Amazon ANS-C01 Exam Questions Instant Access

Question 1

A company's network engineer is configuring an AWS Site-to-Site VPN connection between a transit gateway and the company's on-premises network. The Site-to-Site VPN connection is configured to use BGP over two tunnels in active/active mode with equal-cost multi-path (ECMP) routing activated on the transit gateway.

When the network engineer attempts to send traffic from the on-premises network to an Amazon EC2 instance, traffic is sent over the first tunnel. However, return traffic is received over the second tunnel and is dropped at the customer gateway. The network engineer must resolve this issue without reducing the overall VPN bandwidth.

Which solution will meet these requirements?

AConfigure the customer gateway to use AS PATH prepending and local preference to prefer one tunnel over the other.

BConfigure the Site-to-Site VPN options to set the first tunnel as the primary tunnel to eliminate asymmetric routing.

CConfigure the virtual tunnel interfaces on the customer gateway to allow asymmetric routing.

DConfigure the Site-to-Site VPN to use static routing in active/active mode to ensure that traffic flows over a preferred path.

Answer : D

Question 2

A company needs to capture and log traffic for Nitro-based Amazon EC2 instances to comply with regulations. The company's network team has prepared a solution that enables VPC traffic mirroring and sends traffic to a second set of EC2 instances in an Auto Scaling group.

The network team has added a Network Load Balancer (NLB) in front of the EC2 instances the traffic will be sent to. However, the solution does not send any mirrored traffic to the EC2 instances that are behind the NLB.

How should the network team configure traffic mirroring to use the NLB endpoint?

ASelect the NLB as a source for traffic mirroring. Use a UDP listener.

BSelect the NLB as a target for traffic mirroring. Use a TCP listener and a UDP listener.

CSelect the NLB as a target for traffic mirroring. Use a TCP listener.

DSelect the NLB as a target for traffic mirroring. Use a UDP listener.

Answer : D

Traffic Mirroring with UDP: VPC traffic mirroring sends mirrored traffic as UDP packets encapsulated in VXLAN (Virtual eXtensible Local Area Network). Therefore, the target for traffic mirroring must have a UDP listener to accept the mirrored traffic.

NLB as a Target: The Network Load Balancer (NLB) can be configured as the target for traffic mirroring. By setting up a UDP listener on the NLB, it can properly receive the VXLAN-encapsulated mirrored traffic and forward it to the EC2 instances behind it.

Correct Listener Protocol: Since mirrored traffic uses UDP, setting up a TCP listener or using both TCP and UDP listeners will not work. Only a UDP listener can correctly handle the traffic.

Question 3

A company recently migrated its Amazon EC2 instances to VPC private subnets to satisfy a security compliance requirement. The EC2 instances now use a NAT gateway for internet access. After the migration, some long-running database queries from private EC2 instances to a publicly accessible third-party database no longer receive responses. The database query logs reveal that the queries successfully completed after 7 minutes but that the client EC2 instances never received the response.

Which configuration change should a network engineer implement to resolve this issue?

AConfigure the NAT gateway timeout to allow connections for up to 600 seconds.

BEnable enhanced networking on the client EC2 instances.

CEnable TCP keepalive on the client EC2 instances with a value of less than 300 seconds.

DClose idle TCP connections through the NAT gateway.

Answer : C

When a TCP connection is idle for a long time, it may be terminated by network devices, including the NAT gateway. By enabling TCP keepalive, the client EC2 instances can periodically send packets to the third-party database to indicate that the connection is still active, preventing it from being terminated prematurely.

Question 4

A company has two AWS Direct Connect connections between Direct Connect locations and the company's on-premises environment in the US. The company uses the connections to communicate with AWS workloads that run in the us-east-1 Region. The company has a transit gateway that connects several VPCs. The Direct Connect connections terminate at a Direct Connect gateway and the transit VIFs to the transit gateway.

The company recently acquired a smaller company that is based in Europe. The newly acquired company has only on-premises workloads. The newly acquired company does not

expect to run workloads on AWS for the next 3 years. However, the newly acquired company requires connectivity to the parent company's AWS resources in us-east-1 and to the

parent company's on-premises environment in the US. The parent company wants to use two new Direct Connect connections in Europe to provide the required connectivity.

Which solution will meet these requirements with the LEAST operational overhead for the newly acquired company?

AAssociate new transit VIFs to the existing Direct Connect gateway. Configure the new transit VIFs to use Direct Connect SiteLink.

BAssociate new transit VIFs to a new Direct Connect gateway and to a new transit gateway in the eu-west-1 Region. Use transit gateway peering to connect the transit gateways.

