Official Exam Details: (ANS-C01)

Exam Code:
ANS-C01

Passing Score:
70%

Total Question Bank:
274 Verified Questions

Exam Duration:
120 Minutes

Exam Format & Question Types

This certification exam features multiple-choice questions (single and multi-select), interactive Hotspots, Hot Areas, and Drag-and-Drop scenario configurations designed to test real-world technical competency.

AWS Certified Advanced Networking – Specialty (ANS-C01) Study Guide & Architectural Master Blueprint

1. Exam Overview & Profile

The AWS Certified Advanced Networking – Specialty (ANS-C01) certification targets individuals in a networking role who perform complex networking tasks. This exam validates expertise in designing, developing, and deploying cloud-based solutions using AWS, as well as implementing and maintaining network architectures for all AWS services. Candidates are expected to have a deep understanding of AWS networking concepts, hybrid IT network architectures, and troubleshooting skills.

Target Audience: Network engineers, cloud architects, and network administrators with at least five years of hands-on experience in networking architecture, design, and implementation, specifically with advanced knowledge of AWS networking services.
Question Count: Typically 65 multiple-choice, multiple-response questions.
Duration: 170 minutes.
Passing Score: A scaled score of 750 out of 1000. This is a challenging exam, emphasizing practical application and deep architectural understanding over rote memorization.

2. Deep-Dive Domain Breakdown

The ANS-C01 exam is highly focused on advanced networking concepts across various AWS services. Success requires a mastery of architectural patterns and decision-making for complex scenarios.

Domain 1: Network Design (30%)

VPC Design: Multi-VPC, multi-Region architectures. Subnetting strategies (public, private, isolated, IPv4/IPv6). Route table configurations, NACLs, Security Groups.
IP Addressing: Strategic CIDR block allocation, IPAM considerations, public vs. private IPs, EIPs, NAT Gateway and Egress-Only Internet Gateway designs.
High Availability & Disaster Recovery: Designing highly available network components (e.g., redundant VPNs, Direct Connect failover, multi-AZ deployments for NAT Gateways).
DNS Solutions: Advanced Route 53 configurations, including Private Hosted Zones, Resolver Endpoints (inbound/outbound), and conditional forwarding for hybrid DNS resolution.

Domain 2: Network Implementation (26%)

Hybrid Connectivity: Implementing Direct Connect (dedicated, hosted connections, LAG, public/private VIFs) and various VPN types (Site-to-Site, Client VPN, SSL/IPsec) with redundancy.
Transit Gateway: Centralized hub-and-spoke network architectures. Attaching VPCs, VPNs, Direct Connect Gateways. Route table associations and propagations for inter-VPC and hybrid routing.
Advanced Routing: BGP advertisement for Direct Connect and VPN, understanding routing priorities, static vs. dynamic routing.
Network Address Translation (NAT): Implementing NAT Gateway, understanding its scaling and costs. NAT instances for specific use cases.

Domain 3: Network Management and Operations (20%)

Network Monitoring: Configuring and analyzing VPC Flow Logs, Traffic Mirroring, CloudWatch metrics and alarms for network performance and availability.
Troubleshooting: Utilizing Network Access Analyzer, Reachability Analyzer, VPC Flow Logs, and various Linux/Windows network tools to diagnose complex network issues.
Performance Optimization: Understanding network performance characteristics (throughput, latency, jumbo frames), ENI/ENA tuning, placement groups.
Automation: Using CloudFormation or AWS CDK to deploy and manage complex network infrastructures.

Domain 4: Network Security, Compliance, and Governance (24%)

Security Services: Implementing WAF, Shield (Standard/Advanced), AWS Network Firewall for granular traffic inspection and filtering.
DDoS Protection: Strategies leveraging AWS Shield Advanced, Route 53, and Elastic Load Balancers.
Network Segmentation: Designing and implementing network isolation using VPCs, subnets, and security controls.
Compliance: Logging and auditing network events with CloudTrail and VPC Flow Logs.
Access Control: IAM policies for granular control over network resources and APIs.

3. High-Yield Exam Tips & Scenario Traps

Understand Trade-offs: Every architectural decision involves trade-offs (cost, performance, complexity, security). Be prepared to justify choices based on scenario requirements.
Direct Connect vs. VPN: Direct Connect for high bandwidth, low latency, consistent performance. VPN for flexibility, cost-effectiveness, or backup. Understand Direct Connect Gateway for global connectivity.
Transit Gateway is King: Expect numerous questions involving Transit Gateway for centralized routing, inter-VPC communication, and hybrid connectivity (connecting multiple VPNs/DXs to many VPCs). Master its routing and attachment types.
Security Groups vs. NACLs: Security Groups are stateful and instance-level; NACLs are stateless and subnet-level. NACLs are processed before Security Groups. Understand their order of operations and when to use each.
Hybrid DNS: Route 53 Resolver Endpoints (inbound for on-premises querying AWS, outbound for AWS querying on-premises) are critical for seamless hybrid DNS resolution.
Asymmetric Routing: A common trap. Ensure your routing design prevents traffic from leaving via one path (e.g., DX) and returning via another (e.g., VPN) unexpectedly, which can cause issues with stateful firewalls.
IPv6: Do not overlook IPv6. Understand Egress-Only Internet Gateway, IPv6 CIDR allocation, and dual-stack configurations.
Troubleshooting: Learn the output of VPC Flow Logs and how to interpret common network errors using Reachability Analyzer.

4. Frequently Asked Questions (FAQ)

Q1: How do I best prepare for the highly detailed, scenario-based questions on this exam?

A1: Hands-on experience is paramount. Go beyond tutorials; build complex, multi-VPC, multi-Region, and hybrid network architectures in your own AWS account. Simulate failures, implement redundancy, and deeply understand the intricacies of Transit Gateway, Direct Connect, and advanced Route 53 Resolver configurations. Focus on “why” a particular service or design pattern is chosen for a given requirement (e.g., cost, performance, security, operational overhead).

Q2: What are the most common services I should focus on to pass ANS-C01?

A2: Absolutely prioritize Amazon VPC (subnets, route tables, IGWs, NAT Gateways), AWS Direct Connect, AWS Site-to-Site VPN, AWS Transit Gateway, and Amazon Route 53 Resolver. Also critical are Security Groups, NACLs, VPC Flow Logs, Traffic Mirroring, and AWS Network Firewall. Understand their integration points and how they operate together in complex scenarios.

Q3: How much attention should I pay to cost optimization in my architectural decisions?

A3: Cost optimization is always a factor in architectural decisions and is frequently tested. While performance, availability, and security often take precedence in a specialty exam, be prepared to differentiate between cost-effective solutions and premium options (e.g., VPN vs. Direct Connect, NAT Gateway vs. NAT instance). Understand data transfer costs, especially across Regions and to the internet, as well as service-specific pricing for Transit Gateway attachments and Direct Connect VIFs.

Q4: Are there any specific AWS whitepapers or documentation sections I should deep dive into?

A4: Yes, absolutely. The entire Amazon VPC User Guide is foundational. Delve specifically into the AWS Direct Connect User Guide, AWS Transit Gateway Developer Guide, and the Amazon Route 53 Developer Guide sections pertaining to Resolver endpoints and hybrid DNS architectures. Review whitepapers like “Architecting for HIPAA Security and Compliance on Amazon Web Services” for security best practices and the “AWS Well-Architected Framework” whitepapers, particularly the Networking Lens, for design principles.

Free ANS-C01 Sample Practice Questions

Test your knowledge with these sample scenario questions complete with verified explanations:

General Practice Questions

QUESTION 1

A company has deployed Amazon EC2 instances private subnets in a VPC. The EC2 instances must initiate any requests that leave the VPC, including requests to the company’s on-premises data center over an AWS Direct Connect connection No resources outside the VPC can be allowed to open communications directly to the EC2 instances.

The on-premises data center’s customer gateway is configured with a stateful firewall device that filters for incoming and outgoing requests to and from multiple VPCs. In addition, the company wants to use a single IP match rule to allow all the communications from the EC2 instances to its data center from a single IP address.

Which solution will meet these requirements with the LEAST amount of operational overhead?

A. Create a VPN connection over the Direct Conned connection by using the on-premises firewall. Use the firewall to block all traffic from on premises to AWS. Allow a stateful connection from the EC2 instances to initiate the requests.
B. Configure the on-premises firewall to filter all requests from the on-premises network to the EC2 instances. Allow a stateful connection if the EC2 instances in the VPC initiate the traffic.
C. Deploy a NAT gateway into a private subnet in the VPC where the EC2 it-stances are deployed Specify the NAT gateway type as private. Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT gateway.
D. Deploy a NAT instance into a private subnet in the VPC where the EC2 instances are deployed Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT instance.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Deploying a Private NAT Gateway allows EC2 instances in private subnets to initiate outbound connections to on-premises resources via a single, stable private IP address. This directly enables the company’s requirement for a single IP match rule on the on-premises firewall, while being a fully managed service with the least operational overhead.

❌ Why the other choices are incorrect:

Option A is incorrect: While a VPN over Direct Connect is possible, this option does not inherently provide a single source IP for multiple EC2 instances, failing the "single IP match rule" requirement.
Option B is incorrect: This choice describes desired firewall behavior but offers no AWS-side solution to consolidate the source IPs from multiple EC2 instances into a single IP, which is critical for the on-premises firewall rule.
Option D is incorrect: A NAT instance can provide a single source IP, but it is a self-managed EC2 instance requiring significant operational overhead for high availability, patching, and monitoring, contradicting the "least operational overhead" requirement.

Reference: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-private-nat-gateway

QUESTION 2

A banking company is successfully operating its public mobile banking stack on AWS. The mobile banking stack is deployed in a VPC that includes private subnets and public subnets. The company is using IPv4 networking and has not deployed or supported IPv6 in the environment. The company has decided to adopt a third-party service provides API and must integrate the API with the existing environment. The service provider’s API requires the use of IPv6.

A network engineer must turn on IPv6 connectivity for the existing workload that is deployed in a private subnet. The company does not want to permit IPv6 traffic from the public internet and mandates that the company’s servers must initiate all IPv6 connectivity. The network engineer turns on IPv6 in the VPC and in the private subnets.

Which solution will meet these requirements?

A. Create an internet gateway and a NAT gateway in the VPC. Add a route to the existing subnet route tables to point IPv6 traffic to the NAT gateway.
B. Create an internet gateway and a NAT instance in the VPC. Add a route to the existing subnet route tables to point IPv6 traffic to the NAT instance.
C. Create an egress-only internet gateway in the VPC. Add a route to the existing subnet route tables to point IPv6 traffic to the egress-only internet gateway.
D. Create an egress-only internet gateway in the VPC. Configure a security group that denies all inbound traffic. Associate the security group with the egress-only internet gateway.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: An Egress-Only Internet Gateway allows instances in a private subnet to initiate outbound IPv6 connections to the internet while preventing unsolicited inbound IPv6 traffic, meeting both critical requirements: outbound-only initiation and no inbound public internet traffic. Routing IPv6 traffic to it from the subnet route table is the correct implementation.

❌ Why the other choices are incorrect:

Option A is incorrect: An Internet Gateway allows both inbound and outbound IPv6 traffic, violating the "no inbound public internet traffic" requirement. A NAT Gateway only supports IPv4.
Option B is incorrect: An Internet Gateway allows both inbound and outbound IPv6 traffic, violating the "no inbound public internet traffic" requirement. While a NAT instance could forward IPv6, it’s not the native, secure AWS solution like an Egress-Only IGW, and the IGW is still problematic.
Option D is incorrect: Security groups are associated with EC2 instances or ENIs, not directly with an Egress-Only Internet Gateway. The EIGW inherently provides the desired inbound restriction; associating a security group with it is an invalid architectural approach.

Reference: https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-igw.html

QUESTION 3

A company’s engineer needs to design a new solution to help troubleshoot and detect network anomalies. The network engineer has configured Traffic Mirroring. However. the mirrored traffic is overwhelming the Amazon EC2 instance that is the traffic mirror target. The EC2 instance hosts tools that the company’s security team uses to analyze the traffic. The network engineer needs to design a highly available solution that can scale to meet the demand of the mirrored traffic.

Which solution will meet these requirements?

A. Deploy a Network Load Balancer (NLB) as the traffic mirror target. Behind the NLR deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring as necessary.
B. Deploy an Application Load Balancer (ALB) as the traffic mirror target. Behind the ALB, deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring only during non-business hours.
C. Deploy a Gateway Load Balancer (GLB) as the traffic mirror target. Behind the GLB, deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring as necessary.
D. Deploy an Application Load Balancer (ALB) with an HTTPS listener as the traffic mirror target. Behind the ALB, deploy a fleet of EC2 instances in an Auto Scaling group. Use Traffic Mirroring only during active events or business hours.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Gateway Load Balancer (GLB) is purpose-built for deploying virtual network appliances (like security tools for analysis) operating at Layer 3, ideal for processing raw mirrored IP traffic via GENEVE encapsulation. Integrating with an Auto Scaling group provides robust high availability and scalability, effectively distributing traffic to meet demand. GLB is a supported target for Traffic Mirroring.

❌ Why the other choices are incorrect:

Option A is incorrect: Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP). While a supported target and scalable, GLB is a more appropriate and purpose-built solution for distributing all IP protocols to analysis tools and virtual network appliances.
Option B is incorrect: Application Load Balancer (ALB) operates at Layer 7 (HTTP/S) and is not a supported target for Traffic Mirroring. It cannot process raw IP traffic. Restricting usage doesn’t meet continuous anomaly detection requirements.
Option D is incorrect: Application Load Balancer (ALB) operates at Layer 7 and is not a supported target for Traffic Mirroring. An HTTPS listener is irrelevant for raw mirrored IP traffic. Restricting usage isn’t suitable for continuous network monitoring.

QUESTION 4

A company is developing an application in which IoT devices will report measurements to the AWS Cloud. The application will have millions of end users. The company observes that the IoT devices cannot support DNS resolution. The company needs to implement an Amazon EC2 Auto Scaling solution so that the IoT devices can connect to an application endpoint without using DNS.

Which solution will meet these requirements MOST cost-effectively?

A. Use an Application Load Balancer target group for a Network Load Balancer (NLB). Create an EC2 Auto Scaling group. Attach the Auto Scaling group to the ALB. Set up the IoT devices to connect to the IP addresses of the NLB.
B. Use an AWS Global Accelerator accelerator with an Application Load Balancer (ALB) endpoint. Create an EC2 Auto Scaling group. Attach the Auto Scaling group to the ALB. Set up the IoT devices to connect to the IP addresses of the accelerator.
C. Use a Network Load Balancer (NLB). Create an EC2 Auto Scaling group. Attach the Auto Scaling group to the NLB. Set up the IoT devices to connect to the IP addresses of the NLB.
D. Use an AWS Global Accelerator accelerator with a Network Load Balancer (NLB) endpoint. Create an EC2 Auto Scaling group. Attach the Auto Scaling group to the NLB. Set up the IoT devices to connect to the IP addresses of the accelerator.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Network Load Balancers (NLB) provide static IP addresses, allowing IoT devices to connect directly without DNS resolution. NLBs efficiently handle millions of concurrent connections (TCP/UDP) typical of IoT workloads and seamlessly integrate with EC2 Auto Scaling Groups, making this the most cost-effective solution for these requirements.

❌ Why the other choices are incorrect:

Option A is incorrect: This choice describes a contradictory and overly complex architecture (ALB target group for NLB, ASG attached to ALB). ALB is generally for HTTP/HTTPS traffic and typically relies on DNS, not static IPs for clients. This is not cost-effective.
Option B is incorrect: AWS Global Accelerator and Application Load Balancer add significant cost and complexity. While Global Accelerator provides static IPs, using an ALB for potentially non-HTTP IoT traffic is inefficient, and Global Accelerator’s cost isn’t justified if simpler NLB static IPs suffice for cost-effectiveness.
Option D is incorrect: While Global Accelerator with NLB provides static Anycast IPs, it’s a premium service. For the sole requirement of connecting via static IP without DNS, a standalone NLB is significantly more cost-effective than adding Global Accelerator if global performance optimization isn’t the primary goal.

