A company has five VPCs in the us-east-1 Region. The company hosts an internal web application in us-east-1. One of the company's VPCs. named VPC-A, needs to connect to an external partner's AWS environment. The partner’s environment is in the same AWS Region where the partner hosts a new version of the company's web application. The partner hosts its version of the application in a VPC named VPC-B.
The company has Amazon EC2 instances in VPC-A that need to connect to the web application in VPC-B A network engineer notices that the partner's VPC-B and the company's VPC-A use the same IP space. The network engineer needs a solution to allow the EC2 instances to connect to the web application. The solution must not negatively affect the exiting environment of the company or the partner.
Which combination of steps should the network engineer take meet these requirements? (Choose two.)
A. Establish a VPC peering connection between VPC-A to VPC-B.
B. Ensure the partner creates a VPC endpoint service that uses a Network Load Balancer in VPC-
C. Deploy a VPC endpoint in VPC-A that uses a VPC endpoint service that is shared by the partner.
D. Deploy a new routable VPC CIDR block as a secondary CIDR block to both VPC-A and VPC-B. Deploy a public NAT gateway in VPC-A.
E. Establish an AWS Site-to-Site VPN connection between VPC-A and VPC-B.
Show Answer
Correct Answer: B, C
Explanation: VPC-A and VPC-B have overlapping CIDR ranges, so direct connectivity options like VPC peering or Site-to-Site VPN will not work. AWS PrivateLink is designed for this exact scenario. The partner should create a VPC endpoint service backed by a Network Load Balancer in VPC-B (B). The company then deploys an interface VPC endpoint in VPC-A that connects to this service (C). This enables private, secure connectivity without routing changes, IP renumbering, or impact to either existing environment.
Question 33
A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are part of an Amazon EC2 Auto Scaling group.
To comply with new security standards, the company must capture all application access data, including server response codes, request paths, latency, and client IP addresses. The company also needs to query the captured data for performance analysis.
Which solution will meet these requirements?
A. Enable VPC flow logs on the ALB subnets. Store the logs to an Amazon S3 bucket. Query the logs in the S3 bucket by using Amazon Athena.
B. Configure Amazon VPC Traffic Mirroring on all EC2 elastic network interfaces. Deploy a third-party monitoring appliance from AWS Marketplace in a private subnet. Use Amazon Data Firehose to send all mirrored traffic to the monitoring appliance. Query the logs directly from the monitoring appliance.
C. Configure Amazon CloudWatch detailed monitoring on the EC2 instances Include all available logs. Use Amazon Data Firehose to send all the collected logs to an Amazon S3 bucket. Query the data directly from the S3 bucket.
D. Enable access logs on the ALB. Store the logs in an Amazon S3 bucket. Query the logs in the S3 bucket by using Amazon Athena.
Show Answer
Correct Answer: D
Explanation: ALB access logs capture the required application access details, including client IP addresses, request paths, server response codes, and request/response latency. These logs can be delivered directly to Amazon S3 and queried efficiently using Amazon Athena for performance analysis. Other options either lack application-layer details (VPC flow logs), are overly complex and unnecessary (traffic mirroring), or do not provide the required access-level data (CloudWatch detailed monitoring).
Question 34
A company is planning to migrate to AWS and use multiple VPCs in multiple AWS Regions. A network engineer must connect the eu-west-1 and eu-central-1 Regions to the company headquarters and branch office, respectively.
The network engineer created a production VPC, named Prod A, with a CIDR block of 10.0.0.0/16. Prod A runs in an account in eu-west-1. The network engineer then created another production VPC, named Prod B, with a CIDR block of 10.1.0.0/16. Prod В runs in a different account in eu-central-1.
