A company has developed a web service for language translation. The web service's application runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) and are deployed in a private subnet. The web service can process requests that contain hundreds of megabytes of data.
The company needs to give some customers the ability to access the web service. Each customer has its own AWS account. The company must make the web service accessible to approved customers without making the web service accessible to all customers.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Create VPC peering connections with the approved customers only.
B. Create an AWS PrivateLink endpoint service. Configure the endpoint service to require acceptance that will be granted to approved customers only.
C. Configure an authentication action for the endpoint service's load balancer to allow customers to log in by using their AWS credentials. Provide only approved customers with the URL.
D. Configure a Network Load Balancer (NLB) and a listener with the ALB as a target. Associate the NLB with the endpoint service.
E. Associate the ALB with the endpoint service.
Show Answer
Correct Answer: B, D
Explanation: Use AWS PrivateLink to expose the service privately only to approved AWS accounts by creating an endpoint service that requires acceptance. PrivateLink endpoint services are backed by a Network Load Balancer, not an Application Load Balancer directly. You can place an NLB in front of the existing ALB by configuring the ALB as a target for the NLB, then associate the NLB with the endpoint service. This provides private, account-scoped access with low operational overhead compared with VPC peering.
Question 95
A company has a highly available application that is hosted in multiple VPCs and in two on-premises data centers. All the VPCs reside in the same AWS Region. All the VPCs require access to each other and to the on-premises data centers for the transfer of files that are multiple gigabytes in size.
A network engineer is designing an AWS Direct Connect solution to connect the on-premises data centers to each VPC.
Which architecture will meet the company's requirements with the LEAST operational overhead?
A. Configure a virtual private gateway and a private VIF in each VPC in the Region. Configure a Direct Connect gateway. Associate the VIF of every VPC with the Direct Connect gateway. Create a new private VIF that connects the Direct Connect gateway to each on-premises data center. Configure the new private VIF to exchange BGP routes with the on-premises data centers and to have an MTU of 9001. Use VPC peering between each VPC. Configure static routing in each VPC to provide inter-VPC routing.
B. Configure a virtual private gateway and a private VIF in each VPC in the Region. Configure a Direct Connect gateway. Associate the VIF of every VPC with the Direct Connect gateway. Create a new private VIF that connects the Direct Connect gateway to each on-premises data center. Configure the new private VIF to exchange BGP routes with the on-premises data centers and to have an MTU of 8500. Use VPC peering between each VPC. Configure static routing in each VPC to provide inter-VPC routing.
C. Configure a transit gateway in the same Region of each VPAttach each VPC to the transit gateway. Configure a Direct Connect gateway. Associate the Direct Connect gateway with the transit gateway. Associate a new transit VIF with each Direct Connect connection. Configure the new transit VIF to exchange BGP routes and to have an MTU of 9001. Configure route propagation between each VPC and the transit gateway.
D. Configure a transit gateway in the same Region of each VPC. Attach each VPC to the transit gateway. Configure a Direct Connect gateway. Associate the Direct Connect gateway with the transit gateway. Associate a new transit VIF with each Direct Connect connection. Configure the new transit VIF to exchange BGP routes and to have an MTU of 8500. Configure route propagation between each VPC and the transit gateway.
Show Answer
Correct Answer: D
Explanation: A transit gateway provides scalable any-to-any connectivity among multiple VPCs and on-premises networks with the least operational overhead, avoiding full-mesh VPC peering and static inter-VPC routing. For AWS Direct Connect with a transit gateway, use a Direct Connect gateway associated with the transit gateway and transit virtual interfaces. Transit VIF jumbo frame MTU is 8500 bytes (not 9001), with BGP route exchange and route propagation through the transit gateway.
Question 96
A company has AWS accounts in an organization in AWS Organizations. The company has implemented Amazon VPC IP Address Manager (IPAM) in its networking AWS account. The company is using AWS Resource Access Manager (AWS RAM) to share IPAM pools with other AWS accounts. The company has created a top-level pool with a CIDR block of 10.0.0.0/8. For each AWS account, the company has created an IPAM pool within the top-level pool.
A network engineer needs to implement a solution to ensure that users in each AWS account cannot create new VPCs. The solution also must prevent users from associating a CIDR block with existing VPCs unless the CIDR block is from the IPAM pool for that account.
Which solution will meet these requirements?
A. Create a new AWS Config rule to find all VPCs that are not configured to allocate their CIDR block from an IPAM pool. Invoke an AWS Lambda function to delete these VPCs.
B. Create a new SCP in Organizations. Add a condition that denies the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions if the Ipv4IpamPoolId context key value is not the ID of an IPAM pool.
C. Create an AWS Lambda function to check for and delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool. Invoke the Lambda function at regular intervals.
D. Create an Amazon EventBridge rule to check for AWS CloudTrail events for the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions. Use the rule to invoke an AWS Lambda function to delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool.