QUESTION 5 (Multi-Select)

A company is using a NAT gateway to allow internet connectivity for private subnets in a VPC in the us-west-2 Region. After a security audit, the company needs to remove the NAT gateway.

In the private subnets, the company has resources that use the unified Amazon CloudWatch agent. A network engineer must create a solution to ensure that the unified CloudWatch agent continues to work after the removal of the NAT gateway.

Which combination of steps should the network engineer take to meet these requirements? (Select THREE.)

A. Validate that private DNS is enabled on the VPC by setting the enableDnsHostnames VPC attribute and the enableDnsSupport VPC attribute to true.
B. Create a new security group with an entry to allow outbound traffic that uses the TCP protocol on port 443 to destination 0.000/0
C. Create a new security group with entries to allow inbound traffic that uses the TCP protocol on port 443 from the IP prefixes of the private subnets.
D. Create the following interface VPC endpoints in the VPC: com.amazonawsus-west-2.logs and com.amazonaws.us-west-2nonitoring. Associate the new security group with the endpoint networkinterfaces.
E. Create the following interface VPC endpoint in the VPC: com.amazonaws.us•west-2doudwatch. Associate the new security group with the endpoint network interfaces
F. Associate the VPC endpoint or endpoints with route tables that the private subnets use.

Click to View Verified Solution & Explanation

Correct Option: A,D,F

Explanation: ✅ Option A (Correct)
Reasoning: Enabling private DNS (enableDnsHostnames and enableDnsSupport) is crucial for Interface VPC Endpoints. This ensures that AWS service DNS names (e.g., logs.us-west-2.amazonaws.com) resolve to the private IP addresses of the endpoint network interfaces within the VPC, allowing seamless communication from private subnets.

✅ Option D (Correct)
Reasoning: The unified CloudWatch agent sends logs to com.amazonaws.us-west-2.logs and metrics to com.amazonaws.us-west-2.monitoring. Creating Interface VPC Endpoints for these two specific services allows private subnets to communicate with CloudWatch without requiring a NAT gateway or internet access.

✅ Option F (Correct)
Reasoning: Associating the VPC endpoints with the route tables used by the private subnets is essential. This ensures that traffic destined for the CloudWatch service endpoints is correctly routed to the endpoint network interfaces within the VPC, rather than attempting to reach the internet.

❌ Why the other choices are incorrect:

Option B is incorrect: While instances need outbound 443, this describes an outbound rule for a new security group. If this SG is for the endpoints (as implied by D), an outbound 0.0.0.0/0 rule is not the primary requirement; inbound rules are.
Option C is incorrect: This describes the necessary inbound rule for the endpoint’s security group. While essential, A, D, and F represent broader configuration steps covering DNS, endpoint creation, and routing, which are typically prioritized in such questions.
Option E is incorrect: The CloudWatch agent primarily uses logs and monitoring endpoints for data ingestion. The com.amazonaws.us-west-2.cloudwatch endpoint is for general CloudWatch API calls, not the agent’s data plane.

Reference: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/private-vpc-endpoints.html

QUESTION 6 (Multi-Select)

A company operates its IT services through a multisite hybrid infrastructure. The company deploys resources on AWS in the us-east-I Region and in the eu-west-2 Region. The company also deploys resources in its own data centers that are located in the United States (US) and in the United Kingdom (UK). In both AWS Regions, the company uses a transit gateway to connect 15 VPCs to each other. The company has created a transit gateway peering connection between the two transit gateways. The VPC CIDR blocks do not overlap with each other or with IP addresses used within the data centers. The VPC CIDR prefixes can also be aggregated either on a Regional level or for the company’s entire AWS environment.

The data centers are connected to each other by a private WAN connection. IP routing information is exchanged dynamically through Interior BGP (iBGP) sessions. The data centers maintain connectivity to AWS through one AWS Direct Connect connection in the US and one Direct Connect connection in the 1.1K. Each Direct Connect connection is terminated on a Direct Connect gateway and is associated with a

local transit gateway through a transit VIF.

Traffic follows the shortest geographical path from source to destination. For example. packets from the UK data center that are targeted to resources in eu-west-2 travel across the local Direct Connect connection. In cases of cross-Region data transfers, such as from the UK data center to VPCs in us-east-1, the private WAN connection must be used to minimize costs on AWS. A network engineer has configured each transit gateway association on the Direct Connect gateway to advertise VPC-specific CIDR IP prefixes only from the local Region. The routes toward the other Region must be learned through BGP from the routers in the other data center in the original, non-aggregated form.

The company recently experienced a problem with cross-Region data transfers because of issues with its private WAN connection. The network engineer needs to modify the routing setup to prevent similar interruptions in the future. The solution cannot modify the original traffic routing goal when the network is operating normally.

Which modifications will meet these requirements? (Select TWO.)

A. Remove all the VPC CIDR prefixes from the list of subnets advertised through the local Direct Connect connection. Add the company's entire AWS environment aggregate route to the list of subnets advertised through the local Direct Connect connection.
B. Add the CIDR prefixes from the other Region VPCs and the local VPC CIDR blocks to the list of subnets advertised through the local Direct Connect connection. Configure data center routers to make routing decisions based on the BGP communities received.
C. Add the aggregate IP prefix for the other Region and the local VPC CIDR blocks to the list of subnets advertised through the local Direct Connect connection.
D. Add the aggregate IP prefix for the company's entire AWS environment and the local VPC CIDR blocks to the list of subnets advertised through the local Direct Connect connection.
E. Remove all the VPC CIDR prefixes from the list of subnets advertised through the local Direct Connect connection. Add both Regional aggregate IP prefixes to the list of subnets advertised through the Direct Connect connection on both sides of the network. Configure data center routers to make routing decisions based on the BGP communities received.

Click to View Verified Solution & Explanation

Correct Option: C,E

Explanation: ✅ Option C (Correct)
Reasoning: Adding the aggregate IP prefix for the other Region via the local Direct Connect gateway provides a backup path to the remote AWS Region. Retaining local VPC CIDR blocks ensures local traffic continues as normal. The WAN path, likely advertising more specific routes or having BGP preference, would remain primary for cross-Region traffic (longest prefix match or existing BGP configuration).

✅ Option E (Correct)
Reasoning: Advertising both Regional aggregate IP prefixes from each Direct Connect gateway creates full AWS cross-region reachability via the local DX as a backup. Removing specific VPC advertisements simplifies routing by consolidating to aggregates. Crucially, configuring BGP communities explicitly allows data center routers to prioritize the private WAN path when available, meeting the "no modification of original routing goal" requirement, and failover to AWS cross-region path otherwise.

❌ Why the other choices are incorrect:

Option A is incorrect: Advertising a single, broad "entire AWS environment aggregate route" without BGP communities could easily disrupt the original routing goal by making the local DX path preferred for cross-Region traffic, incurring higher AWS costs.
Option B is incorrect: While technically feasible, advertising all specific VPC CIDRs (30 prefixes) from both Direct Connect gateways is less scalable and efficient than using regional aggregates, which the problem context suggests is an option.
Option D is incorrect: Similar to A, using a global aggregate along with local specific CIDRs without explicit BGP community control risks overriding the desired WAN preference for cross-Region traffic.

QUESTION 7

A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company recently experienced a network security breach. A network engineer must collect and analyze logs that include the client IP address. target IP address, target port, and user agent of each user that accesses the application.

What is the MOST operationally efficient solution that meets these requirements?

A. Configure the ALB to store logs in an Amazon S3 bucket. Download the files from Amazon S3, and use a spreadsheet application to analyze the logs.
B. Configure the ALB to push logs to Amazon Kinesis Data Streams. Use Amazon Kinesis Data Analytics to analyze the logs.
C. Configure Amazon Kinesis Data Streams to stream data from the ALB to Amazon OpenSearch Service (Amazon Elasticsearch Service). Use search operations in Amazon OpenSearch Service (Amazon Elasticsearch Service) to analyze the data.
D. Configure the ALB to store logs in an Amazon S3 bucket. Use Amazon Athena to analyze the logs in Amazon S3.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Option D (Correct)
Reasoning: ALB natively stores detailed access logs, including client IP, target IP, port, and user agent, directly in Amazon S3. Amazon Athena is a serverless query service that enables efficient SQL-based analysis of data stored in S3 without managing any infrastructure, making it the most operationally efficient solution.

❌ Why the other choices are incorrect:

Option A is incorrect: Downloading large log files to analyze with a spreadsheet is a manual, highly inefficient, and unscalable process for ongoing security analysis.
Option B is incorrect: ALB does not natively push logs directly to Amazon Kinesis Data Streams. An intermediate service (e.g., Firehose from S3) would be required, adding complexity and operational overhead.
Option C is incorrect: This solution requires a multi-step pipeline (ALB -> S3 -> Kinesis Firehose -> Kinesis Data Streams -> OpenSearch Service), introducing significant operational complexity and cost compared to Athena.

QUESTION 8

A network engineer must provide additional safeguards to protect encrypted data at Application Load Balancers (ALBs) through the use of a unique random session key.

What should the network engineer do to meet this requirement?

A. Change the ALB security policy to a policy that supports TLS 1.2 protocol only.
B. Use AWS Key Management Service (AWS KMS) to encrypt session keys.
C. Associate an AWS WAF web ACL with the ALBs. and create a security rule to enforce forward secrecy (FS).
D. Change the ALB security policy to a policy that supports forward secrecy (FS).

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Option D (Correct)
Reasoning: Changing the ALB security policy to one that supports forward secrecy (FS) directly addresses the requirement. FS ensures that each TLS session uses a unique, ephemeral session key, preventing the compromise of a server’s long-term private key from decrypting past communications. This provides the "additional safeguards" through "unique random session keys."

❌ Why the other choices are incorrect:

Option A is incorrect: While TLS 1.2 is a secure protocol, simply enforcing it doesn’t guarantee forward secrecy. Many TLS 1.2 cipher suites do not offer FS. Specific FS-enabled cipher suites must be prioritized.
Option B is incorrect: AWS KMS manages encryption keys, but it is not directly involved in generating or managing the ephemeral session keys used for real-time TLS handshakes and forward secrecy on an ALB.
Option C is incorrect: AWS WAF operates at Layer 7 and is designed for web application filtering (e.g., SQL injection, XSS). It cannot configure or enforce TLS protocol versions, cipher suites, or forward secrecy for ALBs, which is handled by ALB security policies.

Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies

QUESTION 9

A company has several production applications across different accounts in the AWS Cloud. The company operates from the us-east-1 Region only. Only certain partner companies can access the applications. The applications are running on Amazon EC2 instances that are in an Auto Scaling group behind an Application Load Balancer (ALB). The EC2 instances are in private subnets and allow traffic only from the ALB. The ALB is in a public subnet and allows inbound traffic only from partner network IP address ranges over port 80.

When the company adds a new partner, the company must allow the IP address range of the partner network in the security group that is associated with the ALB in each account. A network engineer must implement a solution to centrally manage the partner network IP address ranges.

Which solution will meet these requirements in the MOST operationally efficient manner?

A. Create an Amazon DynamoDB table to maintain all IP address ranges and security groups that need to be updated. Update the DynamoDB table with the new IP address range when the company adds a new partner. Invoke an AWS Lambda function to read new IP address ranges and security groups from the DynamoDB table to update the security groups. Deploy this solution in all accounts.
B. Create a new prefix list. Add all allowed IP address ranges to the prefix list. Use Amazon EventBridge (Amazon CloudWatch Events) rules to invoke an AWS Lambda function to update security groups whenever a new IP address range is added to the prefix list. Deploy this solution in all accounts.
C. Create a new prefix list. Add all allowed IP address ranges to the prefix list. Share the prefix list across different accounts by using AWS Resource Access Manager (AWS RAM). Update security groups to use the prefix list instead of the partner IP address range. Update the prefix list with the new IP address range when the company adds a new partner.
D. Create an Amazon S3 bucket to maintain all IP address ranges and security groups that need to be updated. Update the S3 bucket with the new IP address range when the company adds a new partner.Invoke an AWS Lambda function to read new IP address ranges and security groups from the S3 bucket to update the security groups. Deploy this solution in all accounts.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Creating a prefix list to centralize IP ranges and sharing it via AWS Resource Access Manager (AWS RAM) across accounts is the most operationally efficient method. Security groups can directly reference this shared prefix list. When the central prefix list is updated, all associated security groups automatically reflect the changes, eliminating manual updates or custom automation per account.

❌ Why the other choices are incorrect:

Option A is incorrect: This custom solution (DynamoDB + Lambda) requires development, deployment, and maintenance of code/infrastructure in each account or complex cross-account roles, increasing operational overhead compared to native AWS sharing.
Option B is incorrect: While prefix lists are suitable, this option lacks AWS RAM for sharing, implying a distributed management approach where EventBridge/Lambda solutions must be deployed and maintained in each account to track and react to potential changes, making it less efficient for central management.
Option D is incorrect: Similar to Option A, this custom solution (S3 + Lambda) introduces unnecessary development, deployment, and maintenance burden across accounts, failing to leverage native AWS resource sharing mechanisms for maximum operational efficiency.

QUESTION 10

A company is migrating its containerized application to AWS. For the architecture, the company will have an ingress VPC with a Network Load Balancer (NLB) to distribute the traffic to front-end pods in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster The front end of the application will determine which user is requesting access and will send traffic to 1 of 10 services VPCs. Each services VPC will include an NLB that distributes traffic to the services pods in an EKS cluster.

The company is concerned about overall cost. User traffic will be responsible for more than 10 TB of data transfer from the ingress VPC to services VPCs every month. A network engineer needs to recommend how to design the communication between the VPCs.

Which solution will meet these requirements at the LOWEST cost?

A. Create a transit gateway. Peer each VPC to the transit gateway. Use zonal DNS names for the NLB in the services VPCs to minimize cross-AZ traffic from the ingress VPC to the services VPCs.
B. Create an AWS PrivateLink endpoint in every Availability Zone in the ingress VPC. Each PrivateLink endpoint will point to the zonal DNS entry of the NLB in the services VPCs.
C. Create a VPC peering connection between the ingress VPC and each of the 10 services VPCs. Use zonal DNS names for the NLB in the services VPCs to minimize cross-AZ traffic from the ingress VPC to the services VPCs.
D. Create a transit gateway. Peer each VPC to the transit gateway Turn off cross-AZ load balancing on the transit gateway. Use Regional DNS names for the NLB in the services VPCs.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: VPC peering offers the lowest data transfer costs for direct inter-VPC communication. Creating 10 peering connections is manageable. Zonal DNS for NLBs is crucial for cost optimization, as it ensures traffic stays within the same Availability Zone, minimizing expensive cross-AZ data transfer for the 10+ TB/month.

❌ Why the other choices are incorrect:

Option A is incorrect: Transit Gateway incurs hourly attachment fees per VPC and data processing charges per GB. With 11 VPCs and 10 TB of data, these costs would be significantly higher than VPC peering.
Option B is incorrect: AWS PrivateLink endpoints incur hourly costs per endpoint per AZ, plus data processing charges. Implementing 10 PrivateLink services across multiple AZs would be extremely expensive and complex for this use case.
Option D is incorrect: Transit Gateway has data processing charges, making it more expensive than peering. Furthermore, "turn off cross-AZ load balancing on the transit gateway" is not a valid TGW feature, and using Regional DNS names would increase costly cross-AZ traffic.

QUESTION 11

A network engineer must develop an AWS CloudFormation template that can create a virtual private gateway, a customer gateway, a VPN connection, and static routes in a route table. During testing of the template, the network engineer notes that the CloudFormation template has encountered an error and is rolling back.

What should the network engineer do to resolve the error?

A. Change the order of resource creation in the CloudFormation template.
B. Add the Depends on attribute to the resource declaration for the virtual private gateway. Specify the route table entry resource.
C. Add a wait condition in the template to wait for the creation of the virtual private gateway.
D. Add the DependsOn attribute to the resource declaration for the route table entry. Specify the virtual private gateway resource.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Option D (Correct)
Reasoning: A static route table entry for a VPN connection must point to a fully created Virtual Private Gateway. If CloudFormation attempts to create the route before the VPG is ready, it will fail. Adding DependsOn to the route table entry resource, referencing the VPG, explicitly ensures the VPG’s successful creation before the route is added.