The network engineer performed the following steps to try to achieve the required connectivity:
1. Created one transit gateway in each Region
2. Shared and accepted the transit gateways with the production accounts in both Regions
3. Configured the peering attachment between both transit gateways
4. Attached both VPCs to the respective Region transit gateway
5. Created both transit gateway route tables and associated the attachments with the route tables
6. Configured a static route in both transit gateway route tables to send traffic to the remote VPC in the other Region
7. Activated route propagation on the VPC route tables in each Region
After the configuration, the network engineer tried to connect from Prod A to Prod B. However, the connection was unsuccessful.
What should the network engineer do to achieve the required connectivity?
A. Modify the IP address of the peering attachment to a wider range.
B. Delete the static routes that were in the transit gateway route table to send traffic to the remote VPC and enable route propagation instead.
C. Create a new route destined to 10.0.0.0/8 in both production VPC route tables with the Region transit gateway as the target.
D. Modify the transit gateway route tables from the production accounts to propagate routes dynamically between the production VPCs.
Show Answer
Correct Answer: C
Explanation: The transit gateways are correctly peered and have static routes between Regions, but the VPC route tables still must explicitly send traffic for the remote VPC CIDR ranges to the local transit gateway. Transit gateway routes are not automatically propagated into VPC route tables. Adding a route in each production VPC route table that points traffic destined for the other VPC CIDR (for example, a summarized 10.0.0.0/8 route) to the transit gateway completes the end-to-end routing path and enables connectivity.
Question 35
A company is planning to use an AWS Transit Gateway hub and spoke architecture to migrate to AWS. The current on-premises multi-protocol label switching (MPLS) network has strict controls that enforce network segmentation by using MPLS VPNs. The company has provisioned two 10 Gbps AWS Direct Connect connections to provide resilient, high-speed, low-latency connectivity to AWS.
A security engineer needs to apply the concept of network segmentation to the AWS environment to ensure that virtual routing and forwarding (VRF) is logically separated for each of the company's software development environments. The number of MPLS VPNs will increase in the future. On-premises MPLS VPNs will have overlapping address space. The company's AWS network design must support overlapping address space for the VPNs.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy a software-defined WAN (SD-WAN) head-end virtual appliance and an SD-WAN controller into a Transit Gateway Connect VPC. Configure the company's edge routers to be managed by the new SD-WAN controller and to use SD-WAN to segment the traffic into the defined segments for each of the company's development environments.
B. Configure IPsec VPNs on the company edge routers for each MPLS VPN for each of the company's development environments. Attach each IPsec VPN tunnel to a discrete MPLS VPN. Configure AWS Site-to-Site VPN connections that terminate at a transit gateway for each MPLS VPN. Configure a transit gateway route table that matches the MPLS VPN for each Transit Gateway VPN attachment.
C. Create a transit VPC that terminates at the AWS Site-to-Site VRF-aware IPsec VPN. Configure IPsec VPN connections to each VPC for each of the company's development environment VRFs.
D. Configure a Transit Gateway Connect attachment for each MPLS VPN between the company's edge routers and Transit Gateway. Configure a transit gateway route table that matches the MPLS VPN for each of the company's development environments.
Show Answer
Correct Answer: D
Explanation: Transit Gateway Connect is specifically designed to integrate AWS Transit Gateway with on-premises routers over Direct Connect using GRE/BGP while preserving VRF-based segmentation. By creating a separate Transit Gateway Connect attachment and route table per MPLS VPN, the company can maintain logical separation equivalent to MPLS VRFs, support overlapping IP address space, and scale easily as new VPNs are added. This approach is native, avoids additional appliances or complex VPN meshes, and therefore has the least operational overhead.
Question 36
A company is planning to host a secure web application across multiple Amazon EC2 instances. The application will have an associated DNS domain in an Amazon Route 53 hosted zone.
The company wants to protect the domain from DNS poisoning attacks. The company also wants to allow web browsers to authenticate into the application by using a trusted third party.
Which combination of actions will meet these requirements?
A. Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install self-signed X.509 certificates on the EC2 instances.
B. Configure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install X 509 certificates that are signed by a public certificate authority on the EC2 instances.
C. Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install X.509 certificates that are signed by a public certificate authority on the EC2 instances.
