ANS-C01 Practice Exam Questions and Answers

A.  

Validate that private DNS is enabled on the VPC by setting the enableDnsHostnames VPC attribute and the enableDnsSupport VPC attribute to true.

B.  

Create a new security group with an entry to allow outbound traffic that uses the TCP protocol on port 443 to destination 0.0.0.0/0

C.  

Create a new security group with entries to allow inbound traffic that uses the TCP protocol on port 443 from the IP prefixes of the private subnets.

D.  

Create the following interface VPC endpoints in the VPC: com.amazonaws.us-west-2.logs and com.amazonaws.us-west-2.monitoring. Associate the new security group with the endpoint network interfaces.

E.  

Create the following interface VPC endpoint in the VPC: com.amazonaws.us-west-2.cloudwatch. Associate the new security group with the endpoint network interfaces.

F.  

Associate the VPC endpoint or endpoints with route tables that the private subnets use.

A.  

Create a Direct Connect public VI

F.  

Set up an IPsec VPN connection over the public VIF to access Amazon S3. Use HTTPS for communication.

B.  

Create an IPsec VPN connection over the transit VI

F.  

Create a VPC and attach the VPC to the transit gateway. In the VPC, provision an interface VPC endpoint for Amazon S3. Use HTTPS for communication.

C.  

Create a VPC and attach the VPC to the transit gateway. In the VPC, provision an interface VPC endpoint for Amazon S3. Use HTTPS for communication.

D.  

Create a Direct Connect public VI

F.  

Set up an IPsec VPN connection over the public VIF to the transit gateway. Create an attachment for Amazon S3. Use HTTPS for communication.

A.  

Change the ALB security policy to a policy that supports TLS 1.2 protocol only

B.  

Use AWS Key Management Service (AWS KMS) to encrypt session keys

C.  

Associate an AWS WAF web ACL with the ALBs. and create a security rule to enforce forward secrecy (FS)

D.  

Change the ALB security policy to a policy that supports forward secrecy (FS)

A.  

Set up an AWS Site-to-Site VPN connection between on premises and AWS. Deploy an Amazon Route 53 Resolver outbound endpoint in the Region that is hosting the VP

C.  

B.  

Set up an AWS Direct Connect connection with a private VI

F.  

Deploy an Amazon Route 53 Resolver inbound endpoint and a Route 53 Resolver outbound endpoint in the Region that is hosting the VP

C.  

C.  

Set up an AWS Client VPN connection between on premises and AWS. Deploy an Amazon Route 53 Resolver inbound endpoint in the VP

C.  

D.  

Set up an AWS Direct Connect connection with a public VI

F.  

Deploy an Amazon Route 53 Resolver inbound endpoint in the Region that is hosting the VP

C.  

Use the IP address that is assigned to the endpoint for connectivity to the on-premises DNS servers.

A.  

Deploy a transit gateway. Attach a GLB endpoint to the transit gateway. Attach the application VPC to the transit gateway. Update the application subnet route table's default route destination to be the GLB endpoint. Ensure that the EC2 instances' security group allows traffic from the GLB endpoint.

B.  

Update the application subnet route table to have a default route to the GL

B.  

On the standalone VPC that contains the firewall fleet, add a route in the route table for the application VPC's CIDR block with the GLB endpoint as the destination. Update the EC2 instances' security group to allow traffic from the GL

B.  

C.  

Provision a GLB endpoint in the application VPC in a new subnet. Create a gateway route table with a route that specifies the application subnet CIDR block as the destination and the GLB endpoint as the target. Associate the gateway route table with the internet gateway in the application VP

C.  

Update the application subnet route table's default route destination to be the GLB endpoint.

D.  

Instruct the security engineer to move the GLB into the application VP

C.  

Create a gateway route table. Associate the gateway route table with the application subnet. Add a default route to the gateway route table with the GLB as its destination. Update the route table on the GLB to direct traffic from the internet gateway to the application servers. Ensure that the EC2 instances' security group allows traffic from the GL

B.  

A.  

In the VPC route table, add a route that has the PrivateLink endpoints as the destination.

B.  

Ensure that the enableDnsSupport attribute is set to True for the VP

C.  

Ensure that each VPC endpoint has DNS support enabled.

C.  

Ensure that the VPC endpoint policy allows communication.

D.  

Create an Amazon Route 53 public hosted zone for all services.

E.  

Create an Amazon Route 53 private hosted zone that includes a custom name for each service.

A.  

Create a new Site-to-Site VPN connection that supports IPv6.

B.  

Create a new Site-to-Site VPN connection to a self-managed Amazon EC2 instance that runs open source software.

C.  

Update the existing Site-to-Site VPN connections to support IPv6.

D.  

Update the on-premises customer gateway's public IP address from IPv4 to IPv6.

A.  

Determine a supernet for the branch office. In the transit gateway route table, add an aggregate route that targets the VPN attachment. Replace the specific subnet routes in the transit gateway route table with the new supernet route.

B.  

Create an AWS Direct Connect gateway and a transit VI

F.  

Associate the Direct Connect gateway with the transit gateway. Create a propagation for the Direct Connect attachment to the transit gateway route table.

C.  

Create a dynamically routed VPN connection on the transit gateway. Connect the dynamically routed VPN connection to the branch office. Create a propagation for the VPN attachment to the transit gateway route table. Remove the existing static VPN connection.

D.  

Create a prefix list that contains the new subnets and the old subnets for the branch office. Remove the specific subnet routes in the transit gateway route table. Create a prefix list reference in the transit gateway route table.

A.  

Update the core network policy to configure segment sharing. Share the production segment with the security segment.

B.  

Update the core network policy to create a static route for the security segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.

C.  

Update the core network policy to create a static route for the production segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.

D.  

Update the core network policy to create a static route for the production segment.Specify 10.2.0.0/16 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.

E.  

Create an attachment to attach the outbound inspection VPC to the production segment. Update the core network policy to turn on isolated attachment for the production segment.

A.  

Create one Direct Connect gateway in us-east-1. Use AWS Resource Access Manager (AWS RAM) to share the Direct Connect gateway with each account. Create a transit VIF for Account

A.  

Associate the four transit gateways in Account A to the Direct Connect gateway. Create a transit VIF for Account

B.  

Associate the three transit gateways inAccount В to the Direct Connect gateway.

B.  

Create one Direct Connect gateway in us-east-1 for Account

A.  

Create a second Direct Connect gateway in us-east-1 for Account

B.  

Create a transit VIF for Account

A.  

Associate the four transit gateways in Account A to the Direct Connect gateway in Account

A.  

Create a transit VIF for Account

B.  

Associate the three transit gateways in Account В to the Direct Connect gateway in Account В.

C.  

Create one Direct Connect gateway in us-east-1. Use AWS Resource Access Manager (AWS RAM) to share the Direct Connect gateway with each account. Create a transit VIF for Account

A.  

Associate the four transit gateways in Account A to the Direct Connect gateway. Order a new 10 Gbps Direct Connect dedicated connection for Account

B.  

Create a transit VIF on the new Direct Connect connection for Account

B.  

Associate the three transit gateways in

D.  

Create one Direct Connect gateway in us-east-1 for Account

A.  

Create a second Direct Connect gateway in us-east-1 for Account

B.  

Create a transit VIF for Account

A.  

Associate the four transit gateways in Account A to the Direct Connect gateway in Account

A.  

Order a new 10 Gbps Direct Connect dedicated connection for Account В. Create a transit VIF on the new Direct Connect connection for Account В. Associate the three transit gateways in Ac