Nest 0 Cart
Nest Account
Popular Exams
All Categories...
Nest
Nest 0
Contact
Log In / Sign Up
Copyright 2024 © store. All rights reserved.
Home Amazon ANS-C00

Amazon ANS-C00 Exam Practice Questions (P. 2)

  • Full Access (377 questions)
  • Six months of Premium Access
  • Access to one million comments
  • Seamless ChatGPT Integration
  • Ability to download PDF files
  • Anki Flashcard files for revision
  • No Captcha & No AdSense
  • Advanced Exam Configuration
Get Contributor Access
Question #11
An organization processes consumer information submitted through its website. The organization's security policy requires that personally identifiable information
(PII) elements are specifically encrypted at all times and as soon as feasible when received. The front-end Amazon EC2 instances should not have access to decrypted PII. A single service within the production VPC must decrypt the PII by leveraging an IAM role.
Which combination of services will support these requirements? (Choose two.)
  1. A
    Amazon Aurora in a private subnet
  2. B
    Amazon CloudFront using AWS Lambda@Edge
  3. C
    Customer-managed MySQL with Transparent Data Encryption
  4. D
    Application Load Balancer using HTTPS listeners and targets
  5. E
    AWS Key Management Services

Correct Answer:
CE
References:
https://noise.getoto.net/tag/aws-kms/

Question #12
A Lambda function needs to access the private address of an Amazon ElastiCache cluster in a VPC. The Lambda function also needs to write messages to
Amazon SQS. The Lambda function has been configured to run in a subnet in the VPC.
Which of the following actions meet the requirements? (Choose two.)
  1. A
    The Lambda function needs an IAM role to access Amazon SQS
  2. B
    The Lambda function must route through a NAT gateway or NAT instance in another subnet to access the public SQS API.
  3. C
    The Lambda function must be assigned a public IP address to access the public Amazon SQS API.
  4. D
    The ElastiCache server outbound security group rules must be configured to permit the Lambda function's security group.
  5. E
    The Lambda function must consume auto-assigned public IP addresses but not elastic IP addresses.

Correct Answer:
AC
References:
https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/

Question #13
You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URLs, the instances should be able to access any Amazon S3 bucket in the same region via any URL.
Which of the following solutions should you deploy? (Choose two.)
  1. A
    Include s3.amazonaws.com in the whitelist.
  2. B
    Create a VPC endpoint for S3.
  3. C
    Run Squid proxy on a NAT instance.
  4. D
    Deploy a NAT gateway into your VPC.
  5. E
    Utilize a security group to restrict access.

Correct Answer:
CD

Question #14
Your company runs an HTTPS application using an Elastic Load Balancing (ELB) load balancer/PHP on nginx server/RDS in multiple Availability Zones. You need to apply Geographic Restriction and identify the client's IP address in your application to generate dynamic content.
How should you utilize AWS services in a scalable fashion to perform this task?
  1. A
    Modify the nginx log configuration to record value in X-Forwarded-For and use CloudFront to apply the Geographic Restriction.
  2. B
    Enable ELB access logs to store the client IP address and parse these to dynamically modify a blacklist.
  3. C
    Use X-Forwarded-For with security groups to apply the Geographic Restriction.
  4. D
    Modify the application code to use value of X-Forwarded-For and CloudFront to apply the Geographic Restriction.

Correct Answer:
A

Question #15
You run a well-architected, multi-AZ application in the eu-central-1 (Frankfurt) AWS region. The application is hosted in a VPC and is only accessed from the corporate network. To support large volumes of data transfer and administration of the application, you use a single 10-Gbps AWS Direct Connect connection with multiple private virtual interfaces. As part of a review, you decide to improve the resilience of your connection to AWS and make sure that any additional connectivity does not share the same Direct Connect routers at AWS. You need to provide the best levels of resilience to meet the application's needs.
Which two options should you consider? (Choose two.)
  1. A
    Install a second 10-Gbps Direct Connect connection to the same Direct Connection location.
  2. B
    Deploy an IPsec VPN over a public virtual interface on a new 10-Gbps Direct Connect connection.
  3. C
    Install a second 10-Gbps Direct Connect connection to a Direct Connect location in eu-west-1.
  4. D
    Deploy an IPsec VPN over the Internet to the eu-west-1 region for diversity.
  5. E
    Install a second 10-Gbps Direct Connect connection to a second Direct Connect location for eu-central-1.

