A company uses the us-east-1 Region and the ap-south-1 Region for its business units (BUs). The BUS are named BU-1 and BU-Z. For each BU, there are two VPCs in us-east-1 and one VPC in ap-south-1.
Because of workload isolation requirements, resources can communicate within the same BU but cannot communicate with resources in the other BU. The company plans to add more BUs and plans to expand into more Regions
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure an AWS Cloud WAN network that operates in the required Regions. Attach all BU VPCs to the AWS Cloud WAN core network. Update the AWS Cloud WAN segment actions to configure new routes to deny traffic between the different BU segments.
B. Configure a transit gateway in each Region. Configure peering between the transit gateways. Attach the BU VPCs to the transit gateway in the corresponding Region. Configure the transit gateway and VPC route tables to isolate traffic between BU VPCs.
C. Configure an AWS Cloud WAN network that operates in the required Regions. Attach all BU VPCs to the AWS Cloud WAN core network. Update the core network policy by setting the isolate-attachments parameter for each segment.
D. Configure an AWS Cloud WAN network that operates in the required Regions. Create AWS Cloud WAN segments for each BU Configure VPC attachments for each BU’s VPCs to the corresponding BU segment.
Show Answer
Correct Answer: D
Explanation: AWS Cloud WAN is designed for scalable multi-Region networking. Creating a separate Cloud WAN segment for each business unit and attaching each BU's VPCs to its corresponding segment provides built-in traffic isolation between BUs while allowing communication within the same BU across Regions. This scales cleanly as additional BUs and Regions are added. Transit gateways require more operational overhead, using deny actions is less clean than native segmentation, and isolate-attachments only isolates attachments within a segment rather than separating business units into distinct routing domains.
Question 74
A company has a VPC in the AWS Cloud. The company recently acquired a competitor that also has a VPC the AWS Cloud. A network engineer discovers an IP address overlap between the two VPCs. Both VPCs require access to an AWS Marketplace partner service.
Which solution will ensure interoperability among the VPC hosted services and the AWS Markelplace partner service?
A. Configure VPC peering with static routing between the VPCs. Configure an AWS Site-to-Site VPN connection with static routing to the partner service.
B. Configure a NAT gateway in the VPCs. Configure default routes in each VPC to point to the local NAT gateway. Attach each NAT gateway to a transit gateway. Configure an AWS Site-to-Site VPN connection with static routing to the partner service.
C. Configure AWS PrivateLink to facilitate connectivity between the VPCs and the partner service. Use the DNS name that is created with the associated interface endpoints to route traffic between the VPCs and the partner service.
D. Configure a NAT instance in the VPCs. Configure default routes in each VPC to point to the local NAT instance. Configure an interface endpoint in each VPC to connect to the partner service. Use the DNS name that is created with the associated interface endpoints to route traffic between the VPCs and the partner service.
Show Answer
Correct Answer: C
Explanation: AWS PrivateLink is designed to provide private connectivity to endpoint services, including many AWS Marketplace partner services, without requiring IP-level connectivity between VPCs. VPC peering does not support overlapping CIDR ranges, and transit gateways or NAT devices do not solve overlapping IP address conflicts. By creating interface endpoints in each VPC, both overlapping VPCs can independently access the partner service using the endpoint DNS names, avoiding routing conflicts.
Question 75
A financial company offers investment forecasts and recommendations to authorized users through the internet. All the services are hosted in the AWS Cloud. A new compliance requirement states that all the internet service traffic from any host must be logged and retained for 2 years. In its development AWS accounts, the company has designed, tested, and verified a solution that uses Amazon VPC Traffic Mirroring with a Network Load Balancer (NLB) as the traffic mirror target. While the solution runs in one AWS account, the solution mirrors the traffic to another AWS account.
A network engineer notices that not all traffic is mirrored when the solution is deployed into the production environment. The network engineer also notices that this behavior is random.
Which statements are possible explanations for why not all the traffic is mirrored? (Choose two.)
A. The security groups are misconfigured on the production AWS account that hosts the company’s services.
B. The Amazon EC2 instance that is being monitored cannot handle the extra traffic that Traffic Mirroring has introduced.
C. The IAM policy that allows the creation of traffic mirror sessions is misconfigured
D. The mirrored traffic has a lower priority than the production traffic and is being dropped when network congestion occurs.
