A company is developing a new application that is deployed in multiple VPCs across multiple AWS Regions. The VPCs are connected through AWS Transit Gateway. The VPCs contain private subnets and public subnets.
All outbound internet traffic in the private subnets must be audited and logged. The company's network engineer plans to use AWS Network Firewall and must ensure that all traffic through Network Firewall is completely logged for auditing and alerting.
How should the network engineer configure Network Firewall logging to meet these requirements?
A. Configure Network Firewall logging in Amazon CloudWatch to capture all alerts. Send the logs to a log group in Amazon CloudWatch Logs.
B. Configure Network Firewall logging in Network Firewall to capture all alerts and flow logs.
C. Configure Network Firewall logging by configuring VPC Flow Logs for the firewall endpoint. Send the logs to a log group in Amazon CloudWatch Logs.
D. Configure Network Firewall logging by configuring AWS CloudTrail to capture data events.
Show Answer
Correct Answer: B
Explanation: The requirement is to audit and log all outbound traffic through AWS Network Firewall, which means capturing both traffic (flow) logs and alert logs. AWS Network Firewall natively supports two log types—alert logs and flow logs—and logging must be configured on the firewall itself to send these logs to a supported destination (CloudWatch Logs, S3, or Kinesis Data Firehose). Option B is the only choice that explicitly enables both alerts and flow logs. Option A captures only alerts, VPC Flow Logs (Option C) do not provide Network Firewall alerts, and CloudTrail (Option D) records API activity, not network traffic.
Question 104
A company has a hybrid IT setup that includes services that run in an on-premises data center and in the AWS Cloud. The company is using AWS Direct Connect to connect its data center to AWS. The company is using one AWS Site-to-Site VPN connection as backup and requires a backup connectivity option to always be present. The company is transitioning to IPv6 by implementing dual-stack architectures.
Which combination of steps will transition the data center's connectivity to AWS in the LEAST amount of time? (Choose two.)
A. Create a new Site-to-Site VPN tunnel for the IPv6 traffic.
B. Create a new dual-stack Site-to-Site VPN connection between the data center and AWS. Provision routing. Delete the original Site-to-Site VPN connection.
C. Associate a new dual-stack public VIF with the Direct Connect connection. Migrate the Direct Connect traffic to the new VIF.
D. Add a new IPv6 peer in the existing VIF. Use the IPv6 address provided by Amazon on the peer router.
E. Send IPv6 traffic between the data center and AWS in a tunnel inside the existing IPv4 tunnels.
Show Answer
Correct Answer: A, D
Explanation: The goal is to transition to dual-stack (IPv4/IPv6) connectivity in the least amount of time while maintaining an always-present backup connection.
For the backup path (Site-to-Site VPN): Existing Site-to-Site VPN connections cannot be converted to dual-stack, and a single VPN connection cannot carry both IPv4 and IPv6 traffic. The fastest approach is to create an additional VPN tunnel specifically for IPv6 traffic while keeping the existing IPv4 VPN as backup. This matches option A.
For the primary path (Direct Connect): IPv6 can be enabled on Direct Connect without creating a new VIF by adding an IPv6 BGP peer to the existing virtual interface. This is faster than provisioning a new VIF and migrating traffic. This matches option D.
Other options either require deleting and recreating connections, provisioning new VIFs, or rely on unsupported configurations, all of which take more time.
Question 105
A company has an order processing system that needs to keep credit card numbers encrypted. The company's customer-facing application runs as an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon CloudFront distribution is configured with the ALB as the origin. The company uses a third-party trusted certificate authority to provision its certificates.
The company is using HTTPS for encryption in transit. The company needs additional field-level encryption to keep sensitive data encrypted during processing so that only certain application components can decrypt the sensitive data.
Which combination of steps will meet these requirements? (Choose two.)
A. Import the third-party certificate for the ALB. Associate the certificate with the ALB. Upload the certificate for the CloudFront distribution into AWS Certificate Manager (ACM) in us-west-2.
B. Import the third-party certificate for the ALB into AWS Certificate Manager (ACM) in us-west-2. Associate the certificate with the ALUpload the certificate for the CloudFront distribution into ACM in the us-east-1 Region.
C. Upload the private key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption profile and specify the fields that contain sensitive information. Create a field-level encryption configuration, and choose the newly created profile. Link the configuration to the appropriate cache behavior that is associated with sensitive POST requests.
D. Upload the public key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption configuration, and specify the fields that contain sensitive information. Create a field-level encryption profile, and choose the newly created configuration. Link the profile to the appropriate cache behavior that is associated with sensitive GET requests.
E. Upload the public key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption profile and specify the fields that contain sensitive information. Create a field-level encryption configuration, and choose the newly created profile. Link the configuration to the appropriate cache behavior that is associated with sensitive POST requests.
