A company has a 2 Gbps AWS Direct Connect hosted connection from the company’s office to a VPC in the ap-southeast-2 Region. A network engineer adds a 5 Gbps Direct Connect hosted connection from a different Direct Connect location in the same Region. The hosted connections are connected to different routers from the office with an iBGP session running in between the routers.
The network engineer wants to ensure that the VPC uses the 5 Gbps hosted connection to route traffic to the office. Failover to the 2 Gbps hosted connection must occur when the 5 Gbps hosted connection is down.
Which solution will meet these requirements?
A. Configure an outbound BGP policy from the router that is connected to the 2 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS.
B. Advertise a longer prefix route from the router that is connected to the 2 Gbps connection.
C. Advertise a less specific route from the router that is connected to the 5 Gbps connection.
D. Configure an outbound BGP policy from the router that is connected to the 5 Gbps connection. Advertise routes with a longer AS_PATH attribute to AWS.
Show Answer
Correct Answer: A
Explanation: For AWS Direct Connect inbound traffic from AWS to the on-premises network, AWS selects the best BGP path. AS_PATH prepending makes a route less preferred because BGP prefers the shortest AS_PATH. By prepending the AS_PATH on advertisements sent over the 2 Gbps hosted connection, the 5 Gbps connection becomes the preferred path. If the 5 Gbps connection fails and its routes are withdrawn, AWS will use the remaining 2 Gbps path automatically. Advertising longer or less specific prefixes would not meet the desired primary/backup behavior in this scenario.
Question 135
A company uses multiple AWS accounts and VPCs in a single AWS Region. The company must log all network traffic for Amazon EC2 instances and Amazon RDS databases. The company will use the log information to monitor and identify traffic flows in the event of a security incident. The information must be retained for 12 months but will be accessed infrequently after the first 90 days. The company must be able to view metadata that includes the vpc-id, subnet-id: and tcp-flags fields.
Which solution will meet these requirements at the LOWEST cost?
A. Configure VPC flow logs with the default fields Store the logs in Amazon CloudWatch Logs.
B. Configure Traffic Mirroring on all AWS resources to point to a Network Load Balancer that will send the mirrored traffic to monitoring instances.
C. Configure VPC flow logs with additional custom format fields Store the logs in Amazon S3.
D. Configure VPC flow logs with additional custom format fields Store the logs in Amazon CloudWatch Logs.
Show Answer
Correct Answer: C
Explanation: VPC Flow Logs provide network traffic metadata (not packet payloads) and support custom format fields including vpc-id, subnet-id, and tcp-flags. Storing the logs in Amazon S3 is the lowest-cost option for 12-month retention, especially because the logs are accessed infrequently after the first 90 days and can use S3 lifecycle policies to transition to lower-cost storage classes. CloudWatch Logs is more expensive for long-term log storage, and Traffic Mirroring captures full packets and requires additional infrastructure, making it significantly more costly.
Question 136
A network engineer needs to design the architecture for a high performance computing (HPC) workload. Amazon EC2 instances will require 10 Gbps flows and an aggregate throughput of up to 100 Gbps across many instances with low-latency communication.
Which architecture solution will optimize this workload?
A. Place nodes in a single subnet of a VPC. Configure a cluster placement group. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system.
B. Place nodes in multiple subnets in a single VPC. Configure a spread placement group. Ensure that the EC2 instances support Elastic Network Adapters (ENAs) and that the drivers are updated on each instance operating system.
C. Place nodes in multiple VPCs Use AWS Transit Gateway to route traffic between the VPCs. Ensure that the latest Elastic Fabric Adapter (EFA) drivers are installed on the EC2 instances with a supported operating system.
D. Place nodes in multiple subnets in multiple Availability Zones. Configure a cluster placement group. Ensure that the EC2 instances support Elastic Network Adapters (ENAs) and that the drivers are updated on each instance operating system.
