A global network service provider deploys managed AWS Direct Connect connections for its customers. The company wants to integrate monitoring for the connections into its existing ticketing system. The ticketing system runs in the company's VPC on multiple EC2 instances. The ticketing system uses a REST API.
The ticketing system must receive events with minimal latency. The company expects to receive an average of 1 event each day. The company wants to use its existing infrastructure as code (IaC) tooling to configure the monitoring integration solution.
Which solution will meet these requirements in the MOST cost-effective way?
A. Configure an Amazon EventBridge rule to send events to an AWS Lambda function. Configure the Lambda function to process the events and to send events to the ticketing system's REST API.
B. Configure a scheduled event in Amazon CloudWatch to run an AWS Lambda function once every minute. Configure the function to poll the AWS API to detect changes in the Direct Connect connection state. Configure the function to submit tickets to the ticketing system's REST API when the function detects state changes.
C. Write a script to poll the AWS API to detect changes in Direct Connect connection state and to submit tickets to the ticketing system's REST API. Deploy the script to the ticketing system's EC2 instance. Schedule the script to run once every minute by using the operating system configuration.
D. Configure an Amazon EventBridge rule to send events directly to an Amazon DynamoDB table. Use Amazon DynamoDB Streams to send the events to an AWS Lambda function. Configure the function to process the events and to send the events to the ticketing system's REST API.
Show Answer
Correct Answer: A
Explanation: AWS Direct Connect emits events that can be matched by Amazon EventBridge, enabling an event-driven integration with minimal latency. An EventBridge rule invoking AWS Lambda only when an event occurs is highly cost-effective for an average of one event per day. The Lambda function can call the existing REST API in the VPC (with appropriate networking if needed), and EventBridge/Lambda resources are easily managed with infrastructure as code. The polling approaches incur unnecessary recurring execution, and the DynamoDB/Streams design adds needless components and cost.
Question 12
A network engineer maintains a company's AWS infrastructure. The network engineer used AWS Transit Gateway to set up a hub and spoke architecture. The network engineer created a shared services VPC to centralize access to interface VPC endpoints.
The company uses AWS Organizations to manage AWS accounts for multiple teams in a single organization. Each team in the company has a separate account and VPC. All the team accounts require access to the interface VPC endpoints.
The network engineer needs a solution to grant each account the minimum required access. Each team's account must have access only to a list of authorized interface VPC endpoints. The solution must have minimal effect on the current architecture.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a separate shared services VPC for each team account. Include the interface VPC endpoints that the team is authorized to use in each VPC. Use a unique transit gateway route table to connect each team's spoke VPC to the team's shared services VPC.
B. Apply security groups to the interface VPC endpoints that are in the shared services VPC. Configure each security group to allow only the CIDR block of the team spoke VPCs that are authorized to use the endpoints included in the security group.
C. Create a unique interface VPC endpoint for each team that is authorized to access a service. Update routing for the shared services VPC so that the CIDR block for each team can access only the set of endpoints the team is authorized to access.
D. Associate an endpoint policy with each interface VPC endpoint. In each policy, deny all the traffic except for traffic from accounts that are authorized to access the corresponding service.
Show Answer
Correct Answer: D
Explanation: Interface VPC endpoints support endpoint policies, which are resource-based policies that control which IAM principals and AWS accounts can use the endpoint to access the associated AWS service. In a centralized shared-services VPC, attaching an appropriate endpoint policy to each interface endpoint allows only authorized team accounts to use specific endpoints without changing the Transit Gateway topology or creating duplicate VPCs/endpoints. Security groups filter by network source, not AWS account authorization, and duplicating VPCs or endpoints increases operational overhead.
Question 13
A company is setting up an AWS Direct Connect connection between the company's on-premises data center and AWS. The company currently has a single VPC in its AWS account. The on-premises data center uses the 172.16.0.0/16 CIDR block, and the VPC uses the 10.1.1.0/24 CIDR block. The company associates the Direct Connect connection to one private VIF.
A network engineer receives reports that SSH communication from hosts that are in the company's on-premises data center to Amazon EC2 instances that are deployed in the company's VPC is failing. The network engineer investigates and finds that the VIF is up and a BGP peering session has been established properly.
Which steps should the engineer take to troubleshoot this issue? (Choose three.)
