A logistics company has multiple VPCs in an AWS Region. The company uses a transit gateway to connect the VPCs. The company has several on-premises offices that connect to the transit gateway by using AWS Site-to-Site VPN connections over the internet. The company has configured one transit gateway VPN attachment for each office.
Route propagation is enabled on all route tables. Each Site-to-Site VPN connection uses two tunnels in an active-passive configuration. The company configured each office with appropriate static routes on both the Site-to-Site VPN connection and the office’s customer gateway.
The company wants to use both IPsec tunnels of every office to maximize the overall VPN connection bandwidth.
Which design changes are necessary to meet these requirements?
A. Create an AWS Transit Gateway Connect attachment for each office Use the existing VPN attachments as the transport for the new Connect attachments. Set up a Generic Routing Encapsulation (GRE) tunnel on each customer gateway that terminates on the Connect attachment for each office. Move the static routes from the transit gateway VPN attachment to the customer gateway for the transit gateway Connect attachment.
B. Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Enable ECMP on the Site-to-Site VPN connection. Ensure static routes on the customer gateways have equal metrics and administrative distance.
C. Enable equal-cost multi-path (ECMP) routing on the transit gateway. (Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Remove related static routes from the customer gateways.
D. Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Ensure the customer gateway applies the correct community strings to give the transit gateway the ability to perform ECMP forwarding.
Show Answer
Correct Answer: C
Explanation: To use both VPN tunnels simultaneously with a transit gateway, the VPN must use dynamic routing (BGP) because ECMP is supported for BGP-based VPNs, not static-routed VPNs. Enable ECMP on the transit gateway and ensure the customer gateways also support and use ECMP. Replace the static routing configuration with BGP and remove the corresponding static routes. Transit Gateway Connect is for GRE/BGP use cases and is not required here, and BGP community strings are not used to enable ECMP forwarding in this scenario.
Question 33
A company is migrating its internet VPN connections to dedicated AWS Direct Connect connections. The company needs to set up the Direct Connect connections so that all network communications are encrypted in transit.
Which combination of steps will meet this requirement? (Choose three.)
A. Create new Direct Connect connections while requesting MACsec ports.
B. Create a MACsec Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair. Associate the pair with each new connection.
C. Update the on-premises routers to use MACsec and the shared Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair.
D. Create a shared key for an IPsec connection.
E. Configure a new Direct Connect gateway. Associate the shared key with the new Direct Connect gateway.
F. Set up IPsec on the on-premises router. Associate the shared key with the IPsec configuration.
Show Answer
Correct Answer: A, B, C
Explanation: AWS Direct Connect supports native encryption in transit using IEEE 802.1AE MACsec on supported dedicated connections. You must request MACsec-capable ports when creating the Direct Connect connection, create and associate a Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK), and configure the on-premises routers to use MACsec with the same CKN/CAK. The IPsec-related options do not describe the required Direct Connect MACsec configuration and include incorrect associations such as attaching a shared key to a Direct Connect gateway.
Question 34
A company runs a workload in a single VPC on AWS. The company’s architecture contains several interface VPC endpoints for AWS services, including Amazon CloudWatch Logs and AWS Key Management Service (AWS KMS). The endpoints are configured to use a shared security group. The security group is not used for any other workloads or resources.
After a security review of the environment, the company determined that the shared security group is more permissive than necessary. The company wants to make the rules associated with the security group more restrictive. The changes to the security group rules must not prevent the resources in the VPC from using AWS services through interface VPC endpoints. The changes must prevent unnecessary access.
The security group currently uses the following rules:
• Inbound - Rule 1
Protocol: TCP -
Port: 443 -
Source: 0.0.0.0/0 -
• Inbound - Rule 2
Protocol: TCP -
Port: 443 -
Source: VPC CIDR -
• Outbound - Rule 1
Protocol: All -
Port: All -
Destination: 0.0.0.0/0 -
Which rule or rules should the company remove to meet with these requirements?
