A company has multiple AWS Site-to-Site VPN connections between an on-premises environment and multiple VPCs. The Site-to-Site VPN connections use virtual private gateways and are configured with IPv4 addresses. The company hosts several internal applications in the VPCs.
Application users have reported that the applications are performing slowly. A network engineer notices excessive latency in the network path that the VPN connections use. The network engineer needs to resolve the excessive latency.
Which solution will meet this requirement?
A. Use AWS Global Accelerator to deploy an accelerator on the existing Site-to-Site VPN connections.
B. Deploy a transit gateway and a new accelerated Site-to-Site VPN connection.
C. Replace the existing Site-to-Site VPN connections with new Site-to-Site VPN connections that use IPv6.
D. Replace the existing Site-to-Site VPN connections with AWS PrivateLink connections.
Show Answer
Correct Answer: B
Explanation: Accelerated Site-to-Site VPN uses the AWS Global Network to reduce latency, but VPN acceleration is supported only for Site-to-Site VPN connections that are attached to an AWS Transit Gateway, not virtual private gateways. Deploying a transit gateway and creating a new accelerated Site-to-Site VPN addresses excessive latency. Global Accelerator does not accelerate existing VPN tunnels, IPv6 does not inherently reduce latency, and AWS PrivateLink is not a replacement for site-to-site network connectivity.
Question 43
A company uses AWS Network Firewall to protect outgoing traffic for multiple VPCs that are in the same AWS account. Each VPC contains Amazon EC2 instances that host the company's applications. Each EC2 instance is tagged with the name of the application it hosts. The EC2 instances are in Auto Scaling groups.
A Network Firewall stateful rule group must remain up-to-date, even when an Auto Scaling group launches and terminates EC2 instances.
Which solution will meet this requirement with the LEAST implementation and administrative effort?
A. Create a network ACL for each application. Reference the network ACL in the stateful rule group.
B. Create a prefix list for each application. Reference the prefix list in the stateful rule group.
C. Create an AWS Lambda function that queries the EC2 instance tags for each application name and then updates the stateful rule group with the IP address of each instance.
D. Create a resource group for each application name. Reference the Amazon Resource Name (ARN) for the resource groups in the stateful rule group.
Show Answer
Correct Answer: D
Explanation: AWS Network Firewall supports referencing AWS Resource Groups in stateful rule IP set references. A tag-based resource group automatically tracks EC2 instances as Auto Scaling launches and terminates them, so firewall rules remain current without custom automation. Network ACLs cannot be referenced by Network Firewall rules, prefix lists require managing IP/CIDR entries rather than tag-based instance membership, and a Lambda solution adds unnecessary operational overhead.
Question 44
A company uses AWS Site-to-Site VPN connections to encrypt traffic between the company's on-premises location and a single VPC. The Site-to-Site VPN connections use two 1 Gbps AWS Direct Connect connections with public VIFs. The company plans to add 15 additional VPCs in the same AWS Region.
The company must maintain the same level of encryption that the Site-to-Site VPN connections currently provide for each connection between the on-premises location and the new VPCs. The new connections must not use public IP addresses. The bandwidth of the Site-to-Site VPN connections will remain less than the current provisioned speed.
Which combination of steps will meet these requirements with LEAST operational overhead? (Choose three.)
A. Create a transit gateway and a Direct Connect gateway. Associate the transit gateway with the Direct Connect gateway. Attach all the new VPCs to the transit gateway.
B. For each new VPC, create a new Direct Connect private VIF to a Direct Connect gateway. Associate all VPCs with the Direct Connect gateway.
C. Assign a private IP CIDR block to the transit gateway.
D. Assign a public IP CIDR block to the transit gateway.
E. Create a transit VIF to the Direct Connect gateway. Create a Site-to-Site VPN private IP VPN connection.
F. Create a public VICreate a Site-to-Site VPN public IP VPN connection.
Show Answer
Correct Answer: A, C, E
Explanation: Use a transit gateway attached to a Direct Connect gateway to centrally connect multiple VPCs with minimal operational overhead. Use a transit VIF and a Site-to-Site VPN with private IP addressing over Direct Connect to preserve VPN encryption without using public IP addresses. The transit gateway must use private addressing for the private IP VPN connectivity.
Question 45
A company has an application VPC and a networking VPC that are connected through VPC peering. The networking VPC contains a Network Load Balancer (NLB). The application VPC contains Amazon EC2 instances that run an application. The EC2 instances are part of a target group that is associated with the NLB in the networking VPC.
The company configures a third VPC and peers it to the networking VPC. The new VPC contains a new version of the existing application. The new version of the application runs on new EC2 instances in an application subnet. The new version of the application runs in a different Availability Zone than that original version of the application.
The company needs to establish connectivity between the NLB and the new version of the application.
Which combination of steps will meet this requirement? (Choose three.)
