A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all inbound traffic to the ALB to come from CloudFront. The network engineer must implement the solution at the network layer rather than in the application.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.
B. Add an inbound rule to the network ACLs that are associated with the ALB's subnets. Use the AWS managed prefix list for CloudFront as the source in the rule.
C. Configure CloudFront to add a custom HTTP header to the requests that CloudFront sends to the ALB.
D. Associate an AWS WAF web ACL with the ALB. Configure the AWS WAF rules to allow traffic from the CloudFront IP set. Automatically update the CloudFront IP set by using an AWS Lambda function.
Show Answer
Correct Answer: A
Explanation: The requirement is to restrict access at the network layer so that only CloudFront can reach the ALB, using the most operationally efficient approach. Using the AWS managed prefix list for CloudFront in the ALB’s security group enforces this at Layer 3/4, is simple to configure, and is automatically kept up to date by AWS. Network ACLs are less efficient to manage, and custom headers or AWS WAF operate at the application layer, which does not meet the requirement.
Question 83
A company's VPC has Amazon EC2 instances that are communicating with AWS services over the public internet. The company needs to change the connectivity so that the communication does not occur over the public internet.
The company deploys AWS PrivateLink endpoints in the VPC. After the deployment of the PrivateLink endpoints, the EC2 instances can no longer communicate at all with the required AWS services.
Which combination of steps should a network engineer take to restore communication with the AWS services? (Choose two.)
A. In the VPC route table, add a route that has the PrivateLink endpoints as the destination.
B. Ensure that the enableDnsSupport attribute is set to True for the VPC. Ensure that each VPC endpoint has DNS support enabled.
C. Ensure that the VPC endpoint policy allows communication.
D. Create an Amazon Route 53 public hosted zone for all services.
E. Create an Amazon Route 53 private hosted zone that includes a custom name for each service.
Show Answer
Correct Answer: B, C
Explanation: PrivateLink relies on private DNS to resolve AWS service endpoints to the interface endpoint ENIs. The VPC must have enableDnsSupport enabled, and the VPC endpoint must also have DNS support enabled, otherwise name resolution will fail. Additionally, VPC endpoint policies can explicitly allow or deny access to services; if the policy is restrictive, communication will fail even with correct networking. No route table changes or Route 53 hosted zones are required for interface endpoints.
Question 84
A company is building an API-based application on AWS and is using a microservices architecture for the design. The company is using a multi-account AWS environment that includes a separate AWS account for each microservice development team. Each team hosts its microservice in its own VPC that contains Amazon EC2 instances behind a Network Load Balancer (NLB).
A network engineer needs to use Amazon API Gateway in a shared services account to create an HTTP API to expose these microservices to external applications. The network engineer must ensure that access to the microservices can occur only over a private network. Additionally, the company must be able to control which entities from its internal network can connect to the microservices. In the future, the company will create more microservices that the company must be able to integrate with the application.
What is the MOST secure solution that meets these requirements?
A. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALB. Create a VPC endpoint service in each microservice account. Create an AWS PrivateLink endpoint for those services in the shared services account. Add the elastic network interface IP addresses of the VPC endpoint as targets for the target group of the ALB.
B. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALConnect all the VPCs to each other by using a central transit gateway. Add the IP addresses of the NLB as IP-based targets in the ALB target group.
C. Configure the integration to the API Gateway API by using HTTP-based integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate HTTP integration to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the HTTP integration.
D. Configure the integration to the API Gateway API by using VPC link integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate VPC link to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the VPC link integration.
Show Answer
Correct Answer: A
Explanation: The requirements are private-only connectivity, strong access control from the internal network, cross-account microservices, and future scalability. API Gateway HTTP APIs require a VPC link for private integrations, and for cross-account targets the supported and most secure pattern is API Gateway (shared account) → VPC link → ALB (shared account) → AWS PrivateLink → NLBs in the microservice accounts. PrivateLink exposes each microservice as a VPC endpoint service without full VPC connectivity, allowing fine-grained access control via endpoint permissions and security groups, and avoids CIDR overlap and blast-radius issues of Transit Gateway. Options B, C, and D rely on Transit Gateway or unsupported cross-account VPC link/NLB integrations, which are less secure or not valid for HTTP API private integrations. Therefore, option A is the most secure and correct solution.
Question 85
An education agency is preparing for its annual competition between schools. In the competition, students at schools from around the country solve math problems, complete puzzles, and write essays.
The IP addressing plan of all the schools is well-known and is administered centrally. The competition is hosted in the AWS Cloud and is not publicly available. All competition traffic must be encrypted in transit. Only authorized endpoints can access the competition. All the schools have firewall policies that block ICMP traffic.
