A company has an AWS account with four VPCs in the us-east-1 Region. The VPCs consist of a development VPC and three production VPCs that host various workloads.
The company has extended its on-premises data center to AWS with AWS Direct Connect by using a Direct Connect gateway. The company now wants to establish connectivity to its production VPCs and development VPC from on premises. The production VPCs are allowed to route data to each other. However, the development VPC must be isolated from the production VPCs. No data can flow between the development VPC and the production VPCs.
In preparation to implement this solution, a network engineer creates a transit gateway with a single transit gateway route table. Default route table association and default route table propagation are turned off. The network engineer attaches the production VPCs, the development VPC, and the Direct Connect gateway to the transit gateway. For each VPC route table, the network engineer adds a route to 0.0.0.0/0 with the transit gateway as the next destination.
Which combination of steps should the network engineer take next to complete this solution? (Choose three.)
A. Associate the production VPC attachments with the existing transit gateway route table. Propagate the routes from these attachments.
B. Associate all the attachments with the existing transit gateway route table. Propagate the routes from these attachments.
C. Associate the Direct Connect gateway attachment with the existing transit gateway route table. Propagate the Direct Connect gateway attachment to this route table.
D. Change the security group inbound rules on the existing transit gateway network interfaces in the development VPC to allow connections to and from the on-premises CIDR range only.
E. Create a new transit gateway route table. Associate the new route table with the development VPC attachment. Propagate the Direct Connect gateway and development VPC attachment to the new route table.
F. Create a new transit gateway with default route table association and default route table propagation turned on. Attach the Direct Connect gateway and development VPC to the new transit gateway.
Show Answer
Correct Answer: A, C, E
Explanation: The goal is to allow on-premises connectivity to all VPCs, allow intercommunication among production VPCs, and strictly isolate the development VPC from production VPCs using a single transit gateway.
A: Associating the production VPC attachments with the existing transit gateway route table and propagating their routes allows the production VPCs to learn routes to each other and to on premises.
C: Associating and propagating the Direct Connect gateway attachment to the existing transit gateway route table enables on-premises networks to reach the production VPCs through the transit gateway.
E: Creating a separate transit gateway route table for the development VPC and associating only the development VPC and the Direct Connect gateway with it allows on-premises-to-development connectivity while preventing any routing between development and production VPCs.
Other options either break the required isolation (B), rely on security groups instead of routing control (D), or introduce an unnecessary second transit gateway (F).
Question 134
A company is deploying a web application into two AWS Regions. The company has one VPC in each Region. Each VPC has three Amazon EC2 instances as web servers behind an Application Load Balancer (ALB). The company already has configured an Amazon Route 53 public hosted zone for example.com. Users will access the application by using the fully qualified domain name (FQDN) of app.example.com.
The company needs a DNS solution that allows global users to access the application. The solution must route the users' requests to the Region that provides the lowest response time. The solution must fail over to the Region that provides the next-lowest response time if the application is unavailable in the initially intended Region.
Which solution will meet these requirements?
A. For each ALB, create an A record that has a geolocation routing policy to route app.example.com to the IP addresses of the ALB. Configure a Route 53 HTTP health check that monitors each ALB by IP address. Associate the health check with the A records.
B. Create an A record that has a geolocation routing policy to route app.example.com to the IP addresses for both ALBs. Configure a Route 53 health check that monitors TCP port 80 for each ALB by IP address. Associate the health check with the A records.
C. Create an A record that has a latency-based routing policy to route app.example.com as an alias to one of the ALBs. Configure a Route 53 health check that monitors TCP port 80 for each ALB by IP address. Associate the health check with the A records.
D. For each ALB, create an A record that has a latency-based routing policy to route app.example.com as an alias to the ALB. Set the value for Evaluate Target Health to Yes for the records.
