A company is establishing hybrid cloud connectivity from an on-premises environment to AWS in the us-east-1 Region. The company is using a 10 Gbps AWS Direct Connect dedicated connection. The company has two accounts in AWS. Account A has transit gateways in four AWS Regions. Account В has transit gateways in three Regions. The company does not plan to expand.
To meet security requirements the company's accounts must have separate cloud infrastructure.
Which solution will meet these requirements MOST cost-effectively?
A. Create one Direct Connect gateway in us-east-1. Use AWS Resource Access Manager (AWS RAM) to share the Direct Connect gateway with each account. Create a transit VIF for Account Associate the four transit gateways in Account A to the Direct Connect gateway. Create a transit VIF for Account B. Associate the three transit gateways in Account В to the Direct Connect gateway.
B. Create one Direct Connect gateway in us-east-1 for Account A. Create a second Direct Connect gateway in us-east-1 for Account Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway in Account A. Create a transit VIF for Account Associate the three transit gateways in Account В to the Direct Connect gateway in Account В.
C. Create one Direct Connect gateway in us-east-1. Use AWS Resource Access Manager (AWS RAM) to share the Direct Connect gateway with each account. Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway. Order a new 10 Gbps Direct Connect dedicated connection for Account B. Create a transit VIF on the new Direct Connect connection for Account B. Associate the three transit gateways in Account В to the Direct Connect gateway.
D. Create one Direct Connect gateway in us-east-1 for Account A. Create a second Direct Connect gateway in us-east-1 for Account B. Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway in Account A. Order a new 10 Gbps Direct Connect dedicated connection for Account В. Create a transit VIF on the new Direct Connect connection for Account В. Associate the three transit gateways in Account В to the Direct Connect gateway in Account В.
Show Answer
Correct Answer: B
Explanation: A single Direct Connect gateway can associate with a limited number of transit gateways. The design requires associations to 7 transit gateways (4 in Account A and 3 in Account B), which exceeds the Direct Connect gateway association limit. Creating one Direct Connect gateway per account allows all required transit gateway associations while still using the existing single 10 Gbps dedicated Direct Connect connection with separate transit VIFs, avoiding the cost of a second physical connection. This satisfies the requirement for separate account infrastructure at the lowest cost.
Question 22
A company has two AWS Direct Connect connections between Direct Connect locations and the company's on-premises environment in the US. The company uses the connections to communicate with AWS workloads that run in the us-east-1 Region. The company has a transit gateway that connects several VPCs. The Direct Connect connections terminate at a Direct Connect gateway and the transit VIFs to the transit gateway.
The company recently acquired a smaller company that is based in Europe. The newly acquired company has only on-premises workloads. The newly acquired company does not expect to run workloads on AWS for the next 3 years. However, the newly acquired company requires connectivity to the parent company's AWS resources in us-east-1 and to the parent company's on-premises environment in the US. The parent company wants to use two new Direct Connect connections in Europe to provide the required connectivity.
Which solution will meet these requirements with the LEAST operational overhead for the newly acquired company?
A. Associate new transit VIFs to the existing Direct Connect gateway. Configure the new transit VIFs to use Direct Connect SiteLink.
B. Associate new transit VIFs to a new Direct Connect gateway and to a new transit gateway in the eu-west-1 Region. Use transit gateway peering to connect the transit gateways.
C. Associate new private VIFs to the existing Direct Connect gateway. Configure the existing transit VIFs and the new private VIFs to use Direct Connect SiteLink.
D. Associate new private VIFs to a new Direct Connect gateway and to a new VPC in us-east-1. Configure the existing transit VIFs and the new private VIFs to use Direct Connect SiteLink and AWS PrivateLink endpoints in the new VPC.
Show Answer
Correct Answer: A
Explanation: Direct Connect SiteLink can provide private connectivity between on-premises sites over the AWS global network. By adding the new European Direct Connect connections as transit VIFs to the existing Direct Connect gateway and enabling SiteLink, the European site gains connectivity both to the existing US on-premises environment and to the AWS transit gateway-connected VPCs in us-east-1 without deploying an additional transit gateway, VPC, or Direct Connect gateway. This minimizes operational overhead.
