Amazon ANS-C00 Online Practice Questions and Exam Preparation

Amazon ANS-C00 Online Questions & Answers

• Question 201:

  Your company's policy requires that all VPCs peer with a "common services: VPC. This VPC contains a fleet of layer 7 proxies and an Internet gateway. No other VPC is allowed to provision an Internet gateway. You configure a new VPC and peer with the common service VPC as required by policy. You launch an Amazon EC2. Windows instance configured to forward all traffic to the layer 7 proxies in the common services VPC. The application on this server should successfully interact with Amazon S3 using its properly configured AWS Identity and Access Management (IAM) role. However, Amazon S3 is returning 403 errors to the application.

  Which step should you take to enable access to Amazon S3?

  A. Update the S3 bucket policy with the private IP address of the instance.
  B. Exclude 169.254.169.0/24 from the instance's proxy configuration.
  C. Configure a VPC endpoint for Amazon S3 in the same subnet as the instance.
  D. Update the CORS configuration for Amazon S3 to allow traffic from the proxy.
  D. Update the CORS configuration for Amazon S3 to allow traffic from the proxy.

• Question 202:

  Your company has a highly available Direct Connect solution that utilizes two datacenters. Each data center contains one two-connection LAG and one standard DX connection. How many LOAs will be filled out in total if your company completes an order to add a new connection to each one of the LAGs?

  A. 1
  B. 11
  C. 2
  D. 6
  D. 6

• Question 203:

  An organization has ordered a new AWS Direct Connect connection. The AWS Management Console reports that the connection is available and BGP status is up. However, the networking team is not able to reach instances in the VPC using ping on the organization's private IP address.

  What could cause this connectivity issue? (Choose two.)

  A. The VGW is not advertising the correct CIDR range back on-premises.
  B. The instance security group does not allow ICMP traffic.
  C. A public virtual interface must be configured for Amazon EC2 connectivity.
  D. The on-premises router is not advertising the correct CIDR range to AWS.
  E. There is a misconfiguration of the bi-directional forwarding detection.
  C. A public virtual interface must be configured for Amazon EC2 connectivity.
  D. The on-premises router is not advertising the correct CIDR range to AWS.

• Question 204:

  You have two autoscaling groups in your VPC. One deploys servers that host the index of your website and another that deploys servers that host the images for your website. What three steps would you take to ensure the right servers are used for the right purpose? (Choose three.)

  A. Create a path-based routing rule to route traffic destined for "/" to target group 1 and "/*.jpg" to target group 2.
  B. Create two target groups and associate them with each autoscaling group.
  C. Configure a Classic Load Balancer
  D. Configure an Application Load Balancer
  A. Create a path-based routing rule to route traffic destined for "/" to target group 1 and "/*.jpg" to target group 2.
  B. Create two target groups and associate them with each autoscaling group.
  D. Configure an Application Load Balancer

• Question 205:

  A publishing company recently merged with an ecommerce company. Each company uses a VPC to run compute resources. The two VPCs have overlapping CIDR ranges. The publishing company needs to access an internal application that runs on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones in the ecommerce company VPC.

  Which set of actions will provide the needed interconnectivity between the VPCs?

  A. 1. Create a Network Load Balancer (NLB) for the application in the ecommerce company VPC. Configure the NLB for the Availability Zones that the target instances use. 2. Create a VPC endpoint service configuration, and specify the NLB. Add the publishing company's AWS account as a principal to the allow list. 3. Create interface endpoint connections to the service in the publishing company VPC in the same Availability Zones as the NLB.
  B. 1. Create a VPC peering connection between the ecommerce company VPC and the publishing company VPC. 2. Update the route tables in both VPCs with routes to the attached VPC. 3. Update security groups to allow traffic from the publishing company VPC to the application in the ecommerce company VPC.
  C. 1. Create an Application Load Balancer (ALB) for the application in the ecommerce company VPC. Configure the ALB for all Availability Zones. 2. Create a VPC endpoint service configuration, and specify the ALB. Add the publishing company's AWS account as a principal to the allow list. 3. Create an interface endpoint connection from the publishing company VPC to the service.
  D. 1. Create a VPC peering connection between the ecommerce company VPC and the publishing company VPC. 2. Update the route tables in both VPCs with routes to the attached VPC. 3. Update the network ACLs to allow traffic between subnets in the publishing company VPC and subnets in the ecommerce company VPC.
  D. 1. Create a VPC peering connection between the ecommerce company VPC and the publishing company VPC. 2. Update the route tables in both VPCs with routes to the attached VPC. 3. Update the network ACLs to allow traffic between subnets in the publishing company VPC and subnets in the ecommerce company VPC.