❌ Why the other choices are incorrect:

Option A is incorrect: CloudFormation manages resource creation order based on implicit dependencies (e.g., Ref, Fn::GetAtt). If implicit dependencies are insufficient, DependsOn is the correct explicit mechanism, not simply reordering.
Option B is incorrect: This dependency is backward. The Virtual Private Gateway does not depend on the route table entry. The route table entry depends on the VPG’s existence.
Option C is incorrect: Wait conditions are generally for external signals or custom resource provisioning. For inter-AWS resource dependencies managed by CloudFormation, DependsOn is the appropriate and simpler solution.

Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html

QUESTION 12

A marketing company is using hybrid infrastructure through AWS Direct Connect links and a software-defined wide area network (SD-WAN) overlay to connect its branch offices. The company connects multiple

VPCs to a third-party SD-WAN appliance transit VPC within the same account by using AWS Site-to-Site VPNs.

The company is planning to connect more VPCs to the SD-WAN appliance transit VPC. However, the company faces challenges of scalability route table limitations, and higher costs with the existing architecture. A network engineer must design a solution to resolve these issues and remove dependencies.

Which solution will meet these requirements with the LEAST amount of operational overhead?

A. Configure a transit gateway to attach the VPCs. Configure a Site-to-Site VPN connection between the transit gateway and the third-party SD-WAN appliance transit VPC. Use the SD-WAN overlay links to connect to the branch offices.
B. Configure a transit gateway to attach the VPCs. Configure a transit gateway Connect attachment for the third-party SD-WAN appliance transit VPC. Use transit gateway Connect native integration of SD- WAN virtual hubs with AWS Transit Gateway.
C. Configure a transit gateway to attach the VPCs. Configure VPC peering between the VPCs and the third-party SD-WAN appliance transit VPC. Use the SD-WAN overlay links to connect to the branch.
D. Configure VPC peering between the VPCs and the third-party SD-WAN appliance transit VPC. Use transit gateway Connect native integration of SD-WAN virtual hubs with AWS Transit Gateway.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Option B (Correct)
Reasoning: This solution effectively scales by using a Transit Gateway for VPC attachments. TGW Connect offers native integration for SD-WAN virtual hubs, using GRE tunnels and BGP over existing Direct Connect/VPN. This delivers significantly higher bandwidth and dynamic routing, reducing operational overhead, route table limits, and dependencies compared to traditional Site-to-Site VPNs, directly addressing the core problems.

❌ Why the other choices are incorrect:

Option A is incorrect: While using a Transit Gateway is good, connecting it via a standard Site-to-Site VPN to the SD-WAN appliance transit VPC does not provide the "least operational overhead" or the benefits of native SD-WAN integration that TGW Connect offers.
Option C is incorrect: VPC peering is not transitive and would require a mesh of peerings to connect spoke VPCs through the SD-WAN appliance transit VPC, defeating TGW’s purpose and causing severe scalability and operational overhead issues.
Option D is incorrect: This option incorrectly suggests using VPC peering between VPCs and the SD-WAN transit VPC. VPC peering does not scale for transitive routing and is incompatible with the TGW Connect integration for spoke VPCs, making it an unworkable and high-overhead solution.

Reference: https://aws.amazon.com/transit-gateway/features/connect/

QUESTION 13 (Multi-Select)

A network engineer is designing the architecture for a healthcare company’s workload that is moving to the AWS Cloud. All data to and from the on-premises environment must be encrypted in transit. All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premises environment or to the internet.

The company will expose components of the workload to the internet so that patients can reserve appointments. The architecture must secure these components and protect them against DDoS attacks. The architecture also must provide protection against financial liability for services that scale out during a DDoS event.

Which combination of steps should the network engineer take to meet all these requirements for the workload? (Select THREE.)

A. Use Traffic Mirroring to copy all traffic to a fleet of traffic capture appliances.
B. Set up AWS WAF on all network components.
C. Configure an AWS Lambda function to create Deny rules in security groups to block malicious IP addresses.
D. Use AWS Direct Connect with MACsec support for connectivity to the cloud.
E. Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection.
F. Configure AWS Shield Advanced and ensure that it is configured on all public assets.

Click to View Verified Solution & Explanation

Correct Option: D,E,F

Explanation: ✅ Option D (Correct)
Reasoning: Direct Connect with MACsec ensures Layer 2 encryption for all data traversing between on-premises and AWS, fulfilling the "encrypted in transit" requirement for this critical link.

✅ Option E (Correct)
Reasoning: Gateway Load Balancers (GWLB) allow seamless insertion of third-party firewalls for inline, transparent inspection of all incoming and outgoing network traffic, satisfying the "inspected in the cloud before leaving" requirement.

✅ Option F (Correct)
Reasoning: AWS Shield Advanced provides comprehensive DDoS protection for public assets and includes cost protection against scaling charges during a DDoS event, directly addressing both security and financial liability concerns.

❌ Why the other choices are incorrect:

Option A is incorrect: Traffic Mirroring is for out-of-band monitoring and passive inspection, not the inline traffic inspection required before traffic leaves the cloud.
Option B is incorrect: AWS WAF protects Layer 7 web applications (e.g., ALB, CloudFront), not all network components or providing inline inspection for all traffic types (e.g., to on-premises).
Option C is incorrect: An AWS Lambda function for security groups is a reactive and custom solution, not a primary or comprehensive approach for proactive DDoS protection, inline inspection, or encryption for all traffic.

QUESTION 14

A global company operates all its non-production environments out of three AWS Regions: eu-west-1, us-east-1, and us-west-1. The company hosts all its production workloads in two on-premises data centers. The company has 60 AWS accounts, and each account has two VPCs in each Region. Each VPC has a virtual private gateway where two VPN connections terminate for resilient connectivity to the data centers. The company has 360 VPN tunnels to each data center, resulting in high management overhead. The total VPN throughput for each Region is 500 Mbps.

The company wants to migrate the production environments to AWS. The company needs a solution that will simplify the network architecture and allow for future growth. The production environments will generate

an additional 2 Gbps of traffic per Region back to the data centers. This traffic will increase over time.

Which solution will meet these requirements?

A. Set up an AWS Direct Connect connection from each data center to AWS in each Region. Create and attach private VlFs to a single Direct Connect gateway. Attach the Direct Connect gateway to all the VPCs. Remove the existing VPN connections that are attached directly to the virtual private gateways.
B. Create a single transit gateway with VPN connections from each data center. Share the transit gateway with each account by using AWS Resource Access Manager (AWS RAM). Attach the transit gateway to each VPC. Remove the existing VPN connections that are attached directly to the virtual private gateways.
C. Create a transit gateway in each Region with multiple newly commissioned VPN connections from each data center. Share the transit gateways with each account by using AWS Resource Access Manager (AWS RAM). In each Region, attach the transit gateway to each VPC. Remove the existing VPN connections that are attached directly to the virtual private gateways.
D. Peer all the VPCs in each Region to a new VPC in each Region that will function as a centralized transit VPC. Create new VPN connections from each data center to the transit VPCs. Terminate the original VPN connections that are attached to all the original VPCs. Retain the new VPN connection to the new transit VPC in each Region.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Creating a Transit Gateway in each Region provides a centralized hub for all VPCs. Multiple VPNs per TGW enable ECMP, scaling throughput to 2.5 Gbps and beyond for future growth. Sharing via RAM simplifies multi-account management, consolidating numerous individual VPNs into a streamlined, resilient architecture.

❌ Why the other choices are incorrect:

Option A is incorrect: Direct Connect Gateway (DXGW) does not directly attach to VPCs; it connects to VGWs or TGWs. Attaching to individual VGWs across 360 VPCs would not simplify the architecture or centralize multi-account routing effectively.
Option B is incorrect: A Transit Gateway is a regional resource. A "single transit gateway" cannot connect VPCs across multiple AWS Regions to on-premises data centers, making this solution architecturally impossible for a multi-region setup.
Option D is incorrect: A transit VPC is an outdated anti-pattern. It introduces significant complexity and scalability limitations with numerous VPC peerings (360+ VPCs) compared to the managed and scalable Transit Gateway service.

QUESTION 15

A company is planning a migration of its critical workloads from an on-premises data center to Amazon EC2 instances. The plan includes a new 10 Gbps AWS Direct Connect dedicated connection from the on.

premises data center to a VPC that is attached to a transit gateway. The migration must occur over encrypted paths between the on-premises data center and the AWS Cloud.

Which solution will meet these requirements while providing the HIGHEST throughput?

A. Configure a public VIF on the Direct Connect connection. Configure an AWS Site-to-Site VPN connection to the transit gateway as a VPN attachment.
B. Configure a transit VIF on the Direct Connect connection. Configure an IPsec VPN connection to an EC2 instance that is running third-party VPN software.
C. Configure MACsec for the Direct Connect connection. Configure a transit VIF to a Direct Connect gateway that is associated with the transit gateway.
D. Configure a public VIF on the Direct Connect connection. Configure two AWS Site-to-Site VPN connections to the transit gateway Enable equal-cost multi-path (ECMP) routing.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: MACsec provides line-rate Layer 2 encryption directly over the 10 Gbps Direct Connect link, maximizing throughput while securing traffic. A transit VIF correctly connects the Direct Connect to a Direct Connect Gateway, which then associates with the Transit Gateway. This combination fulfills both the highest throughput and encryption requirements directly at the physical layer.

❌ Why the other choices are incorrect:

Option A is incorrect: Public VIFs are for public AWS services. Site-to-Site VPN throughput is limited to 1.25 Gbps per tunnel, and even over DX, this is significantly less than the 10 Gbps available, failing the "highest throughput" requirement.
Option B is incorrect: While a transit VIF is appropriate, using an IPsec VPN to an EC2 instance running third-party software introduces EC2 instance and software performance bottlenecks, and management overhead. It is unlikely to achieve the highest possible throughput compared to native MACsec.
Option D is incorrect: Public VIF is for public services. While ECMP can aggregate Site-to-Site VPN tunnels, each tunnel is still limited to 1.25 Gbps. This solution won’t achieve 10 Gbps line-rate encryption, unlike MACsec, thus not providing the highest throughput.

QUESTION 16

A company’s development team has created a new product recommendation web service. The web service is hosted in a VPC with a CIDR block of 192.168.224.0119. The company has deployed the web service on Amazon EC2 instances and has configured an Auto Scaling group as the target of a Network Load Balancer (NLB).

The company wants to perform testing to determine whether users who receive product recommendations spend more money than users who do not receive product recommendations. The company has a big sales event in 5 days and needs to integrate its existing production environment with the recommendation engine by then. The existing production environment is hosted in a VPC with a CIDR block of 192.168.128.0/17.

A network engineer must integrate the systems by designing a solution that results in the least possible disruption to the existing environments.

Which solution will meet these requirements?

A. Create a VPC peering connection between the web service VPC and the existing production VPC. Add a routing rule to the appropriate route table to allow data to flow to 192.168.224.0119 from the existing production environment and to flow to 192.168.128.0117 from the web service environment. Configure the relevant security groups and ACLs to allow the systems to communicate.
B. Ask the development team of the web service to redeploy the web service into the production VPC and integrate the systems there.
C. Create a VPC endpoint service. Associate the VPC endpoint service with the NLB for the web service. Create an interface VPC endpoint for the web service in the existing production VPC.
D. Create a transit gateway in the existing production environment. Create attachments to the production VPC and the web service VPC. Configure appropriate routing rules in the transit gateway and VPC route tables for 192.168224.0/19 and 192.168.128 0/17. Configure the relevant security groups and ACLs to allow the systems to communicate.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Creating a VPC endpoint service associated with the existing NLB allows the web service to be exposed privately. An interface VPC endpoint in the production VPC then consumes this service as if it were local, avoiding direct network routing to the web service VPC, thus minimizing disruption and meeting the deadline.

❌ Why the other choices are incorrect:

Option A is incorrect: VPC peering establishes full network connectivity between VPCs. While feasible, it requires direct routing rule updates in both VPCs and is less granular/service-oriented than a VPC endpoint for consuming a specific service, potentially causing more disruption.
Option B is incorrect: Redeploying the web service into the production VPC is a highly disruptive, time-consuming process that would involve significant re-configuration and testing, failing the "least possible disruption" requirement.
Option D is incorrect: A Transit Gateway is an overkill solution for connecting only two VPCs, especially for consuming a single service. It introduces unnecessary complexity and management overhead, increasing disruption compared to a VPC endpoint.

Reference: https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-services.html

QUESTION 17

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is the origin in an Amazon CloudFront distribution. The company wants to implement a custom authentication system that will provide a token for its authenticated customers.

The web application must ensure that the GET/POST requests come from authenticated customers before it delivers the content. A network engineer must design a solution that gives the web application the ability to identify authorized customers.

What is the MOST operationally efficient solution that meets these requirements?

A. Use the ALB to inspect the authorized token inside the GET/POST request payload. Use an AWS Lambda function to insert a customized header to inform the web application of an authenticated customer request.
B. Integrate AWS WAF with the ALB to inspect the authorized token inside the GET/POST request payload. Configure the ALB listener to insert a customized header to inform the web application of an authenticated customer request.
C. Use an AWS Lambda@Edge function to inspect the authorized token inside the GET/POST request payload. Use the Lambda@Edge function also to insert a customized header to inform the web application of an authenticated customer request.
D. Set up an EC2 instance that has a third-party packet inspection tool to inspect the authorized token inside the GET/POST request payload. Configure the tool to insert a customized header to inform the web application of an authenticated customer request.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Lambda@Edge executes at CloudFront’s edge locations, enabling inspection and modification of requests before they reach the origin (ALB/EC2). This allows for custom token validation and header injection at the earliest point in the request flow, providing excellent operational efficiency, low latency, and reduced load on the origin infrastructure.

❌ Why the other choices are incorrect:

Option A is incorrect: ALB lacks the native capability for complex custom token inspection logic within GET/POST payloads. While it can forward to Lambda, performing this pre-authentication at the ALB is later in the flow than optimal and not its primary design.
Option B is incorrect: AWS WAF is for security rules, not complex, dynamic custom token validation logic (e.g., JWT decoding, database lookups). WAF can block/allow, but passing custom authorization status based on complex logic to the ALB for header injection is not its strong suit.
Option D is incorrect: Introducing a new EC2 instance with a third-party tool significantly increases operational overhead, management complexity, and potential performance bottlenecks. It is neither scalable nor operationally efficient compared to serverless edge computing.

Reference: https://docs.aws.amazon.com/lambda/latest/dg/lambda-edge-how-it-works.html

QUESTION 18

A company is starting to implement a central AWS Network Firewall solution to inspect outbound traffic to the internet. The company has created an egress VPC with a non-overlapping IP CIDR block and firewall subnets for the Network Firewall firewall to be deployed into. The egress VPC allows internet traffic through an internet gateway and NAT gateways. The egress VPC and all spoke VPCs are connected to a transit gateway.

The company has set up routing on VPC route tables and transit gateway route tables to allow resources in the spoke VPCs to reach the internet through the egress VPC. The company has created a stateful domain list rule group with an allow list of domains. This stateful domain list rule group is associated with a policy with no stateless rules, and the default action is to forward to stateful inspection.

An instance in a spoke VPC attempts to curl an endpoint that is not listed in the allow list. The instance passes through the firewall and receives a response from the endpoint.

What should a network engineer do to fix this issue?

A. Create a stateful domain list rule group that has a wildcard entry, and configure the rule group as a deny list. Associate the new stateful domain list rule group with the same policy used on the Network Firewall firewall.
B. Use the Network Firewall API to modify the stateful domain list rule group. Set the HOME NET rule variable, and add entries for all the spoke VPC CIDR blocks.
C. Modify the transit gateway VPC attachment on the egress VPC so that it is in appliance mode.
D. Modify the Network Firewall policy for stateless fragmented default actions to pass. Keep the default actions for full packets to forward to stateful inspection.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Enabling appliance mode on the Transit Gateway VPC attachment for the egress VPC ensures symmetric traffic routing. This forces both forward and return traffic for a given flow through the same Network Firewall endpoint, allowing stateful inspection to correctly apply allow list rules and drop unlisted domains.

