Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 265 discussion

Exam question from Amazon's AWS Certified Advanced Networking - Specialty ANS-C01

Question #: 265
Topic #: 1

[All AWS Certified Advanced Networking - Specialty ANS-C01 Questions]

A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establish connectivity between an on-premises environment and the AWS environment. The company does not have a static public IP address for the on-premises environment.

Which combination of steps should the company take to establish VPN connectivity between the transit gateway and the on-premises environment? (Choose two.)

A. Create a public certificate in AWS Certificate Manager (ACM).
B. Create a private certificate in AWS Certificate Manager (ACM).
C. Configure the Site-to-Site VPN tunnels to use the pre-shared key (PSK).
D. Create a customer gateway. Specify the current dynamic IP address of the customer gateway device's external interface.
E. Create a customer gateway. Do not specify the IP address of the customer gateway device.

Show Suggested Answer

Suggested Answer: BE 🗳️

by ashk123456 at April 1, 2025, 9:59 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

AWSLoverLoverLoverLoverLover

2 months, 3 weeks ago

Selected Answer: BE

Answer: B & E

upvoted 1 times

...

ashk123456

2 months, 4 weeks ago

Selected Answer: BE

Why B (Create a private certificate in ACM) is correct: • AWS requires a private certificate from AWS Certificate Manager (ACM) for certificate-based authentication. • The certificate is used to authenticate the VPN connection instead of a pre-shared key (PSK). Why E (Create a customer gateway without specifying an IP address) is correct: • If the on-premises IP address is dynamic, you must create a customer gateway without an IP address. • This allows the VPN to function with BGP (Border Gateway Protocol), which dynamically updates the connection when the on-premises IP changes.

upvoted 2 times

...