A company has three VPCs in a single AWS Region. Each VPC contains 15 Amazon EC2 instances, and no connectivity exists between the VPCs.
The company is deploying a new application across all three VPCs. The application requires high bandwidth between the nodes. A network engineer must implement connectivity between the VPCs.
Which solution will meet these requirements with the HIGHEST throughput?
A. Configure a transit gateway. Attach each VPC to the transit gateway. Configure static routing in each VPC to route traffic to the transit gateway.
B. Configure VPC peering between the three VPCs. Configure static routing to route traffic between the three VPCs.
C. Configure a transit VPConfigure a VPN gateway in each VPCreate an AWS Site-to-Site VPN tunnel from each VPC to the transit VPUse BGP routing to route traffic between the VPCs and the transit VP
D. Configure AWS Site-to-Site VPN connections between each VPC. Enable route propagation for each Site-to-Site VPN connection to route traffic between the VPCs.
Show Answer
Correct Answer: B
Explanation: VPC peering provides direct, private connectivity between VPCs without the aggregate bandwidth cap imposed by a transit gateway attachment. With only three VPCs, full-mesh VPC peering (three peering connections) is straightforward and delivers the highest potential throughput. Transit Gateway simplifies larger topologies but each VPC attachment has a bandwidth limit (up to 50 Gbps per AZ). VPN-based options are limited by encryption overhead and VPN throughput.
Question 145
A company wants to analyze TCP traffic to the internet. The traffic originates from Amazon EC2 instances in the company's VPC. The EC2 instances initiate connections through a NAT gateway. The required information includes source and destination IP addresses, ports, and the first 8 bytes of payload of TCP segments. The company needs to collect, store, and analyze all the required data points.
Which solution will meet these requirements?
A. Set up the EC2 instances as VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights.
B. Set up the NAT gateway as a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon OpenSearch Service cluster. Analyze the data by using OpenSearch Dashboards.
C. Turn on VPC Flow Logs on the EC2 instances. Specify the default format and a log destination of Amazon CloudWatch Logs. Analyze the flow log data by using CloudWatch Logs Insights.
D. Turn on VPC Flow Logs on the EC2 instances. Specify a custom format and a log destination of Amazon S3. Analyze the flow log data by using Amazon Athena.
Show Answer
Correct Answer: A
Explanation: The requirement includes capturing the first 8 bytes of TCP payload. VPC Flow Logs (default or custom) record only flow metadata such as source/destination IPs, ports, protocol, bytes, and action; they do not capture packet payloads. VPC Traffic Mirroring provides packet-level copies of traffic, including payload, from supported ENIs on EC2 instances. NAT gateways cannot be configured as traffic mirror sources, so mirroring must be configured on the EC2 instance ENIs. The mirrored traffic can then be forwarded to CloudWatch Logs for analysis with Logs Insights.
Question 146
A company has critical VPC workloads that connect to an on-premises data center through two redundant active-passive AWS Direct Connect connections. However, a recent outage on one Direct Connect connection revealed that it takes more than a minute for traffic to fail over to the secondary Direct Connect connection. The company wants to reduce the failover time from minutes to seconds.
Which solution will provide the LARGEST reduction in the BGP failover time?
A. Reduce the BGP hold-down timer that is configured on the BGP sessions on the Direct Connect connection VIFs.
B. Configure an Amazon CloudWatch alarm for the Direct Connect connection state to invoke an AWS Lambda function to fail over the traffic.
C. Configure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the AWS side.
D. Configure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the on-premises router.
Show Answer
Correct Answer: D
Explanation: The correct answer is D. AWS Direct Connect virtual interfaces have asynchronous BFD enabled on the AWS side by default, but it does not become operational until BFD is configured on the customer (on-premises) router. BFD provides rapid failure detection (typically sub-second to a few seconds), allowing BGP to tear down the session much faster than relying on the default BGP hold timer (~90 seconds). Option A can improve failover somewhat by lowering BGP timers, but it is less effective than BFD. Option C is incorrect because the AWS side cannot be configured by the customer; it is already enabled. Option B does not affect BGP convergence and would be slower and more complex.