❌ Why the other choices are incorrect:

Option A is incorrect: Modifying rule groups wouldn’t resolve asymmetric routing. An allow list should implicitly deny others if traffic consistently passes through the firewall for stateful inspection.
Option B is incorrect: Setting HOME_NET defines internal network ranges for specific rule types but does not address traffic symmetry essential for stateful firewall operation.
Option D is incorrect: Modifying stateless default actions for fragmented packets is irrelevant to a full packet curl request failing stateful inspection for unlisted domains.

Reference: https://docs.aws.amazon.com/vpc/latest/tgw/tgw-attachments.html#vpc-attachments-appliance-mode

QUESTION 19 (Multi-Select)

A company is using custom DNS servers that run BIND for name resolution in its VPCs. The VPCs are deployed across multiple AWS accounts that are part of the same organization in AWS Organizations. All

the VPCs are connected to a transit gateway. The BIND servers are running in a central VPC and are configured to forward all queries for an on-premises DNS domain to DNS servers that are hosted in an on-

premises data center. To ensure that all the VPCs use the custom DNS servers, a network engineer has configured a VPC DHCP options set in all the VPCs that specifies the custom DNS servers to be used as domain name servers.

Multiple development teams in the company want to use Amazon Elastic File System (Amazon EFS). A development team has created a new EFS file system but cannot mount the file system to one of its Amazon EC2 instances. The network engineer discovers that the EC2 instance cannot resolve the IP address for the EFS mount point fs-33444567d.efs.us-east-1.amazonaws.com. The network engineer needs to implement a solution so that development teams throughout the organization can mount EFS file systems.

Which combination of steps will meet these requirements? (Select TWO.)

A. Configure the BIND DNS servers in the central VPC to forward queries for efs.us-east-l.amazonaws.com to the Amazon provided DNS server (169.254.169.253).
B. Create an Amazon Route 53 Resolver outbound endpoint in the central VPC. Update all the VPC DHCP options sets to use AmazonProvidedDNS for name resolution.
C. Create an Amazon Route 53 Resolver inbound endpoint in the central VPC. Update all the VPC DHCP options sets to use the Route 53 Resolver inbound endpoint in the central VPC for name resolution.
D. Create an Amazon Route 53 Resolver rule to forward queries for the on-premises domain to the on-premises DNS servers. Share the rule with the organization by using AWS Resource Access Manager (AWS RAM) Associate the rule with all the VPCs.

Click to View Verified Solution & Explanation

Correct Option: B,D

Explanation: ✅ Option B (Correct)
Reasoning: Updating DHCP options to AmazonProvidedDNS allows EC2 instances to resolve AWS service endpoints like EFS. Creating an outbound endpoint in the central VPC provides the necessary resource for Route 53 Resolver rules to forward queries to on-premises DNS servers.

✅ Option D (Correct)
Reasoning: Replacing custom BIND for on-premises domains with a Route 53 Resolver rule streamlines management. Sharing this rule via AWS RAM and associating it with all VPCs ensures consistent on-premises name resolution across the entire organization, leveraging the outbound endpoint from Option B.

❌ Why the other choices are incorrect:

Option A is incorrect: Manually configuring BIND servers for each AWS service domain like EFS is not scalable or maintainable for an organization. It also doesn’t leverage AWS native DNS resolution.
Option C is incorrect: An Inbound endpoint is designed for on-premises DNS servers to query AWS, not for VPCs to use as their primary DNS resolver. Using it this way would be misconfigured and ineffective.

QUESTION 20

A compute cluster of Amazon EC2 instances will poll the SQS queue to find out about newly uploaded objects. The cluster will retrieve new objects, perform proprietary image and video recognition and classification, update metadata in DynamoDB, and replace the objects with new watermarked objects. The company does not want public IP addresses on the EC2 instances.

Which networking design solution will meet these requirements MOST cost-effectively as application usage increases?

A. Place the EC2 instances in a public subnet. Disable the Auto-assign Public IP option while launching the EC2 instances. Create an internet gateway. Attach the internet gateway to the VPC. In the publicsubnet's route table, add a default route that points to the internet gateway.
B. Place the EC2 instances In a private subnet. Create a NAT gateway in a public subnet in the same Availability Zone. Create an internet gateway. Attach the internet gateway to the VPC. In the publicsubnet's route table, add a default route that points to the internet gateway.
C. Place the EC2 instances in a private subnet. Create an interface VPC endpoint for Amazon SQS. Create gateway VPC endpoints for Amazon S3 and DynamoDB.
D. Place the EC2 instances in a private subnet. Create a gateway VPC endpoint for Amazon SQS. Create interface VPC endpoints for Amazon S3 and DynamoDB.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: Placing EC2 in a private subnet and using VPC endpoints ensures no public IPs are needed. An interface endpoint is correct for SQS. Gateway endpoints for S3 and DynamoDB are free (no hourly or data processing charges for the endpoint itself), making this solution the MOST cost-effective as usage scales.

❌ Why the other choices are incorrect:

Option A is incorrect: Placing EC2 in a public subnet, even with auto-assign public IP disabled, is not the best design for truly private compute and doesn’t leverage private endpoints for secure and potentially cheaper access.
Option B is incorrect: A NAT Gateway provides internet access but incurs hourly charges and data processing costs, which significantly increase with application usage, making it less cost-effective than VPC endpoints.
Option D is incorrect: SQS does not support gateway VPC endpoints; it only supports interface endpoints. Additionally, using interface endpoints for S3 and DynamoDB is less cost-effective than using free gateway endpoints.

Reference: https://aws.amazon.com/vpc/endpoints/

QUESTION 21 (Multi-Select)

A network engineer has deployed an Amazon EC2 instance in a private subnet in a VPC. The VPC has no public subnet. The EC2 instance hosts application code that sends messages to an Amazon Simple Queue Service (Amazon SQS) queue. The subnet has the default network ACL with no modification applied. The EC2 instance has the default security group with no modification applied.

The SOS queue is not receiving messages.

Which of the following are possible causes of this problem? (Select TWO.)

A. The EC2 instance is not attached to an IAM role that allows write operations to Amazon SQS.
B. The security group is blocking traffic to the IP address range used by Amazon SQS.
C. There is no interface VPC endpoint configured for Amazon SQS.
D. The network ACL is blocking return traffic from Amazon SQS.
E. There is no route configured in the subnet route table for the IP address range used by Amazon SQS.

Click to View Verified Solution & Explanation

Correct Option: A,C

Explanation: ✅ Option A (Correct)
Reasoning: An EC2 instance needs an attached IAM role with permissions allowing sqs:SendMessage (or similar write actions) to send messages to an SQS queue. Lack of these permissions will prevent successful message delivery, irrespective of network connectivity.

✅ Option C (Correct)
Reasoning: An EC2 instance in a private subnet, without an Internet Gateway or NAT Gateway, cannot reach public AWS services like SQS directly. An Interface VPC Endpoint for SQS is required to provide a private, in-VPC network path to the service.

❌ Why the other choices are incorrect:

Option B is incorrect: The default security group has an outbound rule allowing all traffic (0.0.0.0/0), so it would not block egress to SQS.
Option D is incorrect: The default network ACL allows all inbound and outbound traffic, hence it would not block return traffic from SQS.
Option E is incorrect: If there’s no Interface VPC Endpoint (Choice C), there’s no private SQS IP range to route to. If an endpoint existed, AWS typically manages its routing within the subnet’s route table.

QUESTION 22 (Multi-Select)

A company has its production VPC (VPC-

A. Configure inter-Region VPC peering between VPC-A and VPC-
B. Add the peering routes in the transit gateway route tables. Add both the VPC-A and the VPC.B CIDR block under the allowed prefix list in the Direct Connect gateway association.
C. Configure another transit VIF on the Direct Connect connection, and associate TGW-
D. Configure inter-Region transit gateway peering between TGW-A and TGW.
E. Configure an AWS Site-to-Site VPN connection over the transit VIF to TGW-B as a VPN attachment.

Click to View Verified Solution & Explanation

Correct Option: B,D

Explanation: ✅ Option D (Correct)
Reasoning: Inter-Region Transit Gateway peering is the foundational step to establish connectivity between TGW-A (Region-A) and TGW-B (Region-B). This enables traffic flow between VPC-A and VPC-B, and allows VPC-B to reach TGW-A for on-premises access.

✅ Option B (Correct)
Reasoning: After TGW peering, routes must be added to TGW route tables to direct traffic between peered TGWs and towards on-premises. Crucially, for VPC-B to access on-premises via the Direct Connect Gateway (DXGW) in Region-A, VPC-B’s CIDR must be explicitly allowed in the DXGW association with TGW-A.

❌ Why the other choices are incorrect:

Option A is incorrect: VPC peering is non-transitive and meant for direct VPC-to-VPC connectivity, not for complex multi-region scenarios involving Transit Gateways or on-premises networks.
Option C is incorrect: A Transit VIF is region-specific. TGW-B, being in Region-B, cannot directly associate with a Transit VIF configured in Region-A.
Option E is incorrect: AWS Site-to-Site VPN is used to connect on-premises to a TGW. Inter-region TGW peering is the correct AWS-native solution for connecting two Transit Gateways across regions.

QUESTION 23

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all

east-west (VPC-to-VPC) traffic.

Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations, and network ACLs as the cause of the dropped traffic.

What is causing the traffic to drop?

A. The stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC.
B. Appliance mode is not enabled on the transit gateway attachment to the shared services VPC.
C. The stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VPC.
D. Appliance mode is not enabled on the transit gateway attachment to the application VPCs.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Appliance mode is not enabled on the transit gateway attachment to the shared services VPC.

Reasoning: When stateful appliances inspect cross-AZ, inter-VPC traffic via a Transit Gateway, Appliance Mode is crucial. It ensures that traffic for a given flow always returns to the same appliance endpoint, preventing asymmetric routing and subsequent packet drops by the stateful firewall. Without it, the TGW’s default hashing can send forward and reverse traffic to different appliances or paths, breaking state.

Reference: https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-mode.html

QUESTION 24

A company has two on-premises data center locations. There is a company-managed router at each data center Each data center has a dedicated AWS Direct Connect connection to a Direct Connect gateway through a private virtual interface. The router for the first location is advertising 110 routes to the Direct Connect gateway by using BGP, and the router for the second location is advertising 60 routes to the Direct Connect gateway by using BGP The Direct Connect gateway is attached to a company VPC through a virtual private gateway.

A network engineer receives reports that resources in the VPC are not reachable from various locations in either data center. The network engineer checks the VPC route table and sees that the routes from the first data center location are not being populated into the route table. The network engineer must resolve this issue in the most operationally efficient manner.

What should the network engineer do to meet these requirements?

A. Remove the Direct Connect gateway. and create a new private virtual interface from each company router to the virtual private gateway of the VPC.
B. Change the router configurations to summarize the advertised routes.
C. Open a support ticket to increase the quota on advertised routes to the VPC route table.
D. Create an AWS Transit Gateway. Attach the transit gateway to the VPC. and connect the Direct Connect gateway to the transit gateway.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Change the router configurations to summarize the advertised routes.

Reasoning: A Direct Connect gateway advertises a maximum of 100 prefixes to an associated virtual private gateway. The first data center is advertising 110 routes, exceeding this limit. Summarizing these routes on the on-premises router to be 100 or fewer will allow them to propagate correctly to the VPC route table, resolving the connectivity issue efficiently.

Reference: https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways.html#direct-connect-gateway-limits

QUESTION 25

A company is deploying a new application in the AWS Cloud. The company wants a highly available web server that will sit behind an Elastic Load Balancer The load balancer will route requests to multiple target groups based on the URL in the request. All traffic must use HTTPS. TLS processing must be offloaded to the load balancer. The web server must know the users IP address so that the company can keep accurate logs for security purposes.

Which solution will meet these requirements?

A. Deploy an Application Load Balancer with an HTTPS listener. Use path-based routing rules to forward the traffic to the correct target group. Include the X-Forwarded-For request header with traffic to the targets
B. Deploy an Application Load Balancer with an HTTPS listener for each domain. Use host-based routing rules to forward the traffic to the correct target group for each domain. Include the X-Forwarded-For request header with traffic to the targets.
C. Deploy a Network Load Balancer with a TLS listener Use path-based routing rules to forward the traffic to the correct target group. Configure client IP address preservation for traffic to the targets.
D. Deploy a Network Load Balancer with a TLS listener for each domain. Use host-based routing rules to forward the traffic to the correct target group for each domain. Configure client IP address preservation for traffic to the targets.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Option A (Correct)
Reasoning: Application Load Balancers (ALB) support HTTPS listeners for TLS offloading and path-based routing rules for directing traffic "based on the URL in the request". The X-Forwarded-For header reliably passes the client’s IP address to target web servers. This option directly addresses all requirements.

❌ Why the other choices are incorrect:

Option B is incorrect: Host-based routing differentiates traffic by domain name, not typically by the path component of a URL ("based on the URL in the request"). While ALB is correct for other aspects, path-based routing is more precise for the routing requirement.
Option C is incorrect: Network Load Balancers (NLB) operate at Layer 4 (TCP/TLS) and do not support Layer 7 features like path-based routing rules. Thus, it cannot route traffic "based on the URL."
Option D is incorrect: Network Load Balancers (NLB) operate at Layer 4 and do not support Layer 7 features like host-based routing rules. This makes it unable to route traffic based on the domain name within the URL.

QUESTION 26

A company is deploying an application. The application is implemented in a series of containers in an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use the Fargate launch type for its tasks. The containers will run workloads that require connectivity initiated over an SSL connection. Traffic must be able to flow to the application from other AWS accounts over private connectivity. The application must scale in a manageable way as more consumers use the application.

Which solution will meet these requirements?

A. Choose a Gateway Load Balancer (GLB) as the type of load balancer for the ECS service. Create a lifecycle hook to add new tasks to the target group from Amazon ECS as required to handle scaling. Specify the GLB in the service definition. Create a VPC peer for external AWS accounts. Update the route tables so that the AWS accounts can reach the GLB.
B. Choose an Application Load Balancer (ALB) as the type of load balancer for the ECS service. Create path-based routing rules to allow the application to target the containers that are registered in the target group. Specify the ALB in the service definition. Create a VPC endpoint service for the ALB. Share the VPC endpoint service with other AWS accounts.
C. Choose an Application Load Balancer (ALB) as the type of load balancer for the ECS service. Create path-based routing rules to allow the application to target the containers that are registered in the target group. Specify the ALB in the service definition. Create a VPC peer for the external AWS accounts. Update the route tables so that the AWS accounts can reach the ALB.
D. Choose a Network Load Balancer (NLB) as the type of load balancer for the ECS service. Specify the NLB in the service definition. Create a VPC endpoint service for the NLB. Share the VPC endpoint service with other AWS accounts.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Option D (Correct)
Reasoning: An NLB supports ECS Fargate and can handle SSL traffic (pass-through TCP or TLS termination). Crucially, NLB is the only load balancer type compatible with a VPC Endpoint Service (AWS PrivateLink), which provides secure, private connectivity from other AWS accounts without VPC peering or internet traversal, meeting the "manageable way" requirement.

❌ Why the other choices are incorrect:

Option A is incorrect: Gateway Load Balancers are designed for third-party virtual appliances, not direct application exposure. VPC peering scales poorly for many accounts. The lifecycle hook mechanism is inaccurate for ECS service scaling with load balancers.
Option B is incorrect: An Application Load Balancer (ALB) cannot be directly registered as the backend for a VPC Endpoint Service. Only Network Load Balancers are supported for this purpose.
Option C is incorrect: While an ALB can handle the application, VPC peering can become complex and less manageable for numerous external AWS accounts compared to a VPC Endpoint Service (PrivateLink).

QUESTION 27

A company has a single VPC in the us-east-1 Region. The company is planning to set up a new VPC in the us-east-2 Region. The existing VPC has an AWS Site-to-Site VPN connection to the company’s on-premises environment and uses a virtual private gateway.

