A company has a web application that runs in eight AWS Regions. In each Region, the application is hosted on multiple compute resources behind an Application Load Balancer (ALB).
The different Regions are using different domains. Each ALB is configured to accept only HTTPS traffic. Each ALB uses a certificate from AWS Certificate Manager (ACM).
The company wants to simplify the application’s appearance on the web by using a new single domain for all Regions. A network engineer needs to implement this change by designing a solution that also will minimize latency for the application's end users.
Which combination of actions will meet these requirements? (Choose three.)
A. Use ACM to create an SSL/TLS certificate in the us-east-1 Region for the new domain.
B. Set up latency-based routing in Amazon Route 53 for the new domain. Add the ALBs from all the Regions as targets.
C. Create an alias record for the accelerator in Amazon Route 53 for the new domain.
D. Create a standard accelerator in AWS Global Accelerator. Configure a listener for TCP traffic. Add all the ALBs as targets for the listener.
E. Use ACM to create an SSLITLS certificate for each Region. Configure all the ALBs to use the certificate in their respective Regions.
F. Create a custom routing accelerator in AWS Global Accelerator. Configure a listener for HTTPS traffic. Add all the ALBs as targets for the listener. Configure the accelerator to terminate TLS by using the SSLITLS certificate from ACM.
Show Answer
Correct Answer: C, D, E
Explanation: Using a single domain with minimal latency is best achieved by fronting all regional ALBs with AWS Global Accelerator. A standard accelerator provides Anycast IPs and optimal edge routing without DNS latency, and it forwards TCP traffic to regional ALBs that already terminate HTTPS. Route 53 must point the new domain to the accelerator via an alias record. Because TLS is terminated at each ALB, each ALB must have an ACM certificate in its own Region for the new domain. Latency-based Route 53 routing is inferior to Global Accelerator for performance, custom routing accelerators and TLS termination at GA are unnecessary, and a single us-east-1 certificate is not required when TLS terminates at the ALBs.
Question 43
A network engineer needs to provide a list of IP addresses that are sending traffic to an Amazon EC2 instance. VPC flow logs are enabled. The EC2 instance has a single network interface and two assigned IP addresses. However, the flow logs are logging traffic only for the primary IP address. The network engineer needs to determine whether any traffic is being sent to the second IP address of the EC2 instance.
What should the network engineer do to locate the traffic flow for the second IP address?
A. Create a new flow log that includes the pkt-dstaddr field to capture the original destination IP address of the traffic.
B. Create a new flow log that includes the dstaddr field to capture the original destination IP address of the traffic.
C. Create a new flow log that includes the pkt-srcaddr field to capture the original destination IP address of the traffic.
D. Create a new flow log that includes the srcaddr field to capture the original destination IP address of the traffic.
Show Answer
Correct Answer: A
Explanation: For ENIs with multiple IPv4 addresses, VPC Flow Logs record the primary private IP in the dstaddr field even when traffic is sent to a secondary IP. To see the original destination IP (the secondary address), the flow log must include the pkt-dstaddr field, which captures the packet’s original destination before any translation.
Question 44
A company has configured an AWS Cloud WAN core network with edge locations in the us-east-1 Region and the us-west-1 Region. Each edge location has two segments: development and staging. The segments use the default core network policy.
The company has attached VPCs to the core network. A development VPC is attached to the development segment in us-east-1 and is configured to use the 10.0.0.0/16 CIDR block. A staging VPC is attached to the staging segment in us-west-1 and is configured to use the 10.5.0.0/16 CIDR block. The company has updated the route tables for both VPCs with a route that directs any traffic for 0.0.0.0/0 to the core network.
The company’s network team needs to establish communication between the two VPCs by using the AWS Cloud WAN core network. The network team is not receiving a response during tests of communication between the VPCs. The network team has verified that security groups and network ACLs are not blocking the traffic.
What should the network team do to establish this communication?
