Free ANS-C00 Amazon ANS-C00 Practice Test Question

Question 1 (Topic 1)

Your organization's corporate website must be available on www.acme.com and acme.com. How should you configure Amazon Route 53 to meet this requirement?

Select an option, then click Submit answer.

○ Configure acme.com with an ALIAS record targeting the ELB. www.acme.com with an ALIAS record targeting the ELB.
○ Configure acme.com with an A record targeting the ELB. www.acme.com with a CNAME record targeting the acme.com record.
○ Configure acme.com with a CNAME record targeting the ELB. www.acme.com with a CNAME record targeting the acme.com record.
○ Configure acme.com using a second ALIAS record with the ELB target. www.acme.com using a PTR record with the acme.com record target.

Reference / correct answer:

Configure acme.com with an ALIAS record targeting the ELB. www.acme.com with an ALIAS record targeting the ELB.

Most accepted answer: A. Configure acme.com with an ALIAS record targeting the ELB. www.acme.com with an ALIAS record targeting the ELB.

Community votes: A=4

answer should a upvoted 17 times

This is another poorly worded unfair AWS question. What you would want is to have an A record with an ALIAS to the ELB for acme.com and a CNAME record for www.acme.com pointing to acme.com. That way, if you needed to replace the ELB, you wouldn't need to update multiple records. upvoted 8 times shadi1982 4 years, 10 months ago Agree, so answer sould be B not A https://support.dnsimple.com/articles/cname-record/ upvoted 1 times shadi1982 4 years, 9 months ago Change my answer, A is correct upvoted 1 times ... ... Ajani 4 years, 9 months ago Agreed, poorly worded. Also you can't CNAME to an apex record acme.com. only to a subdomain. upvoted 1 times ... ImAlwaysRight 4 years, 9 months ago Wrong. Clearly the only option here is A. Using Alias to both records is ideal, usage of CNAME adds charges but Alias resolution is free. upvoted 1 times StelSen 4 years, 9 months ago You are wrong. Sunil has a valid point. upvoted 2 times ... Cyril_the_Squirl 4 years, 9 months ago Cost is not a consideration or an objective, the question doesn't lead you in anyway to consider costs.. CNAME = www.acme.com A = A record for the ALB Therefore A is Correct. upvoted 1 times ... ...

Agree, so answer sould be B not A https://support.dnsimple.com/articles/cname-record/ upvoted 1 times shadi1982 4 years, 9 months ago Change my answer, A is correct upvoted 1 times ...

Change my answer, A is correct upvoted 1 times

Agreed, poorly worded. Also you can't CNAME to an apex record acme.com. only to a subdomain. upvoted 1 times

Question 2 (Topic 1)

Your organization runs a popular e-commerce application deployed on AWS that uses auto scaling in conjunction with an Elastic Load balancing (ELB) service with an HTTPS listener. Your security team reports that an exploitable vulnerability has been discovered in the encryption protocol and cipher that your site uses. Which step should you take to fix this problem?

Select an option, then click Submit answer.

○ Generate new SSL certificates for all web servers and replace current certificates.
○ Change the security policy on the ELB to disable vulnerable protocols and ciphers.
○ Generate new SSL certificates and use ELB to front-end the encrypted traffic for all web servers.
○ Leverage your current configuration management system to update SSL policy on all web servers.

Reference / correct answer:

Change the security policy on the ELB to disable vulnerable protocols and ciphers.

Most accepted answer: B. Change the security policy on the ELB to disable vulnerable protocols and ciphers.

Community votes: B=2

If the SSL offload happens at ELB, correct answer is B - vulnerable ciphers and protocols can be removed on the security policy upvoted 23 times dpvnme 4 years, 10 months ago Nevermind, the question says HTTPS listener, so yeah, B should be the answer upvoted 8 times ... dpvnme 4 years, 10 months ago Yes but the question does not state that the SSL is offload at ELB. upvoted 3 times ... jason2009 4 years, 9 months ago That's the problem. The question is very badly designed. First, you cannot remove ciphers nor protocols from the security policy. You can only change security policies but not define them yourselves. Secondly, it does not say what exactly is the vulnerabilities are so that's not clear whether you can choose a new security policy in ELB or you will have to bring your own policies because AWS does not support the ciphers and protocols your company considered safe. Its very unclear and the question is seriously trying to confuse you. upvoted 3 times ...

Nevermind, the question says HTTPS listener, so yeah, B should be the answer upvoted 8 times

Yes but the question does not state that the SSL is offload at ELB. upvoted 3 times

That's the problem. The question is very badly designed. First, you cannot remove ciphers nor protocols from the security policy. You can only change security policies but not define them yourselves. Secondly, it does not say what exactly is the vulnerabilities are so that's not clear whether you can choose a new security policy in ELB or you will have to bring your own policies because AWS does not support the ciphers and protocols your company considered safe. Its very unclear and the question is seriously trying to confuse you. upvoted 3 times

Correct Answer D upvoted 1 times

Question 3 (Topic 1)

A department in your company has created a new account that is not part of the organization's consolidated billing family. The department has also created a VPC for its workload. Access is restricted by network access control lists to the department's on-premises private IP allocation. An AWS Direct Connect private virtual interface for this VPC advertises a default route to the company network. When the department downloads data from an Amazon EC2 instance in its new VPC, what are the associated charges?

Select an option, then click Submit answer.

○ The company pays Internet Data Out charges.
○ The company pays AWS Direct Connect Data Out charges.
○ The department pays Internet Data Out charges.
○ The department pays AWS Direct Connect Data Out charges.

Free ANS-C00 – Amazon ANS-C00 Practice Test Question