A network engineer needs to implement a solution to establish connectivity between the existing VPC and the new VPC. The solution also must implement support for IPv6 for the new VPC. The company has new on-premises resources that need to connect to VPC resources by using IPv6 addresses.

Which solution will meet these requirements?

A. Create a new virtual private gateway in us-east-1. Attach the new virtual private gateway to the new VPC. Create two new Site-to-Site VPN connections to the new virtual private gateway with IPv4 and IPv6 support. Configure routing between the VPCs by using VPC peering.
B. Create a transit gateway in us-east-1 and in us-east-2. Attach the existing VPC and the new VPC to each transit gateway. Create a new Site-to-Site VPN connection to each transit gateway with IPv4 and IPv6 support. Configure transit gateway peering. Configure routing between the VPCs and the on-premises environment.
C. Create a new virtual private gateway in us-east-2. Attach the new virtual private gateway to the new VPC create two new Site-to-Site VPN connections to the new virtual private gateway with IPv4 and IPv6 support. Configure routing between the VPCs by using VPC peering.
D. Create a transit gateway in us-east-1. Attach the existing VPC and the new VPC to the transit gateway. Create two new Site-to-Site VPN connections to the transit gateway with IPv4 and IPv6 support. Configure transit gateway peering. Configure routing between the VPCs and the on-premises environment.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Option B (Correct)
Reasoning: Creating transit gateways in each region (us-east-1 and us-east-2), attaching respective VPCs, and configuring transit gateway peering enables cross-region VPC connectivity. Transit Gateway Site-to-Site VPN connections support both IPv4 and IPv6, fulfilling the requirement for new on-premises IPv6 connectivity.

❌ Why the other choices are incorrect:

Option A is incorrect: Virtual Private Gateways (VPGs) only support IPv4 for Site-to-Site VPNs, failing the IPv6 requirement. A VPG in us-east-1 cannot attach to a VPC in us-east-2.
Option C is incorrect: Virtual Private Gateways (VPGs) only support IPv4 for Site-to-Site VPNs, failing the IPv6 requirement for on-premises connectivity.
Option D is incorrect: A single Transit Gateway cannot span regions. You cannot attach a VPC from us-east-2 to a Transit Gateway created in us-east-1.

QUESTION 28 (Multi-Select)

A company delivers applications over the internet. An Amazon Route 53 public hosted zone is the authoritative DNS service for the company and its internet applications, all of which are offered from the same domain name.

A network engineer is working on a new version of one of the applications. All the application’s components are hosted in the AWS Cloud. The application has a three-tier design. The front end is delivered through Amazon EC2 instances that are deployed in public subnets with Elastic IP addresses assigned. The backend components are deployed in private subnets from RFC1918.

Components of the application need to be able to access other components of the application within the application’s VPC by using the same host names as the host names that are used over the public internet. The network engineer also needs to accommodate future DNS changes. such as the introduction of new host names or the retirement of DNS entries.

Which combination of steps will meet these requirements? (Select THREE.)

A. Add a geo-proximity routing policy in Route 53.
B. Create a Route 53 private hosted zone for the same domain name. Associate the application's VPC with the new private hosted zone.
C. Enable DNS hostnames for the application's VPC.
D. Create entries in the private hosted zone for each name in the public hosted zone by using the corresponding private IP addresses.

Click to View Verified Solution & Explanation

Correct Option: B,C,D

Explanation: ✅ Option B (Correct)
Reasoning: Creating a private hosted zone for the same domain name and associating it with the VPC enables split-horizon DNS. Queries originating from the associated VPC for that domain will first consult the private hosted zone, allowing different records (e.g., private IP addresses) than the public zone.

✅ Option C (Correct)
Reasoning: For a VPC to perform DNS resolution using Route 53 private hosted zones, both enableDnsSupport and enableDnsHostnames must be enabled. Enabling DNS hostnames ensures the VPC’s internal DNS resolver is active and functional, allowing components to resolve hostnames within the VPC.

✅ Option D (Correct)
Reasoning: To allow internal components to resolve public hostnames to private IP addresses, corresponding A records must be created in the private hosted zone, pointing to the private IP addresses of the internal application components. This directly fulfills the split-horizon DNS requirement.

❌ Why the other choices are incorrect:

Option A is incorrect: Adding a geo-proximity routing policy is for directing external traffic based on geographic location. It does not address the requirement for internal VPC DNS resolution using private IP addresses.

QUESTION 29 (Multi-Select)

A development team is building a new web application in the AWS Cloud. The main company domain. example.com, is currently hosted in an Amazon Route 53 public hosted zone in one of the company’s production AWS accounts.

The developers want to test the web application in the company’s staging AWS account by using publicly resolvable subdomains under the example.com domain with the ability to create and delete DNS records as needed. Developers have full access to Route 53 hosted zones within the staging account, but they are prohibited from accessing resources in any of the production AWS accounts.

Which combination of steps should a network engineer take to allow the developers to create records under the example.com domain? (Select TWO.)

A. Create a public hosted zone for example.com in the staging account.
B. Create a staging-example.com NS record in the example.com domain. Populate the value with the name servers from the staging.example.com domain. Set the routing policy type to simple routing.
C. Create a private hosted zone for staging.example.com in the staging account.
D. Create an example.com NS record in the staging.example.com domain. Populate the value with the name servers from the example.com domain. Set the routing policy type to simple routing.
E. Create a public hosted zone for stagingeample.com in the staging account.

Click to View Verified Solution & Explanation

Correct Option: B,E

Explanation: ✅ Option E (Correct)
Reasoning: To allow developers to manage subdomains publicly in their staging account, a new public hosted zone for staging.example.com must be created there. This zone will manage all records for staging.example.com and provide the unique name servers necessary for delegation.

✅ Option B (Correct)
Reasoning: After creating the staging.example.com hosted zone, an NS (Name Server) record for staging.example.com must be created in the parent example.com hosted zone (production account). This record’s value should be populated with the name servers obtained from the newly created staging.example.com hosted zone, delegating authority.

❌ Why the other choices are incorrect:

Option A is incorrect: Creating a public hosted zone for example.com in the staging account would create a conflicting root domain. This is not the correct mechanism for delegating a subdomain; it would require re-pointing the domain registrar, which is not the objective.
Option C is incorrect: The requirement is for publicly resolvable subdomains. A private hosted zone is only resolvable within associated VPCs, not publicly, thus it does not meet the requirement.
Option D is incorrect: This option describes creating an NS record for the parent domain (example.com) within the subdomain’s hosted zone (staging.example.com). This is an inverse and incorrect configuration for DNS delegation.

Reference: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingNewSubdomain.html

QUESTION 30

A company is deploying third-party firewall appliances for traffic inspection and NAT capabilities in its VPC. The VPC is configured with private subnets and public subnets. The company needs to deploy the firewall appliances behind a load balancer.

Which architecture will meet these requirements MOST cost-effectively?

A. Deploy a Gateway Load Balancer with the firewall appliances as targets. Configure the firewall appliances with a single network interface in a private subnet. Use a NAT gateway to send the traffic to theinternet after inspection.
B. Deploy a Gateway Load Balancer with the firewall appliances as targets. Configure the firewall appliances with Wo network interfaces: one network interface in a private subnet and another network interface in a public subnet. Use the NAT functionality on the firewall appliances to send the traffic to the internet after inspection.
C. Deploy a Network Load Balancer with the firewall appliances as targets. Configure the firewall appliances with a single network interface in a private subnet. Use a NAT gateway to send the traffic to the internet after inspection.
D. Deploy a Network Load Balancer with the firewall appliances as targets. Configure the firewall appliances with network interfaces: one network interface in a private subnet and another network interface in a public subnet. Use the NAT functionality on the firewall appliances to send the traffic to the internet after inspection.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Option B (Correct)
Reasoning: Gateway Load Balancer is purpose-built for transparent insertion of virtual appliances for inspection. Configuring firewalls with two ENIs (private for GWLB traffic, public for internet egress) allows them to perform NAT directly, leveraging their inherent capabilities and avoiding the higher cost of a separate AWS NAT Gateway.

❌ Why the other choices are incorrect:

Option A is incorrect: Using a NAT Gateway introduces additional cost. The firewall appliances are capable of performing NAT directly if properly configured.
Option C is incorrect: A Network Load Balancer is not designed for transparent inline inspection of security appliances like a Gateway Load Balancer, which uses GENEVE encapsulation. Also, a NAT Gateway adds unnecessary cost.
Option D is incorrect: While using the firewall’s NAT is cost-effective, a Network Load Balancer is not the optimal or most straightforward solution for transparent appliance insertion compared to a Gateway Load Balancer.

QUESTION 31

A company is planning to use Amazon S3 to archive financial data, The data is currently stored in an on-premises data center. The company uses AWS Direct Connect with a Direct Connect gateway and a transit gateway to connect to the on-premises data center. The data cannot be transported over the public internet and must be encrypted in transit.

Which solution will meet these requirements?

A. Create a Direct Connect public VIF. Set up an IPsec VPN connection over the public VIF to access Amazon S3. Use HTTPS for communication.
B. Create an IPsec VPN connection over the transit VIF. Create a VPC and attach the VPC to the transit gateway. In the VPC. provision an interface VPC endpoint for Amazon S3. Use HTTPS for communication.
C. Create a VPC and attach the VPC to the transit gateway in the VPC, provision an interface VPC endpoint for Amazon S3. Use HTTPS for communication.
D. Create a Direct Connect public VIF. Set up an IPsec VPN connection over the public VIF to the transit gateway. Create an attachment for Amazon S3. Use HTTPS for communication.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Option B (Correct)
Reasoning: An S3 interface VPC endpoint ensures S3 data transfer uses private IPs within AWS, meeting the "no public internet" requirement. An IPsec VPN over the transit VIF provides end-to-end network layer encryption from on-premises to AWS, satisfying "encrypted in transit." HTTPS further encrypts S3 communication.

❌ Why the other choices are incorrect:

Option A is incorrect: You cannot establish an IPsec VPN directly to Amazon S3. A public VIF connects to AWS public endpoints, but IPsec VPN over it for S3 access is not a standard or correct pattern for S3.
Option C is incorrect: While it uses an S3 interface endpoint for private access, it lacks the IPsec VPN over the Direct Connect path. Direct Connect private VIFs do not inherently encrypt traffic at the network layer, failing the "must be encrypted in transit" requirement for the full path from on-premises.
Option D is incorrect: Using a Direct Connect public VIF for Transit Gateway connectivity is incorrect; private or transit VIFs are used. Also, you don’t "create an attachment for Amazon S3" on a Transit Gateway.

QUESTION 32 (Multi-Select)

A software-as-a-service (SaaS) provider hosts its solution on Amazon EC2 instances within a VPC in the AWS Cloud. All of the providers customers also have their environments in the AWS Cloud.

A recent design meeting revealed that the customers have IP address overlap with the provider’s AWS deployment. The customers have stated that they will not share their internal IP addresses and that they do not want to connect to the providers SaaS service over the internet.

Which combination of steps is part of a solution that meets these requirements’ (Select TWO.)

A. Deploy the SaaS service endpoint behind a Network Load Balancer.
B. Configure an endpoint service, and grant the customers permission to create a connection to the service.
C. Deploy the SaaS service endpoint behind an Application Load Balancer.
D. Configure a VPC peering connection to the customer VPCs. Route traffic through NAT gateways.
E. Deploy an AWS Transit Gateway, and connect the SaaS VPC to it. Share the transit gateway with the customers. Configure routing on the transit gateway.

Click to View Verified Solution & Explanation

Correct Option: A,B

Explanation: ✅ Option A: Deploy the SaaS service endpoint behind a Network Load Balancer.
Reasoning: An NLB is a prerequisite for creating an AWS PrivateLink endpoint service. It provides the static IP addresses in the consumer’s VPC, enabling private, non-overlapping connectivity to the SaaS service, avoiding the internet.

✅ Option B: Configure an endpoint service, and grant the customers permission to create a connection to the service.
Reasoning: An AWS PrivateLink endpoint service allows private connectivity between VPCs, even with overlapping IP address ranges. It eliminates the need for internet access and resolves the IP overlap issue by presenting the service with unique internal IPs in the consumer’s VPC.

❌ Why the other choices are incorrect:

Option C is incorrect: An Application Load Balancer (ALB) does not directly support PrivateLink for cross-VPC private access with IP overlap; NLBs are required for this purpose.
Option D is incorrect: VPC peering explicitly does not support overlapping IP address ranges, making it unsuitable for this scenario. Routing through NAT gateways doesn’t resolve this fundamental limitation.
Option E is incorrect: While AWS Transit Gateway provides centralized connectivity, it does not resolve overlapping IP address ranges between connected VPCs for direct communication. PrivateLink is needed for that specific requirement.

Reference: https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html

QUESTION 33

A security team is performing an audit of a company’s AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.

The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.

Which solution will meet these requirements with the LEAST operational overhead?

A. Create VPC flow logs in the default format. Create a filter to gather flow logs only from the EKS nodes. Include the srcaddr field and the dstaddr field in the flow logs.
B. Create VPC flow logs in a custom format. Set the EKS nodes as the resource. Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.
C. Create VPC flow logs in a custom format. Set the application subnets as resources. Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.
D. Create VPC flow logs in a custom format. Create a filter to gather flow logs only from the EKS nodes. Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Option B (Correct)
Reasoning: Creating VPC flow logs with a custom format including pkt-srcaddr and pkt-dstaddr is essential to capture the actual Pod IP addresses (packet-level source/destination). Setting the EKS nodes as the resource efficiently limits logs to the application’s compute, minimizing log volume and operational overhead.

❌ Why the other choices are incorrect:

Option A is incorrect: The default format does not include pkt-srcaddr or pkt-dstaddr. srcaddr and dstaddr capture the node’s ENI IP, not the Pod IP.
Option C is incorrect: Setting the application subnets as resources would capture all traffic within those subnets, not just from the applications, leading to excessive log volume.
Option D is incorrect: While using pkt-srcaddr/pkt-dstaddr is correct, "Create a filter to gather flow logs" typically refers to post-collection filtering or an incomplete method to limit generation. Setting the EKS nodes as the resource is the direct and most efficient way to limit log generation at the source.

QUESTION 34

A company deploys a new web application on Amazon EC2 instances. The application runs in private subnets in three Availability Zones behind an Application Load Balancer (ALB). Security auditors require encryption of all connections. The company uses Amazon Route 53 for DNS and uses AWS Certificate Manager (ACM) to automate SSL/TLS certificate provisioning. SSL/TLS connections are terminated on the ALB.

The company tests the application with a single EC2 instance and does not observe any problems. However, after production deployment, users report that they can log in but that they cannot use the application. Every new web request restarts the login process.

What should a network engineer do to resolve this issue?

A. Modify the ALB listener configuration. Edit the rule that forwards traffic to the target group. Change the rule to enable group-level stickiness. Set the duration to the maximum application session length.
B. Replace the ALB with a Network Load Balancer. Create a TLS listener. Create a new target group with the protocol type set to TLS. Register the EC2 instances. Modify the target group configuration byenabling the stickiness attribute.
C. Modify the ALB target group configuration by enabling the stickiness attribute. Use an application-based cookie. Set the duration to the maximum application session length.
D. Modify the ALB. Create an Amazon Route 53 rule with a failover routing policy for the application name, Configure ACM to issue certificates for each EC2 instance.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ [Correct Selection]: Modify the ALB target group configuration by enabling the stickiness attribute. Use an application-based cookie. Set the duration to the maximum application session length.

Reasoning: The described issue (login restarts with every request) indicates lost session state. Enabling stickiness on the ALB target group ensures requests from the same client are routed to the same EC2 instance, maintaining the session. Using an application-based cookie and matching its duration to the application’s session length is the correct implementation.

Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/sticky-sessions.html

QUESTION 35 (Multi-Select)

A company has deployed its AWS environment in a single AWS Region. The environment consists of a few hundred application VPCs, a shared serves VPC, and a VPN connection to the company’s on-premises environment. A network engineer needs to implement a transit gateway with the following requirements:

• Application VPCs must be isolated from each other.

