A company has a hybrid IT setup that includes services that run in an on-premises data center and in the AWS Cloud. The company is using AWS Direct Connect to connect its data center to AWS. The company is using one AWS Site-to-Site VPN connection as backup and requires a backup connectivity option to always be present. The company is transitioning to IPv6 by implementing dual-stack architectures.
Which combination of steps will transition the data center's connectivity to AWS in the LEAST amount of time? (Choose two.)
A. Create a new Site-to-Site VPN tunnel for the IPv6 traffic.
B. Create a new dual-stack Site-to-Site VPN connection between the data center and AWS. Provision routing. Delete the original Site-to-Site VPN connection.
C. Associate a new dual-stack public VIF with the Direct Connect connection. Migrate the Direct Connect traffic to the new VIF.
D. Add a new IPv6 peer in the existing VIF. Use the IPv6 address provided by Amazon on the peer router.
E. Send IPv6 traffic between the data center and AWS in a tunnel inside the existing IPv4 tunnels.
Show Answer
Correct Answer: A, D
Explanation: IPv6 cannot simply be enabled on an existing Site-to-Site VPN connection, and a single Site-to-Site VPN connection does not carry both IPv4 and IPv6 traffic. To preserve backup connectivity during transition, create a separate VPN tunnel/connection for IPv6 traffic. For Direct Connect, the fastest migration is to add an IPv6 BGP peer to the existing virtual interface rather than replacing it with a new dual-stack VIF.
Question 125
A company has an order processing system that needs to keep credit card numbers encrypted. The company's customer-facing application runs as an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon CloudFront distribution is configured with the ALB as the origin. The company uses a third-party trusted certificate authority to provision its certificates.
The company is using HTTPS for encryption in transit. The company needs additional field-level encryption to keep sensitive data encrypted during processing so that only certain application components can decrypt the sensitive data.
Which combination of steps will meet these requirements? (Choose two.)
A. Import the third-party certificate for the ALB. Associate the certificate with the ALB. Upload the certificate for the CloudFront distribution into AWS Certificate Manager (ACM) in us-west-2.
B. Import the third-party certificate for the ALB into AWS Certificate Manager (ACM) in us-west-2. Associate the certificate with the ALUpload the certificate for the CloudFront distribution into ACM in the us-east-1 Region.
C. Upload the private key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption profile and specify the fields that contain sensitive information. Create a field-level encryption configuration, and choose the newly created profile. Link the configuration to the appropriate cache behavior that is associated with sensitive POST requests.
D. Upload the public key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption configuration, and specify the fields that contain sensitive information. Create a field-level encryption profile, and choose the newly created configuration. Link the profile to the appropriate cache behavior that is associated with sensitive GET requests.
E. Upload the public key that handles the encryption of the sensitive data to the CloudFront distribution. Create a field-level encryption profile and specify the fields that contain sensitive information. Create a field-level encryption configuration, and choose the newly created profile. Link the configuration to the appropriate cache behavior that is associated with sensitive POST requests.
Show Answer
Correct Answer: B, E
Explanation: CloudFront requires viewer-facing ACM certificates to be in us-east-1, while the ALB can use an ACM-imported third-party certificate in its own region (us-west-2). For CloudFront field-level encryption, you upload the public key, create a field-level encryption profile specifying sensitive fields, create a field-level encryption configuration that uses the profile, and associate it with the cache behavior handling sensitive POST requests. The private key remains with the application component that decrypts the data.
Question 126
A network engineer is evaluating a network setup for a global retail company. The company has an AWS Direct Connect connection between its on-premises data center and the AWS Cloud. The company has AWS resources in the eu-west-2 Region. These resources consist of multiple VPCs that are attached to a transit gateway.
The company recently provisioned a few AWS resources in the eu-central-1. Region in a single VPC close to its users in this area. The network engineer must connect the resources in eu-central-1 with the on-premises data center and the resources in eu-west-2. The solution must minimize changes to the Direct Connect connection.
What should the network engineer do to meet these requirements?
A. Create a new virtual private gateway. Attach the new virtual private gateway to the VPC in eu-central-1. Use a transit VIF to connect the VPC and the Direct Connect router.
B. Create a new transit gateway in eu-central-1. Create a peering attachment request to the transit gateway in eu-west-2. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gateway peering attachment. Accept the peering request. Add a static route in the transit gateway route table in eu-west-2 to point to the new transit gateway peering attachment.
C. Create a new transit gateway in eu-central-1. Use an AWS Site-to-Site VPN connection to peer both transit gateways. Add a static route in the transit gateway route table in eu-central-1 to point to the transit gateway VPN attachment. Add a static route in the transit gateway route table in eu-west-2 to point to the new transit gateway peering attachment.
