A banking company has an application that must connect to specific public IP addresses from a VPC. A network engineer has configured routes in the route table that is associated with the application’s subnet to the required public IP addresses through an internet gateway.
The network engineer needs to set up email notifications that will alert the network engineer when a user adds a default route to the application subnet's route table with the internet gateway as a target.
Which solution will meet these requirements with the LEAST implementation effort?
A. Create an AWS Lambda function that reads the routes in the route table and sends an email notification. Configure the Lambda function to send an email notification if any route is configured with 0.0.0.0/0 or ::/0 CIDRs to the internet gateway. Configure the Lambda function to run every minute.
B. Create an AWS Lambda function that will be invoked by an Amazon EC2 CreateRoute API call. Configure the Lambda function to send an email notification. Configure the Lambda function to send an email notification if any route is configured with 0.0.0.0/0 or ::/0 CIDRs to the internet gateway.
C. Create AWS Config rules for the route table by using the internet-gateway-authorized-vpc-only managed rule. Create an Amazon EventBridge rule to match the AWS Config rule and to route to an Amazon Simple Notification Service (Amazon SNS) topic to send an email notification.
D. Create an AWS Config rule for the route table by using the no-unrestricted-route-to-igw managed rule. Create an Amazon EventBridge rule to match the AWS Config rule and to route to an Amazon Simple Notification Service (Amazon SNS) topic to send an email notification.
Show Answer
Correct Answer: D
Explanation: The requirement is to detect when a default route (0.0.0.0/0 or ::/0) is added to a route table with an internet gateway target and send an email alert, with the least implementation effort. The AWS Config managed rule **no-unrestricted-route-to-igw** is purpose-built to evaluate route tables for exactly this condition. Using this managed rule avoids custom code, polling, or API handling. An Amazon EventBridge rule can react to the NON_COMPLIANT evaluation and trigger Amazon SNS to send email notifications. The other options require custom Lambda functions or use an unrelated Config rule, which increases effort or does not meet the requirement precisely.
Question 53
A company uses the us-east-1 Region and the ap-south-1 Region for its business units (BUs). The BUS are named BU-1 and BU-Z. For each BU, there are two VPCs in us-east-1 and one VPC in ap-south-1.
Because of workload isolation requirements, resources can communicate within the same BU but cannot communicate with resources in the other BU. The company plans to add more BUs and plans to expand into more Regions
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure an AWS Cloud WAN network that operates in the required Regions. Attach all BU VPCs to the AWS Cloud WAN core network. Update the AWS Cloud WAN segment actions to configure new routes to deny traffic between the different BU segments.
B. Configure a transit gateway in each Region. Configure peering between the transit gateways. Attach the BU VPCs to the transit gateway in the corresponding Region. Configure the transit gateway and VPC route tables to isolate traffic between BU VPCs.
C. Configure an AWS Cloud WAN network that operates in the required Regions. Attach all BU VPCs to the AWS Cloud WAN core network. Update the core network policy by setting the isolate-attachments parameter for each segment.
D. Configure an AWS Cloud WAN network that operates in the required Regions. Create AWS Cloud WAN segments for each BU Configure VPC attachments for each BU’s VPCs to the corresponding BU segment.
Show Answer
Correct Answer: D
Explanation: Using AWS Cloud WAN segments per BU provides native, scalable isolation. By creating a segment for each BU and attaching only that BU’s VPCs to its segment, communication is automatically allowed within a BU and denied across BUs without complex route tables or deny rules. This approach scales efficiently as new BUs and Regions are added and requires less ongoing operational overhead than transit gateway peering or segment action–based denies.
Question 54
A company has a VPC in the AWS Cloud. The company recently acquired a competitor that also has a VPC the AWS Cloud. A network engineer discovers an IP address overlap between the two VPCs. Both VPCs require access to an AWS Marketplace partner service.
Which solution will ensure interoperability among the VPC hosted services and the AWS Markelplace partner service?
A. Configure VPC peering with static routing between the VPCs. Configure an AWS Site-to-Site VPN connection with static routing to the partner service.
B. Configure a NAT gateway in the VPCs. Configure default routes in each VPC to point to the local NAT gateway. Attach each NAT gateway to a transit gateway. Configure an AWS Site-to-Site VPN connection with static routing to the partner service.
C. Configure AWS PrivateLink to facilitate connectivity between the VPCs and the partner service. Use the DNS name that is created with the associated interface endpoints to route traffic between the VPCs and the partner service.
D. Configure a NAT instance in the VPCs. Configure default routes in each VPC to point to the local NAT instance. Configure an interface endpoint in each VPC to connect to the partner service. Use the DNS name that is created with the associated interface endpoints to route traffic between the VPCs and the partner service.