• Bidirectional communication rust be allowed between the application VPCs and the on-premises network.

• Bidirectional communication rust be allowed between the application VPCs and the shared services VPC.

The network engineer creates the transit gateway with options disabled for default route table association and default route table propagation. The network engineer also creates the VPN attachment for the on-premises network and creates the VPC attachments for the application VPCs and the shared services VPC.

The network engineer must meet all the requirements for the transit gateway by designing a solution that needs the least number of transit gateway route tables.

Which combination of actions should the network engineer perform to accomplish this goal? (Select TVVO.)

A. Configure a separate transit gateway route table for on premises. Associate the VPN attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.
B. Configure a separate transit gateway route table for each application VPC. Associate each application VPC attachment with its respective transit gateway route table. Propagate the shared services VPC attachment and the VPN attachment to this transit gateway route table.
C. Configure a separate transit gateway route table for all application VPCs. Associate all application VPCs with this transit gateway route table. Propagate the shared services VPC attachment and the VPN attachment to this transit gateway route table.
D. Configure a separate transit gateway route table for the shared services VPC. Associate the shared services VPC attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.
E. Configure a separate transit gateway route table for on premises and the shared services VPC. Associate the VPN attachment and the shared services VPC attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.

Click to View Verified Solution & Explanation

Correct Option: C,E

Explanation: ✅ Option C (Correct)
Reasoning: This action defines a route table where all Application VPCs are associated. By propagating only the Shared Services and VPN attachments to this table, Application VPCs can send traffic to these central services. Critically, Application VPC routes are not propagated here, ensuring isolation for outbound traffic between Application VPCs.

✅ Option E (Correct)
Reasoning: This action defines a second route table where the VPN and Shared Services attachments are associated. By propagating all Application VPC attachments to this table, On-premises and Shared Services can send traffic to the Application VPCs, completing the bidirectional communication requirements while maintaining isolation.

❌ Why the other choices are incorrect:

Option A is incorrect: This only covers on-premises traffic to App VPCs. It doesn’t address App VPC outbound communication, shared services communication, or the full isolation requirement.
Option B is incorrect: This would create hundreds of route tables (one per application VPC), failing the "least number of transit gateway route tables" requirement.
Option D is incorrect: Similar to A, this only covers shared services traffic to App VPCs. It doesn’t address App VPC outbound communication, on-premises communication, or complete isolation.

Reference: https://docs.aws.amazon.com/vpc/latest/tgw/tgw-rt-tables.html

QUESTION 36

A company has multiple AWS accounts. Each account contains one or more VPCs. A new security guideline requires the inspection of all traffic between VPCs.

The company has deployed a transit gateway that provides connectivity between all VPCs. The company also has deployed a shared services VPC with Amazon EC2 instances that include IDS services for stateful inspection. The EC2 instances are deployed across three Availability Zones. The company has set up VPC associations and routing on the transit gateway. The company has migrated a few test VPCs to the new solution for traffic inspection.

Soon after the configuration of routing, the company receives reports of intermittent connections for traffic that crosses Availability Zones.

What should a network engineer do to resolve this issue?

A. Modify the transit gateway VPC attachment on the shared services VPC by enabling cross-Availability Zone load balancing.
B. Modify the transit gateway VPC attachment on the shared services VPC by enabling appliance mode support.
C. Modify the transit gateway by selecting VPN equal-cost multi-path (ECMP) routing support.
D. Modify the transit gateway by selecting multicast support.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Option B (Correct)
Reasoning: Enabling appliance mode support on the Transit Gateway VPC attachment for the shared services VPC ensures that traffic flows consistently through the same Availability Zone. This prevents asymmetric routing for stateful appliances (like IDS) deployed across multiple AZs, resolving intermittent connection issues caused by session state loss.

❌ Why the other choices are incorrect:

Option A is incorrect: Transit Gateway VPC attachments do not have an explicit "cross-Availability Zone load balancing" feature that would resolve this. TGW’s default behavior can distribute traffic, which causes the problem for stateful devices.
Option C is incorrect: VPN ECMP routing is used to distribute traffic over multiple VPN tunnels to the same destination, which is unrelated to routing traffic through a stateful appliance in a VPC attachment.
Option D is incorrect: Multicast support on a Transit Gateway is for routing multicast traffic, which is irrelevant to resolving unicast, stateful inspection issues.

Reference: https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-mode.html

QUESTION 37

A company uses AWS Direct Connect to connect its corporate network to multiple VPCs in the same AWS account and the same AWS Region. Each VPC uses its own private VIF and its own virtual LAN on the Direct Connect connection. The company has grown and will soon surpass the limit of VPCs and private VlFs for each connection.

What is the MOST scalable way to add VPCs with on-premises connectivity?

A. Provision a new Direct Connect connection to handle the additional VPCs. use the new connection to connect additional VPCs.
B. Create virtual private gateways for each VPC that is over the service quota. Use AWS Site-to-Site VPN to connect the virtual private gateways to the corporate network.
C. Create a Direct Connect gateway, and add virtual private gateway associations to the VPCs. Configure a private VIF to connect to the network.
D. Create a transit gateway, and attach the VPCs. Create a Direct Connect gateway, and associate it with the transit gateway. Create a transit VIF to the Direct Connect gateway.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Option D (Correct)
Reasoning: Attaching VPCs to a Transit Gateway centralizes connectivity. Associating the Transit Gateway with a Direct Connect gateway via a transit VIF allows a single VIF to connect numerous VPCs to on-premises, overcoming individual private VIF limits per VPC. This is the most scalable approach.

❌ Why the other choices are incorrect:

Option A is incorrect: Provisioning a new Direct Connect connection only defers the VIF limit issue and introduces more management overhead, not a scalable architectural solution for numerous VPCs.
Option B is incorrect: This replaces Direct Connect with VPN over the internet, fundamentally changing the connectivity method and potentially impacting performance and cost, not scaling the existing DX setup.
Option C is incorrect: While a Direct Connect gateway can aggregate VPGs, using a private VIF still implies routing to individual VPGs for each VPC, which is not as scalable as a Transit Gateway/transit VIF combination for many VPCs.

QUESTION 38 (Multi-Select)

A company is creating new features for its ecommerce website. These features will use several microservices that are accessed through different paths. The microservices will run on Amazon Elastic Container Service (Amazon ECS). The company requires the use of HTTPS for all of its public websites. The application requires the customers source IP addresses.

A network engineer must implement a load balancing strategy that meets these requirements.

Which combination of actions should the network engineer take to accomplish this goal? (Select TWO.)

A. Use a Network Load Balancer.
B. Retrieve client IP addresses by using the X-Forwarded-For header.
C. Use AWS App Mesh load balancing.
D. Retrieve client IP addresses by using the X-IP-Source header.
E. Use an Application Load Balancer.

Click to View Verified Solution & Explanation

Correct Option: B,E

Explanation: ✅ Option E (Correct)
Reasoning: An Application Load Balancer (ALB) supports HTTPS termination, path-based routing essential for microservices accessed through different paths, and integrates seamlessly with Amazon ECS. It operates at Layer 7, ideal for content-based routing.

✅ Option B (Correct)
Reasoning: Application Load Balancers (ALB) preserve the client’s original IP address by inserting it into the X-Forwarded-For HTTP header. Backend microservices can then retrieve this header to access the customer’s source IP.

❌ Why the other choices are incorrect:

Option A is incorrect: A Network Load Balancer (NLB) operates at Layer 4. It does not support path-based routing for microservices or direct HTTPS termination at the application layer, which are key requirements.
Option C is incorrect: AWS App Mesh provides a service mesh for inter-service communication and traffic management within the application. It is not designed as the primary public-facing load balancer for external client access.
Option D is incorrect: X-IP-Source is not the standard HTTP header used by AWS ALBs to forward client IP addresses. X-Forwarded-For is the correct and widely adopted header for this purpose.

QUESTION 39

A company has deployed an AWS Network Firewall firewall into a VPC. A network engineer needs to implement a solution to deliver Network Firewall flow logs to the company’s Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster in the shortest possible time.

Which solution will meet these requirements?

A. Create an Amazon S3 bucket. Create an AWS Lambda function to load logs into the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster Enable Amazon Simple Notification Service (Amazon SNS) notifications on the S3 bucket to invoke the Lambda function. Configure flow logs for the firewall. Set the S3 bucket as the destination.
B. Create an Amazon Kinesis Data Firehose delivery stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination. Configure flow logs for the firewall. Set the Kinesis Data Firehose delivery stream as the destination for the Network Firewall flow logs.
C. Configure flow logs for the firewall. Set the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination for the Network Firewall flow logs.
D. Create an Amazon Kinesis data stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination. Configure flow logs for the firewall. Set the Kinesis data stream as the destination for the Network Firewall flow logs.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Option B (Correct)
Reasoning: Kinesis Data Firehose directly integrates with Network Firewall and OpenSearch. It’s a fully managed service for near real-time delivery, handling buffering and transformations automatically. This minimizes setup complexity and operational overhead, ensuring the shortest time for both implementation and log delivery.

❌ Why the other choices are incorrect:

Option A is incorrect: S3 and Lambda introduce additional architectural components and custom development. This increases setup time, operational complexity, and potential latency compared to a direct streaming solution like Firehose.
Option C is incorrect: AWS Network Firewall does not directly support Amazon OpenSearch Service as a log destination. This option is not technically feasible within the AWS ecosystem.
Option D is incorrect: Kinesis Data Streams requires a separate consumer application (e.g., Lambda) to process data and deliver it to OpenSearch. This adds development and management overhead, making it less efficient than Kinesis Data Firehose for this specific use case.

Reference: https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html

QUESTION 40

A company has been using an outdated application layer protocol for communication among applications. The company decides not to use this protocol anymore and must migrate all applications to support a new protocol. The old protocol and the new protocol are TCP-based. but the protocols use different port numbers.

After several months of work, the company has migrated dozens of applications that run on Amazon EC2 instances and in containers. The company believes that all the applications have been migrated. But the company wants to verify this belief. A network engineer needs to verify that no application is still using the old protocol.

Which solution will meet these requirements without causing any downtime?

A. Use Amazon Inspector and its Network Reachability rules package. Wait until the analysis has finished running to find out which EC2 instances are still listening to the old port.
B. Enable Amazon GuardDuty. Use the graphical visualizations to filter for traffic that uses the port of the old protocol. Exclude all internet traffic to filter out occasions when the same port is used as an ephemeral port.
C. Configure VPC flow logs to be delivered into an Amazon S3 bucket. Use Amazon Athena to query the data and to filter for the port number that is used by the old protocol.
D. Inspect all security groups that are assigned to the EC2 instances that host the applications. Remove the port of the old protocol if that port is in the list of allowed. Verify that the applications are operating properly after the port is removed from the security groups.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: VPC Flow Logs capture all IP traffic details, including source/destination ports, within a VPC without causing downtime. Delivering them to S3 and querying with Athena allows for comprehensive, non-intrusive analysis to identify any active communication still using the old protocol’s port number.

❌ Why the other choices are incorrect:

Option A is incorrect: Amazon Inspector’s Network Reachability focuses on exposure and potential vulnerabilities, not active internal protocol usage for auditing purposes. It doesn’t confirm if applications are actively communicating on the old port, only if it’s reachable.
Option B is incorrect: Amazon GuardDuty is a threat detection service. While it consumes flow logs, it’s not designed for general network traffic auditing or identifying non-malicious application protocol usage patterns effectively.
Option D is incorrect: Modifying security groups and then verifying functionality will directly cause downtime if applications are still using the old protocol, which violates the key requirement of the question.

QUESTION 41

A global delivery company is modernizing its fleet management system. The company has several business units. Each business unit designs and maintains applications that are hosted in its own AWS account in separate application VPCs in the same AWS Region. Each business unit’s applications are designed to get data from a central shared services VPC.

The company wants the network connectivity architecture to provide granular security controls. The architecture also must be able to scale as more business units consume data from the central shared services VPC in the future.

Which solution will meet these requirements in the MOST secure manner?

A. Create a central transit gateway. Create a VPC attachment to each application VPC. Provide full mesh connectivity between all the VPCs by using the transit gateway.
B. Create VPC peering connections between the central shared services VPC and each application VPC in each business unit's AWS account.
C. Create VPC endpoint services powered by AWS PrivateLink in the central shared services VPC. Create VPC endpoints in each application VPC.
D. Create a central transit VPC with a VPN appliance from AWS Marketplace. Create a VPN attachment from each VPC to the transit VPC. Provide full mesh connectivity among all the VPCs.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Correct Selection: Create VPC endpoint services powered by AWS PrivateLink in the central shared services VPC. Create VPC endpoints in each application VPC.

Reasoning: AWS PrivateLink provides highly granular security by allowing consumers to access specific services in a producer VPC without routing entire VPC networks. It is highly scalable, enabling many business units to consume services securely and privately, satisfying the "MOST secure" and "granular security controls" requirements for service consumption.

Reference: https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html

QUESTION 42

A company has hundreds of VPCs on AWS. All the VPCs access the public endpoints of Amazon S3 and AWS Systems Manager through NAT gateways. All the traffic from the VPCs to Amazon S3 and Systems Manager travels through the NAT gateways. The company’s network engineer must centralize access to these services and must eliminate the need to use public endpoints.

Which solution will meet these requirements with the LEAST operational overhead?

A. Create a central egress VPC that has private NAT gateways. Connect all the VPCs to the central egress VPC by using AWS Transit Gateway use the private NAT gateways to connect to Amazon S3 and Systems Manager by using private IP addresses.
B. Create a central shared services VPC. In the central shared services VPC, create interface VPC endpoints for Amazon S3 and Systems Manager to access. Ensure that private DNS is turned off. Connect all the VPCs to the central shared services VPC by using AWS Transit Gateway. Create an Amazon Route 53 forwarding rule for each interface VPC endpoint. Associate the forwarding rules with all the VPCs. Forward DNS queries to the interface VPC endpoints in the shared services VPC.
C. Create a central shared services VPC. In the central shared services VPC, create interface VPC endpoints for Amazon S3 and Systems Manager to access. Ensure that private DNS is turned off. Connect all the VPCs to the central shared services VPC by using AWS Transit Gateway. Create an Amazon Route 53 private hosted zone with a full service endpoint name for Amazon S3 and Systems Manager. Associate the private hosted zones with all the VPCs. Create an alias record in each private hosted zone with the full AWS service endpoint pointing to the interface VPC endpoint in the shared services VPC.
D. Create a central shared services VPC. In the central shared services VPC, create interface VPC endpoints for Amazon S3 and Systems Manager to access. Connect all the VPCs to the central shared services VPC by using AWS Transit Gateway. Ensure that private DNS is turned on for the interface VPC endpoints and that the transit gateway is created with DNS support turned on.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: This solution centralizes private access. Creating interface VPC endpoints in a shared VPC with private DNS off means public DNS names won’t auto-resolve to private IPs. Overriding public service DNS names (e.g., s3.<region>.amazonaws.com) with Route 53 private hosted zones, associated with all VPCs and pointing to the endpoint’s DNS names, provides a scalable and low-overhead way to direct traffic privately from hundreds of VPCs.

❌ Why the other choices are incorrect:

Option A is incorrect: Using private NAT gateways for S3/Systems Manager is inefficient and adds cost/complexity. Interface VPC Endpoints provide direct private IP access, negating the need for NAT gateways for these services.
Option B is incorrect: Creating individual Route 53 forwarding rules for each interface VPC endpoint and associating them with all VPCs is high operational overhead and not the standard method to override service DNS names across many VPCs.
Option D is incorrect: While private DNS on for endpoints simplifies resolution within their VPC, it doesn’t automatically extend to hundreds of other VPCs via Transit Gateway without additional Route 53 Resolver configurations or complex sharing, increasing overhead compared to Option C’s direct DNS override.

QUESTION 43

A network engineer needs to set up an Amazon EC2 Auto Scaling group to run a Linux-based network appliance in a highly available architecture. The network engineer is configuring the new launch template for the Auto Scaling group.

In addition to the primary network interface, the network appliance requires a second network interface that will be used exclusively by the application to exchange traffic with hosts over the internet. The company has set up a Bring Your Own IP (BYOIP) POI that includes an Elastic IP address that should be used as the public IP address for the second network interface.

