CertBlaze

Amazon

ANS-C01 Free Practice Questions — Page 13

Question 123

A network engineer needs to deploy an AWS Network Firewall firewall into an existing AWS environment. The environment consists of the following: • A transit gateway with all VPCs attached to it • Several hundred application VPCs • A centralized egress internet VPC with a NAT gateway and an internet gateway • A centralized ingress internet VPC that hosts public Application Load Balancers • On-premises connectivity through an AWS Direct Connect gateway attachment The application VPCs have workloads deployed across multiple Availability Zones in private subnets with the VPC route table s default route (0.0.0.0/0) pointing to the transit gateway. The Network Firewall firewall needs to inspect east-west (VPC-to-VPC) traffic and north-south (internet-bound and on-premises network) traffic by using Suricata compatible rules. The network engineer must deploy the firewall by using a solution that requires the least possible architectural changes to the existing production environment. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

A. Deploy Network Firewall in all Availability Zones in each application VPC.
B. Deploy Network Firewall in all Availability Zones in a centralized inspection VPC.
C. Update the HOME_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
D. Update the EXTERNAL_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
E. Configure a single transit gateway route table. Associate all application VPCs and the centralized inspection VPC with this route table.
F. Configure two transit gateway route tables. Associate all application VPCs with one transit gateway route table. Associate the centralized inspection VPC with the other transit gateway route table.
Show Answer
Correct Answer: B, C, F
Explanation:
A centralized inspection model minimizes architectural changes while providing scalable inspection for hundreds of VPCs. Deploying AWS Network Firewall in a centralized inspection VPC (B) allows all east-west and north-south traffic to be steered through a single inspection layer via the transit gateway. Updating the HOME_NET variable to include all VPC and on-premises CIDR ranges (C) is required so Suricata rules correctly identify internal versus external traffic. Using two transit gateway route tables (F)—one for application VPCs and one for the inspection VPC—enables controlled traffic steering to the firewall for inspection before forwarding to other VPCs, the internet, or on-premises networks.

Question 124

A company has three VPCs in a single AWS Region. Each VPC contains 15 Amazon EC2 instances, and no connectivity exists between the VPCs. The company is deploying a new application across all three VPCs. The application requires high bandwidth between the nodes. A network engineer must implement connectivity between the VPCs. Which solution will meet these requirements with the HIGHEST throughput?

A. Configure a transit gateway. Attach each VPC to the transit gateway. Configure static routing in each VPC to route traffic to the transit gateway.
B. Configure VPC peering between the three VPCs. Configure static routing to route traffic between the three VPCs.
C. Configure a transit VPConfigure a VPN gateway in each VPCreate an AWS Site-to-Site VPN tunnel from each VPC to the transit VPUse BGP routing to route traffic between the VPCs and the transit VP
D. Configure AWS Site-to-Site VPN connections between each VPC. Enable route propagation for each Site-to-Site VPN connection to route traffic between the VPCs.
Show Answer
Correct Answer: B
Explanation:
The requirement is the HIGHEST throughput between VPCs. VPC peering provides direct, point-to-point connectivity with no aggregate bandwidth limit enforced by the service; traffic is constrained only by underlying instance networking limits. In contrast, a transit gateway imposes a per-VPC attachment bandwidth limit (up to 50 Gbps per AZ), which can become a bottleneck for high-bandwidth east–west traffic. Site-to-Site VPN options have significantly lower throughput and higher latency. Therefore, VPC peering offers the highest possible throughput in this scenario.

Question 125

A company wants to analyze TCP traffic to the internet. The traffic originates from Amazon EC2 instances in the company's VPC. The EC2 instances initiate connections through a NAT gateway. The required information includes source and destination IP addresses, ports, and the first 8 bytes of payload of TCP segments. The company needs to collect, store, and analyze all the required data points. Which solution will meet these requirements?

