CertBlaze

Amazon

ANS-C01 Free Practice Questions — Page 7

Question 62

A company has an internal web-based application that employees use. The company hosts the application over a VPN in the company’s on-premises network. The application runs on a fleet of Amazon EC2 instances in a private subnet behind a Network Load Balancer (NLB) in the same subnet. The instances are in an Amazon EC2 Auto Scaling group. During a recent security incident, SQL injection occurred on the application. A network engineer must implement a solution to prevent SQL injection attacks in the future. Which combination of steps will meet these requirements? (Choose three.)

A. Create an AWS WAF web ACL that includes rules to block SQL injection attacks.
B. Create an Amazon CloudFront distribution. Specify the EC2 instances as the origin.
C. Replace the NLB with an Application Load Balancer.
D. Associate the AWS WAF web ACL with the NLB.
E. Associate the AWS WAF web ACL with the Application Load Balancer.
F. Associate the AWS WAF web ACL with the Amazon CloudFront distribution.
Show Answer
Correct Answer: A, C, E
Explanation:
SQL injection is a Layer 7 attack, so protection must inspect HTTP requests. AWS WAF provides managed and custom rules to block SQL injection, but WAF can be associated only with Application Load Balancers, CloudFront, or API Gateway—not with Network Load Balancers. Therefore, the NLB must be replaced with an ALB, an AWS WAF web ACL with SQL injection rules must be created, and that web ACL must be associated with the ALB. CloudFront is optional and not required for this use case.

Question 63

A company has VPCs across 50 AWS accounts and is using AWS Organizations. The company wants to implement web filtering. The requirements for how the traffic must be filtered are the same for all the VPCs. A network engineer plans to use AWS Network Firewall. The network engineer needs to implement a solution that minimizes the number of firewall policies and rule groups that are necessary for this web filtering. Which combination of steps will meet these requirements? (Choose three.)

A. Create a firewall policy or rule group in each account.
B. Use SCPs to share the firewall policy or rule group.
C. Create a firewall policy or rule group in the management account
D. Use AWS Resource Access Manager (AWS RAM) to share the firewall policy or rule group.
E. Enable sharing within Organizations.
F. Create OUs to share the firewall policy or rule group.
Show Answer
Correct Answer: C, D, E
Explanation:
To minimize the number of firewall policies and rule groups while applying identical web filtering across many accounts, the policies and rule groups should be created centrally and shared. Creating them in the management account enables centralized ownership and management. AWS Network Firewall supports sharing firewall policies and rule groups through AWS Resource Access Manager (AWS RAM). Enabling sharing within AWS Organizations allows those shared resources to be consumed by all member accounts without duplicating them. This combination achieves consistent filtering with minimal policy duplication.

Question 64

An online retail company is running a web application in the us-wast-2 Region and serves consumers in the United States. The company plans to expand across several countries in Europe and wants to provide low latency for all its users. The application needs to identify the users’ IP addresses and provide localized content based on the users’ geographic location. The application uses HTTP GET and POST methods for its functionality. The company also needs to develop a failover mechanism that works for GET and POST methods and is based on health checks. The failover must occur in less than 1 minute for all clients. Which solution will meet these requirements?

A. Configure a Network Load Balancer (NLB) for the application in each environment in the new AWS Regions. Create an AWS Global Accelerator accelerator that has endpoint groups that point to the NLBs in each Region.
B. Configure an Application Load Balancer (ALB) for the application in each environment in the new AWS Regions. Create an AWS Global Accelerator accelerator that has endpoint groups that point to the ALBs in each Region.
C. Configure an Application Load Balancer (ALB) for the application in each environment in the new AWS Regions. Create Amazon Route 53 public hosted zones that have failover routing policies.
D. Configure a Network Load Balancer (NLB) for the application in each environment in the new AWS Regions. Create an Amazon CloudFront distribution. Configure an origin group with origin failover options.
Show Answer
Correct Answer: B
Explanation:
The application uses HTTP GET and POST and must identify client IPs and serve localized content with sub-minute global failover. Application Load Balancers are designed for HTTP/HTTPS traffic and preserve client IP information. AWS Global Accelerator routes users to the closest healthy regional endpoint over the AWS global network and performs rapid health-check–based failover in seconds, meeting the <1 minute requirement. Route 53 DNS failover can be slower due to DNS caching, NLBs are layer 4 and less suited for HTTP features, and CloudFront origin failover is not ideal for dynamic POST-based applications requiring regional failover.