How can the network engineer implement the required architecture?

A. Configure the two network interfaces in the launch template. Define the primary network interface to be created in one of the private subnets. For the second network interface. select one of the public subnets. Choose the BYOIP pool ID as the source of public IP addresses.
B. Configure the primary network interface in a private subnet in the launch template. Use the user data option to run a cloud-init script after boot to attach the second network interface from a subnet with auto-assign public IP addressing enabled.
C. Create an AWS Lambda function to run as a lifecycle hook of the Auto Scaling group when an instance is launching. In the Lambda function, assign a network interlace to an AWS Global Accelerator endpoint.
D. During creation of the Auto Scaling group, select subnets for the primary network interface. Use the user data option to run a cloud-init script to allocate a second network interface and to associate an Elastic IP address from the BYOIP pool.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Option D (Correct)
Reasoning: User data, executed via cloud-init, provides the necessary flexibility to script the creation of a second network interface, allocate a new Elastic IP address from the BYOIP pool, and then associate that EIP with the newly created secondary ENI on each instance launch. This meets all specified requirements.

❌ Why the other choices are incorrect:

Option A is incorrect: Launch templates do not natively support assigning a specific BYOIP Elastic IP from a pool to a secondary network interface for auto-assignment at launch. They primarily handle AWS-provided public IPs or existing EIPs for primary ENIs.
Option B is incorrect: While user data can attach a secondary ENI, simply enabling "auto-assign public IP" on a subnet assigns an AWS-managed public IP, not an Elastic IP from a BYOIP pool as required by the problem.
Option C is incorrect: This option introduces AWS Global Accelerator, which is not requested and does not address the core requirement of creating a secondary ENI and associating a BYOIP Elastic IP address.

QUESTION 44

A company has deployed a new web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Amazon EC2 Auto Scaling group. Enterprise customers from around the world will use the application. Employees of these enterprise customers will connect to the application over HTTPS from office locations.

The company must configure firewalls to allow outbound traffic to only approved IP addresses. The employees of the enterprise customers must be able to access the application with the least amount of latency.

Which change should a network engineer make in the infrastructure to meet these requirements?

A. Create a new Network Load Balancer (NLB). Add the ALB as a target of the NLB.
B. Create a new Amazon CloudFront distribution. Set the ALB as the distribution's origin.
C. Create a new accelerator in AWS Global Accelerator. Add the ALB as an accelerator endpoint.
D. Create a new Amazon Route 53 hosted zone. Create a new record to route traffic to the ALB.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: AWS Global Accelerator provides two static Anycast IP addresses, which enterprise customers can whitelist in their firewalls. It routes user traffic over the AWS global network, significantly reducing latency for users worldwide.

❌ Why the other choices are incorrect:

Option A is incorrect: An NLB in front of an ALB does not provide global latency reduction for distributed users nor does it provide static IP addresses for customer firewall whitelisting.
Option B is incorrect: CloudFront improves global latency but uses dynamic IP addresses at its edge locations, making static IP whitelisting for customer firewalls impractical.
Option D is incorrect: Route 53 handles DNS resolution and routing but does not directly optimize data transfer latency over the global backbone or provide static IP addresses for the ALB.

Reference: https://aws.amazon.com/global-accelerator/

QUESTION 45 (Multi-Select)

A company uses a hybrid architecture and has an AWS Direct Connect connection between its on-premises data center and AWS. The company has production applications that run in the on-premises data center. The company also has production applications that run in a VPC. The applications that run in the on-premises data center need to communicate with the applications that run in the VPC. The company is using corp.example.com as the domain name for the on-premises resources and is using an Amazon Route 53 private hosted zone for aws.example.com to host the VPC resources.

The company is using an open-source recursive DNS resolver in a VPC subnet and is using a DNS resolver in the on-premises data center. The company’s on-premises DNS resolver has a forwarder that directs requests for the aws.exampte.com domain name to the DNS resolver in the VPC. The DNS resolver in the VPC has a forwarder that directs requests for the corp.example.com domain name to the DNS resolver in the on-premises data center. The company has decided to replace the open-source recursive DNS resolver with Amazon Route 53 Resolver endpoints.

Which combination of steps should a network engineer take to make this replacement? (Select THREE.)

A. Create a Route 53 Resolver rule to forward aws.example.com domain queries to the IP addresses of the outbound endpoint.
B. Configure the on-premises DNS resolver to forward aws.example.com domain queries to the IP addresses of the inbound endpoint.
C. Create a Route 53 Resolver inbound endpoint and a Route 53 Resolver outbound endpoint.
D. Create a Route 53 Resolver rule to forward aws.example.com domain queries to the IP addresses of the inbound endpoint.
E. Create a Route 53 Resolver rule to forward corp.example.com domain queries to the IP address of the on-premises DNS resolver.
F. Configure the on-premises DNS resolver to forward aws.example.com queries to the IP addresses of the outbound endpoint.

Click to View Verified Solution & Explanation

Correct Option: B,C,E

Explanation: ✅ Option C (Correct)
Reasoning: To replace the open-source resolver, both an Inbound Endpoint (for on-premises to AWS DNS queries) and an Outbound Endpoint (for AWS to on-premises DNS queries) are essential components of Route 53 Resolver for hybrid connectivity.

✅ Option B (Correct)
Reasoning: On-premises DNS servers must be configured to forward queries for AWS resources (aws.example.com) to the IP addresses of the newly created Route 53 Resolver Inbound Endpoint, allowing resolution via Route 53 private hosted zones.

✅ Option E (Correct)
Reasoning: A Route 53 Resolver rule is required within AWS to direct queries for on-premises resources (corp.example.com) to the on-premises DNS resolver’s IP address, utilizing the Outbound Endpoint to cross the network boundary.

❌ Why the other choices are incorrect:

Option A is incorrect: A Resolver rule for aws.example.com pointing to an outbound endpoint makes no sense; aws.example.com is resolved in AWS via the inbound endpoint.
Option D is incorrect: A Resolver rule is typically for queries originating from the VPC and pointing towards another DNS server, not for directing aws.example.com queries to its own inbound endpoint within AWS itself.
Option F is incorrect: On-premises DNS forwards aws.example.com queries to the inbound endpoint, not the outbound endpoint. The outbound endpoint handles traffic from AWS to on-premises.

Reference: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-rules.html

QUESTION 46

A company is building an API-based application on AWS and is using a microservices architecture for the design. The company is using a multi-account AWS environment that includes a separate AWS account for each microservice development team. Each team hosts its microservice in its own VPC that contains Amazon EC2 instances behind a Network Load Balancer (NLB).

A network engineer needs to use Amazon API Gateway in a shared services account to create an HTTP API to expose these microservices to external applications. The network engineer must ensure that access to the microservices can occur only over a private network. Additionally, the company must be able to control which entities from its internal network can connect to the microservices. In the future, the company will create more microservices that the company must be able to integrate with the application.

What is the MOST secure solution that meets these requirements?

A. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALB. Create a VPC endpoint service in each microservice account. Create an AWS PrivateLink endpoint for those services in the snared services account. Add the elastic network interface IP addresses of the VPC endpoint as targets for the target group of the ALB.
B. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALB. Connect all the VPCs to each other by using a central transit gateway. Add the IP addresses of the NLB as IP-based targets in the ALB target group.
C. Configure the integration to the API Gateway API by using HTTP-based integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate HTTP integration to each NLB for each microservice. Add the HTTP endpoint of the NL3 as the endpoint URL in the HTTP integration.
D. Configure the integration to the API Gateway API by using VPC link integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate VPC link to each NLB for each microservice. Add the HTTP endpoint of the NL3 as the endpoint URL in the VPC link integration.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Option A (Correct)
Reasoning: This solution creates a private path: API Gateway integrates with an ALB via a VPC link. The ALB in the shared services account connects to each microservice’s NLB using AWS PrivateLink endpoints. This provides secure, private, cross-account access, scalable integration, and granular control over network traffic.

❌ Why the other choices are incorrect:

Option B is incorrect: While Transit Gateway connects VPCs, adding NLB IPs as ALB targets across TGW is less secure, manageable, and scalable for this scenario than PrivateLink. PrivateLink provides explicit service exposure and consumption.
Option C is incorrect: HTTP-based integration without a VPC Link generally implies public access, violating the "private network only" requirement. API Gateway needs a VPC Link for secure private integration across VPCs.
Option D is incorrect: Creating a separate VPC Link for each microservice is inefficient and not how VPC Links are designed for this scale. A VPC Link targets ALBs/NLBs by ARN, not HTTP endpoints, and typically targets an ALB that then routes internally.

QUESTION 47

A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend.

Which solution will meet these requirements?

A. Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure a Network Load Balancer with a TCP listener on port 443 to forward traffic to the IP addresses of the backend service Pods.
B. Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure an Application Load Balancer with an HTTPS listener on port 443 to forward traffic to the IP addresses of the backend service Pods.
C. Create a target group. Add the EKS managed node group's Auto Scaling group as a target Create an Application Load Balancer with an HTTPS listener on port 443 to forward traffic to the target group.
D. Create a target group. Add the EKS managed node group’s Auto Scaling group as a target. Create a Network Load Balancer with a TLS listener on port 443 to forward traffic to the target group.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Option A (Correct)
Reasoning: A Network Load Balancer (NLB) with a TCP listener on port 443 provides Layer 4 passthrough, forwarding encrypted gRPC traffic directly to the backend Pods without decryption. This ensures end-to-end encryption and allows mutual TLS to be handled by the backend service. The AWS Load Balancer Controller correctly targets EKS Pod IPs.

❌ Why the other choices are incorrect:

Option B is incorrect: An Application Load Balancer (ALB) with an HTTPS listener terminates TLS at the ALB, violating the requirement that traffic must not be decrypted between the client and the backend.
Option C is incorrect: An ALB terminates TLS (violating the decryption rule) and targets EKS node Auto Scaling groups, which is not the optimal method for directly targeting Pods in EKS via the controller.
Option D is incorrect: An NLB with a TLS listener terminates TLS at the load balancer, violating the requirement that traffic must not be decrypted between the client and the backend. Targeting EKS nodes’ Auto Scaling groups is also suboptimal.

Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/network/listeners-tlstermination.html

QUESTION 48

A company has developed an application on AWS that will track inventory levels of vending machines and initiate the restocking process automatically. The company plans to integrate this application with vending machines and deploy the vending machines in several markets around the world. The application resides in a VPC in the us-east-1 Region. The application consists of an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). The communication from the vending machines to the application happens over HTTPS.

The company is planning to use an AWS Global Accelerator accelerator and configure static IP addresses of the accelerator in the vending machines for application endpoint access. The application must be accessible only through the accelerator and not through a direct connection over the internet to the ALB endpoint.

Which solution will meet these requirements?

A. Configure the ALB in a private subnet of the VPC. Attach an internet gateway without adding routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB’s security group to only allow inbound traffic from the internet on the ALB listener port.
B. Configure the ALB in a private subnet of the VPC. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the internet on the ALB listener port.
C. Configure the ALB in a public subnet of the VP Attach an internet gateway. Add routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the accelerator's IP addresses on the ALB listener port.
D. Configure the ALB in a private subnet of the VPC. Attach an internet gateway. Add routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the accelerator's IP addresses on the ALB listener port.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Option A (Correct)
Reasoning: Placing the ALB in a private subnet, without specific routes to an Internet Gateway from that subnet, prevents direct internet access. Global Accelerator then uses internal AWS routing to reach the private ALB. Allowing 0.0.0.0/0 in the security group is acceptable because the subnet’s routing prevents arbitrary internet access, ensuring only Global Accelerator traffic reaches the ALB.

❌ Why the other choices are incorrect:

Option B is incorrect: While it correctly places the ALB in a private subnet, it omits mentioning the necessary Internet Gateway (even if no specific routes are added from the ALB’s subnet). An IGW is still required for the VPC to interface with Global Accelerator.
Option C is incorrect: Configuring the ALB in a public subnet directly exposes it to the internet, violating the requirement that the application should not be accessible via a direct internet connection.
Option D is incorrect: Adding routes in the private subnet’s route table to point to the Internet Gateway effectively makes the ALB directly internet-routable, failing the requirement to prevent direct internet access.

QUESTION 49

A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group (LAG) bundle to connect to five VPCs that are deployed in the us-east-1 Region. Each VPC serves a different business unit and uses its own private VIF for connectivity to the on-premises environment. Users are reporting slowness when they access resources that are hosted on AWS.

A network engineer finds that there are sudden increases in throughput and that the Direct Connect connection becomes saturated at the same time for about an hour each business day. The company wants to know which business unit is causing the sudden increase in throughput. The network engineer must find out this information and implement a solution to resolve the problem.

Which solution will meet these requirements?

A. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed. Create a new 10 Gbps dedicated connection. Shift traffic from the existing dedicated connection to the new dedicated connection.
B. Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during the period in which slowness is observed. Upgrade the bandwidth of the existing dedicated connection to 10 Gbps.
C. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed. Upgrade the existing dedicated connection to a 5 Gbps hosted connection.
D. Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress to determine which VIF is sending the highest throughput during the period in which slowness is observed. Create a new 10 Gbps dedicated connection. Shift traffic from the existing dedicated connection to the new dedicated connection.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Option A (Correct)
Reasoning: VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress are the correct CloudWatch metrics to monitor individual VIF throughput, precisely identifying which business unit saturates the connection. Creating a new 10 Gbps dedicated connection effectively addresses the bandwidth constraint, allowing a phased traffic migration to minimize disruption and resolve the slowness.

❌ Why the other choices are incorrect:

Option B is incorrect: While identification metrics are correct, simply "upgrading" a dedicated connection in-place is not standard practice; creating a new connection for increased bandwidth is more robust and common for dedicated Direct Connect.
Option C is incorrect: ConnectionBpsIngress and ConnectionPpsEgress are connection-level metrics, not VIF-specific, failing to pinpoint the source business unit. A 5 Gbps hosted connection is an insufficient upgrade and changes connection type, which is not ideal.
Option D is incorrect: This option incorrectly uses ConnectionBpsIngress and ConnectionPpsEgress metrics, which do not provide per-VIF data, making it impossible to identify the problematic business unit.

QUESTION 50 (Multi-Select)

A retail company is running its service on AWS. The company’s architecture includes Application Load Balancers (ALBs) in public subnets. The ALB target groups are configured to send traffic to backend Amazon EC2 instances in private subnets. These backend EC2 instances can call externally hosted services over the internet by using a NAT gateway.

The company has noticed in its billing that NAT gateway usage has increased significantly. A network engineer needs to find out the source of this increased usage.

Which options can the network engineer use to investigate the traffic through the NAT gateway? (Choose two.)

A. Enable VPC flow logs on the NAT gateway's elastic network interface. Publish the logs to a log group in Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query and analyze the logs.
B. Enable NAT gateway access logs. Publish the logs to a log group in Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query and analyze the logs.
C. Configure Traffic Mirroring on the NAT gateway's elastic network interface. Send the traffic to an additional EC2 instance. Use tools such as tcpdump and Wireshark to query and analyze the mirrored traffic.
D. Enable VPC flow logs on the NAT gateway's elastic network interface. Publish the logs to an Amazon S3 bucket. Create a custom table for the S3 bucket in Amazon Athena to describe the log structure. Use Athena to query and analyze the logs.
E. Enable NAT gateway access logs. Publish the logs to an Amazon S3 bucket. Create a custom table for the S3 bucket in Amazon Athena to describe the log structure. Use Athena to query and analyze the logs.

Click to View Verified Solution & Explanation

Correct Option: A,D

Explanation: ✅ Option A (Correct)
Reasoning: Enabling VPC Flow Logs on the NAT Gateway’s Elastic Network Interface captures all IP traffic details (source, destination, bytes). Publishing these logs to CloudWatch Logs allows using CloudWatch Logs Insights for powerful, real-time querying and analysis to identify the internal sources driving the increased NAT Gateway usage.