E. The NLB is experiencing warm-up delay because of sudden and significant increases in traffic.
Show Answer
Correct Answer: B, D
Explanation: Traffic Mirroring uses the source instance's available network bandwidth. If the monitored EC2 instance is bandwidth-constrained, mirrored packets can be dropped. In addition, mirrored traffic is best-effort and has lower priority than production traffic, so during network congestion the mirrored traffic is dropped before production traffic. Security groups do not control the mirroring function itself, a misconfigured IAM policy would prevent creating sessions rather than cause random packet loss, and Network Load Balancers do not have a warm-up behavior that explains intermittent mirroring loss.
Question 76
A company is using third-party firewall appliances to monitor and inspect traffic on premises. The company wants to use the same model on AWS. The Company has a single VPC with an internet gateway. The VPC has a fleet of web servers that run on Amazon EC2 instances that are managed by an Auto Scaling group.
The company’s network team needs to work with the security team to establish inline inspection of all packets that are sent to and from the web servers. The solution must scale as the fleet of virtual firewall appliances scales
Which combination of steps should the network team take to implement this solution? (Choose three.)
A. Create a new VPC, and deploy a fleet of firewall appliances. Create a Gateway Load Balancer. Add the firewall appliances as targets.
B. Create a security group for use with the firewall appliances, and allow port 443. Allow a port for the Galeway Load Balancer to perform health checks.
C. Create a security group for use with the firewall appliances, and allow port 6081. Allow a port for the Gateway Load Balancer to perform health checks.
D. Deploy a fleet of firewall appliances to the existing VPC. Create a Gateway Load Balancer. Add the firewall appliances as targets.
E. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.
F. Create a new route table inside the web server VPC. Create a new edge association with the internet gateway. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.
Show Answer
Correct Answer: A, C, F
Explanation: Gateway Load Balancer is the AWS service for transparent inline insertion of third-party virtual appliances. The appliances should allow GENEVE traffic on port 6081 and the health check port. AWS recommends deploying the inspection appliances in a dedicated VPC behind a Gateway Load Balancer. To inspect ingress/egress traffic from the internet, an internet gateway edge-associated route table is required to steer traffic to the Gateway Load Balancer endpoint, which entails creating a route table and associating it with the internet gateway if one does not already exist.
Question 77
A company has many application VPCs that use AWS Site-to-Site VPN connections for connectivity to an on-premises location. The company’s network team wants to gradually migrate to AWS Transit Gateway to provide VPC-to-VPC connectivity.
The network team sets up a transit gateway that uses equal-cost multi-path (ECMP) routing. The network team attaches two temporary VPCs to the transit gateway for testing. The test VPCs contain Amazon EC2 instances to confirm connectivity over the transit gateway between the on-premises location and the VPCs. The network team creates two new Site-to-Site VPN connections to the transit gateway.
During testing, the network team cannot reach the required bandwidth of 2.5 Gbps over the pair of new Site-o-Site VPN connections.
Which combination of steps should the network team take to improve bandwidth performance and minimize network congestion? (Choose three.)
A. Enable acceleration for the existing Site-to-Site VPN connections to the transit gateway.
B. Create new accelerated Site-to-Site VPN connections to the transit gateway.
C. Advertise the on-premises prefix to AWS with the same BGP AS_PATH attribute across all the Site-to-Site VPN connections.
D. Advertise the on-premises prefix to AWS with a different BGP AS_PATH attribute across all the Site-to-Site VPN connections.
E. Verify that the transit gateway attachments are present in the Availability Zones of the test VPC.
F. Verify that the on-premises location is sending traffic by using multiple lows.
Show Answer
Correct Answer: B, C, F
Explanation: To maximize VPN throughput with a Transit Gateway using ECMP, create new accelerated Site-to-Site VPN connections because acceleration cannot be enabled on existing VPNs. ECMP requires equal BGP path attributes, so advertising the on-premises prefixes with the same AS_PATH across the VPN connections allows traffic to be load-balanced. Finally, VPN throughput is flow-based (a single flow is limited), so the on-premises side should send traffic using multiple flows to aggregate bandwidth and reduce congestion.
Question 78
A company’s network engineer must implement a cloud-based networking environment for a network operations team to centrally manage. Other Teams will use the environment. Each team must be able to deploy infrastructure to the environment and must be able to manage its own resources. The environment must feature IPv4 and IPv6 support and must provide internet connectivity in a dual-stack configuration.