D. Configure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install self-signed X.509 certificates on the EC2 instances.
Show Answer
Correct Answer: C
Explanation: DNS poisoning attacks are mitigated by enabling DNS Security Extensions (DNSSEC) on the Amazon Route 53 public hosted zone, which provides integrity and origin authentication for DNS responses. Allowing web browsers to authenticate using a trusted third party requires X.509 certificates signed by a public certificate authority, not self-signed certificates. NAPTR records are unrelated to DNS security or browser authentication.
Question 37
A company’s data center is connected to a single AWS Region by an AWS Direct Connect dedicated connection. The company has a single VPC in the Region. The company stores logs for all its applications locally in the data center.
The company must keep all application logs for 7 years. The company decides to copy all application logs to an Amazon S3 bucket.
Which solution will meet these requirements?
A. Create a public VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint in the VPC.
B. Create a private VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint in the VPC.
C. Create a private VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VP
D. Create a public VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VPC.
Show Answer
Correct Answer: C
Explanation: Application logs are uploaded from the on-premises data center over AWS Direct Connect. To access Amazon S3 privately over Direct Connect, the correct pattern is a **private VIF** combined with an **S3 interface endpoint (AWS PrivateLink)**, which is reachable from on-premises networks via the VPC. S3 gateway endpoints work only for resources inside the VPC and are not accessible from on-premises over Direct Connect. A public VIF is unnecessary when private connectivity is required.
Question 38
A finance company runs multiple applications on Amazon EC2 instances in two VPCs that are within a single AWS Region. The company uses one VPC for stock trading applications. The company uses the second VPC for financial applications. Both VPCs are connected to a transit gateway that is configured as a multicast router.
In the stock trading VPC, an EC2 instance that has an IP address of 10.128.10.2 sends trading data over a multicast network to the 239.10.10.10 IP address on UDP Port 5102. The company recently launched two new EC2 instances in the financial application VPC. The new EC2 instances need to receive the multicast stock trading data from the EC2 instance that is in the stock trading VPC.
Which combination of steps should the company take to meet this requirement? (Choose three.)
A. Add the elastic network interfaces of the two new EC2 instances as members of the multicast group by using the group IP address of 239.10.10.10.
B. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows: Protocol: IGMP Version 2. Port: 5102, and Source: 239 10.10.10/32
C. Create associations to two EC2 instance IDs on the financial application VPC transit gateway attachment under the transit gateway multicast domain.
D. Create an association to EC2 instance subnets on the financial application VPC transit gateway attachment under the transit gateway multicast domain. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows: Protocol: IGMP Version 2. Port: All, and Source: 0 0.0.0/32
E. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows. Protocol: UDP, Port: 5102, and Source: 10.128.10.2/32
Show Answer
Correct Answer: A, D, E
Explanation: To receive multicast traffic through an AWS Transit Gateway multicast domain, three things are required. First, the receiver ENIs must explicitly join the multicast group (A). Second, the subnets that contain the receiver EC2 instances must be associated with the transit gateway multicast domain (D); associations are done at the subnet level, not per instance ID. Third, security groups must allow the actual data traffic. Multicast data is carried over UDP, not IGMP, so the receiver security groups must allow UDP port 5102 from the sender IP 10.128.10.2 (E). IGMP rules are not required in security groups, and associating individual instance IDs is not supported.
Question 39
A company has VPCs in the us-east-1 Region that are connected to each other through a transit gateway. A network engineer needs to establish an AWS Direct Connect connection between the company's on-premises data center and the transit gateway for the migration of a workload.
The Direct Connect connection is UP according to the ConnectionState metric in Amazon CloudWatch. However, the VIF is DOWN. The network engineer has verified the transit VIF and BGP configurations on the on-premises router and has found no issues. However, the network engineer is unable to ping the Amazon peer IP address.
Which combination of steps should the network engineer take to troubleshoot this issue? (Choose three.)
