← Back to exam page

Free AWS-CERTIFIED-ADVANCED-NETWORKING-SPECIALTY-ANS-C01 – Amazon AWS-CERTIFIED-ADVANCED-NETWORKING-SPECIALTY-ANS-C01 Practice Test Question

Loading demo links...

Showing 13–15 of 30 questions

Question 13 (Topic 1)

A network engineer needs to improve the network security of an existing AWS environment by adding an AWS Network Firewall firewall to control internet-bound traffic. The AWS environment consists of five VPCs. Each VPC has an internet gateway, NAT gateways, public Application Load Balancers (ALBs), and Amazon EC2 instances. The EC2 instances are deployed in private subnets. The architecture is deployed across two Availability Zones. The network engineer must be able to configure rules for the public IP addresses in the environment, regardless of the direction of traffic. The network engineer must add the firewall by implementing a solution that minimizes changes to the existing production environment. The solution also must ensure high availability. Which combination of steps should the network engineer take to meet these requirements? (Choose two.)

Select an option, then click Submit answer.

  • ○ Create a centralized inspection VPC with subnets in two Availability Zones. Deploy Network Firewall in this inspection VPC with an endpoint in each Availability Zone.
  • ○ Configure new subnets in two Availability Zones in each VPC. Deploy Network Firewall in each VPC with an endpoint in each Availability Zone.
  • ○ Deploy Network Firewall in each VPUse existing subnets in each of the two Availability Zones to deploy Network Firewall endpoints.
  • ○ Update the route tables that are associated with the private subnets that host the EC2 instances. Add routes to the Network Firewall endpoints.
  • ○ Update the route tables that are associated with the public subnets that host the NAT gateways and the ALBs. Add routes to the Network Firewall endpoints.
Question 14 (Topic 1)

A company uses Amazon Route 53 for its DNS needs. The company's security team wants to update the DNS infrastructure to provide the most recent security posture. The security team has configured DNS Security Extensions (DNSSEC) for the domain. The security team wants a network engineer to explain who is responsible for the rotation of DNSSEC keys. Which explanation should the network administrator provide to the security team?

Select an option, then click Submit answer.

  • ○ AWS rotates the zone-signing key (ZSK). The company rotates the key-signing key (KSK).
  • ○ The company rotates the zone-signing key (ZSK) and the key-signing key (KSK).
  • ○ AWS rotates the AWS Key Management Service (AWS KMS) key and the key-signing key (KSK).
  • ○ The company rotates the AWS Key Management Service (AWS KMS) key. AWS rotates the key-signing key (KSK).
Question 15 (Topic 1)

A company has agreed to collaborate with a partner for a research project. The company has multiple VPCs in the us-east-1 Region that use CIDR blocks within 10.10.0.0/16. The VPCs are connected by a transit gateway that is named TGW-C in us-east-1. TGW-C has an Autonomous System Number (ASN) configuration value of 64520. The partner has multiple VPCs in us-east-1 that use CIDR blocks within 172.16.0.0/16. The VPCs are connected by a transit gateway that is named TGW-P in us-east-1. TGW-P has an ASN configuration value of 64530. A network engineer needs to establish network connectivity between the company's VPCs and the partner's VPCs in us-east-1. Which solution will meet these requirements with MINIMUM changes to both networks?

Select an option, then click Submit answer.

  • ○ Create a new VPC in a new account. Deploy a router from AWS Marketplace. Share TGW-C and TGW-P with the new account by using AWS Resource Access Manager (AWS RAM). Associate TGW-C and TGW-P with the new VPC. Configure the router in the new VPC to route between TGW-C and TGW-P.
  • ○ Create an IPsec VPN connection between TGW-C and TGW-P. Configure the routing between the transit gateways to use the IPsec VPN connection.
  • ○ Configure a cross-account transit gateway peering attachment between TGW-C and TGW-P. Configure the routing between the transit gateways to use the peering attachment.
  • ○ Share TGW-C with the partner account by using AWS Resource Access Manager (AWS RAM). Associate the partner VPCs with TGW-C. Configure routing in the partner VPCs and TGW-C.