Question 23
A company wants to analyze TCP internet traffic. The traffic originates from Amazon EC2 instances in the company’s VPC. The EC2 instances initiate connections through a NAT gateway.
The company wants to capture data about the traffic including source and destination IP addresses ports, and the first 8 bytes of the TCP segments of the traffic. The company needs to collect, store, and analyze all the required data points.
Which solution will meet these requirements?
A. Configure the EC2 instances to be VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights
B. Configure the NAT gateway to be a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon S3 bucket. Analyze the data by using Amazon Athena.
C. Turn on VPC Flow Logs for the EC2 instances. Specify the default format and set Amazon CloudWatch Logs as the log destination. Analyze the flow log data by using CloudWatch Logs Insights.
D. Turn on VPC Flow Logs for the EC2 instances. Specify a custom format and set Amazon S3 as the log destination. Analyze the flow log data by using Amazon Athena.
Show Answer
Correct Answer: A
Explanation: The requirement to capture the first 8 bytes of TCP segments requires packet-level visibility, which VPC Flow Logs cannot provide. VPC Traffic Mirroring can mirror traffic from EC2 instance ENIs, but NAT gateways cannot be traffic mirror sources. Although the logging/analysis pipeline in the option is not an ideal representation of raw packet analysis, it is the only choice built on a supported mechanism that can capture the required packet data. Therefore A is the best available answer.
Question 24
A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establish connectivity between an on-premises environment and the AWS environment. The company does not have a static public IP address for the on-premises environment.
Which combination of steps should the company take to establish VPN connectivity between the transit gateway and the on-premises environment? (Choose two.)
A. Create a public certificate in AWS Certificate Manager (ACM).
B. Create a private certificate in AWS Certificate Manager (ACM).
C. Configure the Site-to-Site VPN tunnels to use the pre-shared key (PSK).
D. Create a customer gateway. Specify the current dynamic IP address of the customer gateway device's external interface.
E. Create a customer gateway. Do not specify the IP address of the customer gateway device.
Show Answer
Correct Answer: B, E
Explanation: Certificate-based AWS Site-to-Site VPN uses an AWS Certificate Manager Private CA-issued/private certificate for authentication rather than a pre-shared key. For peers with a dynamic public IP address, AWS supports creating a customer gateway without specifying the outside IP address, enabling certificate-based VPN with dynamic endpoint addressing. A public ACM certificate is not used for VPN authentication, and PSKs apply to PSK-based VPNs, not certificate-based authentication.
Question 25
A company has two teams: Team A and Team B. Team A has VPCs that run in Account A. The team uses a transit gateway (TGW-A) to route traffic between workloads that run in the different VPCs. Similarly, Team В has VPCs that run in Account B. Team В uses a different transit gateway (TGW-B) to route traffic between workloads that run in the different VPCs.
The company's network team manages the routing for Team A and Team В. The network team wants to retire TGW-B and use a single transit gateway to manage routing for the VPCs of both teams.
Which solution will meet this requirement with the LEAST operational overhead?
A. Create a resource share for TGW-A Share TGW-A with Account B. Create VPC attachments for the VPCs in Account В. Configure routing for the VPCs in TGW-A route tables. Update the route tables of the VPCs in Account В to forward traffic to TGW-Delete TGW-B attachments and TGW-B.
B. Create a resource share for TGW-A. Share TGW-A with Account В. Replicate the TGW-B configuration to TGW-A to automatically start routing changes for the VPCs in Account В. Delete TGW-B when routing changes are complete.
C. Create a new transit gateway (TGW-C) in Account A. Create a resource share for TGW-Share TGW-C with Account B. Create VPC attachments for the VPCs in Account A and Account В. Configure routing for all the VPCs in TGW-C route tables. Update the route tables for the VPCs in Account A and Account В to forward traffic to TGW-Delete TGW-A attachments and TGW-B attachments. Delete TGW-A and TGW-B.
