Amazon ANS-C00 Online Practice Questions and Exam Preparation

Amazon ANS-C00 Online Questions & Answers

• Question 71:

  What is the name of the label applied to packets to allow routers to know where to forward in an MPLS network?

  A. BFD
  B. BGP
  C. FEC
  D. ABC
  C. FEC

• Question 72:

  A customer is using ABC Telecom as a network provider. The customer has 10 different offices connected to ABC Telecom's MPLS backbone. The customer is setting up an AWS Direct Connect connection to AWS and has provided the LOA-CFA to ABC Telecom. ABC Telecom has terminated the Direct Connect circuit into their MPLS backbone. To uniquely identify the customer's traffic over the MPLS backbone, the customer must encapsulate all traffic with VLAN tag 100. The customer wants to send traffic to multiple VPCs.

  Which two steps should be taken to meet the customer's requirement? (Choose two.)

  A. The customer performs Q-in-Q tunneling, with the AWS-required VLAN tag in the inside and VLAN 100 as the outside tag.
  B. Create a support ticket with AWS to request the removal of the outer VLAN tag 100 as the traffic reaches AWS routers.
  C. Send the traffic for all VPCs with the same VLAN tag 100 and use BGP to ensure that proper routing takes place to the appropriate VPC.
  D. ABC Telecom removes the outer tag before sending the packet to AWS.
  E. ABC Telecom creates a support ticket with AWS to exchange MPLS labels and include the AWS port as part of their MPLS network.
  C. Send the traffic for all VPCs with the same VLAN tag 100 and use BGP to ensure that proper routing takes place to the appropriate VPC.
  E. ABC Telecom creates a support ticket with AWS to exchange MPLS labels and include the AWS port as part of their MPLS network.

• Question 73:

  A company has a service that runs on TCP port 443 in VPC A within AWS account A. The company wants to expose the service to Amazon EC2 instances in VPC B within AWS account B.

  The service must not be made public, and all other services in VPC A must not be accessible from VPC B. A network engineer is using AWS PrivateLink for the configuration.

  Which set of procedures should the network engineer follow to meet these requirements?

  A. In VPC A, create an Application Load Balancer (ALB) that has an HTTPS listener. Create an endpoint service in VPC A that points to the ALB. Add the principal ARN of account B to the service endpoints allow list. In VPC B, create an interface endpoint that points to the service identifier of the endpoint service in AWS account A.
  B. In VPC A, create a Network Load Balancer (NLB) that has a TCP listener. Create an endpoint service in VPC A that points to the NLB. Add the principal ARN of account B to the service endpoints allow list. In VPC B, create an interface endpoint that points to the service identifier of the endpoint service in AWS account A.
  C. In VPC A, create a Network Load Balancer (NLB) that has a TCP listener. Create an endpoint service in VPC A that points to the NLB. Add the principal ARN of account B to the service endpoints allow list. In VPC B, create a gateway endpoint that points to the service identifier of the endpoint service in AWS account A.
  D. In VPC A, create an Application Load Balancer (ALB) that has a TCP listener. Create an endpoint service in VPC A that points to the ALB. Add the principal ARN of account B to the service endpoints allow list. In VPC B, create a Gateway Load Balancer endpoint that points to the service identifier of the endpoint service in AWS account A.
  A. In VPC A, create an Application Load Balancer (ALB) that has an HTTPS listener. Create an endpoint service in VPC A that points to the ALB. Add the principal ARN of account B to the service endpoints allow list. In VPC B, create an interface endpoint that points to the service identifier of the endpoint service in AWS account A.

• Question 74:

  A company wants to migrate its workloads to the AWS Cloud. The company has two web applications and wants to run them in separate, isolated VPCs. The company needs to use Elastic Load Balancing to distribute requests between application instances.

  For security reasons, internet gateways must not be attached to the application VPCs. Inbound HTTP requests to the application must be routed through a centralized VPC, and the application VPCs must not be exposed to any other inbound traffic. The application VPCs cannot be allowed to initiate any outbound connections.

  What should a network engineer do to meet these requirements?

  A. Run the applications behind private Application Load Balancers (ALBs) in separate VPCs. Create a public Network Load Balancer (NLB) in the centralized VPC. Create target groups for the private DNS names of the ALBs. Configure host-based routing to route application traffic to the corresponding target group through the NLB.
  B. Run the applications behind private Application Load Balancers (ALBs) in separate VPCs. Create a public Network Load Balancer (NLB) in the centralized VPC. Create target groups for the private IP addresses of the ALBs. Configure host-based routing to route application traffic to the corresponding target group through the NLB.
  C. Run the applications behind private Network Load Balancers (NLBs) in separate VPCs. Create VPC peering connections between the application VPCs and the centralized VPC. Create a public Application Load Balancer (ALB) in the centralized VPC. Create target groups for the private DNS names of the NLBs. Configure host-based routing to route application traffic between individual applications though the ALB.
  D. Run the applications behind private Network Load Balancers (NLBs) in separate VPCs. Configure each NLB as an AWS PrivateLink endpoint service with associated VPC endpoints in the centralized VPC. Create target groups that include the private IP addresses of each endpoint. Create a public Application Load Balancer (ALB) in the centralized VPC. Configure host-based routing to route application traffic to the corresponding target group through the ALB.
  D. Run the applications behind private Network Load Balancers (NLBs) in separate VPCs. Configure each NLB as an AWS PrivateLink endpoint service with associated VPC endpoints in the centralized VPC. Create target groups that include the private IP addresses of each endpoint. Create a public Application Load Balancer (ALB) in the centralized VPC. Configure host-based routing to route application traffic to the corresponding target group through the ALB.

