AWS-Certified-Advanced-Networking-Specialty Free Practice Test

Your company runs an application for the US market in the us-east-1 AWS region. This application uses proprietary TCP and UDP protocols on Amazon Elastic Compute Cloud (EC2) instances. End users run a
real-time, front-end application on their local PCs. This front-end application knows the DNS hostname of the service.
You must prepare the system for global expansion. The end users must access the application with lowest latency.
How should you use AWS services to meet these requirements?

1. A. Register the IP addresses of the service hosts as “A” records with latency-based routing policy in Amazon Route 53, and set a Route 53 health check for these hosts.
2. B. Set the Elastic Load Balancing (ELB) load balancer in front of the hosts of the service, and register the ELB name of the main service host as an ALIAS record with a latency-based routing policy in Route 53.
3. C. Set Amazon CloudFront in front of the host of the service, and register the CloudFront name of the main service as an ALIAS record in Route 53.
4. D. Set the Amazon API gateway in front of the service, and register the API gateway name of the main service as an ALIAS record in Route 53.

Correct Answer: B

A company’s web application is deployed on Amazon EC2 instances behind a public Application Load Balancer. The application flags malicious requests and uses an AWS Lambda function to add the offending IP addresses to the network ACL to block any further request for 24 hours. Recently, the application has been receiving more malicious requests, which causes the network ACL to reach its limit of allowed entries.
Which action should be taken to block more IP addresses, without compromising the existing security requirements?

1. A. Update the AWS Lambda function to remove blocked entries from the network ACL after 2 hours.
2. B. Update the AWS Lambda function to block malicious IPs in security groups rather than the network ACL.
3. C. Update the AWS Lambda function to block malicious IPs in AWS WAF attached to the Application Load Balancer.
4. D. Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached.

Correct Answer: C

A company’s Network Engineering team is solely responsible for deploying VPC infrastructure using AWS CloudFormation. The company wants to give its Developers the ability to launch applications using CloudFormation templates so that subnets can be created using available CIDR ranges.
What should be done to meet these requirements?

1. A. Create a CloudFormation templates with Amazon EC2 resources that rely on cfn-init and cfn-signals to inform the stack of available CIDR ranges.
2. B. Create a CloudFormation template with a custom resource that analyzes traffic activity in VPC Flow Logs and reports on available CIDR ranges.
3. C. Create a CloudFormation template that references the Fn::Cidr intrinsic function within a subnet resource to select an available CIDR range.
4. D. Create a CloudFormation template with a custom resource that uses AWS Lambda and Amazon DynamoDB to manage available CIDR ranges.

Correct Answer: D

An organization has ordered a new AWS Direct Connect connection. The AWS Management Console reports that the connection is available and BGP status is up. However, the networking team is not able to reach instances in the VPC using ping on the organization's private IP address
What could cause this connectivity issue? (Choose two.)

1. A. The VGW is not advertising the correct CIDR range back on-premises.
2. B. The instance security group does not allow ICMP traffic.
3. C. A public virtual interface must be configured for Amazon EC2 connectivity.
4. D. The on-premises router is not advertising the correct CIDR range to AWS.
5. E. There is a misconfiguration of the bi-directional forwarding detection.

Correct Answer: BD

An organization will be expanding its current network design. When fully built out, there will be 99 VPCs spread across 11 AWS accounts (9 VPCs per account). There is currently an AWS Direct Connect connection into one account with 9 VPCs, each with a virtual network interface (VIF) per VPC.
Which of the following designs will minimize cost while allowing the organization to expand?

1. A. Order 10 new Direct Connect connections, one from each of the accounts that will be provisioned.Create private VIFs in each accoun
2. B. Attach one private VIF per VPC.
3. C. Create a public VIF on the Direct Connect connectio
4. D. Leverage the public VIF to create a VPN connection to each VPC.
5. E. Create hosted private VIFs in the existing accoun
6. F. Connect a private VIF to an AWS Direct Connect gateway in each accoun
7. G. Connect the gateway in each account to the VPCs.
8. H. Create a transit VPC in the existing account that consists of two routers in separate Availability Zones.Connect each VPC to the two routers in the transit VPC by using VPN.

Correct Answer: D
https://docs.aws.amazon.com/directconnect/latest/UserGuide/limits.html