A company has a new AWS Direct Connect connection between its on-premises data center and the AWS Cloud. The company has created a new private VIF on this connection. However, the VIF status is DOWN.
A network engineer verifies that the physical connection status is UP and RUNNING based on information from the AWS Management Console. The network engineer checks the customer Direct Connect router and can see the ARP entry for the VLAN interface created for the private VIF at AWS.
What could be causing the private VIF to have a DOWN status?
A. ICMP is blocked on the customer Direct Connect router.
B. TCP port 179 is blocked on the customer Direct Connect router.
C. The IEEE 802.1Q VLAN identifier is misconfigured on the customer Direct Connect router.
D. The company has configured IEEE 802.1ad instead of 802.1Q on the customer Direct Connect router.
Show Answer
Correct Answer: B
Explanation: The physical Direct Connect link is UP and ARP entries for the VIF VLAN are present, which confirms Layer 2 connectivity and correct 802.1Q VLAN tagging. A private VIF requires BGP to establish for the VIF to transition to UP. If TCP port 179 is blocked on the customer router, the BGP session cannot form, causing the private VIF to remain in a DOWN state even though Layer 2 is functioning.
Question 114
A company has a 2 Gbps AWS Direct Connect hosted connection from the company’s office to a VPC in the ap-southeast-2 Region. A network engineer adds a 5 Gbps Direct Connect hosted connection from a different Direct Connect location in the same Region. The hosted connections are connected to different routers from the office with an iBGP session running in between the routers.
The network engineer wants to ensure that the VPC uses the 5 Gbps hosted connection to route traffic to the office. Failover to the 2 Gbps hosted connection must occur when the 5 Gbps hosted connection is down.
Which solution will meet these requirements?
A. Configure an outbound BGP policy from the router that is connected to the 2 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS.
B. Advertise a longer prefix route from the router that is connected to the 2 Gbps connection.
C. Advertise a less specific route from the router that is connected to the 5 Gbps connection.
D. Configure an outbound BGP policy from the router that is connected to the 5 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS.
Show Answer
Correct Answer: A
Explanation: AWS Direct Connect uses BGP path selection where shorter AS_PATH is preferred. To make AWS prefer the 5 Gbps connection for traffic toward the office, the routes advertised over the 2 Gbps connection must be made less attractive. Advertising the same prefixes with a longer AS_PATH from the 2 Gbps router achieves this. When the 5 Gbps connection is up, AWS selects its shorter AS_PATH; when it goes down, the 2 Gbps path remains and is used for failover. Prefix-length manipulation options would either break routing symmetry or prefer the wrong path.
Question 115
A company uses multiple AWS accounts and VPCs in a single AWS Region. The company must log all network traffic for Amazon EC2 instances and Amazon RDS databases. The company will use the log information to monitor and identify traffic flows in the event of a security incident. The information must be retained for 12 months but will be accessed infrequently after the first 90 days. The company must be able to view metadata that includes the vpc-id, subnet-id: and tcp-flags fields.
Which solution will meet these requirements at the LOWEST cost?
A. Configure VPC flow logs with the default fields Store the logs in Amazon CloudWatch Logs.
B. Configure Traffic Mirroring on all AWS resources to point to a Network Load Balancer that will send the mirrored traffic to monitoring instances.
C. Configure VPC flow logs with additional custom format fields Store the logs in Amazon S3.
D. Configure VPC flow logs with additional custom format fields Store the logs in Amazon CloudWatch Logs.
Show Answer
Correct Answer: C
Explanation: VPC Flow Logs are designed to capture network traffic metadata (not full packet payloads) and can include custom fields such as vpc-id, subnet-id, and tcp-flags. Storing these logs in Amazon S3 is significantly more cost-effective than CloudWatch Logs for 12 months of retention, especially when access is infrequent after 90 days, and S3 lifecycle policies can further reduce cost. Traffic Mirroring is far more expensive because it mirrors full traffic, and default Flow Logs in CloudWatch Logs either lack required fields or incur higher long-term storage costs.