Question 147
A team of infrastructure engineers wants to automate the deployment of Application Load Balancer (ALB) components by using the AWS Cloud Development Kit (AWS CDK). The CDK application must deploy an infrastructure stack that is reusable and consistent across multiple environments, AWS Regions, and AWS accounts.
The lead network architect on the project has already bootstrapped the target accounts. The lead network architect also has deployed core network components such as VPCs and Amazon Route 53 private hosted zones across the multiple environments and Regions. The infrastructure engineers must design the ALB components in the CDK application to use the existing core network components.
Which combination of steps will meet this requirement with the LEAST manual effort between environment deployments? (Choose two.)
A. Design the CDK application to read AWS CloudFormation parameters for the values that vary across environments and Regions. Reference these variables in the CDK stack for resources that require the variables.
B. Design the CDK application to read environment variables that contain account and Region details at runtime. Use these variables as properties of the CDK stack. Use context methods in the CDK stack to retrieve variable values.
C. Create a dedicated account for shared application services in the multi-account environment. Deploy a CDK pipeline to the dedicated account. Create stages in the pipeline that deploy the CDK application across different environments and Regions.
D. Write a script that automates the deployment of the CDK application across multiple environments and Regions. Distribute the script to engineers who are working on the project.
E. Use the CDK toolkit locally to deploy stacks to each environment and Region. Use the --context flag to pass in variables that the CDK application can reference at runtime.
Show Answer
Correct Answer: B, C
Explanation: Use environment variables and CDK context rather than CloudFormation parameters for values that vary by account and Region, because CDK is designed to synthesize with context/environment information. For repeatable multi-account and multi-Region deployments with minimal manual effort, a CDK Pipeline can orchestrate deployments across environments. CloudFormation parameters (A) are generally discouraged in CDK, local toolkit deployments (E) require repeated manual actions, and distributing a custom script (D) is more manual and less integrated than CDK Pipelines.
Question 148
A company has two AWS Direct Connect links. One Direct Connect link terminates in the us-east-1 Region, and the other Direct Connect link terminates in the af-south-1 Region. The company is using BGP to exchange routes with AWS.
How should a network engineer configure BGP to ensure that af-south-1 is used as a secondary link to AWS?
A. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 200 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 50
B. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 200 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 50
C. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 50 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 200
D. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 50 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 200
Show Answer
Correct Answer: B
Explanation: To make the us-east-1 Direct Connect the primary path and af-south-1 the secondary path, assign a higher local preference (200) to the us-east-1 BGP peer and a lower local preference (50) to the af-south-1 peer. For AWS Direct Connect inbound routing from AWS, use BGP communities so that the preferred primary Region advertises with the higher-preference community (7224:7300 for local Region preference) and the secondary Region uses the lower-preference community (7224:7100). This combination matches option B.
Question 149
A company is deploying AWS Cloud WAN with edge locations in the us-east-1 Region and the ap-southeast-2 Region. Individual AWS Cloud WAN segments are configured for the development environment, the production environment, and the shared services environment at each edge location. Many new VPCs will be deployed for the environments and will be configured as attachments to the AWS Cloud WAN core network.
The company's network team wants to ensure that VPC attachments are configured for the correct segment. The network team will tag the VPC attachments by using the Environment key with a value of the corresponding environment segment name. The segment for the production environment in us-east-1 must require acceptance for attachment requests. All other attachment requests must not require acceptance.
Which solution will meet these requirements?
A. Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag:Environment values to their respective segments.
B. Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag.Environment values to their respective segments.
C. Create a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1.
D. Create a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1.
Show Answer
Correct Answer: B
Explanation: Attachment policy rules are evaluated in order, so the specific exception must come before the general mapping rule. The acceptance requirement applies only to the Production segment in the us-east-1 Region, which requires both conditions to match (AND). A later rule can then map all Environment tag values to their corresponding segments without requiring acceptance. Using OR would incorrectly require acceptance for all production attachments in any Region or all attachments in us-east-1.
