Amazon Amazon Certifications SAP-C01 Questions & Answers

• Question 601:

  A user has created a VPC with a public subnet. The user has terminated all the instances which are part of the subnet.

  Which of the below mentioned statements is true with respect to this scenario?

  A. The subnet to which the instances were launched with will be deleted

  B. When the user launches a new instance it cannot use the same subnet

  C. The user cannot delete the VPC since the subnet is not deleted

  D. Secondary network interfaces attached to the terminated instances may persist.

  Correct Answer: D

  A Virtual Private Cloud (VPC) is a virtual network dedicated to the user's AWS account. A user can create a subnet with VPC and launch instances inside that subnet. When an instance is launched it will have a network interface attached with it. The user cannot delete the subnet until he terminates the instance and deletes the network interface. By default, network interfaces that are automatically created and attached to instances using the console are set to terminate when the instance terminates. However, network interfaces created using the command line interface aren't set to terminate when the instance terminates.

  Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

• Question 602:

  A user wants to create a public subnet in VPC and launch an EC2 instance within it. The user has not selected the option to assign a public IP address while launching the instance.

  Which of the below mentioned statements is true with respect to this scenario?

  A. The instance will always have a public DNS attached to the instance by default

  B. The user would need to create a default route to IGW in subnet's route table and then attach an elastic IP to the instance to connect from the internet

  C. The user can directly attach an elastic IP to the instance

  D. The instance will never launch if the public IP is not assigned

  Correct Answer: B

  A Virtual Private Cloud (VPC) is a virtual network dedicated to the user's AWS account. A user can create a subnet with VPC and launch instances inside that subnet. When the user is launching an instance he needs to select an option which attaches a public IP to the instance. If the user has not selected the option to attach the public IP, then it will only have a private IP when launched. The user cannot connect to the instance from the internet. If the user wants an elastic IP to connect to the instance from the internet, he should create an internet gateway and assign an elastic IP to instance.

  Reference: http://docs.aws.amazon.com/AmazonVPC/latest/GettingStartedGuide/LaunchInstance.html

• Question 603:

  One of the components that is part of ec2-net-utils used with ENI's is ec2ifscan.

  Which of the following is not correct about ec2-net-utils?

  A. ec2-net-utils generates an interface configuration file suitable for use with DHCP.

  B. ec2-net-utils extends the functionality of the standard if up.

  C. ec2-net-utils detaches a primary network interface from an instance.

  D. ec2-net-utils identifies network interfaces when they are attached, detached, or reattached to a running instance.

  Correct Answer: C

  Each instance in a VPC has a default elastic network interface (the primary network interface) that is assigned a private IP address from the IP address range of your VPC. You cannot detach a primary network interface from an instance. You can create and attach additional elastic network interfaces. Amazon Linux AMIs may contain additional scripts installed by AWS, known as ec2-net-utils. One of the components that is part of ec2-net-utils used with ENI's is ec2ifscan. Its function is to check for network interfaces that have not been configured and configure them.

  Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

• Question 604:

  Over which of the following Ethernet standards does AWS Direct Connect link your internal network to an AWS Direct Connect location?

  A. Single mode fiber-optic cable

  B. Multi-mode fiber-optic cable

  C. Shielded balanced copper cable

  D. Twisted pair cable

  Correct Answer: A

  AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard 1 gigabit or 10 gigabit Ethernet single mode fiber-optic cable.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

• Question 605:

  Which of the following statements is NOT correct when working with your AWS Direct Connect connection after it is set up completely?

  A. You can manage your AWS Direct Connect connections and view the connection details.

  B. You can delete a connection as long as there are no virtual interfaces attached to it.

  C. You cannot view the current connection ID and verify if it matches the connection ID on the Letter of Authorization (LOA).

  D. You can accept a host connection by purchasing a hosted connection from the partner (APN).

  Correct Answer: C

  You can manage your AWS Direct Connect connections and view connection details, accept hosted connections, and delete connections. You can view the current status of your connection. You can also view your connection ID, which looks similar to this example dxcon-xxxx, and verify that it matches the connection ID on the Letter of Authorization (LOA) that you received from Amazon.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/viewdetails.html

• Question 606:

  Which statement is NOT true about accessing remote AWS region in the US by your AWS Direct Connect which is located in the US?

  A. AWS Direct Connect locations in the United States can access public resources in any US region.

  B. You can use a single AWS Direct Connect connection to build multi-region services.

  C. Any data transfer out of a remote region is billed at the location of your AWS Direct Connect data transfer rate.

  D. To connect to a VPC in a remote region, you can use a virtual private network (VPN) connection over your public virtual interface.

