← Back to exam page

Free AWS-CERTIFIED-ADVANCED-NETWORKING-SPECIALTY-ANS-C01 – Amazon AWS-CERTIFIED-ADVANCED-NETWORKING-SPECIALTY-ANS-C01 Practice Test Question

Loading demo links...

Showing 22–24 of 30 questions

Question 22 (Topic 1)

A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edge location in the us-west-1 Region. A shared services segment exists at both edge locations. Each shared services segment has a VPC attachment to each inspection VPC in each Region. The inspection VPCs inspect traffic from a WAN by using AWS Network Firewall. The company creates a new segment for a new business unit (BU) in the us-east-1 edge location. The new BU has three VPCs that are attached to the new BU segment. To comply with regulations, the BU VPCs must not communicate with each other. All internet-bound traffic must be inspected in the inspection VPC. The company updates VPC route tables so any traffic that is bound for internet goes to the AWS Cloud WAN core network. The company plans to add more VPCs for the new BU in the future. All future VPCs must comply with regulations. Which solution will meet these requirements in the MOST operationally efficient way? (Choose two.)

Select an option, then click Submit answer.

  • ○ Update the network policy to share the shared services segment with the BU segment.
  • ○ Create a network policy to share the inspection service segment with the BU segment.
  • ○ Set the isolate-attachments field to True for the BU segment.
  • ○ Set the isolate-attachments field to False for the BU segment.
  • ○ Update the network policy to add static routes for the BU segment. Configure the shared services segment to route traffic related to VPC CIDR blocks to each respective VPC attachment.
Question 23 (Topic 1)

A company runs applications in two VPCs that are in separate AWS Regions. One VPC is in the us-east-1 Region. The second VPC is in the us-west-1 Region. The company needs to establish connectivity between the two VPCs. The company also needs to connect the VPCs to applications that run in an on-premises data center. The current traffic requirement between the VPCs is 50 ТВ per month. The company expects traffic volume between the VPCs to increase. The traffic requirement from the VPCs to the on-premises data center is 10 ТВ per month. The company expects the traffic between the VPCs and the data center to remain constant. Which solution will meet these requirements MOST cost-effectively?

Select an option, then click Submit answer.

  • ○ Create a transit gateway in each Region. Create VPN connections from the transit gateways to the on-premises firewall. Create a peering connection between the transit gateways.
  • ○ Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Configure the on-premises firewall to route the traffic between the two VPCs.
  • ○ Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Create a VPC peering connection between the two VPCs.
  • ○ Create a virtual private gateway in each Region. Create VPN connections from the on-premises firewall to the virtual private gateways. Create a VPN connection between the virtual private gateways.
Question 24 (Topic 1)

A company is migrating its internet VPN connections to dedicated AWS Direct Connect connections. The company needs to set up the Direct Connect connections so that all network communications are encrypted in transit. Which combination of steps will meet this requirement? (Choose three.)

Select an option, then click Submit answer.

  • ○ Create new Direct Connect connections while requesting MACsec ports.
  • ○ Create a MACsec Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair. Associate the pair with each new connection.
  • ○ Update the on-premises routers to use MACsec and the shared Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair.
  • ○ Create a shared key for an IPsec connection.
  • ○ Configure a new Direct Connect gateway. Associate the shared key with the new Direct Connect gateway.
  • ○ Set up IPsec on the on-premises router. Associate the shared key with the IPsec configuration.