Question 1

Which two choices can serve as a directory service for WorkSpaces? (Choose two.)

Accepted Answer

A)  Simple AD 
B)  Enhanced AD 
C)  Direct Connection 
D)  AWS Microsoft AD 
A)  Simple AD 
B)  Enhanced AD 
C)  Direct Connection 
D)  AWS Microsoft AD

Question 2

A company uses an Application Load Balancer (ALB) to provide access to a multi-tenant web application for 25 customers. The company creates a unique hostname for each customer to use to access the application. Hostnames use the format customer-name.example.com. Each customer has a dedicated group of Amazon EC2 instances that run their own version of the web application. When a customer visits customer-name.example.com, the ALB should route the request to the correct group of EC2 instances. The company requires a highly available solution that is easy to maintain. Which solution meets these requirements at the LOWEST cost?

Accepted Answer

A)  Create one ALB for all customers. Create a listener rule that includes an HTTP header condition to match the URL. Add a forward action to route the request to the customer target group. Use Amazon Route 53 to create an alias record for each customer-name.example.com hostname that points to the ALB. 
B)  Create one ALB for each customer. Configure the listener to route requests to the customer target group. Configure an NGINX proxy server to manage connections to each ALB. Use Amazon Route 53 to create a CNAME record for each customer-name.example.com hostname that points to the NGINX proxy server. 
C)  Create one ALB for all customers. Create a listener rule that includes a Host header condition to match the hostname. Add a forward action to route the request to the customer target group. Use Amazon Route 53 to create an alias record for each customer-name.example.com hostname that points to the ALB. 
D)  Create one ALB for each customer. Configure the listener to route requests to the customer target group. Create an Amazon CloudFront distribution. Add each ALB to the distribution as a custom origin. Use Amazon Route 53 to create an alias for each customer-name.example.com hostname that points to the CloudFront distribution. 
A)  Create one ALB for all customers. Create a listener rule that includes an HTTP header condition to match the URL. Add a forward action to route the request to the customer target group. Use Amazon Route 53 to create an alias record for each customer-name.example.com hostname that points to the ALB. 
B)  Create one ALB for each customer. Configure the listener to route requests to the customer target group. Configure an NGINX proxy server to manage connections to each ALB. Use Amazon Route 53 to create a CNAME record for each customer-name.example.com hostname that points to the NGINX proxy server. 
C)  Create one ALB for all customers. Create a listener rule that includes a Host header condition to match the hostname. Add a forward action to route the request to the customer target group. Use Amazon Route 53 to create an alias record for each customer-name.example.com hostname that points to the ALB. 
D)  Create one ALB for each customer. Configure the listener to route requests to the customer target group. Create an Amazon CloudFront distribution. Add each ALB to the distribution as a custom origin. Use Amazon Route 53 to create an alias for each customer-name.example.com hostname that points to the CloudFront distribution.

Question 3

A company is running services in a VPC with a CIDR block of 10.5.0.0/22. End users report that they no longer can provision new resources because some of the subnets in the VPC have run out of IP addresses. How should a network engineer resolve this issue?

Accepted Answer

A)  Add 10.5.2.0/23 as a second CIDR block to the VPC. Create a new subnet with a new CIDR block, and provision new resources in the new subnet. 
B)  Add 10.5.4.0/21 as a second CIDR block to the VPC. Assign a second network from this CIDR block to the existing subnets that have run out of IP addresses. 
C)  Add 10.5.4.0/22 as a second CIDR block to the VPC. Assign a second network from this CIDR block to the existing subnets that have run out of IP addresses. 
D)  Add 10.5.4.0/22 as a second CIDR block to the VPC. Create a new subnet with a new CIDR block, and provision new resources in the new subnet. 
A)  Add 10.5.2.0/23 as a second CIDR block to the VPC. Create a new subnet with a new CIDR block, and provision new resources in the new subnet. 
B)  Add 10.5.4.0/21 as a second CIDR block to the VPC. Assign a second network from this CIDR block to the existing subnets that have run out of IP addresses. 
C)  Add 10.5.4.0/22 as a second CIDR block to the VPC. Assign a second network from this CIDR block to the existing subnets that have run out of IP addresses. 
D)  Add 10.5.4.0/22 as a second CIDR block to the VPC. Create a new subnet with a new CIDR block, and provision new resources in the new subnet.

Question 4

You can turn on the AWS Config service from the AWS CLI by running the subscribe command and passing as parameters a valid IAM role, SNS topic, and ____.