✅ Option D (Correct)
Reasoning: Similar to Option A, VPC Flow Logs on the NAT Gateway’s ENI provide crucial traffic information. Publishing logs to Amazon S3 and leveraging Amazon Athena for queries offers a scalable, cost-effective method to analyze large volumes of log data, pinpointing specific instances or applications contributing to the usage increase.

❌ Why the other choices are incorrect:

Option B is incorrect: "NAT Gateway access logs" is not an AWS feature. VPC Flow Logs are the standard mechanism for monitoring traffic through NAT Gateways.
Option C is incorrect: Traffic Mirroring is overly complex and resource-intensive for investigating aggregate usage patterns. It provides deep packet inspection but is not the practical or recommended approach for simply identifying sources of increased NAT Gateway data transfer; Flow Logs are designed for this.
Option E is incorrect: As with Option B, "NAT Gateway access logs" do not exist as a feature in AWS.

QUESTION 51

An ecommerce company is hosting a web application on Amazon EC2 instances to handle continuously changing customer demand. The EC2 instances are part of an Auto Scaling group. The company wants to implement a solution to distribute traffic from customers to the EC2 instances. The company must encrypt all traffic at all stages between the customers and the application servers. No decryption at intermediate points is allowed.

Which solution will meet these requirements?

A. Create an Application Load Balancer (ALB). Add an HTTPS listener to the ALB. Configure the Auto Scaling group to register instances with the ALB's target group.
B. Create an Amazon CloudFront distribution. Configure the distribution with a custom SSL/TLS certificate. Set the Auto Scaling group as the distribution's origin.
C. Create a Network Load Balancer (NLB). Add a TCP listener to the NLB. Configure the Auto Scaling group to register instances with the NLB's target group.
D. Create a Gateway Load Balancer (GLB). Configure the Auto Scaling group to register instances with the GLB's target group.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Option C (Correct)
Reasoning: A Network Load Balancer with a TCP listener forwards traffic directly to the backend instances at Layer 4 without inspecting or terminating the SSL/TLS connection. The encryption remains end-to-end from the customer to the EC2 instance, satisfying the "no decryption at intermediate points" requirement.

❌ Why the other choices are incorrect:

Option A is incorrect: An Application Load Balancer with an HTTPS listener decrypts traffic at the ALB itself, violating the "no decryption at intermediate points" rule.
Option B is incorrect: Amazon CloudFront acts as a reverse proxy and terminates the SSL/TLS connection from the client, decrypting the traffic at CloudFront before re-encrypting (if configured) to the origin.
Option D is incorrect: A Gateway Load Balancer is designed for traffic inspection appliances and operates at Layer 3, not suitable for direct web application traffic distribution with end-to-end SSL/TLS without intermediate decryption for the described scenario.

Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/nlb/introduction.html

QUESTION 52 (Multi-Select)

A company has expanded its network to the AWS Cloud by using a hybrid architecture with multiple AWS accounts. The company has set up a shared AWS account for the connection to its on-premises data centers and the company offices. The workloads consist of private web-based services for internal use. These services run in different AWS accounts. Office-based employees consume these services by using a DNS name in an on-premises DNS zone that is named example.internal.

The process to register a new service that runs on AWS requires a manual and complicated change request to the internal DNS. The process involves many teams.

The company wants to update the DNS registration process by giving the service creators access that will allow them to register their DNS records. A network engineer must design a solution that will achieve this goal. The solution must maximize cost-effectiveness and must require the least possible number of configuration changes.

Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

A. Create a record for each service in its local private hosted zone (serviceA.account1.aws.example.internal). Provide this DNS record to the employees who need access.
B. Create an Amazon Route 53 Resolver inbound endpoint in the shared account VPC. Create a conditional forwarder for a domain named aws.example.internal on the on-premises DNS servers. Set the forwarding IP addresses to the inbound endpoint's IP addresses that were created.
C. Create an Amazon Route 53 Resolver rule to forward any queries made to onprem.example.internal to the on-premises DNS servers.
D. Create an Amazon Route 53 private hosted zone named aws.example.internal in the shared AWS account to resolve queries for this domain.
E. Launch two Amazon EC2 instances in the shared AWS account. Install BIND on each instance. Create a DNS conditional forwarder on each BIND server to forward queries for each subdomain under aws.example.internal to the appropriate private hosted zone in each AWS account. Create a conditional forwarder for a domain named aws.example.internal on the on-premises DNS servers. Set the forwarding IP addresses to the IP addresses of the BIND servers.
F. Create a private hosted zone in the shared AWS account for each account that runs the service. Configure the private hosted zone to contain aws.example.internal in the domain (account1.aws.example.internal). Associate the private hosted zone with the VPC that runs the service and the shared account VPC.

Click to View Verified Solution & Explanation

Correct Option: A,B,F

Explanation: ✅ Option A (Correct)
Reasoning: This allows service creators to manage their specific DNS records (e.g., serviceA.account1.aws.example.internal) directly, delegating DNS management to the service teams as required by the problem.

✅ Option B (Correct)
Reasoning: An Inbound Endpoint in the shared account allows on-premises DNS servers to forward queries for AWS-hosted private domains (aws.example.internal) into the AWS Cloud, enabling hybrid resolution.

✅ Option F (Correct)
Reasoning: Creating private hosted zones (e.g., account1.aws.example.internal) in the shared account and associating them with both the service VPC (in account1) and the shared account VPC enables centralized resolution. Service creators in account1 would then be granted cross-account IAM permissions to manage records within their respective account1.aws.example.internal PHZ in the shared account, fulfilling the delegation goal.

❌ Why the other choices are incorrect:

Option C is incorrect: Creating a Resolver rule for onprem.example.internal is for AWS resources to resolve on-premises DNS, not the other way around, which is the problem focus.
Option D is incorrect: While creating aws.example.internal is a logical step, it alone doesn’t address the multi-account delegation or on-premises resolution of specific service subdomains.
Option E is incorrect: Using custom BIND servers on EC2 instances is less cost-effective and involves more configuration and operational overhead compared to using managed Route 53 Resolver services.

QUESTION 53

An international company provides early warning about tsunamis. The company plans to use IoT devices to monitor sea waves around the world. The data that is collected by the IoT devices must reach the company’s infrastructure on AWS as quickly as possible. The company is using three operation centers around the world. Each operation center is connected to AWS through Its own AWS Direct Connect connection. Each operation center is connected to the internet through at least two upstream internet service providers.

The company has its own provider-independent (PI) address space. The IoT devices use TCP protocols for reliable transmission of the data they collect. The IoT devices have both landline and mobile internet connectivity. The infrastructure and the solution will be deployed in multiple AWS Regions. The company will use Amazon Route 53 for DNS services.

A network engineer needs to design connectivity between the IoT devices and the services that run in the AWS Cloud.

Which solution will meet these requirements with the HIGHEST availability?

A. Set up an Amazon CloudFront distribution with origin failover. Create an origin group for each Region where the solution is deployed.
B. Set up Route 53 latency-based routing. Add latency alias records. For the latency alias records, set the value of Evaluate Target Health to Yes.
C. Set up an accelerator in AWS Global Accelerator. Configure Regional endpoint groups and health checks.
D. Set up Bring Your Own IP (BYOIP) addresses. Use the same PI addresses for each Region where the solution is deployed.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Option B (Correct)
Reasoning: Route 53 latency-based routing directs IoT devices to the AWS Region with the lowest latency, fulfilling "as quickly as possible." Crucially, "Evaluate Target Health to Yes" ensures only healthy endpoints receive traffic, providing the highest availability and automatic failover across regions using the specified DNS service.

❌ Why the other choices are incorrect:

Option A is incorrect: CloudFront is primarily a CDN. While it can accelerate API calls, it adds a hop and isn’t the most direct or highest availability solution for raw, real-time IoT data ingestion compared to dedicated routing.
Option C is incorrect: AWS Global Accelerator offers high availability and performance via Anycast IPs and the AWS backbone. While strong, Route 53 latency-based routing with health checks is a direct, robust, and explicitly DNS-centric solution that meets the requirements without introducing a separate Anycast IP layer, leveraging the stated Route 53 usage.
Option D is incorrect: Using the same PI addresses for multiple distinct Regions without a service like Global Accelerator or complex BGP configurations for Anycast routing is problematic and does not guarantee optimal routing or highest availability.

QUESTION 54 (Multi-Select)

A government contractor is designing a multi-account environment with multiple VPCs for a customer. A network security policy requires all traffic between any two VPCs to be transparently inspected by a third-party appliance.

The customer wants a solution that features AWS Transit Gateway. The setup must be highly available across multiple Availability Zones, and the solution needs to support automated failover. Furthermore, asymmetric routing is not supported by the inspection appliances.

Which combination of steps is part of a solution that meets these requirements? (Choose two.)

A. Deploy two clusters that consist of multiple appliances across multiple Availability Zones in a designated inspection VPC. Connect the inspection VPC to the transit gateway by using a VPC attachment. Create a target group, and register the appliances with the target group. Create a Network Load Balancer (NLB), and set it up to forward to the newly created target group. Configure a default route in the inspection VPCs transit gateway subnet toward the NLB.
B. Deploy two clusters that consist of multiple appliances across multiple Availability Zones in a designated inspection VPC. Connect the inspection VPC to the transit gateway by using a VPC attachment. Create a target group, and register the appliances with the target group. Create a Gateway Load Balancer, and set it up to forward to the newly created target group. Configure a default route in the inspection VPC’s transit gateway subnet toward the Gateway Load Balancer endpoint.
C. Configure two route tables on the transit gateway. Associate one route table with all the attachments of the application VPCs. Associate the other route table with the inspection VPC’s attachment. Propagate all VPC attachments into the inspection route table. Define a static default route in the application route table. Enable appliance mode on the attachment that connects the inspection VPC.
D. Configure two route tables on the transit gateway. Associate one route table with all the attachments of the application VPCs. Associate the other route table with the inspection VPCs attachment. Propagate all VPC attachments into the application route table. Define a static default route in the inspection route table. Enable appliance mode on the attachment that connects the inspection VPC.
E. Configure one route table on the transit gateway. Associate the route table with all the VPCs. Propagate all VPC attachments into the route table. Define a static default route in the route table.

Click to View Verified Solution & Explanation

Correct Option: B,C

Explanation: ✅ Option B (Correct)
Reasoning: This step correctly describes deploying inspection appliances with a Gateway Load Balancer (GWLB). GWLB is purpose-built for transparent inline inspection with Transit Gateway, supporting high availability and automated failover across multiple AZs. Routing the inspection VPC’s TGW subnet to the GWLB endpoint ensures traffic is directed through the appliances.

✅ Option C (Correct)
Reasoning: This outlines the essential Transit Gateway (TGW) routing configuration for centralized inspection. Two TGW route tables—one for application VPCs with a default route to the inspection VPC and one for the inspection VPC—are crucial. Propagating application routes back to the inspection route table facilitates return traffic. Enabling appliance mode on the inspection VPC attachment prevents asymmetric routing, which is critical as appliances don’t support it.

❌ Why the other choices are incorrect:

Option A is incorrect: Network Load Balancer (NLB) is not designed for transparent inline inspection with Transit Gateway. It lacks the necessary integration (like GWLB endpoints) to insert third-party appliances into the TGW traffic path, making it unsuitable for this requirement.
Option D is incorrect: This option’s TGW routing is flawed. Propagating all VPC attachments into the application route table would allow application VPCs to route directly to each other, bypassing inspection. The static default route is also incorrectly placed in the inspection route table instead of the application route table.
Option E is incorrect: Using a single TGW route table prevents centralized inspection. With a single route table, if application VPC routes are propagated, traffic will route directly between application VPCs, bypassing any appliance and failing to meet the security policy requirement.

QUESTION 55

A company is building its website on AWS in a single VPC. The VPC has public subnets and private subnets in two Availability Zones. The website has static content such as images. The company is using Amazon S3 to store the content.

The company has deployed a fleet of Amazon EC2 instances as web servers in a private subnet. The EC2 instances are in an Auto Scaling group behind an Application Load Balancer. The EC2 instances will serve traffic, and they must pull content from an S3 bucket to render the webpages. The company is using AWS Direct Connect with a public VIF for on-premises connectivity to the S3 bucket.

A network engineer notices that traffic between the EC2 instances and Amazon S3 is routing through a NAT gateway. As traffic increases, the company’s costs are increasing. The network engineer needs to change the connectivity to reduce the NAT gateway costs that result from the traffic between the EC2 instances and Amazon S3.

Which solution will meet these requirements?

A. Create a Direct Connect private VIF. Migrate the traffic from the public VIF to the private VIF.
B. Create an AWS Site-to-Site VPN tunnel over the existing public VIF.
C. Implement interface VPC endpoints for Amazon S3. Update the VPC route table.
D. Implement gateway VPC endpoints for Amazon S3. Update the VPC route table.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

✅ Option D (Correct) Reasoning: Implementing a gateway VPC endpoint for Amazon S3 allows EC2 instances in private subnets to access S3 directly within the AWS network without traversing a NAT Gateway. This eliminates the NAT Gateway data processing charges for S3 traffic, directly addressing the cost reduction requirement. Updating the VPC route table directs S3-bound traffic to the endpoint.

❌ Why the other choices are incorrect:

Option A is incorrect: A Direct Connect private VIF connects your on-premises network to your VPC’s private IP space. It doesn’t enable EC2 instances within a private subnet to reach public AWS services like S3 directly without a NAT gateway or VPC endpoint.
Option B is incorrect: An AWS Site-to-Site VPN tunnel is for connecting on-premises networks to a VPC securely. It does not provide a direct, cost-optimized path for EC2 instances in private subnets to access Amazon S3 within the AWS network, independent of a NAT Gateway.
Option C is incorrect: Amazon S3 uses gateway VPC endpoints, not interface VPC endpoints. Interface endpoints are for services that use PrivateLink, creating ENIs in your subnets. S3, along with DynamoDB, uses gateway endpoints implemented as route table targets.

Reference: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html

Need the Full Exam Simulator?

Practice the complete question bank in a realistic, timed environment with advanced tracking.

Access Full CertoMetrics Engine →

Official Exam Details: (ANS-C01)

Exam Format & Question Types

AWS Certified Advanced Networking – Specialty (ANS-C01) Study Guide & Architectural Master Blueprint

1. Exam Overview & Profile

2. Deep-Dive Domain Breakdown

Domain 1: Network Design (30%)

Domain 2: Network Implementation (26%)

Domain 3: Network Management and Operations (20%)

Domain 4: Network Security, Compliance, and Governance (24%)

3. High-Yield Exam Tips & Scenario Traps

4. Frequently Asked Questions (FAQ)

Free ANS-C01 Sample Practice Questions

General Practice Questions

QUESTION 1

QUESTION 2

QUESTION 3

QUESTION 4

QUESTION 5 (Multi-Select)

QUESTION 6 (Multi-Select)

QUESTION 7

QUESTION 8

QUESTION 9

QUESTION 10

QUESTION 11

QUESTION 12

QUESTION 13 (Multi-Select)

QUESTION 14

QUESTION 15

QUESTION 16

QUESTION 17

QUESTION 18

QUESTION 19 (Multi-Select)

QUESTION 20

QUESTION 21 (Multi-Select)

QUESTION 22 (Multi-Select)

QUESTION 23

QUESTION 24

QUESTION 25

QUESTION 26

QUESTION 27

QUESTION 28 (Multi-Select)

QUESTION 29 (Multi-Select)

QUESTION 30

QUESTION 31

QUESTION 32 (Multi-Select)

QUESTION 33

QUESTION 34

QUESTION 35 (Multi-Select)

QUESTION 36

QUESTION 37

QUESTION 38 (Multi-Select)

QUESTION 39

QUESTION 40

QUESTION 41

QUESTION 42

QUESTION 43

QUESTION 44

QUESTION 45 (Multi-Select)

QUESTION 46

QUESTION 47

QUESTION 48

QUESTION 49

QUESTION 50 (Multi-Select)

QUESTION 51

QUESTION 52 (Multi-Select)

QUESTION 53

QUESTION 54 (Multi-Select)

QUESTION 55

Need the Full Exam Simulator?

Related Posts

Leave a Comment Cancel Reply