AWS-Certified-Advanced-Networking-Specialty Free Practice Test

A company is deploying a critical application on two Amazon EC2 instances in a VPC Failed client connections to the EC2 instances must be logged according to company policy.
What is the MOST cost-effective solution to meet these requirements'?

1. A. Move the EC2 instances to a dedicated VPC Enable VPC Flow Logs with a filter on the deny action Publish the flow logs to Amazon CloudWatch Logs
2. B. Move the EC2 instances to a dedicated VPC subnet Enable VPC Flow Logs for the subnet with a filter on the reject action Publish the flow logs to an Amazon Kinesis Data Firehose stream with a data delivery to an Amazon S3 bucket
3. C. Enable VPC Flow Logs, filtered for rejected traffic for the elastic network interfaces associated with the instances Publish the flow logs to an Amazon Kinesis Data Firehose stream with a data delivery to an Amazon S3 bucket
4. D. Enable VPC Flow Logs, filtered for rejected traffic for the elastic network interfaces associated with the instances Publish the flow logs to Amazon CloudWatch Logs

Correct Answer: D

A company provisions an AWS Direct Connect connection to permit access to Amazon EC2 resources in several Amazon VPCs and to data stored in private Amazon S3 buckets. The Network Engineer needs to configure the company's on-premises router for this Direct Connect connection.
Which of the following actions will require the LEAST amount of configuration overhead on the customer router?

1. A. Configure private virtual interfaces for the VPC resources and for Amazon S3.
2. B. Configure private virtual interfaces for the VPC resources and a public virtual interface for Amazon S3.
3. C. Configure a private virtual interface to a Direct Connect gateway for the VPC resources and for Amazon S3.
4. D. Configure a private virtual interface to a Direct Connect gateway for the VPC resources and a public virtual interface for Amazon S3.

Correct Answer: A

A financial company is designing a secure AWS network architecture to support a hybrid cloud strategy. Systems deployed in the AWS Cloud are mission critical and have strict availability requirements. The
company anticipates the need for hundreds of VPCs. Instances will be transient and rely heavily on DNS resolution The applications must be designed to have Availability Zone isolation and tolerate the loss of an Availability Zone
What is the MOST reliable way to implement DNS in this scenario?

1. A. Create a new DHCP options set with DNS settings with on-premises DNS servers that traverse an AWS Direct Connect connection.
2. B. Create private hosted zones and share them with each VP
3. C. Use Amazon Route 53 Resolver for hybrid DNS.
4. D. Modify the default DHCP options set with a fleet of proxy DNS servers that are deployed in each VPC.
5. E. Create a fleet of DNS proxy servers in a central VP
6. F. Share the proxy fleet with each VPC using AWS PrivateLink.

Correct Answer: C

You run a well-architected, multi-AZ application in the eu-central-1 (Frankfurt) AWS region. The application is hosted in a VPC and is only accessed from the corporate network. To support large volumes of data transfer and administration of the application, you use a single 10-Gbps AWS Direct Connect connection with multiple private virtual interfaces. As part of a review, you decide to improve the resilience of your connection to AWS and make sure that any additional connectivity does not share the same Direct Connect routers at AWS. You need to provide the best levels of resilience to meet the application’s needs.
Which two options should you consider? (Select two.)

1. A. Install a second 10-Gbps Direct Connect connection to the same Direct Connection location.
2. B. Deploy an IPsec VPN over a public virtual interface on a new 10-Gbps Direct Connect connection.
3. C. Install a second 10-Gbps Direct Connect connection to a Direct Connect location in eu-west-1.
4. D. Deploy an IPsec VPN over the Internet to the eu-west-1 region for diversity.
5. E. Install a second 10-Gbps Direct Connect connection to a second Direct Connect location for eu-central-1.

Correct Answer: AE
https://aws.amazon.com/directconnect/resiliency-recommendation/

Refer to the image.

You have three VPCs: A, B, and C. VPCs A and C are both peered with VPC B. The IP address ranges are as follows:
VPC A: 10.0.0.0/16
VPC B: 192.168.0.0/16
VPC C: 10.0.0.0/16
Instance i-1 in VPC A has the IP address 10.0.0.10. Instance i-2 in VPC C has the IP address 10.0.0.10. Instances i-3 and i-4 in VPC B have the IP addresses 192.168.1.10 and 192.168.1.20, respectively, i-3 and i-4 are in the subnet 192.168.1.0/24.
i-3 must be able to communicate with i-1
i-4 must be able to communicate with i-2
i-3 and i-4 are able to communicate with i-1, but not with i-2.
Which two steps will fix this problem? (Select two.)

1. A. Create subnets 192.168.1.0/28 and 192.168.1.16/28. Move i-3 and i-4 to these subnets, respectively.
2. B. Create subnets 192.168.1.0/27 and 192.168.1.16/27. Move i-3 and i-4 to these subnets, respectively.
3. C. Change the IP address of i-2 to 10.0.0.100. Assign it an elastic IP address.
4. D. Create a new route table for VPC B, with unique route entries for destination VPC A and destination VPC C.
5. E. Create two route tables: one with a route for destination VPC A, and another for destination VPC C.

Correct Answer: AE
https://docs.aws.amazon.com/vpc/latest/peering/peering-configurations-partial-access.html#one-to-two-vpcs-sim