Question 150
An application team for a startup company is deploying a new multi-tier application into the AWS Cloud. The application will be hosted on a fleet of Amazon EC2 instances that run in an Auto Scaling group behind a publicly accessible Network Load Balancer (NLB). The application requires the clients to work with UDP traffic and TCP traffic.
In the near term, the application will serve only users within the same geographic location. The application team plans to extend the application to a global audience and will move the deployment to multiple AWS Regions around the world to bring the application closer to the end users. The application team wants to use the new Regions to deploy new versions of the application and wants to be able to control the amount of traffic that each Region receives during these rollouts. In addition, the application team must minimize first-byte latency and jitter (randomized delay) for the end users.
How should the application team design the network architecture for the application to meet these requirements?
A. Create an Amazon CloudFront distribution to align to each Regional deployment. Set the NLB for each Region as the origin for each CloudFront distribution. Use an Amazon Route 53 weighted routing policy to control traffic to the newer Regional deployments.
B. Create an AWS Global Accelerator accelerator and listeners for the required ports. Configure endpoint groups for each Region. Configure a traffic dial for the endpoint groups to control traffic to the newer Regional deployments. Register the NLBs with the endpoint groups.
C. Use Amazon S3 Transfer Acceleration for the application in each Region. Adjust the amount of traffic that each Region receives from the Transfer Acceleration endpoints to the Regional NLBs.
D. Create an Amazon CloudFront distribution that includes an origin group. Set the NLB for each Region as the origins for the origin group. Use an Amazon Route 53 latency routing policy to control traffic to the new Regional deployments.
Show Answer
Correct Answer: B
Explanation: AWS Global Accelerator is designed for TCP and UDP applications, provides static anycast IPs, routes users onto the AWS global network to reduce first-byte latency and jitter, supports endpoint groups across multiple Regions, and includes traffic dials to gradually shift traffic during regional deployments. Network Load Balancers are supported as endpoints. CloudFront is primarily for HTTP/HTTPS content delivery and is not the appropriate choice for this TCP/UDP use case, while S3 Transfer Acceleration is unrelated to this application architecture.
Question 151
A company recently implemented a security policy that prohibits developers from launching VPC network infrastructure. The policy states that any time a NAT gateway is launched in a VPC, the company's network security team must immediately receive an alert to terminate the NAT gateway. The network security team needs to implement a solution that can be deployed across AWS accounts with the least possible administrative overhead. The solution also must provide the network security team with a simple way to view compliance history.
Which solution will meet these requirements?
A. Develop a script that programmatically checks for NAT gateways in an AWS account, sends an email alert, and terminates the NAT gateway if a NAT gateway is detected. Deploy the script on an Amazon EC2 instance in each account. Use a cron job to run the script every 5 minutes. Log the results of the checks to an Amazon RDS for MySQL database.
B. Create an AWS Lambda function that programmatically checks for NAT gateways in an AWS account, sends an email alert, and terminates the NAT gateway if a NAT gateway is detected. Deploy the Lambda function to each account by using AWS Serverless Application Model (AWS SAM) templates. Store the results of the checks on an Amazon OpenSearch Service cluster in each account.
C. Enable Amazon GuardDuty. Create an Amazon EventBridge rule for the Behavior:EC2/NATGatewayCreation GuardDuty finding type. Configure the rule to invoke an AWS Step Functions state machine to send an email alert and terminate a NAT gateway if a NAT gateway is detected. Store the runtime log as a text file in an Amazon S3 bucket.