A. Ensure that the advertised route for the on-premises network is present in the VPC route tables. Ensure that the VPC's subnets are present in the route tables of the on-premises network equipment.
B. Ensure that BGP community tags announcements from the customer gateway router are configured properly.
C. Ensure that the customer gateway router accepts BGP community tags in the prefixes the router receives.
D. Ensure that the VPC network ACLs allow inbound and outbound traffic for the on-premises network prefix.
E. Ensure that the security groups for the EC2 instances allow inbound SSH communication from the on-premises network prefix.
F. Ensure that the security groups for the EC2 instances allow outbound SSH communication from the on-premises network prefix.
Show Answer
Correct Answer: A, D, E
Explanation: Because the Direct Connect private VIF and BGP session are already established, focus on end-to-end connectivity: verify routing in both directions so each network has routes to the other, verify the VPC subnet network ACLs permit the traffic (NACLs are stateless and require appropriate inbound and outbound rules), and verify the EC2 security groups allow inbound TCP port 22 from the on-premises CIDR. BGP community tags are not required for basic connectivity troubleshooting in this scenario, and security groups are stateful so a separate outbound SSH rule is not needed for return traffic.
Question 14
A gaming company operates in one AWS Region. The company's architecture includes an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group that support a frontend application. The company uses AWS WAF integrated with the ALB. The ALB has one security group attached to it. The company uses AWS Network Firewall with stateful rules. The company has set up Network ACLs.
The company wants to automatically block access for game users who violate specific rules. The company wants to temporarily block access for problematic users for 1 to 2 hours. The company's software can identify the source IP addresses of problematic users. The company has created a serverless solution to store the IP addresses in Amazon DynamoDB.
The company wants to use its existing serverless architecture to automatically block the problematic users.
Which solution will meet these requirements in the MOST scalable way? (Choose two.)
A. Create a new AWS WAF IP set that the serverless solution updates. Introduce an AWS WAF deny rule to block traffic from any address in the IP set.
B. Configure the serverless solution to modify the network ACLs to block traffic from the IP addresses of the problematic users.
C. Configure the serverless solution to modify the ALB security group to block traffic from the IP addresses of the problematic users.
D. Create a new AWS WAF IP set that is updated by the serverless solution. Create an AWS WAF rule to redirect traffic from sources that match the IP set to a new API for the serverless solution.
E. Create an AWS Network Firewall stateless rule to drop traffic from the IP addresses of the problematic users. Configure the serverless solution to update the new rule with the IP addresses of the problematic users.
Show Answer
Correct Answer: A, E
Explanation: AWS WAF IP sets are purpose-built for dynamically blocking specific source IP addresses and integrate directly with the existing ALB and WAF deployment. A serverless application can efficiently update the IP set as users are identified. For network-layer blocking at scale, AWS Network Firewall stateless rules can be updated programmatically to drop traffic from listed source IPs. Modifying network ACLs or security groups is not scalable for frequently changing IP lists, and redirecting blocked users to an API does not satisfy the requirement to block access.
Question 15
A company has a hybrid environment. The company uses AWS Direct Connect with a transit VIF attached to a transit gateway to connect its on-premises location to the AWS Cloud. The company operates from a single AWS account in the us-east-1 Region. The company has a legacy application that runs on premises with the corp.example.com DNS name. The company has created an Amazon Route 53 Resolver outbound endpoint and a Resolver rule in us-east-1 in the AWS account.
As part of an expansion, the company creates one more AWS account for a new business unit that operates in us-east-1. The new account has VPCs that are attached to the transit gateway. The new account uses the existing Direct Connect connection to connect to the on-premises location. Applications that run in the new account's VPCs also need to access the on-premises location by using the corp.example.com DNS name.
A network engineer needs to identify a solution to resolve the corp.example.com DNS name from the new account.
Which solution will meet these requirements MOST cost-effectively?
A. Create a hosted transit VIF for the new account on the existing Direct Connect connection. In the new account, create a new Route 53 Resolver outbound endpoint. Also in the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the new rule with the VPCs in the new account.
B. Share the Resolver rule from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). Associate the shared rule with the VPCs in the new account.
C. Share the Route 53 Resolver outbound endpoint from the existing account with the new account by using AWS Resource Access Manager (AWS RAM). In the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the new rule with the VPCs in the new account.