A. Outbound - Rule 2
B. Inbound - Rule 1 and Outbound - Rule 1
C. Inbound - Rule 2 and Outbound - Rule 1
D. Outbound - Rule 1
Show Answer
Correct Answer: B
Explanation: For interface VPC endpoints, the endpoint's security group only needs to allow inbound HTTPS (TCP 443) from the clients in the VPC that will access the endpoint. Allowing 0.0.0.0/0 is unnecessarily permissive and should be removed. Security groups are stateful, so return traffic is automatically allowed; an outbound allow-all rule is not required for the endpoint to function. Therefore, remove Inbound Rule 1 and Outbound Rule 1, while keeping the inbound rule that permits TCP 443 from the VPC CIDR.
Question 35
A company uses transit gateways to route traffic between the company's VPCs. Each transit gateway has a single route table. Each route table contains attachments and routes for the VPCs that are in the same AWS Region as the transit gateway. The route tables in each VPC also contain routes to all the other VPC CIDR ranges that are available through the transit gateways. Some VPCs route to local NAT gateways.
The company plans to add many new VPCs soon. A network engineer needs a solution to add new VPC CIDR ranges to the route tables in each VPC.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Create a new customer-managed prefix list. Add all VPC CIDR ranges to the new prefix list. Update the route tables in each VPC to use the new prefix list ID as the destination and the appropriate transit gateway ID as the target.
B. Turn on default route table propagation for the transit gateway route tables. Turn on route propagation for each route table in each VPC.
C. Update the route tables in each VPC to use 0.0.0.010 as the destination and the appropriate transit gateway ID as the target.
D. Turn on default route table association for the transit gateway route tables. Turn on route propagation for each route table in each VPC.
Show Answer
Correct Answer: A
Explanation: A customer-managed prefix list lets VPC route tables reference a single prefix list instead of maintaining individual routes for every VPC CIDR. When new VPCs are added, only the prefix list needs updating, greatly reducing operational overhead. Transit gateway route propagation does not automatically populate VPC route tables, and using a default route (0.0.0.0/0) to the transit gateway would interfere with internet/NAT routing.
Question 36
A company has several AWS Site-to-Site VPN connections between an on-premises customer gateway and a transit gateway. The company's application uses IPv4 to communicate through the VPN connections.
The company has updated the VPC to be dual stack and wants to transition to using IPv6-only for new workloads. When the company tries to communicate through the existing VPN connections, IPv6 traffic fails.
Which solution will provide IPv6 support with the LEAST operational overhead?
A. Create a new Site-to-Site VPN connection that supports IPv6.
B. Create a new Site-to-Site VPN connection to a self-managed Amazon EC2 instance that runs open source software.
C. Update the existing Site-to-Site VPN connections to support IPv6.
D. Update the on-premises customer gateway's public IP address from IPv4 to IPv6.
Show Answer
Correct Answer: A
Explanation: Existing AWS Site-to-Site VPN connections established for IPv4 cannot simply be updated to carry IPv6 traffic. To support IPv6, create a new Site-to-Site VPN connection with IPv6 support. This is the AWS-managed solution with the least operational overhead. Running a self-managed EC2 VPN appliance adds management burden, and changing the customer gateway public IP to IPv6 does not upgrade an existing IPv4 VPN connection.
Question 37
A company hosts a highly available, scalable, and resilient application on Amazon EC2 instances that are part of an Auto Scaling group. A network engineer is planning to integrate IPv6 support with the application deployment in phases. The first phase is to enable IPv6 service consumption on the public Network Load Balancers (NLBs) that are deployed across the infrastructure. The target groups for the NLBS are configured as the Auto Scaling groups of the EC2 instances that host the application. The NLBs are configured for dual-stack operation.
During the testing of the first phase, the IPv6 application queries are not reaching the backend servers.