A. Update both VPC route tables to have a new static route. Configure a route on the development VPC to direct the traffic for 10.0.0.0/16 to the development VPC attachment. Configure a route on the staging VPC to direct the traffic for 10.5.0.0/16 to the staging VPC attachment.
B. Update the segment filter to allow traffic on the development and staging segments.
C. Set the isolate-attachments parameter to False for the development and staging segments.
D. Update the core network policy to add a static route for each segment. Configure a route to direct the traffic for 10.0.0.0/16 to the development VPC attachment. Configure a route to direct the traffic for 10.5.0.0/16 to the staging VPC attachment.
Show Answer
Correct Answer: D
Explanation: In AWS Cloud WAN, routing between segments is controlled by the core network policy, not by VPC route tables alone. By default, segments are isolated from each other, so traffic between the development and staging segments will not flow unless explicitly allowed. Adding static routes in the core network policy defines how traffic destined for each VPC CIDR is routed across segments via their attachments. Segment filters and isolate-attachments do not enable inter-segment communication, and adding VPC route table entries alone is insufficient.
Question 45
A network engineer needs to monitor internet metrics for an application that is in a VPC. The metrics include user experiences such as health events, latency, and traffic insights.
The network engineer sets up Amazon CloudWatch Internet Monitor for the application. The engineer wants to push the internet health events to a third-party target.
Which solution will meet these requirements with the LEAST implementation effort?
A. Create a third-party API endpoint in Amazon EventBridge. Configure internet Monitor to send the events to the third-party API endpoint in EventBridge.
B. Create a third-party API endpoint in Amazon EventBridge. Create a rule in EventBridge that uses Internet Monitor as the source and the third-party API endpoint in EventBridge as the destination.
C. Create a third-party API endpoint in internet Monitor. Configure Internet Monitor to send the events to an Amazon S3 bucket. Configure an AWS Lambda function to send the events to the third-party API endpoint in Internet Monitor.
D. Create a third-party API endpoint in Internet Monitor. Configure Internet Monitor to send the events to the third-party API endpoint in Internet Monitor.
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch Internet Monitor publishes internet health events to Amazon EventBridge by default. The least-effort way to forward these events to a third-party system is to create an EventBridge API destination (third-party API endpoint) and an EventBridge rule that uses Internet Monitor as the event source and routes matching events to that API destination. This uses native integration without additional services like Lambda or S3.
Question 46
A company is running its application servers on Amazon EC2 instances. The EC2 instances run in separate VPCs that are connected by a transit gateway. The EC2 instances launch in a private subnet with a route to the transit gateway for internal and external connectivity. The external connectivity is provided by a VPC with firewall devices that perform an inspection for packets that ingress and egress through an internet gateway.
A network engineer needs to help the company’s application team increase the payload size per packet delivery between the EC2 instances. All network connectivity must be through the transit gateway
What should the network engineer do to meet these requirements?
A. Enable jumbo frames on the transit gateway. Instruct the application team to set the maximum transmission unit (MTU) of the system’s network interfaces to 9001 bytes.
B. Instruct the application team to set the maximum transmission unit (MTU) of the VPC to 8500 bytes.
C. Instruct the application team to set up enhanced networking on the system by using the enhanced networking adapter. Set the maximum transmission unit (MTU) to 9001 bytes.
D. Instruct the application team to set the maximum transmission unit (MTU) of the system’s network interfaces to 8500 bytes.
Show Answer
Correct Answer: D
Explanation: All traffic must traverse the transit gateway, which supports a maximum MTU of 8500 bytes. Any packets larger than 8500 bytes are dropped by the transit gateway. To increase payload size without fragmentation or packet loss, the EC2 instances’ network interfaces must be configured with an MTU of 8500 bytes, matching the transit gateway limit. Options involving 9001-byte MTU are invalid because the transit gateway cannot forward packets of that size.
Question 47
A company is building an internet-facing application that is hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company is using the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes for pod networking connectivity. The company needs to expose its application to the internet by using a Network Load Balancer (NLB).
The pods that host the application must have visibility of the source IP address that is contained in the original packet that the NLB receives.
