Suggested Answer:C🗳️
In Amazon CloudFront, while creating a web distribution, you can create one or more Amazon S3 buckets or configure HTTP servers as your origin servers. An origin is the location where you store the original version of your web content. When CloudFront gets a request for your files, it goes to the origin to get the files that it distributes at edge locations. You can use any combination of Amazon S3 buckets and HTTP servers as your origin servers. Reference: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating.html
Q13, Feb, 2022
A company wants to migrate its production and development applications to the AWS Cloud across multiple VPCs in three AWS Regions us-east-1 (N Virginia), eu-west-1 (Ireland), and ap- southeast-1 (Singapore) The company needs a scalable solution that provides connectivity between all three Regions The solution also must provide private connectivity to the company's on-premises data center in Northern Virginia Data that is transferred from on premises and data that is transferred between Regions must be encrypted in transit The company requires predictable network performance and must minimize cost The company has initiated a solution by deploying a transit gateway with two route tables in each Region One route table is for the production environment, and one route table is for the development environment What else must the company do to meet its requirements with the LOWEST latency?
A. Deploy an AWS Direct Connect connection in us-east-1 and a public VIF to the on-premises data center On each transit gateway, create a VPN attachment over the public VIF for the production and development route tables Create transit gateway peenng connections to route traffic between Regions
B. Deploy an AWS Direct Connect connection in us-east-1 and a transit VIF to the on-premises data center Associate all transit gateways and the transit VIF with a different Direct Connect gateway. Create transit gateway peering connections to route traffic between Regions
C. Deploy an AWS Direct Connect connection in us-east-1 and a public VIF to the on-premises data center. On each transit gateway, create a VPN attachment over the public VIF for the production and development route tables. Route traffic between Regions through the VPN connections.
D. Deploy an AWS Direct Connect connection in us-east-1 to the on-premises data center Create one transit VIF for each transit gateway route table, and associate each transit VIF with a Direct Connect gateway Associate all transit gateways with the Direct Connect gateway Create transit gateway peering connections to route traffic between Regions.
B and D are out since traffic need to be encrypted in transit between Onprem and AWS- VPN over public VIF needed
TGW peering encrypts traffic between them
Answer: A
Q12 - Fe, 2012
A company has two AWS accounts: one for Production and one for Connectivity. A network engineer needs to connect the Production account VPC to a transit gateway in the Connectivity account. The feature to auto accept shared attachments is not enabled on the transit gateway.
Which sot of stops should the network engineer follow in each AWS account to meet those requirements?
A. In the Production account Create a resource share In AWS Resource Access Manager for the transit gateway Provide the Connectivity account ID Enable the feature to allow external accounts
. In the Connectivity account Accept the resource
. In the Connectivity account Create an attachment to the VPC subnets
. In the Production account: Accept the attachment. Associate a route table with the attachment.
B. In the Production account Create a resource share In AWS Resource Access Manager for the VPC subnets Provide the Connectivity account ID Enable the feature to allow external accounts.
. In the Connectivity account Accept the resource.
. In the Production account Create an attachment on the transit gateway to the VPC subnets
. In the Connectivity account Accept the attachment Associate a route table will the attachment.
C. In the Connectivity account Create a resource share in AWS Resource Access Manager for the VPC subnets. Provide the Production account ID Enable the feature lo allow external accounts.
. In the Production account Accept the resource
. In the Connectivity account Create an attachment on the transit gateway to the VPC subnets A In the Production account . Accept the attachment Associate a route table with the attachment.
D. In the Connectivity account Create a resource share in AWS Resource Access Manager for the transit gateway Provide the Production account ID Enable the feature to allow external accounts
. In the Production account Accept the resource.
