ANS-C00 questions and answers

You can use the ____ command of the AWS Config service CLI to see the compliance state for each AWS resource of a specific type.

You need to find the MTU used by another instance, but tracepath is not working. You know the instance you are trying to tracepath has open security group and NACL rules.

Which protocol do you need to allow to access your instance to remedy this?

Your security team implements a host-based firewall on all of your Amazon Elastic Compute Cloud (EC2) instances to block all outgoing traffic. Exceptions must be requested for each specific requirement. Until you request a new rule, you cannot access the instance metadata service.

Which firewall rule should you request to be added to your instances to allow instance metadata access?

When an AWS Config rule is triggered a JSON object known as an AWS Config Event is created. This object contains a(n) ____ attribute, which is a JSON-formatted set of key/value pairs the receiving AWS Lambda function processes as part of its evaluation logic.

A company recently migrated its Amazon EC2 instances to VPC private subnets to satisfy a security

compliance requirement. The EC2 instances now use a NAT gateway for internet access. After the migration, some long-running database queries from private EC2 instances to a publicly accessible third-party database no longer receive responses. The database query logs reveal that the queries successfully completed after 7 minutes but that the client EC2 instances never received the response.

Which configuration change should a network engineer implement to resolve this issue?

Your AWS WorkSpaces users are unable to authenticate.

What could be one reason for this?

You manage a webserver that serves a webpage on AWS infrastructure. You utilize an Application Load Balancer, CloudFront, S3, and some other AWS services for this site. You are only responsible for the server and you don't have access to the AWS console or API.
You need to find out what IPs are accessing your website.

What is the best way to achieve this?

From the following options, select the answer that correctly describes the implementation of the HTTP protocol

Your company just deployed a WAF to protect its resources. You need to create a baseline before you start blocking traffic.

How will you achieve this?

In the context of Amazon CloudFront, when you configure the media player, the path you specify to the media file must contain the characters _____________.

You can use the ____ command of the AWS Config service CLI to see the compliance state of each of your rules.

A company has an AWS Direct Connect connection between its on-premises data center and Amazon VPC. An application running on an Amazon EC2 instance in the VPC needs to access confidential data stored in the on-premises data center with consistent performance. For compliance purposes, data encryption is required.

What should the network engineer do to meet these requirements?

In Amazon CloudFront, if you need to quickly remove objects from a distribution, you can:

You are your company's AWS cloud architect. You have created a VPC topology that consists of 3 VPCs.
You have a centralised VPC (VPC-Shared) that provides shared services to the remaining 2 departmental dedicated VPCs (VPC-Dept1 and VPC-Dept2). The centralised VPC is VPC peered to both of the departmental VPCs, that is a VPC peering connection exists between VPC-Shared and VPC-Dept1, and a VPC peering connection exists between VPC-Shared and VPC-Dept2.

Select the correct option from the list below.

You wish to have a sub-1G connection to AWS to save on costs.

How can you achieve this?

You have a DX connection and a VPN connection as backup for your 10.0.0.0/16 network. You just received a letter indicating that the colocation provider hosting the DX connection will be undergoing maintenance soon. It is critical that you do not experience any downtime or latency during this period.

What is the best course of action?

You are a network admin of a US company called Webby Widgets that is expanding to Europe. The company has a website that serves dynamic and static content.

You have been instructed to ensure the European clients receive the least latency possible, no matter where in Europe they live, while still allowing the US clients to receive the same user experience and performance they have been accustomed to. You have also been instructed to ensure both countries use the same URL to access the site and keep costs low.

What two things should you do? (Choose two.)

In AWS, which tool records API calls for a specific AWS account and also delivers the log files for that account?

You have many IAM users with the ability to create EC2 volumes. Most of the data your team works with is sensitive, so you would like to make sure all volumes are encrypted.

How might you facilitate this requirement?

Your application is hosted behind an Elastic Load Balancer (ELB) within an autoscaling group. The autoscaling group is configured with a minimum of 2, a maximum of 14, and a desired value of 2. The autoscaling cooldown and the termination policies are set to the default value.

CloudWatch reports that the site typically requires just two servers, but spikes at the start and end of the business day can require eight to ten servers. You receive intermittent reports of timeouts and partially loaded web pages.

Which configuration change should you make to address this issue?

You have a static VPN connecting your data center and your VPC. You currently have 50 routes added to your route table.
You want to add more; how should you do this?