• Question 206:

  Which service would you use to see CPU usage?

  A. CloudTrail
  B. Config
  C. CloudWatch
  D. None of the above
  C. CloudWatch

• Question 207:

  Your company wishes to improve the performance of its EC2 instances. They require low latency and high throughput. They are currently deployed on T2.medium. It is imperative that you experience as little downtime as possible, but cost and performance are most important. How should you accomplish this?

  A. Create AMIs from the instances, create new instances on t2.medium, and start those instances in a placement group.
  B. Create AMIs from the instances, deploy the instances as i3.large, and start those instances in a placement group.
  C. Stop the instances and restart them in a placement group.
  D. Add an extra ENI to the instances and team them to provide greater throughput.
  B. Create AMIs from the instances, deploy the instances as i3.large, and start those instances in a placement group.

• Question 208:

  A Network Engineer is designing a new system on AWS that will take advantage of Amazon CloudFront for both content caching and for protecting the underlying origin. There is concern that an external agency might be able to access the IP addresses for the application's origin and then attack the origin despite it being served by CloudFront. Which of the following solutions provides the strongest level of protection to the origin?

  A. Use an IP whitelist rule in AWS WAF within CloudFront to ensure that only known-client IPs are able to access the application.
  B. Configure CloudFront to use a custom header and configure an AWS WAF rule on the origin's Application Load Balancer to accept only traffic that contains that header.
  C. Configure an AWS Lambda@Edge function to validate that the traffic to the Application Load Balancer originates from CloudFront.
  D. Attach an origin access identity to the CloudFront origin that allows traffic to the origin that originates from only CloudFront.
  A. Use an IP whitelist rule in AWS WAF within CloudFront to ensure that only known-client IPs are able to access the application.

• Question 209:

  Imagine you are using AWS Direct Connect with just one connection from your router to the AWS Direct Connect router. If your connection becomes unavailable, the communication with AWS cloud is lost. What is the best method to prevent this from happening?

  A. AWS Direct Connect neither provides BGP nor provides the failover.
  B. AWS Direct Connect recommends to have the same configuration set up in a multi AZ zone to prevent such loss in connections.
  C. AWS Direct Connect recommends that you request and configure two dedicated connections to AWS either using BGP Multipath (Active/Active) connection or the failover (Active/Passive) connection.
  D. AWS Direct connect does not have a provision to prevent the situation but when you design the system, it is recommended to request a back-up instance to which the traffic can be re-routed.
  C. AWS Direct Connect recommends that you request and configure two dedicated connections to AWS either using BGP Multipath (Active/Active) connection or the failover (Active/Passive) connection.

• Question 210:

  An application runs on a fleet of Amazon EC2 instances in a VPC. All instances can reach one another using private IP addresses. The application owner has a new requirement that the domain name received via DHCP should be different for a particular set of instances that are currently in one particular subnet.

  What changes should be made to meet this requirement while continuing to support the existing application requirements?

  A. Modify the existing DHCP option set and specify the different domain name for the specified subnet.
  B. Create a new DHCP option set with the different domain name, associate it with the specified subnet, and re-launch the Amazon EC2 instances.
  C. Create a new subnet, configure the DHCP option set with the different domain name, and re-launch the required instances there.
  D. Create a new peered VPC, configure the DHCP option set with the different domain name, and re-launch the required instances there.
  B. Create a new DHCP option set with the different domain name, associate it with the specified subnet, and re-launch the Amazon EC2 instances.