Free ANS-C00 Amazon ANS-C00 Practice Test Question - Page 2

Question 4 (Topic 1)

Your security team implements a host-based firewall on all of your Amazon Elastic Compute Cloud (EC2) instances to block all outgoing traffic. Exceptions must be requested for each specific requirement. Until you request a new rule, you cannot access the instance metadata service. Which firewall rule should you request to be added to your instances to allow instance metadata access?

Select an option, then click Submit answer.

○ Inbound; Protocol tcp; Source [Instance's EIP]; Destination 169.254.169.254
○ Inbound; Protocol tcp; Destination 169.254.169.254; Destination port 80
○ Outbound; Protocol tcp; Destination 169.254.169.254; Destination port 80
○ Outbound; Protocol tcp; Destination 169 .254.169.254; Destination port 443

Question 5 (Topic 1)

You have multiple Amazon Elastic Compute Cloud (EC2) instances running a web server in a VPC configured with security groups and NACL. You need to ensure layer 7 protocol level logging of all network traffic (ACCEPT/REJECT) on the instances. What should be enabled to complete this task?

Select an option, then click Submit answer.

○ CloudWatch Logs at the VPC level
○ Packet sniffing at the instance level
○ VPC flow logs at the subnet level
○ Packet sniffing at the VPC level

Reference / correct answer:

Packet sniffing at the instance level

Most accepted answer: B. Packet sniffing at the instance level

Community votes: B=2

Flow logs are L4 only. The question clearly says L7 logging. The decision is between B&D. There is no way/option to take packet captures at a VPC level, you have to do it at interface level so its B. upvoted 26 times JohnnyBG 4 years, 7 months ago Packet sniffing is not a log, I would go with A. upvoted 1 times JohnnyBG 4 years, 6 months ago From Cloudwatch docs: Monitor logs from Amazon EC2 instances – You can use CloudWatch Logs to monitor applications and systems using log data. For example, CloudWatch Logs can track the number of errors that occur in your application logs and send you a notification whenever the rate of errors exceeds a threshold you specify. CloudWatch Logs uses your log data for monitoring; so, no code changes are required. For example, you can monitor application logs for specific literal terms (such as "NullReferenceException") or count the number of occurrences of a literal term at a particular position in log data (such as "404" status codes in an Apache access log). When the term you are searching for is found, CloudWatch Logs reports the data to a CloudWatch metric that you specify. Log data is encrypted while in transit and while it is at rest. To get started, see Getting started with CloudWatch Logs. upvoted 1 times ... ...

Packet sniffing is not a log, I would go with A. upvoted 1 times JohnnyBG 4 years, 6 months ago From Cloudwatch docs: Monitor logs from Amazon EC2 instances – You can use CloudWatch Logs to monitor applications and systems using log data. For example, CloudWatch Logs can track the number of errors that occur in your application logs and send you a notification whenever the rate of errors exceeds a threshold you specify. CloudWatch Logs uses your log data for monitoring; so, no code changes are required. For example, you can monitor application logs for specific literal terms (such as "NullReferenceException") or count the number of occurrences of a literal term at a particular position in log data (such as "404" status codes in an Apache access log). When the term you are searching for is found, CloudWatch Logs reports the data to a CloudWatch metric that you specify. Log data is encrypted while in transit and while it is at rest. To get started, see Getting started with CloudWatch Logs. upvoted 1 times ...

From Cloudwatch docs: Monitor logs from Amazon EC2 instances – You can use CloudWatch Logs to monitor applications and systems using log data. For example, CloudWatch Logs can track the number of errors that occur in your application logs and send you a notification whenever the rate of errors exceeds a threshold you specify. CloudWatch Logs uses your log data for monitoring; so, no code changes are required. For example, you can monitor application logs for specific literal terms (such as "NullReferenceException") or count the number of occurrences of a literal term at a particular position in log data (such as "404" status codes in an Apache access log). When the term you are searching for is found, CloudWatch Logs reports the data to a CloudWatch metric that you specify. Log data is encrypted while in transit and while it is at rest. To get started, see Getting started with CloudWatch Logs. upvoted 1 times

Out of all the options ACCEPT/REJECT will be shown by VPC logs. Packet Sniffing will not show if a packet was discarded or will be discarded (depending on where you sniff). The Cloudwatch - seems more like a monitoring tool that can collect among other things, also the VPC logs but not enable them. So I would go with C as the closest answer upvoted 10 times

Selected Answer: B Only layer 7 answer. VPC flow logs is layer 4 upvoted 1 times

Question 6 (Topic 1)

Your company has a 1-Gbps AWS Direct Connect connection to AWS. Your company needs to send traffic from on-premises to a VPC owned by a partner company. The connectivity must have minimal latency at the lowest price. Which of the following connectivity options should you choose?

Select an option, then click Submit answer.

○ Create a new Direct Connect connection, and set up a new circuit to connect to the partner VPC using a private virtual interface.
○ Create a new Direct Connect connection, and leverage the existing circuit to connect to the partner VPC.
○ Create a new private virtual interface, and leverage the existing connection to connect to the partner VPC.
○ Enable VPC peering and use your VPC as a transitive point to reach the partner VPC.

Reference / correct answer:

Create a new private virtual interface, and leverage the existing connection to connect to the partner VPC.

Most accepted answer: C. Create a new private virtual interface, and leverage the existing connection to connect to the partner VPC.

Community votes: C=3

VPC peering is not transitive. D can't be correct. I suggest C upvoted 16 times clark 4 years, 10 months ago Multiple VPC Peering Connections A VPC peering connection is a one to one relationship between two VPCs. If there was more than a "one to one" relationship, you would be correct. The answer is D. upvoted 2 times piotr 4 years, 10 months ago Traffic is originated on-prem and VPC is not transitive over peering so D will not work. It would be valid only for traffic originated in that VPC. upvoted 9 times ... ...

Multiple VPC Peering Connections A VPC peering connection is a one to one relationship between two VPCs. If there was more than a "one to one" relationship, you would be correct. The answer is D. upvoted 2 times piotr 4 years, 10 months ago Traffic is originated on-prem and VPC is not transitive over peering so D will not work. It would be valid only for traffic originated in that VPC. upvoted 9 times ...

Traffic is originated on-prem and VPC is not transitive over peering so D will not work. It would be valid only for traffic originated in that VPC. upvoted 9 times

Hosted virtual interfaces To use your AWS Direct Connect connection with another account, you can create a hosted virtual interface for that account. The owner of the other account must accept the hosted virtual interface to begin using it. A hosted virtual interface works the same as a standard virtual interface and can connect to public resources or a VPC. upvoted 5 times

Between A and C I would go with A, since a DXGW is free. Option C implies additional site-to-site VPN connection costs, while with DX we already pay the port hours for us-west-2. upvoted 1 times squeeze_talus0y 3 years, 10 months ago Wrong question to comment. upvoted 1 times ...

Free ANS-C00 – Amazon ANS-C00 Practice Test Question