A. Register the new application EC2 instances with the NLB by using the instance IDs.
B. Register the new application EC2 instances with the NLB by using instance IP addresses.
C. Configure the NLB in the Availability Zone where the new application EC2 instances run.
D. Configure the NLB to use zonal shift.
E. Configure the network ACL for the application subnet in the new VPC to allow outbound connections.
F. Configure the network ACL for the application subnet in the new VPC to allow inbound connections and outbound connections.
Show Answer
Correct Answer: B, C, F
Explanation: Network Load Balancers can register targets in a peered VPC only by IP address, not by instance ID. The NLB must be enabled in the Availability Zone where the targets reside so it can create a load balancer node there. Network ACLs are stateless, so the application subnet must allow both inbound and outbound traffic for the connection to function. Zonal shift is unrelated to establishing connectivity.
Question 46
A company runs workloads in multiple VPCs. The company needs to securely access a workload in one of the VPCs, named VPC-A, from an on-premises data center. A network engineer sets up an AWS Site-to-Site VPN connection to a transit gateway. The network engineer configures dynamic routing for the connection, and communication works properly.
Recently, the owner of VPC-A added another CIDR range to the VPC. The VPC-A owner created workloads that use the additional CIDR range.
The company's on-premises network is unable to reach the new workloads. The network engineer needs to resolve the network connectivity issue and ensure that connectivity will not be affected if additional VPC CIDR ranges are added to the VPC in the future.
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure route propagation for VPC-A to the VPN attachment route table.
B. Manually update the VPN attachment route table to include the new CIDR range.
C. Configure an Amazon EventBridge rule to invoke an AWS Lambda function when the rule to matches an update to the VPC-A CIDR range. Configure the Lambda function to update the VPN attachment route table.
D. Configure an Amazon CloudWatch alarm to invoke an AWS Lambda function when there is an update to the VPC-A CIDR range. Configure the Lambda function to update the VPN attachment route table. Restart the VPN tunnels.
Show Answer
Correct Answer: A
Explanation: With a transit gateway and dynamic routing over Site-to-Site VPN (BGP), enabling route propagation from the VPC attachment into the VPN attachment's transit gateway route table allows newly associated VPC CIDR blocks to be propagated automatically. This avoids manual route updates and continues to work if additional CIDR blocks are added in the future. Manually updating routes or automating updates with Lambda is less operationally efficient, and CloudWatch alarms are not the appropriate mechanism.
Question 47
A US-based company is expanding its business to Europe. A network engineer needs to extend the company's network infrastructure by setting up a new hub and spoke architecture in the eu-west-1 Region. The network engineer uses a transit gateway peering connection to connect the new resources in eu-west-1 to an existing environment in the us-east-1 Region.
The hub and spoke architecture in each AWS Region includes an inspection VPC that uses AWS Network Firewall to centralize traffic inspection for each Region. To reduce costs, the network engineer decides to inspect inter-Region traffic by using the inspection VPC in the Region that originates the traffic. The network engineer configures the transit gateway route tables accordingly for each Region.
When the network engineer tests the new architecture, communication within each Region works as expected. However, the network engineer finds that inter-Region communication is not working. The network engineer must resolve the inter-Region communication issue.
Which solution will meet this requirement?
A. Configure Open Shortest Path First (OSPF) routing on the transit gateway peering connection to propagate the VPC CIDR blocks from each Region to the remote peer.
B. Use AWS Resource Access Manager (AWS RAM) to share access between the transit gateways. Enable the Allow sharing with anyone setting.
C. Prevent asymmetric routing in the inspection VPCs by ensuring that both requests and responses are inspected by the same inspection VPC
D. Enable Appliance mode on both the transit gateway attachments for the inspection VPC.
Show Answer
Correct Answer: D
Explanation: The issue is caused by stateful inspection through AWS Network Firewall behind a Transit Gateway. Transit Gateway appliance mode must be enabled on the inspection VPC attachments so that flows remain symmetric and both directions of a connection are forwarded through the same firewall appliance/AZ path. OSPF is not supported on Transit Gateway peering, AWS RAM is unrelated to this routing problem, and merely stating that asymmetric routing should be prevented does not implement the required Transit Gateway behavior; appliance mode is the mechanism that achieves it.
Question 48
A company runs applications in two VPCs that are in separate AWS Regions. One VPC is in the us-east-1 Region. The second VPC is in the us-west-1 Region. The company needs to establish connectivity between the two VPCs. The company also needs to connect the VPCs to applications that run in an on-premises data center.
The current traffic requirement between the VPCs is 50 ТВ per month. The company expects traffic volume between the VPCs to increase. The traffic requirement from the VPCs to the on-premises data center is 10 ТВ per month. The company expects the traffic between the VPCs and the data center to remain constant.
Which solution will meet these requirements MOST cost-effectively?
A. Create a transit gateway in each Region. Create VPN connections from the transit gateways to the on-premises firewall. Create a peering connection between the transit gateways.
B. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Configure the on-premises firewall to route the traffic between the two VPCs.
C. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Create a VPC peering connection between the two VPCs.
D. Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Create a VPN connection between the virtual private gateways.
Show Answer
Correct Answer: C
Explanation: Use a virtual private gateway and VPN from each VPC to the on-premises data center, and connect the two VPCs with inter-Region VPC peering. With only two VPCs, Transit Gateway introduces additional hourly and data processing costs that are not justified. Inter-Region VPC peering supports direct connectivity and is generally the most cost-effective option for a simple two-VPC topology, while keeping the on-premises VPN traffic separate. Routing VPC-to-VPC traffic through the on-premises network is inefficient and increases on-premises bandwidth usage, and VPN between virtual private gateways is not supported.
Question 49
A company hosts application servers on premises and on Amazon EC2 instances in a VPC. The application servers access data that is hosted in an Amazon S3 bucket through the public internet. The EC2 instances in the VPC use an AWS Site-to-Site VPN for connectivity with the on-premises application servers.
New company regulations state that all traffic between the application servers and the S3 bucket must remain private and must not use public IP addresses.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an S3 gateway endpoint Modify the route table with the appropriate route for the endpoint. Access the S3 bucket through the gateway endpoint from the EC2 instances.
B. Configure an S3 interface endpoint. Update the on-premises servers and EC2 instances to use the interface endpoint DNS name to access the S3 bucket.
C. Configure an S3 interface endpoint. Update the on-premises servers to use the interface endpoint DNS name to access the S3 bucket. Configure an S3 gateway endpoint. Modify the route table so that the EC2 instances use the gateway endpoint.
D. Configure an S3 gateway endpoint. Modify the route table with the appropriate route for the endpoint. Use an S3 bucket policy to restrict access to the gateway endpoint. Configure a proxy server fleet behind a Network Load Balancer in the VPC so that the on-premises servers can access the S3 bucket.
Show Answer
Correct Answer: C
Explanation: Gateway endpoints for Amazon S3 are free and are the most cost-effective option for resources inside the VPC, but they cannot be used from on-premises networks over Site-to-Site VPN. On-premises servers require an S3 interface VPC endpoint (AWS PrivateLink), which is reachable privately over the VPN using the endpoint's private DNS. Therefore, use a gateway endpoint for the EC2 instances and an interface endpoint for the on-premises servers. Option B would work but would unnecessarily incur interface endpoint charges for the EC2 traffic as well, making it less cost-effective.
Question 50
A company needs to capture and log traffic for Nitro-based Amazon EC2 instances to comply with regulations. The company's network team has prepared a solution that enables VPC traffic mirroring and sends traffic to a second set of EC2 instances in an Auto Scaling group.
The network team has added a Network Load Balancer (NLB) in front of the EC2 instances the traffic will be sent to. However, the solution does not send any mirrored traffic to the EC2 instances that are behind the NLB.
How should the network team configure traffic mirroring to use the NLB endpoint?
A. Select the NLB as a source for traffic mirroring. Use a UDP listener.
B. Select the NLB as a target for traffic mirroring. Use a TCP listener and a UDP listener.
C. Select the NLB as a target for traffic mirroring. Use a TCP listener.
D. Select the NLB as a target for traffic mirroring. Use a UDP listener.
Show Answer
Correct Answer: D
Explanation: Amazon VPC Traffic Mirroring sends mirrored packets to a traffic mirror target using VXLAN encapsulation over UDP (destination port 4789). When using a Network Load Balancer as the traffic mirror target, the NLB must be configured as the target with a UDP listener to forward the mirrored UDP traffic to the monitoring instances. An NLB cannot be the traffic mirror source, and TCP listeners will not receive the VXLAN-encapsulated mirrored traffic.
Question 51
A company has a hybrid environment that connects an on-premises data center to the AWS Cloud. The hybrid environment uses a 10 Gbps AWS Direct Connect dedicated connection. The Direct Connect connection has multiple private VIFs that terminate in multiple VPCs.
To comply with regulations, the company must encrypt all WAN traffic, regardless of the underlying transport. The company needs to implement an encryption solution that will not affect the company's bandwidth capacity.
Which solution will meet these requirements?
A. Create a public VIF. Configure a new AWS Site-to-Site VPN connection to use the new public VIF.
B. Configure MAC security (MACsec) support on the port of the existing Direct Connect connection. Change the encryption mode to must_encrypt.
C. Configure a new Direct Connect connection that supports MAC security (MACSec) Associate the existing VIFs to the new Direct Connect connection.
D. Create a public VIF. Configure a new private IP VPN that uses the Direct Connect connection.
Show Answer
Correct Answer: C
Explanation: MACsec is the only option that provides line-rate encryption on AWS Direct Connect without reducing available bandwidth. Site-to-Site VPN or private IP VPN add IPsec encapsulation and can impact throughput. MACsec cannot simply be enabled on an existing non-MACsec Direct Connect connection; a MACsec-capable Direct Connect connection is required, after which the VIF configuration must be migrated to the new connection.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.