A logistics company has multiple VPCs in an AWS Region. The company uses a transit gateway to connect the VPCs. The company has several on-premises offices that connect to the transit gateway by using AWS Site-to-Site VPN connections over the internet. The company has configured one transit gateway VPN attachment for each office.
Route propagation is enabled on all route tables. Each Site-to-Site VPN connection uses two tunnels in an active-passive configuration. The company configured each office with appropriate static routes on both the Site-to-Site VPN connection and the office’s customer gateway.
The company wants to use both IPsec tunnels of every office to maximize the overall VPN connection bandwidth.
Which design changes are necessary to meet these requirements?
A. Create an AWS Transit Gateway Connect attachment for each office Use the existing VPN attachments as the transport for the new Connect attachments. Set up a Generic Routing Encapsulation (GRE) tunnel on each customer gateway that terminates on the Connect attachment for each office. Move the static routes from the transit gateway VPN attachment to the customer gateway for the transit gateway Connect attachment.
B. Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Enable ECMP on the Site-to-Site VPN connection. Ensure static routes on the customer gateways have equal metrics and administrative distance.
C. Enable equal-cost multi-path (ECMP) routing on the transit gateway. (Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Remove related static routes from the customer gateways.
D. Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Ensure the customer gateway applies the correct community strings to give the transit gateway the ability to perform ECMP forwarding.
Show Answer
Correct Answer: C
Explanation: With static routing, AWS Site-to-Site VPN uses an active-passive tunnel model, so only one tunnel forwards traffic at a time. To utilize both IPsec tunnels simultaneously and increase aggregate bandwidth, the design must use BGP with equal-cost multi-path (ECMP). Enabling ECMP on the transit gateway and customer gateways and switching from static routes to BGP allows the transit gateway to load-balance traffic across both tunnels. No special community strings are required for ECMP with AWS Transit Gateway.
Question 13
A company is migrating its internet VPN connections to dedicated AWS Direct Connect connections. The company needs to set up the Direct Connect connections so that all network communications are encrypted in transit.
Which combination of steps will meet this requirement? (Choose three.)
A. Create new Direct Connect connections while requesting MACsec ports.
B. Create a MACsec Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair. Associate the pair with each new connection.
C. Update the on-premises routers to use MACsec and the shared Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair.
D. Create a shared key for an IPsec connection.
E. Configure a new Direct Connect gateway. Associate the shared key with the new Direct Connect gateway.
F. Set up IPsec on the on-premises router. Associate the shared key with the IPsec configuration.
Show Answer
Correct Answer: A, B, C
Explanation: To encrypt traffic in transit over AWS Direct Connect, MACsec must be used. This requires ordering Direct Connect ports that support MACsec, creating and associating a MACsec Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) with each connection, and configuring the on‑premises routers to use MACsec with the same shared CKN/CAK. IPsec options are not used directly with Direct Connect links themselves.
Question 14
A company runs a workload in a single VPC on AWS. The company’s architecture contains several interface VPC endpoints for AWS services, including Amazon CloudWatch Logs and AWS Key Management Service (AWS KMS). The endpoints are configured to use a shared security group. The security group is not used for any other workloads or resources.
After a security review of the environment, the company determined that the shared security group is more permissive than necessary. The company wants to make the rules associated with the security group more restrictive. The changes to the security group rules must not prevent the resources in the VPC from using AWS services through interface VPC endpoints. The changes must prevent unnecessary access.
The security group currently uses the following rules:
• Inbound - Rule 1
Protocol: TCP -
Port: 443 -
Source: 0.0.0.0/0 -
• Inbound - Rule 2
Protocol: TCP -
Port: 443 -
Source: VPC CIDR -
• Outbound - Rule 1
Protocol: All -
Port: All -
Destination: 0.0.0.0/0 -
Which rule or rules should the company remove to meet with these requirements?
A. Outbound - Rule 2
B. Inbound - Rule 1 and Outbound - Rule 1
C. Inbound - Rule 2 and Outbound - Rule 1
D. Outbound - Rule 1
Show Answer
Correct Answer: B
Explanation: Interface VPC endpoints should accept HTTPS traffic only from resources within the VPC. The inbound rule allowing 0.0.0.0/0 on port 443 is overly permissive and unnecessary because the VPC CIDR rule already allows required access. Security groups are stateful, so responses to initiated connections are automatically allowed; therefore, a broad outbound rule to 0.0.0.0/0 is not required for endpoint usage. Removing Inbound Rule 1 and Outbound Rule 1 makes the security group more restrictive without breaking access to AWS services through the interface endpoints.
Question 15
A company uses transit gateways to route traffic between the company's VPCs. Each transit gateway has a single route table. Each route table contains attachments and routes for the VPCs that are in the same AWS Region as the transit gateway. The route tables in each VPC also contain routes to all the other VPC CIDR ranges that are available through the transit gateways. Some VPCs route to local NAT gateways.
The company plans to add many new VPCs soon. A network engineer needs a solution to add new VPC CIDR ranges to the route tables in each VPC.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Create a new customer-managed prefix list. Add all VPC CIDR ranges to the new prefix list. Update the route tables in each VPC to use the new prefix list ID as the destination and the appropriate transit gateway ID as the target.