D. Create a new transit gateway (TGW-C) in a new account (Account C). Create a resource share for TGW-C. Share TGW-C with Account A and Account B. Create VPC attachments for the VPCs in Account A and Account В. Configure routing for all the VPCs in TGW-C route tables. Update the route tables for the VPCs in Account A and Account В to forward traffic to TGW-C. Delete TGW-A attachments and TGW-B attachments. Delete TGW-A and TGW-B.
Show Answer
Correct Answer: A
Explanation: AWS Transit Gateway can be shared across AWS accounts by using AWS Resource Access Manager (RAM). Sharing the existing TGW-A with Account B, creating VPC attachments from Account B, updating VPC and TGW route tables, and then removing TGW-B achieves the goal with the least operational overhead because it reuses the existing transit gateway instead of creating and migrating to a new one. Option B is incorrect because there is no feature to automatically replicate a transit gateway configuration. Options C and D introduce a new transit gateway, increasing migration effort and operational overhead.
Question 26
A company operates in multiple AWS Regions. The company has deployed transit gateways in each Region. The company uses AWS Organizations to operate multiple AWS accounts in one organization.
The company needs to capture all VPC flow log data when a new VPC is created. The company needs to send flow logs to a specific Amazon S3 bucket.
Which solution will meet these requirements with the LEAST administrative effort?
A. Update IAM permissions for each user to include a condition that ensures users can create VPCs only when VPC Flow Logs is enabled and configured correctly.
B. Create a custom AWS Config rule with automatic remediation that verifies VPC Flow Logs is enabled and configured correctly. Apply the AWS Config rule to the organization.
C. Enable VPC Flow Logs on each transit gateway. Configure VPC Flow Logs to send flow logs to the specified S3 bucket.
D. Deploy a serverless application that uses AWS CloudTrail to monitor for VPC creation events in each account. Configure the application to apply the correct VPC Flow Logs configuration.
Show Answer
Correct Answer: B
Explanation: An organization-wide AWS Config custom rule with automatic remediation provides centralized governance across AWS Organizations and can automatically ensure newly created VPCs have Flow Logs enabled and configured to deliver to the designated S3 bucket. This requires less ongoing administrative effort than IAM policy conditions or custom CloudTrail/Lambda automation. Transit gateway flow logs do not replace VPC flow logs and do not satisfy the requirement to capture all VPC flow log data.
Question 27
A media company is planning to host an event that the company will live stream to users. The company wants to use Amazon CloudFront.
A network engineer creates a primary origin and a secondary origin for CloudFront. The engineer needs to ensure that the primary origin can fail over to the secondary origin within 15 seconds if a disruption occurs.
Which solution will meet this requirement with the LEAST operational overhead?
A. Configure a Lambda@Edge function to check the health status of both origins every 10 seconds. Reroute incoming requests when the origin health status is unhealthy.
B. Create a Network Load Balancer (NLB) in front of both origins Configure the NLB as the origin in CloudFront.
C. Set the CloudFront origin connection timeout value to 5 seconds Set the origin connection attempts value to 2.
D. Configure a Lambda@Edge function to monitor incoming requests for an origin response. Reroute incoming requests if no response is received from the primary origin within 10 seconds.
Show Answer
Correct Answer: C
Explanation: CloudFront provides native origin failover between a primary and secondary origin. The failover timing is governed by the origin connection timeout and origin connection attempts. Configuring a 5-second connection timeout with 2 connection attempts causes CloudFront to give up on the primary after about 10 seconds and fail over to the secondary, satisfying the requirement to fail over within 15 seconds with minimal operational overhead. Lambda@Edge-based health checking or request routing adds unnecessary complexity, and placing an NLB in front of both origins does not provide the desired CloudFront origin failover behavior.
Question 29
A company runs an application across multiple AWS Regions and multiple Availability Zones. The company needs to expand to a new AWS Region. Low latency is critical to the functionality of the application.
A network engineer needs to gather metrics for the latency between the existing. Regions and the new Region. The network engineer must gather metrics for at least the previous 30 days.
Which solution will meet these requirements?
