← Back to exam page

Free ANS-C00 – Amazon ANS-C00 Practice Test Question

Loading demo links...

Showing 34–36 of 38 questions

Question 34 (Topic 1)

A company is delivering web content from an Amazon EC2 instance in a public subnet with address 2001:db8:1:100::1. Users report they are unable to access the web content. The VPC Flow Logs for the subnet contain the following entries: 2 012345678912 eni-0596e500123456789 2001:db8:2:200::2 2001:db8:1:100::1 0 0 58 234 24336 1551299195 1551299434 ACCEPT OK - 2 012345678912 eni-0596e500123456789 2001:db8:1:100::1 2001:db8:2:200::2 0 0 58 234 24336 1551299195 1551299434 REJECT OK - Which action will restore network reachability to the EC2 instance?

Select an option, then click Submit answer.

  • ○ Update the security group associated with eni-0596e500123456789 to permit inbound traffic.
  • ○ Update the security group associated with eni-0596e500123456789 to permit outbound traffic.
  • ○ Update the network ACL associated with the subnet to permit inbound traffic.
  • ○ Update the network ACL associated with the subnet to permit outbound traffic.
Question 35 (Topic 1)

A company has deployed a production environment in the AWS Cloud. The environment is contained in a VPC and includes a virtual private gateway. The company has established an AWS Direct Connect connection. which includes a private Virtual Interface (VIF), and a VPN connection to the on-premises data center. For traffic originating in the VPC, what is the order of BGP path selection from MOST preferred to LEAST preferred?

Select an option, then click Submit answer.

  • ○ Direct Connect BGP routes, static routes, longest prefix match, VPN BGP routes.
  • ○ Static routes, longest prefix match, Direct Connect BGP routes, VPN BGP routes.
  • ○ Longest prefix match, static routes, Direct-Connect BGP routes, VPN BGP routes.
  • ○ Longest prefix match, VPN BGP routes, static routes, Direct Connect BGP routes.
Question 36 (Topic 1)

A company's application runs in a VPC and stores sensitive data in Amazon S3. The application's Amazon EC2 instances are located in a private subnet with a NAT gateway deployed in a public subnet to provide access to Amazon S3. The S3 bucket is located in the same AWS Region as the EC2 instances. The company wants to ensure that this bucket can be accessed only from the VPC where the application resides. Which changes should a network engineer make to the architecture to meet these requirements?

Select an option, then click Submit answer.

  • ○ Delete the existing S3 bucket and create a new S3 bucket inside the VPC in the private subnet. Configure the S3 security group to allow only the application instances to access the bucket.
  • ○ Deploy an S3 VPC endpoint in the VPC where the application resides. Configure an S3 bucket policy with a condition to allow access only from the VPC endpoint.
  • ○ Configure an S3 bucket policy, and use an IP address condition to restrict access to the bucket. Allow access only from the VPC CIDR range, and deny all other IP address ranges.
  • ○ Create a new IAM role for the EC2 instances that provides access to the S3 bucket, and assign the role to the application instances. Configure an S3 bucket policy to allow access only from the role.