Show Answer
Correct Answer: D
Explanation: Latency-based routing in Route 53 directs users to the AWS Region that provides the lowest latency, which meets the requirement for lowest response time. Creating separate A alias records for each ALB with a latency-based routing policy allows Route 53 to compare regions. Setting Evaluate Target Health to Yes lets Route 53 use the ALB’s health status automatically, so if the ALB in the lowest-latency Region becomes unhealthy, traffic fails over to the next-lowest-latency healthy Region without requiring separate Route 53 health checks.
Question 135
A network engineer is designing the DNS architecture for a new AWS environment. The environment must be able to resolve DNS names of endpoints on premises, and the on-premises systems must be able to resolve the names of AWS endpoints. The DNS architecture must give individual accounts the ability to manage subdomains.
The network engineer needs to create a single set of rules that will work across multiple accounts to control this behavior. In addition, the network engineer must use AWS native services whenever possible.
Which combination of steps should the network engineer take to meet these requirements? (Choose three.)
A. Create an Amazon Route 53 private hosted zone for the overall cloud domain. Plan to create subdomains that align to other AWS accounts that are associated with the central Route 53 private hosted zone.
B. Create AWS Directory Service for Microsoft Active Directory server endpoints in the central AWS account that hosts the private hosted zone for the overall cloud domain. Create a conditional forwarding rule in Microsoft Active Directory DNS to forward traffic to a DNS resolver endpoint on premises. Create another rule to forward traffic between subdomains to the VPC resolver.
C. Create Amazon Route 53 Resolver inbound and outbound endpoints in the central AWS account that hosts the private hosted zone for the overall cloud domain. Create a forwarding rule to forward traffic to a DNS resolver endpoint on premises. Create another rule to forward traffic between subdomains to the Resolver inbound endpoint.
D. Ensure that networking exists between the other accounts and the central account so that traffic can reach the AWS Directory Service for Microsoft Active Directory DNS endpoints.
E. Ensure that networking exists between the other accounts and the central account so that traffic can reach the Amazon Route 53 Resolver endpoints.
F. Share the Amazon Route 53 Resolver rules between accounts by using AWS Resource Access Manager (AWS RAM). Ensure that networking exists between the other accounts and the central account so that traffic can reach the Route 53 Resolver endpoints.
Show Answer
Correct Answer: A, C, F
Explanation: The requirements are bidirectional DNS resolution between on‑premises and AWS, centralized control with AWS‑native services, and the ability for individual accounts to manage subdomains using a single reusable rule set.
A is required to establish a central Amazon Route 53 private hosted zone for the overall cloud domain, with subdomains delegated or associated to individual accounts, enabling decentralized subdomain management.
C is required to enable hybrid DNS resolution using AWS‑native services. Route 53 Resolver inbound and outbound endpoints allow on‑premises systems to resolve AWS names and AWS workloads to resolve on‑premises names via forwarding rules.
F is required to apply the same Route 53 Resolver rules across multiple accounts by sharing them with AWS RAM. Networking connectivity is also required so that VPCs in other accounts can reach the shared Resolver endpoints.
Options involving AWS Directory Service are unnecessary, and simple networking without rule sharing does not satisfy the multi‑account, single‑rule requirement.
Question 136
A company uses Amazon Route 53 to host a public hosted zone for example.com. A network engineer recently reduced the TTL on several records to 60 seconds. The network engineer wants to assess whether the change has increased the number of queries to Route 53 beyond the expected levels that the company identified before the change. The network engineer must obtain the number of queries that have been made to the example.com public hosted zone.
Which solution will provide this information?
A. Create a new trail in AWS CloudTrail to include Route 53 data events. Send logs to Amazon CloudWatch Logs. Set up a CloudWatch metric filter to count the number of queries and create graphs.
B. Use Amazon CloudWatch to access the AWS/Route 53 namespace and to check the DNSQueries metric for the public hosted zone.
C. Use Amazon CloudWatch to access the AWS/Route 53 Resolver namespace and to check the InboundQueryVolume metric for a specific endpoint.