A. Verify that the correct IP address and subnet mask are in use for the subinterface on the router.
B. Ensure that VLAN trunking is disabled on the router.
C. Verify that the router has a MAC address entry from the AWS endpoint in the Address Resolution Protocol (ARP) table.
D. Verify that the optical signal that is received over the cross connect is optimal.
E. Ensure that the correct VLAN tag is applied on the subinterface configuration on the router.
F. Ensure that TCP port 179 is not being blocked at the on-premises router.
Show Answer
Correct Answer: A, C, E
Explanation: The Direct Connect physical connection is UP, but the VIF is DOWN and the Amazon peer IP cannot be pinged, indicating a Layer 2/subinterface issue rather than BGP or TCP 179. The correct troubleshooting steps are to verify the IP address and subnet mask on the router subinterface (A), check that ARP is resolving and that a MAC address from the AWS endpoint appears in the ARP table (C), and ensure the correct VLAN tag is configured on the subinterface to match the VIF (E).
Question 40
A company wants to implement a distributed architecture on AWS that uses a Gateway Load Balancer (GWLB) and GWLB endpoints.
The company has chosen a hub-and-spoke model. The model includes a GWLB and virtual appliances that are deployed into a centralized appliance VPC and GWLB endpoints. The model also includes internet gateways that are configured in spoke VPCs.
Which sequence of traffic flow to the internet from the spoke VPC is correct?
A. 1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration. 2. Traffic is delivered securely and privately to the GWLB. 3. The GWLB sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway.
B. 1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration. 2. Traffic is delivered securely and privately to the GWLB endpoint. 3. The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB and out to the internet through an internet gateway.
C. 1. An application in a spoke VPC sends traffic to the GWLB endpoint. 2. Traffic is delivered securely and privately to the GWLB. 3. The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway.
D. 1. An application in a spoke VPC sends traffic to the GWLB. 2. Traffic is delivered securely and privately to the GWLB endpoint. 3. The GWLB sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB and out to the internet through an internet gateway.
Show Answer
Correct Answer: A
Explanation: In a hub-and-spoke design with GWLB, spoke VPC route tables send traffic to a GWLB endpoint. The endpoint privately forwards traffic to the GWLB in the centralized appliance VPC, which then distributes it to virtual appliances for inspection. After inspection, traffic returns symmetrically through the GWLB endpoint and exits the spoke VPC via its internet gateway. Other options incorrectly place components (sending directly to GWLB), misuse headers, or describe an invalid return path.
Question 41
A company has a VPC that includes application workloads that run on Amazon EC2 instances in a single AWS Region. The company wants to use AWS Local Zones to deploy an extension of the application workloads that run in the Region. The extended workloads in the Local Zone need to communicate bidirectionally with the workloads in the VPC in the Region.
Which solution will meet these requirements MOST cost-effectively?
A. Create a new VPC in the Local Zone. Attach all the VPCs to a transit gateway. Configure routing for the transit gateway and the VPCs. Deploy instances in the new VPC.
B. Deploy a third-party appliance in a new VPC in the Region. Create a new VPC in the Local Zone. Create VPN connections to the appliance for the VPCs. Deploy instances in the new VPC in the Local Zone.
C. Create a new subnet in the Local Zone. Deploy a third-party appliance in the VPC with interfaces in each subnet. Configure the new subnet to route the Local Zone through the appliance. Deploy instances in the new subnet.
D. Create a new subnet in the Local Zone. Configure the new subnet to use a CIDR block that is within the VPC’s CIDR block. Deploy instances in the new subnet in the Local Zone.
Show Answer
Correct Answer: D
Explanation: AWS Local Zones are extensions of an existing Region and VPC. The most cost-effective and simplest approach is to enable the Local Zone and create a new subnet in the same VPC using a CIDR from the VPC’s CIDR block. Resources in the Local Zone subnet can communicate bidirectionally with Regional subnets using standard VPC routing without transit gateways, VPNs, or third-party appliances, avoiding additional infrastructure and costs.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.