2021 Realistic Verified Free Amazon AWS-Advanced-Networking-Specialty Exam Questions
AWS-Advanced-Networking-Specialty Real Exam Questions and Answers FREE
NEW QUESTION 26
Your company's policy requires that all VPCs peer with a "common services: VPC. This VPC contains a fleet of layer 7 proxies and an Internet gateway. No other VPC is allowed to provision an Internet gateway.
You configure a new VPC and peer with the common service VPC as required by policy. You launch an Amazon EC2. Windows instance configured to forward all traffic to the layer 7 proxies in the common services VPC. The application on this server should successfully interact with Amazon S3 using its properly configured AWS Identity and Access Management (IAM) role. However, Amazon S3 is returning
403 errors to the application.
Which step should you take to enable access to Amazon S3?
- A. Configure a VPC endpoint for Amazon S3 in the same subnet as the instance.
- B. Update the S3 bucket policy with the private IP address of the instance.
- C. Exclude 169.254.169.0/24 from the instance's proxy configuration.
- D. Update the CORS configuration for Amazon S3 to allow traffic from the proxy.
Answer: D
NEW QUESTION 27
You use a VPN to extend your corporate network into a VPC. Instances in the VPC are able to resolve resource records in an Amazon Route 53 private hosted zone. Your on-premises DNS server is configured with a forwarder to the VPC DNS server IP address. On-premises users are unable to resolve names in the private hosted zone, although instances in a peered VPC can.
What should you do to provide on-premises users with access to the private hosted zone?
- A. Create a proxy resolver within the VPC. Point the on-premises forwarder to the proxy resolver.
- B. Configure the on-premises server as a secondary DNS for the private zone. Update the NS records.
- C. Update the on-premises forwarders with the four name servers assigned to the private hosted zone.
- D. Modify the network access control list on the VPC to allow DNS queries from on-premises systems.
Answer: C
Explanation:
Explanation/Reference:
References: https://aws.amazon.com/blogs/security/how-to-set-up-dns-resolution-between-on-premises- networks-and-aws-by-using-unbound/
NEW QUESTION 28
A company has an AWS Direct Connect connection between its on-premises data center and Amazon VPC.
An application running on an Amazon EC2 instance in the VPC needs to access confidential data stored in the on-premises data center with consistent performance For compliance purposes, data encryption is required.
What should the network engineer do to meet these requirements?
- A. Configure a private virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
- B. Configure a public virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
- C. Configure an internet gateway in the VPC Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.
- D. Configure an internet gateway in the VPC Set up a software VPN between the customer gateway and an EC2 instance in the VPC.
Answer: C
NEW QUESTION 29
An organization will be extending its existing on-premises infrastructure into the cloud. The design consists of a transit VPC that contains stateful firewalls that will be deployed in a highly available configuration across two Availability Zones for automatic failover.
What MUST be configured for this design to work? (Select two.)
- A. Static routing
- B. A different Autonomous System Number (ASN) for each firewall.
- C. Autonomous system (AS) path prepending
- D. Equal-cost multi-path routing (ECMP)
- E. Border Gateway Protocol (BGP) routing
Answer: D,E
NEW QUESTION 30
Due to security requirements, all traffic must be encrypted between your VPC and your on- premises data center. You also want to maintain reliability.
What two options will allow you to achieve this?
Choose the 2 correct answers:
- A. A Direct Connect connection with a Hosted VIF
- B. A Direct Connect connection with a Private VIF
- C. A Direct Connect connection with a Public VIF
- D. A VPN connection
Answer: C,D
Explanation:
To run VPN over DX, you need to have a public VIF to access the VPN endpoints.
NEW QUESTION 31
Which of these is not required when setting up a VIF? Choose the correct answer:
- A. BGP MED
- B. BGP Key
- C. VLAN ID
- D. ASN
Answer: A
Explanation:
BGP MED is used to steer traffic and not for requesting a VIF.
NEW QUESTION 32
A company has 225 mobile and desktop devices and 300 partner VPNs that need access to an AWS VPC. VPN users should not be able to reach one another. Which approach will meet the technical and security requirements while minimizing costs?
- A. Use the AWS IPsec VPN for the mobile, desktop, and partner VPN connections. Use network access control lists (Network ACLs) and security groups to maintain routing separation.
- B. Use the AWS IPsec VPN for the partner VPN connections. Use an Amazon EC2 instance VPN for the mobile and desktop devices. Use Network ACLs and security groups to maintain routing separation.
- C. Create an AWS Direct Connect connection between on-premises and AWS Use a public virtual interface to connect to the AWS IPsec VPN for the mobile, desktop, and partner VPN connections.
- D. Use an Amazon EC2 instance VPN for the desktop, mobile, and partner VPN connections. Use features of the VPN instance to limit routing and connectivity.