D. Configure logging to Amazon CloudWatch for the public hosted zone. Set up a CloudWatch metric filter to count the number of queries and create graphs.
Show Answer
Correct Answer: B
Explanation: Amazon Route 53 automatically publishes query metrics for public hosted zones to Amazon CloudWatch. The AWS/Route53 namespace includes the DNSQueries metric, which shows the number of DNS queries received for a specific hosted zone. This directly provides the required information without additional configuration. The other options either involve unnecessary logging setups or apply to Route 53 Resolver endpoints rather than public hosted zones.
Question 137
A financial trading company is using Amazon EC2 instances to run its trading platform. Part of the company's trading platform includes a third-party pricing service that the EC2 instances communicate with over UDP on port 50000.
Recently, the company has had problems with the pricing service. Some of the responses from the pricing service appear to be incorrectly formatted and are not being processed successfully. The third-party vendor requests access to the data that the pricing service is returning. The third-party vendor wants to capture request and response data for debugging by logging in to an EC2 instance that accesses the pricing service. The company prohibits direct access to production systems and requires all log analysis to be performed in a dedicated monitoring account.
Which set of steps should a network engineer take to capture the data and meet these requirements?
A. 1. Configure VPC flow logs to capture the data that flows in the VPC. 2. Send the data to an Amazon S3 bucket. 3. In the monitoring account, extract the data that flows to the EC2 instance's IP address and filter the traffic for the UDP data. 4. Provide the data to the third-party vendor.
B. 1. Configure a traffic mirror filter to capture the UDP data. 2. Configure Traffic Mirroring to capture the traffic for the EC2 instance's elastic network interface. 3. Configure a packet inspection package on a new EC2 instance in the production environment. Use the elastic network interface of the new EC2 instance as the target for the traffic mirror. 4. Extract the data by using the packet inspection package. 5. Provide the data to the third-party vendor.
C. 1. Configure a traffic mirror filter to capture the UDP data. 2. Configure Traffic Mirroring to capture the traffic for the EC2 instance's elastic network interface. 3. Configure a packet inspection package on a new EC2 instance in the monitoring account. Use the elastic network interface of the new EC2 instance as the target for the traffic mirror. 4. Extract the data by using the packet inspection package. 5. Provide the data to the third-party vendor.
D. 1. Create a new Amazon Elastic Block Store (Amazon EBS) volume. Attach the EBS volume to the EC2 instance. 2. Log in to the EC2 instance in the production environment. Run the tcpdump command to capture the UDP data on the EBS volume. 3. Export the data from the EBS volume to Amazon S3. 4. Provide the data to the third-party vendor.
Show Answer
Correct Answer: C
Explanation: The company needs full packet-level request and response data without granting access to production systems, and analysis must occur in a dedicated monitoring account. VPC Flow Logs (A) only capture metadata, not payloads, so they cannot show malformed responses. Logging in and running tcpdump on production (D) violates the prohibition on direct production access. Traffic Mirroring provides packet-level capture, but option B inspects traffic in the production account, which still places analysis infrastructure in production. Option C correctly uses VPC Traffic Mirroring with a filter for UDP port 50000 and mirrors the EC2 instance ENI traffic to an inspection EC2 instance in the monitoring account, where packet inspection tools can safely extract the request/response data and share it with the vendor.
Question 138
A company has developed a new web application on AWS. The application runs on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate behind an Application Load Balancer (ALB) in the us-east-1 Region. The application uses Amazon Route 53 to host the DNS records for the domain. The content that is served from the website is mostly static images and files that are not updated frequently. Most of the traffic to the website from end users will originate from the United States. Some traffic will originate from Canada and Europe.
A network engineer needs to design a solution that will reduce latency for end users at the lowest cost. The solution also must ensure that all traffic is encrypted in transit until the traffic reaches the ALB.
Which solution will meet these requirements?
