A real estate company is using Amazon Workspaces to provide corporate managed desktop service to its real estate agents around the world. These Workspaces are deployed in seven VPCs. Each VPC is in a different AWS Region.
According to a new requirement, the company’s cloud-hosted security information and events management (SIEM) system needs to analyze DNS queries generated by the Workspaces to identify the target domains that are connected to the Workspaces. The SIEM system supports poll and push methods for data and log collection.
Which solution should a network engineer implement to meet these requirements MOST cost-effectively?
A. Create VPC flow logs in each VPC that is connected to the Workspaces instances. Publish the log data to a central Amazon S3 bucket. Configure the SIEM system to poll the S3 bucket periodically.
B. Configure an Amazon CloudWatch agent to log all DNS requests in Amazon CloudWatch Logs. Configure a subscription filter in CloudWatch Logs. Push the logs to the SIEM system by using Amazon Kinesis Data Firehose.
C. Configure VPC Traffic Mirroring to copy network traffic from each Workspace and to send the traffic to the SIEM system probes for analysis.
D. Configure Amazon Route 53 query logging. Set the destination as an Amazon Kinesis Data Firehose delivery stream that is configured to push data to the SIEM system.
Show Answer
Correct Answer: D
Explanation: Amazon Route 53 Resolver query logging is the native service for capturing DNS queries made through the AmazonProvidedDNS/Route 53 Resolver in VPCs. It can deliver logs to Amazon Kinesis Data Firehose, which can push them to the SIEM. VPC Flow Logs do not record DNS query names, Traffic Mirroring is unnecessarily expensive and complex, and installing CloudWatch agents on every Workspace is operationally costly.
Question 141
A company hosts a web application that runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The company uses an Amazon CloudFront distribution with the ALB as an origin.
The application recently experienced an attack. In response, the company associated an AWS WAF web ACL with the CloudFront distribution. The company needs to use Amazon Athena to analyze application attacks that AWS WAF detects.
Which solution will meet this requirement?
A. Configure the ALB and the EC2 instance subnets to produce VPC flow logs. Configure the VPC flow logs to deliver logs to an Amazon S3 bucket for log analysis.
B. Create a trail in AWS CloudTrail to capture data events. Configure the trail to deliver logs to an Amazon S3 bucket for log analysis.
C. Configure the AWS WAF web ACL to deliver logs to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon S3 bucket for log analysis.
D. Turn on access logging for the ALB. Configure the access logs to deliver the logs to an Amazon S3 bucket for log analysis.
Show Answer
Correct Answer: C
Explanation: AWS WAF logging is configured to send web ACL logs to an Amazon Kinesis Data Firehose delivery stream, which can then deliver the logs to Amazon S3. Amazon Athena can query the WAF logs stored in S3 to analyze detected application attacks. VPC Flow Logs, CloudTrail, and ALB access logs do not contain AWS WAF detection details.
Question 142
A company has deployed a multi-VPC environment in the AWS Cloud. The company uses a transit gateway to connect all the VPCs together. In the past, the company has experienced a loss of connectivity between applications after changes to security groups, network ACLs, and route tables in a VPC. When these changes occur, the company wants to automatically verify that connectivity still exists between different resources in a single VPC.
A. Create a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
B. Create a list of paths between different resources to check in VPC Reachability Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS. CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Reachability Analyzer.
C. Create a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in Amazon CloudWatch. Configure the rule to invoke an AWS Lambda function to test the diffident paths in Route Analyzer.
D. Create a list of paths to check in AWS Transit Gateway Network Manager Route Analyzer. Create an Amazon EventBridge rule to monitor when a change is made and logged in AWS CloudTrail. Configure the rule to invoke an AWS Lambda function to test the different paths in Route Analyzer.
Show Answer
Correct Answer: B
Explanation: VPC Reachability Analyzer is the correct service for verifying connectivity between resources within a single VPC, including the effects of security groups, network ACLs, and route tables. Configuration changes are recorded as API events in AWS CloudTrail, and EventBridge can match those CloudTrail events to trigger a Lambda function that reruns predefined Reachability Analyzer path analyses automatically. Transit Gateway Network Manager Route Analyzer is intended for transit gateway routing analysis, not single-VPC reachability.
Question 143
A network engineer needs to deploy an AWS Network Firewall firewall into an existing AWS environment. The environment consists of the following:
• A transit gateway with all VPCs attached to it
• Several hundred application VPCs
• A centralized egress internet VPC with a NAT gateway and an internet gateway
• A centralized ingress internet VPC that hosts public Application Load Balancers
• On-premises connectivity through an AWS Direct Connect gateway attachment
The application VPCs have workloads deployed across multiple Availability Zones in private subnets with the VPC route table s default route (0.0.0.0/0) pointing to the transit gateway. The Network Firewall firewall needs to inspect east-west (VPC-to-VPC) traffic and north-south (internet-bound and on-premises network) traffic by using Suricata compatible rules.
