A company has established connectivity between its on-premises data center in Paris. France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway.
The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center.
In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet.
Which set of steps should a network engineer take to meet these requirements?
A. 1. Create public subnets in the Tokyo VPC to migrate the workloads into. 2. Configure an internet gateway for the Tokyo office to reach the Tokyo VPC. 3. Configure security groups on the Tokyo workloads to only allow traffic from the Tokyo office and the Paris workloads. 4. Create peering connections between the Tokyo VPC and the Paris VPCs. 5. Configure a VPN connection between the Paris data center and the Tokyo office by using existing routers.
B. 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC. 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Set up a new Direct Connect connection from the Tokyo office to the Tokyo transit gateway. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
C. 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VP 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Configure an AWS Site-to-Site VPN connection from the Tokyo office. Set the Tokyo transit gateway as the target. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
D. 1. Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit gateway. 2. Create an association between the Paris transit gateway and the Tokyo VPC. 3. Configure routing on the Paris transit gateway to allow data to flow between sites and the VPC.
Show Answer
Correct Answer: C
Explanation: Option C meets all requirements. A new Direct Connect from Tokyo (option B) cannot be provisioned within 5 days. Using an AWS Site-to-Site VPN from the Tokyo office is fast to deploy and provides private, encrypted connectivity without exposing workloads to the internet. Creating a transit gateway in Tokyo and peering it with the existing Paris transit gateway enables private inter-Region connectivity between VPCs. Routing on both transit gateways allows connectivity among the Tokyo office, Tokyo VPC workloads, Paris VPC workloads, and the Paris data center via the existing Direct Connect.
Question 73
Company A recently acquired Company B. Company A has a hybrid AWS and on-premises environment that uses a hosted AWS Direct Connect connection, a Direct Connect gateway, and a transit gateway. Company A has a transit VIF to access the resources in its production environment in the us-east-1 Region.
Company B has applications that run across multiple VPCs in the us-west-2 Region in a single AWS account. A transit gateway connects all Company B's application VPCs. The CIDR blocks for both companies do not overlap.
Company A needs to use the existing Direct Connect connection to access Company B’s applications from the on-premises environment.
Which solution will meet these requirements?
A. Create a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a transit VIF on the existing hosted connection for Company B.
B. Create an association proposal from the Company B account to associate the Company B transit gateway with the Company A Direct Connect gateway. Accept the transit gateway association proposal by logging into the Company A account.
C. Create multiple virtual private gateways. Attach the virtual private gateways to each of Company B's application VPCs. Create a hosted private VIF for each virtual private gateway.
D. Create a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a hosted private VIF for Company B.
Show Answer
Correct Answer: B
Explanation: Company A already has a hosted Direct Connect connection, a Direct Connect gateway, and a transit VIF. Direct Connect gateways are global and can be associated with transit gateways in different AWS accounts and Regions. By creating a transit gateway association proposal from Company B’s account and associating Company B’s transit gateway with Company A’s existing Direct Connect gateway, Company A can use the existing Direct Connect connection to reach Company B’s VPCs without creating new Direct Connect gateways or VIFs. This is the supported and most efficient multi-account, multi-Region design.
Question 74
A company has developed a web service for language translation. The web service's application runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) and are deployed in a private subnet. The web service can process requests that contain hundreds of megabytes of data.
The company needs to give some customers the ability to access the web service. Each customer has its own AWS account. The company must make the web service accessible to approved customers without making the web service accessible to all customers.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Create VPC peering connections with the approved customers only.
B. Create an AWS PrivateLink endpoint service. Configure the endpoint service to require acceptance that will be granted to approved customers only.
C. Configure an authentication action for the endpoint service's load balancer to allow customers to log in by using their AWS credentials. Provide only approved customers with the URL.
D. Configure a Network Load Balancer (NLB) and a listener with the ALB as a target. Associate the NLB with the endpoint service.
E. Associate the ALB with the endpoint service.
Show Answer
Correct Answer: B, D
Explanation: The requirement is to expose a private web service only to approved customers in other AWS accounts with minimal operational overhead and support for large payloads. AWS PrivateLink is designed for this use case.
