ANS-C01 — questions

A company runs a workload in a single VPC on AWS. The company’s architecture contains several interface VPC endpoints for AWS services, including Amazon CloudWatch Logs and AWS Key Management Service (AWS KMS). The endpoints are configured to use a shared security group. The security group is not used for any other workloads or resources. After a security review of the environment, the company determined that the shared security group is more permissive than necessary. The company wants to make the rules associated with the security group more restrictive. The changes to the security group rules must not prevent the resources in the VPC from using AWS services through interface VPC endpoints. The changes must prevent unnecessary access. The security group currently uses the following rules: • Inbound - Rule 1 Protocol: TCP - Port: 443 - Source: 0.0.0.0/0 - • Inbound - Rule 2 Protocol: TCP - Port: 443 - Source: VPC CIDR - • Outbound - Rule 1 Protocol: All - Port: All - Destination: 0.0.0.0/0 - Which rule or rules should the company remove to meet with these requirements?

A company uses transit gateways to route traffic between the company's VPCs. Each transit gateway has a single route table. Each route table contains attachments and routes for the VPCs that are in the same AWS Region as the transit gateway. The route tables in each VPC also contain routes to all the other VPC CIDR ranges that are available through the transit gateways. Some VPCs route to local NAT gateways. The company plans to add many new VPCs soon. A network engineer needs a solution to add new VPC CIDR ranges to the route tables in each VPC. Which solution will meet these requirements in the MOST operationally efficient way?

A company has several AWS Site-to-Site VPN connections between an on-premises customer gateway and a transit gateway. The company's application uses IPv4 to communicate through the VPN connections. The company has updated the VPC to be dual stack and wants to transition to using IPv6-only for new workloads. When the company tries to communicate through the existing VPN connections, IPv6 traffic fails. Which solution will provide IPv6 support with the LEAST operational overhead?

A company has two teams: Team A and Team B. Team A has VPCs that run in Account A. The team uses a transit gateway (TGW-A) to route traffic between workloads that run in the different VPCs. Similarly, Team В has VPCs that run in Account B. Team В uses a different transit gateway (TGW-B) to route traffic between workloads that run in the different VPCs. The company's network team manages the routing for Team A and Team В. The network team wants to retire TGW-B and use a single transit gateway to manage routing for the VPCs of both teams. Which solution will meet this requirement with the LEAST operational overhead?

A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establish connectivity between an on-premises environment and the AWS environment. The company does not have a static public IP address for the on-premises environment. Which combination of steps should the company take to establish VPN connectivity between the transit gateway and the on-premises environment? (Choose two.)

A company operates in multiple AWS Regions. The company has deployed transit gateways in each Region. The company uses AWS Organizations to operate multiple AWS accounts in one organization. The company needs to capture all VPC flow log data when a new VPC is created. The company needs to send flow logs to a specific Amazon S3 bucket. Which solution will meet these requirements with the LEAST administrative effort?

A company wants to analyze TCP internet traffic. The traffic originates from Amazon EC2 instances in the company’s VPC. The EC2 instances initiate connections through a NAT gateway. The company wants to capture data about the traffic including source and destination IP addresses ports, and the first 8 bytes of the TCP segments of the traffic. The company needs to collect, store, and analyze all the required data points. Which solution will meet these requirements?

A media company is planning to host an event that the company will live stream to users. The company wants to use Amazon CloudFront. A network engineer creates a primary origin and a secondary origin for CloudFront. The engineer needs to ensure that the primary origin can fail over to the secondary origin within 15 seconds if a disruption occurs. Which solution will meet this requirement with the LEAST operational overhead?

AnyCompany deploys and manages networking resources in its AWS network account, named Account-A. AnyCompany acquires Example Corp, which has an application that runs behind an Application Load Balancer (ALB) in Example Corp's AWS account, named Account-B. Example Corp needs to use AWS Global Accelerator to create an accelerator to publish the application to users. AnyCompany's networking team will manage the accelerator. Which solution will meet these requirements with the LEAST management overhead?

A company has two AWS Direct Connect connections between Direct Connect locations and the company's on-premises environment in the US. The company uses the connections to communicate with AWS workloads that run in the us-east-1 Region. The company has a transit gateway that connects several VPCs. The Direct Connect connections terminate at a Direct Connect gateway and the transit VIFs to the transit gateway. The company recently acquired a smaller company that is based in Europe. The newly acquired company has only on-premises workloads. The newly acquired company does not expect to run workloads on AWS for the next 3 years. However, the newly acquired company requires connectivity to the parent company's AWS resources in us-east-1 and to the parent company's on-premises environment in the US. The parent company wants to use two new Direct Connect connections in Europe to provide the required connectivity. Which solution will meet these requirements with the LEAST operational overhead for the newly acquired company?

