A company has five VPCs in the us-east-1 Region. The company hosts an internal web application in us-east-1. One of the company's VPCs. named VPC-A, needs to connect to an external partner's AWS environment. The partner’s environment is in the same AWS Region where the partner hosts a new version of the company's web application. The partner hosts its version of the application in a VPC named VPC-B.
The company has Amazon EC2 instances in VPC-A that need to connect to the web application in VPC-B A network engineer notices that the partner's VPC-B and the company's VPC-A use the same IP space. The network engineer needs a solution to allow the EC2 instances to connect to the web application. The solution must not negatively affect the exiting environment of the company or the partner.
Which combination of steps should the network engineer take meet these requirements? (Choose two.)
A. Establish a VPC peering connection between VPC-A to VPC-B.
B. Ensure the partner creates a VPC endpoint service that uses a Network Load Balancer in VPC-
C. Deploy a VPC endpoint in VPC-A that uses a VPC endpoint service that is shared by the partner.
D. Deploy a new routable VPC CIDR block as a secondary CIDR block to both VPC-A and VPC-B. Deploy a public NAT gateway in VPC-A.
E. Establish an AWS Site-to-Site VPN connection between VPC-A and VPC-B.
Show Answer
Correct Answer: B, C
Explanation: The correct solution is AWS PrivateLink. When VPCs have overlapping CIDR ranges, VPC peering and Site-to-Site VPN cannot provide IP routing between them. The partner should expose the application through a VPC endpoint service backed by a Network Load Balancer (B), and the company should create an interface VPC endpoint in VPC-A to consume that endpoint service (C). This enables private connectivity without changing either VPC's IP addressing or affecting existing environments.
Question 53
A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are part of an Amazon EC2 Auto Scaling group.
To comply with new security standards, the company must capture all application access data, including server response codes, request paths, latency, and client IP addresses. The company also needs to query the captured data for performance analysis.
Which solution will meet these requirements?
A. Enable VPC flow logs on the ALB subnets. Store the logs to an Amazon S3 bucket. Query the logs in the S3 bucket by using Amazon Athena.
B. Configure Amazon VPC Traffic Mirroring on all EC2 elastic network interfaces. Deploy a third-party monitoring appliance from AWS Marketplace in a private subnet. Use Amazon Data Firehose to send all mirrored traffic to the monitoring appliance. Query the logs directly from the monitoring appliance.
C. Configure Amazon CloudWatch detailed monitoring on the EC2 instances Include all available logs. Use Amazon Data Firehose to send all the collected logs to an Amazon S3 bucket. Query the data directly from the S3 bucket.
D. Enable access logs on the ALB. Store the logs in an Amazon S3 bucket. Query the logs in the S3 bucket by using Amazon Athena.
Show Answer
Correct Answer: D
Explanation: Application Load Balancer access logs record detailed request information including client IP address, request URL/path, target and load balancer response codes, processing latency, and other request metadata. ALB access logs are delivered to Amazon S3, where Amazon Athena can query them for performance analysis. VPC Flow Logs capture network flow metadata only, not HTTP request paths or response codes. Traffic Mirroring is unnecessary and complex for this requirement. CloudWatch detailed monitoring provides metrics rather than comprehensive HTTP access logs.
Question 54
A company is planning to migrate to AWS and use multiple VPCs in multiple AWS Regions. A network engineer must connect the eu-west-1 and eu-central-1 Regions to the company headquarters and branch office, respectively.
The network engineer created a production VPC, named Prod A, with a CIDR block of 10.0.0.0/16. Prod A runs in an account in eu-west-1. The network engineer then created another production VPC, named Prod B, with a CIDR block of 10.1.0.0/16. Prod В runs in a different account in eu-central-1.
The network engineer performed the following steps to try to achieve the required connectivity:
1. Created one transit gateway in each Region
2. Shared and accepted the transit gateways with the production accounts in both Regions
3. Configured the peering attachment between both transit gateways
4. Attached both VPCs to the respective Region transit gateway
5. Created both transit gateway route tables and associated the attachments with the route tables
6. Configured a static route in both transit gateway route tables to send traffic to the remote VPC in the other Region
7. Activated route propagation on the VPC route tables in each Region
After the configuration, the network engineer tried to connect from Prod A to Prod B. However, the connection was unsuccessful.