Question 65

A network engineer is working on a large migration effort from an on-premises data center to an AWS Control Tower based multi-account environment. The environment has a transit gateway that is deployed to a central network services account. The central network services account has been shared with an organization in AWS Organizations through AWS Resource Access Manager (AWS RAM). A shared services account also exists in the environment. The shared services account hosts workloads that need to be shared with the entire organization. The network engineer needs to create a solution to automate the deployment of common network components across the environment. The solution must provision a VPC for application workloads to each new and existing member account. The VPCs must be connected to the transit gateway in the central network services account. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

A. Deploy an AWS Lambda function to the shared services account. Program the Lambda function to assume a role in the new and existing member accounts to provision the necessary network infrastructure.
B. Update the existing accounts with an Account Factory Customization (AFC). Select the same AFC when provisioning new accounts.
C. Create an AWS CloudFormation template that describes the infrastructure that needs to be created in each account. Upload the template as an AWS Service Catalog product to the shared services account.
D. Deploy an Amazon EventBridge rule on a default event bus in the shared services account. Configure the EventBridge rule to react to AWS Control Tower CreateManagedAccount lifecycle events and to invoke the AWS Lambda function.
E. Create an AWSControlTowerBiueprintAccess role in the shared services account. F Create an AWSControlTowerBiueprintAccess role in each member account.
Show Answer
Correct Answer: B, C, E
Explanation:
The least operational overhead approach in an AWS Control Tower environment is to use native Account Factory Customizations (AFC). AFC allows consistent deployment to both existing and newly created accounts without maintaining custom event-driven code. - **B** applies the customization uniformly to existing accounts and automatically to new ones via Account Factory. - **C** packages the VPC and transit gateway attachment as a CloudFormation template delivered through AWS Service Catalog, which is the required mechanism for AFC. - **E** provides the necessary AWSControlTowerBlueprintAccess role so Control Tower can deploy the Service Catalog product into member accounts. This approach avoids ongoing Lambda code maintenance and EventBridge plumbing, resulting in lower operational overhead.

Question 66

A company has deployed an application in which the front end of the application communicates with the backend instances through a Network Load Balancer (NLB) in the same VPC. The application is highly available across two Availability Zones. The company wants to limit the amount of traffic that travels across the Availability Zones. Traffic from the front end of the application must stay in the same Availability Zone unless there is no healthy target in that Availability Zone behind the NLB. If there is no healthy target in the same Availability Zone, traffic must be sent to the other Availability Zone. Which solution will meet these requirements?

A. Create a private hosted zone with weighted routing for each Availability Zone. Point the primary record to the local Availability Zone NLB DNS record. Point the secondary record to the Regional NLB DNS record. Configure the front end of the application to perform DNS lookups on the local private hosted zone records.
B. Turn off cross-zone load balancing on the NLConfigure the front end of the application to perform DNS lookups on the local Availability Zone NLB DNS record.
C. Create a private hosted zone. Create a failover record for each Availability Zone. For each failover record, point the primary record to the local Availability Zone NLB DNS record and point the secondary record to the Regional NLB DNS record. Configure the front end of the application to perform DNS lookups on the local private hosted zone records.
D. Enable sticky sessions (session affinity) so that the NLB can bind a user’s session to targets in the same Availability Zone.
Show Answer
Correct Answer: C
Explanation:
The requirement is zonal affinity with automatic failover to another Availability Zone only when no healthy targets exist locally. Network Load Balancer cross-zone load balancing does not provide this behavior: when disabled, an NLB node routes only to local targets and does not fail over to other AZs. Using Route 53 failover records per AZ allows the front end to resolve to the local AZ NLB DNS name under normal conditions, while automatically failing over to the regional (or other AZ) NLB endpoint when the local AZ becomes unhealthy. This minimizes cross-AZ traffic while still providing availability.

Question 67

A company is planning to host external websites on AWS. The websites will include multiple tiers such as web servers, application logic services, and databases. The company wants to use AWS Network Firewall, AWS WAF, and VPC security groups for network security. The company must ensure that the Network Firewall firewalls are deployed appropriately within relevant VPCs. The company needs the ability to centrally manage policies that are deployed to Network Firewall and AWS WAF rules. The company also needs to allow application teams to manage their own security groups while ensuring that the security groups do not allow overly permissive access. What is the MOST operationally efficient solution that meets these requirements?