. In the Production account Create an attachment to the VPC subnets
. In the Connectivity account Accept the attachment. Associate a route tab e win toe attachment
I stand corrected : D
the ARM share is created in the connectivity account
the VPC attachemnts are created in the Prod Account
the Route tables are created/propagated i nthe Connectivity account
Answer : D
Q11 - Feb, 2022
A financial services company receives real-time stock quotes in its ingestion VPC. The company plans to perform customer-specific data analysis on the stock quotes in various VPCs. The stock quotes must be distributed simultaneously from Amazon EC2 instances in the ingestion VPC to EC2 instances in the data analysis VPCs Which set of configuration steps should the company lake to meet these requirements?
A.Configure EC2 instances m f he ingestion VPC as IP unicast senders Configure a transit gateway to serve as a unicast router for instances that send traffic destined for the EC2 instances in the data analysis VPCs.
B.Configure VPC peering between the ingestion VPC and the data analysis VPCs Configure an Application Load Balancer to distribute Virtual Extensible LAN (VXLAN)-encapsulated traffic from the sender EC2 instances to the receiver EC2 instances.
C.Configure EC2 instances m the ingestion VPC as IP multicast senders Configure a transit gateway to serve as a multicast router for instances that send traffic destined for the EC2 instances m the data analysis VPCs
D.Configure Amazon Kinesis Data Forehose to capture streaming data from the ingestion VPC and load the data into Amazon S3 Configure the instances in the data analysis VPCs to download the data from Amazon S3 for processing
Multicast is a communication protocol used for delivering a single stream of data to multiple receiving computers simultaneously. Transit Gateway supports routing multicast traffic between subnets of attached VPCs, and it serves as a multicast router for instances sending traffic destined for multiple receiving instances.
Answer : C
Q10 - Feb, 2022
A company recently migrated its Amazon EC2 instances to VPC private subnets to satisfy a security compliance requirement. The EC2 instances now use a NAT gateway tor internet access After the migration, some long-running database queries from private EC2 instances to a publicly accessible third-party database no longer receive responses The database query logs reveal that the queries successfully completed after 7 minutes but that the client EC2 instances never received the response.
Which configuration change should a network engineer implement to resolve this issue''
A.Configure the NAT gateway timeout to allow connections for up to 600 seconds
B.Enable enhanced networking on the client EC2 instances
C.Enable TCP keepalive on the client EC2 instances with a value of less than 300 seconds
D.Close idle TCP connections though the NAT gateway
Sorry It is C. Enable TCP keepalive on the client EC2 instances with a value of less than 300 seconds
https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-troubleshooting.html
To prevent the connection from being dropped, you can initiate more traffic over the connection. Alternatively, you can enable TCP keepalive on the instance with a value less than 350 seconds.
Answer : C
Q9 - Feb, 2022
A company's developers wrote an AWS Lambda function to modify existing private route tables in response to a security appliance's auto scaling events. The Lambda function will be invoked on lifecycle hooks for an Auto Scaling group and Is configured to run in a VPC The developers are unsure if the following 1AM policy provides sufficient permissions to be used as an execution role for this Lambda function.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "XIlew",
"Action": :
"logs:CreatelogGroup",
"logs :OreateLogStream",
"logs : PutogcgEvents",
"ec2:CreateRoute",
"ec2:DescribeNetworkInterfaces",
"ec2:AssignPrivateIpAddresses",
"ec2:UnassignPrivateIpAddresses"
],
"Resource": "*"
}
]
}
The developers ask a network engineer to review the permissions. Which set of permissions should the network engineer add lo the policy?
A - lambda. ListFunctions, lambda:GetPolicy, and ec2 Delete RouteTable
B - ec2:AssociateAddress, ec2 ModifylnstanceAttribute. and ec2 AssociateRouteTable
C - ec2:CreateNetworklntertace ec2 DeleteNetworklnterface, and ec2 ReplaceRoute
D - ec2:Describei.ifecydoHooks, ec2 DescribeScalingActivities, and ec2 DescribePolicies
Q8 - Feb, 2022
An insurance company is planning the migration of workloads from its on-premises data center to the AWS Cloud The company requires end-to-end domain name resolution Bidirectional DNS resolution between AWS and the existing on-premises environments must be established The workloads will be migrated into multiple VPCs. The workloads also have dependencies on each other, and not all the workloads will be migrated at the same time Which solution meets these requirements?