How should the network engineer configure the NLB and Amazon EKS settings to achieve these goals?
A. Specify the ip target type for the NLB. Set the externalTrafficPolicy attribute to Local in the Kubernetes service specification.
B. Specify the instance target type for the NLSet the externalTrafficPolicy attribute to Cluster in the Kubernetes service specification.
C. Specify the instance target type for the NLB. Set the externalTrafficPolicy attribute to Local in the Kubernetes service specification.
D. Specify the ip target type for the NLB. Set the externalTrafficPolicy attribute to Cluster in the Kubernetes service specification.
Show Answer
Correct Answer: A
Explanation: To preserve the original client source IP when exposing EKS pods through an internet-facing NLB with the Amazon VPC CNI, the NLB must use the ip target type so traffic is sent directly to pod IPs. Additionally, setting externalTrafficPolicy to Local prevents kube-proxy from performing source NAT, ensuring the pod receives the original source IP. Other combinations either introduce SNAT or route traffic through nodes, which obscures the client IP.
Question 48
A retail company is migrating its on-premises application to the AWS Cloud. Currently, the company has two on-premises data center locations. One data center is on the east coast of the United States, and one data center is on the west coast.
Each data center hosts four database systems. The largest database system stores 500 GB of data. The data centers are interconnected by two 10 GbE circuits for data synchronization. Each data center has two separate 1 GbE upstream internet connections. The company plans to have eight total VPCs to service its multiple business units. Four VPCs will be in the us-east-1 Region, and four will be in the us-west-2 Region.
A network engineer needs to design a connectivity solution that allows VPC-to-VPC connectivity. The solution must also allow secure connections between the on-premises data centers and AWS during the migration process. The company expects spikes in traffic among the VPCs during database synchronization. The company wants to run the migration plan during one weekend and as soon as technically possible. The company also wants to minimize long-term operational and human resources costs.
Which combination of steps will meet these requirements? (Choose two.)
A. Deploy one transit gateway and attach all VPCs to it. Update the transit gateway and VPC route tables to allow any VPC to connect to any other VPC.
B. Configure VPC peering between all the VPCs. Update the VPC route tables to allow connectivity.
C. Provision two AWS Direct Connect connections from two Direct Connect locations that serve us-east-1 and us-west-2 to provide connectivity between the data centers and AWS.
D. Provision one transit gateway VPN attachment for each data center to build connectivity between the on-premises data centers and AWS VPCs.
E. Provision one AWS Site-to-Site VPN connection for each data center and for each VPC to build connectivity between the on-premises data centers and AWS VPCs.
Show Answer
Correct Answer: B, E
Explanation: VPC-to-VPC connectivity across Regions can be achieved immediately with inter-Region VPC peering, which avoids additional managed infrastructure and keeps long-term costs low compared with transit gateways for this fixed set of VPCs. For on-premises connectivity during a time‑critical migration, AWS Site‑to‑Site VPNs can be provisioned quickly and securely, unlike Direct Connect, which typically takes weeks to months. Using VPNs provides sufficient bandwidth for a weekend migration and minimizes long‑term operational overhead once the migration completes.
Question 49
A company is migrating its on-premises network from its data center in Virginia to its data center in New York. The AWS Direct Connect connections for the Virginia and New York data center locations are both associated to the us-east-1 Region. The company needs to migrate a private VIF on an existing Direct Connect hosted connection from Virginia to New York. The company's on-premises network uses the connection to access VPCs through a Direct Connect gateway in us-east-1.
The company has already requested a new Direct Connect hosted connection from the new data center to the New York Direct Connect location.
Which solution will meet these requirements with the LEAST downtime?
A. Create a new private VIF on the new Direct Connect hosted connection. Create a new Direct Connect gateway and attach the gateway to the new private VIF. Configure BGP routing on the new private VIF as a backup route. Perform the switchover during a maintenance window by shutting down BGP on the existing private VIF. Decommission the existing Direct Connect connection.
