Amazon ANS-C01 Online Practice Questions and Exam Preparation

Amazon ANS-C01 Online Questions & Answers

• Question 171:

  All IP addresses within a 10.0.0.0/16 VPC are fully utilized with application servers across two Availability Zones. The application servers need to send frequent UDP probes to a single central authentication server on the Internet to confirm that it is running up-to-date packages. The network is designed for application servers to use a single NAT gateway for internal access. Testing reveals that a few of the servers are unable to communicate with the authentication server.

  What is the reason for this failure?

  A. The NAT gateway does not support UDP traffic.
  B. The authentication server is not accepting traffic.
  C. The NAT gateway cannot allocate more ports.
  D. The NAT gateway is launched in a private subnet.
  C. The NAT gateway cannot allocate more ports.

  ---

  Ref: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat- gateway.html "A NAT gateway can support up to 55,000 simultaneous connections to each unique destination. This limit also applies if you create approximately 900 connections per second to a single destination (about 55,000 connections per minute). If the destination IP address, the destination port, or the protocol (TCP/UDP/ICMP) changes, you can create an additional 55,000 connections. For more than 55,000 connections, there is an increased chance of connection errors due to port allocation errors. These errors can be monitored by viewing the ErrorPortAllocation CloudWatch metric for your NAT gateway. For more information, see Monitoring NAT Gateways Using Amazon CloudWatch."

• Question 172:

  A company has multiple AWS Site-to-Site VPN connections between an on-premises environment and multiple VPCs. The Site-to-Site VPN connections use virtual private gateways and are configured with IPv4 addresses. The company hosts several internal applications in the VPCs.

  Application users have reported that the applications are performing slowly. A networkengineer notices excessive latency in the network path that the VPN connections use. The network engineer needs to resolve the excessive latency.

  Which solution will meet this requirement?

  A. Use AWS Global Accelerator to deploy an accelerator on the existing Site-to-Site VPN connections.
  B. Deploy a transit gateway and a new accelerated Site-to-Site VPN connection.
  C. Replace the existing Site-to-Site VPN connections with new Site-to-Site VPN connections that use IPv6.
  D. Replace the existing Site-to-Site VPN connections with AWS PrivateLink connections.
  B. Deploy a transit gateway and a new accelerated Site-to-Site VPN connection.

• Question 173:

  An international company provides early warning about tsunamis. The company plans to use IoT devices to monitor sea waves around the world. The data that is collected by the IoT devices must reach the company's infrastructure on AWS

  as quickly as possible. The company is using three operation centers around the world. Each operation center is connected to AWS through its own AWS Direct Connect connection. Each operation center is connected to the internet through

  at least two upstream internet service providers.

  The company has its own provider-independent (PI) address space. The IoT devices use TCP protocols for reliable transmission of the data they collect. The IoT devices have both landline and mobile internet connectivity. The infrastructure

  and the solution will be deployed in multiple AWS Regions. The company will use Amazon Route 53 for DNS services.

  A network engineer needs to design connectivity between the IoT devices and the services that run in the AWS Cloud.

  Which solution will meet these requirements with the HIGHEST availability?

  A. Set up an Amazon CloudFront distribution with origin failover. Create an origin group for each Region where the solution is deployed.
  B. Set up Route 53 latency-based routing. Add latency alias records. For the latency alias records, set the value of Evaluate Target Health to Yes.
  C. Set up an accelerator in AWS Global Accelerator. Configure Regional endpoint groups and health checks.
  D. Set up Bring Your Own IP (BYOIP) addresses. Use the same PI addresses for each Region where the solution is deployed.
  C. Set up an accelerator in AWS Global Accelerator. Configure Regional endpoint groups and health checks.

  ---

  https://docs.aws.amazon.com/global-accelerator/latest/dg/introduction-benefits-of-migrating.html https://docs.aws.amazon.com/global-accelerator/latest/dg/using-byoip.html

• Question 174:

  A company has VPCs in the us-east-1 Region that are connected to each other through a transit gateway. A network engineer needs to establish an AWS Direct Connect connection between the company's on-premises data center and the transit gateway for the migration of a workload.

  The Direct Connect connection is UP according to the ConnectionState metric in Amazon CloudWatch. However, the VIF is DOWN. The network engineer has verified the transit VIF and BGP configurations on the on-premises router and has found no issues. However, the network engineer is unable to ping the Amazon peer IP address.