Option B is correct because creating an AWS PrivateLink endpoint service with acceptance required allows the company to explicitly approve which customer AWS accounts can connect, without exposing the service publicly.
Option D is correct because an endpoint service must be associated with a Network Load Balancer (NLB). Since the service currently uses an Application Load Balancer (ALB), the correct architecture is to place an NLB in front of the ALB and associate the NLB with the PrivateLink endpoint service.
Other options are incorrect: VPC peering does not scale well across many customer accounts, ALBs cannot be directly associated with endpoint services, and authentication actions on ALB do not restrict network-level access to only approved AWS accounts.
Question 75
A company has a highly available application that is hosted in multiple VPCs and in two on-premises data centers. All the VPCs reside in the same AWS Region. All the VPCs require access to each other and to the on-premises data centers for the transfer of files that are multiple gigabytes in size.
A network engineer is designing an AWS Direct Connect solution to connect the on-premises data centers to each VPC.
Which architecture will meet the company's requirements with the LEAST operational overhead?
A. Configure a virtual private gateway and a private VIF in each VPC in the Region. Configure a Direct Connect gateway. Associate the VIF of every VPC with the Direct Connect gateway. Create a new private VIF that connects the Direct Connect gateway to each on-premises data center. Configure the new private VIF to exchange BGP routes with the on-premises data centers and to have an MTU of 9001. Use VPC peering between each VPC. Configure static routing in each VPC to provide inter-VPC routing.
B. Configure a virtual private gateway and a private VIF in each VPC in the Region. Configure a Direct Connect gateway. Associate the VIF of every VPC with the Direct Connect gateway. Create a new private VIF that connects the Direct Connect gateway to each on-premises data center. Configure the new private VIF to exchange BGP routes with the on-premises data centers and to have an MTU of 8500. Use VPC peering between each VPC. Configure static routing in each VPC to provide inter-VPC routing.
C. Configure a transit gateway in the same Region of each VPAttach each VPC to the transit gateway. Configure a Direct Connect gateway. Associate the Direct Connect gateway with the transit gateway. Associate a new transit VIF with each Direct Connect connection. Configure the new transit VIF to exchange BGP routes and to have an MTU of 9001. Configure route propagation between each VPC and the transit gateway.
D. Configure a transit gateway in the same Region of each VPC. Attach each VPC to the transit gateway. Configure a Direct Connect gateway. Associate the Direct Connect gateway with the transit gateway. Associate a new transit VIF with each Direct Connect connection. Configure the new transit VIF to exchange BGP routes and to have an MTU of 8500. Configure route propagation between each VPC and the transit gateway.
Show Answer
Correct Answer: D
Explanation: Using a transit gateway with a Direct Connect gateway provides a hub-and-spoke architecture that minimizes operational overhead compared to managing multiple VPC peering connections and static routes. Transit gateways natively support scalable inter-VPC routing and route propagation. For Direct Connect with a transit gateway, a transit virtual interface (VIF) must be used, and jumbo frames on transit VIFs support an MTU of 8500 (not 9001). This design supports large file transfers, high availability, and simplified routing across multiple VPCs and on-premises data centers.
Question 76
A company has AWS accounts in an organization in AWS Organizations. The company has implemented Amazon VPC IP Address Manager (IPAM) in its networking AWS account. The company is using AWS Resource Access Manager (AWS RAM) to share IPAM pools with other AWS accounts. The company has created a top-level pool with a CIDR block of 10.0.0.0/8. For each AWS account, the company has created an IPAM pool within the top-level pool.
A network engineer needs to implement a solution to ensure that users in each AWS account cannot create new VPCs. The solution also must prevent users from associating a CIDR block with existing VPCs unless the CIDR block is from the IPAM pool for that account.
Which solution will meet these requirements?
A. Create a new AWS Config rule to find all VPCs that are not configured to allocate their CIDR block from an IPAM pool. Invoke an AWS Lambda function to delete these VPCs.
B. Create a new SCP in Organizations. Add a condition that denies the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions if the Ipv4IpamPoolId context key value is not the ID of an IPAM pool.
C. Create an AWS Lambda function to check for and delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool. Invoke the Lambda function at regular intervals.
