Question 1

You have two VPCs that you've peered. You created a route for VPC A to get to an instance in VPC. You are unable to ping the instance. You have double checked your security groups and NACLs. Why might this be?

Accepted Answer

A)  You forgot to add a return route. 
B)  ICMP is not supported over peering connections. 
C)  You have to enable Source/Destination check in the VPCs. 
D)  You have to configure the peering connection to allow two way traffic.

Question 2

A network engineer is managing two AWS Direct Connect connections. Each connection has a public virtual interface configured with a private ASN. The engineer wants to configure active/passive routing between the Direct Connect connections to access Amazon public endpoints. What BGP configuration is required for the on-premises equipment? (Choose two.)

Accepted Answer

A)  Use Local Pref to control outbound traffic. 
B)  Use AS Prepending to control inbound traffic. 
C)  Use eBGP multi-hop between loopback interfaces. 
D)  Use BGP Communities to control outbound traffic. 
E)  Advertise more specific prefixes over one Direct Connect connection.

Question 3

Which path will be chosen first?

Accepted Answer

A)  192.168.0.0/16 AS 65000 over Direct Connect 
B)  192.0.0.0/8 AS 65000 over Direct Connect 
C)  192.168.1.0/24 AS 65000 65000 65000 over a Dynamic VPN 
D)  192.168.0.0/16 AS 65000 over a Static VPN

Question 4

Your organization has placed a project on hold and has stopped 30 public EC2 instances. These instances use instance store volumes and do not have custom AMIs associated. You are still being charged every month. What is the charge probably for?

Accepted Answer

A)  AWS charges for dormant accounts. 
B)  You have Elastic IPs associated with those instances. 
C)  There is a "stopped instance" fee that AWS charges every month. 
D)  You are being charged for the EBS volumes.

Question 5

What are two routing methods used by Route 53? (Choose two.)

Accepted Answer

A)  RIP 
B)  Failover 
C)  Latency 
D)  AS_PATH

Question 6

You would like to ensure that all Amazon S3 buckets going forward, current and newly created ones, have logging enabled. What type of trigger(s) should you use?

Accepted Answer

A)  only a periodic trigger 
B)  only a configuration change trigger 
C)  both configuration change and periodic triggers 
D)  only a transitioning trigger

Question 7

You are a network admin of a US company called Webby Widgets that is expanding to Europe. The company has a website that serves dynamic and static content. You have been instructed to ensure the European clients receive the least latency possible, no matter where in Europe they live, while still allowing the US clients to receive the same user experience and performance they have been accustomed to. You have also been instructed to ensure both countries use the same URL to access the site and keep costs low. What two things should you do? (Choose two.)

Accepted Answer

A)  Deploy three VPCs; one for the US, one for the EU, and one as a central VPC that hosts an Elastic Load Balancer that will distribute traffic between the US and EU VPCs. 
B)  Create two A records: eu.webbywidgets.com that points to the EU resources and us.webbywidgets.com that points to the US resources. 
C)  Use the Traffic Flow policy creator to create the perfect routing policy. 
D)  Create a CloudFront distribution to serve the static content from an S3 bucket.

Question 8

Your company has signed up to trial AWS WorkSpaces. You aren't sure you're going to keep it, but you want to try it out to see if it works for your organization of 112 users. You need to deploy it with as little work and up-front expense as possible while still allowing access to your Active Directory for authentication. What two things should you do? (Choose two.)

Accepted Answer

A)  Create a VPN connection. 
B)  Create an AD connector 
C)  Setup AWS hosted Microsoft AD 
D)  Create a Direct Connect connection to AWS.

Question 9

Your company needs an inexpensive solution to host their AD data in the cloud. They do not need all of the features of AD but do need to be able to use it with WorkSpaces. What is the best solution?

Accepted Answer

A)  AD Connector 
B)  Hosted Microsoft AD 
C)  Simple AD 
D)  Deploy an AD server on an M3.large instance

Question 10

You need to ensure the files served by your CloudFront distribution are only accessible to authorized users. You hope to serve thousands of users. What two steps should you take? (Choose two.)

Accepted Answer

A)  Configure signed cookies. 
B)  Configure a WAF. 
C)  Configure a bucket policy restricting the bucket to only CloudFront OAI. 
D)  Configure an SSL on the distribution.