A. Set up the EC2 instances as VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights.
B. Set up the NAT gateway as a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon OpenSearch Service cluster. Analyze the data by using OpenSearch Dashboards.
C. Turn on VPC Flow Logs on the EC2 instances. Specify the default format and a log destination of Amazon CloudWatch Logs. Analyze the flow log data by using CloudWatch Logs Insights.
D. Turn on VPC Flow Logs on the EC2 instances. Specify a custom format and a log destination of Amazon S3. Analyze the flow log data by using Amazon Athena.
Show Answer
Correct Answer: A
Explanation:
The requirement includes capturing the first 8 bytes of the TCP payload, which VPC Flow Logs cannot provide because they record only traffic metadata, even with a custom format. VPC Traffic Mirroring can capture full packet data, including headers and payload, from EC2 instances. NAT gateways cannot be traffic mirror sources, eliminating option B. Mirroring traffic from the EC2 instances to a target where software forwards logs for analysis meets all data collection and analysis requirements.

Question 126

A company has critical VPC workloads that connect to an on-premises data center through two redundant active-passive AWS Direct Connect connections. However, a recent outage on one Direct Connect connection revealed that it takes more than a minute for traffic to fail over to the secondary Direct Connect connection. The company wants to reduce the failover time from minutes to seconds. Which solution will provide the LARGEST reduction in the BGP failover time?

A. Reduce the BGP hold-down timer that is configured on the BGP sessions on the Direct Connect connection VIFs.
B. Configure an Amazon CloudWatch alarm for the Direct Connect connection state to invoke an AWS Lambda function to fail over the traffic.
C. Configure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the AWS side.
D. Configure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the on-premises router.
Show Answer
Correct Answer: D
Explanation:
BGP failover is slow because it relies on hold timers (often ~90 seconds). Bidirectional Forwarding Detection (BFD) provides sub-second failure detection and immediately brings down the BGP session. For AWS Direct Connect, asynchronous BFD is already enabled on the AWS side and cannot be tuned there; it only becomes effective when configured on the on-premises router. This yields the largest reduction in failover time—from minutes to seconds.

Question 127

A team of infrastructure engineers wants to automate the deployment of Application Load Balancer (ALB) components by using the AWS Cloud Development Kit (AWS CDK). The CDK application must deploy an infrastructure stack that is reusable and consistent across multiple environments, AWS Regions, and AWS accounts. The lead network architect on the project has already bootstrapped the target accounts. The lead network architect also has deployed core network components such as VPCs and Amazon Route 53 private hosted zones across the multiple environments and Regions. The infrastructure engineers must design the ALB components in the CDK application to use the existing core network components. Which combination of steps will meet this requirement with the LEAST manual effort between environment deployments? (Choose two.)

A. Design the CDK application to read AWS CloudFormation parameters for the values that vary across environments and Regions. Reference these variables in the CDK stack for resources that require the variables.
B. Design the CDK application to read environment variables that contain account and Region details at runtime. Use these variables as properties of the CDK stack. Use context methods in the CDK stack to retrieve variable values.
C. Create a dedicated account for shared application services in the multi-account environment. Deploy a CDK pipeline to the dedicated account. Create stages in the pipeline that deploy the CDK application across different environments and Regions.
D. Write a script that automates the deployment of the CDK application across multiple environments and Regions. Distribute the script to engineers who are working on the project.
E. Use the CDK toolkit locally to deploy stacks to each environment and Region. Use the --context flag to pass in variables that the CDK application can reference at runtime.
Show Answer
Correct Answer: B, C
Explanation:
The goal is reusable, consistent CDK deployments across multiple environments, Regions, and accounts with the least manual effort, while integrating with pre-existing network resources. Using environment variables and CDK context (B) is the recommended CDK-native approach for supplying account-, Region-, and environment-specific values at synthesis time, and avoids CloudFormation parameters, which AWS advises against in CDK. Creating a centralized CDK pipeline that deploys to multiple environments and Regions (C) minimizes manual effort by automating cross-account and cross-Region deployments in a consistent, repeatable way. Other options rely on manual scripting, repeated local deployments, or CloudFormation parameters, all of which increase operational effort or are discouraged with CDK.