A network engineer builds a solution in which all the schools access the competition through AWS Site-to-Site VPN connections. The network engineer uses BGP as the routing protocol. The network engineer must implement a solution that notifies schools when they lose connectivity and need to take action on their premises to address the issue.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Monitor the state of the VPN tunnels by using Amazon CloudWatch. Create a CloudWatch alarm that uses Amazon Simple Notification Service (Amazon SNS) to notify people at the affected school if the tunnels are down.
B. Create a scheduled AWS Lambda function that pings each school's on-premises customer gateway device. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if the ping fails.
C. Create a scheduled AWS Lambda function that uses the VPC Reachability Analyzer API to verify the connectivity. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if failure occurs.
D. Create an Amazon CloudWatch dashboard for each school to show all CloudWatch metrics for each school's Site-to-Site VPN connection. Share each dashboard with the appropriate school.
E. Create a scheduled AWS Lambda function to monitor the existence of each school's routes in the VPC route table where VPN routes are propagated. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if failure occurs.
Show Answer
Correct Answer: A, E
Explanation: Monitoring VPN tunnel state with CloudWatch provides a native, low-cost way to detect loss of connectivity and trigger SNS notifications when tunnels go down, directly meeting the notification requirement. Monitoring BGP route propagation by checking for the existence of VPN-propagated routes in the VPC route table detects loss of routing even if tunnels appear up, ensuring schools are notified when action is required. Other options are either infeasible (ICMP blocked), more expensive, or do not provide proactive notifications.
Question 86
A company has two business units (BUs). The company operates in the us-east-1 Region and the us-west-1 Region. The company plans to extend to more Regions in the future. Each BU has a VPC in each Region. Each Region has a transit gateway with the BU VPCs attached. The transit gateways in both Regions are peered.
The company will create several more BUs in the future and will need to isolate some of the BUs from the other BUs. The company wants to migrate to an architecture to incorporate more Regions and BUs.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new transit gateway for each new BU in each Region. Peer the new transit gateways with the existing transit gateways. Update the route tables to control traffic between BUs.
B. Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Use segment actions to control traffic between segments.
C. Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Configure the segments to isolate attachments to control traffic between segments.
D. Attach new VPCs to the existing transit gateways. Update route tables to control traffic between BUs.
Show Answer
Correct Answer: B
Explanation: AWS Cloud WAN is designed for multi-Region, multi-VPC network scaling with centralized policy management. Creating a Cloud WAN core network with segments per BU allows clean logical separation of BUs across Regions and simplifies future expansion. Segment actions explicitly control inter-segment connectivity, enabling selective isolation between BUs with minimal operational overhead. This is more operationally efficient and scalable than managing multiple transit gateways, peering connections, and route tables manually.
Question 87
A company has started using AWS Cloud WAN with one edge location in the us-east-1 Region. The company has a production segment and a security segment in AWS Cloud WAN. The company also has a default core network policy.
The company has created a production VPC for the production workload. The company has created an outbound inspection VPC to inspect internet-bound traffic from the production VPC. The company has attached the production VPC to the production segment and has attached the outbound inspection VPC to the security segment. The company has also created an AWS Network Firewall firewall in the outbound inspection VPC to inspect internet-based traffic.
The company has updated a route table for the production VPC to send all internet-bound traffic to the AWS Cloud WAN core network. The company has updated a route table for the outbound inspection VPC to ensure that Network Firewall inspects any outgoing traffic and incoming traffic.
During testing, an Amazon EC2 instance in the production VPC cannot reach the internet. The company checks the Network Firewall rules and confirms that the rules are not blocking the traffic.
Which combination of steps will meet these requirements? (Choose two.)
A. Update the core network policy to configure segment sharing. Share the production segment with the security segment.
B. Update the core network policy to create a static route for the security segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
C. Update the core network policy to create a static route for the production segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
D. Update the core network policy to create a static route for the production segment. Specify 10.2.0.0/16 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
E. Create an attachment to attach the outbound inspection VPC to the production segment. Update the core network policy to turn on isolated attachment for the production segment.
Show Answer
Correct Answer: A, C
Explanation: Traffic from the production VPC is sent to the Cloud WAN core, but without core network policy updates it cannot reach the outbound inspection VPC or return correctly. Segment sharing is required so the production segment can communicate with the security segment (A). In addition, the core network policy must include a static route in the production segment for 0.0.0.0/0 that points to the outbound inspection VPC attachment so all internet-bound traffic is forwarded to the inspection VPC (C).
Question 88
A company is building a new workload on AWS that uses an Application Load Balancer (ALB). The company has configured a new ALB target group that uses slow start mode. A team begins registering Amazon EC2 instances as targets in the new target group. During testing, the team observes that the targets did not enter slow start mode.
What caused the targets to not enter slow start mode?