Show Answer
Correct Answer: A
Explanation: High-performance computing workloads that require low-latency communication, 10 Gbps flows, and aggregate throughput up to 100 Gbps are optimized by using Elastic Fabric Adapter (EFA) with supported EC2 instances. A cluster placement group keeps instances physically close within a single Availability Zone to minimize latency and maximize network performance. The other options use spread placement groups, multiple VPCs, or multiple Availability Zones, all of which increase latency or do not provide the required HPC-optimized networking.
Question 137
A company is using a shared services VPC with two domain controllers. The domain controllers are deployed in the company's private subnets. The company is deploying a new application into a new VPC in the account. The application will be deployed onto an Amazon EC2 for Windows Server instance in the new VPC. The instance must join the existing Windows domain that is supported by the domain controllers in the shared services VPC.
A transit gateway is attached to both the shared services VPC and the new VPC. The company has updated the route tables for the transit gateway, the shared services VPC, and the new VPC. The security groups for the domain controllers and the instance are updated and allow traffic only on the ports that are necessary for domain operations. The instance is unable to join the domain that is hosted on the domain controllers.
Which combination of actions will help identify the cause of this issue with the LEAST operational overhead? (Choose two.)
A. Use AWS Network Manager to perform a route analysis for the transit gateway network. Specify the existing EC2 instance as the source. Specify the first domain controller as the destination. Repeat the route analysis for the second domain controller.
B. Use port mirroring with the existing EC2 instance as the source and another EC2 instance as the target to obtain packet captures of the connection attempts.
C. Review the VPC flow logs on the shared services VPC and the new VP
D. Issue a ping command from one of the domain controllers to the existing EC2 instance.
E. Ensure that route propagation is turned off on the shared services VPC.
Show Answer
Correct Answer: A, C
Explanation: Use Transit Gateway route analysis in AWS Network Manager to verify that traffic can be routed from the EC2 instance to each domain controller through the transit gateway. Review VPC Flow Logs in both VPCs to determine whether traffic is accepted or rejected and where connectivity is failing. These approaches provide effective troubleshooting with minimal operational overhead. Port mirroring is heavier, ping is not a reliable test for Active Directory connectivity and may be blocked by ICMP rules, and disabling route propagation would not help diagnose or fix the issue.
Question 138
A European car manufacturer wants to migrate its customer-facing services and its analytics platform from two on-premises data centers to the AWS Cloud. The company has a 50-mile (80.4 km) separation between its on-premises data centers and must maintain that separation between its two locations in the cloud. The company also needs failover capabilities between the two locations in the cloud.
The company's infrastructure team creates several accounts to separate workloads and responsibilities. The company provisions resources in the eu-west-3 Region and in the eu-central-1 Region. The company selects an AWS Direct Connect Partner in each Region and requests two resilient 1 Gbps fiber connections from each provider.
The company's network engineer must establish a connection between all VPCs in the accounts and between the on-premises network and the AWS Cloud. The solution must provide access to all services in both Regions in case of network issues.
Which solution will meet these requirements?
A. Create a Direct Connect gateway. Create a private VIF on each of the Direct Connect connections. Attach the private VIFs to the Direct Connect gateway. Use equal-cost multi-path (ECMP) routing to aggregate the four connections across the two Regions. Attach the Direct Connect gateway directly to each VPC's virtual private gateway.
B. Create a Direct Connect gateway. Create a transit gateway. Attach the transit gateway to the Direct Connect gateway. Create a transit VIF on each of the Direct Connect connections. Attach the transit VIFs to the Direct Connect gateway. Use a link aggregation group (LAG) to aggregate the four connections across the two Regions. Attach the transit gateway directly to each VPC.
C. Create a Direct Connect gateway. Create a transit gateway in each Region. Attach the transit gateways to the Direct Connect gateway. Create a transit VIF on each of the Direct Connect connections. Attach the transit VIFs to the Direct Connect gateway. Peer the transit gateways. Attach the transit gateways in each Region to the VPCs in the same Region.
D. Create a Direct Connect gateway. Create a private VIF on each of the Direct Connect connections. Attach the private VIFs to the Direct Connect gateway. Use a link aggregation group (LAG) to aggregate the four connections across the two Regions. Create a transit gateway. Attach the transit gateway to the Direct Connect gateway. Attach the transit gateway directly to each VPC.