Question 116
A network engineer needs to design the architecture for a high performance computing (HPC) workload. Amazon EC2 instances will require 10 Gbps flows and an aggregate throughput of up to 100 Gbps across many instances with low-latency communication.
Which architecture solution will optimize this workload?
A. Place nodes in a single subnet of a VPC. Configure a cluster placement group. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system.
B. Place nodes in multiple subnets in a single VPC. Configure a spread placement group. Ensure that the EC2 instances support Elastic Network Adapters (ENAs) and that the drivers are updated on each instance operating system.
C. Place nodes in multiple VPCs Use AWS Transit Gateway to route traffic between the VPCs. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system.
D. Place nodes in multiple subnets in multiple Availability Zones. Configure a cluster placement group. Ensure that the EC2 instances support Elastic Network Adapters (ENAs) and that the drivers are updated on each instance operating system.
Show Answer
Correct Answer: A
Explanation: High performance computing workloads require very low latency, high bandwidth, and predictable network performance. A cluster placement group places EC2 instances physically close together within a single Availability Zone, enabling high-throughput, low-latency networking and supporting 10 Gbps flows with high aggregate bandwidth. Elastic Fabric Adapter (EFA) is specifically designed for tightly coupled HPC workloads and provides OS-bypass and low-latency communication beyond standard ENA networking. Using a single subnet simplifies placement and ensures optimal connectivity. The other options introduce unnecessary latency, spread, or cross-VPC/AZ networking that degrades HPC performance.
Question 117
A company is using a shared services VPC with two domain controllers. The domain controllers are deployed in the company's private subnets. The company is deploying a new application into a new VPC in the account. The application will be deployed onto an Amazon EC2 for Windows Server instance in the new VPC. The instance must join the existing Windows domain that is supported by the domain controllers in the shared services VPC.
A transit gateway is attached to both the shared services VPC and the new VPC. The company has updated the route tables for the transit gateway, the shared services VPC, and the new VPC. The security groups for the domain controllers and the instance are updated and allow traffic only on the ports that are necessary for domain operations. The instance is unable to join the domain that is hosted on the domain controllers.
Which combination of actions will help identify the cause of this issue with the LEAST operational overhead? (Choose two.)
A. Use AWS Network Manager to perform a route analysis for the transit gateway network. Specify the existing EC2 instance as the source. Specify the first domain controller as the destination. Repeat the route analysis for the second domain controller.
B. Use port mirroring with the existing EC2 instance as the source and another EC2 instance as the target to obtain packet captures of the connection attempts.
C. Review the VPC flow logs on the shared services VPC and the new VP
D. Issue a ping command from one of the domain controllers to the existing EC2 instance.
E. Ensure that route propagation is turned off on the shared services VPC.
Show Answer
Correct Answer: A, C
Explanation: The problem is a connectivity or routing issue between two VPCs connected by a transit gateway. Using AWS Network Manager route analysis directly validates whether traffic from the EC2 instance can reach each domain controller through the transit gateway without deploying or modifying resources, making it very low overhead. Reviewing VPC flow logs in both the shared services VPC and the new VPC provides visibility into accepted and rejected traffic, helping identify security group, NACL, or routing problems. Other options either add higher operational overhead (packet mirroring), provide limited diagnostic value (ping), or are configuration changes rather than diagnostic steps.
Question 118
A European car manufacturer wants to migrate its customer-facing services and its analytics platform from two on-premises data centers to the AWS Cloud. The company has a 50-mile (80.4 km) separation between its on-premises data centers and must maintain that separation between its two locations in the cloud. The company also needs failover capabilities between the two locations in the cloud.
The company's infrastructure team creates several accounts to separate workloads and responsibilities. The company provisions resources in the eu-west-3 Region and in the eu-central-1 Region. The company selects an AWS Direct Connect Partner in each Region and requests two resilient 1 Gbps fiber connections from each provider.