A. Configure an AWS Network Access Analyzer Network Access Scope, and use the analysis to review the latency.
B. Set up AWS Network Manager Infrastructure Performance. Publish network performance metrics to Amazon CloudWatch.
C. Use an Amazon VPC Reachability Analyzer path to review the latency.
D. Set up VPC Flow Logs. Publish log metrics to Amazon CloudWatch.
Show Answer
Correct Answer: B
Explanation: AWS Network Manager Infrastructure Performance measures network latency and other performance metrics between AWS Regions and publishes them to Amazon CloudWatch, enabling historical analysis (including 30+ days depending on CloudWatch retention). Network Access Analyzer and Reachability Analyzer validate connectivity or reachability rather than measuring latency, and VPC Flow Logs record traffic metadata, not end-to-end latency.
Question 30
A company has 10 Amazon EC2 instances that run web server software in a production VPC. The company also has 10 web servers that run in an on-premises data center. The company has a 10 Gbps AWS Direct Connect connection between the on-premises data center and the production VPC. The data center uses the 10.100.0.0/20 CIDR block.
The company needs to implement a load balancing solution that receives HTTPS traffic from thousands of external users. The solution must distribute the traffic across the web servers on AWS and the web servers in the data center. Regardless of the location of the web servers, HTTPS requests must go to the same web server for the duration of the session.
Which solution will meet these requirements?
A. Deploy a Network Load Balancer (NLB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify IP as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable connection draining on the NLB.
B. Deploy an Application Load Balancer (ALB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify IP as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable application-based sticky sessions on the AL
C. Deploy a Network Load Balancer (NLB) in the production VPCreate one target group for the EC2 Instances and a second target group for the on-premises servers. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable sticky sessions on the NLB.
D. Deploy an Application Load Balancer (ALB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable application-based sticky sessions on the ALB.
Show Answer
Correct Answer: B
Explanation: An Application Load Balancer supports HTTPS termination, application-based sticky sessions, and IP target groups that can include on-premises servers reachable over Direct Connect. On-premises servers cannot be registered in an instance target group because they are not EC2 instances. Network Load Balancer does not provide application-cookie sticky sessions for HTTPS in the way required for maintaining a user's session on the same backend across both EC2 and on-premises targets.
Question 31
A company runs workloads in multiple VPCs in the us-east-1 Region. The VPCs are connected to a transit gateway. An AWS Direct Connect connection provides private connectivity between a data center that is in the US and the transit gateway. A Direct Connect gateway is associated with the transit gateway.
The company has recently opened a new office location in London. The company plans to launch cloud services in multiple VPCs in the eu-west-2 Region. Users in the new London office must have private access to the workloads that run in us-east-1. Users in the US data center must have access to any workloads that are created in eu-west-2. A network engineer must implement a flexible solution that provides users the required access. The solution must be able to accommodate future growth.
Which solution will meet these requirements with the LEAST operational effort?
A. Create an AWS Site-to-Site VPN connection from the London office to the Direct Connect gateway in us-east-1.
B. Establish a new Direct Connect connection for the London office. Attach the new Direct Connect connection to the existing Direct Connect gateway. Create a transit gateway in eu-west-2. Associate the new transit gateway with the existing Direct Connect gateway. Create a peering connection between the transit gateways in us-east-1 and eu-west-2.
C. Create an AWS Site-to-Site VPN connection from the London office to each of the VPCs that are in us-east-1.
D. Establish a new AWS Direct Connect connection for the London office Create a new Direct Connect gateway and a transit gateway in eu-west-2. Attach the new Direct Connect connection to the new Direct Connect gateway. Create a peering connection between the transit gateways in us-east-1 and eu-west-2.
Show Answer
Correct Answer: B
Explanation: A Direct Connect gateway is a global resource and can associate with multiple transit gateways in different Regions (within supported limits). Adding a new Direct Connect connection in London to the existing Direct Connect gateway, creating a transit gateway in eu-west-2, associating it with the existing Direct Connect gateway, and peering the us-east-1 and eu-west-2 transit gateways provides private connectivity for both offices and both Regions with good scalability and minimal operational effort. The VPN options are less scalable and do not satisfy the broader connectivity requirements. Creating a second Direct Connect gateway adds unnecessary operational overhead.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.