Show Answer
Correct Answer: C
Explanation: A transit gateway is a Regional service, so a separate transit gateway is required in each AWS Region. A Direct Connect gateway can connect to multiple transit gateways across Regions using transit virtual interfaces. Peering the two transit gateways provides inter-Region connectivity and failover between Regions, while each Region's transit gateway connects to its local VPCs. Options using a single transit gateway across Regions are invalid, attaching a Direct Connect gateway directly to many VPC virtual private gateways is not the scalable design requested, and LAG cannot aggregate connections across different Direct Connect locations/providers or Regions.
Question 139
An ecommerce company needs to implement additional security controls on all its domain names that are hosted in Amazon Route 53. The company's new policy requires data authentication and data integrity verification for all queries to the company’s domain names. The current Route 53 architecture has four public hosted zones.
A network engineer needs to implement DNS Security Extensions (DNSSEC) signing and validation on the hosted zones. The solution must include an alert capability.
Which combination of steps will meet these requirements? (Choose three.)
A. Enable DNSSEC signing for Route 53 Request that Route 53 create a key-signing key (KSK) based on a customer managed key in AWS Key Management Service (AWS KMS).
B. Enable DNSSEC signing for Route 53 Request that Route 53 create a zone-signing key (ZSK) based on a customer managed key in AWS Key Management Service (AWS KMS).
C. Create a chain of trust for the hosted zones by adding a Delegation Signer (DS) record for each subdomain
D. Create a chain of trust for the hosted zones by adding a Delegation Signer (DS) record to the parent zone.
E. Set up an Amazon CloudWatch alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected.
F. Set up an AWS CloudTrail alarm that provides an alert whenever a DNSSECInternalFailure error or DNSSECKeySigningKeysNeedingAction error is detected.
Show Answer
Correct Answer: A, D, E
Explanation: Route 53 DNSSEC signing uses a customer-managed AWS KMS key only for the key-signing key (KSK); Route 53 manages the zone-signing key (ZSK) automatically. To establish the DNSSEC chain of trust, publish a DS record in the parent zone, not within the child zone itself. Route 53 exposes DNSSEC health metrics such as DNSSECInternalFailure and DNSSECKeySigningKeysNeedingAction to Amazon CloudWatch, so CloudWatch alarms provide the required alerting capability.
Question 140
A real estate company is using Amazon Workspaces to provide corporate managed desktop service to its real estate agents around the world. These Workspaces are deployed in seven VPCs. Each VPC is in a different AWS Region.
According to a new requirement, the company’s cloud-hosted security information and events management (SIEM) system needs to analyze DNS queries generated by the Workspaces to identify the target domains that are connected to the Workspaces. The SIEM system supports poll and push methods for data and log collection.
Which solution should a network engineer implement to meet these requirements MOST cost-effectively?
A. Create VPC flow logs in each VPC that is connected to the Workspaces instances. Publish the log data to a central Amazon S3 bucket. Configure the SIEM system to poll the S3 bucket periodically.
B. Configure an Amazon CloudWatch agent to log all DNS requests in Amazon CloudWatch Logs. Configure a subscription filter in CloudWatch Logs. Push the logs to the SIEM system by using Amazon Kinesis Data Firehose.
C. Configure VPC Traffic Mirroring to copy network traffic from each Workspace and to send the traffic to the SIEM system probes for analysis.
D. Configure Amazon Route 53 query logging. Set the destination as an Amazon Kinesis Data Firehose delivery stream that is configured to push data to the SIEM system.
Show Answer
Correct Answer: D
Explanation: Amazon Route 53 Resolver query logging is the native service for capturing DNS queries made through the AmazonProvidedDNS/Route 53 Resolver in VPCs. It can deliver logs to Amazon Kinesis Data Firehose, which can push them to the SIEM. VPC Flow Logs do not record DNS query names, Traffic Mirroring is unnecessarily expensive and complex, and installing CloudWatch agents on every Workspace is operationally costly.