The company's network engineer must establish a connection between all VPCs in the accounts and between the on-premises network and the AWS Cloud. The solution must provide access to all services in both Regions in case of network issues.
Which solution will meet these requirements?
A. Create a Direct Connect gateway. Create a private VIF on each of the Direct Connect connections. Attach the private VIFs to the Direct Connect gateway. Use equal-cost multi-path (ECMP) routing to aggregate the four connections across the two Regions. Attach the Direct Connect gateway directly to each VPC's virtual private gateway.
B. Create a Direct Connect gateway. Create a transit gateway. Attach the transit gateway to the Direct Connect gateway. Create a transit VIF on each of the Direct Connect connections. Attach the transit VIFs to the Direct Connect gateway. Use a link aggregation group (LAG) to aggregate the four connections across the two Regions. Attach the transit gateway directly to each VPC.
C. Create a Direct Connect gateway. Create a transit gateway in each Region. Attach the transit gateways to the Direct Connect gateway. Create a transit VIF on each of the Direct Connect connections. Attach the transit VIFs to the Direct Connect gateway. Peer the transit gateways. Attach the transit gateways in each Region to the VPCs in the same Region.
D. Create a Direct Connect gateway. Create a private VIF on each of the Direct Connect connections. Attach the private VIFs to the Direct Connect gateway. Use a link aggregation group (LAG) to aggregate the four connections across the two Regions. Create a transit gateway. Attach the transit gateway to the Direct Connect gateway. Attach the transit gateway directly to each VPC.
Show Answer
Correct Answer: C
Explanation: The company needs highly available, multi-Region connectivity between on-premises networks and multiple VPCs, with regional separation and failover. AWS Transit Gateway is a regional service, so a separate transit gateway is required in each Region. Using a Direct Connect gateway allows the same Direct Connect connections to reach multiple Regions. Transit VIFs are required to connect Direct Connect to transit gateways. Attaching each regional transit gateway to the Direct Connect gateway, peering the two transit gateways, and connecting VPCs regionally provides full mesh connectivity and regional failover while maintaining geographic separation. Other options are invalid due to unsupported LAG usage across Regions, incorrect VIF types, or missing regional transit gateway design.
Question 119
An ecommerce company needs to implement additional security controls on all its domain names that are hosted in Amazon Route 53. The company's new policy requires data authentication and data integrity verification for all queries to the company’s domain names. The current Route 53 architecture has four public hosted zones.
A network engineer needs to implement DNS Security Extensions (DNSSEC) signing and validation on the hosted zones. The solution must include an alert capability.
Which combination of steps will meet these requirements? (Choose three.)
A. Enable DNSSEC signing for Route 53 Request that Route 53 create a key-signing key (KSK) based on a customer managed key in AWS Key Management Service (AWS KMS).
B. Enable DNSSEC signing for Route 53 Request that Route 53 create a zone-signing key (ZSK) based on a customer managed key in AWS Key Management Service (AWS KMS).
C. Create a chain of trust for the hosted zones by adding a Delegation Signer (DS) record for each subdomain
D. Create a chain of trust for the hosted zones by adding a Delegation Signer (DS) record to the parent zone.
E. Set up an Amazon CloudWatch alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected.
F. Set up an AWS CloudTrail alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected.
Show Answer
Correct Answer: A, D, E
Explanation: To implement DNSSEC in Amazon Route 53, you must enable DNSSEC signing and create a key-signing key (KSK) backed by a customer managed AWS KMS key; Route 53 automatically manages the zone-signing keys (ZSKs), so explicitly creating a ZSK is not required. Establishing the chain of trust requires adding a Delegation Signer (DS) record in the parent zone, not for each subdomain. For alerting, DNSSEC-related operational errors such as DNSSECInternalFailure and DNSSECKeySigningKeysNeedingAction are published as Route 53 metrics, which can be monitored with Amazon CloudWatch alarms; CloudTrail does not provide this type of DNSSEC error monitoring.
Question 120
A real estate company is using Amazon Workspaces to provide corporate managed desktop service to its real estate agents around the world. These Workspaces are deployed in seven VPCs. Each VPC is in a different AWS Region.