Show Answer
Correct Answer: C
Explanation: The VPCs have overlapping CIDR ranges, which prevents direct connectivity methods such as VPC peering or transit gateway routing. AWS PrivateLink is specifically designed to provide access to AWS Marketplace and partner services without requiring IP-level connectivity between VPCs. Each VPC creates an interface endpoint with its own private IPs and DNS name, allowing services in both VPCs to consume the partner service independently while avoiding any IP address conflicts.
Question 55
A financial company offers investment forecasts and recommendations to authorized users through the internet. All the services are hosted in the AWS Cloud. A new compliance requirement states that all the internet service traffic from any host must be logged and retained for 2 years. In its development AWS accounts, the company has designed, tested, and verified a solution that uses Amazon VPC Traffic Mirroring with a Network Load Balancer (NLB) as the traffic mirror target. While the solution runs in one AWS account, the solution mirrors the traffic to another AWS account.
A network engineer notices that not all traffic is mirrored when the solution is deployed into the production environment. The network engineer also notices that this behavior is random.
Which statements are possible explanations for why not all the traffic is mirrored? (Choose two.)
A. The security groups are misconfigured on the production AWS account that hosts the company’s services.
B. The Amazon EC2 instance that is being monitored cannot handle the extra traffic that Traffic Mirroring has introduced.
C. The IAM policy that allows the creation of traffic mirror sessions is misconfigured
D. The mirrored traffic has a lower priority than the production traffic and is being dropped when network congestion occurs.
E. The NLB is experiencing warm-up delay because of sudden and significant increases in traffic.
Show Answer
Correct Answer: B, D
Explanation: Amazon VPC Traffic Mirroring consumes additional network bandwidth on the source EC2 instances. If an instance cannot handle the extra mirrored traffic, packets can be dropped, which can appear random (B). In addition, mirrored traffic is treated as lower priority than production traffic. During periods of network congestion, AWS may drop mirrored packets first, leading to incomplete and seemingly random mirroring (D). Other options do not align with the random, partial nature of the issue.
Question 56
A company is using third-party firewall appliances to monitor and inspect traffic on premises. The company wants to use the same model on AWS. The Company has a single VPC with an internet gateway. The VPC has a fleet of web servers that run on Amazon EC2 instances that are managed by an Auto Scaling group.
The company’s network team needs to work with the security team to establish inline inspection of all packets that are sent to and from the web servers. The solution must scale as the fleet of virtual firewall appliances scales
Which combination of steps should the network team take to implement this solution? (Choose three.)
A. Create a new VPC, and deploy a fleet of firewall appliances. Create a Gateway Load Balancer. Add the firewall appliances as targets.
B. Create a security group for use with the firewall appliances, and allow port 443. Allow a port for the Galeway Load Balancer to perform health checks.
C. Create a security group for use with the firewall appliances, and allow port 6081. Allow a port for the Gateway Load Balancer to perform health checks.
D. Deploy a fleet of firewall appliances to the existing VPC. Create a Gateway Load Balancer. Add the firewall appliances as targets.
E. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.
F. Create a new route table inside the web server VPC. Create a new edge association with the internet gateway. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.
Show Answer
Correct Answer: A, C, E
Explanation: Inline traffic inspection at scale on AWS is achieved with AWS Gateway Load Balancer (GWLB). The correct steps are: deploy the firewall appliances behind a GWLB (best practice is a dedicated inspection VPC) [A]; configure the firewall appliance security group to allow GENEVE traffic on port 6081, which is required by GWLB, plus health checks [C]; and update the existing route tables so that internet-bound and return traffic from the web server subnets is routed to the GWLB VPC endpoint, while the endpoint subnet routes traffic back to the internet gateway [E]. Creating a new edge-associated route table (F) is not required because existing IGW route tables can be updated.
Question 57
A company has many application VPCs that use AWS Site-to-Site VPN connections for connectivity to an on-premises location. The company’s network team wants to gradually migrate to AWS Transit Gateway to provide VPC-to-VPC connectivity.
The network team sets up a transit gateway that uses equal-cost multi-path (ECMP) routing. The network team attaches two temporary VPCs to the transit gateway for testing. The test VPCs contain Amazon EC2 instances to confirm connectivity over the transit gateway between the on-premises location and the VPCs. The network team creates two new Site-to-Site VPN connections to the transit gateway.
During testing, the network team cannot reach the required bandwidth of 2.5 Gbps over the pair of new Site-o-Site VPN connections.
Which combination of steps should the network team take to improve bandwidth performance and minimize network congestion? (Choose three.)
A. Enable acceleration for the existing Site-to-Site VPN connections to the transit gateway.
B. Create new accelerated Site-to-Site VPN connections to the transit gateway.
C. Advertise the on-premises prefix to AWS with the same BGP AS_PATH attribute across all the Site-to-Site VPN connections.