A. Define Network Firewall firewalls, AWS WAFV2 web ACLs. Network Firewall policies, and VPC security groups in code. Use AWS CloudFormation to deploy the objects and initial policies and rule groups. Use CloudFormation to update the AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups. Use Amazon GuardDuty to monitor for overly permissive rules.
B. Define Network Firewall firewalls. AWS WAFV2 web ACLs, Network Firewall policies, and VPC security groups in code. Use the AWS Management Console or the AWS CLI to manage the AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups. Use Amazon GuardDuly to invoke an AWS Lambda function to evaluate the configured rules and remove any overly permissive rules.
C. Deploy AWS WAFv2 IP sets and AWS WAFv2 web ACLs with AWS CloudFormation. Use AWS Firewall Manager to deploy Network Firewall firewalls and VPC security groups where required and to manage the AWS WAFv2 web ACLs, Network Firewall policies, and VPC security groups.
D. Define Network Firewall firewalls, AWS WAFv2 web ACLS, Network Firewall policies, and VPC security groups in code. Use AWS CloudFarmation to deploy the objects and initial policies and rule groups. Use AWS Firewall Manager to manage the AWS WAFV2 web ACLS, Network Firewall policies, and VPC security groups. Use Amazon GuardDuty to monitor for overly permissive rules.
Show Answer
Correct Answer: D
Explanation:
The requirements call for centralized, organization-wide management of AWS Network Firewall, AWS WAF, and VPC security group policies, while still allowing application teams to manage their own security groups with guardrails. AWS Firewall Manager is specifically designed for this purpose: it centrally manages AWS WAF web ACLs, Network Firewall policies, and VPC security group policies across multiple accounts and VPCs. Using AWS CloudFormation to define and deploy the baseline resources and initial policies ensures consistent, repeatable infrastructure provisioning. Firewall Manager then enforces and manages those policies centrally, while GuardDuty provides continuous monitoring and detection of overly permissive or risky configurations. This combination is the most operationally efficient and best aligned with AWS best practices.

Question 68

A company is replatforming a legacy data processing solution to AWS. The company deploys the solution on Amazon EC2 Instances in private subnets that are in one VPC. The solution uses Amazon S3 for abject storage. Both the data that the solution processes and the data the solution produces are stored in Amazon S3. The solution uses Amazon DynamoDB to save its own state. The company collects flow logs for the VPC. The solution uses one NAT gateway to register its license through the internet. A software vendor provides a specific hostname so the solution can register its license. The company notices that the AWS bill exceeds the projected budget for the solution. A network engineer uses AWS Cost Explorer to investigate the bill. The network engineer notices that the USE2-NatGateway-Bytes($) usage type is the root cause of the higher than expected bill. What should the network engineer do to resolve the issue? (Choose two.)

A. Set up Amazon VPC Traffic Mirroring. Analyze the traffic to identify the traffic that the NAT gateway processes.
B. Examine the VPC flow logs to identity the traffic that traverses the NAT gateway.
C. Set up an AWS Cost and Usage Report in the AWS Billing and Cost Management console. Examine the report to find more details about the NAT gateway charges.
D. Verify that the security groups attached to the EC2 instances allow outgoing traffic only to the IP addresses that the hostname resolves to, the VPC CIDR block, and the AWS IP address ranges for Amazon S3 and DynamoDB.
E. Verify that the gateway VPC endpoints for Amazon S3 and DynamoDB are both set up and associated with the route tables of the private subnets.
Show Answer
Correct Answer: B, E
Explanation:
High USE2-NatGateway-Bytes charges indicate large volumes of traffic are traversing the NAT gateway. Examining VPC flow logs reveals which traffic is using the NAT gateway and helps identify unnecessary paths. Traffic to Amazon S3 and DynamoDB should not go through a NAT gateway; configuring and associating gateway VPC endpoints for S3 and DynamoDB with the private subnet route tables ensures this traffic stays on the AWS network and bypasses the NAT gateway, reducing cost.

Question 69

A company has two on-premises data centers. The first data center is in the us-east-1 Region. The Second data canter is in the us-east-2 Region. Each data center connects to the closest AWS Direct Connect facility. The company uses Direct Connect connections, transit VIFs, and a single Direct Connect gateway to establish connectivity to VPCs in us-east-1 and us-east-2 from the company’s data centers. The company also has private connectivity from a telecommunications provider that connects the first data center to the second data center. Recently, there have been multiple connection disruptions to the private connectivity between the data centers. The company needs a solution to improve the reliability of the connection between the two data centers. Which solution will meet these requirements?