Correct Answer:
BC

Question #16
You currently use a single security group assigned to all nodes in a clustered NoSQL database. Only your cluster members in one region must be able to connect to each other. This security group uses a self-referencing rule using the cluster security group's group-id to make it easier to add or remove nodes from the cluster. You need to make this database comply with out-of-region disaster recovery requirements and ensure that the network traffic between the nodes is encrypted when travelling between regions. How should you enable secure cluster communication while deploying additional cluster members in another AWS region?
  1. A
    Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group rules that reference each other's security group-id in each region.
  2. B
    Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region.
  3. C
    Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region.
  4. D
    Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group rules that reference each other's security group-id in each region.

Correct Answer:
D

Question #17
You have to set up an AWS Direct Connect connection to connect your on-premises to an AWS VPC. Due to budget requirements, you can only provision a single
Direct Connect port. You have two border gateway routers at your on-premises data center that can peer with the Direct Connect routers for redundancy.
Which two design methodologies, in combination, will achieve this connectivity? (Choose two.)
  1. A
    Terminate the Direct Connect circuit on a L2 border switch, which in turn has trunk connections to the two routers.
  2. B
    Create two Direct Connect private VIFs for the same VPC, each with a different peer IP.
  3. C
    Terminate the Direct Connect circuit on any of the one routers, which in turn will have an IBGP session with the other router.
  4. D
    Create one Direct Connect private VIF for the VPC with two customer peer IPs.
  5. E
    Provision two VGWs for the VPC and create one Direct Connect private VIF per VGW.

Correct Answer:
AD

Question #18
Your organization needs to resolve DNS entries stored in an Amazon Route 53 private zone `awscloud:internal` from the corporate network. An AWS Direct
Connect connection with a private virtual interface is configured to provide access to a VPC with the CIDR block 192.168.0.0/16. A DNS Resolver (BIND) is configured on an Amazon Elastic Compute Cloud (EC2) instance with the IP address 192.168.10.5 within the VPC. The DNS Resolver has standard root server hints configured and conditional forwarding for `awscloud.internal` to the IP address 192.168.0.2.
From your PC on the corporate network, you query the DNS server at 192.168.10.5 for www.amazon.com. The query is successful and returns the appropriate response. When you query for `server.awscloud.internal`, the query times out. You receive no response.
How should you enable successful queries for `server.awscloud.internal`?
  1. A
    Attach an internet gateway to the VPC and create a default route.
  2. B
    Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True
  3. C
    Relocate the BIND DNS Resolver to the corporate network.
  4. D
    Update the security group for the EC2 instance at 192.168.10.5 to allow UDP Port 53 outbound.

Correct Answer:
B

Question #19
Your company's policy requires that all VPCs peer with a `common services: VPC. This VPC contains a fleet of layer 7 proxies and an Internet gateway. No other
VPC is allowed to provision an Internet gateway. You configure a new VPC and peer with the common service VPC as required by policy. You launch an Amazon
EC2. Windows instance configured to forward all traffic to the layer 7 proxies in the common services VPC. The application on this server should successfully interact with Amazon S3 using its properly configured AWS Identity and Access Management (IAM) role. However, Amazon S3 is returning 403 errors to the application.
Which step should you take to enable access to Amazon S3?
  1. A
    Update the S3 bucket policy with the private IP address of the instance.
  2. B
    Exclude 169.254.169.0/24 from the instance's proxy configuration.
  3. C
    Configure a VPC endpoint for Amazon S3 in the same subnet as the instance.
  4. D
    Update the CORS configuration for Amazon S3 to allow traffic from the proxy.

Correct Answer:
D

Question #20
A customer is using ABC Telecom as a network provider. The customer has 10 different offices connected to ABC Telecom's MPLS backbone. The customer is setting up an AWS Direct Connect connection to AWS and has provided the LOA-CFA to ABC Telecom. ABC Telecom has terminated the Direct Connect circuit into their MPLS backbone. To uniquely identify the customer's traffic over the MPLS backbone, the customer must encapsulate all traffic with VLAN tag 100. The customer wants to send traffic to multiple VPCs.
Which two steps should be taken to meet the customer's requirement? (Choose two.)
  1. A
    The customer performs Q-in-Q tunneling, with the AWS-required VLAN tag in the inside and VLAN 100 as the outside tag.
  2. B
    Create a support ticket with AWS to request the removal of the outer VLAN tag 100 as the traffic reaches AWS routers.
  3. C
    Send the traffic for all VPCs with the same VLAN tag 100 and use BGP to ensure that proper routing takes place to the appropriate VPC.
  4. D
    ABC Telecom removes the outer tag before sending the packet to AWS.
  5. E
    ABC Telecom creates a support ticket with AWS to exchange MPLS labels and include the AWS port as part of their MPLS network.

Correct Answer:
CE

Previous Questions Next Questions

All Pages