D. Create an AWS Site-to-Site VPN connection between the new account and the on-premises location. Attach the Site-to-Site VPN connection to the existing transit gateway. In the new account, create a new Route 53 Resolver outbound endpoint. Also in the new account, create a new Resolver rule that specifies FORWARD as the value for RuleType. Associate the rule with the VPCs in the new account.
Show Answer
Correct Answer: B
Explanation: Route 53 Resolver forwarding rules can be shared across AWS accounts by using AWS Resource Access Manager (AWS RAM). The shared rule continues to use the outbound Resolver endpoint in the owning account, so there is no need to create additional outbound endpoints, Direct Connect virtual interfaces, or VPNs. After the rule is shared, it can be associated with VPCs in the new account, making this the most cost-effective solution.
Question 16
A company is using AWS Fargate to deploy many containerized web applications to a VPC. The applications must all be reachable through various DNS names on the standard port for HTTPS traffic. The company uses an Application Load Balancer (ALB) to handle traffic to each of the applications.
The company uses the AWS Cloud Development Kit (AWS CDK) to automate the deployment process. The company uses two types of CDK stacks. The company uses one common stack to build the VPC itself and other shared infrastructure. The company also uses a set of application-specific stacks that contain details and logic for each application.
The company needs to correctly allocate ALB-related resources between the two types of stacks.
Which combination of solutions will provide a repeatable allocation of resources to the common stack and application-specific stacks? (Choose three.)
A. ALB listener in the common stack
B. ALB listener in the application-specific stacks
C. ALB listener host header rule in the common stack
D. ALB listener host header rule in the application-specific stacks
E. ALB target group in the common stack
F. ALB target group in the application-specific stacks
Show Answer
Correct Answer: A, D, F
Explanation: Place shared ALB infrastructure in the common stack: the HTTPS listener is shared by all applications. Each application stack should define its own target group for its Fargate service and its own host-header listener rule that maps the application's DNS name to that target group. This cleanly separates shared infrastructure from application-specific routing and backend configuration.
Question 17
A company has many VPCs in the us-east-1 Region. The company uses a transit gateway to connect the VPCs to one another. The company recently acquired a smaller company that has a single VPC named VPC-Z.
A network engineer needs to onboard VPC-Z to the existing transit gateway. The network engineer notices an IP address overlap between VPC-Z and VPC-A. The network engineer must establish outbound connectivity from VPC-Z to all the company's other VPCs, including VPC-A.
Which combination of solutions will meet this requirement? (Choose two.)
A. Create a new non-overlapping CIDR block in VPC-Z. Create two subnets that use the new CIDR block.
B. Create a new non-overlapping CIDR block in VPC-A. Create two subnets that use the new CIDR block.
C. Create a private NAT gateway in VPC-Z in a non-overlapping subnet. Advertise only the non-overlapping VPC-Z CIDR block to the transit gateway route table.
D. Create a private NAT gateway in VPC-A in a non-overlapping subnet. Advertise only the non-overlapping VPC-A CIDR block to the transit gateway route table.
E. Create a VPC peering connection between VPC-A and VPC-Z.
Show Answer
Correct Answer: A, C
Explanation: Transit Gateway cannot route between overlapping CIDR ranges. Add a new non-overlapping secondary CIDR to VPC-Z and create subnets in that range. Deploy a private NAT gateway in a subnet from the non-overlapping range so traffic originating from overlapping addresses in VPC-Z is translated to a non-overlapping source before traversing the transit gateway. Advertise only the non-overlapping CIDR to the transit gateway, enabling outbound connectivity from VPC-Z to all other VPCs, including VPC-A.
Question 18
A company has several application accounts that include dual-stack VPCs. The company wants to implement a centralized DNS solution that supports IPv6.
A network engineer deploys a shared services VPC. The network engineer sets up network connectivity between the company's application VPCs, the shared services VPC, and the company's on-premises environment with support for IPv4 and IPv6 traffic.
The network engineer is using Amazon Route 53 to implement a centralized DNS solution. The network engineer needs to ensure that resources in the application VPCs have the ability to perform DNS queries against an on-premises DNS resolver.
Which solution will meet this requirement?
A. Create a Route 53 Resolver outbound endpoint in the shared services VPC within a dual-stack subnet. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts.