Question 128

A company has two AWS Direct Connect links. One Direct Connect link terminates in the us-east-1 Region, and the other Direct Connect link terminates in the af-south-1 Region. The company is using BGP to exchange routes with AWS. How should a network engineer configure BGP to ensure that af-south-1 is used as a secondary link to AWS?

A. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 200 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 50
B. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 200 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 50
C. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 50 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 200
D. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 50 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 200
Show Answer
Correct Answer: B
Explanation:
To make af-south-1 a secondary (less preferred) Direct Connect path, the us-east-1 link must be preferred. In BGP, higher local preference is more preferred. Therefore, us-east-1 should have a higher local preference (200) and af-south-1 a lower one (50). In addition, AWS Direct Connect BGP community 7224:7100 is used to prefer a path, while 7224:7300 makes it less preferred. Option B correctly applies the preferred community and higher local preference to us-east-1, and the less-preferred community and lower local preference to af-south-1, ensuring af-south-1 is used only as a backup.

Question 129

A company is deploying AWS Cloud WAN with edge locations in the us-east-1 Region and the ap-southeast-2 Region. Individual AWS Cloud WAN segments are configured for the development environment, the production environment, and the shared services environment at each edge location. Many new VPCs will be deployed for the environments and will be configured as attachments to the AWS Cloud WAN core network. The company's network team wants to ensure that VPC attachments are configured for the correct segment. The network team will tag the VPC attachments by using the Environment key with a value of the corresponding environment segment name. The segment for the production environment in us-east-1 must require acceptance for attachment requests. All other attachment requests must not require acceptance. Which solution will meet these requirements?

A. Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag:Environment values to their respective segments.
B. Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag.Environment values to their respective segments.
C. Create a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1.
D. Create a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1.
Show Answer
Correct Answer: B
Explanation:
AWS Cloud WAN attachment policies are evaluated in ascending rule number order, and the first matching rule is applied. The requirement is to require attachment acceptance only when both conditions are met: the attachment is for the production environment and it is in us-east-1. Therefore, the rule that requires acceptance must come first and must use AND condition logic with tag:Environment = Production and Region = us-east-1. A subsequent rule can then map all environment tags to their respective segments without requiring acceptance. Options that use OR logic would incorrectly require acceptance for all production attachments in any Region or for all attachments in us-east-1. Options that place the non-acceptance rule first would prevent the acceptance rule from ever being evaluated.

Question 130

An application team for a startup company is deploying a new multi-tier application into the AWS Cloud. The application will be hosted on a fleet of Amazon EC2 instances that run in an Auto Scaling group behind a publicly accessible Network Load Balancer (NLB). The application requires the clients to work with UDP traffic and TCP traffic. In the near term, the application will serve only users within the same geographic location. The application team plans to extend the application to a global audience and will move the deployment to multiple AWS Regions around the world to bring the application closer to the end users. The application team wants to use the new Regions to deploy new versions of the application and wants to be able to control the amount of traffic that each Region receives during these rollouts. In addition, the application team must minimize first-byte latency and jitter (randomized delay) for the end users. How should the application team design the network architecture for the application to meet these requirements?

A. Create an Amazon CloudFront distribution to align to each Regional deployment. Set the NLB for each Region as the origin for each CloudFront distribution. Use an Amazon Route 53 weighted routing policy to control traffic to the newer Regional deployments.
B. Create an AWS Global Accelerator accelerator and listeners for the required ports. Configure endpoint groups for each Region. Configure a traffic dial for the endpoint groups to control traffic to the newer Regional deployments. Register the NLBs with the endpoint groups.
C. Use Amazon S3 Transfer Acceleration for the application in each Region. Adjust the amount of traffic that each Region receives from the Transfer Acceleration endpoints to the Regional NLBs.
D. Create an Amazon CloudFront distribution that includes an origin group. Set the NLB for each Region as the origins for the origin group. Use an Amazon Route 53 latency routing policy to control traffic to the new Regional deployments.
Show Answer
Correct Answer: B
Explanation:
The application must support both TCP and UDP, minimize latency and jitter, and allow controlled traffic shifting across multiple AWS Regions during global rollouts. AWS Global Accelerator is designed for non-HTTP protocols (including TCP and UDP), uses the AWS global Anycast network to reduce first-byte latency and jitter, and supports static entry points. Endpoint groups per Region with traffic dials allow precise control of how much traffic each Region receives, which is ideal for progressive deployments. CloudFront is primarily for HTTP/HTTPS and does not support NLBs or UDP, and S3 Transfer Acceleration is irrelevant.

