ANS-C01 sample questions

Question 1

A healthcare provider requires a dedicated network connection between their on-premises data center and AWS to transfer sensitive patient records. Compliance regulations mandate that all data must be encrypted at Layer 2 using a dedicated encryption key that the customer controls. The connection must support speeds of at least 10 Gbps. Which solution meets these requirements?

Accepted Answer

Provision a 10 Gbps Direct Connect Dedicated connection at a MACsec-capable location and configure MACsec using a Connectivity Association Key (CAK) and Connectivity Association Key Name (CKN).

Answer

Establish an AWS Site-to-Site VPN over a 10 Gbps Direct Connect Dedicated connection.

Answer

Use AWS Transit Gateway with a VPN attachment over a Direct Connect Hosted connection.

Answer

Configure a Nitro-based EC2 instance with encryption in transit enabled and route traffic through a transit VPC.

Question 2

A company operates a hybrid environment with a complex DNS structure. They have an on-premises Microsoft DNS server for the `corp.local` domain and several VPCs in AWS using Route 53 Private Hosted Zones for `aws.corp.local`. The company needs to enable bi-directional DNS resolution between on-premises and AWS. Specifically, on-premises servers must resolve `aws.corp.local`, and AWS instances must resolve `corp.local`. Which set of configurations is required?

Accepted Answer

Create a Route 53 Resolver Inbound Endpoint. Configure the on-premises DNS to forward `aws.corp.local` to the Inbound Endpoint IPs. Create a Route 53 Resolver Outbound Endpoint. Create a Resolver Rule for `corp.local` that targets the on-premises DNS IPs and associate it with the VPCs.

Answer

Create a Route 53 Private Hosted Zone for `corp.local` and create A-records for all on-premises servers. Update the VPC DHCP options set to use the on-premises DNS servers.

Answer

Use Simple AD in AWS Directory Service. Configure the on-premises DNS to use the Simple AD IP addresses as forwarders. Configure Simple AD to forward `corp.local` requests to on-premises.

Answer

Create a Route 53 Resolver Outbound Endpoint. Configure the on-premises DNS to forward `aws.corp.local` to the Outbound Endpoint IPs. Create a Private Hosted Zone for `corp.local` associated with the VPC.

Question 3

A media company uses AWS CloudFront to deliver content globally. They want to ensure that users in Europe are routed to a specific version of their application hosted in the eu-central-1 Region, while users in North America are routed to the us-east-1 Region. They also need to perform A/B testing by routing 10% of European traffic to a beta stack in eu-west-1. Which Route 53 routing policy configuration should be used?

Accepted Answer

Use Route 53 Traffic Flow to create a traffic policy. Start with a Geolocation rule to split traffic between Europe and North America. Under the Europe branch, add a Weighted rule to split traffic 90/10 between eu-central-1 and eu-west-1 resources.

Answer

Use a Latency routing policy for the top-level domain. Create CNAME records for each region with Weighted routing policies.

Answer

Use a Failover routing policy. Set North America as Primary and Europe as Secondary. Use Weighted routing for the European resources.

Answer

Use a Multivalue Answer routing policy for all resources and rely on client-side selection.

Question 4

An enterprise has a centralized auditing account that needs to collect VPC Flow Logs from 50 different AWS accounts within their AWS Organization. The auditing team requires the logs to be stored in a single S3 bucket in the auditing account, partitioned by account ID and date. What is the most efficient way to configure this?

Accepted Answer

Configure VPC Flow Logs in each member account to publish directly to the S3 bucket ARN in the auditing account. Update the S3 bucket policy in the auditing account to allow `delivery.logs.amazonaws.com` and the member account IDs to put objects.

Answer

Create a Lambda function in each account to stream CloudWatch Logs to the central S3 bucket.

Answer

Use AWS Transit Gateway to route all traffic through the auditing account and capture Flow Logs at the Transit Gateway level only.

Answer

Enable VPC Flow Logs to CloudWatch Logs in each account. Use Kinesis Data Firehose in each account to subscribe to the log group and deliver to the central S3 bucket.