What is the cause of this issue?
A. The subnets where the EC2 instances are deployed do not have IPv6 addresses configured.
B. The route tables for the NLB subnets do not have IPV6 routing configured.
C. The route tables for the EC2 subnets do not have IPV6 routing configured.
D. The security groups that are associated with the NLBs do not allow IPv6 traffic.
Show Answer
Correct Answer: A
Explanation: A dual-stack internet-facing Network Load Balancer can accept IPv6 client connections and forward them to IPv4 targets. However, if the backend EC2 instances are intended to be reached over IPv6, their subnets must have IPv6 addressing. In the described phased migration, the missing IPv6 configuration on the EC2 side prevents IPv6 queries from reaching the backend. Network Load Balancers do not rely on security groups in the way suggested, and missing IPv6 routes on the NLB subnets would prevent reaching the NLB itself rather than specifically the backend servers.
Question 38
A global company is establishing network connections between the company's primary and secondary data centers and a VPC. A network engineer needs to maximize resiliency and fault tolerance for the connections. The network bandwidth must be greater than 10 Gbps.
Which solution will meet these requirements MOST cost-effectively?
A. Set up a 100 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up a second 100 Gbps connection at the secondary data center that terminates at a second Direct Connect location. Ensure the connections are managed by separate providers.
B. Set up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up a second 10 Gbps connection at the secondary data center that terminates at a second Direct Connect location. Ensure the connections are managed by separate providers.
C. Set up two 10 Gbps connections at the primary data center that terminate at one AWS Direct Connect location. Ensure the connections are managed by separate providers. Set up two 10 Gbps connections at the secondary data center that terminate at a second Direct Connect location. Ensure the connections are managed by separate providers.
D. Set up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connect location. Set up an AWS Site-to-Site VPN connection at the secondary data center that terminates at a virtual private gateway in the same Region as the company’s VPC.
Show Answer
Correct Answer: C
Explanation: The requirement is bandwidth greater than 10 Gbps while maximizing resiliency and fault tolerance in a cost-effective way. A single 10 Gbps connection at each data center does not provide >10 Gbps of available bandwidth, and a VPN does not satisfy the bandwidth requirement. Two 100 Gbps links are unnecessarily expensive. Deploying two 10 Gbps Direct Connect connections at each data center, terminating at separate Direct Connect locations and using separate providers, provides aggregate capacity above 10 Gbps, redundancy against circuit/provider failures, and aligns with AWS Direct Connect resiliency recommendations at much lower cost than 100 Gbps links.
Question 39
A company deployed an application in two AWS Regions in one AWS account. The company has one VPC in each Region. The VPCs use non-overlapping private CIDR ranges.
The company needs to connect both VPCs to a single on-premises data center to test the application. The application requires up to 800 Mbps of throughput. A network engineer needs to establish connectivity between the VPCs and the on-premises data center.
Which solution will meet this requirement with the LEAST operational overhead?
A. Order a 2 Gbps Direct Connect connection for the data center. Configure a virtual private gateway in each VPC. Create a private VIF for each virtual private gateway, and associate the virtual private gateways with the Direct Connect connection. Configure static routes in the VPC route tables and in the data center router.
B. Order a 2 Gbps Direct Connect connection for the data center. Configure a virtual private gateway in each VPC. Create a private VIF for each virtual private gateway, and associate the virtual private gateways with the Direct Connect connection. Configure Open Shortest Path First (OSPF) routing between the private VIF and the data center.
C. Configure a customer gateway and a virtual private gateway in each VPConfigure an AWS Site-to-Site VPN connection between the data center and each VPConfigure static routes in each VPC route table to point to the subnets in the data center.
D. Configure a customer gateway and a virtual private gateway in each VPC. Configure an AWS Site-to-Site VPN connection between the data center and each VPC. Configure BGP routing between the VPCs and the data center.