A company is establishing hybrid cloud connectivity from an on-premises environment to AWS in the us-east-1 Region. The company is using a 10 Gbps AWS Direct Connect dedicated connection. The company has two accounts in AWS. Account A has transit gateways in four AWS Regions. Account В has transit gateways in three Regions. The company does not plan to expand. To meet security requirements the company's accounts must have separate cloud infrastructure. Which solution will meet these requirements MOST cost-effectively?

A company runs an application across multiple AWS Regions and multiple Availability Zones. The company needs to expand to a new AWS Region. Low latency is critical to the functionality of the application. A network engineer needs to gather metrics for the latency between the existing. Regions and the new Region. The network engineer must gather metrics for at least the previous 30 days. Which solution will meet these requirements?

A company operates in the us-east-1 Region and the us-west-1 Region. The company is designing a solution to connect an on-premises data center to the company's AWS environment in us-east-1. The solution uses two AWS Direct Connect connections. Traffic from us-west-1 to the data center needs to traverse the Direct Connect connections. A network engineer needs to set up active-passive functionality across the two Direct Connect connections by using a Direct Connect gateway to influence inbound traffic from VPCs that are in us-west-1 to the data center. Which solution will meet these requirements?

A company has multiple firewalls and ISPs for its on-premises data center. The company has a single AWS Site-to-Site VPN connection from the company's on-premises data center to a transit gateway. A single ISP services the Site-to-Site VPN connection. Multiple VPCs are attached to the transit gateway. A customer gateway that the Site-to-Site VPN connection uses fails. Connectivity is completely lost, but the company's network team does not receive a notification. The network team needs to implement redundancy within a week in case a single customer gateway fails again. The team wants to use an Amazon CloudWatch alarm to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic if any tunnel of the Site-to-Site VPN connection fails. Which solution will meet these requirements MOST cost-effectively?

A gaming company operates in one AWS Region. The company's architecture includes an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group that support a frontend application. The company uses AWS WAF integrated with the ALB. The ALB has one security group attached to it. The company uses AWS Network Firewall with stateful rules. The company has set up Network ACLs. The company wants to automatically block access for game users who violate specific rules. The company wants to temporarily block access for problematic users for 1 to 2 hours. The company's software can identify the source IP addresses of problematic users. The company has created a serverless solution to store the IP addresses in Amazon DynamoDB. The company wants to use its existing serverless architecture to automatically block the problematic users. Which solution will meet these requirements in the MOST scalable way? (Choose two.)

A company is setting up an AWS Direct Connect connection between the company's on-premises data center and AWS. The company currently has a single VPC in its AWS account. The on-premises data center uses the 172.16.0.0/16 CIDR block, and the VPC uses the 10.1.1.0/24 CIDR block. The company associates the Direct Connect connection to one private VIF. A network engineer receives reports that SSH communication from hosts that are in the company's on-premises data center to Amazon EC2 instances that are deployed in the company's VPC is failing. The network engineer investigates and finds that the VIF is up and a BGP peering session has been established properly. Which steps should the engineer take to troubleshoot this issue? (Choose three.)

A company needs to connect its on-premises network to a VPC in the us-east-1 Region. The connection must support a maximum transmission unit (MTU) of 9,000 bytes and must be highly available. Which solution will meet these requirements MOST cost-effectively?

A network engineer maintains a company's AWS infrastructure. The network engineer used AWS Transit Gateway to set up a hub and spoke architecture. The network engineer created a shared services VPC to centralize access to interface VPC endpoints. The company uses AWS Organizations to manage AWS accounts for multiple teams in a single organization. Each team in the company has a separate account and VPC. All the team accounts require access to the interface VPC endpoints. The network engineer needs a solution to grant each account the minimum required access. Each team's account must have access only to a list of authorized interface VPC endpoints. The solution must have minimal effect on the current architecture. Which solution will meet these requirements with the LEAST operational overhead?

A global network service provider deploys managed AWS Direct Connect connections for its customers. The company wants to integrate monitoring for the connections into its existing ticketing system. The ticketing system runs in the company's VPC on multiple EC2 instances. The ticketing system uses a REST API. The ticketing system must receive events with minimal latency. The company expects to receive an average of 1 event each day. The company wants to use its existing infrastructure as code (IaC) tooling to configure the monitoring integration solution. Which solution will meet these requirements in the MOST cost-effective way?

A network engineer deploys an Application Load Balancer (ALB) in two Availability Zones. There is one target group. There are four Amazon EC2 instance targets in the first Availability Zone and six EC2 instance targets in the second Availability Zone. During testing, the network engineer notices that the targets in the first Availability Zone receive 40% of the traffic. The targets in the second Availability Zone receive 60% of the traffic. The network engineer needs to update the configuration to prevent traffic from crossing Availability Zones. The network engineer wants to achieve a 50% traffic split across the Availability Zones. Which solution will meet these requirements?