Your application server instances reside in the private subnet of your VPC. These instances need to access a Git repository on the Internet. You create a NAT gateway in the public subnet of your VPC. The NAT gateway can reach the Git repository, but instances in the private subnet cannot. You confirm that a default route in the private subnet route table points to the NAT gateway. The security group for your application server instances permits all traffic to the NAT gateway.

What configuration change should you make to ensure that these instances can reach the patch server?

When using AWS Config, which two items are stored on S3 as a part of its operation?

What statement about LAGs is incorrect?

A company has two redundant AWS Direct Connect connections to a VPC. The VPC is configured using BGP metrics so that one Direct Connect connection is used as the primary traffic path. The company wants the primary Direct Connect connection to fail to the secondary in less than one second.

What should be done to meet this requirement?

You need to find the subnet, the security group and the VPC that your instance is associated with. You only have access to the terminal of an instance with an admin role attached.

What is the first part of the command you would use?

Your company wishes to improve the performance of its EC2 instances. They require low latency and high throughput. They are currently deployed on T2.medium. It is imperative that you experience as little downtime as possible, but cost and performance are most important.

How should you accomplish this?

You have two autoscaling groups in your VPC. One deploys servers that host the index of your website and another that deploys servers that host the images for your website.

What three steps would you take to ensure the right servers are used for the right purpose? (Choose three.)

Which statement about Elastic IP addresses is incorrect?

A Network Engineer is designing a new system on AWS that will take advantage of Amazon CloudFront for both content caching and for protecting the underlying origin. There is concern that an external agency might be able to access the IP addresses for the application's origin and then attack the origin despite it being served by CloudFront.

Which of the following solutions provides the strongest level of protection to the origin?

You are the network engineer at your company, and you are noticing issues with QoS in you're the traffic to your instances hosting a VOIP program. You need to inspect the network packets to determine if it is a programming error or a networking error.

How should you do this?

What are three services that help mitigate a DDoS? (Choose two.)

A company's network engineer needs to evaluate and monitor DNS traffic. The company uses Amazon Route 53 as the DNS service for its public hosted zone. All DNS queries must be captured for future analysis.

What should the network engineer do to meet these requirements?

Which of the following statements is true of AWS Elastic Beanstalk?

Your company's policy requires that all VPCs peer with a "common services: VPC. This VPC contains a fleet of layer 7 proxies and an Internet gateway. No other VPC is allowed to provision an Internet gateway.
You configure a new VPC and peer with the common service VPC as required by policy. You launch an Amazon EC2. Windows instance configured to forward all traffic to the layer 7 proxies in the common services VPC. The application on this server should successfully interact with Amazon S3 using its properly configured AWS Identity and Access Management (IAM) role. However, Amazon S3 is returning 403 errors to the application.

Which step should you take to enable access to Amazon S3?

You deploy an Amazon EC2 instance that runs a web server into a subnet in a VPC. An Internet gateway is attached, and the main route table has a default route (0.0.0.0/0) configured with a target of the Internet gateway.

The instance has a security group configured to allow as follows:

1. Protocol: TCP
2. Port: 80 inbound, nothing outbound

The Network ACL for the subnet is configured to allow as follows:

1. Protocol: TCP
2. Port: 80 inbound, nothing outbound

When you try to browse to the web server, you receive no response.

Which additional step should you take to receive a successful response?

You have been asked to monitor traffic flows on your Amazon EC2 instance. You will be performing deep packet inspection, looking for atypical patterns.

Which tool will enable you to look at this data?

Your company has a highly-available Direct Connect solution that utilizes two datacenters. Each datacenter was initially configured with one four-connection LAG and one standard DX connection.

How many LOA documents have been requested and completed for this configuration?

The Web Application Development team is worried about malicious activity from 200 random IP addresses.

Which action will ensure security and scalability from this type of threat?

Your company runs an HTTPS application using an Elastic Load Balancing (ELB) load balancer/PHP on nginx server/RDS in multiple Availability Zones. You need to apply Geographic Restriction and identify the client's IP address in your application to generate dynamic content.

How should you utilize AWS services in a scalable fashion to perform this task?

You can use the ____ page of the AWS Config console to look up resources that AWS Config has discovered, including deleted resources and resources that are not currently being recorded.

What are two routing methods used by Route 53? (Choose two.)

What are two reasons that could cause an HTTP health check to fail? (Choose two.)

You would like to ensure that all Amazon S3 buckets going forward, current and newly created ones, have logging enabled.

What type of trigger(s) should you use?

A user is collecting 1000 records per second. The user wants to send the data to CloudWatch using a custom namespace.