What should the network engineer do to achieve the required connectivity?
A. Modify the IP address of the peering attachment to a wider range.
B. Delete the static routes that were in the transit gateway route table to send traffic to the remote VPC and enable route propagation instead.
C. Create a new route destined to 10.0.0.0/8 in both production VPC route tables with the Region transit gateway as the target.
D. Modify the transit gateway route tables from the production accounts to propagate routes dynamically between the production VPCs.
Show Answer
Correct Answer: C
Explanation: Transit gateway route propagation does not automatically update VPC route tables. Inter-Region transit gateway peering requires static routes in the transit gateway route tables, and each attached VPC must also have routes that direct the remote CIDR through its local transit gateway. Adding a route in each VPC route table that covers the remote network via the transit gateway completes the end-to-end path. Among the options, adding a 10.0.0.0/8 route to the transit gateway achieves connectivity, although using the specific remote CIDR would be a more precise design.
Question 55
A company is planning to use an AWS Transit Gateway hub and spoke architecture to migrate to AWS. The current on-premises multi-protocol label switching (MPLS) network has strict controls that enforce network segmentation by using MPLS VPNs. The company has provisioned two 10 Gbps AWS Direct Connect connections to provide resilient, high-speed, low-latency connectivity to AWS.
A security engineer needs to apply the concept of network segmentation to the AWS environment to ensure that virtual routing and forwarding (VRF) is logically separated for each of the company's software development environments. The number of MPLS VPNs will increase in the future. On-premises MPLS VPNs will have overlapping address space. The company's AWS network design must support overlapping address space for the VPNs.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy a software-defined WAN (SD-WAN) head-end virtual appliance and an SD-WAN controller into a Transit Gateway Connect VPC. Configure the company's edge routers to be managed by the new SD-WAN controller and to use SD-WAN to segment the traffic into the defined segments for each of the company's development environments.
B. Configure IPsec VPNs on the company edge routers for each MPLS VPN for each of the company's development environments. Attach each IPsec VPN tunnel to a discrete MPLS VPN. Configure AWS Site-to-Site VPN connections that terminate at a transit gateway for each MPLS VPN. Configure a transit gateway route table that matches the MPLS VPN for each Transit Gateway VPN attachment.
C. Create a transit VPC that terminates at the AWS Site-to-Site VRF-aware IPsec VPN. Configure IPsec VPN connections to each VPC for each of the company's development environment VRFs.
D. Configure a Transit Gateway Connect attachment for each MPLS VPN between the company's edge routers and Transit Gateway. Configure a transit gateway route table that matches the MPLS VPN for each of the company's development environments.
Show Answer
Correct Answer: D
Explanation: Transit Gateway Connect is designed to integrate high-performance routing over Direct Connect and supports dynamic routing with GRE/BGP. Using separate Transit Gateway Connect attachments and transit gateway route tables per MPLS VPN provides logical VRF-like segmentation with low operational overhead, scales as additional VPNs are added, and aligns with a Transit Gateway hub-and-spoke architecture. The alternatives either introduce unnecessary SD-WAN infrastructure, require many individual IPsec VPNs, or rely on a transit VPC design that has higher operational complexity.
Question 56
A company is planning to host a secure web application across multiple Amazon EC2 instances. The application will have an associated DNS domain in an Amazon Route 53 hosted zone.
The company wants to protect the domain from DNS poisoning attacks. The company also wants to allow web browsers to authenticate into the application by using a trusted third party.
Which combination of actions will meet these requirements?
A. Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install self-signed X.509 certificates on the EC2 instances.
B. Configure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install X 509 certificates that are signed by a public certificate authority on the EC2 instances.
C. Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install X.509 certificates that are signed by a public certificate authority on the EC2 instances.
D. Configure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install self-signed X.509 certificates on the EC2 instances.
Show Answer
Correct Answer: C
Explanation: DNSSEC on the Route 53 hosted zone protects against DNS cache poisoning and spoofing by allowing DNS responses to be validated. Browsers authenticate HTTPS servers using X.509 certificates signed by a trusted public certificate authority, not self-signed certificates. NAPTR records are unrelated to these requirements.