D. Create a custom AWS Config rule that checks for NAT gateways in an AWS account. Configure the AWS Config rule to perform an AWS Systems Manager Automation remediation action to send an email alert and terminate the NAT gateway if a NAT gateway is detected. Deploy the AWS Config rule and the Systems Manager runbooks to each account by using AWS CloudFormation StackSets
Show Answer
Correct Answer: D
Explanation: AWS Config is designed for continuous resource compliance evaluation and provides built-in compliance history. A custom AWS Config rule can detect NAT gateways, and automatic remediation can be implemented with AWS Systems Manager Automation to send an alert and terminate the NAT gateway. AWS CloudFormation StackSets enables deployment across multiple AWS accounts with minimal administrative overhead. GuardDuty does not generate findings for NAT gateway creation events, and the EC2 script/Lambda options lack centralized compliance tracking and require more operational overhead.
Question 152
A company uses an AWS Direct Connect private VIF with a link aggregation group (LAG) that consists of two 10 Gbps connections. The company's security team has implemented a new requirement for external network connections to provide layer 2 encryption. The company's network team plans to use MACsec support for Direct Connect to meet the new requirement.
Which combination of steps should the network team take to implement this functionality? (Choose three.)
A. Create a new Direct Connect LAG with new circuits and ports that support MACsec.
B. Associate the MACsec Connectivity Association Key (CAK) and the Connection Key Name (CKN) with the new LAG.
C. Associate the Internet Key Exchange (IKE) with the existing LAG.
D. Configure the MACsec encryption mode on the existing LAG.
E. Configure the MACsec encryption mode on the new LAG.
F. Configure the MACsec encryption mode on each Direct Connect connection that makes up the existing LAG.
Show Answer
Correct Answer: A, B, E
Explanation: AWS Direct Connect MACsec must be enabled on MACsec-capable dedicated connections/LAGs. The implementation requires creating a MACsec-capable LAG if the existing one was not created with MACsec support, associating the MACsec CAK and CKN with the LAG, and configuring the MACsec encryption mode on that new LAG. IKE is not used for Direct Connect MACsec, and MACsec mode is configured at the LAG level rather than per existing connection in this scenario.
Question 153
A company has an AWS account with four VPCs in the us-east-1 Region. The VPCs consist of a development VPC and three production VPCs that host various workloads.
The company has extended its on-premises data center to AWS with AWS Direct Connect by using a Direct Connect gateway. The company now wants to establish connectivity to its production VPCs and development VPC from on premises. The production VPCs are allowed to route data to each other. However, the development VPC must be isolated from the production VPCs. No data can flow between the development VPC and the production VPCs.
In preparation to implement this solution, a network engineer creates a transit gateway with a single transit gateway route table. Default route table association and default route table propagation are turned off. The network engineer attaches the production VPCs, the development VPC, and the Direct Connect gateway to the transit gateway. For each VPC route table, the network engineer adds a route to 0.0.0.0/0 with the transit gateway as the next destination.
Which combination of steps should the network engineer take next to complete this solution? (Choose three.)
A. Associate the production VPC attachments with the existing transit gateway route table. Propagate the routes from these attachments.
B. Associate all the attachments with the existing transit gateway route table. Propagate the routes from these attachments.
C. Associate the Direct Connect gateway attachment with the existing transit gateway route table. Propagate the Direct Connect gateway attachment to this route table.
D. Change the security group inbound rules on the existing transit gateway network interfaces in the development VPC to allow connections to and from the on-premises CIDR range only.
E. Create a new transit gateway route table. Associate the new route table with the development VPC attachment. Propagate the Direct Connect gateway and development VPC attachment to the new route table.
F. Create a new transit gateway with default route table association and default route table propagation turned on. Attach the Direct Connect gateway and development VPC to the new transit gateway.
Show Answer
Correct Answer: A, C, E
Explanation: Use separate transit gateway route tables to isolate the development VPC while allowing on-premises connectivity to both environments. Associate and propagate the production VPC attachments into the existing route table so production VPCs can communicate with each other. Associate and propagate the Direct Connect gateway attachment with the production route table so on-premises can reach production. Create a second transit gateway route table for the development VPC, associate the development attachment with it, and propagate both the Direct Connect gateway attachment and the development VPC attachment into that table so on-premises can reach development without exposing production routes. Security groups on TGW ENIs are not the mechanism for this isolation, and creating a second transit gateway is unnecessary.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.