Answer: D
NEW QUESTION 33
Your company's policy requires that all VPCs peer with a "common services: VPC. This VPC contains a fleet of layer 7 proxies and an Internet gateway. No other VPC is allowed to provision an Internet gateway. You configure a new VPC and peer with the common service VPC as required by policy. You launch an Amazon EC2. Windows instance configured to forward all traffic to the layer 7 proxies in the common services VPC.
The application on this server should successfully interact with Amazon S3 using its properly configured AWS Identity and Access Management (IAM) role. However, Amazon S3 is returning 403 errors to the application.
Which step should you take to enable access to Amazon S3?
- A. Configure a VPC endpoint for Amazon S3 in the same subnet as the instance.
- B. Update the S3 bucket policy with the private IP address of the instance.
- C. Exclude 169.254.169.0/24 from the instance's proxy configuration.
- D. Update the CORS configuration for Amazon S3 to allow traffic from the proxy.
Answer: D
NEW QUESTION 34
You have a management server that needs to be able to communicate with two subnets. One of these subnets is private. This subnet must remain private and must not pass any traffic back to other subnets. How would you configure this?
Choose the correct answer:
- A. Configure a security group rule to allow access from the management server to the private server.
- B. Configure a NACL to allow access from the management server to the private server.
- C. Add an ENI to the management server that resides in the subnet of the private server.
- D. You can't do this without allowing traffic back through the other subnet.
Answer: C
Explanation:
Add an ENI to the management server that resides in the subnet of the private server. This will allow the management server to communicate with the private server without having to change security rules.
NEW QUESTION 35
An AWS CloudFormation template is being used to create a VPC peering connection between two existing operational VPCs, each belonging to a different AWS account. All necessary components in the 'Remote' (receiving) account are already in place.
The template below creates the VPC peering connection in the Originating account. It contains these components:
AWSTemplateFormation Version: 2010-09-09
Parameters:
Originating VCId:
Type: String
RemoteVPCId:
Type: String
RemoteVPCAccountId:
Type: String
Resources:
newVPCPeeringConnection:
Type: 'AWS::EC2::VPCPeeringConnection'
Properties:
VpcdId: !Ref OriginatingVPCId
PeerVpcId: !Ref RemoteVPCId
PeerOwnerId: !Ref RemoteVPCAccountId
Which additional AWS CloudFormation components are necessary in the Originating account to create an operational cross-account VPC peering connection with AWS CloudFormation? (Select two.)
- A. Resources:NetworkInterfaceToRemoteVPC:Type: "AWS::EC2NetworkInterface"
- B. Resources:NewEC2SecurityGroup:Type: AWS::EC2::SecurityGroup
- C. Resources:VPCGatewayToRemoteVPC:Type: "AWS::EC2::VPCGatewayAttachment"
- D. Resources:newVPCPeeringConnection:Type: 'AWS::EC2VPCPeeringConnection'PeerRoleArn: !Ref PeerRoleArn
- E. Resources:newEC2Route:Type: AWS::EC2::Route
Answer: D,E
Explanation:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_EC2.html
NEW QUESTION 36
An organization runs a consumer-facing website on AWS. The Amazon EC2-based web fleet is load balanced using the AWS Application Load Balancer, Amazon Route 53 is used to provide the public DNS services.
The following URLs need to server content to end users:
test.example.com
web.example.com
example.com
Based on this information, what combination of services must be used to meet the requirement? (Select two.)
- A. Host condition a ALB listener to route example.com to appropriate target groups.
- B. Host condition in ALB listener to route $$$$.example.com to appropriate target groups.
- C. Path condition in ALB listener to route *.example.com to appropriate target groups.
- D. Path condition in ALB listener to route example.com to appropriate target groups.
- E. Host condition in ALB listener to route *.example.com to appropriate target groups.
Answer: A,E
Explanation:
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#rule-condition-types
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html
NEW QUESTION 37
Your organization runs a popular e-commerce application deployed on AWS that uses autoscaling in conjunction with an Elastic Load balancing (ELB) service with an HTTPS listener. Your security team reports that an exploitable vulnerability has been discovered in the encryption protocol and cipher that your site uses.
Which step should you take to fix this problem?
- A. Generate new SSL certificates for all web servers and replace current certificates.
- B. Generate new SSL certificates and use ELB to front-end the encrypted traffic for all web servers.
- C. Change the security policy on the ELB to disable vulnerable protocols and ciphers.
- D. Leverage your current configuration management system to update SSL policy on all web servers.
Answer: C
NEW QUESTION 38
Your application server instances reside in the private subnet of your VPC. These instances need to access a Git repository on the Internet. You create a NAT gateway in the public subnet of your VPC. The NAT gateway can reach the Git repository, but instances in the private subnet cannot.