  Which combination of steps should the network engineer take to troubleshoot this issue? (Choose three.)

  A. Verify that the correct IP address and subnet mask are in use for the subinterface on the router.
  B. Ensure that VLAN trunking is disabled on the router.
  C. Verify that the router has a MAC address entry from the AWS endpoint in the Address Resolution Protocol (ARP) table.
  D. Verify that the optical signal that is received over the cross connect is optimal.
  E. Ensure that the correct VLAN tag is applied on the subinterface configuration on the router.
  F. Ensure that TCP port 179 is not being blocked at the on-premises router.
  A. Verify that the correct IP address and subnet mask are in use for the subinterface on the router.
  C. Verify that the router has a MAC address entry from the AWS endpoint in the Address Resolution Protocol (ARP) table.
  E. Ensure that the correct VLAN tag is applied on the subinterface configuration on the router.

• Question 175:

  A company is planning to use Amazon S3 to archive financial data. The data is currently stored in an on-premises data center. The companyuses AWS Direct Connect with a Direct Connect gateway and a transit gateway to connect to the on-premises data center. The data cannot be transported over the public internet and must be encrypted in transit.

  Which solution will meet these requirements?

  A. Create a Direct Connect public VIF. Set up an IPsec VPN connection over the public VIF to access Amazon S3. Use HTTPS for communication.
  B. Create an IPsec VPN connection over the transit VIF. Create a VPC and attach the VPC to the transit gateway. In the VPC, provision aninterface VPC endpoint for Amazon S3. Use HTTPS for communication.
  C. Create a VPC and attach the VPC to the transit gateway. In the VPC, provision an interface VPC endpoint for Amazon S3. Use HTTPS for communication.
  D. Create a Direct Connect public VIF. Set up an IPsec VPN connection over the public VIF to the transit gateway. Create an attachment for Amazon S3. Use HTTPS for communication.
  B. Create an IPsec VPN connection over the transit VIF. Create a VPC and attach the VPC to the transit gateway. In the VPC, provision aninterface VPC endpoint for Amazon S3. Use HTTPS for communication.

  ---

  Technically both B and C are possible, but with B encryption is enforced. You can prevent unencrypted S3 actions via bucket policies, but not mentioned in the question, see: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ example-bucket-policies.html#example-bucket-policies-HTTP-HTTPS In this case interface vpc endpoint for S3 is also correct, see: https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html > "You can use two types of VPC endpoints to access Amazon S3: gateway endpoints and interface endpoints (by using AWS PrivateLink). A gateway endpoint is a gateway that you specify in your route table to access Amazon S3 from your VPC over the AWS network. Interface endpoints extend the functionality of gateway endpoints by using private IP addresses to route requests to Amazon S3 from within your VPC, on premises, or from a VPC in another AWS Region by using VPC peering or AWS Transit Gateway."

• Question 176:

  A company has deployed an application in which the front end of the application communicates with the backend instances through a Network Load Balancer (NLB) in the same VPC. The application is highly available across two Availability Zones. The company wants to limit the amount of traffic that travels across the Availability Zones. Traffic from the front end of the application must stay in the same Availability Zone unless there is no healthy target in that Availability Zone behind the NLB. If there is no healthy target in the same Availability Zone, traffic must be sent to the other Availability Zone.

  Which solution will meet these requirements?

  A. Create a private hosted zone with weighted routing for each Availability Zone. Point the primary record to the local Availability Zone NLB DNS record. Point the secondary record to the Regional NLB DNS record. Configure the front end of the application to perform DNS lookups on the local private hosted zone records.
  B. Turn off cross-zone load balancing on the NLB. Configure the front end of the application to perform DNS lookups on the local Availability Zone NLB DNS record.
  C. Create a private hosted zone. Create a failover record for each Availability Zone. For each failover record, point the primary record to the local Availability Zone NLB DNS record and point the secondary record to the Regional NLB DNS record. Configure the front end of the application to perform DNS lookups on the local private hosted zone records.
  D. Enable sticky sessions (session affinity) so that the NLB can bind a user's session to targets in the same Availability Zone.
  B. Turn off cross-zone load balancing on the NLB. Configure the front end of the application to perform DNS lookups on the local Availability Zone NLB DNS record.

• Question 177:

  A development team is building a new web application in the AWS Cloud. The main company domain, example.com, is currently hosted in an Amazon Route 53 public hosted zone in one of the company's production AWS accounts.

