ANS-C01 Free Practice Test

A company is using a NAT gateway to allow internet connectivity for private subnets in a VPC in the us-west-2 Region. After a security audit, the company needs to remove the NAT gateway.
In the private subnets, the company has resources that use the unified Amazon CloudWatch agent. A network engineer must create a solution to ensure that the unified CloudWatch agent continues to work after the removal of the NAT gateway.
Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

1. A. Validate that private DNS is enabled on the VPC by setting the enableDnsHostnames VPC attribute and the enableDnsSupport VPC attribute to true.
2. B. Create a new security group with an entry to allow outbound traffic that uses the TCP protocol on port 443 to destination 0.0.0.0/0
3. C. Create a new security group with entries to allow inbound traffic that uses the TCP protocol on port 443 from the IP prefixes of the private subnets.
4. D. Create the following interface VPC endpoints in the VPC: com.amazonaws.us-west-2.logs and com.amazonaws.us-west-2.monitorin
5. E. Associate the new security group with the endpoint network interfaces.
6. F. Create the following interface VPC endpoint in the VPC: com.amazonaws.us-west-2.cloudwatch.Associate the new security group with the endpoint network interfaces.
7. G. Associate the VPC endpoint or endpoints with route tables that the private subnets use.

Correct Answer: BDF

A company is using an AWS Site-to-Site VPN connection from the company's on-premises data center to a virtual private gateway in the AWS Cloud Because of congestion, the company is experiencing availability and performance issues as traffic travels across the internet before the traffic reaches AWS. A network engineer must reduce these issues for the connection as quickly as possible with minimum administration effort.
Which solution will meet these requirements?

1. A. Edit the existing Site-to-Site VPN connection by enabling acceleratio
2. B. Stop and start the VPN service on the customer gateway for the new setting to take effect.
3. C. Configure a transit gateway in the same AWS Region as the existing virtual private gatewa
4. D. Create a new accelerated Site-to-Site VPN connectio
5. E. Connect the new connection to the transit gateway by using a VPN attachmen
6. F. Update the customer gateway device to use the new Site to Site VPN connectio
7. G. Delete the existing Site-to-Site VPN connection
8. H. Create a new accelerated Site-to-Site VPN connectio
9. I. Connect the new Site-to-Site VPN connection to the existing virtual private gatewa
10. J. Update the customer gateway device to use the new Site-to-Site VPN connectio
11. K. Delete the existing Site-to-Site VPN connection.
12. L. Create a new AWS Direct Connect connection with a private VIF between the on-premises data center and the AWS Clou
13. M. Update the customer gateway device to use the new Direct Connect connectio
14. N. Delete the existing Site-to-Site VPN connection.

Correct Answer: B

A company wants to improve visibility into its AWS environment. The AWS environment consists of multiple VPCs that are connected to a transit gateway. The transit gateway connects to an on-premises data center through an AWS Direct Connect gateway and a pair of redundant Direct Connect connections that use transit VIFs. The company must receive notification each time a new route is advertised to AWS from on premises over Direct Connect.
What should a network engineer do to meet these requirements?

1. A. Enable Amazon CloudWatch metrics on Direct Connect to track the received route
2. B. Configure a CloudWatch alarm to send notifications when routes change.
3. C. Onboard Transit Gateway Network Manager to Amazon CloudWatch Logs Insight
4. D. Use Amazon EventBridge (Amazon CloudWatch Events) to send notifications when routes change.
5. E. Configure an AWS Lambda function to periodically check the routes on the Direct Connect gateway and to send notifications when routes change.
6. F. Enable Amazon CloudWatch Logs on the transit VIFs to track the received route
7. G. Create a metric filter Set an alarm on the filter to send notifications when routes change.

Correct Answer: B
https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-cloudwatch-events.html
To receive notification each time a new route is advertised to AWS from on premises over Direct Connect, a network engineer should onboard Transit Gateway Network Manager to Amazon CloudWatch Logs Insights and use Amazon EventBridge (Amazon CloudWatch Events) to send notifications when routes change (Option B). This solution allows for real-time monitoring of route changes and automatic notification when new routes are advertised.

A company’s network engineer is designing a hybrid DNS solution for an AWS Cloud workload. Individual teams want to manage their own DNS hostnames for their applications in their development environment. The solution must integrate the application-specific hostnames with the centrally managed DNS hostnames from the on-premises network and must provide bidirectional name resolution. The solution also must minimize management overhead.
Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

1. A. Use an Amazon Route 53 Resolver inbound endpoint.
2. B. Modify the DHCP options set by setting a custom DNS server value.
3. C. Use an Amazon Route 53 Resolver outbound endpoint.
4. D. Create DNS proxy servers.
5. E. Create Amazon Route 53 private hosted zones.
6. F. Set up a zone transfer between Amazon Route 53 and the on-premises DNS.

Correct Answer: ABE

An international company provides early warning about tsunamis. The company plans to use IoT devices to monitor sea waves around the world. The data that is collected by the IoT devices must reach the company’s infrastructure on AWS as quickly as possible. The company is using three operation centers around the world. Each operation center is connected to AWS through Its own AWS Direct Connect connection. Each operation center is connected to the internet through at least two upstream internet service providers.
The company has its own provider-independent (PI) address space. The IoT devices use TCP protocols for reliable transmission of the data they collect. The IoT devices have both landline and mobile internet connectivity. The infrastructure and the solution will be deployed in multiple AWS Regions. The company will use Amazon Route 53 for DNS services.
A network engineer needs to design connectivity between the IoT devices and the services that run in the AWS Cloud.
Which solution will meet these requirements with the HIGHEST availability?

1. A. Set up an Amazon CloudFront distribution with origin failove
2. B. Create an origin group for each Region where the solution is deployed.
3. C. Set up Route 53 latency-based routin
4. D. Add latency alias record
5. E. For the latency alias records, set the value of Evaluate Target Health to Yes.
6. F. Set up an accelerator in AWS Global Accelerato
7. G. Configure Regional endpoint groups andhealth checks.
8. H. Set up Bring Your Own IP (BYOIP) addresse
9. I. Use the same PI addresses for each Region where the solution is deployed.

Correct Answer: B
https://aws.amazon.com/blogs/iot/automate-global-device-provisioning-with-aws-iot-core-and-amazon-route-53