Show Answer
Correct Answer: B, E
Explanation: CloudFront requires viewer HTTPS certificates to be in ACM us-east-1, while the ALB certificate is imported into ACM in the ALB’s Region (us-west-2), making option B correct. For field-level encryption, CloudFront uses a public key to encrypt sensitive fields in incoming POST requests, configured through a field-level encryption profile and configuration linked to the relevant cache behavior. The private key remains with trusted application components for decryption, which is exactly what option E describes.
Question 106
A network engineer is evaluating a network setup for a global retail company. The company has an AWS Direct Connect connection between its on-premises data center and the AWS Cloud. The company has AWS resources in the eu-west-2 Region. These resources consist of multiple VPCs that are attached to a transit gateway.
The company recently provisioned a few AWS resources in the eu-central-1. Region in a single VPC close to its users in this area. The network engineer must connect the resources in eu-central-1 with the on-premises data center and the resources in eu-west-2. The solution must minimize changes to the Direct Connect connection.
What should the network engineer do to meet these requirements?
A. Create a new virtual private gateway. Attach the new virtual private gateway to the VPC in eu-central-1. Use a transit VIF to connect the VPC and the Direct Connect router.
B. Create a new transit gateway in eu-central-1. Create a peering attachment request to the transit gateway in eu-west-2. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gateway peering attachment. Accept the peering request. Add a static route in the transit gateway route table in eu-west-2 to point to the new transit gateway peering attachment.
C. Create a new transit gateway in eu-central-1. Use an AWS Site-to-Site VPN connection to peer both transit gateways. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gateway VPN attachment. Add a static route in the transit gateway route table in eu-west-2 to point to the new transit gateway peering attachment.
D. Create a new virtual private gateway. Attach the new virtual private gateway to the VPC in eu-central-1. Use a public VIF to connect the VPC and the Direct Connect router.
Show Answer
Correct Answer: B
Explanation: Transit gateways are regional. To connect a VPC in eu-central-1 with existing VPCs and on-premises connectivity via the eu-west-2 transit gateway and Direct Connect, the correct approach is to create a transit gateway in eu-central-1 and peer it with the existing eu-west-2 transit gateway. Inter-Region transit gateway peering provides private, scalable connectivity between regions and requires no changes to the existing Direct Connect configuration, which already terminates on the eu-west-2 transit gateway.
Question 107
A company has an on-premises data center in the United States. The data center is connected to AWS by an AWS Direct Connect connection. The data center has a private VIF that is connected to a Direct Connect gateway.
Recently, the company opened a new data center in Europe and established a new Direct Connect connection between the Europe data center and AWS. A new private VIF connects to the existing Direct Connect gateway.
The company wants to use Direct Connect SiteLink to set up a private network between the data center in the United States and the data center in Europe.
Which solution will meet these requirements in the MOST operationally efficient manner?
A. Create a new public VIF from each data center. Enable SiteLink on the new public VIFs.
B. Create a new transit VIF from each data center. Enable SiteLink on the new transit VIFs.
C. Use the existing VIF from each data center. Enable SiteLink on the existing private VIFs.
D. Create a new AWS Site-to-Site VPN connection between the data centers. Configure the new connection to use SiteLink.
Show Answer
Correct Answer: C
Explanation: Direct Connect SiteLink can be enabled on existing private or transit VIFs that are attached to the same Direct Connect gateway. The company already has private VIFs from both the US and Europe data centers connected to the existing Direct Connect gateway, so enabling SiteLink on those existing private VIFs allows direct, private connectivity between the data centers without creating new VIFs or connections. This is the most operationally efficient option.
Question 108
A company is migrating critical applications to AWS. The company has multiple accounts and VPCs that are connected by a transit gateway.
A network engineer must design a solution that performs deep packet inspection for any traffic that leaves a VPC network boundary. All inspected traffic and the actions that are taken on the traffic must be logged in a central log account.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Create a central network VPC that includes an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Gateway Load Balancer that is backed by third-party, next-generation firewall appliances to the central network VPC. Create a policy that contains the rules for deep packet inspection. Attach the policy to the firewall appliances. Create an Amazon S3 bucket in the central log account. Configure the firewall appliances to capture and save the network flow logs to the S3 bucket.
B. Create a central network VPC that includes an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Application Load Balancer that is backed by third-party, next-generation firewall appliances to the central network VPC. Create a policy that contains the rules for deep packet inspection. Attach the policy to the firewall appliances. Create a syslog server in the central log account. Configure the firewall appliances to capture and save the network flow logs to the syslog server.
C. Deploy network ACLs and security groups to each VPAttach the security groups to active network interfaces. Associate the network ACLs with VPC subnets. Create rules for the network ACLs and security groups to allow only the required traffic flows between subnets and network interfaces. Create an Amazon S3 bucket in the central log account. Configure a VPC flow log that captures and saves all traffic flows to the S3 bucket.