Which solution meets these requirements?
A.Configure a private hosted zone for each application VPC, and create the requisite records Create a set of Amazon Route 53 Resolver inbound and outbound endpoint In an egress VPC Define Route 53 Resolver rules to forward requests for the on-premises domains to the on-premises DNS resolver Associate the application VPC private hosted zones with the egress VPC and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager. Configure the on premises DNS servers to forward the cloud domains to the Route 53 inbound endpoint.
B.Configure a public hosted zone for each application VPC and create the requisite records Create a set of Amazon Route 53 Resolver Inbound and outbound endpoints in an egress VPC. Define Route 53 Resolver rules to forward requests for the on-premises domains to the on-premises DNS resolver Associate the application VPC private hosted zones with the egress VPC and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints.
C.Configure a private hosted zone for each application VPC, and create the requisite records Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VPC Define Route 53 Resolver rules to forward requests for the on-premises domains to the on-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager. Configure the on-premises DNS servers to forward the cloud domains to the Route 53 outbound endpoint.
D.Configure a private hosted zone for each application VPC, and create the requisite records Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VPC Define Route 53 Resolver rules to forward requests for the on-premises domains to the on-premises DNS resolver Associate the Route 53 outbound rules with the application VPCs and share the private hosted zones with the application accounts by using AWS Resource Access Manager Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoint.
Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints : C out
Associate the Route 53 outbound rules with the application VPCs : A and B out
Answer : D
No not D. Non-sense, you are not ready for the exam.
AWS ARAM lets you share only forwardning rules, not hosted zones.
R3 PHZ association is done using AWS CLI, API orSDK not ARAM
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-associate-vpcs-different-accounts.html
https://docs.aws.amazon.com/ram/latest/userguide/shareable.html
Answer : A
Q7 - FEb, 2022
A company uses an AWS Site-to-Site VPN to connect its corporate network The company recently added an AWS Direct Connect connection A network engineer wants all traffic to use the Direct Connect connection and for the VPN to be used as backup However after the Direct Connect connection was added traffic continued to pass through the VPN connection What should the network engineer do to route the traffic through the Direct Connect connection'?
A.Add routes to the VPC route tables that specify the Direct Connect connection
B.Set local preference BGP community tags on the on-premises router
C.Advertise the same network routes over the Direct Connect connection and VPN connection
D.Ensure the Direct Connect connection AS_PATH is longer than the VPN connection AS_PATH
Q6 - Feb 2022
A company has established an AWS Direct Connect connection between its customer gateway at its on-premises data center and a virtual private gateway m the AWS Cloud The BGP routing protocol configuration includes the Autonomous System Number {ASN) of 7224 on the AWS end of the connection and the BGP ASN of 65004 on the company end of the connection The company's IT administrators report that servers that run at the on-premises data center are not able to communicate with the company's web application that runs on a fleet of Amazon EC2 Instances A network engineer performs initial troubleshooting The network engineer finds that the private VIF is operational and that there is a fully established BGP peering session However, the company still cannot route traffic over the private VIF Which of the following is a possible cause of this connectivity issue?
A.Firewall or ACL rules are blocking TCP pod 179 or are blocking high-numbered ephemeral TCP ports
B.The provider is advertising 50 prefixes for private VIFs
C.VPC route tables am lacking prefixes that point to the virtual private gateway to which the private VIF is connected
D.Peer IP addresses for both sides of the BGP peering session are not configured correctly.