Show Answer
Correct Answer: B
Explanation: An SCP is the correct preventive control for an AWS Organization. By denying the EC2 CreateVpc and AssociateVpcCidrBlock actions unless the request includes the appropriate Ipv4IpamPoolId, users cannot create VPCs or associate additional CIDR blocks outside the designated IPAM pool. The other options are detective/reactive controls that allow noncompliant resources to be created before remediation.
Question 97
A company's AWS infrastructure is spread across more than 50 accounts and across five AWS Regions. The company needs to manage its security posture with simplified administration and maintenance for all the AWS accounts. The company wants to use AWS Firewall Manager to manage the firewall rules and requirements.
The company creates an organization with all features enabled in AWS Organizations.
Which combination of steps should the company take next to meet the requirements? (Choose three.)
A. Configure only the Firewall Manager administrator account to join the organization.
B. Configure all the accounts to join the organization.
C. Set an account as the Firewall Manager administrator account.
D. Set an account as the Firewall Manager child account.
E. Set up AWS Config for all the accounts and all the Regions where the company has resources.
F. Set up AWS Config for only the organization's management account.
Show Answer
Correct Answer: B, C, E
Explanation: AWS Firewall Manager requires AWS Organizations with all features enabled, all member accounts to be part of the organization, a delegated Firewall Manager administrator account, and AWS Config enabled in every account and Region where protected resources exist. A child account designation is not used, and enabling AWS Config only in the management account is insufficient.
Question 98
A company securely connects resources that are in its VPC to a software as a service (SaaS) solution from a SaaS provider. The SaaS solution is hosted in the AWS Cloud and is powered by AWS PrivateLink. The company uses a PrivateLink endpoint to access the SaaS solution behind the SaaS provider's Network Load Balancer (NLB).
The company recently added a new Availability Zone and new subnets to its VPC. A network engineer is unable to deploy a new interface VPC endpoint for the SaaS solution in the new Availability Zone.
What is the cause of this problem?
A. The CIDR block of the new subnets conflicts with the SaaS provider's CIDR block.
B. The enableDnsHostnames attribute and enableDnsSupport attribute were not configured on the new subnets in the new Availability Zone.
C. The SaaS provider does not offer the solution in the new Availability Zone and has not configured cross-zone load balancing for the NLB.
D. The new subnets are missing a route to the VPC internet gateway.
Show Answer
Correct Answer: C
Explanation: AWS PrivateLink interface endpoints can be created only in Availability Zones that the endpoint service supports. If the SaaS provider has not enabled the endpoint service in the newly added Availability Zone, the endpoint cannot be deployed there. Cross-zone load balancing on the provider's Network Load Balancer does not make the endpoint service available in unsupported Availability Zones; the provider must expose the service in that AZ. The other options are incorrect because PrivateLink does not require overlapping/non-overlapping provider CIDRs, subnet DNS attributes do not prevent endpoint creation, and an internet gateway route is not required for PrivateLink.
Question 99
An international company wants to implement a multi-site hybrid infrastructure. The company wants to deploy its cloud computing resources on AWS in the us-east-1 Region and in the eu-west-2 Region, and in on-premises data centers in the United States (US) and in the United Kingdom (UK). The data centers are connected to each other by a private WAN connection. IP routing information is exchanged dynamically through BGP. The company wants to have two AWS Direct Connect connections, one each in the US and the UK.
The company expects to have 15 VPCs in each Region with CIDR blocks that do not overlap with each other or with CIDR blocks of the on-premises environment. The VPC CIDR blocks are planned so that the prefix aggregation can be performed both on a Regional level and across the entire AWS environment. The company will deploy a transit gateway in each Region to connect the VPCs. A network engineer plans to use a Direct Connect gateway in each Region. A transit VIF will attach the Direct Connect gateway in each Region to the transit gateway in that Region. The transit gateways will be peered with each other.
The network engineer wants to ensure that traffic follows the shortest geographical path from source to destination. Traffic between the on-premises data centers and AWS must travel across a local Direct Connect connection. Traffic between the US data center and eu-west-2 and traffic between the UK data center and us-east-1 must use the private WAN connection to reach the Direct Connect connection to the appropriate Region when the Direct Connect connection is available. The network must be resilient to failures in either the private WAN connection or with the Direct Connect connections. The network also must reroute traffic automatically in the event of any failure.
How should the network engineer configure the transit VIF associations on the Direct Connect gateways to meet these requirements?
A. Advertise only the aggregate route for the company's entire AWS environment.
B. Advertise VPC-specific CIDR prefixes from only the local Region. Additionally, advertise the aggregate route for the company’s entire AWS environment.
C. Advertise all the specific VPC CIDR blocks from both Regions.
D. Advertise both Regional aggregate prefixes. Configure custom BGP communities on the routes advertised toward the data center.
Show Answer
Correct Answer: B
Explanation: Advertising VPC-specific prefixes for the local Region makes the on-premises routers prefer the local Direct Connect path for destinations in that Region because the more-specific routes win. Advertising a single aggregate for the entire AWS address space provides a fallback path if the local Direct Connect fails, allowing traffic to reroute via the private WAN to the remote Direct Connect and then across the AWS backbone/transit gateway peering. This satisfies geographic path preference while maintaining automatic resiliency without advertising every VPC from both Regions.