The company has an organization in AWS Organizations that contains a workload account for the teams. The network engineer creates a new networking account in the organization.
Which combination of steps should the network engineer take next to meet the requirements? (Choose three.)
A. Create a new VPC. Associate an IPv4 CIDR block of 10.0.0.0/16 and specify an IPv6 block of 2001:db8:c5a:6000::/56. Provision subnets by assigning /24 IPv4 CIDR blocks and /64 IPv6 CIDR blocks.
B. Create a new VPC. Associate an IPv4 CIDR block of 10.0.0.0/16 and use an Amazon-provided IPV6 CIDR block. Provision subnets by assigning /24 IPv4 CIDR blocks and /64 IPV6 CIDR blocks.
C. Enable sharing of resources within the organization by using AWS Resource Access Manager (AWS RAM). Create a resource share in the networking account, select the provisioned subnets, and share the provisioned subnets with the target workload account. Use the workload account to accept the resource share through AWS RAM.
D. Enable sharing of resources within the organization by using AWS Resource Access Manager (AWS RAM). Create a resource share in the networking account, select the new VPC, and share the new VPC with the target workload account. Use the workload account to accept the resource share through AWS RAM.
E. Create an internet gateway and an egress-only internal gateway. Deploy NAT gateways to the public subnets. Associate the internet gateway with the new VPC. Update the route tables. Associate the route tables with the relevant subnets.
F. Create an internet gateway. Deploy NAT instances to public subnets. Update the route tables. Associate the route tables with the relevant subnets.
Show Answer
Correct Answer: B, C, E
Explanation: Use an Amazon-provided IPv6 CIDR for dual-stack VPCs, share subnets (not the entire VPC) with workload accounts using AWS RAM for centralized networking and delegated resource management, and configure an internet gateway, egress-only internet gateway for IPv6 outbound-only access, and NAT gateways with appropriate routes for IPv4 private subnet internet access.
Question 79
A company ran out of IP address space in one of the Availability Zones in an AWS Region that the company uses. The Availability Zone that is out of space is assigned the 10.10.1.0/24 CIDR block. The company manages its networking configurations in an AWS CloudFormation stack. The company’ VPC is assigned the 10 10.0.0/16 CIDR block and has available capacity in the 10.10.1.0/22 CIDR block.
How should a network specialist add more IP address space in the existing VPC with the LEAST operational overhead?
A. Update the AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Change the CidrBlock property to 10.10.1.0/22.
B. Update the AWS::EC2::VPC resource in the CloudFormation stack. Change the CidrBlock property to 10.10.1.0/22.
C. Copy the CloudFormation stack. Set the AWS::EC2::VPC resource CidrBlock property to 10.10.0.0/16. Set the AWS::EC2::Subnet resource CidrBlock property to 10.10.1.0/22 for the Availability Zone.
D. Create a new AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Set the CidrBlock property to 10.10.2.0/24.
Show Answer
Correct Answer: D
Explanation: The CIDR block of an existing subnet cannot be expanded by updating its CidrBlock property; changing it requires replacement, causing disruption. Similarly, changing the VPC's primary CIDR block is not supported in this manner. Recreating the entire stack is unnecessary and has high operational overhead. The lowest-overhead approach is to add an additional subnet in the same Availability Zone using unused address space from the VPC CIDR, such as 10.10.2.0/24, and place new resources there.
Question 80
A company has two data centers that are interconnected with multiple redundant links from different suppliers. The company Uses IP addresses that are within the 172.16,0.0/16 CIDR block. The company is running iBGP between the two data centers by using a private Autonomous System Number (ASN) and IGP.
The company is moving toward a hybrid setup in which the company will initially use one VPC in the AWS Cloud. An AWS Direct Connect connection runs from the first data center to a Direct Connect gateway by using a private VIF. On the connection, the company advertises a summarized route for the 172.16.0.0/16 network. The company is planning to set up a second summarized route from the second data center to a different Direct Connect location.
The company needs to implement a solution to route traffic to and from AWS through the first Direct Connect connection. The solution must use the second Direct Connect connection for failover purposes only.
Which solution will meet these requirements?
A. Prepend the private ASN on the BGP announcements to AWS from the second data center. Add a second VIF in the first Direct Connect connection. Advertise the same network without any prepends from the first data center. Implement the same setup for the BGP announcement from AWS to the two data centers.