A. Configure the ALB to use an AWS Global Accelerator accelerator in us-east-1. Create a secure HTTPS listener. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the DNS name that is assigned to the accelerator for the ALB.
B. Configure the ALB to use a secure HTTPS listener. Create an Amazon CloudFront distribution. Set the origin domain name to point to the DNS record that is assigned to the ALConfigure the CloudFront distribution to use an SSL certificate. Set all behaviors to force HTTPS. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the DNS name that is assigned to the AL
C. Configure the ALB to use a secure HTTPS listener. Create an Amazon CloudFront distribution. Set the origin domain name to point to the DNS record that is assigned to the ALB. Configure the CloudFront distribution to use an SSL certificate and redirect HTTP to HTTPS. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the CloudFront distribution.
D. Configure the ALB to use an AWS Global Accelerator accelerator in us-east-1. Create a secure HTTPS listener. Create a second application stack on Amazon ECS on Fargate in the eu-west-1 Region. Create another secure HTTPS listener. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to use a latency-based routing policy to route to the DNS name that is assigned to the accelerator for the ALBs.
Show Answer
Correct Answer: C
Explanation: Amazon CloudFront is the lowest-cost way to reduce latency for mostly static content with global users by caching content at edge locations close to end users. CloudFront supports HTTPS from viewers to the edge and HTTPS from CloudFront to the ALB, ensuring encryption in transit all the way to the ALB. Route 53 must alias to the CloudFront distribution (not directly to the ALB) so traffic flows through CloudFront. AWS Global Accelerator is optimized for dynamic traffic and is more expensive, and multi-Region deployments are unnecessary for the stated requirements.
Question 139
A network engineer needs to build an encrypted connection between an on-premises data center and a VPC. The network engineer attaches the VPC to a virtual private gateway and sets up an AWS Site-to-Site VPN connection. The VPN tunnel is UP after configuration and is working. However, during rekey for phase 2 of the VPN negotiation, the customer gateway device is receiving different parameters than the parameters that the device is configured to support.
The network engineer checks the IPsec configuration of the VPN tunnel. The network engineer notices that the customer gateway device is configured with the most secure encryption algorithms that the AWS Site-to-Site VPN configuration file provides.
What should the network engineer do to troubleshoot and correct the issue?
A. Check the native virtual private gateway logs. Restrict the VPN tunnel options to the specific VPN parameters that the virtual private gateway requires.
B. Check the native customer gateway logs. Restrict the VPN tunnel options to the specific VPN parameters that the customer gateway requires.
C. Check Amazon CloudWatch logs of the virtual private gateway. Restrict the VPN tunnel options to the specific VPN parameters that the virtual private gateway requires.
D. Check Amazon CloudWatch logs of the customer gateway. Restrict the VPN tunnel options to the specific VPN parameters that the customer gateway requires.
Show Answer
Correct Answer: B
Explanation: The issue occurs during Phase 2 rekey when the customer gateway receives parameters it does not support. Troubleshooting should start on the customer gateway side, using its native logs to identify which IPsec parameters are being proposed and rejected. To correct the issue, the VPN tunnel options must be restricted so that AWS proposes only the parameters that the customer gateway supports. There are no native CloudWatch logs for the customer gateway device itself, making options that reference CloudWatch for the customer gateway or virtual private gateway incorrect.
Question 140
A software-as-a-service (SaaS) company is migrating its private SaaS application to AWS. The company has hundreds of customers that connect to multiple data centers by using VPN tunnels. As the number of customers has grown, the company has experienced more difficulty in its effort to manage routing and segmentation of customers with complex NAT rules.
After the migration to AWS is complete, the company's AWS customers must be able to access the SaaS application directly from their VPCs. Meanwhile, the company's on-premises customers still must be able to connect through IPsec encrypted tunnels.
Which solution will meet these requirements?
A. Connect the AWS customer VPCs to a shared transit gateway. Use AWS Site-to-Site VPN connections to the transit gateway for the on-premises customers
B. Use AWS PrivateLink to connect the AWS customers. Use a third-party routing appliance in the SaaS application VPC to terminate onpremises Site-to-Site VPN connections.
