryption is achieved by terminating TLS at the ALB with a public certificate and using HTTPS between the ALB and EC2 instances. This is supported by configuring the target group to use HTTPS; the EC2 instances manage their own certificates. AWS Certificate Manager is correctly used on the ALB for the public-facing certificate, and AWS WAF is associated with the ALB to protect against web request threats. Option D is incorrect because importing a third-party certificate into ACM does not enable ACM-managed certificates for ALB-to-EC2 communication, and it adds unnecessary and incorrect steps.
Question 94
A company has an AWS Site-to-Site VPN connection between AWS and its branch office. A network engineer is troubleshooting connectivity issues that the connection is experiencing. The VPN connection terminates at a transit gateway and is statically routed. In the transit gateway route table, there are several static route entries that target specific subnets at the branch office.
The network engineer determines that the root cause of the issues was the expansion of underlying subnet ranges in the branch office during routine maintenance.
Which solution will solve this problem with the LEAST administrative overhead for future expansion efforts?
A. Determine a supernet for the branch office. In the transit gateway route table, add an aggregate route that targets the VPN attachment. Replace the specific subnet routes in the transit gateway route table with the new supernet route.
B. Create an AWS Direct Connect gateway and a transit VIF. Associate the Direct Connect gateway with the transit gateway. Create a propagation for the Direct Connect attachment to the transit gateway route table.
C. Create a dynamically routed VPN connection on the transit gateway. Connect the dynamically routed VPN connection to the branch office. Create a propagation for the VPN attachment to the transit gateway route table. Remove the existing static VPN connection.
D. Create a prefix list that contains the new subnets and the old subnets for the branch office. Remove the specific subnet routes in the transit gateway route table. Create a prefix list reference in the transit gateway route table.
Show Answer
Correct Answer: C
Explanation: The problem is caused by static routes that must be manually updated whenever the branch office expands its subnet ranges. The solution with the least administrative overhead is to eliminate static routing altogether. By using a dynamically routed Site-to-Site VPN with BGP and enabling route propagation on the transit gateway, new and changed on‑premises routes are learned automatically. This removes the need for ongoing manual route updates during future expansions, unlike supernets or prefix lists, which still require planning and maintenance.
Question 95
A company hosts infrastructure services in multiple VPCs across multiple accounts in the us-west-2 Region. The VPC CIDR blocks do not overlap. The company wants to connect the VPCs to its data centers by using AWS Site-to-Site VPN tunnels.
The connections must be encrypted in transit. Additionally, the connection from each data center must route to the closest AWS edge location. The connections must be highly available and must accommodate automatic failover.
Which solution will meet these requirements?
A. Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering.
B. Deploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on each account. Add routes to the on-premises subnet in each of the service VPC route tables. Use the VPNs as the gateway. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering.
C. Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure static routing.
D. Deploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on each account. Add routes to the on-premises subnet in each of the service VPC route tables. Use the VPNs as the gateway. Configure the VPN tunnels on the on-premises equipment. Configure static routing.
Show Answer
Correct Answer: A
Explanation: The solution must provide encrypted Site-to-Site VPN connectivity, use the closest AWS edge location, and support high availability with automatic failover across multiple VPCs and accounts. Using an AWS Transit Gateway shared via AWS RAM allows centralized connectivity for all VPCs. Site-to-Site VPN attachments to the transit gateway support dynamic routing with BGP, which is required for automatic failover. Enabling VPN acceleration ensures traffic enters AWS at the nearest edge location. Options using static routing do not support automatic failover, and deploying individual VPN gateways per VPC is less scalable and does not meet the centralized multi-account requirement as effectively.
Question 96
A company has agreed to collaborate with a partner for a research project. The company has multiple VPCs in the us-east-1 Region that use CIDR blocks within 10.10.0.0/16. The VPCs are connected by a transit gateway that is named TGW-C in us-east-1. TGW-C has an Autonomous System Number (ASN) configuration value of 64520.