D. Advertise the on-premises prefix to AWS with a different BGP AS_PATH attribute across all the Site-to-Site VPN connections.
E. Verify that the transit gateway attachments are present in the Availability Zones of the test VPC.
F. Verify that the on-premises location is sending traffic by using multiple lows.
Show Answer
Correct Answer: B, C, F
Explanation: To reach higher aggregate bandwidth over multiple VPN tunnels with a transit gateway using ECMP, the team should (B) create new accelerated Site-to-Site VPN connections because acceleration cannot be enabled on existing VPNs and provides higher throughput; (C) advertise the on-premises prefix with the same BGP AS_PATH across all VPN connections so ECMP can load-balance traffic evenly instead of preferring a single path; and (F) ensure the on-premises device is sending multiple traffic flows, because ECMP load sharing occurs per flow and a single flow cannot fully utilize multiple tunnels.
Question 58
A company’s network engineer must implement a cloud-based networking environment for a network operations team to centrally manage. Other Teams will use the environment. Each team must be able to deploy infrastructure to the environment and must be able to manage its own resources. The environment must feature IPv4 and IPv6 support and must provide internet connectivity in a dual-stack configuration.
The company has an organization in AWS Organizations that contains a workload account for the teams. The network engineer creates a new networking account in the organization.
Which combination of steps should the network engineer take next to meet the requirements? (Choose three.)
A. Create a new VPC. Associate an IPv4 CIDR block of 10.0.0.0/16 and specify an IPv6 block of 2001:db8:c5a:6000::/56. Provision subnets by assigning /24 IPv4 CIDR blocks and /64 IPv6 CIDR blocks.
B. Create a new VPC. Associate an IPv4 CIDR block of 10.0.0.0/16 and use an Amazon-provided IPV6 CIDR block. Provision subnets by assigning /24 IPv4 CIDR blocks and /64 IPV6 CIDR blocks.
C. Enable sharing of resources within the organization by using AWS Resource Access Manager (AWS RAM). Create a resource share in the networking account, select the provisioned subnets, and share the provisioned subnets with the target workload account. Use the workload account to accept the resource share through AWS RAM.
D. Enable sharing of resources within the organization by using AWS Resource Access Manager (AWS RAM). Create a resource share in the networking account, select the new VPC, and share the new VPC with the target workload account. Use the workload account to accept the resource share through AWS RAM.
E. Create an internet gateway and an egress-only internal gateway. Deploy NAT gateways to the public subnets. Associate the internet gateway with the new VPC. Update the route tables. Associate the route tables with the relevant subnets.
F. Create an internet gateway. Deploy NAT instances to public subnets. Update the route tables. Associate the route tables with the relevant subnets.
Show Answer
Correct Answer: B, C, E
Explanation: The goal is a centrally managed, shared networking environment with dual-stack (IPv4/IPv6) internet connectivity for multiple teams.
B is correct because AWS requires using an Amazon-provided IPv6 CIDR block for standard VPC IPv6; subnets must be /64 for IPv6 and /24 is a valid IPv4 choice.
C is correct because AWS Resource Access Manager (RAM) is the supported way to share subnets from a central networking account to workload accounts while retaining centralized control. Sharing subnets (not the entire VPC) aligns with best practices.
E is correct because dual-stack internet connectivity requires an internet gateway for IPv4 and IPv6, an egress-only internet gateway for IPv6 outbound-only traffic, and NAT gateways for IPv4 private subnet egress. Proper route table associations are required.
A is incorrect because manually specifying an IPv6 CIDR block is not the standard or recommended approach for VPC IPv6.
D is incorrect because sharing an entire VPC reduces centralized control and is not the recommended multi-account pattern.
F is incorrect because NAT instances are legacy, less scalable, and higher operational overhead compared to NAT gateways.
Question 59
A company ran out of IP address space in one of the Availability Zones in an AWS Region that the company uses. The Availability Zone that is out of space is assigned the 10.10.1.0/24 CIDR block. The company manages its networking configurations in an AWS CloudFormation stack. The company’ VPC is assigned the 10 10.0.0/16 CIDR block and has available capacity in the 10.10.1.0/22 CIDR block.
How should a network specialist add more IP address space in the existing VPC with the LEAST operational overhead?
A. Update the AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Change the CidrBlock property to 10.10.1.0/22.
B. Update the AWS::EC2::VPC resource in the CloudFormation stack. Change the CidrBlock property to 10.10.1.0/22.
C. Copy the CloudFormation stack. Set the AWS::EC2::VPC resource CidrBlock property to 10.10.0.0/16. Set the AWS::EC2::Subnet resource CidrBlock property to 10.10.1.0/22 for the Availability Zone.