Accepted Answer

A)  EBS volume 
B)  EC2 instance 
C)  S3 bucket 
D)  Kinesis stream 
A)  EBS volume 
B)  EC2 instance 
C)  S3 bucket 
D)  Kinesis stream

Question 5

You have a Simple AD deployment, and you wish to use it for your Microsoft Exchange email server. You are having issues finding the AD server, why might this be?

Accepted Answer

A)  You need to contact AWS to receive a PTR record for your email server. 
B)  Your firewall is blocking it. 
C)  Simple AD is not a full Active Directory server and will not work with many MS products. 
D)  SSL is not implemented. 
A)  You need to contact AWS to receive a PTR record for your email server. 
B)  Your firewall is blocking it. 
C)  Simple AD is not a full Active Directory server and will not work with many MS products. 
D)  SSL is not implemented.

Question 6

An AWS CloudTrail log file provides the identity and source IP address of the API caller, and a time of the API call, request parameters, and ____.

Accepted Answer

A)  response elements 
B)  event selectors 
C)  port alarms 
D)  destination buckets 
A)  response elements 
B)  event selectors 
C)  port alarms 
D)  destination buckets

Question 7

An application runs on a fleet of Amazon EC2 instances in a VPC. All instances can reach one another using private IP addresses. The application owner has a new requirement that the domain name received via DHCP should be different for a particular set of instances that are currently in one particular subnet. What changes should be made to meet this requirement while continuing to support the existing application requirements?

Accepted Answer

A)  Modify the existing DHCP option set and specify the different domain name for the specified subnet. 
B)  Create a new DHCP option set with the different domain name, associate it with the specified subnet, and re-launch the Amazon EC2 instances. 
C)  Create a new subnet, configure the DHCP option set with the different domain name, and re-launch the required instances there. 
D)  Create a new peered VPC, configure the DHCP option set with the different domain name, and re-launch the required instances there. 
A)  Modify the existing DHCP option set and specify the different domain name for the specified subnet. 
B)  Create a new DHCP option set with the different domain name, associate it with the specified subnet, and re-launch the Amazon EC2 instances. 
C)  Create a new subnet, configure the DHCP option set with the different domain name, and re-launch the required instances there. 
D)  Create a new peered VPC, configure the DHCP option set with the different domain name, and re-launch the required instances there.

Question 8

You are auditing an AWS infrastructure after you noticed some abnormal charges on the bill. You use AWS Config to monitor your changes. What else is required to find out who made the change?

Accepted Answer

A)  There is no information to find this. You will need to sign up for Config Premium. 
B)  Use the eventID of the change and reference it with your Flow Logs. 
C)  Use the eventId of the change and reference it with CloudTrail to find the culprit. 
D)  Use the eventID of the change and reference it with CloudWatch to find the culprit. 
A)  There is no information to find this. You will need to sign up for Config Premium. 
B)  Use the eventID of the change and reference it with your Flow Logs. 
C)  Use the eventId of the change and reference it with CloudTrail to find the culprit. 
D)  Use the eventID of the change and reference it with CloudWatch to find the culprit.

Question 9

In the context of Amazon CloudFront Actions, you use the _____ when specifying APIs in IAM policies.

Accepted Answer

A)  object names 
B)  class names 
C)  entity names 
D)  action names 
A)  object names 
B)  class names 
C)  entity names 
D)  action names

Question 10

In AWS, which service provides a reliable and inexpensive way to backup and archive CloudTrail log files?

Accepted Answer

A)  Amazon Archiver 
B)  Amazon Glacier 
C)  AWS Storage Gateway 
D)  Amazon Elastic Block Store 
A)  Amazon Archiver 
B)  Amazon Glacier 
C)  AWS Storage Gateway 
D)  Amazon Elastic Block Store

Question 11

A company has an AWS Direct Connect connection between its on-premises data center and Amazon VPC. An application running on an Amazon EC2 instance in the VPC needs to access confidential data stored in the on-premises data center with consistent performance. For compliance purposes, data encryption is required. What should the network engineer do to meet these requirements?

Accepted Answer

A)  Configure a public virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC. 
B)  Configure a private virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC. 
C)  Configure an internet gateway in the VPC. Set up a software VPN between the customer gateway and an EC2 instance in the VPC. 
D)  Configure an internet gateway in the VPC. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC. 
A)  Configure a public virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC. 
B)  Configure a private virtual interface on the Direct Connect connection. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC. 
C)  Configure an internet gateway in the VPC. Set up a software VPN between the customer gateway and an EC2 instance in the VPC. 
D)  Configure an internet gateway in the VPC. Set up an AWS Site-to-Site VPN between the customer gateway and the virtual private gateway in the VPC.