Question 100
A company has a data center in the us-west-1 Region with a 10 Gbps AWS Direct Connect dedicated connection to a Direct Connect gateway. There are two private VIFs from the same data center location in us-west-1 that are attached to the same Direct Connect gateway.
VIF 1 advertises 172.16.0.0/16 with an AS_PATH attribute value of 65000. VIF 2 advertises 172.16.1.0/24 with an AS PATH attribute value of 65000 65000 65000.
How will AWS route traffic to the data center for traffic that has a destination address within the 172.16.1.0/24 network range?
A. AWS will route all traffic by using VIF 1.
B. AWS will route all traffic by using VIF 2.
C. AWS will use both VIFs for routing by using a round-robin policy.
D. AWS will use flow control to balance the traffic between the two VIFs.
Show Answer
Correct Answer: B
Explanation: AWS uses longest-prefix match before considering BGP path attributes. The 172.16.1.0/24 route advertised on VIF 2 is more specific than the 172.16.0.0/16 route on VIF 1, so traffic destined for 172.16.1.0/24 will be routed via VIF 2. The longer AS_PATH on VIF 2 does not override longest-prefix matching in this case.
Question 101
A company has an application that runs on premises. The application needs to communicate with an application that runs in a VPC on AWS. The communication between the applications must be encrypted and must use private IP addresses. The communication cannot travel across the public internet.
The company has established a 1 Gbps AWS Direct Connect connection between the on-premises location and AWS.
Which solution will meet the connectivity requirements with the LEAST operational overhead?
A. Configure a private VIF on the Direct Connect connection. Associate the private VIF with the VPC's virtual private gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the virtual private gateway.
B. Create a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.
C. Configure a public VIF on the Direct Connect connection. Associate the public VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.
D. Create a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up a third-party firewall in a new VPC that is attached to the transit gateway. Set up a VPN connection to the third-party firewall.
Show Answer
Correct Answer: B
Explanation: The requirement is encrypted connectivity over Direct Connect without traversing the public internet and using private IP addresses. AWS recommends a private IP VPN over Direct Connect for this use case. A private IP VPN to a Transit Gateway requires a transit VIF and Direct Connect gateway. Option A is not valid because private IP VPN is not established to a virtual private gateway over a private VIF. Option C uses a public VIF and has an invalid association pattern, and D adds unnecessary third-party infrastructure, increasing operational overhead.
Question 102
A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all inbound traffic to the ALB to come from CloudFront. The network engineer must implement the solution at the network layer rather than in the application.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.
B. Add an inbound rule to the network ACLs that are associated with the ALB's subnets. Use the AWS managed prefix list for CloudFront as the source in the rule.
C. Configure CloudFront to add a custom HTTP header to the requests that CloudFront sends to the ALB.
D. Associate an AWS WAF web ACL with the ALB. Configure the AWS WAF rules to allow traffic from the CloudFront IP set. Automatically update the CloudFront IP set by using an AWS Lambda function.
Show Answer
Correct Answer: A
Explanation: Using the AWS-managed CloudFront origin-facing prefix list in the ALB's security group restricts network-layer access so only traffic originating from CloudFront can reach the ALB. AWS maintains the prefix list automatically, making it the most operationally efficient solution. Network ACLs do not support AWS-managed prefix lists in the required way for this use case, custom HTTP headers operate at the application layer, and AWS WAF is not a network-layer control and would require additional maintenance if using IP sets.
Question 103
A company's VPC has Amazon EC2 instances that are communicating with AWS services over the public internet. The company needs to change the connectivity so that the communication does not occur over the public internet.
The company deploys AWS PrivateLink endpoints in the VPC. After the deployment of the PrivateLink endpoints, the EC2 instances can no longer communicate at all with the required AWS services.
Which combination of steps should a network engineer take to restore communication with the AWS services? (Choose two.)
A. In the VPC route table, add a route that has the PrivateLink endpoints as the destination.
B. Ensure that the enableDnsSupport attribute is set to True for the VPC. Ensure that each VPC endpoint has DNS support enabled.
C. Ensure that the VPC endpoint policy allows communication.
D. Create an Amazon Route 53 public hosted zone for all services.
E. Create an Amazon Route 53 private hosted zone that includes a custom name for each service.
Show Answer
Correct Answer: B, C
Explanation: Interface VPC endpoints (AWS PrivateLink) rely on private DNS rather than route table entries. The VPC must have DNS support enabled, and private DNS should be enabled on the interface endpoints so standard AWS service names resolve to the endpoint ENIs. In addition, the VPC endpoint policy must allow the required actions; an overly restrictive endpoint policy can block access. Route table changes are not required for interface endpoints, and Route 53 hosted zones are not needed for standard AWS service PrivateLink access.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.