A company has multiple AWS Site-to-Site VPN connections between an on-premises environment and multiple VPCs. The Site-to-Site VPN connections use virtual private gateways and are configured with IPv4 addresses. The company hosts several internal applications in the VPCs.
Application users have reported that the applications are performing slowly. A network engineer notices excessive latency in the network path that the VPN connections use. The network engineer needs to resolve the excessive latency.
Which solution will meet this requirement?
A. Use AWS Global Accelerator to deploy an accelerator on the existing Site-to-Site VPN connections.
B. Deploy a transit gateway and a new accelerated Site-to-Site VPN connection.
C. Replace the existing Site-to-Site VPN connections with new Site-to-Site VPN connections that use IPv6.
D. Replace the existing Site-to-Site VPN connections with AWS PrivateLink connections.
Show Answer
Correct Answer: B
Explanation: Excessive latency on Site-to-Site VPN can be reduced by using AWS VPN acceleration, which leverages the AWS global network. Accelerated Site-to-Site VPN is supported only when the VPN is attached to an AWS Transit Gateway, not a virtual private gateway. Therefore, deploying a transit gateway and creating a new accelerated Site-to-Site VPN connection addresses the latency issue. The other options either are unsupported for acceleration, do not improve latency, or are not suitable replacements for Site-to-Site VPN in this scenario.
Question 23
A company uses AWS Network Firewall to protect outgoing traffic for multiple VPCs that are in the same AWS account. Each VPC contains Amazon EC2 instances that host the company's applications. Each EC2 instance is tagged with the name of the application it hosts. The EC2 instances are in Auto Scaling groups.
A Network Firewall stateful rule group must remain up-to-date, even when an Auto Scaling group launches and terminates EC2 instances.
Which solution will meet this requirement with the LEAST implementation and administrative effort?
A. Create a network ACL for each application. Reference the network ACL in the stateful rule group.
B. Create a prefix list for each application. Reference the prefix list in the stateful rule group.
C. Create an AWS Lambda function that queries the EC2 instance tags for each application name and then updates the stateful rule group with the IP address of each instance.
D. Create a resource group for each application name. Reference the Amazon Resource Name (ARN) for the resource groups in the stateful rule group.
Show Answer
Correct Answer: D
Explanation: AWS Network Firewall supports using tag-based AWS Resource Groups as IP set references in stateful rule groups. By creating a resource group per application based on EC2 instance tags, membership automatically updates as Auto Scaling groups launch and terminate instances. Referencing the resource group ARN keeps the firewall rules current without custom code or ongoing administration, providing the least implementation and operational effort.
Question 24
A company uses AWS Site-to-Site VPN connections to encrypt traffic between the company's on-premises location and a single VPC. The Site-to-Site VPN connections use two 1 Gbps AWS Direct Connect connections with public VIFs. The company plans to add 15 additional VPCs in the same AWS Region.
The company must maintain the same level of encryption that the Site-to-Site VPN connections currently provide for each connection between the on-premises location and the new VPCs. The new connections must not use public IP addresses. The bandwidth of the Site-to-Site VPN connections will remain less than the current provisioned speed.
Which combination of steps will meet these requirements with LEAST operational overhead? (Choose three.)
A. Create a transit gateway and a Direct Connect gateway. Associate the transit gateway with the Direct Connect gateway. Attach all the new VPCs to the transit gateway.
B. For each new VPC, create a new Direct Connect private VIF to a Direct Connect gateway. Associate all VPCs with the Direct Connect gateway.