Question 12

After setting an AWS Direct Connect, which of the following cannot be done with an AWS Direct Connect Virtual Interface?

Accepted Answer

A)  You can delete a virtual interface; if its connection has no other virtual interfaces, you can delete the connection. 
B)  You can change the region of your virtual interface. 
C)  You can create a hosted virtual interface. 
D)  You can exchange traffic between the two ports in the same region connecting to different Virtual Private Gateways (VGWs) if you have more than one virtual interface. 
A)  You can delete a virtual interface; if its connection has no other virtual interfaces, you can delete the connection. 
B)  You can change the region of your virtual interface. 
C)  You can create a hosted virtual interface. 
D)  You can exchange traffic between the two ports in the same region connecting to different Virtual Private Gateways (VGWs) if you have more than one virtual interface.

Question 13

A company's web application is deployed on Amazon EC2 instances behind a public Application Load Balancer. The application flags malicious requests and uses an AWS Lambda function to add the offending IP addresses to the network ACL to block any further requests for 24 hours. Recently, the application has been receiving more malicious requests, which causes the network ACL to reach its limit of allowed entries. Which action should be taken to block more IP addresses, without compromising the existing security requirements?

Accepted Answer

A)  Update the AWS Lambda function to remove blocked entries from the network ACL after 2 hours. 
B)  Update the AWS Lambda function to block malicious IPs in security groups rather than the network ACL. 
C)  Update the AWS Lambda function to block malicious IPs in AWS WAF attached to the Application Load Balancer. 
D)  Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached. 
A)  Update the AWS Lambda function to remove blocked entries from the network ACL after 2 hours. 
B)  Update the AWS Lambda function to block malicious IPs in security groups rather than the network ACL. 
C)  Update the AWS Lambda function to block malicious IPs in AWS WAF attached to the Application Load Balancer. 
D)  Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached.

Question 14

Select the answer/s that correctly state how Jumbo Frames work

Accepted Answer

A)  Jumbo Frames assist with application disk storage 
B)  Jumbo Frames can assist with application performance 
C)  Jumbo Frames are supported across Virtual Private Gateway connections 
D)  Jumbo Frames are enabled by increasing the MTU size to 9000 kilobytes 
A)  Jumbo Frames assist with application disk storage 
B)  Jumbo Frames can assist with application performance 
C)  Jumbo Frames are supported across Virtual Private Gateway connections 
D)  Jumbo Frames are enabled by increasing the MTU size to 9000 kilobytes

Question 15

A Lambda function needs to access the private address of an Amazon ElastiCache cluster in a VPC. The Lambda function also needs to write messages to Amazon SQS. The Lambda function has been configured to run in a subnet in the VPC. Which of the following actions meet the requirements? (Choose two.)

Accepted Answer

A)  The Lambda function needs an IAM role to access Amazon SQS 
B)  The Lambda function must route through a NAT gateway or NAT instance in another subnet to access the public SQS API. 
C)  The Lambda function must be assigned a public IP address to access the public Amazon SQS API. 
D)  The ElastiCache server outbound security group rules must be configured to permit the Lambda function's security group. 
E)  The Lambda function must consume auto-assigned public IP addresses but not elastic IP addresses. 
A)  The Lambda function needs an IAM role to access Amazon SQS 
B)  The Lambda function must route through a NAT gateway or NAT instance in another subnet to access the public SQS API. 
C)  The Lambda function must be assigned a public IP address to access the public Amazon SQS API. 
D)  The ElastiCache server outbound security group rules must be configured to permit the Lambda function's security group. 
E)  The Lambda function must consume auto-assigned public IP addresses but not elastic IP addresses.

Question 16

An architecture is being designed to support an Amazon WorkSpaces deployment of 1,000 desktops. Which architecture will support this deployment while allowing for future expansion?

Accepted Answer

A)  A VPC with a /16 CIDR and one /21 subnet 
B)  A VPC with a /20 CIDR and two /21 subnets 
C)  A VPC with a /16 CIDR and one /22 subnet 
D)  A VPC with a /20 CIDR and two /23 subnets 
A)  A VPC with a /16 CIDR and one /21 subnet 
B)  A VPC with a /20 CIDR and two /21 subnets 
C)  A VPC with a /16 CIDR and one /22 subnet 
D)  A VPC with a /20 CIDR and two /23 subnets

Question 17

You need to set up an Amazon Elastic Compute Cloud (EC2) instance for an application that requires the lowest latency and the highest packet-per-second network performance. The application will talk to other servers in a peered VPC. Which two of the following components should be part of the design? (Choose two.)