D. Create an Amazon EventBridge rule to check for AWS CloudTrail events for the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions. Use the rule to invoke an AWS Lambda function to delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool.
Show Answer
Correct Answer: B
Explanation: The requirement is to prevent noncompliant actions at the time they are attempted across all accounts. An AWS Organizations SCP can explicitly deny ec2:CreateVpc and ec2:AssociateVpcCidrBlock unless the Ipv4IpamPoolId request context key matches an approved IPAM pool. This enforces that new VPCs cannot be created and additional CIDR blocks cannot be associated unless they come from the account’s shared IPAM pool. The other options detect and remediate after the fact, which does not meet the preventive requirement.
Question 77
A company's AWS infrastructure is spread across more than 50 accounts and across five AWS Regions. The company needs to manage its security posture with simplified administration and maintenance for all the AWS accounts. The company wants to use AWS Firewall Manager to manage the firewall rules and requirements.
The company creates an organization with all features enabled in AWS Organizations.
Which combination of steps should the company take next to meet the requirements? (Choose three.)
A. Configure only the Firewall Manager administrator account to join the organization.
B. Configure all the accounts to join the organization.
C. Set an account as the Firewall Manager administrator account.
D. Set an account as the Firewall Manager child account.
E. Set up AWS Config for all the accounts and all the Regions where the company has resources.
F. Set up AWS Config for only the organization's management account.
Show Answer
Correct Answer: B, C, E
Explanation: AWS Firewall Manager requires AWS Organizations with all features enabled, all member accounts added to the organization, a designated Firewall Manager administrator account, and AWS Config enabled in all accounts and Regions to evaluate and enforce firewall policies. Therefore, the correct steps are to configure all accounts to join the organization (B), set an account as the Firewall Manager administrator account (C), and set up AWS Config for all accounts and all Regions (E).
Question 78
A company securely connects resources that are in its VPC to a software as a service (SaaS) solution from a SaaS provider. The SaaS solution is hosted in the AWS Cloud and is powered by AWS PrivateLink. The company uses a PrivateLink endpoint to access the SaaS solution behind the SaaS provider's Network Load Balancer (NLB).
The company recently added a new Availability Zone and new subnets to its VPC. A network engineer is unable to deploy a new interface VPC endpoint for the SaaS solution in the new Availability Zone.
What is the cause of this problem?
A. The CIDR block of the new subnets conflicts with the SaaS provider's CIDR block.
B. The enableDnsHostnames attribute and enableDnsSupport attribute were not configured on the new subnets in the new Availability Zone.
C. The SaaS provider does not offer the solution in the new Availability Zone and has not configured cross-zone load balancing for the NLB.
D. The new subnets are missing a route to the VPC internet gateway.
Show Answer
Correct Answer: C
Explanation: Interface VPC endpoints for AWS PrivateLink must be created in Availability Zones where the endpoint service (backed by the SaaS provider’s NLB) is available. If the SaaS provider has not deployed the service in the new Availability Zone and has not enabled cross-zone load balancing on the NLB, the endpoint cannot be created in that AZ. Other options (CIDR conflicts, DNS attributes, or internet gateway routes) do not prevent endpoint creation.
Question 79
An international company wants to implement a multi-site hybrid infrastructure. The company wants to deploy its cloud computing resources on AWS in the us-east-1 Region and in the eu-west-2 Region, and in on-premises data centers in the United States (US) and in the United Kingdom (UK). The data centers are connected to each other by a private WAN connection. IP routing information is exchanged dynamically through BGP. The company wants to have two AWS Direct Connect connections, one each in the US and the UK.
The company expects to have 15 VPCs in each Region with CIDR blocks that do not overlap with each other or with CIDR blocks of the on-premises environment. The VPC CIDR blocks are planned so that the prefix aggregation can be performed both on a Regional level and across the entire AWS environment. The company will deploy a transit gateway in each Region to connect the VPCs. A network engineer plans to use a Direct Connect gateway in each Region. A transit VIF will attach the Direct Connect gateway in each Region to the transit gateway in that Region. The transit gateways will be peered with each other.