The network engineer must deploy the firewall by using a solution that requires the least possible architectural changes to the existing production environment.
Which combination of steps should the network engineer take to meet these requirements? (Choose three.)
A. Deploy Network Firewall in all Availability Zones in each application VPC.
B. Deploy Network Firewall in all Availability Zones in a centralized inspection VPC.
C. Update the HOME_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
D. Update the EXTERNAL_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
E. Configure a single transit gateway route table. Associate all application VPCs and the centralized inspection VPC with this route table.
F. Configure two transit gateway route tables. Associate all application VPCs with one transit gateway route table. Associate the centralized inspection VPC with the other transit gateway route table.
Show Answer
Correct Answer: B, C, F
Explanation: A centralized inspection VPC minimizes architectural changes while allowing AWS Network Firewall to inspect east-west and north-south traffic. For Suricata-compatible rules, HOME_NET should include all protected internal address spaces (all VPC CIDRs and on-premises CIDRs) so internal traffic is correctly classified. Using two Transit Gateway route tables—one for application VPC attachments and one for the inspection VPC attachment—supports centralized service insertion and traffic steering through the inspection VPC.
Question 144
A company has three VPCs in a single AWS Region. Each VPC contains 15 Amazon EC2 instances, and no connectivity exists between the VPCs.
The company is deploying a new application across all three VPCs. The application requires high bandwidth between the nodes. A network engineer must implement connectivity between the VPCs.
Which solution will meet these requirements with the HIGHEST throughput?
A. Configure a transit gateway. Attach each VPC to the transit gateway. Configure static routing in each VPC to route traffic to the transit gateway.
B. Configure VPC peering between the three VPCs. Configure static routing to route traffic between the three VPCs.
C. Configure a transit VPConfigure a VPN gateway in each VPCreate an AWS Site-to-Site VPN tunnel from each VPC to the transit VPUse BGP routing to route traffic between the VPCs and the transit VP
D. Configure AWS Site-to-Site VPN connections between each VPC. Enable route propagation for each Site-to-Site VPN connection to route traffic between the VPCs.
Show Answer
Correct Answer: B
Explanation: VPC peering provides direct, private connectivity between VPCs without the aggregate bandwidth cap imposed by a transit gateway attachment. With only three VPCs, full-mesh VPC peering (three peering connections) is straightforward and delivers the highest potential throughput. Transit Gateway simplifies larger topologies but each VPC attachment has a bandwidth limit (up to 50 Gbps per AZ). VPN-based options are limited by encryption overhead and VPN throughput.
Question 145
A company wants to analyze TCP traffic to the internet. The traffic originates from Amazon EC2 instances in the company's VPC. The EC2 instances initiate connections through a NAT gateway. The required information includes source and destination IP addresses, ports, and the first 8 bytes of payload of TCP segments. The company needs to collect, store, and analyze all the required data points.
Which solution will meet these requirements?
A. Set up the EC2 instances as VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights.
B. Set up the NAT gateway as a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon OpenSearch Service cluster. Analyze the data by using OpenSearch Dashboards.
C. Turn on VPC Flow Logs on the EC2 instances. Specify the default format and a log destination of Amazon CloudWatch Logs. Analyze the flow log data by using CloudWatch Logs Insights.
D. Turn on VPC Flow Logs on the EC2 instances. Specify a custom format and a log destination of Amazon S3. Analyze the flow log data by using Amazon Athena.
Show Answer
Correct Answer: A
Explanation: The requirement includes capturing the first 8 bytes of TCP payload. VPC Flow Logs (default or custom) record only flow metadata such as source/destination IPs, ports, protocol, bytes, and action; they do not capture packet payloads. VPC Traffic Mirroring provides packet-level copies of traffic, including payload, from supported ENIs on EC2 instances. NAT gateways cannot be configured as traffic mirror sources, so mirroring must be configured on the EC2 instance ENIs. The mirrored traffic can then be forwarded to CloudWatch Logs for analysis with Logs Insights.
Question 146
A company has critical VPC workloads that connect to an on-premises data center through two redundant active-passive AWS Direct Connect connections. However, a recent outage on one Direct Connect connection revealed that it takes more than a minute for traffic to fail over to the secondary Direct Connect connection. The company wants to reduce the failover time from minutes to seconds.
Which solution will provide the LARGEST reduction in the BGP failover time?
A. Reduce the BGP hold-down timer that is configured on the BGP sessions on the Direct Connect connection VIFs.
B. Configure an Amazon CloudWatch alarm for the Direct Connect connection state to invoke an AWS Lambda function to fail over the traffic.