The partner has multiple VPCs in us-east-1 that use CIDR blocks within 172.16.0.0/16. The VPCs are connected by a transit gateway that is named TGW-P in us-east-1. TGW-P has an ASN configuration value of 64530.
A network engineer needs to establish network connectivity between the company's VPCs and the partner's VPCs in us-east-1.
Which solution will meet these requirements with MINIMUM changes to both networks?
A. Create a new VPC in a new account. Deploy a router from AWS Marketplace. Share TGW-C and TGW-P with the new account by using AWS Resource Access Manager (AWS RAM). Associate TGW-C and TGW-P with the new VPC. Configure the router in the new VPC to route between TGW-C and TGW-P.
B. Create an IPsec VPN connection between TGW-C and TGW-P. Configure the routing between the transit gateways to use the IPsec VPN connection.
C. Configure a cross-account transit gateway peering attachment between TGW-C and TGW-P. Configure the routing between the transit gateways to use the peering attachment.
D. Share TGW-C with the partner account by using AWS Resource Access Manager (AWS RAM). Associate the partner VPCs with TGW-C. Configure routing in the partner VPCs and TGW-C.
Show Answer
Correct Answer: C
Explanation: The requirement is to connect two existing transit gateways in the same Region across different accounts with minimal changes. A cross-account transit gateway peering attachment directly connects TGW-C and TGW-P, supports different ASN values, and avoids redesigning VPC attachments or introducing additional VPN or routing infrastructure. IPsec VPNs and router-based solutions add unnecessary complexity, and sharing one transit gateway (option D) would require reattaching partner VPCs, which is a larger change.
Question 98
A company is planning to migrate an internal application to the AWS Cloud. The application will run on Amazon EC2 instances in one VPC. Users will access the application from the company's on-premises data center through AWS VPN or AWS Direct Connect. Users will use private domain names for the application endpoint from a domain name that is reserved explicitly for use in the AWS Cloud.
Each EC2 instance must have automatic failover to another EC2 instance in the same AWS account and the same VPC. A network engineer must design a DNS solution that will not expose the application to the internet.
Which solution will meet these requirements?
A. Assign public IP addresses to the EC2 instances. Create an Amazon Route 53 private hosted zone for the AWS reserved domain name. Associate the private hosted zone with the VPC. Create a Route 53 Resolver outbound endpoint. Configure conditional forwarding in the on-premises DNS resolvers to forward all DNS queries for the AWS domain to the outbound endpoint IP address for Route 53 Resolver. In the private hosted zone, configure primary and failover records that point to the public IP addresses of the EC2 instances. Create an Amazon CloudWatch metric and alarm to monitor the application's health. Set up a health check on the alarm for the primary application endpoint.
B. Place the EC2 instances in private subnets. Create an Amazon Route 53 public hosted zone for the AWS reserved domain name. Associate the public hosted zone with the VPC. Create a Route 53 Resolver inbound endpoint. Configure conditional forwarding in the on-premises DNS resolvers to forward all DNS queries for the AWS domain to the inbound endpoint IP address for Route 53 Resolver. In the public hosted zone, configure primary and failover records that point to the IP addresses of the EC2 instances. Create an Amazon CloudWatch metric and alarm to monitor the application's health. Set up a health check on the alarm for the primary application endpoint.
C. Place the EC2 instances in private subnets. Create an Amazon Route 53 private hosted zone for the AWS reserved domain name. Associate the private hosted zone with the VPCreate a Route 53 Resolver inbound endpoint. Configure conditional forwarding in the on-premises DNS resolvers to forward all DNS queries for the AWS domain to the inbound endpoint IP address for Route 53 Resolver. In the private hosted zone, configure primary and failover records that point to the IP addresses of the EC2 instances. Create an Amazon CloudWatch metric and alarm to monitor the application's health. Set up a health check on the alarm for the primary application endpoint.