Question 131

A company recently implemented a security policy that prohibits developers from launching VPC network infrastructure. The policy states that any time a NAT gateway is launched in a VPC, the company's network security team must immediately receive an alert to terminate the NAT gateway. The network security team needs to implement a solution that can be deployed across AWS accounts with the least possible administrative overhead. The solution also must provide the network security team with a simple way to view compliance history. Which solution will meet these requirements?

A. Develop a script that programmatically checks for NAT gateways in an AWS account, sends an email alert, and terminates the NAT gateway if a NAT gateway is detected. Deploy the script on an Amazon EC2 instance in each account. Use a cron job to run the script every 5 minutes. Log the results of the checks to an Amazon RDS for MySQL database.
B. Create an AWS Lambda function that programmatically checks for NAT gateways in an AWS account, sends an email alert, and terminates the NAT gateway if a NAT gateway is detected. Deploy the Lambda function to each account by using AWS Serverless Application Model (AWS SAM) templates. Store the results of the checks on an Amazon OpenSearch Service cluster in each account.
C. Enable Amazon GuardDuty. Create an Amazon EventBridge rule for the Behavior:EC2/NATGatewayCreation GuardDuty finding type. Configure the rule to invoke an AWS Step Functions state machine to send an email alert and terminate a NAT gateway if a NAT gateway is detected. Store the runtime log as a text file in an Amazon S3 bucket.
D. Create a custom AWS Config rule that checks for NAT gateways in an AWS account. Configure the AWS Config rule to perform an AWS Systems Manager Automation remediation action to send an email alert and terminate the NAT gateway if a NAT gateway is detected. Deploy the AWS Config rule and the Systems Manager runbooks to each account by using AWS CloudFormation StackSets
Show Answer
Correct Answer: D
Explanation:
AWS Config is designed for continuous compliance monitoring and provides built-in compliance history and timelines. A custom AWS Config rule can detect the creation of NAT gateways, and automatic remediation can be performed by invoking AWS Systems Manager Automation runbooks to send alerts and terminate the resource. Using AWS CloudFormation StackSets allows centralized, low-overhead deployment across multiple AWS accounts. This meets all requirements: immediate detection, automated remediation, cross-account scalability, and simple compliance history viewing.

Question 132

A company uses an AWS Direct Connect private VIF with a link aggregation group (LAG) that consists of two 10 Gbps connections. The company's security team has implemented a new requirement for external network connections to provide layer 2 encryption. The company's network team plans to use MACsec support for Direct Connect to meet the new requirement. Which combination of steps should the network team take to implement this functionality? (Choose three.)

A. Create a new Direct Connect LAG with new circuits and ports that support MACsec.
B. Associate the MACsec Connectivity Association Key (CAK) and the Connection Key Name (CKN) with the new LAG.
C. Associate the Internet Key Exchange (IKE) with the existing LAG.
D. Configure the MACsec encryption mode on the existing LAG.
E. Configure the MACsec encryption mode on the new LAG.
F. Configure the MACsec encryption mode on each Direct Connect connection that makes up the existing LAG.
Show Answer
Correct Answer: A, B, E
Explanation:
AWS Direct Connect MACsec must be enabled at creation time on supported dedicated connections/LAGs. Existing non‑MACsec connections cannot be retrofitted. Therefore the team must create a new LAG using MACsec‑capable circuits, associate the MACsec keys (CAK and CKN) with that LAG, and enable/configure MACsec encryption mode on the new LAG. IKE is not used with Direct Connect MACsec, and configuring MACsec on the existing LAG or its member connections is not valid.

$19

Get all 269 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full ANS-C01 study guide →