Accepted Answer

A)  Select an instance with support for single root I/O virtualization. 
B)  Select an instance that has support for multiple ENAs. 
C)  Ensure that the instance supports jumbo frames and set 9001 MTU. 
D)  Select an instance with Amazon Elastic Block Store (EBS)-optimization. 
E)  Ensure that proper OS drivers are installed. 
A)  Select an instance with support for single root I/O virtualization. 
B)  Select an instance that has support for multiple ENAs. 
C)  Ensure that the instance supports jumbo frames and set 9001 MTU. 
D)  Select an instance with Amazon Elastic Block Store (EBS)-optimization. 
E)  Ensure that proper OS drivers are installed.

Question 18

A company with several VPCs in the us-east-1 Region wants to reduce the cost of its workloads. A network engineer has identified that all traffic bound to Amazon services is flowing through a NAT gateway. Additionally, all the VPCs are peered to a hub VPC for access to common services. What should the network engineer do to reduce data transfer costs to Amazon Simple Queue Service (Amazon SQS)?

Accepted Answer

A)  Disable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain us-east-1.sqs.amazonaws.com. Create a CNAME record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs. 
B)  Disable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain sqs.us-east-1.amazonaws.com. Create an alias record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs. 
C)  Enable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain sqs.us-east-1.amazonaws.com. Create a CNAME record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs. 
D)  Enable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain us-east-1.sqs.amazonaws.com. Create an alias record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs. 
A)  Disable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain us-east-1.sqs.amazonaws.com. Create a CNAME record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs. 
B)  Disable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain sqs.us-east-1.amazonaws.com. Create an alias record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs. 
C)  Enable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain sqs.us-east-1.amazonaws.com. Create a CNAME record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs. 
D)  Enable the private DNS name for the SQS endpoint. Create an Amazon Route 53 private hosted zone for the domain us-east-1.sqs.amazonaws.com. Create an alias record to the DNS name of the SQS endpoint. Share the private hosted zone with all other VPCs.

Question 19

You are configuring multiple Direct Connect links for your organization and need them to be in an HA Active/Passive configuration with extreme sensitivity to outages in order to encourage very quick failover times. You also need to be able to control which link is active. What two configuration changes should you implement? (Choose two.)

Accepted Answer

A)  MPLS 
B)  BFD 
C)  AS_PATH Prepending 
D)  BGP 
A)  MPLS 
B)  BFD 
C)  AS_PATH Prepending 
D)  BGP

Question 20

A Network Engineer needs to create a public virtual interface on the company's AWS Direct Connect connection and only import routes which originated from the same region as the Direct Connect location. What action should accomplish this?

Accepted Answer

A)  Configure a prefix list on the customer router containing the AWS IP address ranges for the specific region. 
B)  Configure a filter on the company's router to only import routes with the 7224:8100 BGP community attribute. Configure a filter on the company's router to only import routes with the 7224:8100 BGP community attribute. 
C)  Configure a filter on the company's router to only import routes without a BGP community attribute and a maximum path length of 3. 
D)  Configure a filter in the console and only allow routes advertised by AWS without a BGP community attribute and a maximum path length of 3. 
A)  Configure a prefix list on the customer router containing the AWS IP address ranges for the specific region. 
B)  Configure a filter on the company's router to only import routes with the 7224:8100 BGP community attribute. Configure a filter on the company's router to only import routes with the 7224:8100 BGP community attribute. 
C)  Configure a filter on the company's router to only import routes without a BGP community attribute and a maximum path length of 3. 
D)  Configure a filter in the console and only allow routes advertised by AWS without a BGP community attribute and a maximum path length of 3.

Which two choices can serve as a directory service for WorkSpaces? (Choose two.)

A company is running services in a VPC with a CIDR block of 10.5.0.0/22. End users report that they no longer can provision new resources because some of the subnets in the VPC have run out of IP addresses. How should a network engineer resolve this issue?

You can turn on the AWS Config service from the AWS CLI by running the subscribe command and passing as parameters a valid IAM role, SNS topic, and ____.