D. Place the EC2 instances in private subnets. Create an Amazon Route 53 private hosted zone for the AWS reserved domain name. Associate the private hosted zone with the VPC. Create a Route 53 Resolver inbound endpoint. Configure conditional forwarding in the on-premises DNS resolvers to forward all DNS queries for the AWS domain to the inbound endpoint IP address for Route 53 Resolver. In the private hosted zone, configure primary and failover records that point to the IP addresses of the EC2 instances. Set up Route 53 health checks on the private IP addresses of the EC2 instances.
Show Answer
Correct Answer: C
Explanation: The application must remain private, use private DNS names, and support failover within a VPC. This requires EC2 instances in private subnets and a Route 53 private hosted zone associated with the VPC. On‑premises users can resolve the private AWS domain by forwarding queries to a Route 53 Resolver inbound endpoint. For failover without exposing endpoints to the internet, Route 53 failover records must be driven by CloudWatch alarms, because native Route 53 health checks cannot directly probe private IPs in a private hosted zone. Option C satisfies all requirements without public exposure.
Question 99
A network engineer needs to improve the network security of an existing AWS environment by adding an AWS Network Firewall firewall to control internet-bound traffic. The AWS environment consists of five VPCs. Each VPC has an internet gateway, NAT gateways, public Application Load Balancers (ALBs), and Amazon EC2 instances. The EC2 instances are deployed in private subnets. The architecture is deployed across two Availability Zones.
The network engineer must be able to configure rules for the public IP addresses in the environment, regardless of the direction of traffic. The network engineer must add the firewall by implementing a solution that minimizes changes to the existing production environment. The solution also must ensure high availability.
Which combination of steps should the network engineer take to meet these requirements? (Choose two.)
A. Create a centralized inspection VPC with subnets in two Availability Zones. Deploy Network Firewall in this inspection VPC with an endpoint in each Availability Zone.
B. Configure new subnets in two Availability Zones in each VPC. Deploy Network Firewall in each VPC with an endpoint in each Availability Zone.
C. Deploy Network Firewall in each VPUse existing subnets in each of the two Availability Zones to deploy Network Firewall endpoints.
D. Update the route tables that are associated with the private subnets that host the EC2 instances. Add routes to the Network Firewall endpoints.
E. Update the route tables that are associated with the public subnets that host the NAT gateways and the ALBs. Add routes to the Network Firewall endpoints.
Show Answer
Correct Answer: B, E
Explanation: The requirements call for minimal changes to existing VPCs, high availability across two AZs, and the ability to inspect traffic to and from public IPs (including ALBs and internet-bound traffic). A centralized inspection VPC (option A) would require additional connectivity such as a Transit Gateway or VPC peering, which is not described and would increase architectural changes. Therefore, a distributed model is appropriate.
Deploying AWS Network Firewall in each VPC using new dedicated firewall subnets in two AZs (option B) aligns with AWS best practices for a distributed deployment and ensures high availability while avoiding the need for new inter-VPC connectivity. To ensure that both inbound traffic to public ALBs and outbound internet traffic via NAT gateways are inspected, the route tables associated with the public subnets must be updated to send traffic through the firewall endpoints (option E). Updating only private subnet routes would not protect ALB traffic.
Thus, the correct combination is B and E.
Question 100
A company has a total of 30 VPCs. Three AWS Regions each contain 10 VPCs. The company has attached the VPCs in each Region to a transit gateway in that Region. The company also has set up inter-Region peering connections between the transit gateways.
The company wants to use AWS Direct Connect to provide access from its on-premises location for only four VPCs across the three Regions. The company has provisioned four Direct Connect connections at two Direct Connect locations.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)
A. Create four virtual private gateways. Attach the virtual private gateways to the four VPCs.
B. Create a Direct Connect gateway. Associate the four virtual private gateways with the Direct Connect gateway.
C. Create four transit VIFs on each Direct Connect connection. Associate the transit VIFs with the Direct Connect gateway.