Question 5

A company is migrating a legacy application to AWS. The application uses hardcoded IP addresses for connectivity between the application tier and the database tier. The migration plan involves moving the application tier to AWS first, while the database remains on-premises. The on-premises network is 10.0.0.0/16. The application expects the database at 10.0.5.50. You need to enable the AWS application instances to connect to the on-premises database using the hardcoded IP. What should you do?

Accepted Answer

Use a VPC CIDR of 192.168.0.0/16. Establish connectivity via Direct Connect. Since the application uses the hardcoded IP 10.0.5.50, ensure the route table has a route for 10.0.0.0/16 pointing to the Virtual Private Gateway (VGW). No conflict exists since the VPC CIDR is different.

Answer

Create a VPC with a CIDR that does not overlap with 10.0.0.0/16. Establish a Direct Connect connection. Configure a NAT Gateway in the VPC and use a private NAT rule to translate the destination IP.

Answer

Assign the 10.0.0.0/16 CIDR to the VPC. Connect via Direct Connect. The VPC local route will take precedence, so this configuration will fail.

Answer

Create a VPC with 10.0.0.0/16. Use a secondary CIDR block for the subnets. Configure specific routes for 10.0.5.50/32 pointing to the Internet Gateway.

Question 6

A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend.Which solution will meet these requirements?

Accepted Answer

Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure a Network Load Balancer with a TCP listener on port 443 to forward traffic to the IP addresses of the backend service Pods.

Answer

Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure an Application Load Balancer with an HTTPS listener on port 443 to forward traffic to the IP addresses of the backend service Pods.

Answer

Create a target group. Add the EKS managed node group's Auto Scaling group as a target Create an Application Load Balancer with an HTTPS listener on port 443 to forward traffic to the target group.

Answer

Create a target group. Add the EKS managed node group’s Auto Scaling group as a target. Create a Network Load Balancer with a TLS listener on port 443 to forward traffic to the target group.

Question 7

A company is deploying a new application in the AWS Cloud. The company wants a highly available web server that will sit behind an Elastic Load Balancer. The load balancer will route requests to multiple target groups based on the URL in the request. All traffic must use HTTPS. TLS processing must be offloaded to the load balancer. The web server must know the user’s IP address so that the company can keep accurate logs for security purposes.Which solution will meet these requirements?

Accepted Answer

Deploy an Application Load Balancer with an HTTPS listener. Use path-based routing rules to forward the traffic to the correct target group. Include the X-Forwarded-For request header with traffic to the targets.

Answer

Deploy an Application Load Balancer with an HTTPS listener for each domain. Use host-based routing rules to forward the traffic to the correct target group for each domain. Include the X-Forwarded-For request header with traffic to the targets.

Answer

Deploy a Network Load Balancer with a TLS listener. Use path-based routing rules to forward the traffic to the correct target group. Configure client IP address preservation for traffic to the targets.

Answer

Deploy a Network Load Balancer with a TLS listener for each domain. Use host-based routing rules to forward the traffic to the correct target group for each domain. Configure client IP address preservation for traffic to the targets.

Question 8

A company has developed an application on AWS that will track inventory levels of vending machines and initiate the restocking process automatically. The company plans to integrate this application with vending machines and deploy the vending machines in several markets around the world. The application resides in a VPC in the us-east-1 Region. The application consists of an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). The communication from the vending machines to the application happens over HTTPS.The company is planning to use an AWS Global Accelerator accelerator and configure static IP addresses of the accelerator in the vending machines for application endpoint access. The application must be accessible only through the accelerator and not through a direct connection over the internet to the ALB endpoint.Which solution will meet these requirements?

Accepted Answer

Configure the ALB in a private subnet of the VP

Answer

Attach an internet gateway without adding routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB’s security group to only allow inbound traffic from the internet on the ALB listener port.

Answer

Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the internet on the ALB listener port.

Answer

Configure the ALB in a public subnet of the VPAttach an internet gateway. Add routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the accelerator's IP addresses on the ALB listener port.

Answer

Attach an internet gateway. Add routes in the subnet route tables to point to the internet gateway. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from the accelerator's IP addresses on the ALB listener port.

Advanced Networking - Specialty Practice Questions

Unlock the full exam and previous versions

Create an account to continue.

Create an account to continue.

Related exams