C. Assign a private IP CIDR block to the transit gateway.
D. Assign a public IP CIDR block to the transit gateway.
E. Create a transit VIF to the Direct Connect gateway. Create a Site-to-Site VPN private IP VPN connection.
F. Create a public VICreate a Site-to-Site VPN public IP VPN connection.
Show Answer
Correct Answer: A, C, E
Explanation: To extend encrypted connectivity to many VPCs with the least operational overhead, the company should centralize routing and VPN termination. Creating an AWS Transit Gateway and associating it with a Direct Connect gateway (A) allows all existing and new VPCs to connect through a single hub. Assigning a private IP CIDR block to the transit gateway (C) enables private IP routing and avoids public IP usage. Creating a transit VIF to the Direct Connect gateway and establishing a Site-to-Site VPN using private IP addresses (E) preserves the same level of IPsec encryption while running over Direct Connect, scales efficiently to multiple VPCs, and avoids managing separate VPNs or VIFs per VPC.
Question 25
A company has an application VPC and a networking VPC that are connected through VPC peering. The networking VPC contains a Network Load Balancer (NLB). The application VPC contains Amazon EC2 instances that run an application. The EC2 instances are part of a target group that is associated with the NLB in the networking VPC.
The company configures a third VPC and peers it to the networking VPC. The new VPC contains a new version of the existing application. The new version of the application runs on new EC2 instances in an application subnet. The new version of the application runs in a different Availability Zone than that original version of the application.
The company needs to establish connectivity between the NLB and the new version of the application.
Which combination of steps will meet this requirement? (Choose three.)
A. Register the new application EC2 instances with the NLB by using the instance IDs.
B. Register the new application EC2 instances with the NLB by using instance IP addresses.
C. Configure the NLB in the Availability Zone where the new application EC2 instances run.
D. Configure the NLB to use zonal shift.
E. Configure the network ACL for the application subnet in the new VPC to allow outbound connections.
F. Configure the network ACL for the application subnet in the new VPC to allow inbound connections and outbound connections.
Show Answer
Correct Answer: B, C, F
Explanation: Targets in a different VPC that is connected through VPC peering must be registered with a Network Load Balancer by IP address, not by instance ID. The NLB must also be enabled in the Availability Zone where the new EC2 instances run so it can route traffic to those targets. Finally, the application subnet’s network ACLs must allow both inbound and outbound traffic to permit bidirectional communication between the NLB and the EC2 instances. Other options do not establish or enable the required cross-VPC, cross-AZ connectivity.
Question 26
A company runs workloads in multiple VPCs. The company needs to securely access a workload in one of the VPCs, named VPC-A, from an on-premises data center. A network engineer sets up an AWS Site-to-Site VPN connection to a transit gateway. The network engineer configures dynamic routing for the connection, and communication works properly.
Recently, the owner of VPC-A added another CIDR range to the VPC. The VPC-A owner created workloads that use the additional CIDR range.
The company's on-premises network is unable to reach the new workloads. The network engineer needs to resolve the network connectivity issue and ensure that connectivity will not be affected if additional VPC CIDR ranges are added to the VPC in the future.
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure route propagation for VPC-A to the VPN attachment route table.
B. Manually update the VPN attachment route table to include the new CIDR range.
C. Configure an Amazon EventBridge rule to invoke an AWS Lambda function when the rule to matches an update to the VPC-A CIDR range. Configure the Lambda function to update the VPN attachment route table.
D. Configure an Amazon CloudWatch alarm to invoke an AWS Lambda function when there is an update to the VPC-A CIDR range. Configure the Lambda function to update the VPN attachment route table. Restart the VPN tunnels.
Show Answer
Correct Answer: A
Explanation: The Site-to-Site VPN uses dynamic routing through the transit gateway. When a VPC is attached to a transit gateway and route propagation is enabled, all CIDR blocks associated with that VPC attachment are automatically propagated into the transit gateway route table that the VPN attachment uses. Enabling route propagation for VPC-A ensures that newly added VPC CIDR ranges are automatically advertised to the on-premises network without manual updates or automation, providing the highest operational efficiency and future-proofing.
Question 27
A US-based company is expanding its business to Europe. A network engineer needs to extend the company's network infrastructure by setting up a new hub and spoke architecture in the eu-west-1 Region. The network engineer uses a transit gateway peering connection to connect the new resources in eu-west-1 to an existing environment in the us-east-1 Region.