D. Create four transit VIFs on each Direct Connect connection. Associate the transit VIFs with the four virtual private gateways.
E. Create four private VIFs on each Direct Connect connection to the Direct Connect gateway.
F. Create an association between the Direct Connect gateway and the transit gateways.
Show Answer
Correct Answer: A, B, E
Explanation: The most cost-effective way to provide on-premises access to only four VPCs is to connect those VPCs directly with virtual private gateways (VGWs) rather than extending connectivity through transit gateways (TGWs), which would add unnecessary cost and complexity.
A. Each of the four VPCs that requires on-premises access must have its own virtual private gateway.
B. A Direct Connect gateway is required to aggregate access across multiple VPCs and Regions and to connect the VGWs to Direct Connect.
E. Private virtual interfaces (private VIFs) are used with a Direct Connect gateway to connect on-premises networks to VPCs via VGWs.
Using transit VIFs and associating the Direct Connect gateway with transit gateways (options C and F) would provide broader access through the TGWs and incur higher costs, which is unnecessary when only four VPCs require connectivity.
Question 101
A company uses Amazon Route 53 for its DNS needs. The company's security team wants to update the DNS infrastructure to provide the most recent security posture.
The security team has configured DNS Security Extensions (DNSSEC) for the domain. The security team wants a network engineer to explain who is responsible for the rotation of DNSSEC keys.
Which explanation should the network administrator provide to the security team?
A. AWS rotates the zone-signing key (ZSK). The company rotates the key-signing key (KSK).
B. The company rotates the zone-signing key (ZSK) and the key-signing key (KSK).
C. AWS rotates the AWS Key Management Service (AWS KMS) key and the key-signing key (KSK).
D. The company rotates the AWS Key Management Service (AWS KMS) key. AWS rotates the key-signing key (KSK).
Show Answer
Correct Answer: A
Explanation: With Amazon Route 53 DNSSEC, AWS manages and automatically rotates the zone-signing key (ZSK). The key-signing key (KSK) is based on a customer-managed asymmetric AWS KMS key, and the customer is responsible for managing and rotating the KSK when required.
Question 102
A company has set up a NAT gateway in a single Availability Zone (AZ1) in a VPC (VPC1) to access the internet from Amazon EC2 workloads in the VPC. The EC2 workloads are running in private subnets in three Availability Zones (AZ1, AZ2, AZ3). The route table for each subnet is configured to use the NAT gateway to access the internet.
Recently during an outage, internet access stopped working for the EC2 workloads because of the NAT gateway's unavailability. A network engineer must implement a solution to remove the single point of failure from the architecture and provide built-in redundancy.
Which solution will meet these requirements?
A. Set up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table for private subnets to route traffic to the virtual IP addresses of the two NAT gateways.
B. Set up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table to point the AZ2 private subnets to the NAT gateway in AZ2. Configure the same route table to point the AZ3 private subnets to the NAT gateway in AZ3.
C. Create a second VPC (VPC2). Set up two NAT gateways. Place each NAT gateway in a different VPC (VPC1 and VPC2) and in the same Availability Zone (AZ2). Configure a route table in VPC1 to point the AZ2 private subnets to one NAT gateway. Configure a route table in VPC2 to point the AZ2 private subnets to the second NAT gateway.
D. Set up two NAT gateways. Place each NAT gateway in a different public subnet in separate Availability Zones (AZ2 and AZ3). Configure a route table to point the AZ2 private subnets to the NAT gateway in AZ2. Configure a second route table to point the AZ3 private subnets to the NAT gateway in AZ3.
Show Answer
Correct Answer: D
Explanation: NAT gateways are AZ-scoped and do not provide cross-AZ high availability. To remove the single point of failure, deploy one NAT gateway per Availability Zone and route private subnets in each AZ to the NAT gateway in the same AZ using separate route tables. This provides built-in redundancy and avoids cross-AZ dependencies. Options proposing virtual IPs or shared NAT gateways across AZs are not supported or still introduce a single point of failure.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.