You have a Simple AD deployment, and you wish to use it for your Microsoft Exchange email server. You are having issues finding the AD server, why might this be?

An AWS CloudTrail log file provides the identity and source IP address of the API caller, and a time of the API call, request parameters, and ____.

You are auditing an AWS infrastructure after you noticed some abnormal charges on the bill. You use AWS Config to monitor your changes. What else is required to find out who made the change?

In the context of Amazon CloudFront Actions, you use the _____ when specifying APIs in IAM policies.

In AWS, which service provides a reliable and inexpensive way to backup and archive CloudTrail log files?

After setting an AWS Direct Connect, which of the following cannot be done with an AWS Direct Connect Virtual Interface?

Select the answer/s that correctly state how Jumbo Frames work

A Lambda function needs to access the private address of an Amazon ElastiCache cluster in a VPC. The Lambda function also needs to write messages to Amazon SQS. The Lambda function has been configured to run in a subnet in the VPC. Which of the following actions meet the requirements? (Choose two.)

An architecture is being designed to support an Amazon WorkSpaces deployment of 1,000 desktops. Which architecture will support this deployment while allowing for future expansion?

A Network Engineer needs to create a public virtual interface on the company's AWS Direct Connect connection and only import routes which originated from the same region as the Direct Connect location. What action should accomplish this?

AWS Certified Alexa Skill Builder - Specialty

AWS Certified Cloud Practitioner (CLF-C01)

AWS Certified Data Analytics - Specialty (DAS-C01)

AWS Certified Database - Specialty

AWS Certified Developer Associate (DVA-C01)

AWS Certified Machine Learning - Specialty (MLS-C01)

AWS Certified Security - Specialty (SCS-C01)

AWS Certified Solutions Architect - Associate SAA-C02

AWS Certified Solutions Architect - Professional (SAP-C01)

AWS Certified SysOps Administrator - Associate (SOA-C02)

AWS DevOps Engineer - Professional (DOP-C01)

AWS Certified SysOps Administrator (SOA-C01)

Filters

Exam 1: AWS Certified Advanced Networking - Specialty (ANS-C00)

Which two choices can serve as a directory service for WorkSpaces? (Choose two.)

A company is running services in a VPC with a CIDR block of 10.5.0.0/22. End users report that they no longer can provision new resources because some of the subnets in the VPC have run out of IP addresses. How should a network engineer resolve this issue?

You can turn on the AWS Config service from the AWS CLI by running the subscribe command and passing as parameters a valid IAM role, SNS topic, and ____.

You have a Simple AD deployment, and you wish to use it for your Microsoft Exchange email server. You are having issues finding the AD server, why might this be?

An AWS CloudTrail log file provides the identity and source IP address of the API caller, and a time of the API call, request parameters, and ____.

You are auditing an AWS infrastructure after you noticed some abnormal charges on the bill. You use AWS Config to monitor your changes. What else is required to find out who made the change?

In the context of Amazon CloudFront Actions, you use the _____ when specifying APIs in IAM policies.

In AWS, which service provides a reliable and inexpensive way to backup and archive CloudTrail log files?

After setting an AWS Direct Connect, which of the following cannot be done with an AWS Direct Connect Virtual Interface?

Select the answer/s that correctly state how Jumbo Frames work

A Lambda function needs to access the private address of an Amazon ElastiCache cluster in a VPC. The Lambda function also needs to write messages to Amazon SQS. The Lambda function has been configured to run in a subnet in the VPC. Which of the following actions meet the requirements? (Choose two.)

An architecture is being designed to support an Amazon WorkSpaces deployment of 1,000 desktops. Which architecture will support this deployment while allowing for future expansion?

A Network Engineer needs to create a public virtual interface on the company's AWS Direct Connect connection and only import routes which originated from the same region as the Direct Connect location. What action should accomplish this?

AWS Certified Alexa Skill Builder - Specialty

AWS Certified Cloud Practitioner (CLF-C01)

AWS Certified Data Analytics - Specialty (DAS-C01)

AWS Certified Database - Specialty

AWS Certified Developer Associate (DVA-C01)

AWS Certified Machine Learning - Specialty (MLS-C01)

AWS Certified Security - Specialty (SCS-C01)

AWS Certified Solutions Architect - Associate SAA-C02

AWS Certified Solutions Architect - Professional (SAP-C01)

AWS Certified SysOps Administrator - Associate (SOA-C02)

AWS DevOps Engineer - Professional (DOP-C01)

AWS Certified SysOps Administrator (SOA-C01)

Filters