Question 11

You need to set up an Amazon Elastic Compute Cloud (EC2) instance for an application that requires the lowest latency and the highest packet-per-second network performance. The application will talk to other servers in a peered VPC. Which two of the following components should be part of the design? (Select two.)

Accepted Answer

A)  Select an instance with support for single root I/O virtualization. 
B)  Select an instance that has support for multiple ENIs. 
C)  Ensure that the instance supports jumbo frames and set 9001 MTU. 
D)  Select an instance with Amazon Elastic Block Store (EBS)-optimization. 
E)  Ensure that proper OS drivers are installed.

Question 12

How many BGP advertised routes can you have per route table?

Accepted Answer

A)  50 
B)  200 
C)  100 
D)  As many as you want as long as you contact AWS first.

Question 13

Which statement about Elastic IP addresses is incorrect?

Accepted Answer

A)  Additional EIPs associated with one instance incur a charge. 
B)  Once an EIP is associated with an instance, you must manually change the hostname if you want it to match. 
C)  Once you associate an EIP with an instance, the original public IP is released. 
D)  Disassociated EIPs incur a charge.

Question 14

You need to find the subnet, the security group and the VPC that your instance is associated with. You only have access to the terminal of an instance with an admin role attached. What is the first part of the command you would use?

Accepted Answer

A)  aws ec2 describe-network-acl 
B)  aws ec2 describe-instances 
C)  aws vpc describe-all 
D)  aws ec2 describe-security-groups

Question 15

You are deploying a web application in a VPC that requires SSL mutual authentication with a client- side, smartcard-stored certificate. The ELB Classic Load Balancer listener must support mutual authentication between the client and the application. Which load balancer protocol should you select for this application?

Accepted Answer

A)  HTTP 
B)  HTTPS 
C)  SSL 
D)  TCP

Question 16

What number does the binary number 10101000 correspond to?

Accepted Answer

A)  168 
B)  128 
C)  192 
D)  160

Question 17

Your company has installed an AWS Direct Connect connection in an ap-southeast-1 Direct Connect location. A public virtual interface is configured through a router to a dedicated firewall. You advertise your company's public /24 CIDR block to AWS with AS 65500. The company maintains a separate, corporate Internet firewall to map all outbound traffic to a single IP. This firewall maintains a BGP relationship with an upstream Internet provider that has delegated the public IP block your company uses. When the BGP session for the public virtual interface is up, corporate network users cannot access Amazon S3 resources in the ap-southeast-1 region. Which step should you take to provide concurrent AWS and Internet access?

Accepted Answer

A)  Configure AS-PATH prepending for the public virtual interface. 
B)  Advertise a host route for the corporate firewall on the public virtual interface. 
C)  Advertise a host route for the corporate firewall to the upstream Internet provider. 
D)  NAT the traffic destined for AWS from the dedicated firewall using the public virtual interface.

Question 18

You are building an application that provides real-time audio and video services to customers on the Internet. The application requires high throughput. To ensure proper audio and video transmission, minimal latency is required. Which of the following will improve transmission quality?

Accepted Answer

A)  Enable enhanced networking 
B)  Select G2 instance types 
C)  Enable jumbo frames 
D)  Use multiple elastic network interfaces

Question 19

You can use the ____ page of the AWS Config console to look up resources that AWS Config has discovered, including deleted resources and resources that are not currently being recorded.

Accepted Answer

A)  snapshot listing 
B)  configuration history 
C)  resource inventory 
D)  resource database

Question 20

A company is connecting to a VPC over an AWS Direct Connect using a private VIF, and a dynamic VPN connection as a backup. The company's Reliability Engineering team has been running failover and resiliency tests on the network and the existing VPC by simulating an outage situation on the Direct Connect connection. During the resiliency tests, traffic failed to switch over to the backup VPN connection. How can this failure be troubleshot?

Accepted Answer

A)  Ensure that Bidirectional Forwarding Detection is enabled on the Direct Connect connection 
B)  Confirm that the same routes are being advertised over both the VPN and Direct Connect. 
C)  Reconfigure the Direct Connect session from static routes to Border Gateway Protocol (BGP) peering. 
D)  Configure a virtual private gateway for the VPN and another virtual private gateway for Direct Connect.

Exam 1: AWS Certified Advanced Networking - Specialty (ANS-C00)