A company has a web application that runs in eight AWS Regions. In each Region, the application is hosted on multiple compute resources behind an Application Load Balancer (ALB).
The different Regions are using different domains. Each ALB is configured to accept only HTTPS traffic. Each ALB uses a certificate from AWS Certificate Manager (ACM).
The company wants to simplify the application’s appearance on the web by using a new single domain for all Regions. A network engineer needs to implement this change by designing a solution that also will minimize latency for the application's end users.
Which combination of actions will meet these requirements? (Choose three.)
A. Use ACM to create an SSL/TLS certificate in the us-east-1 Region for the new domain.
B. Set up latency-based routing in Amazon Route 53 for the new domain. Add the ALBs from all the Regions as targets.
C. Create an alias record for the accelerator in Amazon Route 53 for the new domain.
D. Create a standard accelerator in AWS Global Accelerator. Configure a listener for TCP traffic. Add all the ALBs as targets for the listener.
E. Use ACM to create an SSLITLS certificate for each Region. Configure all the ALBs to use the certificate in their respective Regions.
F. Create a custom routing accelerator in AWS Global Accelerator. Configure a listener for HTTPS traffic. Add all the ALBs as targets for the listener. Configure the accelerator to terminate TLS by using the SSLITLS certificate from ACM.
Show Answer
Correct Answer: C, D, E
Explanation: Use AWS Global Accelerator standard accelerator to provide a single anycast entry point and lowest-latency routing to the optimal regional ALB. Point the new domain to the accelerator with a Route 53 alias record. ACM certificates are regional resources for ALBs, so each ALB must use a certificate in its own Region for the shared domain. A us-east-1 certificate is not required for Global Accelerator because GA does not terminate TLS for standard accelerators, and custom routing accelerators do not support ALBs or HTTPS termination as described.
Question 63
A network engineer needs to provide a list of IP addresses that are sending traffic to an Amazon EC2 instance. VPC flow logs are enabled. The EC2 instance has a single network interface and two assigned IP addresses. However, the flow logs are logging traffic only for the primary IP address. The network engineer needs to determine whether any traffic is being sent to the second IP address of the EC2 instance.
What should the network engineer do to locate the traffic flow for the second IP address?
A. Create a new flow log that includes the pkt-dstaddr field to capture the original destination IP address of the traffic.
B. Create a new flow log that includes the dstaddr field to capture the original destination IP address of the traffic.
C. Create a new flow log that includes the pkt-srcaddr field to capture the original destination IP address of the traffic.
D. Create a new flow log that includes the srcaddr field to capture the original destination IP address of the traffic.
Show Answer
Correct Answer: A
Explanation: When an Elastic Network Interface has multiple private IPv4 addresses, the VPC Flow Logs dstaddr field records the primary private IP address rather than the original destination if traffic is sent to a secondary IP. The pkt-dstaddr field captures the original packet destination IP address, allowing you to identify traffic sent to the secondary IP address.
Question 65
A network engineer needs to monitor internet metrics for an application that is in a VPC. The metrics include user experiences such as health events, latency, and traffic insights.
The network engineer sets up Amazon CloudWatch Internet Monitor for the application. The engineer wants to push the internet health events to a third-party target.
Which solution will meet these requirements with the LEAST implementation effort?
A. Create a third-party API endpoint in Amazon EventBridge. Configure internet Monitor to send the events to the third-party API endpoint in EventBridge.
B. Create a third-party API endpoint in Amazon EventBridge. Create a rule in EventBridge that uses Internet Monitor as the source and the third-party API endpoint in EventBridge as the destination.
C. Create a third-party API endpoint in internet Monitor. Configure Internet Monitor to send the events to an Amazon S3 bucket. Configure an AWS Lambda function to send the events to the third-party API endpoint in Internet Monitor.
D. Create a third-party API endpoint in Internet Monitor. Configure Internet Monitor to send the events to the third-party API endpoint in Internet Monitor.
