A company is building an API-based application on AWS and is using a microservices architecture for the design. The company is using a multi-account AWS environment that includes a separate AWS account for each microservice development team. Each team hosts its microservice in its own VPC that contains Amazon EC2 instances behind a Network Load Balancer (NLB).
A network engineer needs to use Amazon API Gateway in a shared services account to create an HTTP API to expose these microservices to external applications. The network engineer must ensure that access to the microservices can occur only over a private network. Additionally, the company must be able to control which entities from its internal network can connect to the microservices. In the future, the company will create more microservices that the company must be able to integrate with the application.
What is the MOST secure solution that meets these requirements?
A. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALB. Create a VPC endpoint service in each microservice account. Create an AWS PrivateLink endpoint for those services in the shared services account. Add the elastic network interface IP addresses of the VPC endpoint as targets for the target group of the ALB.
B. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALConnect all the VPCs to each other by using a central transit gateway. Add the IP addresses of the NLB as IP-based targets in the ALB target group.
C. Configure the integration to the API Gateway API by using HTTP-based integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate HTTP integration to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the HTTP integration.
D. Configure the integration to the API Gateway API by using VPC link integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate VPC link to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the VPC link integration.
Show Answer
Correct Answer: A
Explanation: HTTP API private integrations using VPC links require the VPC link and integrated load balancer to be in the same account. Because the microservice NLBs are in different accounts, a direct VPC link to those NLBs is not appropriate. Using AWS PrivateLink (endpoint services backed by the existing NLBs in each microservice account) exposes each service privately into the shared services VPC. An ALB in the shared account can target the interface endpoint ENIs, and API Gateway uses a VPC link to that ALB. This keeps all traffic private, allows fine-grained control over which consumers can connect via PrivateLink, and scales as new microservices are added without broadly connecting VPCs via a transit gateway.
Question 105
An education agency is preparing for its annual competition between schools. In the competition, students at schools from around the country solve math problems, complete puzzles, and write essays.
The IP addressing plan of all the schools is well-known and is administered centrally. The competition is hosted in the AWS Cloud and is not publicly available. All competition traffic must be encrypted in transit. Only authorized endpoints can access the competition. All the schools have firewall policies that block ICMP traffic.
A network engineer builds a solution in which all the schools access the competition through AWS Site-to-Site VPN connections. The network engineer uses BGP as the routing protocol. The network engineer must implement a solution that notifies schools when they lose connectivity and need to take action on their premises to address the issue.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Monitor the state of the VPN tunnels by using Amazon CloudWatch. Create a CloudWatch alarm that uses Amazon Simple Notification Service (Amazon SNS) to notify people at the affected school if the tunnels are down.
B. Create a scheduled AWS Lambda function that pings each school's on-premises customer gateway device. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if the ping fails.
C. Create a scheduled AWS Lambda function that uses the VPC Reachability Analyzer API to verify the connectivity. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if failure occurs.
D. Create an Amazon CloudWatch dashboard for each school to show all CloudWatch metrics for each school's Site-to-Site VPN connection. Share each dashboard with the appropriate school.
E. Create a scheduled AWS Lambda function to monitor the existence of each school's routes in the VPC route table where VPN routes are propagated. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if failure occurs.
Show Answer
Correct Answer: A, E
Explanation: CloudWatch natively publishes Site-to-Site VPN tunnel state metrics, allowing CloudWatch alarms and SNS notifications when tunnels go down. Because BGP is used with route propagation, loss of the VPN/BGP session causes propagated routes to be withdrawn from the VPC route table. A scheduled Lambda can check for the expected propagated routes and notify the affected school via SNS. ICMP-based pinging is unsuitable because the schools block ICMP. Reachability Analyzer is unnecessary and incurs additional per-analysis cost. CloudWatch dashboards provide visibility but not proactive notifications.