B. Turn on default route table propagation for the transit gateway route tables. Turn on route propagation for each route table in each VPC.
C. Update the route tables in each VPC to use 0.0.0.010 as the destination and the appropriate transit gateway ID as the target.
D. Turn on default route table association for the transit gateway route tables. Turn on route propagation for each route table in each VPC.
Show Answer
Correct Answer: A
Explanation: Using a customer-managed prefix list allows all VPC CIDR ranges to be referenced by a single object in each VPC route table. When new VPCs are added, only the prefix list needs to be updated, and all associated routes automatically apply, minimizing ongoing route table changes. Transit gateway route propagation does not populate VPC route tables, and using a default route (0.0.0.0/0) would be incorrect or disruptive.
Question 16
A company has several AWS Site-to-Site VPN connections between an on-premises customer gateway and a transit gateway. The company's application uses IPv4 to communicate through the VPN connections.
The company has updated the VPC to be dual stack and wants to transition to using IPv6-only for new workloads. When the company tries to communicate through the existing VPN connections, IPv6 traffic fails.
Which solution will provide IPv6 support with the LEAST operational overhead?
A. Create a new Site-to-Site VPN connection that supports IPv6.
B. Create a new Site-to-Site VPN connection to a self-managed Amazon EC2 instance that runs open source software.
C. Update the existing Site-to-Site VPN connections to support IPv6.
D. Update the on-premises customer gateway's public IP address from IPv4 to IPv6.
Show Answer
Correct Answer: A
Explanation: Existing AWS Site-to-Site VPN connections that were created for IPv4 cannot be upgraded in place to carry IPv6 traffic. To use IPv6, the VPN connection must be created with IPv6 support from the start. Creating a new Site-to-Site VPN connection that supports IPv6 is a managed AWS solution and requires minimal operational effort compared to running self-managed VPN software or redesigning on-premises addressing. Updating the customer gateway IP to IPv6 or modifying existing VPNs is not supported.
Question 17
A company hosts a highly available, scalable, and resilient application on Amazon EC2 instances that are part of an Auto Scaling group. A network engineer is planning to integrate IPv6 support with the application deployment in phases. The first phase is to enable IPv6 service consumption on the public Network Load Balancers (NLBs) that are deployed across the infrastructure. The target groups for the NLBS are configured as the Auto Scaling groups of the EC2 instances that host the application. The NLBs are configured for dual-stack operation.
During the testing of the first phase, the IPv6 application queries are not reaching the backend servers.
What is the cause of this issue?
A. The subnets where the EC2 instances are deployed do not have IPv6 addresses configured.
B. The route tables for the NLB subnets do not have IPV6 routing configured.
C. The route tables for the EC2 subnets do not have IPV6 routing configured.
D. The security groups that are associated with the NLBs do not allow IPv6 traffic.
Show Answer
Correct Answer: A
Explanation: For a dual-stack Network Load Balancer to successfully forward IPv6 traffic to its targets, the backend EC2 instances must be able to receive IPv6 traffic. That requires the EC2 subnets to be IPv6-enabled and the instances to have IPv6 addresses assigned. In this scenario, only the NLBs were enabled for IPv6 in the first phase, while the EC2 subnets and instances were not configured for IPv6, so IPv6 requests terminate at the NLB and cannot be delivered to the targets. NLBs do not use security groups, and IPv6 routing on NLB subnets alone does not solve the absence of IPv6 addressing on the target instances.
Question 18
A global company is establishing network connections between the company's primary and secondary data centers and a VPC. A network engineer needs to maximize resiliency and fault tolerance for the connections. The network bandwidth must be greater than 10 Gbps.
Which solution will meet these requirements MOST cost-effectively?
A. Set up a 100 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up a second 100 Gbps connection at the secondary data center that terminates at a second Direct Connect location. Ensure the connections are managed by separate providers.
B. Set up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up a second 10 Gbps connection at the secondary data center that terminates at a second Direct Connect location. Ensure the connections are managed by separate providers.
C. Set up two 10 Gbps connections at the primary data center that terminate at one AWS Direct Connect location. Ensure the connections are managed by separate providers. Set up two 10 Gbps connections at the secondary data center that terminate at a second Direct Connect location. Ensure the connections are managed by separate providers.
D. Set up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up an AWS Site-to-Site VPN connection at the secondary data center that terminates at a virtual private gateway in the same Region as the company’s VPC.
Show Answer
Correct Answer: C
Explanation: The requirement is >10 Gbps bandwidth with maximum resiliency and fault tolerance at the lowest cost. Option C provides aggregated bandwidth greater than 10 Gbps by using multiple 10 Gbps Direct Connect links, while also following AWS resiliency best practices: redundant connections per data center, separate Direct Connect locations, and separate providers. This delivers high availability and fault tolerance without the high cost of 100 Gbps ports. Option B does not exceed 10 Gbps per site, and option A is significantly more expensive than necessary.
Question 19
A company deployed an application in two AWS Regions in one AWS account. The company has one VPC in each Region. The VPCs use non-overlapping private CIDR ranges.
