A company has VPCs across 50 AWS accounts and is using AWS Organizations. The company wants to implement web filtering. The requirements for how the traffic must be filtered are the same for all the VPCs. A network engineer plans to use AWS Network Firewall. The network engineer needs to implement a solution that minimizes the number of firewall policies and rule groups that are necessary for this web filtering.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a firewall policy or rule group in each account.
B. Use SCPs to share the firewall policy or rule group.
C. Create a firewall policy or rule group in the management account
D. Use AWS Resource Access Manager (AWS RAM) to share the firewall policy or rule group.
E. Enable sharing within Organizations.
F. Create OUs to share the firewall policy or rule group.
Show Answer
Correct Answer: C, D, E
Explanation: To minimize the number of AWS Network Firewall policies and rule groups, create them centrally in the AWS Organizations management account, enable sharing within AWS Organizations, and use AWS Resource Access Manager (AWS RAM) to share the firewall policies and rule groups with member accounts. Creating separate policies in each account defeats the goal of centralization, SCPs cannot share Network Firewall resources, and creating OUs is optional for organizing sharing targets but not required for the sharing mechanism.
Question 84
An online retail company is running a web application in the us-wast-2 Region and serves consumers in the United States. The company plans to expand across several countries in Europe and wants to provide low latency for all its users.
The application needs to identify the users’ IP addresses and provide localized content based on the users’ geographic location. The application uses HTTP GET and POST methods for its functionality. The company also needs to develop a failover mechanism that works for GET and POST methods and is based on health checks. The failover must occur in less than 1 minute for all clients.
Which solution will meet these requirements?
A. Configure a Network Load Balancer (NLB) for the application in each environment in the new AWS Regions. Create an AWS Global Accelerator accelerator that has endpoint groups that point to the NLBs in each Region.
B. Configure an Application Load Balancer (ALB) for the application in each environment in the new AWS Regions. Create an AWS Global Accelerator accelerator that has endpoint groups that point to the ALBs in each Region.
C. Configure an Application Load Balancer (ALB) for the application in each environment in the new AWS Regions. Create Amazon Route 53 public hosted zones that have failover routing policies.
D. Configure a Network Load Balancer (NLB) for the application in each environment in the new AWS Regions. Create an Amazon CloudFront distribution. Configure an origin group with origin failover options.
Show Answer
Correct Answer: B
Explanation: AWS Global Accelerator provides anycast IPs, routes users to the nearest healthy regional endpoint, preserves the client source IP for supported endpoints, and performs rapid health-check-based failover that is typically much faster than DNS-based approaches. An Application Load Balancer is designed for HTTP/HTTPS applications supporting both GET and POST methods. Route 53 DNS failover cannot guarantee client failover in under 1 minute because of DNS caching. CloudFront origin failover applies only to cacheable/idempotent requests (primarily GET/HEAD), not POST. NLBs can front HTTP, but ALB is the appropriate load balancer for an HTTP web application requiring Layer 7 features.
Question 86
A company has deployed an application in which the front end of the application communicates with the backend instances through a Network Load Balancer (NLB) in the same VPC. The application is highly available across two Availability Zones. The company wants to limit the amount of traffic that travels across the Availability Zones. Traffic from the front end of the application must stay in the same Availability Zone unless there is no healthy target in that Availability Zone behind the NLB. If there is no healthy target in the same Availability Zone, traffic must be sent to the other Availability Zone.
Which solution will meet these requirements?
A. Create a private hosted zone with weighted routing for each Availability Zone. Point the primary record to the local Availability Zone NLB DNS record. Point the secondary record to the Regional NLB DNS record. Configure the front end of the application to perform DNS lookups on the local private hosted zone records.
B. Turn off cross-zone load balancing on the NLConfigure the front end of the application to perform DNS lookups on the local Availability Zone NLB DNS record.
C. Create a private hosted zone. Create a failover record for each Availability Zone. For each failover record, point the primary record to the local Availability Zone NLB DNS record and point the secondary record to the Regional NLB DNS record. Configure the front end of the application to perform DNS lookups on the local private hosted zone records.
D. Enable sticky sessions (session affinity) so that the NLB can bind a user’s session to targets in the same Availability Zone.
Show Answer
Correct Answer: C
Explanation: The requirement is zonal affinity with failover to another Availability Zone only when the local zone has no healthy targets. Disabling cross-zone load balancing alone does not provide cross-AZ failover; an NLB node with cross-zone disabled will not forward to targets in another AZ. Using Route 53 private hosted zone failover records that prefer the local zonal NLB DNS name and fall back to the regional NLB DNS name satisfies the requirement.