there is a fully established BGP peering session : AandD out
If you're advertising more than 100 routes over the BGP session, then the BGP session goes into an idle state : B Out
Answer : C
Q5 - Feb 2022
A manufacturing company has a hybrid environment that includes an AWS Direct Connect gateway that is associated with an AWS Transit Gateway The company wants to extend a third-party application that is hosted in its on-premises data center into one of its VPCs The application vendor has stated that It must use an overlay IP address to meet the company's requirement for high availability. The DHCP administrator has assigned a non-overlapping RFC1918 private address for use as the overlay IP address The security team requires connectivity to remain private Which solution meets these requirements with the LEAST management overhead''
A.Create a layer 2 VPN across a public VIF by using a software-based VPN on a pair of Amazon EC2 instances Use BGP to advertise the routes over the VPN
B.Create a transit VIF with automatically propagated routes in the transit gateway route table Create a new subnet in the VPC for the overlay IP address, and propagate the route to the VPC route table. Update the route tables on premises as needed.
C.Create an external Network Load Balancer by using Amazon Route 53 to create records that point to the target application's overlay IP address. Create static entries in the VPC route table
D.Create a transit VIF Then create static routes in the transit gateway route table to point to the VPC that contains the overlay IP address Create static routes in the VPC route table that point to the transit gateway Update the route tables on premises as needed
According to this article: https://aws.amazon.com/transit-gateway/faqs/ FAQ "Q: How are routes propagated into the AWS Transit Gateway?" Here's the excerpt "Routes Propagated to/from Amazon VPCs: When you attach an Amazon VPC to an AWS Transit Gateway or resize an attached Amazon VPC, the Amazon VPC Classless Inter-Domain Routing (CIDR) will propagate into the AWS Transit Gateway route table using internal APIs (not BGP). CIDR is a method for allocating IP addresses and IP routing to slow the growth of routing tables on routers across the Internet, and to help slow the rapid exhaustion of IPv4 addresses. Routes in the AWS Transit Gateway route table will not be propagated to the Amazon VPC’s route table. The VPC owner needs to create a static route to send Traffic to the AWS Transit Gateway." I think the answer is B, looks like the VPC will automatically propagate the subnet as it is created in the VPC via API and NOT BGP. NO static route needed.
According to this article: https://aws.amazon.com/transit-gateway/faqs/ FAQ "Q: How are routes propagated into the AWS Transit Gateway?" Here's the excerpt "Routes Propagated to/from Amazon VPCs: When you attach an Amazon VPC to an AWS Transit Gateway or resize an attached Amazon VPC, the Amazon VPC Classless Inter-Domain Routing (CIDR) will propagate into the AWS Transit Gateway route table using internal APIs (not BGP). CIDR is a method for allocating IP addresses and IP routing to slow the growth of routing tables on routers across the Internet, and to help slow the rapid exhaustion of IPv4 addresses. Routes in the AWS Transit Gateway route table will not be propagated to the Amazon VPC’s route table. The VPC owner needs to create a static route to send Traffic to the AWS Transit Gateway." I think the answer is B, looks like the VPC will automatically propagate the subnet as it is created in the VPC via API and NOT BGP. NO static route needed.
Q4-Feb 2022
A company hosts several applications in the AWS Cloud across multiple VPCs that are connected to a transit gateway Redundant AWS Direct Connect connections and a Direct Connect gateway provide private network connectivity lo the company's on-premises environment During a maintenance window, the networking team adds eight VPCs The application management team notices that there is no reachability between the newly created VPCs and the on-premises environment Connectivity between all VPCs through the transit gateway is working as expected.
Which of the following are possible causes of the connectivity issues? (Choose TWO)
A.The prefixes that are advertised from the Direct Connect gateway to the on-premises router are shorter than the CIDR blocks of the newly created VPCs
B.The route tables for the newly created A. VPCs do not have the routes to the on-premises environment that point to the transit gateway attachment
C.The on-premises route tables do not contain the exact CIDR blocks of the newly created VPCs
D.The route tables (or the newly created VPCs have only summary routes for (he on-premises environment (fiat point to the transit gateway attachment.