D. Create a central log VPC and an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Network Load Balancer (NLB) that is backed by third-party, next-generation intrusion detection system (IDS) security appliances to the central VPC. Activate rules on the security appliances to monitor for intrusion signatures. For each network interface, create a VPC Traffic Mirroring session that sends the traffic to the central VPC's NLB.
Show Answer
Correct Answer: A
Explanation: The requirement is for inline deep packet inspection of all traffic leaving VPC boundaries across multiple accounts and VPCs, with centralized logging and the least administrative overhead. AWS Gateway Load Balancer (GWLB) is purpose-built for this use case: it transparently inserts third-party next-generation firewalls inline with traffic flowing through a transit gateway, without per-ENI configuration or traffic mirroring. GWLB scales automatically and integrates cleanly with TGW routing. Firewall appliances can enforce inspection policies and take actions (allow, block, modify traffic) and send logs centrally to an S3 bucket in a dedicated log account.
Option B is invalid because ALB operates at Layer 7 and cannot perform transparent inline inspection of arbitrary network traffic. Option C only provides basic filtering and flow logs, not deep packet inspection. Option D relies on traffic mirroring, which is out-of-band (not inline), cannot take actions on traffic, and requires mirroring configuration per interface, increasing operational overhead. Therefore, A best meets all requirements with the least administrative overhead.
Question 109
A financial company that is located in the us-east-1 Region needs to establish secure connectivity to AWS. The company has two on-premises data centers, each located within the same Region. The company's network team needs to establish hybrid connectivity to its AWS environment with reliable and consistent connectivity.
The connection must provide access to the company's private resources inside its AWS environment. The resources are located in the us-east-1 and us-west-2 Regions. The connection must allow resources from the corporate networks to send large amounts of data to Amazon S3 over the same connection. To meet compliance requirements, the connection must be highly available and must provide encryption for all packets that are sent between the on-premises location and any services on AWS.
Which combination of steps should the network team take to meet these requirements? (Choose two.)
A. Set up a private VIF to send data to Amazon S3. Use an AWS Site-to-Site VPN connection over the private VIF to encrypt data in transit to the VPCs in us-east-1 and us-west-2.
B. Set up an AWS Direct Connect connection to each of the company's data centers.
C. Set up an AWS Direct Connect connection from one of the company's data centers to us-east-1 and us-west-2.
D. Set up a public VIF to send data to Amazon S3. Use an AWS Site-to-Site VPN connection over the public VIF to encrypt data in transit to the VPCs in us-east-1 and us-west-2.
E. Set up a transit VIF for an AWS Direct Connect gateway to send data to Amazon S3. Create a transit gateway. Associate the transit gateway with the Direct Connect gateway to provide secure communications from the company’s data centers to the VPCs in us-east-1 and us-west-2.
Show Answer
Correct Answer: B, D
Explanation: The solution must provide reliable, highly available hybrid connectivity from two on-premises data centers, encrypted in transit, with access to private VPC resources in two Regions and the ability to send large volumes of data to Amazon S3 over the same connection.
Option B is required because establishing an AWS Direct Connect connection from each data center provides consistent performance and high availability through physical redundancy.
Option D is required because Amazon S3 is accessed over a public virtual interface. To meet the encryption requirement, AWS Site-to-Site VPN is used over the Direct Connect public VIF, ensuring all packets are encrypted in transit while still using the dedicated Direct Connect path. This also allows access to AWS services across Regions.
Option E is incorrect because a transit VIF and transit gateway do not provide encryption by themselves and are not used to access Amazon S3. Options A and C fail to meet either the encryption or high availability requirements.
Question 110
AnyCompany has acquired Example Corp. AnyCompany's infrastructure is all on premises, and Example Corp's infrastructure is completely in the AWS Cloud. The companies are using AWS Direct Connect with AWS Transit Gateway to establish connectivity between each other.
Example Corp has deployed a new application across two Availability Zones in a VPC with no internet gateway. The CIDR range for the VPC is 10.0.0.0/16. Example Corp needs to access an application that is deployed on premises by AnyCompany. Because of compliance requirements, Example Corp must access the application through a limited contiguous block of approved IP addresses (10.1.0.0/24).
A network engineer needs to implement a highly available solution to achieve this goal. The network engineer starts by updating the VPC to add a new CIDR range of 10.1.0.0/24.
What should the network engineer do next to meet the requirements?
A. In each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address range. Create a public NAT gateway in each of the new subnets. Update the route tables that are associated with other subnets to route application traffic to the public NAT gateway in the corresponding Availability Zone. Add a route to the route table that is associated with the subnets of the public NAT gateways to send traffic destined for the application to the transit gateway.