Question 106
A company has two business units (BUs). The company operates in the us-east-1 Region and the us-west-1 Region. The company plans to extend to more Regions in the future. Each BU has a VPC in each Region. Each Region has a transit gateway with the BU VPCs attached. The transit gateways in both Regions are peered.
The company will create several more BUs in the future and will need to isolate some of the BUs from the other BUs. The company wants to migrate to an architecture to incorporate more Regions and BUs.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new transit gateway for each new BU in each Region. Peer the new transit gateways with the existing transit gateways. Update the route tables to control traffic between BUs.
B. Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Use segment actions to control traffic between segments.
C. Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Configure the segments to isolate attachments to control traffic between segments.
D. Attach new VPCs to the existing transit gateways. Update route tables to control traffic between BUs.
Show Answer
Correct Answer: B
Explanation: AWS Cloud WAN is designed for multi-Region network management and scales better than adding and peering more transit gateways. Creating a segment per business unit provides logical separation, and segment actions allow fine-grained control over which segments can communicate, satisfying the requirement that only some BUs be isolated while others can still communicate. Simply isolating attachments would not provide the selective inter-segment connectivity needed.
Question 107
A company has started using AWS Cloud WAN with one edge location in the us-east-1 Region. The company has a production segment and a security segment in AWS Cloud WAN. The company also has a default core network policy.
The company has created a production VPC for the production workload. The company has created an outbound inspection VPC to inspect internet-bound traffic from the production VPC. The company has attached the production VPC to the production segment and has attached the outbound inspection VPC to the security segment. The company has also created an AWS Network Firewall firewall in the outbound inspection VPC to inspect internet-based traffic.
The company has updated a route table for the production VPC to send all internet-bound traffic to the AWS Cloud WAN core network. The company has updated a route table for the outbound inspection VPC to ensure that Network Firewall inspects any outgoing traffic and incoming traffic.
During testing, an Amazon EC2 instance in the production VPC cannot reach the internet. The company checks the Network Firewall rules and confirms that the rules are not blocking the traffic.
Which combination of steps will meet these requirements? (Choose two.)
A. Update the core network policy to configure segment sharing. Share the production segment with the security segment.
B. Update the core network policy to create a static route for the security segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
C. Update the core network policy to create a static route for the production segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
D. Update the core network policy to create a static route for the production segment. Specify 10.2.0.0/16 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
E. Create an attachment to attach the outbound inspection VPC to the production segment. Update the core network policy to turn on isolated attachment for the production segment.
Show Answer
Correct Answer: A, C
Explanation: The production VPC already sends 0.0.0.0/0 traffic to the Cloud WAN core, but the core network policy must direct that default traffic from the production segment to the outbound inspection VPC attachment. This requires a static 0.0.0.0/0 route in the production segment pointing to the inspection VPC attachment. Because the production and inspection VPCs are in different Cloud WAN segments, the core network policy also needs segment sharing so the production segment can reach the security segment attachment and return traffic can flow appropriately. A static default route in the security segment is not what steers production traffic, and the other options do not match the required traffic flow.
Question 108
A company is building a new workload on AWS that uses an Application Load Balancer (ALB). The company has configured a new ALB target group that uses slow start mode. A team begins registering Amazon EC2 instances as targets in the new target group. During testing, the team observes that the targets did not enter slow start mode.
What caused the targets to not enter slow start mode?
A. The ALB configuration uses the round robin routing algorithm for traffic.
B. The target group did not contain at least one healthy target configured in slow start mode.
C. The target group must contain EC2 instances that are all the same instance type.
D. The ALB configuration uses the 5-tuple criteria for traffic.
Show Answer
Correct Answer: B
Explanation: Slow start mode only applies to newly registered targets when the target group already has at least one healthy target that is not in slow start mode. If slow start is enabled on an empty target group and multiple targets are registered together, those targets do not enter slow start mode. The routing algorithm, instance types, and 5-tuple criteria do not cause this behavior.