E.The prefixes that are advertised from the Direct Connect gateway to the on-premises router do not contain the CIDR blocks of the newly created VPCs
Answers: B, E
B: need to create routes in VPC either 0/0 or specific routes to onprem pointing to TGW
E: TGW advertised prefixes over DGW need to be updated to include the newly created VPC CIDRs to Onprem
Q3 - Feb 2022
A logistics company has deployed a hybrid environment that has multiple VPCs in both the us- east-1 Region and the af-south-1 Region The on-premises data center is connected to us-east-1 through an AWS Direct Connect connection The Direct Connect connection is connected to a Direct Connect gateway that is associated with a transit gateway The transit gateway is attached to all the VPCs in us-east-1 An application that is deployed in af-south-1 requires access to a database in the data center The application also requires access to file storage in a VPC in us-east-1 Which solution will meet these requirements with the LOWEST latency?
A.Create a transit gateway in af-south-1, and attach the VPCs Create a transit gateway peering connection between the transit gateways
B.Create a Direct Connect connection in af-south-1, and attach the VPCs with a Direct Connect gateway and a transit gateway Create an AWS Site-to-Site VPN connection over the internet between the Direct Connect connections.
C. Create a transit gateway in af-south-1 and attach the VPCs Associate the transit gateway in af- south-1 with the Direct Connect gateway tn us-east-1
D. Create inter-Region VPC peering connections between the VPCs in each Region Use the transit gateway attachments in us-east-1 to access the database in the data center
Answer :C
Both A and C can be done.
But A does not have the LOWEST latency: If you go with option A traffic will go from VPC inside af-south-1 to its TGW then it will go towards us-east-1 TGW (on the TGW peering connection) > Then it will go to On-premise from us-east-1 TGW [So this is basically 3 hop: TGW in af region, TGW in US region, then On-premise]
If we go with C (which can totally be done): af-south-1 VPC traffic will hit af-south-1 TGW > Which will be directly connected to the DXGW in us-east-1 > So it will go straight to On-premises [This is only 2 HOPS]
NEW Qs here, Feb 2022 - Q2
A company uses multiple AWS accounts within AWS Organizations and has services deployed in a single AWS Region. The instances in a private subnet occasionally download patches from the internet through a NAT gateway The company recently migrated from VPC peering to AWS Transit Gateway The cumulative traffic through deployed NAT gateways Is less than 1Gbps The NAT gateway hourly charge contributes to most of the NAT gateway costs across all linked accounts.
What should the company do to reduce NAT gateway hourly costs?
A. Deploy and use NAT gateways in the same Availability Zone as the heavy-traffic resources.
B- Move to a centralized NAT gateway architecture with NAT gateways deployed in an egress VPC Use VPC peering to send traffic through the centralized NAT gateways.
cchaconUse VPC endpoints to send traffic to AWS services in the same Region.
Move to a centralized NAT gateway architecture with NAT gateways deployed in an egress VPC Use AWS Transit Gateway to send traffic through the centralized NAT gateways.
sorry going again NEW Qs here, Feb 2022 - Q2
A company uses multiple AWS accounts within AWS Organizations and has services deployed in a single AWS Region. The instances in a private subnet occasionally download patches from the internet through a NAT gateway The company recently migrated from VPC peering to AWS Transit Gateway The cumulative traffic through deployed NAT gateways Is less than 1Gbps The NAT gateway hourly charge contributes to most of the NAT gateway costs across all linked accounts.
What should the company do to reduce NAT gateway hourly costs?
A.Deploy and use NAT gateways in the same Availability Zone as the heavy-traffic resources.
B.Move to a centralized NAT gateway architecture with NAT gateways deployed in an egress VPC Use VPC peering to send traffic through the centralized NAT gateways.
C.Use VPC endpoints to send traffic to AWS services in the same Region.
D.Move to a centralized NAT gateway architecture with NAT gateways deployed in an egress VPC Use AWS Transit Gateway to send traffic through the centralized NAT gateways.