Question 57
A company’s data center is connected to a single AWS Region by an AWS Direct Connect dedicated connection. The company has a single VPC in the Region. The company stores logs for all its applications locally in the data center.
The company must keep all application logs for 7 years. The company decides to copy all application logs to an Amazon S3 bucket.
Which solution will meet these requirements?
A. Create a public VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint in the VPC.
B. Create a private VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint in the VPC.
C. Create a private VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VP
D. Create a public VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VPC.
Show Answer
Correct Answer: C
Explanation: Amazon S3 gateway endpoints are only usable from within the VPC and cannot be accessed directly from on-premises over Direct Connect. To access S3 privately from an on-premises data center through Direct Connect, use a private VIF to reach the VPC and an Amazon S3 interface endpoint (AWS PrivateLink), whose ENIs are reachable over the private VIF. A public VIF is used to access AWS public services directly, but pairing it with VPC endpoints is unnecessary and gateway endpoints do not solve on-premises access.
Question 58
A finance company runs multiple applications on Amazon EC2 instances in two VPCs that are within a single AWS Region. The company uses one VPC for stock trading applications. The company uses the second VPC for financial applications. Both VPCs are connected to a transit gateway that is configured as a multicast router.
In the stock trading VPC, an EC2 instance that has an IP address of 10.128.10.2 sends trading data over a multicast network to the 239.10.10.10 IP address on UDP Port 5102. The company recently launched two new EC2 instances in the financial application VPC. The new EC2 instances need to receive the multicast stock trading data from the EC2 instance that is in the stock trading VPC.
Which combination of steps should the company take to meet this requirement? (Choose three.)
A. Add the elastic network interfaces of the two new EC2 instances as members of the multicast group by using the group IP address of 239.10.10.10.
B. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows: Protocol: IGMP Version 2. Port: 5102, and Source: 239 10.10.10/32
C. Create associations to two EC2 instance IDs on the financial application VPC transit gateway attachment under the transit gateway multicast domain.
D. Create an association to EC2 instance subnets on the financial application VPC transit gateway attachment under the transit gateway multicast domain. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows: Protocol: IGMP Version 2. Port: All, and Source: 0 0.0.0/32
E. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows. Protocol: UDP, Port: 5102, and Source: 10.128.10.2/32
Show Answer
Correct Answer: A, D, E
Explanation: Transit Gateway multicast requires associating the receiver subnets with the multicast domain and registering the receiver ENIs as multicast group members. Security groups do not use IGMP rules; they must allow the actual UDP application traffic from the sender. Therefore the receivers need UDP port 5102 allowed from the source 10.128.10.2. Associating individual EC2 instance IDs is not how Transit Gateway multicast domain associations are configured; subnet associations are used.
Sources:
https://aws.amazon.com/blogs/industries/cme-group-mdp-multicast-data-access-on-aws-using-transit-gateway
https://aws.amazon.com/blogs/networking-and-content-delivery/modernizing-financial-networks-huatai-securities-multicast-implementation-on-aws
Question 59
A company has VPCs in the us-east-1 Region that are connected to each other through a transit gateway. A network engineer needs to establish an AWS Direct Connect connection between the company's on-premises data center and the transit gateway for the migration of a workload.
The Direct Connect connection is UP according to the ConnectionState metric in Amazon CloudWatch. However, the VIF is DOWN. The network engineer has verified the transit VIF and BGP configurations on the on-premises router and has found no issues. However, the network engineer is unable to ping the Amazon peer IP address.
Which combination of steps should the network engineer take to troubleshoot this issue? (Choose three.)