Question 109
A network engineer configures a second AWS Direct Connect connection to an existing network. The network engineer runs a test in the AWS Direct Connect Resiliency Toolkit on the connections. The test produces a failure. During the failover event, the network engineer observes a 90-second interruption before traffic shifts to the failover connection.
Which solution will reduce the time for failover?
A. Decrease the BGP hello timer to 5 seconds.
B. Add a VPN connection to the connectivity solution. Implement fast failover.
C. Configure Bidirectional Forwarding Detection (BFD) on the on-premises router.
D. Decrease the BGP hold-down timer to 5 seconds.
Show Answer
Correct Answer: C
Explanation: The default BGP failover interval is governed by BGP hold timers, which can lead to interruptions of around 90 seconds when a link fails. Bidirectional Forwarding Detection (BFD) provides sub-second failure detection independent of BGP timers and is the recommended mechanism with AWS Direct Connect to accelerate failover. Simply lowering BGP timers is less effective and may not be supported or recommended, while adding a VPN changes the architecture rather than addressing Direct Connect failover detection.
Question 110
A company wants to use an AWS Network Firewall firewall to secure its workloads in the cloud through network traffic inspection. The company must record complete metadata information, such as source/destination IP addresses and protocol type. The company must also record all network traffic flows and any DROP or ALERT actions that the firewall takes for traffic that the firewall processes. The Network Firewall endpoints are placed in the correct subnets, and the VPC route tables direct traffic to the Network Firewall endpoints on the path to and from the internet.
How should a network engineer configure the firewall to meet these requirements?
A. Create a firewall policy to ensure that traffic is processed by stateless or stateful rules according to needs. Select Amazon CloudWatch Logs as the destination for the flow logs.
B. Create a firewall policy to ensure that traffic is processed by stateless or stateful rules according to needs. Configure Network Firewall logging for alert logs and flow logs. Select a destination for logs separately for stateful and stateless engines.
C. Create a firewall policy to ensure that a stateful engine processes all the traffic. Configure Network Firewall logging for alert logs and flow logs. Select a destination for alert logs and flow logs.
D. Create a firewall policy to ensure that a stateful engine processes all the traffic. Configure VPC flow logs for the subnets that the firewall protects. Select a destination for the flow logs.
Show Answer
Correct Answer: C
Explanation: AWS Network Firewall logging (flow logs and alert logs) is generated by the stateful engine. To record all traffic flows along with DROP/ALERT actions, traffic must be forwarded to and processed by the stateful engine, and Network Firewall logging must be configured for both flow logs and alert logs. VPC Flow Logs cannot capture firewall actions, and simply allowing traffic to be processed by either stateless or stateful rules does not ensure the required logging for all traffic.
Question 111
A company has a transit gateway in AWS Account A. The company uses AWS Resource Access Manager (AWS RAM) to share the transit gateway so that users in other accounts can connect to multiple VPCs in the same AWS Region. AWS Account B contains a VPC (10.0.0.0/16) with subnet 10.0.0.0/24 in the us-west-2a Availability Zone and subnet 10.0.1.0/24 in the us-west-2b Availability Zone. Resources in these subnets can communicate with other VPCs.
A network engineer creates two new subnets: 10.0.2.0/24 in the us-west-2b Availability Zone and 10.0.3.0/24 in the us-west-2c Availability Zone. All the subnets share one route table. The default route 0.0.0.0/0 is pointing to the transit gateway. Resources in subnet 10.0.2.0/24 can communicate with other VPCs, but resources in subnet 10.0.3.0/24 cannot communicate with other VPCs.
What should the network engineer do so that resources in subnet 10.0.3.0/24 can communicate with other VPCs?
A. In Account B, add 10.0.2.0/24 and 10.0.3.0/24 as the destinations to the route table. Use the transit gateway as the target.
B. In Account B, update the transit gateway attachment. Attach the new subnet ID that is associated with us-west-2c to Account B's VPC.