Show Answer
Correct Answer: D
Explanation: For a temporary test environment requiring up to 800 Mbps, AWS Site-to-Site VPN is sufficient and avoids the provisioning and management overhead of Direct Connect. Using BGP provides dynamic route exchange and automatic route updates, reducing operational overhead compared to maintaining static routes. Direct Connect private VIFs use BGP, not OSPF, so option B is technically incorrect, and option A relies on static routing.
Question 40
A company has multiple VPCs with subnets that use IPv4. Traffic from the VPCs to the internet uses a NAT gateway. The company wants to transition to IPv6.
A network engineer creates multiple IPv6-only subnets in an existing testing VPC. The network engineer deploys a new Amazon EC2 instance that has an IPv6 address into one of the subnets. During testing, the network engineer discovers that the new EC2 instance is not able to communicate with an IPv4-only service through the internet. The network engineer needs to enable the IPv6 EC2 instance to communicate with the IPv4-only service.
Which solution will meet this requirement?
A. Enable DNS64 for the IPv6-only subnets. Update the route tables for the IPv6-only subnets to send traffic through the NAT gateway.
B. Enable NAT64 for the testing VPC. Reconfigure the existing NAT gateway to support IPv6.
C. Enable DNS64 for the new EC2 instance. Create a new egress-only internet gateway that supports IPv6.
D. Enable NAT64 for each route table. Create a new NAT gateway that supports both IPv4 and IPv6.
Show Answer
Correct Answer: A
Explanation: An IPv6-only instance that needs to reach IPv4-only internet services requires DNS64 to synthesize AAAA records from IPv4 A records, while AWS NAT Gateway provides NAT64 functionality for IPv6-to-IPv4 translation. DNS64 is enabled at the subnet level, and the IPv6-only subnet's route table must direct the synthesized traffic to the NAT gateway. The other options incorrectly describe enabling NAT64 or NAT gateway IPv6 support, or use an egress-only internet gateway, which only provides outbound IPv6 connectivity and does not translate to IPv4.
Question 41
A company has a transit gateway in a single AWS account. The company sends flow logs for the transit gateway to an Amazon CloudWatch Logs log group.
The company created an AWS Lambda function to analyze the logs. The Lambda function sends a notification to an Amazon Simple Notification Service (Amazon SNS) topic when a VPC generates traffic that is dropped by the transit gateway. Each notification contains the account ID. VPC ID, and total amount of dropped packets.
The company wants to subscribe a new Lambda function to the SNS topic. The new Lambda function must automatically prevent the traffic that is identified in each notification from leaving a VPC by applying a network ACL to the transit gateway attachment subnets in the VPC that generates the traffic.
Which solution will meet these requirements?
A. Configure the existing Lambda function to add the destination IP addresses of the dropped traffic to each SNS notification. Configure the new Lambda function to create an outbound rule by using the destination IP addresses in the network ACL.
B. Configure the existing Lambda function to add the source IP addresses of the dropped traffic to each SNS notification. Configure the new Lambda function to create an inbound rule by using the source IP addresses in the network ACL.
C. Configure the existing Lambda function to add the source IP addresses of the dropped traffic to each SNS notification. Configure the new Lambda function to create an outbound rule by using the source IP addresses in the network ACL.
D. Configure the existing Lambda function to add the destination IP addresses of the dropped traffic to each SNS notification. Configure the new Lambda function to create an inbound rule by using the destination IP addresses in the network ACL.
Show Answer
Correct Answer: A
Explanation: To prevent identified traffic from leaving the VPC, apply an outbound network ACL rule on the transit gateway attachment subnets. Network ACL outbound rules match on the destination IP address of egress traffic, not the source IP. Therefore the notification must include the destination IP addresses from the dropped flows, and the automation should create outbound deny rules for those destinations.
Sources:
https://www.secexams.com/exams/Amazon/aws-certified-advanced-networking-specialty-ans-c01/view/52
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.