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch Internet Monitor emits health events to Amazon EventBridge. To forward those events to a third-party service with minimal implementation effort, configure an EventBridge API Destination for the third-party endpoint and create an EventBridge rule that matches Internet Monitor events and sends them to that API Destination. Internet Monitor does not send directly to arbitrary third-party endpoints.
Question 66
A company is running its application servers on Amazon EC2 instances. The EC2 instances run in separate VPCs that are connected by a transit gateway. The EC2 instances launch in a private subnet with a route to the transit gateway for internal and external connectivity. The external connectivity is provided by a VPC with firewall devices that perform an inspection for packets that ingress and egress through an internet gateway.
A network engineer needs to help the company’s application team increase the payload size per packet delivery between the EC2 instances. All network connectivity must be through the transit gateway
What should the network engineer do to meet these requirements?
A. Enable jumbo frames on the transit gateway. Instruct the application team to set the maximum transmission unit (MTU) of the system’s network interfaces to 9001 bytes.
B. Instruct the application team to set the maximum transmission unit (MTU) of the VPC to 8500 bytes.
C. Instruct the application team to set up enhanced networking on the system by using the enhanced networking adapter. Set the maximum transmission unit (MTU) to 9001 bytes.
D. Instruct the application team to set the maximum transmission unit (MTU) of the system’s network interfaces to 8500 bytes.
Show Answer
Correct Answer: D
Explanation: AWS Transit Gateway supports a maximum MTU of 8500 bytes. Packets larger than 8500 bytes that reach the transit gateway are dropped. Because all traffic between the EC2 instances must traverse the transit gateway, configuring the EC2 instances' network interfaces to use an MTU of 8500 bytes maximizes payload size without fragmentation or packet drops. There is no MTU setting for a VPC, transit gateway jumbo frames cannot be enabled beyond its supported MTU, and enhanced networking does not increase the transit gateway MTU limit.
Question 67
A company is building an internet-facing application that is hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company is using the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes for pod networking connectivity. The company needs to expose its application to the internet by using a Network Load Balancer (NLB).
The pods that host the application must have visibility of the source IP address that is contained in the original packet that the NLB receives.
How should the network engineer configure the NLB and Amazon EKS settings to achieve these goals?
A. Specify the ip target type for the NLB. Set the externalTrafficPolicy attribute to Local in the Kubernetes service specification.
B. Specify the instance target type for the NLSet the externalTrafficPolicy attribute to Cluster in the Kubernetes service specification.
C. Specify the instance target type for the NLB. Set the externalTrafficPolicy attribute to Local in the Kubernetes service specification.
D. Specify the ip target type for the NLB. Set the externalTrafficPolicy attribute to Cluster in the Kubernetes service specification.
Show Answer
Correct Answer: A
Explanation: Using the NLB with the IP target type registers pod IPs directly, avoiding an extra hop through node ports. Setting externalTrafficPolicy to Local preserves the original client source IP by preventing kube-proxy from performing cross-node forwarding that can mask the client IP. This combination satisfies the requirement that the application pods see the original source IP address.
Question 68
A retail company is migrating its on-premises application to the AWS Cloud. Currently, the company has two on-premises data center locations. One data center is on the east coast of the United States, and one data center is on the west coast.
Each data center hosts four database systems. The largest database system stores 500 GB of data. The data centers are interconnected by two 10 GbE circuits for data synchronization. Each data center has two separate 1 GbE upstream internet connections. The company plans to have eight total VPCs to service its multiple business units. Four VPCs will be in the us-east-1 Region, and four will be in the us-west-2 Region.
A network engineer needs to design a connectivity solution that allows VPC-to-VPC connectivity. The solution must also allow secure connections between the on-premises data centers and AWS during the migration process. The company expects spikes in traffic among the VPCs during database synchronization. The company wants to run the migration plan during one weekend and as soon as technically possible. The company also wants to minimize long-term operational and human resources costs.
Which combination of steps will meet these requirements? (Choose two.)
