Amazon Amazon Certifications ANS-C00 Questions & Answers

• Question 211:

  Which two statements about placement groups are correct? (Choose two.)

  A. A placement group can span multiple VPCs.

  B. A placement group can span multiple Availability Zones.

  C. You cannot merge placement groups.

  D. It is best to use the same instance types in a placement group.

  Correct Answer: AC

  Explanation:

  A placement group can span multiple VPCs but may not experience the full performance benefit. The only

  way to add instances from one placement group to another is to create AMIs out of the instances and spin

  them all up into one placement group.

• Question 212:

  Which statement about placement groups is incorrect?

  A. A placement group is a logical grouping of instances in a single AZ.

  B. If you stop an instance and restart it, it will always return to the same placement group.

  C. To help ensure capacity in a placement group, deploy all instances at once.

  D. There is no charge for creating a placement group.

  Correct Answer: B

  Explanation:

  There may not be sufficient capacity in the placement group.

• Question 213:

  What MTU is recommended for VPN and Direct Connect links?

  A. 1500

  B. 2000

  C. 128

  D. Jumbo Frames

  Correct Answer: A

  Explanation:

  Jumbo frames will not pass through VPN and Direct Connect links using AWS connections. You must use

  an MTU of 1500.

• Question 214:

  How many BGP advertised routes can you have per route table?

  A. 50

  B. 200

  C. 100

  D. As many as you want as long as you contact AWS first.

  Correct Answer: C

  Explanation:

  You can only have 100 advertised routes from BGP. This cannot be changed.

• Question 215:

  If you have one VPC peered with two VPCs with overlapping CIDRs, which route will be more preferred?

  A. 10.1.0.0/16

  B. 10.0.0.0/8

  C. 10.1.1.5/32

  D. 10.1.1.0/24

  Correct Answer: C

  Explanation:

  10.1.1.5/32. The most specific route is preferred.

• Question 216:

  Which ports must you allow for HTTP and HTTPS traffic?

  A. 25/465

  B. 21/22

  C. 3389/3306

  D. 80/443

  Correct Answer: D

  Explanation:

  80 and 443 are the ports for HTTP and HTTPS, respectively.

• Question 217:

  Which of these addresses cannot be given to an EC2 instance in your VPC?

  A. 10.0.0.157

  B. 10.0.0.3

  C. 10.0.0.4

  D. 10.0.0.253

  Correct Answer: B

  Explanation:

  10.0.0.3 is reserved by AWS for future use.

• Question 218:

  You have created a custom VPC. What are two things you may need to do in order to SSH directly into your instance? (Choose two.)

  A. Enable SSH on the instance

  B. Attach a NAT Gateway

  C. Enable Public IP addresses

  D. Attach an Internet Gateway

  Correct Answer: CD

  Explanation:

  Public IP addresses are not enabled by default in a custom VPC. An Internet Gateway is also required.

• Question 219:

  To allow all traffic to access an instance in "Subnet 1" that uses "Security Group 1", what two options need to be configured? (Choose two.)

  A. NACL rule allowing 0.0.0.0/0 to access "Subnet 1"

  B. Security Group rule in "Security Group 1" that allows 0.0.0.0/0 inbound

  C. Security Group rule in "Security Group 1" that allows outbound traffic to 0.0.0.0/0

  D. NACL rule allowing 0.0.0.0/0 to access "Security Group 1"

  Correct Answer: AB

  Explanation:

  You must allow traffic through the NACL and through the Security Group to access the instance. If there is

  not an Outbound allow setup in the NACL, you may need to set that, but an outbound rule for Security

  Group 1 is not necessary as security groups are stateful.

• Question 220:

  Which port range must be allowed through a NACL to ensure all return traffic is successful?

  A. 1024 - 65,535

  B. 22

  C. 65,000 - 65,535

  D. 80 - 443

  Correct Answer: A

  Explanation:

  1024 - 65,535 is the full "ephemeral port" range.