The hub and spoke architecture in each AWS Region includes an inspection VPC that uses AWS Network Firewall to centralize traffic inspection for each Region. To reduce costs, the network engineer decides to inspect inter-Region traffic by using the inspection VPC in the Region that originates the traffic. The network engineer configures the transit gateway route tables accordingly for each Region.
When the network engineer tests the new architecture, communication within each Region works as expected. However, the network engineer finds that inter-Region communication is not working. The network engineer must resolve the inter-Region communication issue.
Which solution will meet this requirement?
A. Configure Open Shortest Path First (OSPF) routing on the transit gateway peering connection to propagate the VPC CIDR blocks from each Region to the remote peer.
B. Use AWS Resource Access Manager (AWS RAM) to share access between the transit gateways. Enable the Allow sharing with anyone setting.
C. Prevent asymmetric routing in the inspection VPCs by ensuring that both requests and responses are inspected by the same inspection VPC
D. Enable Appliance mode on both the transit gateway attachments for the inspection VPC.
Show Answer
Correct Answer: D
Explanation: Inter-Region traffic is routed through inspection VPCs that contain AWS Network Firewall. Without appliance mode, AWS Transit Gateway can forward return traffic along a different path, causing asymmetric routing, which Network Firewall does not support. Enabling appliance mode on the transit gateway attachments for the inspection VPCs ensures that both request and response traffic traverse the same inspection VPC in the originating Region, allowing inter-Region communication to function correctly.
Question 28
A company runs applications in two VPCs that are in separate AWS Regions. One VPC is in the us-east-1 Region. The second VPC is in the us-west-1 Region. The company needs to establish connectivity between the two VPCs. The company also needs to connect the VPCs to applications that run in an on-premises data center.
The current traffic requirement between the VPCs is 50 ТВ per month. The company expects traffic volume between the VPCs to increase. The traffic requirement from the VPCs to the on-premises data center is 10 ТВ per month. The company expects the traffic between the VPCs and the data center to remain constant.
Which solution will meet these requirements MOST cost-effectively?
A. Create a transit gateway in each Region. Create VPN connections from the transit gateways to the on-premises firewall. Create a peering connection between the transit gateways.
B. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Configure the on-premises firewall to route the traffic between the two VPCs.
C. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Create a VPC peering connection between the two VPCs.
D. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Create a VPN connection between the virtual private gateways.
Show Answer
Correct Answer: C
Explanation: The requirement is to connect two VPCs in different Regions and also connect both to an on-premises data center, with high and growing inter-VPC traffic (50 TB/month and increasing) but relatively low, stable on-premises traffic (10 TB/month). Inter-Region VPC peering supports direct VPC-to-VPC connectivity and is more cost-effective than using Transit Gateways because it avoids Transit Gateway hourly charges and additional data processing fees. Although inter-Region VPC peering has per-GB data transfer costs, these are still lower than inter-Region Transit Gateway peering costs. Using virtual private gateways with site-to-site VPNs is sufficient for the stable on-premises traffic volume. There is no requirement for hub-and-spoke scalability or many VPCs, so a Transit Gateway would be unnecessarily expensive. Therefore, creating VPN connections to VGWs and using inter-Region VPC peering between the VPCs is the most cost-effective solution.
Question 29
A company hosts application servers on premises and on Amazon EC2 instances in a VPC. The application servers access data that is hosted in an Amazon S3 bucket through the public internet. The EC2 instances in the VPC use an AWS Site-to-Site VPN for connectivity with the on-premises application servers.
New company regulations state that all traffic between the application servers and the S3 bucket must remain private and must not use public IP addresses.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an S3 gateway endpoint Modify the route table with the appropriate route for the endpoint. Access the S3 bucket through the gateway endpoint from the EC2 instances.
B. Configure an S3 interface endpoint. Update the on-premises servers and EC2 instances to use the interface endpoint DNS name to access the S3 bucket.
