Amazon Amazon Certifications ANS-C00 Questions & Answers

• Question 131:

  Your company has a highly available Direct Connect solution that utilizes two datacenters. Each data center contains one two-connection LAG and one standard DX connection. How many LOAs will be filled out in total if your company completes an order to add a new connection to each one of the LAGs?

  A. 1

  B. 11

  C. 2

  D. 6

  Correct Answer: D

  Explanation:

  Four LOAs are required for the first order and two more for the second.

• Question 132:

  You are the network engineer at your company, and you are noticing issues with QoS in you're the traffic to your instances hosting a VOIP program. You need to inspect the network packets to determine if it is a programming error or a networking error. How should you do this?

  A. Configure a network monitoring program on every instance and stream the logs to an S3 bucket to be parsed.

  B. Use CloudWatch

  C. Set up another instance with an ENI added to act as a monitoring interface. Set the port to "promiscuous mode" and sniff the traffic to analyze the packets. Then output this single stream to an S3 bucket to be parsed.

  D. Inspect Flow Logs

  Correct Answer: A

  Explanation:

  Flow Logs and CloudWatch do not display packet contents. You cannot sniff traffic destined for other

  instances.

• Question 133:

  Which endpoint is considered to be best practice when analyzing data within a Configuration Stream of AWS Config?

  A. SNS

  B. E-Mail

  C. SQS

  D. Kinesis

  Correct Answer: C

  Explanation: The Simple Queue Service can be subscribed to the AWS Config topic (the Configuration Stream) which gives you a highly available and decoupled environment for the data within your Configuration Streams. By using SQS it allows you to create and use your own applications to extract only information and data that is pertinent to you. There can be vast amounts of data coming into the Configuration Stream, but you might only want to be notified and made away of any changes that may relate to any potential security issues. As a result, you may want to pull information from the queue that only relate to Security Groups/NACLs/IAM Roles or any other resource type that could affect the security of your environment.

  Reference: http://docs.aws.amazon.com/config/latest/developerguide/monitor-resource-changes.html

• Question 134:

  Does Amazon VPC support multicast or broadcast?

  A. Yes, both.

  B. It doesn't support any of them.

  C. Multicast yes, Broadcast no.

  D. Both, but only outside Amazon VPC.

  Correct Answer: B

  Explanation:

  Amazon VPC does not support multicast nor broadcast

  Reference: https://aws.amazon.com/vpc/faqs/

• Question 135:

  Imagine you are using AWS Direct Connect with just one connection from your router to the AWS Direct Connect router. If your connection becomes unavailable, the communication with AWS cloud is lost. What is the best method to prevent this from happening?

  A. AWS Direct Connect neither provides BGP nor provides the failover.

  B. AWS Direct Connect recommends to have the same configuration set up in a multi AZ zone to prevent such loss in connections.

  C. AWS Direct Connect recommends that you request and configure two dedicated connections to AWS either using BGP Multipath (Active/Active) connection or the failover (Active/Passive) connection.

  D. AWS Direct connect does not have a provision to prevent the situation but when you design the system, it is recommended to request a back-up instance to which the traffic can be re-routed.

  Correct Answer: C

  Explanation:

  When configuring redundant connections with the AWS Direct Connect, and to provide for failover, we

  recommend that you request and configure two dedicated connections to the AWS. There are different

  configuration choices available when you provision two dedicated connections. You can either use Active/

  Active (BGP multipath) connection or Active/Passive (failover) connection to configure the two dedicated

  connections.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/

  getstarted.html#RedundantConnections

• Question 136:

  To get started using AWS Direct Connect, in which of the following steps do you configure Border Gateway Protocol (BGP)?

  A. Complete the Cross Connect

  B. Verify your Virtual Interface

  C. Create a Virtual Interface

  D. Submit AWS Direct Connect Connection Request

  Correct Answer: C

  Explanation: In AWS Direct Connect, your network must support Border Gateway Protocol (BGP) and BGP MD5 authentication, and you need to provide a private Autonomous System Number (ASN) for that to connect to Amazon Virtual Private Cloud (VPC). To connect to public AWS products such as Amazon EC2 and Amazon S3, you will also need to provide a public ASN that you own (preferred) or a private ASN. You have to configure BGP in the Create a Virtual Interface step.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/ getstarted.html#createvirtualinterface

• Question 137:

  In AWS Direct Connect, to provide for failover, AWS recommends that you request and configure two dedicated connections to AWS. These connections can terminate on one or two routers in your network. You can do this while __________________ with AWS Direct Connect step.

  A. creating a Virtual Interface

  B. configuring redundant connections

  C. completing the cross-connect

  D. verifying your Virtual Interface

  Correct Answer: B

  Explanation:

  In AWS Direct Connect, to provide for failover, AWS recommends that you request and configure two

  dedicated connections to AWS.

  These connections can terminate on one or two routers in your network. You can do this in Configure

  Redundant Connections with AWS Direct Connect step.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/

  getstarted.html#RedundantConnections

• Question 138:

  In AWS Direct Connect, which of the following is true of configuring your router to connect to the AWS Direct Connect router?

  A. After creating a virtual interface for your AWS Direct Connect connection, you can download the router configuration file from the available link

  B. After Completing the Cross Connect step, the download link for router configuration will be available

  C. After submitting your AWS Direct Connect connection request, you will receive the router configuration details by email within 72 hours

  D. In Create a Virtual Interface step, the general configuration of your router would be available for downloading.

  Correct Answer: A

  Explanation: To use the AWS Direct Connect, after you have created a virtual interface for your AWS Direct Connect connection, you can download the router configuration file. This configuration helps your router connect to AWS Direct Connect router. This configuration is related to your created virtual interface details and vendor, platform, and software of your router.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/getstarted.html#routerconfig

• Question 139:

  Which of the following physical layer standards is required for connection to AWS Direct Connect over a standard 1 gigabit or 10 gigabit Ethernet fiber-optic cable?

  A. Single mode fiber, 1000BASE-LX for 1 gigabit Ethernet, or 10GBASE-ER for 10 gigabit Ethernet

  B. Multi mode fiber, 1000BASE-LX for 1 gigabit Ethernet, or 10GBASE-ER for 10 gigabit Ethernet

  C. Single mode fiber, 1000BASE-LX for 1 gigabit Ethernet, or 10GBASE-LR for 10 gigabit Ethernet

  D. Multi mode fiber, 1000BASE-SX for 1 gigabit Ethernet, or 10GBASE-SR for 10 gigabit Ethernet

  Correct Answer: C

  Explanation:

  Connections to AWS Direct Connect require single mode fiber, 1000BASE-LX (1310nm) for 1 gigabit

  Ethernet, or 10GBASE-LR (1310nm) for 10 gigabit Ethernet.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

• Question 140:

  Fill in the blanks: One of the basic characteristics of security groups for your VPC is that you ______ .

  A. can specify allow rules, but not deny rules

  B. can specify deny rules, but not allow rules

  C. can specify allow rules as well as deny rules

  D. can neither specify allow rules nor deny rules

  Correct Answer: A

  Explanation:

  Security Groups in VPC allow you to specify rules with reference to the protocols and ports through which

  communications with your instances can be established. One such rule is that you can specify allow rules,

  but not deny rules.

  Reference: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html