• Question 75:

  Your company just acquired a new company. You have two VPCs ?one is 172.31.0.0/16 and one is 10.111.0.0/16. The acquired company uses 10.111.0.0/16 for their VPC. Your VPC "A" has a group of 12 servers in the range 10.111.2.101 ?

  10.111.2.112. Their VPC "B" has 20 servers from 10.111.2.171 ?10.111.2.190. You need to access both VPCs from the 172.31.0.0/16 VPC "C". What is the best way to approach this problem?

  A. From VPC C, create a peering connection and add a route to VPC A's peering connection for 10.111.2.96/27 and a route to VPC B's peering connection for 10.111.2.0/24.
  B. From VPC C, create a peering connection and add a route to VPC A's peering connection for 10.111.2.96/28 and a route to VPC B's peering connection for 10.111.2.0/24.
  C. From VPC C, create a peering connection and adjust the route tables to direct traffic to the individual servers by exact IP address of the servers.
  D. Invest the money and change the CIDR of one of the VPCs since one VPC cannot be peered to two VPCs with the same CIDR block.
  A. From VPC C, create a peering connection and add a route to VPC A's peering connection for 10.111.2.96/27 and a route to VPC B's peering connection for 10.111.2.0/24.

• Question 76:

  Which service would you use to see the DSCP value in a packet header?

  A. CloudTrail
  B. Config
  C. Flow Logs
  D. None of the above
  D. None of the above

• Question 77:

  An organization has multiple applications running in VPCs across multiple AWS accounts. The network engineer has deployed a central VPC with a pair of software VPN instances that run IPSec tunnels with dynamic routing to VGWs of all application VPCs. This central VPC is connected to on-premises resources via a Direct Connect connection using a private VIF.

  What additional configuration is required to enable the applications in VPCs to communicate with each other and access on-premises resources?

  A. Configure each application VPC with a static route entry pointing the on-premises CIDR block to the software VPN instances.
  B. Configure the central VPC with a static route entry pointing the on-premises CIDR block to local VGWs.
  C. Advertise all application VPC CIDR blocks to on-premises resources via the VGW in the central VPC.
  D. Configure IPSec tunnels from the on-premises router into the software VPN instances with dynamic routing.
  B. Configure the central VPC with a static route entry pointing the on-premises CIDR block to local VGWs.

• Question 78:

  You have multiple Amazon Elastic Compute Cloud (EC2) instances running a web server in a VPC configured with security groups and NACL. You need to ensure layer 7 protocol level logging of all network traffic (ACCEPT/REJECT) on the instances. What should be enabled to complete this task?

  A. CloudWatch Logs at the VPC level
  B. Packet sniffing at the instance level
  C. VPC flow logs at the subnet level
  D. Packet sniffing at the VPC level
  A. CloudWatch Logs at the VPC level

• Question 79:

  What port and protocol is used by DNS?

  A. 80/TCP
  B. 22/TCP
  C. 80/TCP and UDP
  D. 53/TCP and UDP
  D. 53/TCP and UDP

• Question 80:

  A company wants to conduct a proof of concept for an SAP HANA application with a key objective to automate the provisioning of infrastructure and the application. The company operates a hybrid cloud infrastructure with AWS Direct Connect between its data center and VPC. Security policy dictates that all traffic from AWS be routed through on-premises data center firewalls. Security policy also prohibits the use of a VPC internet gateway for internet access. The company enforces use of a forward proxy server for all outbound network traffic. All resources inside the VPC are able to reach on-premises servers.

  All Amazon EC2 Linux instances require package updates over the internet. However, the updates are falling and sending errors.

  What would cause these errors?

  A. Inbound security groups are configured incorrectly on the EC2 instances running in the VPC.
  B. The VPC route table does not have entries for the proxy server in the data center.
  C. The EC2 instances are not configured to use the proxy running in the data center for traffic on TCP port 80.
  D. The data center firewall is blocking all traffic sent from the VPC CIDR range destined for 0.0.0.0/0.
  C. The EC2 instances are not configured to use the proxy running in the data center for traffic on TCP port 80.