Sources:
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-subnets.html
https://aws.amazon.com/blogs/networking-and-content-delivery/application-load-balancer-type-target-group-for-network-load-balancer
Question 87
A company is planning to host external websites on AWS. The websites will include multiple tiers such as web servers, application logic services, and databases. The company wants to use AWS Network Firewall, AWS WAF, and VPC security groups for network security.
The company must ensure that the Network Firewall firewalls are deployed appropriately within relevant VPCs. The company needs the ability to centrally manage policies that are deployed to Network Firewall and AWS WAF rules. The company also needs to allow application teams to manage their own security groups while ensuring that the security groups do not allow overly permissive access.
What is the MOST operationally efficient solution that meets these requirements?
A. Define Network Firewall firewalls, AWS WAFV2 web ACLs. Network Firewall policies, and VPC security groups in code. Use AWS CloudFormation to deploy the objects and initial policies and rule groups. Use CloudFormation to update the AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups. Use Amazon GuardDuty to monitor for overly permissive rules.
B. Define Network Firewall firewalls. AWS WAFV2 web ACLs, Network Firewall policies, and VPC security groups in code. Use the AWS Management Console or the AWS CLI to manage the AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups. Use Amazon GuardDuly to invoke an AWS Lambda function to evaluate the configured rules and remove any overly permissive rules.
C. Deploy AWS WAFv2 IP sets and AWS WAFv2 web ACLs with AWS CloudFormation. Use AWS Firewall Manager to deploy Network Firewall firewalls and VPC security groups where required and to manage the AWS WAFv2 web ACLs, Network Firewall policies, and VPC security groups.
D. Define Network Firewall firewalls, AWS WAFv2 web ACLS, Network Firewall policies, and VPC security groups in code. Use AWS CloudFarmation to deploy the objects and initial policies and rule groups. Use AWS Firewall Manager to manage the AWS WAFV2 web ACLS, Network Firewall policies, and VPC security groups. Use Amazon GuardDuty to monitor for overly permissive rules.
Show Answer
Correct Answer: C
Explanation: AWS Firewall Manager is the service designed to centrally deploy and manage AWS Network Firewall policies, AWS WAF web ACLs, and security group policies across an AWS Organization. It can automatically deploy Network Firewall to in-scope VPCs and enforce security group policies that audit or remediate overly permissive rules while still allowing application teams to manage their own security groups within guardrails. GuardDuty does not monitor or enforce overly permissive security group rules, so the options relying on GuardDuty for that purpose are incorrect. CloudFormation can be used to define WAF resources such as IP sets and web ACLs, while Firewall Manager provides the centralized ongoing management required.
Sources:
https://www.pass4success.com/amazon/discussions/exam-ans-c01-topic-1-question-42-discussion
Question 88
A company is replatforming a legacy data processing solution to AWS. The company deploys the solution on Amazon EC2 Instances in private subnets that are in one VPC.
The solution uses Amazon S3 for abject storage. Both the data that the solution processes and the data the solution produces are stored in Amazon S3. The solution uses Amazon DynamoDB to save its own state. The company collects flow logs for the VPC. The solution uses one NAT gateway to register its license through the internet. A software vendor provides a specific hostname so the solution can register its license.
The company notices that the AWS bill exceeds the projected budget for the solution. A network engineer uses AWS Cost Explorer to investigate the bill. The network engineer notices that the USE2-NatGateway-Bytes($) usage type is the root cause of the higher than expected bill.
What should the network engineer do to resolve the issue? (Choose two.)
A. Set up Amazon VPC Traffic Mirroring. Analyze the traffic to identify the traffic that the NAT gateway processes.
B. Examine the VPC flow logs to identity the traffic that traverses the NAT gateway.
C. Set up an AWS Cost and Usage Report in the AWS Billing and Cost Management console. Examine the report to find more details about the NAT gateway charges.
D. Verify that the security groups attached to the EC2 instances allow outgoing traffic only to the IP addresses that the hostname resolves to, the VPC CIDR block, and the AWS IP address ranges for Amazon S3 and DynamoDB.
E. Verify that the gateway VPC endpoints for Amazon S3 and DynamoDB are both set up and associated with the route tables of the private subnets.