A. Create a new Direct Connect gateway. Enable the Direct Connect SiteLink feature on the transit VIF. Share the CIDR blocks from the first data center and the second data center with each other.
B. Create a new public VIF to both Regions. Enable the Direct Connect SiteLink feature on the new public VIF.
C. Enable the Direct Connect SiteLink feature on the existing Direct Connect connections.
D. Enable the Direct Connect SiteLink feature on the existing transit VIFS that are attached to the existing Direct Connect gateway.
Show Answer
Correct Answer: D
Explanation:
AWS Direct Connect SiteLink enables on-premises locations connected via Direct Connect to communicate with each other over the AWS global network, removing dependence on separate private WAN links. Since the company already uses Direct Connect connections, a Direct Connect gateway, and transit VIFs, the correct and minimal-change solution is to enable SiteLink on the existing transit VIFs attached to the Direct Connect gateway. This improves reliability between the two data centers without creating new gateways or VIF types.

Question 70

A company needs to protect against potential botnet command and control traffic from any Amazon EC2 instances that is in in the company’s AWS Environment. Which solution will meet these requirements?

A. Use AWS Shield Advanced. Activate Shield Advanced protections on the EC2 instances to filter and block botnet traffic.
B. Use Amazon Route 53 Resolver DNS Firewall. Add a rule to a rule group to use the AWSManagedDomainsBotnetCommandandControl managed domain list with an action to block botnet traffic.
C. Use AWS WAF Bot Control. Configure a managed rule group that uses an AWS managed rule set to block botnet traffic.
D. Use AWS Systems Manager. Run a Systems Manager Automation runbook on the EC2 instances to configure the instances to block botnet traffic.
Show Answer
Correct Answer: B
Explanation:
Botnet command-and-control traffic from EC2 instances most commonly relies on DNS lookups to reach known malicious domains. Amazon Route 53 Resolver DNS Firewall can block these DNS queries using the AWSManagedDomainsBotnetCommandandControl managed domain list, preventing instances from resolving and communicating with botnet C2 endpoints. This is a managed, scalable, and preventative control that directly addresses outbound botnet C2 traffic. The other options do not specifically or effectively block C2 traffic at the DNS level.

Question 71

A company is migrating an application to the AWS Cloud. The company has successfully provisioned and tested connectivity between AWS Direct Connect and the company's on-premises data center. The application runs on Amazon EC2 instances across multiple Availability Zones. The instances are in an Auto Scaling group. The application communicates through HTTPS to a third-party vendor's data service that is hosted at the company’s data center. The data service implements a static ACL through explicit allow listing of client IP addresses. A network engineer must design a network solution so that the migrated application can continue to access the vendor’s data service as the application scales. Which solution will meet these requirements with the LEAST amount of ongoing change to the vendor's allow list?

A. Configure a private NAT gateway in the subnets for each Availability Zone that the application runs in. Configure the application to target the NAT gateways instead of the data service directly. Update the data service's allow list to include the IP addresses of the NAT gateways.
B. Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Associate the elastic network interfaces with the Auto Scaling group for the application. Update the data service's allow list to include the IP addresses of the elastic network interfaces.
C. Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Launch an EC2 instance into each subnet. Attach the respective elastic network interfaces to the new EC2 instances. In the application subnet route tables, configure the new EC2 instances as the next destination for the data service. Update the data service’s allow list to include the IP addresses of the elastic network interfaces.
D. Configure an Application Load Balancer (ALB) in the subnets for each Availability Zone that the application runs in. Configure an ALB-associated target group that contains a target that uses the IP address for the data service. Configure the application to target the ALB instead of the data service directly. Update the data service's allow list to include the IP addresses of the ALBs.
Show Answer
Correct Answer: A
Explanation:
The requirement is to provide a small, stable set of source IP addresses that the vendor can allow list while the EC2 Auto Scaling group scales across multiple Availability Zones. A private NAT gateway provides fixed, per-AZ IP addresses for outbound traffic, regardless of how many instances scale in or out. The vendor will always see traffic originating from the NAT gateway IPs, minimizing ongoing changes to the allow list. Other options either do not provide static IPs (ALB), do not scale cleanly with Auto Scaling (ENIs directly attached), or add unnecessary operational complexity (custom EC2-based routing).

$19

Get all 269 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full ANS-C01 study guide →