Deploying a NAT Gateway in every spoke VPC can become expensive because you pay an hourly charge for every NAT Gateway you deploy (see Amazon VPC pricing), so centralizing it could be a viable option. To centralize, we create an egress VPC in the network services account and route all egress traffic from the spoke VPCs via a NAT Gateway sitting in this VPC leveraging Transit Gateway,
https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-egress-to-internet.html
Answer : D
A NAT gateway supports 5 Gbps of bandwidth and automatically scales up to 45 Gbps. If you require more bandwidth, you can split your resources into multiple subnets and create a NAT gateway in each subnet.
A company uses AWS Direct Connect lo connect its corporate network to multiple VPCs in the same AWS account and the same AVVS Region Each VPC uses its own private VIF and its own virtual LAN on the Direct Connect connection The company has grown and will soon surpass the limit of VPCs and private VIFs for each connection What is the MOST scalable way to add VPCs with on- premises connectivity?
Provision a new Direct Connect connection to handle the additional VPCs Use the new connection to connect additional VPCs.
Create virtual private gateways for each VPC that is over the service quota Use AWS Site-to-Site VPN to connect the virtual private gateways to the corporate network
Create a Direct Connect gateway, and add virtual private gateway associations to the VPCs. Configure a private VIF to connect to the corporate network
Create a transit gateway and attach the VPCs Create a Direct Connect gateway, and associate it with the transit gateway Create a transit VIF to the Direct Connect gateway
You can associate a Transit Gateway to a Direct Connect gateway over a dedicated or hosted Direct Connect connection running at 1 Gbps or more. This option allows you to connect your on-premises data center to up to three Transit Gateways (which can connect to 1000s of VPCs) across different AWS Regions and AWS accounts
Answer : D
This section is not available anymore. Please use the main Exam Page.ANS-C00 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
ChauPhan
Highly Voted 3 years, 7 months agokopper2019
Highly Voted 3 years, 2 months agosapien45
3 years, 1 month agodeechi
Most Recent 2 years, 8 months agoMohamedSherif1
2 years, 12 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agosapien45
3 years, 2 months agoclooudy
3 years agotsangckl
3 years, 2 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agoclooudy
3 years agosapien45
3 years, 2 months agosapien45
3 years, 1 month agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agoclooudy
3 years agotsangckl
3 years, 2 months agosapien45
3 years, 2 months agokopper2019
3 years, 2 months agoBobip
2 years, 10 months agotsangckl
3 years, 2 months agotsangckl
3 years, 2 months agotsangckl
3 years, 2 months agosapien45
3 years, 2 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agotsangckl
3 years, 2 months agosapien45
3 years, 2 months agotiti_r
2 years, 9 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agotsangckl
3 years, 2 months agosapien45
3 years, 2 months agosapien45
3 years, 1 month agotsangckl
3 years, 1 month agokopper2019
3 years, 2 months agoBobyly
3 years, 2 months agosapien45
3 years, 2 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agoclooudy
3 years agoBobyly
3 years, 2 months agosapien45
3 years, 2 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agotsangckl
3 years, 2 months agoclooudy
3 years, 1 month agolurker8000
2 years, 11 months agolurker8000
2 years, 11 months agosapien45
3 years, 2 months agolurker8000
2 years, 11 months agolurker8000
2 years, 11 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agosapien45
3 years, 2 months agotsangckl
3 years, 2 months agoclooudy
3 years agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agoBobyly
3 years, 2 months agosapien45
3 years, 2 months agoBalki
2 years, 4 months agoSickcnt
2 years, 2 months agoSickcnt
2 years, 2 months agokopper2019
3 years, 2 months agokopper2019
3 years, 2 months agoBobyly
3 years, 2 months agosapien45
3 years, 2 months agosapien45
3 years, 1 month agokopper2019
3 years, 2 months agoBobyly
3 years, 2 months agosapien45
3 years, 2 months ago