  Correct Answer: C

  AWS Direct Connect locations in the United States can access public resources in any US region. You can use a single AWS Direct Connect connection to build multi-region services. To connect to a VPC in a remote region, you can use a virtual private network (VPN) connection over your public virtual interface. To access public resources in a remote region, you must set up a public virtual interface and establish a border gateway protocol (BGP) session. Then your router learns the routes of the other AWS regions in the US. You can then also establish a VPN connection to your VPC in the remote region. Any data transfer out of a remote region is billed at the remote region data transfer rate.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/remote_regions.html

• Question 607:

  You have been asked to set up a public website on AWS with the following criteria:

  You want the database and the application server running on an Amazon VPC. You want the database to

  be able to connect to the Internet so that it can be automatically updated to the correct patch level.

  You do not want to receive any incoming traffic from the Internet to the database.

  Which solutions would be the best to satisfy all the above requirements for your planned public website on

  AWS? (Choose two.)

  A. Set up both the public website and the database on a public subnet and block all incoming requests from the Internet with a Network Access Control List (NACL)

  B. Set up both the public website and the database on a public subnet, and block all incoming requests from the Internet with a security group which only allows access from the IP of the public website.

  C. Set up the public website on a public subnet and set up the database in a private subnet which connects to the Internet via a NAT instance.

  D. Set up both the public website and the database on a private subnet and block all incoming requests from the Internet with a Network Access Control List (NACL). Set up a Security group between the public website and the database which only allows access via port 80.

  Correct Answer: BC

  You want the database to be able to connect to the Internet you need to either set it up on a public subnet or set it up on a private subnet which connects to the Internet via a NAT instance

  Reference: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html

• Question 608:

  A user has created a VPC with CIDR 20.0.0.0/16 using the VPC wizard. The user has created public and VPN only subnets along with hardware VPN access to connect to the user's data center. The user has not yet launched any instance as well as modified or deleted any setup. He wants to delete this VPC from the console.

  Will the console allow the user to delete the VPC?

  A. Yes, the user can detach the virtual private gateway and then use the VPC console to delete the VPC.

  B. No, since the NAT instance is running, the user cannot delete the VPC.

  C. Yes, the user can use the CLI to delete the VPC that will detach the virtual private gateway automatically.

  D. No, the VPC console needs to be accessed using an administrator account to delete the VPC.

  Correct Answer: A

  You can delete your VPC at any time (for example, if you decide it's too small). However, you must terminate all instances in the VPC first. When you delete a VPC using the VPC console, Amazon deletes all its components, such as subnets, security groups, network ACLs, route tables, Internet gateways, VPC peering connections, and DHCP options. If you have a VPN connection, you don't have to delete it or the other components related to the VPN (such as the customer gateway and virtual private gateway).

  Reference: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html#VPC_Deleting

• Question 609:

  In which step of "start using AWS Direct Connect" steps is the virtual interface you created tagged with a customer-provided tag that complies with the Ethernet 802.1Q standard?

  A. Download Router Configuration.

  B. Complete the Cross Connect.

  C. Configure Redundant Connections with AWS Direct Connect.

  D. Create a Virtual Interface.

  Correct Answer: D

  In the list of using Direct Connect steps, the create a Virtual Interface step is to provision your virtual interfaces. Each virtual interface must be tagged with a customer-provided tag that complies with the Ethernet 802.1Q standard. This tag is required for any traffic traversing the AWS Direct Connect connection.

  Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/getstarted.html#createvirtualinterface

• Question 610:

  A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created a public subnet CIDR (20.0.0.0/24) and VPN only subnets CIDR (20.0.1.0/24) along with the VPN gateway (vgw-123456) to connect to the user's data center. The user's data center has CIDR 172.28.0.0/12. The user has also setup a NAT instance (i-123456) to allow traffic to the internet from the VPN subnet.

  Which of the below mentioned options is not a valid entry for the main route table in this scenario?

  A. Destination: 20.0.0.0/16 and Target: local

  B. Destination: 0.0.0.0/0 and Target: i-123456

  C. Destination: 172.28.0.0/12 and Target: vgw-123456

  D. Destination: 20.0.1.0/24 and Target: i-123456

  Correct Answer: D

  The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data centre, he can setup a public and VPN only subnet which uses hardware VPN access to connect with his data centre. When the user has configured this setup with Wizard, it will create a virtual private gateway to route all traffic of the VPN subnet. If the user has setup a NAT instance to route all the internet requests, then all requests to the internet should be routed to it. All requests to the organization's DC will be routed to the VPN gateway. Here are the valid entries for the main route table in this scenario: Destination: 0.0.0.0/0 and Target: i-123456 (To route all internet traffic to the NAT Instance) Destination: 172.28.0.0/12 and Target: vgw-123456 (To route all the organization's data centre traffic to the VPN gateway) Destination: 20.0.0.0/16 and Target: local (To allow local routing in VPC) Reference: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario3.html