B. Create a Route 53 Resolver inbound endpoint in the shared services VPC within a subnet that supports only IPv6. Use AWS Resource Access Manager (AWS RAM) to share the endpoint to the application accounts.
C. Create a Route 53 Resolver outbound endpoint within a dual-stack subnet in each application VPUse AWS Resource Access Manager (AWS RAM) to share the resolver rules to the application accounts.
D. Create a Route 53 Resolver inbound endpoint within a subnet that supports only IPv4 in each application VPC. Use AWS Resource Access Manager (AWS RAM) to share the resolver rules to the shared services account.
Show Answer
Correct Answer: A
Explanation: Resources in VPCs that need to query an on-premises DNS resolver require a Route 53 Resolver outbound endpoint plus forwarding rules. To centralize the design, deploy the outbound endpoint in the shared services VPC using dual-stack subnets so it supports IPv4 and IPv6, create forwarding rules for the on-premises DNS servers, and share those resolver rules with the application accounts by using AWS RAM. Inbound endpoints are for receiving DNS queries into Route 53 Resolver from external networks, not for forwarding VPC queries to on-premises DNS. Deploying outbound endpoints in every application VPC is unnecessary for a centralized architecture.
Question 19
A company needs to connect its on-premises network to a VPC in the us-east-1 Region. The connection must support a maximum transmission unit (MTU) of 9,000 bytes and must be highly available.
Which solution will meet these requirements MOST cost-effectively?
A. Use AWS Site-to-Site VPN to create two VPNs. Use two connections to two virtual private gateways that are in the same VPC.
B. Use AWS Site-to-Site VPN to create two VPNs. Use two connections to a single transit gateway that has a VPC attachment.
C. Create a multi-site, nonredundant AWS Direct Connect deployment. Use two Direct Connect connections to two separate Direct Connect locations.
D. Create a multi-site, redundant AWS Direct Connect deployment. Use two Direct Connect connections to one Direct Connect location and two connections to a second Direct Connect location.
Show Answer
Correct Answer: C
Explanation: The requirement for a 9,000-byte MTU eliminates Site-to-Site VPN because VPN supports only standard MTU, not jumbo frames. Direct Connect supports jumbo frames. Option C provides two Direct Connect connections at two separate Direct Connect locations, giving a multi-site design for high availability while using only two connections, making it more cost-effective than the fully redundant four-connection design in option D. Although D offers higher resilience, the question asks for the most cost-effective solution that still meets the stated high-availability requirement.
Sources:
https://aws.amazon.com/blogs/apn/amazon-vpc-for-on-premises-network-engineers-part-one
https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/transit-gateway.html
Question 20
A company has multiple firewalls and ISPs for its on-premises data center. The company has a single AWS Site-to-Site VPN connection from the company's on-premises data center to a transit gateway. A single ISP services the Site-to-Site VPN connection. Multiple VPCs are attached to the transit gateway.
A customer gateway that the Site-to-Site VPN connection uses fails. Connectivity is completely lost, but the company's network team does not receive a notification.
The network team needs to implement redundancy within a week in case a single customer gateway fails again. The team wants to use an Amazon CloudWatch alarm to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic if any tunnel of the Site-to-Site VPN connection fails.
Which solution will meet these requirements MOST cost-effectively?
A. Replace the existing customer gateway with a new router. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of 0 for the alarm.
B. Use a second customer gateway and a second ISP. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of less than 1 for the alarm.
C. Add an AWS Direct Connect connection to the existing Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of failed for the alarm.
D. Use a second customer gateway with the existing ISP. Create a new Site-to-Site VPN connection to the transit gateway. For each VPN connection, set up a CloudWatch TunnelState alarm for the VPN connection. Use a value of unavailable for the alarm.
Show Answer
Correct Answer: B
Explanation: To provide redundancy against a single customer gateway failure, deploy a second customer gateway and terminate a second Site-to-Site VPN connection on it. Using a second ISP also removes the existing ISP as a single point of failure, providing the required resilience. Configure CloudWatch alarms on the TunnelState metric so an alarm triggers when the connection-level TunnelState drops below 1, indicating that at least one tunnel is down, and notify through Amazon SNS. This is more appropriate than replacing the existing gateway, using the same ISP, or adding Direct Connect, which is significantly more expensive.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.