Which of the below mentioned options is recommended for this activity?

Which two statements about placement groups are correct? (Choose two.)

You have 4 Direct Connect connections from your datacenter. Site A advertises 172.16.0.0/16 AS 65000, Site B advertises 172.16.0.128/25 AS 65000 65000 65000, Site C advertises 172.0.0.0/8 AS 65000 and Site D advertises 172.16.0.0/24 AS 65000.

Which site will AWS choose to reach your network?

Under increased cybersecurity concerns, a company is deploying a near real-time intrusion detection system (IDS) solution. A system must be put in place as soon as possible. The architecture consists of many AWS accounts, and all results must be delivered to a central location.

Which solution will meet this requirement, while minimizing downtime and costs?

A company needs to allow its remote users to access company resources in the AWS Cloud. The company has two VPCs that are connected through VPC peering. The remote users must be able to access resources in both VPCs by using secure connections from their laptop computers. The company does not want to implement an access management solution that requires additional costs or effort.

Which solution meets these requirements?

You are auditing an AWS infrastructure after you noticed some abnormal charges on the bill. You use AWS Config to monitor your changes.

What else is required to find out who made the change?

You manage a website that uses a load balancer. You are noticing one of the servers is receiving more traffic than the other.

What is probably the cause of this?

You can use the ____ command of the AWS Config service CLI to see the compliance state of each

resource that AWS Config evaluates for a specific rule.

You have several Amazon Glacier vaults you would like to monitor.

How might you monitor those vaults?

A user is trying to understand the detailed CloudWatch monitoring concept.

Which of the below mentioned services does not provide detailed monitoring with CloudWatch?

Refer to the image.

You have three VPCs: A, B, and C. VPCs A and C are both peered with VPC B. The IP address ranges are as follows:

1. VPC A: 10.0.0.0/16
2. VPC B: 192.168.0.0/16
3. VPC C: 10.0.0.0/16

Instance i-1 in VPC A has the IP address 10.0.0.10. Instance i-2 in VPC C has the IP address 10.0.0.10.
Instances i-3 and i-4 in VPC B have the IP addresses 192.168.1.10 and 192.168.1.20, respectively, i-3 and i-4 are in the subnet 192.168.1.0/24.

1. i-3 must be able to communicate with i-1
2. i-4 must be able to communicate with i-2
3. i-3 and i-4 are able to communicate with i-1, but not with i-2.

Which two steps will fix this problem? (Choose two.)

A company's IT Security team needs to ensure that all servers within an Amazon VPC can communicate with a list of five approved external IPs only. The team also wants to receive a notification every time any server tries to open a connection with a non-approved endpoint.

What is the MOST cost-effective solution that meets these requirements?

What are two reasons to have multiple IP addresses or interfaces on one server? (Choose two.)

An organization runs a consumer-facing website on AWS. The Amazon EC2-based web fleet is load balanced using the AWS Application Load Balancer, Amazon Route 53 is used to provide the public DNS

services.

The following URLs need to server content to end users:

1. test.example.com
2. web.example.com
3. example.com

Based on this information, what combination of services must be used to meet the requirement? (Choose two.)

Your Amazon Kinesis application receives data streams from thousands of devices. The data is then stored in an on-premises Hadoop cluster. You are concerned about historical data that shows periods of sustained traffic between 1 Gbps and 2 Gbps during peaks. You must ensure that you have secure, fault-tolerant connectivity between Amazon Kinesis and your data center.

What should you implement to address these needs?

For web distributions in Amazon CloudFront, your origin can be either an Amazon S3 bucket or _______ .

A network engineer deploys an application in a private subnet in a VPC that connects to many external video feed providers using RTMP over the internet. A NAT gateway has been deployed in a public subnet and is working as expected. From the Amazon EC2 instance, the application is able to connect to all feed providers except one, which hangs when connecting. Manually testing a connection from an Amazon EC2 instance in the public subnet to the problem feed indicates that the feed works as expected.

What is causing this issue?

A company's web application is deployed on Amazon EC2 instances behind a public Application Load Balancer. The application flags malicious requests and uses an AWS Lambda function to add the offending IP addresses to the network ACL to block any further request for 24 hours. Recently, the application has been receiving more malicious requests, which causes the network ACL to reach its limit of allowed entries.

Which action should be taken to block more IP addresses, without compromising the existing security requirements?

Your company has two DX locations. You need to configure one link as passive. What should you configure in your router to set that link as the passive link.