C. Configure an S3 interface endpoint. Update the on-premises servers to use the interface endpoint DNS name to access the S3 bucket. Configure an S3 gateway endpoint. Modify the route table so that the EC2 instances use the gateway endpoint.
D. Configure an S3 gateway endpoint. Modify the route table with the appropriate route for the endpoint. Use an S3 bucket policy to restrict access to the gateway endpoint. Configure a proxy server fleet behind a Network Load Balancer in the VPC so that the on-premises servers can access the S3 bucket.
Show Answer
Correct Answer: C
Explanation: The requirement is that all traffic to Amazon S3 must remain private and not use public IP addresses, for both on-premises servers and EC2 instances, and the solution must be the most cost-effective.
An S3 gateway endpoint is the most cost-effective option for EC2 instances in a VPC because it is free and allows private access to S3 without public IPs. However, gateway endpoints are accessible only from within the VPC and cannot be used directly by on-premises servers.
On-premises servers connected via Site-to-Site VPN require an S3 interface endpoint to access S3 privately through private IP addresses within the VPC. Interface endpoints incur a cost but are necessary for on-premises access.
Option C correctly combines both: EC2 instances use the free S3 gateway endpoint, while on-premises servers use the S3 interface endpoint. This meets the privacy requirement and minimizes cost.
Question 30
A company needs to capture and log traffic for Nitro-based Amazon EC2 instances to comply with regulations. The company's network team has prepared a solution that enables VPC traffic mirroring and sends traffic to a second set of EC2 instances in an Auto Scaling group.
The network team has added a Network Load Balancer (NLB) in front of the EC2 instances the traffic will be sent to. However, the solution does not send any mirrored traffic to the EC2 instances that are behind the NLB.
How should the network team configure traffic mirroring to use the NLB endpoint?
A. Select the NLB as a source for traffic mirroring. Use a UDP listener.
B. Select the NLB as a target for traffic mirroring. Use a TCP listener and a UDP listener.
C. Select the NLB as a target for traffic mirroring. Use a TCP listener.
D. Select the NLB as a target for traffic mirroring. Use a UDP listener.
Show Answer
Correct Answer: D
Explanation: Amazon VPC Traffic Mirroring sends mirrored packets using VXLAN encapsulation over UDP (port 4789). When using a Network Load Balancer as the traffic mirroring destination, the NLB must be configured as a target (not a source) with a UDP listener to receive the mirrored traffic and forward it to the EC2 instances. TCP listeners are not used for traffic mirroring.
Question 31
A company has a hybrid environment that connects an on-premises data center to the AWS Cloud. The hybrid environment uses a 10 Gbps AWS Direct Connect dedicated connection. The Direct Connect connection has multiple private VIFs that terminate in multiple VPCs.
To comply with regulations, the company must encrypt all WAN traffic, regardless of the underlying transport. The company needs to implement an encryption solution that will not affect the company's bandwidth capacity.
Which solution will meet these requirements?
A. Create a public VIF. Configure a new AWS Site-to-Site VPN connection to use the new public VIF.
B. Configure MAC security (MACsec) support on the port of the existing Direct Connect connection. Change the encryption mode to must_encrypt.
C. Configure a new Direct Connect connection that supports MAC security (MACSec) Associate the existing VIFs to the new Direct Connect connection.
D. Create a public VIF. Configure a new private IP VPN that uses the Direct Connect connection.
Show Answer
Correct Answer: C
Explanation: The requirement is to encrypt all WAN traffic without reducing the available 10 Gbps bandwidth. Using VPN-based encryption (options A and D) would introduce IPsec overhead and reduce effective throughput. AWS Direct Connect MACsec provides line‑rate, Layer 2 encryption with no bandwidth impact, which meets the requirement. However, MACsec cannot be enabled on an existing Direct Connect connection; it requires a MACsec-capable circuit. Therefore, the correct solution is to create a new Direct Connect connection that supports MACsec and associate the existing VIFs with it.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.