A. Verify that the correct IP address and subnet mask are in use for the subinterface on the router.
B. Ensure that VLAN trunking is disabled on the router.
C. Verify that the router has a MAC address entry from the AWS endpoint in the Address Resolution Protocol (ARP) table.
D. Verify that the optical signal that is received over the cross connect is optimal.
E. Ensure that the correct VLAN tag is applied on the subinterface configuration on the router.
F. Ensure that TCP port 179 is not being blocked at the on-premises router.
Show Answer
Correct Answer: A, C, E
Explanation: A Direct Connect connection being UP while the VIF is DOWN, combined with inability to ping the Amazon peer IP, points to a Layer 2/subinterface configuration problem rather than BGP. Verify the subinterface IP address and subnet mask match the VIF configuration (A), confirm the router can resolve the AWS endpoint MAC via ARP (C), and ensure the configured VLAN tag matches the VLAN assigned to the VIF (E). The physical link is already up, making optical issues less likely (D). TCP port 179 affects BGP after basic connectivity exists, and failure to ping the peer indicates the problem is below that layer (F). VLAN trunking is required to carry tagged subinterfaces, so disabling it is not appropriate (B).
Question 60
A company wants to implement a distributed architecture on AWS that uses a Gateway Load Balancer (GWLB) and GWLB endpoints.
The company has chosen a hub-and-spoke model. The model includes a GWLB and virtual appliances that are deployed into a centralized appliance VPC and GWLB endpoints. The model also includes internet gateways that are configured in spoke VPCs.
Which sequence of traffic flow to the internet from the spoke VPC is correct?
A. 1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration. 2. Traffic is delivered securely and privately to the GWLB. 3. The GWLB sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway.
B. 1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration. 2. Traffic is delivered securely and privately to the GWLB endpoint. 3. The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB and out to the internet through an internet gateway.
C. 1. An application in a spoke VPC sends traffic to the GWLB endpoint. 2. Traffic is delivered securely and privately to the GWLB. 3. The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway.
D. 1. An application in a spoke VPC sends traffic to the GWLB. 2. Traffic is delivered securely and privately to the GWLB endpoint. 3. The GWLB sends the traffic to a virtual appliance for inspection. 4. Return traffic flows back to the GWLB and out to the internet through an internet gateway.
Show Answer
Correct Answer: A
Explanation: In a hub-and-spoke design with Gateway Load Balancer, workloads in the spoke VPC send traffic to the local Gateway Load Balancer endpoint (GWLBE) based on route table entries. The endpoint privately forwards the traffic to the GWLB in the centralized appliance VPC, which steers it to a virtual appliance using GENEVE for inspection. After inspection, the traffic returns symmetrically through the GWLB and GWLB endpoint before exiting the spoke VPC through its internet gateway. Options B and C are incorrect because GWLB does not set the X-Forwarded-For header (that is an Application Load Balancer feature). Option D is incorrect because workloads do not route directly to the GWLB; they route to the GWLB endpoint.
Question 61
A company has a VPC that includes application workloads that run on Amazon EC2 instances in a single AWS Region. The company wants to use AWS Local Zones to deploy an extension of the application workloads that run in the Region. The extended workloads in the Local Zone need to communicate bidirectionally with the workloads in the VPC in the Region.
Which solution will meet these requirements MOST cost-effectively?
A. Create a new VPC in the Local Zone. Attach all the VPCs to a transit gateway. Configure routing for the transit gateway and the VPCs. Deploy instances in the new VPC.
B. Deploy a third-party appliance in a new VPC in the Region. Create a new VPC in the Local Zone. Create VPN connections to the appliance for the VPCs. Deploy instances in the new VPC in the Local Zone.
C. Create a new subnet in the Local Zone. Deploy a third-party appliance in the VPC with interfaces in each subnet. Configure the new subnet to route the Local Zone through the appliance. Deploy instances in the new subnet.
D. Create a new subnet in the Local Zone. Configure the new subnet to use a CIDR block that is within the VPC’s CIDR block. Deploy instances in the new subnet in the Local Zone.
Show Answer
Correct Answer: D
Explanation: AWS Local Zones are extensions of an existing Region and are designed to work as part of the same VPC. To extend workloads into a Local Zone, create a subnet in the Local Zone that uses an IP range from the existing VPC CIDR, then launch EC2 instances into that subnet. Because the Local Zone subnet belongs to the same VPC, workloads communicate bidirectionally using native VPC networking without Transit Gateway, VPNs, or third-party appliances, making this the most cost-effective solution.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.