The company needs to connect both VPCs to a single on-premises data center to test the application. The application requires up to 800 Mbps of throughput. A network engineer needs to establish connectivity between the VPCs and the on-premises data center.
Which solution will meet this requirement with the LEAST operational overhead?
A. Order a 2 Gbps Direct Connect connection for the data center. Configure a virtual private gateway in each VPC. Create a private VIF for each virtual private gateway, and associate the virtual private gateways with the Direct Connect connection. Configure static routes in the VPC route tables and in the data center router.
B. Order a 2 Gbps Direct Connect connection for the data center. Configure a virtual private gateway in each VPC. Create a private VIF for each virtual private gateway, and associate the virtual private gateways with the Direct Connect connection. Configure Open Shortest Path First (OSPF) routing between the private VIF and the data center.
C. Configure a customer gateway and a virtual private gateway in each VPConfigure an AWS Site-to-Site VPN connection between the data center and each VPConfigure static routes in each VPC route table to point to the subnets in the data center.
D. Configure a customer gateway and a virtual private gateway in each VPC. Configure an AWS Site-to-Site VPN connection between the data center and each VPC. Configure BGP routing between the VPCs and the data center.
Show Answer
Correct Answer: D
Explanation: The requirement is temporary/testing connectivity with up to 800 Mbps and the least operational overhead. AWS Site-to-Site VPN is faster and simpler to deploy than Direct Connect, which requires ordering and provisioning physical circuits. Using BGP with the VPN enables automatic route exchange and failover, reducing ongoing manual route management compared to static routes. With accelerated VPN and ECMP, Site-to-Site VPN can support up to ~1.25 Gbps, which meets the 800 Mbps requirement. Therefore, option D provides sufficient throughput with the lowest operational overhead.
Question 20
A company has multiple VPCs with subnets that use IPv4. Traffic from the VPCs to the internet uses a NAT gateway. The company wants to transition to IPv6.
A network engineer creates multiple IPv6-only subnets in an existing testing VPC. The network engineer deploys a new Amazon EC2 instance that has an IPv6 address into one of the subnets. During testing, the network engineer discovers that the new EC2 instance is not able to communicate with an IPv4-only service through the internet. The network engineer needs to enable the IPv6 EC2 instance to communicate with the IPv4-only service.
Which solution will meet this requirement?
A. Enable DNS64 for the IPv6-only subnets. Update the route tables for the IPv6-only subnets to send traffic through the NAT gateway.
B. Enable NAT64 for the testing VPC. Reconfigure the existing NAT gateway to support IPv6.
C. Enable DNS64 for the new EC2 instance. Create a new egress-only internet gateway that supports IPv6.
D. Enable NAT64 for each route table. Create a new NAT gateway that supports both IPv4 and IPv6.
Show Answer
Correct Answer: A
Explanation: An IPv6-only EC2 instance cannot directly reach IPv4-only services. In AWS, this is achieved by using NAT64 for traffic translation and DNS64 for name resolution. AWS NAT gateways already provide NAT64 functionality when used by IPv6-only subnets, but DNS64 must be explicitly enabled at the subnet level so that IPv4-only DNS records are synthesized into IPv6 addresses. Updating the route tables to send traffic to the existing NAT gateway enables the IPv6 instance to reach IPv4-only internet services.
Question 21
A company has a transit gateway in a single AWS account. The company sends flow logs for the transit gateway to an Amazon CloudWatch Logs log group.
The company created an AWS Lambda function to analyze the logs. The Lambda function sends a notification to an Amazon Simple Notification Service (Amazon SNS) topic when a VPC generates traffic that is dropped by the transit gateway. Each notification contains the account ID. VPC ID, and total amount of dropped packets.
The company wants to subscribe a new Lambda function to the SNS topic. The new Lambda function must automatically prevent the traffic that is identified in each notification from leaving a VPC by applying a network ACL to the transit gateway attachment subnets in the VPC that generates the traffic.
Which solution will meet these requirements?
A. Configure the existing Lambda function to add the destination IP addresses of the dropped traffic to each SNS notification. Configure the new Lambda function to create an outbound rule by using the destination IP addresses in the network ACL.
B. Configure the existing Lambda function to add the source IP addresses of the dropped traffic to each SNS notification. Configure the new Lambda function to create an inbound rule by using the source IP addresses in the network ACL.
C. Configure the existing Lambda function to add the source IP addresses of the dropped traffic to each SNS notification. Configure the new Lambda function to create an outbound rule by using the source IP addresses in the network ACL.
D. Configure the existing Lambda function to add the destination IP addresses of the dropped traffic to each SNS notification. Configure the new Lambda function to create an inbound rule by using the destination IP addresses in the network ACL.
Show Answer
Correct Answer: A
Explanation: To prevent traffic from leaving the VPC, the control must be applied with an outbound network ACL rule on the transit gateway attachment subnets. Outbound NACL rules match on destination CIDR (not source), so the existing Lambda must include the destination IP addresses of the dropped traffic in the SNS notification. The new Lambda can then create outbound deny rules using those destination IPs, effectively blocking the identified traffic from exiting the VPC.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.