D. Create a new virtual private gateway. Attach the new virtual private gateway to the VPC in eu-central-1. Use a public VIF to connect the VPC and the Direct Connect router.
Show Answer
Correct Answer: B
Explanation: A transit gateway is regional, so the VPC in eu-central-1 cannot attach to the existing transit gateway in eu-west-2. Create a new transit gateway in eu-central-1, attach the VPC, and establish an inter-Region transit gateway peering attachment with the existing transit gateway in eu-west-2. Update the transit gateway route tables in both Regions to route traffic across the peering attachment. This preserves the existing Direct Connect architecture with minimal changes while enabling connectivity between on-premises, eu-west-2, and eu-central-1.
Question 127
A company has an on-premises data center in the United States. The data center is connected to AWS by an AWS Direct Connect connection. The data center has a private VIF that is connected to a Direct Connect gateway.
Recently, the company opened a new data center in Europe and established a new Direct Connect connection between the Europe data center and AWS. A new private VIF connects to the existing Direct Connect gateway.
The company wants to use Direct Connect SiteLink to set up a private network between the data center in the United States and the data center in Europe.
Which solution will meet these requirements in the MOST operationally efficient manner?
A. Create a new public VIF from each data center. Enable SiteLink on the new public VIFs.
B. Create a new transit VIF from each data center. Enable SiteLink on the new transit VIFs.
C. Use the existing VIF from each data center. Enable SiteLink on the existing private VIFs.
D. Create a new AWS Site-to-Site VPN connection between the data centers. Configure the new connection to use SiteLink.
Show Answer
Correct Answer: C
Explanation: AWS Direct Connect SiteLink can be enabled on existing private or transit VIFs that are attached to a Direct Connect gateway. Since both data centers already have private VIFs connected to the same Direct Connect gateway, the most operationally efficient solution is to enable SiteLink on those existing private VIFs. No new VIFs or VPNs are required.
Question 128
A company is migrating critical applications to AWS. The company has multiple accounts and VPCs that are connected by a transit gateway.
A network engineer must design a solution that performs deep packet inspection for any traffic that leaves a VPC network boundary. All inspected traffic and the actions that are taken on the traffic must be logged in a central log account.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Create a central network VPC that includes an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Gateway Load Balancer that is backed by third-party, next-generation firewall appliances to the central network VPC. Create a policy that contains the rules for deep packet inspection. Attach the policy to the firewall appliances. Create an Amazon S3 bucket in the central log account. Configure the firewall appliances to capture and save the network flow logs to the S3 bucket.
B. Create a central network VPC that includes an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Application Load Balancer that is backed by third-party, next-generation firewall appliances to the central network VPC. Create a policy that contains the rules for deep packet inspection. Attach the policy to the firewall appliances. Create a syslog server in the central log account. Configure the firewall appliances to capture and save the network flow logs to the syslog server.
C. Deploy network ACLs and security groups to each VPAttach the security groups to active network interfaces. Associate the network ACLs with VPC subnets. Create rules for the network ACLs and security groups to allow only the required traffic flows between subnets and network interfaces. Create an Amazon S3 bucket in the central log account. Configure a VPC flow log that captures and saves all traffic flows to the S3 bucket.
D. Create a central log VPC and an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the new attachment. Deploy an AWS Network Load Balancer (NLB) that is backed by third-party, next-generation intrusion detection system (IDS) security appliances to the central VPC. Activate rules on the security appliances to monitor for intrusion signatures. For each network interface, create a VPC Traffic Mirroring session that sends the traffic to the central VPC's NLB.
Show Answer
Correct Answer: A
Explanation: A central inspection VPC using AWS Gateway Load Balancer with third-party firewall appliances is the AWS-recommended inline architecture for deep packet inspection across multiple VPCs connected through a transit gateway. GWLB is purpose-built for transparent insertion of security appliances with minimal operational overhead. Traffic can be routed through the inspection VPC via the transit gateway, and the firewall appliances can centrally log inspection results and actions to an S3 bucket in the central log account. Option B incorrectly uses an ALB, which is not suitable for transparent network traffic inspection. Option C provides filtering and flow logging but not deep packet inspection. Option D uses traffic mirroring and IDS, which is out-of-band, cannot enforce actions on live traffic, and requires additional mirroring configuration, increasing administrative overhead.
Question 129
A financial company that is located in the us-east-1 Region needs to establish secure connectivity to AWS. The company has two on-premises data centers, each located within the same Region. The company's network team needs to establish hybrid connectivity to its AWS environment with reliable and consistent connectivity.