C. Peer each AWS customer's VPCs to the VPC that hosts the SaaS application. Create AWS Site-to-Site VPN connections on the SaaS VPC virtual private gateway.
D. Use Site-to-Site VPN tunnels to connect each AWS customer's VPCs to the VPC that hosts the SaaS application. Use AWS Site-to-Site VPN to connect the on-premises customers.
Show Answer
Correct Answer: B
Explanation: AWS PrivateLink is designed for SaaS providers to expose applications privately to many customer VPCs without VPC peering, transit gateways, or customer-side routing/NAT complexity. It scales well and provides strong network isolation between customers. For on-premises customers, PrivateLink cannot terminate IPsec VPNs, so a third-party VPN/routing appliance in the SaaS VPC can aggregate and manage the existing Site-to-Site VPN tunnels. This avoids complex routing and segmentation that would persist with Transit Gateway or peering-based designs, directly addressing the company’s stated pain points.
Question 141
A company's security guidelines state that all outbound traffic from a VPC to the company's on-premises data center must pass through a security appliance. The security appliance runs on an Amazon EC2 instance. A network engineer needs to improve the network performance between the on-premises data center and the security appliance.
Which actions should the network engineer take to meet these requirements? (Choose two.)
A. Use an EC2 instance that supports enhanced networking.
B. Send outbound traffic through a transit gateway.
C. Increase the EC2 instance size.
D. Place the EC2 instance in a placement group within the VPC.
E. Attach multiple elastic network interfaces to the EC2 instance.
Show Answer
Correct Answer: A, C
Explanation: To improve network performance between the on-premises data center and the EC2-based security appliance, the engineer should optimize the EC2 instance’s networking capabilities. Using an EC2 instance that supports enhanced networking (A) enables higher throughput, lower latency, and reduced jitter by leveraging SR-IOV. Increasing the EC2 instance size (C) provides more vCPUs and higher available network bandwidth, which directly improves throughput for traffic flowing between on premises and the instance. Other options either do not directly improve single-instance throughput (placement groups, multiple ENIs) or are unrelated to performance optimization for this path (transit gateway).
Question 142
A company hosts its IT infrastructure in an on-premises data center. The company wants to migrate the infrastructure to the AWS Cloud in phases. A network engineer wants to set up a 10 Gbps AWS Direct Connect dedicated connection between the on-premises data center and VPCs. The company's network provider needs 3 months to provision the Direct Connect connection.
In the meantime, the network engineer implements a temporary solution by deploying an AWS Site-to-Site VPN connection that terminates to a virtual private gateway. The network engineer observes that the bandwidth of the Site-to-Site VPN connection is capped at 1.25 Gbps despite a powerful customer gateway device.
What should the network engineer do to improve the VPN connection bandwidth before the implementation of the Direct Connect connection?
A. Contact AWS Support to request a bandwidth quota increase for the existing Site-to-Site VPN connection.
B. Discuss the issue with the hardware vendor. Buy a bigger and more powerful customer gateway device that has faster encryption and decryption capabilities.
C. Create several additional Site-to-Site VPN connections that terminate on the same virtual gateway. Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously.
D. Create a transit gateway. Attach the VPCs to the transit gateway. Create several additional Site-to-Site VPN connections that terminate on the transit gateway. Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously.
Show Answer
Correct Answer: D
Explanation: An AWS Site-to-Site VPN connection is limited to about 1.25 Gbps per tunnel, and ECMP is not supported when VPNs terminate on a virtual private gateway. To increase aggregate bandwidth, the VPNs must terminate on an AWS Transit Gateway, which supports ECMP with dynamic (BGP) routing. By creating multiple VPN connections to a transit gateway and enabling ECMP, traffic can be load-balanced across multiple tunnels to achieve higher total throughput before Direct Connect is available.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.