  The developers want to test the web application in the company's staging AWS account by using publicly resolvable subdomains under the example.com domain with the ability to create and delete DNS records as needed. Developers have

  full access to Route 53 hosted zones within the staging account, but they are prohibited from accessing resources in any of the production AWS accounts.

  Which combination of steps should a network engineer take to allow the developers to create records under the example com domain? (Choose two.)

  A. Create a public hosted zone for example com in the staging account
  B. Create a staging example.com NS record in the example.com domain. Populate the value with the name servers from the staging.example.com domain. Set the routing policy type to simple routing.
  C. Create a private hosted zone for staging example com in the staging account.
  D. Create an example com NS record in the staging example.com domain. Populate the value with the name servers from the example.com domain. Set the routing policy type to simple routing.
  E. Create a public hosted zone for staging.example.com in the staging account.
  B. Create a staging example.com NS record in the example.com domain. Populate the value with the name servers from the staging.example.com domain. Set the routing policy type to simple routing.
  E. Create a public hosted zone for staging.example.com in the staging account.

  ---

  When a client queries a DNS server for a domain name, the DNS server typically starts by looking for NS records to determine which name servers are authoritative for the domain. The DNS server then queries the authoritative name servers to obtain the information about the domain that the client requested. For example, suppose you own the domain example.com, but you want to delegate control of the subdomain sub.example.com to a different set of name servers. You would create NS records in the example.com zone file that point to the name servers for sub.example.com. This tells DNS servers that the name servers for sub.example.com are authoritative for that subdomain, and they should query those name servers for any requests related to sub.example.com.

• Question 178:

  A company's application team is unable to launch new resources into its VPC. A network engineer discovers that the VPC has run out of usable IP addresses. The VPC CIDR block is 172.16.0.0/16.

  Which additional CIDR block can the network engineer attach to the VPC?

  A. 172.17.0.0/29
  B. 10.0.0.0/16
  C. 172.17.0.0/16
  D. 192.168.0.0/16
  C. 172.17.0.0/16

  ---

  https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html#add-cidr-block-restrictions Only it will also us to add 172.17.0.0/16

• Question 179:

  A global company is designing a hybrid architecture to privately access AWS resources in the us-west-2 Region. The company's existing architecture includes a VPC that uses RFC 1918 IP address space. The VPC is connected to an on-

  premises data center over AWS Direct Connect Amazon Route 53 provides name resolution within the VPC. Locally managed DNS servers in the data center provide DNS services to the on-premises hosts.

  The company has applications in the data center that need to download objects from an Amazon S3 bucket in us-west-2.

  Which solution can the company use to access Amazon S3 without using the public IP address space?

  A. Create an S3 interface endpoint in the VPC. Update the on-premises application configuration to use the Regional VPC endpoint DNS hostname that is mapped to the S3 interface endpoint.
  B. Create an S3 interface endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.
  C. Create an S3 gateway endpoint in the VPUpdate the on-premises application configuration to use the hostname that is mapped to the S3 gateway endpoint.
  D. Create an S3 gateway endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.
  B. Create an S3 interface endpoint in the VPC. Configure a Route 53 Resolver inbound endpoint in the VPC. Set up the data center DNS servers to forward DNS queries for the S3 domain from on premises to the inbound endpoint.

  ---

  Explanation Explanation/Reference:https://aws.amazon.com/blogs/networking-and-content-delivery/secure-hybrid-access-to-amazon-s3-using-aws-privatelink/

• Question 180:

  A company's network engineer is designing a hybrid DNS solution for an AWS Cloud workload. Individual teams want to manage their own DNS hostnames for their applications in their development environment. The solution must integrate the application-specific hostnames with the centrally managed DNS hostnames from the on-premises network and must provide bidirectional name resolution. The solution also must minimize management overhead.

  Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

  A. Use an Amazon Route 53 Resolver inbound endpoint.
  B. Modify the DHCP options set by setting a custom DNS server value.
  C. Use an Amazon Route 53 Resolver outbound endpoint.
  D. Create DNS proxy servers.
  E. Create Amazon Route 53 private hosted zones.
  F. Set up a zone transfer between Amazon Route 53 and the on-premises DNS.
  A. Use an Amazon Route 53 Resolver inbound endpoint.
  C. Use an Amazon Route 53 Resolver outbound endpoint.
  E. Create Amazon Route 53 private hosted zones.

  ---

  For bidirectional name resolution, both Route 53 Resolver inbound and outbound endpoint is required.