A. Deploy one transit gateway and attach all VPCs to it. Update the transit gateway and VPC route tables to allow any VPC to connect to any other VPC.
B. Configure VPC peering between all the VPCs. Update the VPC route tables to allow connectivity.
C. Provision two AWS Direct Connect connections from two Direct Connect locations that serve us-east-1 and us-west-2 to provide connectivity between the data centers and AWS.
D. Provision one transit gateway VPN attachment for each data center to build connectivity between the on-premises data centers and AWS VPCs.
E. Provision one AWS Site-to-Site VPN connection for each data center and for each VPC to build connectivity between the on-premises data centers and AWS VPCs.
Show Answer
Correct Answer: B, E
Explanation: Option A is not valid as written because a single transit gateway is a Regional resource and cannot have VPC attachments from both us-east-1 and us-west-2. Option D depends on a transit gateway but does not include deploying one. VPC peering provides VPC-to-VPC connectivity, and Site-to-Site VPNs can be deployed quickly to provide secure on-premises connectivity during migration. Although VPC peering is less scalable than Transit Gateway, given the wording of the options it is the only valid VPC-to-VPC choice.
Question 69
A company is migrating its on-premises network from its data center in Virginia to its data center in New York. The AWS Direct Connect connections for the Virginia and New York data center locations are both associated to the us-east-1 Region. The company needs to migrate a private VIF on an existing Direct Connect hosted connection from Virginia to New York. The company's on-premises network uses the connection to access VPCs through a Direct Connect gateway in us-east-1.
The company has already requested a new Direct Connect hosted connection from the new data center to the New York Direct Connect location.
Which solution will meet these requirements with the LEAST downtime?
A. Create a new private VIF on the new Direct Connect hosted connection. Create a new Direct Connect gateway and attach the gateway to the new private VIF. Configure BGP routing on the new private VIF as a backup route. Perform the switchover during a maintenance window by shutting down BGP on the existing private VIF. Decommission the existing Direct Connect connection.
B. Create a new private VIF on the new Direct Connect hosted connection. Attach the new private VIF to the existing Direct Connect gateway. Configure BGP routing on the new private VIF as a backup route. Perform the switchover during a maintenance window by shutting down BGP on the existing private VIF. Decommission the existing Direct Connect connection.
C. During a maintenance window, migrate the existing private VIF to the new Direct Connect hosted connection. Attach the existing private VIF to the existing Direct Connect gateway. Decommission the existing Direct Connect connection.
D. During a maintenance window, delete the existing private VIF and create a new private VIF to the new Direct Connect hosted connection. Attach the new private VIF to the existing Direct Connect gateway. Decommission the existing Direct Connect hosted connection.
Show Answer
Correct Answer: B
Explanation: Create a new private VIF on the new hosted connection and attach it to the existing Direct Connect gateway. Establish BGP on the new VIF with a less-preferred path initially (backup), then during the maintenance window withdraw the old BGP session so traffic converges to the new connection with minimal downtime. Creating a new Direct Connect gateway is unnecessary, and deleting or migrating the existing VIF directly would introduce more downtime.
Question 70
A company is developing an API-based application on AWS for its process workflow requirements. The API will be invoked by clients in the company’s on-premises data centers. The company has set up an AWS Direct Connect connection between on premises and AWS. A network engineer decides to implement the API as a private REST API in Amazon API Gateway. The network engineer wants to ensure that clients can reach the API endpoint through private communication.
Which solution can the network engineer use to invoke the API without any additional infrastructure setup?
A. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the private DNS name of the endpoint.
B. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using an Amazon Route 53 alias of the endpoint.
C. Create an interface VPC endpoint for API Gateway. Associate the endpoint with the private REST API, Access the API by using an Amazon Route 53 alias of the endpoint.
D. Create an interface VPC endpoint for API Gateway with private DNS names enabled. Access the API by using the public DNS name of the endpoint.