The connection must provide access to the company's private resources inside its AWS environment. The resources are located in the us-east-1 and us-west-2 Regions. The connection must allow resources from the corporate networks to send large amounts of data to Amazon S3 over the same connection. To meet compliance requirements, the connection must be highly available and must provide encryption for all packets that are sent between the on-premises location and any services on AWS.
Which combination of steps should the network team take to meet these requirements? (Choose two.)
A. Set up a private VIF to send data to Amazon S3. Use an AWS Site-to-Site VPN connection over the private VIF to encrypt data in transit to the VPCs in us-east-1 and us-west-2.
B. Set up an AWS Direct Connect connection to each of the company's data centers.
C. Set up an AWS Direct Connect connection from one of the company's data centers to us-east-1 and us-west-2.
D. Set up a public VIF to send data to Amazon S3. Use an AWS Site-to-Site VPN connection over the public VIF to encrypt data in transit to the VPCs in us-east-1 and us-west-2.
E. Set up a transit VIF for an AWS Direct Connect gateway to send data to Amazon S3. Create a transit gateway. Associate the transit gateway with the Direct Connect gateway to provide secure communications from the company’s data centers to the VPCs in us-east-1 and us-west-2.
Show Answer
Correct Answer: B, D
Explanation: Two Direct Connect connections (one from each data center) provide high availability. A public virtual interface provides access to Amazon S3 over Direct Connect, and using AWS Site-to-Site VPN provides IPsec encryption for traffic to the AWS environment while allowing access across Regions.
Question 130
AnyCompany has acquired Example Corp. AnyCompany's infrastructure is all on premises, and Example Corp's infrastructure is completely in the AWS Cloud. The companies are using AWS Direct Connect with AWS Transit Gateway to establish connectivity between each other.
Example Corp has deployed a new application across two Availability Zones in a VPC with no internet gateway. The CIDR range for the VPC is 10.0.0.0/16. Example Corp needs to access an application that is deployed on premises by AnyCompany. Because of compliance requirements, Example Corp must access the application through a limited contiguous block of approved IP addresses (10.1.0.0/24).
A network engineer needs to implement a highly available solution to achieve this goal. The network engineer starts by updating the VPC to add a new CIDR range of 10.1.0.0/24.
What should the network engineer do next to meet the requirements?
A. In each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address range. Create a public NAT gateway in each of the new subnets. Update the route tables that are associated with other subnets to route application traffic to the public NAT gateway in the corresponding Availability Zone. Add a route to the route table that is associated with the subnets of the public NAT gateways to send traffic destined for the application to the transit gateway.
B. In each Availability Zone in the VPC, create a subnet that uses part of the allowed IP address range. Create a private NAT gateway in each of the new subnets. Update the route tables that are associated with other subnets to route application traffic to the private NAT gateway in the corresponding Availability Zone. Add a route to the route table that is associated with the subnets of the private NAT gateways to send traffic destined for the application to the transit gateway.
C. In the VPC, create a subnet that uses the allowed IP address range. Create a private NAT gateway in the new subnet. Update the route tables that are associated with other subnets to route application traffic to the private NAT gateway. Add a route to the route table that is associated with the subnet of the private NAT gateway to send traffic destined for the application to the transit gateway.
D. In the VPC, create a subnet that uses the allowed IP address range. Create a public NAT gateway in the new subnet. Update the route tables that are associated with other subnets to route application traffic to the public NAT gateway. Add a route to the route table that is associated with the subnet of the public NAT gateway to send traffic destined for the application to the transit gateway.
Show Answer
Correct Answer: B
Explanation: The correct solution is to use private NAT gateways because the VPC has no internet gateway and traffic is destined for an on-premises application over Transit Gateway/Direct Connect, not the internet. Private NAT gateways perform source NAT so the application traffic appears from the approved 10.1.0.0/24 range. For high availability, deploy a private NAT gateway in each Availability Zone and route each AZ's workloads to the local NAT gateway. Since the secondary CIDR is 10.1.0.0/24, it must be subdivided into multiple subnets (one per AZ). Public NAT gateways require an internet gateway and are inappropriate here, while a single NAT gateway is not highly available.
Question 131
A global company is designing a hybrid architecture to privately access AWS resources in the us-west-2 Region. The company's existing architecture includes a VPC that uses RFC 1918 IP address space. The VPC is connected to an on-premises data center over AWS Direct Connect Amazon Route 53 provides name resolution within the VPC. Locally managed DNS servers in the data center provide DNS services to the on-premises hosts.