CAssociate new private VIFs to the existing Direct Connect gateway. Configure the existing transit VIFs and the new private VIFs to use Direct Connect SiteLink.

DAssociate new private VIFs to a new Direct Connect gateway and to a new VPC in us-east-1. Configure the existing transit VIFs and the new private VIFs to use Direct Connect SiteLink and AWS PrivateLink endpoints in the new VPC.

Answer : A

In this scenario, the company wants to provide connectivity from the newly acquired company in Europe to the existing AWS resources in the us-east-1 Region with minimal operational overhead. The best approach is to use Direct Connect SiteLink, which allows direct communication between two different Direct Connect locations (one in Europe and one in the US) via the existing Direct Connect gateway.

By associating new transit VIFs (Virtual Interfaces) to the existing Direct Connect gateway and configuring Direct Connect SiteLink, the company can efficiently extend the existing network architecture with minimal additional configuration. This solution provides the required connectivity to both AWS resources and the on-premises environment in the US, leveraging the existing infrastructure without introducing significant complexity or the need for additional resources like new transit gateways or VPCs.

Question 5

A company uses Amazon Route 53 to host a public hosted zone for example.com. A network engineer recently reduced the TTL on several records to 60 seconds. The network engineer wants to assess whether the change has increased the number of queries to Route 53 beyond the expected levels that the company identified before the change. The network engineer must obtain the number of queries that have been made to the example.com public hosted zone.

Which solution will provide this information?

ACreate a new trail in AWS CloudTrail to include Route 53 data events. Send logs to Amazon CloudWatch Logs. Set up a CloudWatch metric filter to count the number of queries and create graphs.

BUse Amazon CloudWatch to access the AWS/Route 53 namespace and to check the DNSQuenes metric tor the public hosted zone.

CUse Amazon CloudWatch to access the AWS/Route 53 Resolver namespace and to check the InboundQueryVolume metric for a specific endpoint.

DConfigure logging to Amazon CloudWatch for the public hosted zone. Set up a CloudWatch metric filter to count the number of queries and create graphs.

Answer : B

Question 6

A security team is performing an audit of a company's AWS deployment. The security team is concerned that two applications might be accessing resources that should be blocked by network ACLs and security groups. The applications are deployed across two Amazon Elastic Kubernetes Service (Amazon EKS) clusters that use the Amazon VPC Container Network Interface (CNI) plugin for Kubernetes. The clusters are in separate subnets within the same VPC and have a Cluster Autoscaler configured.

The security team needs to determine which POD IP addresses are communicating with which services throughout the VPC. The security team wants to limit the number of flow logs and wants to examine the traffic from only the two applications.

Which solution will meet these requirements with the LEAST operational overhead?

ACreate VPC flow logs in the default format. Create a filter to gather flow logs only from the EKS nodes. Include the srcaddr field and the dstaddr field in the flow logs.

BCreate VPC flow logs in a custom format. Set the EKS nodes as the resource Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.

CCreate VPC flow logs in a custom format. Set the application subnets as resources. Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.

DCreate VPC flow logs in a custom format. Create a filter to gather flow logs only from the EKS nodes. Include the pkt-srcaddr field and the pkt-dstaddr field in the flow logs.

Answer : D

Question 7

A company has multiple AWS accounts. Each account contains one or more VPCs. A new security guideline requires the inspection of all traffic between VPCs.

The company has deployed a transit gateway that provides connectivity between all VPCs. The company also has deployed a shared services VPC with Amazon EC2 instances that include IDS services for stateful inspection. The EC2 instances are deployed across three Availability Zones. The company has set up VPC associations and routing on the transit gateway. The company has migrated a few test VPCs to the new solution for traffic inspection.

Soon after the configuration of routing, the company receives reports of intermittent connections for traffic that crosses Availability Zones.

What should a network engineer do to resolve this issue?

AModify the transit gateway VPC attachment on the shared services VPC by enabling cross-Availability Zone load balancing.

BModify the transit gateway VPC attachment on the shared services VPC by enabling appliance mode support.

CModify the transit gateway by selecting VPN equal-cost multi-path (ECMP) routing support.

DModify the transit gateway by selecting multicast support.

Answer : B

To resolve the issue of intermittent connections for traffic that crosses Availability Zones after configuring routing for traffic inspection between VPCs using a transit gateway and EC2 instances with IDS services in a shared services VPC, a network engineer should modify the transit gateway VPC attachment on the shared services VPC by enabling appliance mode support (Option B). This will ensure that traffic is routed to the same EC2 instance for stateful inspection and prevent intermittent connections.

Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Exam Questions