Question 141
A company hosts a web application that runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The company uses an Amazon CloudFront distribution with the ALB as an origin.
The application recently experienced an attack. In response, the company associated an AWS WAF web ACL with the CloudFront distribution. The company needs to use Amazon Athena to analyze application attacks that AWS WAF detects.
Which solution will meet this requirement?
A. Configure the ALB and the EC2 instance subnets to produce VPC flow logs. Configure the VPC flow logs to deliver logs to an Amazon S3 bucket for log analysis.
B. Create a trail in AWS CloudTrail to capture data events. Configure the trail to deliver logs to an Amazon S3 bucket for log analysis.
C. Configure the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon S3 bucket for log analysis.
D. Turn on access logging for the ALB. Configure the access logs to deliver the logs to an Amazon S3 bucket for log analysis.
Show Answer
Correct Answer: C
Explanation: AWS WAF logging is configured to send web ACL logs to an Amazon Kinesis Data Firehose delivery stream, which can then deliver the logs to Amazon S3. Amazon Athena can query the WAF logs stored in S3 to analyze detected application attacks. VPC Flow Logs, CloudTrail, and ALB access logs do not contain AWS WAF detection details.
Question 142
A company has deployed a multi-VPC environment in the AWS Cloud. The company uses a transit gateway to connect all the VPCs together. In the past, the company has experienced a loss of connectivity between applications after changes to security groups, network ACLs, and route tables in a VPC. When these changes occur, the company wants to automatically verify that connectivity still exists between different resources in a single VPC.
A. Create a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
B. Create a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS. CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
C. Create a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the diffident paths in Route Analyzer.
D. Create a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Route Analyzer.
Show Answer
Correct Answer: B
Explanation: VPC Reachability Analyzer is the correct service for verifying connectivity between resources within a single VPC, including the effects of security groups, network ACLs, and route tables. Configuration changes are recorded as API events in AWS CloudTrail, and EventBridge can match those CloudTrail events to trigger a Lambda function that reruns predefined Reachability Analyzer path analyses automatically. Transit Gateway Network Manager Route Analyzer is intended for transit gateway routing analysis, not single-VPC reachability.
Question 143
A network engineer needs to deploy an AWS Network Firewall firewall into an existing AWS environment. The environment consists of the following:
• A transit gateway with all VPCs attached to it
• Several hundred application VPCs
• A centralized egress internet VPC with a NAT gateway and an internet gateway
• A centralized ingress internet VPC that hosts public Application Load Balancers
• On-premises connectivity through an AWS Direct Connect gateway attachment
The application VPCs have workloads deployed across multiple Availability Zones in private subnets with the VPC route table s default route (0.0.0.0/0) pointing to the transit gateway. The Network Firewall firewall needs to inspect east-west (VPC-to-VPC) traffic and north-south (internet-bound and on-premises network) traffic by using Suricata compatible rules.
The network engineer must deploy the firewall by using a solution that requires the least possible architectural changes to the existing production environment.
Which combination of steps should the network engineer take to meet these requirements? (Choose three.)
A. Deploy Network Firewall in all Availability Zones in each application VPC.
B. Deploy Network Firewall in all Availability Zones in a centralized inspection VPC.
C. Update the HOME_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
D. Update the EXTERNAL_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
E. Configure a single transit gateway route table. Associate all application VPCs and the centralized inspection VPC with this route table.
F. Configure two transit gateway route tables. Associate all application VPCs with one transit gateway route table. Associate the centralized inspection VPC with the other transit gateway route table.
Show Answer
Correct Answer: B, C, F
Explanation: A centralized inspection VPC minimizes architectural changes while allowing AWS Network Firewall to inspect east-west and north-south traffic. For Suricata-compatible rules, HOME_NET should include all protected internal address spaces (all VPC CIDRs and on-premises CIDRs) so internal traffic is correctly classified. Using two Transit Gateway route tables—one for application VPC attachments and one for the inspection VPC attachment—supports centralized service insertion and traffic steering through the inspection VPC.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.