AWS-Certified-Advanced-Networking-Specialty Free Practice Test

An organization is replacing a tape backup system with a storage gateway. there is currently no connectivity to AWS. Initial testing is needed.
What connection option should the organization use to get up and running at minimal cost?

1. A. Use an internet connection.
2. B. Set up an AWS VPN connection.
3. C. Provision an AWS Direct Connection private virtual interface.
4. D. Provision a Direct Connect public virtual interface.

Correct Answer: A

Your organization leverages an IP Address Management (IPAM) product to manage IP address distribution. The IPAM exposes an API. Development teams use CloudFormation to provision approved reference architectures. At deployment time, IP addresses must be allocated to the VPC. When the VPC is deleted, the IPAM must reclaim the VPC’s IP allocation.
Which method allows for efficient, automated integration of the IPAM with CloudFormation?

1. A. AWS CloudFormation parameters using the “Ref::” intrinsic function
2. B. AWS CloudFormation custom resource using an AWS Lambda invocation.
3. C. CloudFormation::OpsWorks::Stack with custom Chef configuration.
4. D. AWS CloudFormation parameters using the “Fn::FindInMap” intrinsic function.

Correct Answer: B
Cloudformation chapter under exam essentials it says "custom resources in an AWS cloudformation template allows you to configure non-aws resources not supported by AWS. You can use custom resources to make calls to an IPAM"

You currently use a single security group assigned to all nodes in a clustered NoSQL database. Only your cluster members in one region must be able to connect to each other. This security group uses a
self-referencing rule using the cluster security group’s group-id to make it easier to add or remove nodes from the cluster. You need to make this database comply with out-of-region disaster recovery requirements and ensure that the network traffic between the nodes is encrypted when travelling between regions. How should you enable secure cluster communication while deploying additional cluster members in another AWS region?

1. A. Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group rules that reference each other’s security group-id in each region.
2. B. Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region.
3. C. Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region.
4. D. Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group rules that reference each other’s security group-id in each region.

Correct Answer: B

A company is connecting to a VPC over an AWS Direct Connect using a private VIF, and a dynamic VPN connection as a backup. The company's Reliability Engineering team has been running failover and resiliency tests on the network and the existing VPC by simulating an outage situation on the Direct Connect connection. During the resiliency tests, traffic failed to switch over to the backup VPN connection.
How can this failure be troubleshot?

1. A. Ensure that Bidirectional Forwarding Detection is enabled on the Direct Connect connection
2. B. Confirm that the same routes are being advertised over both the VPN and Direct Connect.
3. C. Reconfigure the Direct Connect session from static routes to Border Gateway Protocol (BGP) peering.
4. D. Configure a virtual private gateway for the VPN and another virtual private gateway for Direct Connect.

Correct Answer: B

A company has established an AWS Direct Connect connection between its customer gateway at its on-premises data center and a virtual private gateway m the AWS Cloud The BGP routing protocol
configuration includes the Autonomous System Number {ASN) of 7224 on the AWS end of the connection
and the BGP ASN of 65004 on the company end of the connection
The company's IT administrators report that servers that run at the on-premises data center are not able to
communicate with the company's web application that runs on a fleet of Amazon EC2 Instances A network engineer performs initial troubleshooting The network engineer finds that the private VIF is operational and that there is a fully established BGP peering session However, the company still cannot route traffic over the private VIF
Which of the following is a possible cause of this connectivity issue?

1. A. Firewall or ACL rules are blocking TCP pod 179 or are blocking high-numbered ephemeral TCP pons
2. B. The provider is advertising 50 prefixes for private VIFs
3. C. VPC route tables am lacking prefixes that point to the virtual private gateway to which the private VIF is connected
4. D. Peer IP addresses for both sides of the BGP peering session are not configured correctly.

Correct Answer: A