B. Create a new private VIF on the new Direct Connect hosted connection. Attach the new private VIF to the existing Direct Connect gateway. Configure BGP routing on the new private VIF as a backup route. Perform the switchover during a maintenance window by shutting down BGP on the existing private VIF. Decommission the existing Direct Connect connection.
C. During a maintenance window, migrate the existing private VIF to the new Direct Connect hosted connection. Attach the existing private VIF to the existing Direct Connect gateway. Decommission the existing Direct Connect connection.
D. During a maintenance window, delete the existing private VIF and create a new private VIF to the new Direct Connect hosted connection. Attach the new private VIF to the existing Direct Connect gateway. Decommission the existing Direct Connect hosted connection.
Show Answer
Correct Answer: B
Explanation: To achieve the least downtime, the new Direct Connect hosted connection should be brought online in parallel with the existing one. Creating a new private VIF on the new connection and attaching it to the existing Direct Connect gateway allows both connections to operate simultaneously. By configuring BGP so the new VIF is available as a backup, traffic can be shifted by simply adjusting BGP during a maintenance window, avoiding any hard disconnect. Options that migrate, delete, or recreate the existing VIF cause unavoidable downtime, and creating a new Direct Connect gateway is unnecessary.
Question 50
A company is developing an API-based application on AWS for its process workflow requirements. The API will be invoked by clients in the company’s on-premises data centers. The company has set up an AWS Direct Connect connection between on premises and AWS. A network engineer decides to implement the API as a private REST API in Amazon API Gateway. The network engineer wants to ensure that clients can reach the API endpoint through private communication.
Which solution can the network engineer use to invoke the API without any additional infrastructure setup?
A. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the private DNS name of the endpoint.
B. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using an Amazon Route 53 alias of the endpoint.
C. Create an interface VPC endpoint for API Gateway. Associate the endpoint with the private REST API, Access the API by using an Amazon Route 53 alias of the endpoint.
D. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the public DNS name of the endpoint.
Show Answer
Correct Answer: D
Explanation: For a private REST API in API Gateway accessed from on‑premises over AWS Direct Connect, clients can invoke the API using the public DNS name of the interface VPC endpoint without setting up additional infrastructure. Using private DNS names from on‑premises would require extra components such as a Route 53 Resolver inbound endpoint and DNS forwarding. Since the question explicitly requires no additional infrastructure, accessing the private API over Direct Connect via the public DNS name of the VPC endpoint is the correct approach.
Question 51
A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edge location in the us-west-1 Region. A shared services segment exists at both edge locations. Each shared services segment has a VPC attachment to each inspection VPC in each Region. The inspection VPCs inspect traffic from a WAN by using AWS Network Firewall.
The company creates a new segment for a new business unit (BU) in the us-east-1 edge location. The new BU has three VPCs that are attached to the new BU segment. To comply with regulations, the BU VPCs must not communicate with each other. All internet-bound traffic must be inspected in the inspection VPC.
The company updates VPC route tables so any traffic that is bound for internet goes to the AWS Cloud WAN core network.
The company plans to add more VPCs for the new BU in the future. All future VPCs must comply with regulations.
Which solution will meet these requirements in the MOST operationally efficient way? (Choose two.)
A. Update the network policy to share the shared services segment with the BU segment.
B. Create a network policy to share the inspection service segment with the BU segment.
C. Set the isolate-attachments field to True for the BU segment.
D. Set the isolate-attachments field to False for the BU segment.
E. Update the network policy to add static routes for the BU segment. Configure the shared services segment to route traffic related to VPC CIDR blocks to each respective VPC attachment.
Show Answer
Correct Answer: B, C
Explanation: BU VPCs must be isolated from each other and all internet-bound traffic must be inspected. Setting isolate-attachments to True on the BU segment prevents east–west communication between BU VPC attachments and automatically applies to future VPCs. Sharing the inspection service segment with the BU segment ensures all egress traffic from the BU is routed to the inspection VPCs (AWS Network Firewall) without per‑VPC route changes, providing the most operationally efficient and scalable solution.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.