The company has applications in the data center that need to download objects from an Amazon S3 bucket in us-west-2.
Which solution can the company use to access Amazon S3 without using the public IP address space?
A. Create an S3 interface endpoint in the VPC. Update the on-premises application configuration to use the Regional VPC endpoint DNS hostname that is mapped to the S3 interface endpoint.
B. Create an S3 interface endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.
C. Create an S3 gateway endpoint in the VPUpdate the on-premises application configuration to use the hostname that is mapped to the S3 gateway endpoint.
D. Create an S3 gateway endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.
Show Answer
Correct Answer: A
Explanation: Amazon S3 gateway endpoints are for resources inside a VPC and cannot be used by on-premises hosts over Direct Connect. For hybrid access, an S3 interface endpoint (AWS PrivateLink) is required. The endpoint-specific Regional DNS name (vpce-...s3.<region>.vpce.amazonaws.com) is publicly resolvable but returns the interface endpoint's private IPs, so on-premises applications can use that hostname directly without requiring Route 53 Resolver inbound endpoints. Option B describes private DNS integration but is incomplete because it would also require private DNS/hosted zone configuration not stated in the option.
Sources:
https://aws.amazon.com/blogs/networking-and-content-delivery/secure-hybrid-access-to-amazon-s3-using-aws-privatelink
Question 132
A company recently experienced an IP address exhaustion event in its VPCs. The event affected service capacity. The VPCs hold two or more subnets in different Availability Zones.
A network engineer needs to develop a solution that monitors IP address usage across resources in the VPCs. The company needs to receive notification about possible issues so that the company can act before an incident happens.
Which solution will meet these requirements with the LEAST operational overhead?
A. Set up Amazon VPC IP Address Manager (IPAM) with a new top-level pool. In the top-level pool, create a pool for each VPC. In each VPC pool, create a pool for each subnet in that VPC. Turn on the auto-import option for the VPC pools and the subnet pools. Configure an Amazon CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
B. Set up a log group in Amazon CloudWatch Logs for each subnet. Create an AWS Lambda function that reads each subnet's IP address usage and publishes metrics to the log group. Configure an Amazon CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
C. Set up a custom Amazon CloudWatch metric for IP address usage for each subnet. Create an AWS Lambda function that reads each subnet's IP address usage and publishes a CloudWatch metric dimension. Schedule the Lambda function to run every 5 minutes. Configure a CloudWatch alarm to send an Amazon Simple Notification Service (Amazon SNS) notification if the availability limit threshold is reached.
D. Set up Amazon VPC IP Address Manager (IPAM) with a new top-level pool. In the top-level pool, create a pool for each VPC. In each VPC pool, create a pool for each subnet in that VPC. Turn on the auto-import option for the VPC pools and the subnet pools. Configure an Amazon EventBridge rule that monitors each pool availability limit threshold and sends an Amazon Simple Notification Service (Amazon SNS) notification if the limit threshold is reached.
Show Answer
Correct Answer: A
Explanation: Amazon VPC IP Address Manager (IPAM) is purpose-built to monitor IP address utilization across VPCs and subnets. By organizing pools for VPCs and subnets with auto-import enabled, IPAM automatically tracks usage. IPAM publishes CloudWatch metrics for pool utilization and availability, allowing a CloudWatch alarm to trigger an Amazon SNS notification when the configured availability threshold is reached. This avoids custom Lambda functions and scheduled polling, resulting in the least operational overhead.
Question 133
A company has a new AWS Direct Connect connection between its on-premises data center and the AWS Cloud. The company has created a new private VIF on this connection. However, the VIF status is DOWN.
A network engineer verifies that the physical connection status is UP and RUNNING based on information from the AWS Management Console. The network engineer checks the customer Direct Connect router and can see the ARP entry for the VLAN interface created for the private VIF at AWS.
What could be causing the private VIF to have a DOWN status?
A. ICMP is blocked on the customer Direct Connect router.
B. TCP port 179 is blocked on the customer Direct Connect router.
C. The IEEE 802.1Q VLAN identifier is misconfigured on the customer Direct Connect router.
D. The company has configured IEEE 802.1ad instead of 802.1Q on the customer Direct Connect router.
Show Answer
Correct Answer: B
Explanation: A visible ARP entry indicates Layer 2 connectivity over the VLAN is working, making an incorrect 802.1Q tag less likely. A private VIF can remain DOWN when the required BGP session cannot be established, such as if TCP port 179 is blocked by a firewall or ACL. ICMP is not required for the VIF to come up, and 802.1ad is not the expected encapsulation for Direct Connect.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.