C. In Account A, create a static route for 10.0.3.0/24 in the transit gateway route tables.
D. In Account A, recreate propagation for 10.0.0.0/16 in the transit gateway route tables.
Show Answer
Correct Answer: B
Explanation: A transit gateway VPC attachment must include a subnet in each Availability Zone that needs transit gateway connectivity. The existing attachment has subnets in us-west-2a and us-west-2b, so the new subnet in us-west-2b works through the existing attachment. The new subnet in us-west-2c cannot use the transit gateway until the VPC attachment is updated to include a subnet in us-west-2c. Adding routes or recreating propagation does not address the missing Availability Zone attachment.
Question 112
A company needs to manage Amazon EC2 instances through command line interfaces for Linux hosts and Windows hosts. The EC2 instances are deployed in an environment in which there is no route to the internet. The company must implement role-based access control for management of the instances. The company has a standalone on-premises environment.
Which approach will meet these requirements with the LEAST maintenance overhead?
A. Set up an AWS Direct Connect connection between the on-premises environment and the VPC where the instances are deployed. Configure routing, security groups, and ACLs. Connect to the instances by using the Direct Connect connection.
B. Deploy and configure AWS Systems Manager Agent (SSM Agent) on each instance. Deploy VPC endpoints for Systems Manager Session Manager. Connect to the instances by using Session Manager.
C. Establish an AWS Site-to-Site VPN connection between the on-premises environment and the VPC where the instances are deployed. Configure routing, security groups, and ACLs. Connect to the instances by using the Site-to-Site VPN connection.
D. Deploy an appliance to the VPC where the instances are deployed. Assign a public IP address to the appliance. Configure security groups and ACLs. Connect to the instances by using the appliance as an intermediary.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Session Manager provides secure CLI access to Linux and Windows EC2 instances without requiring internet access when Systems Manager VPC endpoints are deployed. It integrates with IAM for role-based access control and avoids the operational overhead of managing bastion hosts, Direct Connect, or VPN connectivity for administrative access. SSM Agent runs on the instances and Session Manager communicates through the private VPC endpoints.
Question 113
A company has a public application. The application uses an Application Load Balancer (ALB) that has a target group of Amazon EC2 instances.
The company wants to protect the application from security issues in web requests. The traffic to the application must have end-to-end encryption.
Which solution will meet these requirements?
A. Configure a Network Load Balancer (NLB) that has a target group of the existing EC2 instances. Configure TLS connections to terminate on the EC2 instances that use a public certificate. Configure an AWS WAF web ACL. Associate the web ACL with the NLB.
B. Configure TLS connections to terminate at the ALB that uses a public certificate. Configure AWS Certificate Manager (ACM) certificates for the communication between the ALB and the EC2 instances. Configure an AWS WAF web ACL. Associate the web ACL with the AL
C. Configure a Network Load Balancer (NLB) that has a target group of the existing EC2 instances. Configure TLS connections to terminate at the EC2 instances by creating a TLS listener. Configure self-signed certificates on the EC2 instances for the communication between the NLB and the EC2 instances. Configure an AWS WAF web ACL. Associate the web ACL with the NLB.
D. Configure a third-party certificate on the EC2 instances for the communication between the ALB and the EC2 instances. Import the third-party certificate into AWS Certificate Manager (ACM). Associate the imported certificate with the ALB. Configure TLS connections to terminate at the ALB. Configure an AWS WAF web ACL. Associate the web ACL with the ALB.
Show Answer
Correct Answer: D
Explanation: The existing architecture uses an ALB, and AWS WAF can be associated with an ALB but not with an NLB, eliminating A and C. End-to-end encryption requires HTTPS/TLS from the client to the ALB and from the ALB to the EC2 instances. AWS-managed ACM certificates cannot be directly deployed onto standard EC2 instances for the ALB-to-instance TLS connection; the instances need their own server certificates (such as third-party certificates). Importing the certificate into ACM allows it to be used on the ALB, while installing the certificate on the EC2 instances enables HTTPS from the ALB to the targets. Therefore D is the best match among the options.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.