The network engineer wants to ensure that traffic follows the shortest geographical path from source to destination. Traffic between the on-premises data centers and AWS must travel across a local Direct Connect connection. Traffic between the US data center and eu-west-2 and traffic between the UK data center and us-east-1 must use the private WAN connection to reach the Direct Connect connection to the appropriate Region when the Direct Connect connection is available. The network must be resilient to failures in either the private WAN connection or with the Direct Connect connections. The network also must reroute traffic automatically in the event of any failure.
How should the network engineer configure the transit VIF associations on the Direct Connect gateways to meet these requirements?
A. Advertise only the aggregate route for the company's entire AWS environment.
B. Advertise VPC-specific CIDR prefixes from only the local Region. Additionally, advertise the aggregate route for the company’s entire AWS environment.
C. Advertise all the specific VPC CIDR blocks from both Regions.
D. Advertise both Regional aggregate prefixes. Configure custom BGP communities on the routes advertised toward the data center.
Show Answer
Correct Answer: B
Explanation: Advertising VPC-specific CIDR prefixes only from the local Region ensures that on-premises traffic prefers the geographically closest Direct Connect and Region, achieving shortest-path routing. Advertising the aggregate route for the entire AWS environment provides a less-specific fallback that can be used automatically if the local Direct Connect or WAN path fails, enabling resilient failover via the private WAN or inter-Region transit gateway peering. This balances optimal path selection with resiliency without excessive route advertisement.
Question 80
A company has a data center in the us-west-1 Region with a 10 Gbps AWS Direct Connect dedicated connection to a Direct Connect gateway. There are two private VIFs from the same data center location in us-west-1 that are attached to the same Direct Connect gateway.
VIF 1 advertises 172.16.0.0/16 with an AS_PATH attribute value of 65000. VIF 2 advertises 172.16.1.0/24 with an AS PATH attribute value of 65000 65000 65000.
How will AWS route traffic to the data center for traffic that has a destination address within the 172.16.1.0/24 network range?
A. AWS will route all traffic by using VIF 1.
B. AWS will route all traffic by using VIF 2.
C. AWS will use both VIFs for routing by using a round-robin policy.
D. AWS will use flow control to balance the traffic between the two VIFs.
Show Answer
Correct Answer: B
Explanation: AWS Direct Connect routing follows standard IP longest-prefix-match rules first. VIF 1 advertises 172.16.0.0/16, while VIF 2 advertises the more specific 172.16.1.0/24. For traffic destined to 172.16.1.0/24, AWS will always prefer the /24 route regardless of the longer AS_PATH on VIF 2. AS_PATH length is only considered when comparing routes with the same prefix length. Therefore, all traffic to 172.16.1.0/24 is routed via VIF 2.
Question 81
A company has an application that runs on premises. The application needs to communicate with an application that runs in a VPC on AWS. The communication between the applications must be encrypted and must use private IP addresses. The communication cannot travel across the public internet.
The company has established a 1 Gbps AWS Direct Connect connection between the on-premises location and AWS.
Which solution will meet the connectivity requirements with the LEAST operational overhead?
A. Configure a private VIF on the Direct Connect connection. Associate the private VIF with the VPC's virtual private gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the virtual private gateway.
B. Create a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.
C. Configure a public VIF on the Direct Connect connection. Associate the public VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up an AWS Site-to-Site VPN private IP VPN connection to the transit gateway.
D. Create a transit gateway. Configure a transit VIF on the Direct Connect connection. Associate the transit VIF with a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway. Set up a third-party firewall in a new VPC that is attached to the transit gateway. Set up a VPN connection to the third-party firewall.
Show Answer
Correct Answer: B
Explanation: The requirements are encrypted communication, private IP addressing, no traversal of the public internet, and least operational overhead. Encryption is not provided by Direct Connect itself, so an IPsec VPN is required. A Site-to-Site VPN with private IPs over Direct Connect can be established only when using a transit gateway with a transit VIF and Direct Connect gateway (private IP VPN). Option A is invalid because you cannot establish a Site-to-Site VPN over a private VIF attached directly to a virtual private gateway. Option C relies on a public VIF, which is not appropriate for private IP VPN in this context. Option D adds unnecessary third‑party infrastructure. Therefore, option B is the correct and supported design with the least operational overhead that meets all requirements.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.