You confirm that a default route in the private subnet route table points to the NAT gateway. The security group for your application server instances permits all traffic to the NAT gateway.
What configuration change should you make to ensure that these instances can reach the patch server?
- A. Configure an outbound rule on the application server instance security group for the Git repository.
- B. Configure inbound network access control lists (network ACLs) to allow traffic from the Git repository to the public subnet.
- C. Assign public IP addresses to the instances and route 0.0.0.0/0 to the Internet gateway.
- D. Configure an inbound rule on the application server instance security group for the Git repository.
Answer: A
Explanation:
The traffic leaves the instance destined for the Git repository; at this point, the security group must allow it through. The route then directs that traffic (based on the IP) to the NAT gateway. A is wrong because it removes the private aspect of the subnet and would have no effect on the blocked traffic anyway. C is wrong because the problem is that outgoing traffic is not getting to the NAT gateway. D is wrong because to allow outgoing traffic to the Git repository requires an outgoing security group rule.
NEW QUESTION 39
Your hybrid networking environment consists of two application VPCs, a shared services VPC, and your corporate network. The corporate network is connected to the shared services VPC via an IPsec VPN with dynamic (BGP) routing enabled.
The applications require access to a common authentication service in the shared services VPC. You need to enable native network access from the corporate network to both application VPCs.
Which step should you take to meet the requirements?
- A. Configure additional IPsec VPNs for each application VPC back to the corporate network, and enable VPC peering to the shared services VPC.
- B. Use VPC peering to peer the application VPCs with the shared services VPC, and enable associated routing in the shared services VPC via the corporate VPN.
- C. Enable CloudHub functionality to route traffic between the three VPCs and the corporate network using dynamic BGP routing.
- D. Configure an IPsec VPN between the virtual private gateway in each application VPC to the virtual private gateway in the shared services VPC.
Answer: A
NEW QUESTION 40
You run a well-architected, multi-AZ application in the eu-central-1 (Frankfurt) AWS region. The application is hosted in a VPC and is only accessed from the corporate network. To support large volumes of data transfer and administration of the application, you use a single 10-Gbps AWS Direct Connect connection with multiple private virtual interfaces. As part of a review, you decide to improve the resilience of your connection to AWS and make sure that any additional connectivity does not share the same Direct Connect routers at AWS. You need to provide the best levels of resilience to meet the application's needs.
Which two options should you consider? (Select two.)
- A. Deploy an IPsec VPN over the Internet to the eu-west-1 region for diversity.
- B. Install a second 10-Gbps Direct Connect connection to a Direct Connect location in eu-west-1.
- C. Install a second 10-Gbps Direct Connect connection to a second Direct Connect location for eu-central-1.
- D. Install a second 10-Gbps Direct Connect connection to the same Direct Connection location.
- E. Deploy an IPsec VPN over a public virtual interface on a new 10-Gbps Direct Connect connection.
Answer: C,D
Explanation:
https://aws.amazon.com/directconnect/resiliency-recommendation/
NEW QUESTION 41
You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URL, the instances should be able to access any Amazon S3 bucket in the same region via any URL.
Which of the following solutions should you deploy? (Select two.)
- A. Create a VPC endpoint for S3.
- B. Run Squid proxy on a NAT instance.
- C. Deploy a NAT gateway into your VPC.
- D. Include s3.amazonaws.com in the whitelist.
- E. Utilize a security group to restrict access.
Answer: A,B
Explanation:
Explanation
https://aws.amazon.com/blogs/security/how-to-set-up-an-outbound-vpc-proxy-with-domain-whitelisting-and-con
NEW QUESTION 42
Which service parses large Flow Logs for consumption by other programs such as Kibana?
Choose the correct answer:
- A. ElasticSearch
- B. Elastic Beanstalk
- C. Kinesis
- D. S3
Answer: A
NEW QUESTION 43
A corporate network routing table contains 624 individual RFC 1918 and public IP prefixes. You have two AWS Direct Connect connectors. You configure a private virtual interface on both connections to a virtual private gateway. The virtual private gateway is not currently attached to a VPC. Neither BGP session will maintain the Established state on the customer router. The AWS Management Console reports the private virtual interfaces as Down.
What could you do to address the problem so that the AWS Management Console reports the private virtual interface as Available?
- A. Change the BGP advertisements from the corporate network to only be a default route.
- B. Attach the virtual private gateway to a VPC and enable route propagation.
- C. Attach the second virtual interface to an alternative virtual private gateway.
- D. Filter the public IP prefixes on the corporate network from the private virtual interface.
