Free AWS-CERTIFIED-ADVANCED-NETWORKING-SPECIALTY-ANS-C01 – Amazon AWS-CERTIFIED-ADVANCED-NETWORKING-SPECIALTY-ANS-C01 Practice Test Question

Loading demo links...

Showing 16–18 of 30 questions

Question 16 (Topic 1)

A company's VPC has Amazon EC2 instances that are communicating with AWS services over the public internet. The company needs to change the connectivity so that the communication does not occur over the public internet. The company deploys AWS PrivateLink endpoints in the VPC. After the deployment of the PrivateLink endpoints, the EC2 instances can no longer communicate at all with the required AWS services. Which combination of steps should a network engineer take to restore communication with the AWS services? (Choose two.)

Select an option, then click Submit answer.

○ In the VPC route table, add a route that has the PrivateLink endpoints as the destination.
○ Ensure that the enableDnsSupport attribute is set to True for the VPC. Ensure that each VPC endpoint has DNS support enabled.
○ Ensure that the VPC endpoint policy allows communication.
○ Create an Amazon Route 53 public hosted zone for all services.
○ Create an Amazon Route 53 private hosted zone that includes a custom name for each service.

Reference / correct answer:

Ensure that the enableDnsSupport attribute is set to True for the VPC. Ensure that each VPC endpoint has DNS support enabled.

Most accepted answer: B. Ensure that the enableDnsSupport attribute is set to True for the VPC. Ensure that each VPC endpoint has DNS support enabled.

Community votes: B=3, C=3

Selected Answer: BC A is incorrect: Adding routes to the PrivateLink endpoints in the route table is not necessary for endpoint communication D is incorrect: Creating a public hosted zone is not the right approach for private connectivity E is incorrect: While private hosted zones can be useful, they are not directly required to restore PrivateLink endpoint communication upvoted 2 times

Selected Answer: BC The most effective steps are B and C. Ensuring that DNS support is enabled for both the VPC and the PrivateLink endpoints, along with verifying that the VPC endpoint policy permits the required access, will restore the necessary communication between the EC2 instances and the AWS services over the private network. These steps ensure that the services are correctly resolved and accessible while maintaining security and privacy through the AWS network. upvoted 3 times

Selected Answer: BC A. This is not a VPC Gateway Endpoint. B. You need to use AmazonProvidedDNS, so this is doable option. C. VPC endpoint policy might block the connection, so possible cause. D & E. You don't need to use the R53 Hosted Zone for this scenario. upvoted 3 times

Question 17 (Topic 1)

A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all inbound traffic to the ALB to come from CloudFront. The network engineer must implement the solution at the network layer rather than in the application. Which solution will meet these requirements in the MOST operationally efficient way?

Select an option, then click Submit answer.

○ Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.
○ Add an inbound rule to the network ACLs that are associated with the ALB's subnets. Use the AWS managed prefix list for CloudFront as the source in the rule.
○ Configure CloudFront to add a custom HTTP header to the requests that CloudFront sends to the ALB.
○ Associate an AWS WAF web ACL with the ALB. Configure the AWS WAF rules to allow traffic from the CloudFront IP set. Automatically update the CloudFront IP set by using an AWS Lambda function.

Reference / correct answer:

Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.

Most accepted answer: A. Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.

Community votes: A=4, C=1

It is asking a solution at network layer rather than application layer. Therefore it is A in my opinion. A managed prefix list is a set of one or more CIDR blocks. You can use prefix lists to make it easier to configure and maintain your security groups and route tables. upvoted 7 times

Selected Answer: A A is right Adding an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront ensures that only traffic coming from CloudFront is allowed to reach the ALB. This meets the requirement of having all inbound traffic to the ALB come from CloudFront. upvoted 3 times

Selected Answer: A AWS Managed Prefix List for CloudFront: AWS provides a managed prefix list that includes the IP ranges for CloudFront edge locations. By using this list in the ALB's security group, the network engineer can restrict access to only traffic originating from CloudFront without manually managing IP ranges. Operational Efficiency: This approach is operationally efficient because: The managed prefix list is automatically updated by AWS whenever CloudFront's IP ranges change. Security groups are simple to configure and maintain compared to other options like network ACLs or AWS WAF. upvoted 2 times

C - This defines the solution https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/restrict-access-to-load-balancer.html upvoted 1 times Spaurito 1 year, 8 months ago Have to change my answer to "A". A defined for the network layer requirement. upvoted 1 times ...

Have to change my answer to "A". A defined for the network layer requirement. upvoted 1 times

Question 18 (Topic 1)

A company is migrating an application to the AWS Cloud. The company has successfully provisioned and tested connectivity between AWS Direct Connect and the company's on-premises data center. The application runs on Amazon EC2 instances across multiple Availability Zones. The instances are in an Auto Scaling group. The application communicates through HTTPS to a third-party vendor's data service that is hosted at the company’s data center. The data service implements a static ACL through explicit allow listing of client IP addresses. A network engineer must design a network solution so that the migrated application can continue to access the vendor’s data service as the application scales. Which solution will meet these requirements with the LEAST amount of ongoing change to the vendor's allow list?

Select an option, then click Submit answer.

○ Configure a private NAT gateway in the subnets for each Availability Zone that the application runs in. Configure the application to target the NAT gateways instead of the data service directly. Update the data service's allow list to include the IP addresses of the NAT gateways.
○ Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Associate the elastic network interfaces with the Auto Scaling group for the application. Update the data service's allow list to include the IP addresses of the elastic network interfaces.
○ Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Launch an EC2 instance into each subnet. Attach the respective elastic network interfaces to the new EC2 instances. In the application subnet route tables, configure the new EC2 instances as the next destination for the data service. Update the data service’s allow list to include the IP addresses of the elastic network interfaces.
○ Configure an Application Load Balancer (ALB) in the subnets for each Availability Zone that the application runs in. Configure an ALB-associated target group that contains a target that uses the IP address for the data service. Configure the application to target the ALB instead of the data service directly. Update the data service's allow list to include the IP addresses of the ALBs.

Reference / correct answer:

Configure a private NAT gateway in the subnets for each Availability Zone that the application runs in. Configure the application to target the NAT gateways instead of the data service directly. Update the data service's allow list to include the IP addresses of the NAT gateways.

Most accepted answer: A. Configure a private NAT gateway in the subnets for each Availability Zone that the application runs in. Configure the application to target the NAT gateways instead of the data service directly. Update the data service's allow list to include the IP addresses of the NAT gateways.

Community votes: A=4

Selected Answer: A A ... but I'm not ok with "Configure the application to target the NAT gateways instead of the data service directly." => the subnet route tables should be modified ... NOT the application itself. upvoted 4 times

Selected Answer: A By using a private NAT gateway, the solution ensures that the vendor's data service always sees the same IP address, minimizing the need for ongoing updates to the allow list while allowing the application to scale. upvoted 2 times

Selected Answer: A this is A upvoted 1 times

Selected Answer: A VOTE A upvoted 2 times

The correct answer is D. Considering the simplicity of managing the allow list and the automation of load balancing, option D, using an Application Load Balancer (ALB), is the optimal solution. However, if managing the allow list is not an issue or if direct communication is required due to specific requirements, option B, using an Elastic Network Interface (ENI), is also a strong choice. upvoted 1 times jhon648274 1 year, 11 months ago Application load balancer ip is not static and it can change thus why is not an optimal solution upvoted 3 times ...

← Prev 1 2 3 4 5 6 7 8 9 10 Next →

Page 6 of 10

Sale Ends In

2h 0m 0s