A. The ALB configuration uses the round robin routing algorithm for traffic.
B. The target group did not contain at least one healthy target configured in slow start mode.
C. The target group must contain EC2 instances that are all the same instance type.
D. The ALB configuration uses the 5-tuple criteria for traffic.
Show Answer
Correct Answer: B
Explanation: ALB slow start only applies when new targets are added to a target group that already has at least one healthy target not in slow start mode. If slow start is enabled on an empty target group and targets are registered together, they will not enter slow start. This behavior matches AWS documentation.
Question 89
A network engineer configures a second AWS Direct Connect connection to an existing network. The network engineer runs a test in the AWS Direct Connect Resiliency Toolkit on the connections. The test produces a failure. During the failover event, the network engineer observes a 90-second interruption before traffic shifts to the failover connection.
Which solution will reduce the time for failover?
A. Decrease the BGP hello timer to 5 seconds.
B. Add a VPN connection to the connectivity solution. Implement fast failover.
C. Configure Bidirectional Forwarding Detection (BFD) on the on-premises router.
D. Decrease the BGP hold-down timer to 5 seconds.
Show Answer
Correct Answer: C
Explanation: The 90-second interruption is due to slow failure detection with standard BGP timers. Bidirectional Forwarding Detection (BFD) provides sub-second link failure detection and integrates with BGP to trigger rapid route withdrawal, significantly reducing failover time on AWS Direct Connect. Adjusting BGP timers alone is less effective and not supported/recommended by AWS, and adding a VPN does not directly address the Direct Connect failover delay.
Question 90
A company wants to use an AWS Network Firewall firewall to secure its workloads in the cloud through network traffic inspection. The company must record complete metadata information, such as source/destination IP addresses and protocol type. The company must also record all network traffic flows and any DROP or ALERT actions that the firewall takes for traffic that the firewall processes. The Network Firewall endpoints are placed in the correct subnets, and the VPC route tables direct traffic to the Network Firewall endpoints on the path to and from the internet.
How should a network engineer configure the firewall to meet these requirements?
A. Create a firewall policy to ensure that traffic is processed by stateless or stateful rules according to needs. Select Amazon CloudWatch Logs as the destination for the flow logs.
B. Create a firewall policy to ensure that traffic is processed by stateless or stateful rules according to needs. Configure Network Firewall logging for alert logs and flow logs. Select a destination for logs separately for stateful and stateless engines.
C. Create a firewall policy to ensure that a stateful engine processes all the traffic. Configure Network Firewall logging for alert logs and flow logs. Select a destination for alert logs and flow logs.
D. Create a firewall policy to ensure that a stateful engine processes all the traffic. Configure VPC flow logs for the subnets that the firewall protects. Select a destination for the flow logs.
Show Answer
Correct Answer: C
Explanation: AWS Network Firewall logging (flow logs and alert logs) is generated only for traffic that is processed by the stateful rules engine. To record complete metadata for all traffic flows and to capture DROP or ALERT actions taken by the firewall, the firewall policy must ensure that all traffic is forwarded to the stateful engine. Configuring Network Firewall logging for both flow logs and alert logs then meets the requirement. Stateless-only processing or VPC Flow Logs would not capture firewall actions.
Question 91
A company has a transit gateway in AWS Account A. The company uses AWS Resource Access Manager (AWS RAM) to share the transit gateway so that users in other accounts can connect to multiple VPCs in the same AWS Region. AWS Account B contains a VPC (10.0.0.0/16) with subnet 10.0.0.0/24 in the us-west-2a Availability Zone and subnet 10.0.1.0/24 in the us-west-2b Availability Zone. Resources in these subnets can communicate with other VPCs.
A network engineer creates two new subnets: 10.0.2.0/24 in the us-west-2b Availability Zone and 10.0.3.0/24 in the us-west-2c Availability Zone. All the subnets share one route table. The default route 0.0.0.0/0 is pointing to the transit gateway. Resources in subnet 10.0.2.0/24 can communicate with other VPCs, but resources in subnet 10.0.3.0/24 cannot communicate with other VPCs.
What should the network engineer do so that resources in subnet 10.0.3.0/24 can communicate with other VPCs?
A. In Account B, add 10.0.2.0/24 and 10.0.3.0/24 as the destinations to the route table. Use the transit gateway as the target.
B. In Account B, update the transit gateway attachment. Attach the new subnet ID that is associated with us-west-2c to Account B's VPC.
C. In Account A, create a static route for 10.0.3.0/24 in the transit gateway route tables.
D. In Account A, recreate propagation for 10.0.0.0/16 in the transit gateway route tables.
Show Answer
Correct Answer: B
Explanation: A transit gateway VPC attachment is Availability Zone–specific. To send traffic from subnets in a given AZ to the transit gateway, the attachment must include at least one subnet from that AZ. The new subnet 10.0.3.0/24 is in us-west-2c, but the existing transit gateway attachment does not include a subnet from that AZ, so traffic cannot reach the transit gateway. Updating the attachment in Account B to add a subnet from us-west-2c resolves the issue.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.