Answer: A
Explanation:
https://aws.amazon.com/es/premiumsupport/knowledge-center/virtual-interface-bgp-down/
NEW QUESTION 44
An organization is using a VPC endpoint for Amazon S3. When the security group rules for a set of instances were initially configured, access was restricted to allow traffic only to the IP addresses of the Amazon S3 API endpoints in the region from the published JSON file. The application was working properly, but now is logging a growing number of timeouts when connecting with Amazon S3. No internet gateway is configured for the VPC.
Which solution will fix the connectivity failures with the LEAST amount of effort?
- A. Update the VPC routing to direct Amazon S3 prefix-list traffic to the VPC endpoint using the route table APIs.
- B. Create an additional VPC endpoint for Amazon S3 in the same route table to scale the concurrent connections to Amazon.
- C. Update the application server's outbound security group to use the prefix-list for Amazon S3 in the same region.
- D. Create a Lambda function to update the security group based on AmazonIPSpaceChanged notifications.
Answer: C
NEW QUESTION 45
You use a VPN to extend your corporate network into a VPC. Instances in the VPC are able to resolve resource records in an Amazon Route 53 private hosted zone. Your on-premises DNS server is configured with a forwarder to the VPC DNS server IP address. On-premises users are unable to resolve names in the private hosted zone, although instances in a peered VPC can.
What should you do to provide on-premises users with access to the private hosted zone?
- A. Update the on-premises forwarders with the four name servers assigned to the private hosted zone.
- B. Configure the on-premises server as a secondary DNS for the private zone. Update the NS records.
- C. Create a proxy resolver within the VPC. Point the on-premises forwarder to the proxy resolver.
- D. Modify the network access control list on the VPC to allow DNS queries from on-premises systems.
Answer: C
Explanation:
References: https://aws.amazon.com/blogs/security/how-to-set-up-dns-resolution-between-on-premises-networks-and-aws-by-using-unbound/
NEW QUESTION 46
Your Amazon Kinesis application receives data streams from thousands of devices. The data is then stored in an on-premises Hadoop cluster. You are concerned about historical data that shows periods of sustained traffic between 1 Gbps and 2 Gbps during peaks. You must ensure that you have secure, fault- tolerant connectivity between Amazon Kinesis and your data center.
What should you implement to address these needs?
- A. Deploy two 1-Gbps Direct Connect connections.
- B. Deploy three 1-Gbps Direct Connect connections.
- C. Deploy a single 1-Gbps Direct Connect connection with a VPN backup.
- D. Set up an IPsec VPN connection over Direct Connect with two tunnels.
Answer: B
Explanation:
Three connections are required to provide fault tolerance. All of the other options would be unable to handle the peak loads over 1 Gbps without exceeding the available bandwidth.
NEW QUESTION 47
Your company has a 1-Gbps AWS Direct Connect connection to AWS. Your company needs to send traffic from on-premises to a VPC owned by a partner company. The connectivity must have minimal latency at the lowest price.
Which of the following connectivity options should you choose?
- A. Enable VPC peering and use your VPC as a transitive point to reach the partner VPC.
- B. Create a new Direct Connect connection, and set up a new circuit to connect to the partner VPC using a private virtual interface.
- C. Create a new Direct Connect connection, and leverage the existing circuit to connect to the partner VPC.
- D. Create a new private virtual interface, and leverage the existing connection to connect to the partner VPC.
Answer: D
Explanation:
https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html#create-vpc-peering-connection-remote
NEW QUESTION 48
A company is connecting to a VPC over an AWS Direct Connect using a private VIF, and a dynamic VPN connection as a backup. The company's Reliability Engineering team has been running failover and resiliency tests on the network and the existing VPC by simulating an outage situation on the Direct Connect connection. During the resiliency tests, traffic failed to switch over to the backup VPN connection.
How can this failure be troubleshot?
- A. Ensure that Bidirectional Forwarding Detection is enabled on the Direct Connect connection
- B. Reconfigure the Direct Connect session from static routes to Border Gateway Protocol (BGP) peering.
- C. Confirm that the same routes are being advertised over both the VPN and Direct Connect.
- D. Configure a virtual private gateway for the VPN and another virtual private gateway for Direct Connect.
Answer: C
NEW QUESTION 49
You have two VPCs that you've peered. You created a route for VPC A to get to an instance in VPC
- A. You have to enable Source/Destination check in the VPCs.
- B. You have to configure the peering connection to allow two way traffic.
- C. ICMP is not supported over peering connections.
- D. You forgot to add a return route.
- E. You are unable to ping the instance. You have double checked your security groups and NACLs.
Why might this be?
Choose the correct answer:
Answer: E
Explanation:
Every route needs a return route for ICMP traffic.
NEW QUESTION 50
......
Exam Dumps AWS-Advanced-Networking-Specialty Practice Free Latest Amazon Practice Tests: https://www.dumpstillvalid.com/AWS-Advanced-Networking-Specialty-prep4sure-review.html