D. Create a new AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Set the CidrBlock property to 10.10.2.0/24.
Show Answer
Correct Answer: D
Explanation: An existing subnet’s CIDR block cannot be modified or expanded after creation. Changing the subnet or VPC CIDR in CloudFormation would require replacement and cause disruption. The VPC already has available address space, so the least operational overhead is to add a new subnet in the same Availability Zone using a non-overlapping CIDR (for example, 10.10.2.0/24). This immediately provides additional IP addresses without impacting existing resources.
Question 60
A company has two data centers that are interconnected with multiple redundant links from different suppliers. The company Uses IP addresses that are within the 172.16,0.0/16 CIDR block. The company is running iBGP between the two data centers by using a private Autonomous System Number (ASN) and IGP.
The company is moving toward a hybrid setup in which the company will initially use one VPC in the AWS Cloud. An AWS Direct Connect connection runs from the first data center to a Direct Connect gateway by using a private VIF. On the connection, the company advertises a summarized route for the 172.16.0.0/16 network. The company is planning to set up a second summarized route from the second data center to a different Direct Connect location.
The company needs to implement a solution to route traffic to and from AWS through the first Direct Connect connection. The solution must use the second Direct Connect connection for failover purposes only.
Which solution will meet these requirements?
A. Prepend the private ASN on the BGP announcements to AWS from the second data center. Add a second VIF in the first Direct Connect connection. Advertise the same network without any prepends from the first data center. Implement the same setup for the BGP announcement from AWS to the two data centers.
B. Tag the BGP announcements with the local preference BGP community tags. Set the tag to high preference for the first data center. Set the tag to low preference for the second data center. Configure the second data center’s router to have a lower local preference for the direct AWS BGP advertisements than for the advertisement from the fist data center.
C. Configure the Direct Connect gateway to prefer routing through the Direct Connect connection with the first data center. Configure the second data center’s router to have a lower local preference for the direct AWS BGP advertisements than for the advertisement from the first data center.
D. Configure the focal AWS Region BGP community tag on the BGP route that is advertised from the fist data center. Configure AS_PATH prepends on the BGP announcements from the second data center.
Show Answer
Correct Answer: B
Explanation: The requirement is active/passive Direct Connect, with all traffic preferring the first connection and the second used only for failover, for both directions (to and from AWS).
AWS Direct Connect supports local preference BGP community tags that influence how AWS selects paths when multiple private VIFs advertise the same prefixes. By tagging the routes from the first data center with a higher local preference community and the routes from the second data center with a lower preference community, AWS will prefer the first Direct Connect connection and only use the second if the first fails.
For traffic from the data centers toward AWS, configuring a lower local preference on the second data center for AWS-learned routes ensures it prefers reaching AWS via the first data center over iBGP.
Other options are incorrect because:
- AS_PATH prepending only reliably influences traffic in one direction and cannot fully control AWS-to-on-premises routing.
- Direct Connect gateways do not provide configurable path preference logic.
- Region-based BGP communities are not applicable for this private VIF scenario.
Therefore, option B meets all requirements.
Question 61
A company is running business applications on AWS. The company uses 50 AWS accounts, thousands of VPCs, and 3 AWS Regions across the United States and Europe.
A network engineer needs to establish network connectivity between an on-premises data center and the Regions. The network engineer also must establish connectivity between the VPCs. On-premises: users and applications must be able to connect to applications that run in the VPCs.
The company has an existing AWS Direct Connect connection that the network engineer can use. The network engineer creates a transit gateway in each Region and configures the transit gateways as inter-Region peers.
Which solution will provide network connectivity from the on-premises data center to the Regions and will provide inter-VPC communications across the different Regions?
A. Create a private VIF with a gateway type of virtual private gateway. Configure the private VIF to use a virtual private gateway that is associated with one of the VPCs.
B. Create a private VIF to a new Direct Connect gateway. Associate the new Direct Connect gateway with a virtual private gateway in each VPC.
C. Create transit VIF with a gateway association to a new Direct Connect gateway. Associate each transit gateway with the new Direct Connect gateway.
D. Create an AWS Site-to-Site VPN connection that uses a public VIF for the Direct Connect connection. Attach the Site-to-Site VPN connection to the transit gateways.
Show Answer
Correct Answer: C
Explanation: A transit VIF connected to a Direct Connect gateway is required to integrate Direct Connect with AWS Transit Gateway. The Direct Connect gateway can be associated with multiple transit gateways across Regions, enabling on‑premises connectivity to all VPCs attached to those transit gateways. With inter‑Region transit gateway peering already configured, this design also enables inter‑VPC communication across Regions and scales to many accounts and VPCs.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.