B. Tag the BGP announcements with the local preference BGP community tags. Set the tag to high preference for the first data center. Set the tag to low preference for the second data center. Configure the second data center’s router to have a lower local preference for the direct AWS BGP advertisements than for the advertisement from the fist data center.
C. Configure the Direct Connect gateway to prefer routing through the Direct Connect connection with the first data center. Configure the second data center’s router to have a lower local preference for the direct AWS BGP advertisements than for the advertisement from the first data center.
D. Configure the focal AWS Region BGP community tag on the BGP route that is advertised from the fist data center. Configure AS_PATH prepends on the BGP announcements from the second data center.
Show Answer
Correct Answer: B
Explanation: Use AWS Direct Connect local preference BGP community tags to make AWS prefer the primary Direct Connect (high preference on the first data center, low preference on the second). For return traffic from the data centers toward AWS, configure the second data center to assign a lower local preference to its directly learned AWS routes than to the routes learned over iBGP from the first data center, so the first connection is preferred and the second is used only during failover. AS_PATH prepending alone is less appropriate because AWS evaluates Direct Connect local preference communities before AS_PATH for private routing. A and D rely on mechanisms that do not correctly address both traffic directions in this scenario, and C assumes a Direct Connect gateway preference configuration that does not exist.
Question 81
A company is running business applications on AWS. The company uses 50 AWS accounts, thousands of VPCs, and 3 AWS Regions across the United States and Europe.
A network engineer needs to establish network connectivity between an on-premises data center and the Regions. The network engineer also must establish connectivity between the VPCs. On-premises: users and applications must be able to connect to applications that run in the VPCs.
The company has an existing AWS Direct Connect connection that the network engineer can use. The network engineer creates a transit gateway in each Region and configures the transit gateways as inter-Region peers.
Which solution will provide network connectivity from the on-premises data center to the Regions and will provide inter-VPC communications across the different Regions?
A. Create a private VIF with a gateway type of virtual private gateway. Configure the private VIF to use a virtual private gateway that is associated with one of the VPCs.
B. Create a private VIF to a new Direct Connect gateway. Associate the new Direct Connect gateway with a virtual private gateway in each VPC.
C. Create transit VIF with a gateway association to a new Direct Connect gateway. Associate each transit gateway with the new Direct Connect gateway.
D. Create an AWS Site-to-Site VPN connection that uses a public VIF for the Direct Connect connection. Attach the Site-to-Site VPN connection to the transit gateways.
Show Answer
Correct Answer: C
Explanation: A transit VIF connects the existing AWS Direct Connect connection to a Direct Connect gateway, and a Direct Connect gateway can be associated with transit gateways. Since the company already uses a transit gateway in each Region with inter-Region peering, associating those transit gateways to a Direct Connect gateway provides scalable on-premises connectivity to all attached VPCs across accounts and Regions, while the existing transit gateway peering provides inter-Region VPC communication. The other options rely on virtual private gateways, which do not scale for thousands of VPCs or integrate with transit gateways in the required architecture, or use VPN unnecessarily.
Question 82
A company has an internal web-based application that employees use. The company hosts the application over a VPN in the company’s on-premises network. The application runs on a fleet of Amazon EC2 instances in a private subnet behind a Network Load Balancer (NLB) in the same subnet. The instances are in an Amazon EC2 Auto Scaling group.
During a recent security incident, SQL injection occurred on the application. A network engineer must implement a solution to prevent SQL injection attacks in the future.
Which combination of steps will meet these requirements? (Choose three.)
A. Create an AWS WAF web ACL that includes rules to block SQL injection attacks.
B. Create an Amazon CloudFront distribution. Specify the EC2 instances as the origin.
C. Replace the NLB with an Application Load Balancer.
D. Associate the AWS WAF web ACL with the NLB.
E. Associate the AWS WAF web ACL with the Application Load Balancer.
F. Associate the AWS WAF web ACL with the Amazon CloudFront distribution.
Show Answer
Correct Answer: A, C, E
Explanation: AWS WAF protects against SQL injection by using managed or custom web ACL rules. AWS WAF can be associated with an Application Load Balancer but not a Network Load Balancer. Therefore, replace the NLB with an ALB, create a WAF web ACL with SQL injection rules, and associate the web ACL with the ALB. CloudFront is not required for this internal VPN-hosted application.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.