Show Answer
Correct Answer: D
Explanation: For private API Gateway access from on-premises over AWS Direct Connect without adding additional infrastructure, create an interface VPC endpoint for API Gateway with private DNS enabled and invoke the private API using the public DNS name. Using private DNS from on premises requires additional DNS infrastructure (such as a Route 53 Resolver inbound endpoint and DNS forwarding), which the question explicitly wants to avoid. Route 53 aliases are not required for this scenario.
Sources:
https://aws.amazon.com/blogs/compute/integrating-amazon-api-gateway-private-endpoints-with-on-premises-networks
Question 71
A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edge location in the us-west-1 Region. A shared services segment exists at both edge locations. Each shared services segment has a VPC attachment to each inspection VPC in each Region. The inspection VPCs inspect traffic from a WAN by using AWS Network Firewall.
The company creates a new segment for a new business unit (BU) in the us-east-1 edge location. The new BU has three VPCs that are attached to the new BU segment. To comply with regulations, the BU VPCs must not communicate with each other. All internet-bound traffic must be inspected in the inspection VPC.
The company updates VPC route tables so any traffic that is bound for internet goes to the AWS Cloud WAN core network.
The company plans to add more VPCs for the new BU in the future. All future VPCs must comply with regulations.
Which solution will meet these requirements in the MOST operationally efficient way? (Choose two.)
A. Update the network policy to share the shared services segment with the BU segment.
B. Create a network policy to share the inspection service segment with the BU segment.
C. Set the isolate-attachments field to True for the BU segment.
D. Set the isolate-attachments field to False for the BU segment.
E. Update the network policy to add static routes for the BU segment. Configure the shared services segment to route traffic related to VPC CIDR blocks to each respective VPC attachment.
Show Answer
Correct Answer: A, C
Explanation: The BU VPCs must be isolated from each other, which is achieved by setting isolate-attachments to True on the BU segment. Internet-bound traffic must reach the centralized inspection VPCs, which already reside in the shared services segment; sharing that segment with the BU segment allows access to the inspection path without requiring per-VPC static routes. Static routes to every VPC attachment are not operationally efficient for future growth, and the question does not define an inspection service segment.
Sources:
https://www.cliffsnotes.com/study-notes/27384715
Question 72
A banking company has an application that must connect to specific public IP addresses from a VPC. A network engineer has configured routes in the route table that is associated with the application’s subnet to the required public IP addresses through an internet gateway.
The network engineer needs to set up email notifications that will alert the network engineer when a user adds a default route to the application subnet's route table with the internet gateway as a target.
Which solution will meet these requirements with the LEAST implementation effort?
A. Create an AWS Lambda function that reads the routes in the route table and sends an email notification. Configure the Lambda function to send an email notification if any route is configured with 0.0.0.0/0 or ::/0 CIDRs to the internet gateway. Configure the Lambda function to run every minute.
B. Create an AWS Lambda function that will be invoked by an Amazon EC2 CreateRoute API call. Configure the Lambda function to send an email notification. Configure the Lambda function to send an email notification if any route is configured with 0.0.0.0/0 or ::/0 CIDRs to the internet gateway.
C. Create AWS Config rules for the route table by using the internet-gateway-authorized-vpc-only managed rule. Create an Amazon EventBridge rule to match the AWS Config rule and to route to an Amazon Simple Notification Service (Amazon SNS) topic to send an email notification.
D. Create an AWS Config rule for the route table by using the no-unrestricted-route-to-igw managed rule. Create an Amazon EventBridge rule to match the AWS Config rule and to route to an Amazon Simple Notification Service (Amazon SNS) topic to send an email notification.
Show Answer
Correct Answer: D
Explanation: The AWS Config managed rule no-unrestricted-route-to-igw is specifically designed to detect route tables that contain unrestricted routes (0.0.0.0/0 or ::/0) to an Internet Gateway. Pairing it with EventBridge and SNS provides automatic email notifications with minimal implementation effort. The Lambda-based options require custom code and maintenance, while internet-gateway-authorized-vpc-only validates IGW attachment to authorized VPCs rather than detecting default routes to an IGW.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.