B. In each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address range. Create a private NAT gateway in each of the new subnets. Update the route tables that are associated with other subnets to route application traffic to the private NAT gateway in the corresponding Availability Zone. Add a route to the route table that is associated with the subnets of the private NAT gateways to send traffic destined for the application to the transit gateway.
C. In the VPC, create a subnet that uses the allowed IP address range. Create a private NAT gateway in the new subnet. Update the route tables that are associated with other subnets to route application traffic to the private NAT gateway. Add a route to the route table that is associated with the subnet of the private NAT gateway to send traffic destined for the application to the transit gateway.
D. In the VPC, create a subnet that uses the allowed IP address range. Create a public NAT gateway in the new subnet. Update the route tables that are associated with other subnets to route application traffic to the public NAT gateway. Add a route to the route table that is associated with the subnet of the public NAT gateway to send traffic destined for the application to the transit gateway.
Show Answer
Correct Answer: B
Explanation: The requirement is to present traffic to on‑premises from a limited contiguous IP block (10.1.0.0/24) and to be highly available across two AZs, without an internet gateway. Adding a secondary CIDR enables source NAT from that range. Using private NAT gateways keeps traffic private over Direct Connect/Transit Gateway and avoids any internet dependency. For high availability, a NAT gateway is needed per AZ, with each AZ’s workloads routing to the local NAT. Public NAT gateways and single‑AZ designs do not meet the compliance and HA requirements.
Question 111
A global company is designing a hybrid architecture to privately access AWS resources in the us-west-2 Region. The company's existing architecture includes a VPC that uses RFC 1918 IP address space. The VPC is connected to an on-premises data center over AWS Direct Connect Amazon Route 53 provides name resolution within the VPC. Locally managed DNS servers in the data center provide DNS services to the on-premises hosts.
The company has applications in the data center that need to download objects from an Amazon S3 bucket in us-west-2.
Which solution can the company use to access Amazon S3 without using the public IP address space?
A. Create an S3 interface endpoint in the VPC. Update the on-premises application configuration to use the Regional VPC endpoint DNS hostname that is mapped to the S3 interface endpoint.
B. Create an S3 interface endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.
C. Create an S3 gateway endpoint in the VPUpdate the on-premises application configuration to use the hostname that is mapped to the S3 gateway endpoint.
D. Create an S3 gateway endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.
Show Answer
Correct Answer: A
Explanation: An Amazon S3 interface VPC endpoint (AWS PrivateLink) provides private connectivity to S3 using RFC 1918 IP addresses over Direct Connect. The VPC endpoint exposes a regional, endpoint-specific DNS hostname (vpce-*.s3.us-west-2.vpce.amazonaws.com) that resolves to private IP addresses and can be resolved from on premises without configuring a Route 53 Resolver inbound endpoint. By updating the on-premises application to use this endpoint DNS name, traffic stays on the private AWS network and does not use public IP address space. The additional Route 53 Resolver inbound endpoint described in option B is not required for this approach.
Question 112
A company recently experienced an IP address exhaustion event in its VPCs. The event affected service capacity. The VPCs hold two or more subnets in different Availability Zones.
A network engineer needs to develop a solution that monitors IP address usage across resources in the VPCs. The company needs to receive notification about possible issues so that the company can act before an incident happens.
Which solution will meet these requirements with the LEAST operational overhead?
A. Set up Amazon VPC IP Address Manager (IPAM) with a new top-level pool. In the top-level pool, create a pool for each VPC. In each VPC pool, create a pool for each subnet in that VPC. Turn on the auto-import option for the VPC pools and the subnet pools. Configure an Amazon CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
B. Set up a log group in Amazon CloudWatch Logs for each subnet. Create an AWS Lambda function that reads each subnet's IP address usage and publishes metrics to the log group. Configure an Amazon CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
C. Set up a custom Amazon CloudWatch metric for IP address usage for each subnet. Create an AWS Lambda function that reads each subnet's IP address usage and publishes a CloudWatch metric dimension. Schedule the Lambda function to run every 5 minutes. Configure a CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
D. Set up Amazon VPC IP Address Manager (IPAM) with a new top-level pool. In the top-level pool, create a pool for each VPC. In each VPC pool, create a pool for each subnet in that VPC. Turn on the auto-import option for the VPC pools and the subnet pools. Configure an Amazon EventBridge rule that monitors each pool availability limit threshold and sends an Amazon Simple Notification Service (Amazon SNS) notification if the limit threshold is reached.
Show Answer
Correct Answer: A
Explanation: Amazon VPC IP Address Manager (IPAM) natively tracks IP address utilization across VPCs and subnets with minimal setup. By enabling auto-import, IPAM automatically discovers existing VPCs and subnets and publishes utilization and availability metrics directly to Amazon CloudWatch. CloudWatch alarms can then trigger SNS notifications when availability thresholds are approached. This avoids custom Lambda functions, custom metrics, or log processing, resulting in the least operational overhead.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.