According to a new requirement, the company’s cloud-hosted security information and events management (SIEM) system needs to analyze DNS queries generated by the Workspaces to identify the target domains that are connected to the Workspaces. The SIEM system supports poll and push methods for data and log collection.
Which solution should a network engineer implement to meet these requirements MOST cost-effectively?
A. Create VPC flow logs in each VPC that is connected to the Workspaces instances. Publish the log data to a central Amazon S3 bucket. Configure the SIEM system to poll the S3 bucket periodically.
B. Configure an Amazon CloudWatch agent to log all DNS requests in Amazon CloudWatch Logs. Configure a subscription filter in CloudWatch Logs. Push the logs to the SIEM system by using Amazon Kinesis Data Firehose.
C. Configure VPC Traffic Mirroring to copy network traffic from each Workspace and to send the traffic to the SIEM system probes for analysis.
D. Configure Amazon Route 53 query logging. Set the destination as an Amazon Kinesis Data Firehose delivery stream that is configured to push data to the SIEM system.
Show Answer
Correct Answer: D
Explanation: Amazon Route 53 Resolver query logging natively records DNS queries (including domain names) made by resources in VPCs that use the Amazon-provided DNS resolver, which is the default for Amazon WorkSpaces. Sending these logs directly to Amazon Kinesis Data Firehose enables a push-based integration to the SIEM across Regions without deploying agents. VPC Flow Logs do not capture DNS query names, Traffic Mirroring is costly overkill, and installing agents on all WorkSpaces is operationally complex and more expensive.
Question 121
A company hosts a web application that runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The company uses an Amazon CloudFront distribution with the ALB as an origin.
The application recently experienced an attack. In response, the company associated an AWS WAF web ACL with the CloudFront distribution. The company needs to use Amazon Athena to analyze application attacks that AWS WAF detects.
Which solution will meet this requirement?
A. Configure the ALB and the EC2 instance subnets to produce VPC flow logs. Configure the VPC flow logs to deliver logs to an Amazon S3 bucket for log analysis.
B. Create a trail in AWS CloudTrail to capture data events. Configure the trail to deliver logs to an Amazon S3 bucket for log analysis.
C. Configure the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon S3 bucket for log analysis.
D. Turn on access logging for the ALB. Configure the access logs to deliver the logs to an Amazon S3 bucket for log analysis.
Show Answer
Correct Answer: C
Explanation: AWS WAF can natively log detailed information about detected and blocked web requests. To analyze these attacks with Amazon Athena, the logs must be stored in Amazon S3. AWS WAF delivers logs by streaming them to Amazon Kinesis Data Firehose, which can be configured to write directly to an S3 bucket in a queryable format. VPC flow logs, ALB access logs, and CloudTrail logs do not contain the detailed WAF attack data required.
Question 122
A company has deployed a multi-VPC environment in the AWS Cloud. The company uses a transit gateway to connect all the VPCs together. In the past, the company has experienced a loss of connectivity between applications after changes to security groups, network ACLs, and route tables in a VPC. When these changes occur, the company wants to automatically verify that connectivity still exists between different resources in a single VPC.
A. Create a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
B. Create a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS. CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
C. Create a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the diffident paths in Route Analyzer.
D. Create a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Route Analyzer.
Show Answer
Correct Answer: B
Explanation: The requirement is to automatically verify connectivity between resources within a single VPC after changes to security groups, network ACLs, or route tables. VPC Reachability Analyzer is the correct service for analyzing and validating network paths inside a VPC. Configuration changes to these networking components are recorded as API calls in AWS CloudTrail, which can be sent to Amazon EventBridge. An EventBridge rule can then trigger an AWS Lambda function to run predefined Reachability Analyzer path checks. Options using CloudWatch for change detection are incorrect, and Transit Gateway Network Manager Route Analyzer is intended for transit gateway and multi-network routing analysis, not single-VPC connectivity validation.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.