C. Configure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the AWS side.
D. Configure Bidirectional Forwarding Detection (BFD) on the Direct Connect connections on the on-premises router.
Show Answer
Correct Answer: D
Explanation: The correct answer is D. AWS Direct Connect virtual interfaces have asynchronous BFD enabled on the AWS side by default, but it does not become operational until BFD is configured on the customer (on-premises) router. BFD provides rapid failure detection (typically sub-second to a few seconds), allowing BGP to tear down the session much faster than relying on the default BGP hold timer (~90 seconds). Option A can improve failover somewhat by lowering BGP timers, but it is less effective than BFD. Option C is incorrect because the AWS side cannot be configured by the customer; it is already enabled. Option B does not affect BGP convergence and would be slower and more complex.
Question 147
A team of infrastructure engineers wants to automate the deployment of Application Load Balancer (ALB) components by using the AWS Cloud Development Kit (AWS CDK). The CDK application must deploy an infrastructure stack that is reusable and consistent across multiple environments, AWS Regions, and AWS accounts.
The lead network architect on the project has already bootstrapped the target accounts. The lead network architect also has deployed core network components such as VPCs and Amazon Route 53 private hosted zones across the multiple environments and Regions. The infrastructure engineers must design the ALB components in the CDK application to use the existing core network components.
Which combination of steps will meet this requirement with the LEAST manual effort between environment deployments? (Choose two.)
A. Design the CDK application to read AWS CloudFormation parameters for the values that vary across environments and Regions. Reference these variables in the CDK stack for resources that require the variables.
B. Design the CDK application to read environment variables that contain account and Region details at runtime. Use these variables as properties of the CDK stack. Use context methods in the CDK stack to retrieve variable values.
C. Create a dedicated account for shared application services in the multi-account environment. Deploy a CDK pipeline to the dedicated account. Create stages in the pipeline that deploy the CDK application across different environments and Regions.
D. Write a script that automates the deployment of the CDK application across multiple environments and Regions. Distribute the script to engineers who are working on the project.
E. Use the CDK toolkit locally to deploy stacks to each environment and Region. Use the --context flag to pass in variables that the CDK application can reference at runtime.
Show Answer
Correct Answer: B, C
Explanation: Use environment variables and CDK context rather than CloudFormation parameters for values that vary by account and Region, because CDK is designed to synthesize with context/environment information. For repeatable multi-account and multi-Region deployments with minimal manual effort, a CDK Pipeline can orchestrate deployments across environments. CloudFormation parameters (A) are generally discouraged in CDK, local toolkit deployments (E) require repeated manual actions, and distributing a custom script (D) is more manual and less integrated than CDK Pipelines.
Question 148
A company has two AWS Direct Connect links. One Direct Connect link terminates in the us-east-1 Region, and the other Direct Connect link terminates in the af-south-1 Region. The company is using BGP to exchange routes with AWS.
How should a network engineer configure BGP to ensure that af-south-1 is used as a secondary link to AWS?
A. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 200 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 50
B. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 200 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 50
C. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 50 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 200
D. • On the Direct Connect link to us-east-1, configure BGP peering to use community tag 7224:7300 • On the Direct Connect link to af-south-1, configure BGP peering to use community tag 7224:7100 • On the Direct Connect BGP peer to us-east-1, set the local preference value to 50 • On the Direct Connect BGP peer to af-south-1, set the local preference value to 200
Show Answer
Correct Answer: B
Explanation: To make the us-east-1 Direct Connect the primary path and af-south-1 the secondary path, assign a higher local preference (200) to the us-east-1 BGP peer and a lower local preference (50) to the af-south-1 peer. For AWS Direct Connect inbound routing from AWS, use BGP communities so that the preferred primary Region advertises with the higher-preference community (7224:7300 for local Region preference) and the secondary Region uses the lower-preference community (7224:7100). This combination matches option B.
Question 149
A company is deploying AWS Cloud WAN with edge locations in the us-east-1 Region and the ap-southeast-2 Region. Individual AWS Cloud WAN segments are configured for the development environment, the production environment, and the shared services environment at each edge location. Many new VPCs will be deployed for the environments and will be configured as attachments to the AWS Cloud WAN core network.
The company's network team wants to ensure that VPC attachments are configured for the correct segment. The network team will tag the VPC attachments by using the Environment key with a value of the corresponding environment segment name. The segment for the production environment in us-east-1 must require acceptance for attachment requests. All other attachment requests must not require acceptance.
Which solution will meet these requirements?
A. Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag:Environment values to their respective segments.
B. Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag.Environment values to their respective segments.
C. Create a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1.
D. Create a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1.
Show Answer
Correct Answer: B
Explanation: Attachment policy rules are evaluated in order, so the specific exception must come before the general mapping rule. The acceptance requirement applies only to the Production segment in the us-east-1 Region, which requires both conditions to match (AND). A later rule can then map all Environment tag values to their corresponding segments without requiring acceptance. Using OR would incorrectly require acceptance for all production attachments in any Region or all attachments in us-east-1.
$19
Get all 291 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.