Show Answer
Correct Answer: B, E
Explanation: The excessive NAT gateway data processing charges indicate that significant traffic is traversing the NAT gateway. VPC Flow Logs are the appropriate tool to identify which traffic is using the NAT gateway. Traffic to Amazon S3 and DynamoDB from private subnets should use gateway VPC endpoints rather than the NAT gateway. Verifying that gateway endpoints for both services exist and are associated with the private subnet route tables prevents that traffic from incurring NAT gateway data processing charges. Traffic Mirroring is unnecessary and adds cost, Cost and Usage Reports do not identify the network flows causing the charges, and tightening security groups does not address the root cause of unnecessary NAT traversal.
Question 89
A company has two on-premises data centers. The first data center is in the us-east-1 Region. The Second data canter is in the us-east-2 Region. Each data center connects to the closest AWS Direct Connect facility. The company uses Direct Connect connections, transit VIFs, and a single Direct Connect gateway to establish connectivity to VPCs in us-east-1 and us-east-2 from the company’s data centers. The company also has private connectivity from a telecommunications provider that connects the first data center to the second data center.
Recently, there have been multiple connection disruptions to the private connectivity between the data centers. The company needs a solution to improve the reliability of the connection between the two data centers.
Which solution will meet these requirements?
A. Create a new Direct Connect gateway. Enable the Direct Connect SiteLink feature on the transit VIF. Share the CIDR blocks from the first data center and the second data center with each other.
B. Create a new public VIF to both Regions. Enable the Direct Connect SiteLink feature on the new public VIF.
C. Enable the Direct Connect SiteLink feature on the existing Direct Connect connections.
D. Enable the Direct Connect SiteLink feature on the existing transit VIFS that are attached to the existing Direct Connect gateway.
Show Answer
Correct Answer: D
Explanation: AWS Direct Connect SiteLink is enabled on virtual interfaces (including transit VIFs), not on the physical Direct Connect connection. With existing transit VIFs attached to a Direct Connect gateway, enabling SiteLink allows direct site-to-site communication between the two on-premises locations over the AWS global network, improving reliability without creating new gateways or VIFs. A is unnecessary because a new Direct Connect gateway is not required. B is incorrect because public VIFs are not used for this purpose. C is incorrect because SiteLink is configured on VIFs, not the Direct Connect connection.
Question 90
A company needs to protect against potential botnet command and control traffic from any Amazon EC2 instances that is in in the company’s AWS Environment.
Which solution will meet these requirements?
A. Use AWS Shield Advanced. Activate Shield Advanced protections on the EC2 instances to filter and block botnet traffic.
B. Use Amazon Route 53 Resolver DNS Firewall. Add a rule to a rule group to use the AWSManagedDomainsBotnetCommandandControl managed domain list with an action to block botnet traffic.
C. Use AWS WAF Bot Control. Configure a managed rule group that uses an AWS managed rule set to block botnet traffic.
D. Use AWS Systems Manager. Run a Systems Manager Automation runbook on the EC2 instances to configure the instances to block botnet traffic.
Show Answer
Correct Answer: B
Explanation: Amazon Route 53 Resolver DNS Firewall can block DNS resolution to known botnet command-and-control domains using the AWSManagedDomainsBotnetCommandandControl managed domain list. This directly addresses preventing EC2 instances from communicating with botnet C2 infrastructure. AWS Shield Advanced protects against DDoS attacks, AWS WAF Bot Control targets bots accessing web applications rather than outbound EC2 C2 traffic, and Systems Manager Automation is not a managed botnet C2 protection mechanism.
Question 91
A company is migrating an application to the AWS Cloud. The company has successfully provisioned and tested connectivity between AWS Direct Connect and the company's on-premises data center. The application runs on Amazon EC2 instances across multiple Availability Zones. The instances are in an Auto Scaling group.
The application communicates through HTTPS to a third-party vendor's data service that is hosted at the company’s data center. The data service implements a static ACL through explicit allow listing of client IP addresses.
A network engineer must design a network solution so that the migrated application can continue to access the vendor’s data service as the application scales.
Which solution will meet these requirements with the LEAST amount of ongoing change to the vendor's allow list?
A. Configure a private NAT gateway in the subnets for each Availability Zone that the application runs in. Configure the application to target the NAT gateways instead of the data service directly. Update the data service's allow list to include the IP addresses of the NAT gateways.
B. Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Associate the elastic network interfaces with the Auto Scaling group for the application. Update the data service's allow list to include the IP addresses of the elastic network interfaces.
C. Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Launch an EC2 instance into each subnet. Attach the respective elastic network interfaces to the new EC2 instances. In the application subnet route tables, configure the new EC2 instances as the next destination for the data service. Update the data service’s allow list to include the IP addresses of the elastic network interfaces.
D. Configure an Application Load Balancer (ALB) in the subnets for each Availability Zone that the application runs in. Configure an ALB-associated target group that contains a target that uses the IP address for the data service. Configure the application to target the ALB instead of the data service directly. Update the data service's allow list to include the IP addresses of the ALBs.
Show Answer
Correct Answer: A
Explanation: A private NAT gateway provides stable private IP addresses for outbound connections from the application to the on-premises data service over Direct Connect. The vendor only needs to allowlist the NAT gateway IPs (typically one per Availability Zone), while the Auto Scaling group's EC2 instances can scale without changing the source IPs seen by the data service. ENIs cannot be shared by an Auto Scaling group as source identities in this manner, NAT instances require more management, and an ALB does not provide fixed source IPs to the backend service.
Question 92
A company has established connectivity between its on-premises data center in Paris. France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway.
The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center.
In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet.
Which set of steps should a network engineer take to meet these requirements?
A. 1. Create public subnets in the Tokyo VPC to migrate the workloads into. 2. Configure an internet gateway for the Tokyo office to reach the Tokyo VPC. 3. Configure security groups on the Tokyo workloads to only allow traffic from the Tokyo office and the Paris workloads. 4. Create peering connections between the Tokyo VPC and the Paris VPCs. 5. Configure a VPN connection between the Paris data center and the Tokyo office by using existing routers.
B. 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC. 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Set up a new Direct Connect connection from the Tokyo office to the Tokyo transit gateway. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
C. 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VP 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Configure an AWS Site-to-Site VPN connection from the Tokyo office. Set the Tokyo transit gateway as the target. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
D. 1. Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit gateway. 2. Create an association between the Paris transit gateway and the Tokyo VPC. 3. Configure routing on the Paris transit gateway to allow data to flow between sites and the VPC.
Show Answer
Correct Answer: C
Explanation: A new Direct Connect circuit cannot realistically be provisioned within 5 days, so using AWS Site-to-Site VPN is the appropriate connectivity method for the migration timeline. Because the workloads are in a new VPC in the Tokyo Region and must communicate with workloads behind the existing transit gateway in Paris, create a transit gateway in Tokyo, attach the Tokyo VPC, peer the Tokyo and Paris transit gateways, terminate the Site-to-Site VPN on the Tokyo transit gateway, and configure routing between the transit gateways and VPCs. This provides private connectivity between the Tokyo office, the Tokyo VPC, the Paris VPCs, and the Paris data center via the existing Direct Connect and transit gateway.
Question 93
Company A recently acquired Company B. Company A has a hybrid AWS and on-premises environment that uses a hosted AWS Direct Connect connection, a Direct Connect gateway, and a transit gateway. Company A has a transit VIF to access the resources in its production environment in the us-east-1 Region.
Company B has applications that run across multiple VPCs in the us-west-2 Region in a single AWS account. A transit gateway connects all Company B's application VPCs. The CIDR blocks for both companies do not overlap.
Company A needs to use the existing Direct Connect connection to access Company B’s applications from the on-premises environment.
Which solution will meet these requirements?
A. Create a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a transit VIF on the existing hosted connection for Company B.
B. Create an association proposal from the Company B account to associate the Company B transit gateway with the Company A Direct Connect gateway. Accept the transit gateway association proposal by logging into the Company A account.
C. Create multiple virtual private gateways. Attach the virtual private gateways to each of Company B's application VPCs. Create a hosted private VIF for each virtual private gateway.
D. Create a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a hosted private VIF for Company B.
Show Answer
Correct Answer: B
Explanation: A Direct Connect gateway can be associated with multiple transit gateways, including across AWS accounts by using a transit gateway association proposal. Company A already has the Direct Connect gateway and transit VIF on the existing hosted Direct Connect connection. Company B should propose associating its transit gateway to Company A's Direct Connect gateway, and Company A accepts the proposal. This reuses the existing Direct Connect infrastructure without creating additional Direct Connect gateways or VIFs. Options A and D require new Direct Connect gateways and additional VIFs unnecessarily, and C is operationally inefficient and does not leverage the transit gateway design.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.