Question 1

A company is running multiple workloads on Amazon EC2 instances in public subnets. In a recent incident, an attacker exploited an application vulnerability on one of the EC2 instances to gain access to the instance. The company fixed the application and launched a replacement EC2 instance that contains the updated application. The attacker used the compromised application to spread malware over the internet. The company became aware of the compromise through a notification from AWS. The company needs the ability to identify when an application that is deployed on an EC2 instance is spreading malware. Which solution will meet this requirement with the LEAST operational effort?

Options :

A : Use Amazon GuardDuty to analyze traffic patterns by inspecting DNS requests and VPC flow logs.

B :

Use Amazon GuardDuty to deploy AWS managed decoy systems that are equipped with the most recent malware signatures.

C :

Set up a Gateway Load Balancer. Run an intrusion detection system (IDS) appliance from AWS Marketplace on Amazon EC2 for traffic inspection.

D : Configure Amazon Inspector to perform deep packet inspection of outgoing traffic.

Answer: A

Question 2

An IoT company sells hardware sensor modules that periodically send out temperature, humidity, pressure, and location data through the MQTT messaging protocol. The hardware sensor modules send this data to the company's on-premises MQTT brokers that run on Linux servers behind a load balancer. The hardware sensor modules have been hardcoded with public IP addresses to reach the brokers. The company is growing and is acquiring customers across the world. The existing solution can no longer scale and is introducing additional latency because of the company's global presence. As a result, the company decides to migrate its entire infrastructure from on premises to the AWS Cloud. The company needs to migrate without reconfiguring the hardware sensor modules that are already deployed across the world. The solution also must minimize latency. The company migrates the MQTT brokers to run on Amazon EC2 instances. What should the company do next to meet these requirements?

Options :

A :

Place the EC2 instances behind a Network Load Balancer (NLB). Configure TCP listeners. Use Bring Your Own IP (BYOIP) from the on-premises network with the NLB.

B :

Place the EC2 instances behind a Network Load Balancer (NLB). Configure TCP listeners. Create an AWS Global Accelerator accelerator in front of the NLUse Bring Your Own IP (BYOIP) from the onpremises network with Global Accelerator.

C :

Place the EC2 instances behind an Application Load Balancer (ALB). Configure TCP listeners. Create an AWS Global Accelerator accelerator in front of the ALB. Use Bring Your Own IP (BYOIP) from the on-premises network with Global Accelerator

D :

Place the EC2 instances behind an Amazon CloudFront distribution. Use Bring Your Own IP (BYOIP) from the on-premises network with CloudFront.

Answer: B

Question 3

A company delivers applications over the internet. An Amazon Route 53 public hosted zone is the authoritative DNS service for the company and its internet applications, all of which are offered from the same domain name. A network engineer is working on a new version of one of the applications. All the application's components are hosted in the AWS Cloud. The application has a three-tier design. The front end is delivered through Amazon EC2 instances that are deployed in public subnets with Elastic IP addresses assigned. The backend components are deployed in private subnets from RFC1918. Components of the application need to be able to access other components of the application within the application's VPC by using the same host names as the host names that are used over the public internet. The network engineer also needs to accommodate future DNS changes, such as the introduction of new host names or the retirement of DNS entries. Which combination of steps will meet these requirements? (Choose three.)

Options :

A : Add a geoproximity routing policy in Route 53.

B :

Create a Route 53 private hosted zone for the same domain name Associate the application’s VPC with the new private hosted zone

C : Enable DNS hostnames for the application-s VPC.

D :

Create entries in the private hosted zone for each name in the public hosted zone by using the corresponding private IP addresses.

E :

Create an Amazon EventBridge (Amazon CloudWatch Events) rule that runs when AWS CloudTrail logs a Route 53 API call to the public hosted zone. Create an AWS Lambda function as the target of the rule. Configure the function to use the event information to update the private hosted zone

F : Add the private IP addresses in the existing Route 53 public hosted zone.

Answer: B,C,D

Question 4

A Network Engineer is designing a system on AWS that will leverage Amazon CloudFront for content caching and for protecting the underlying origin. The security team has flagged a concern of a probable attack on the origin server IP addresses, despite it being served by CloudFront. Suggest a solution that provides the strongest level of protection to the origin server?

Options :

A : Configure private access to content by using special CloudFront signed URLs or signed cookies

B :

Configure CloudFront to use a custom header and configure an AWS WAF rule on the origin’s Application Load Balancer to accept only traffic that contains that header

C :

Configure an AWS Lambda@Edge function to validate that the traffic to the Application Load Balancer originates from CloudFront

D :

Configure Origin Access Identity(OAI) on the origin server, which will only allow requests originating from CloudFront

Answer: B

Question 5

A health care company has two web applications and wants to run them in separate, isolated VPCs. The company is looking at using Elastic Load Balancing to distribute requests between application instances. The security and compliance team at the company has imposed the following restrictions: Inbound HTTP requests to the application must be routed through a centralized VPC Application VPCs must not be exposed to any other inbound traffic Application VPCs cannot be allowed to initiate any outbound connections Internet gateways must not be attached to the application VPCs Which of the following solutions would you recommend to address these requirements?

Options :

A :

Configure the applications behind private Application Load Balancers (ALBs) in separate VPCs. Set up a public Network Load Balancer (NLB) in the centralized VPC and point the target groups to the ALBs. Set up host-based routing to route application traffic to the corresponding target group through the NLB

B :

Configure the applications behind private Network Load Balancers (NLBs) in separate VPCs. Set up each NLB as an AWS PrivateLink endpoint service with associated VPC endpoints in the centralized VPC. Set up a public Application Load Balancer (ALB) in the centralized VPC and point the target groups to the private IP addresses of each endpoint. Set up host-based routing to route application traffic to the corresponding target group through the ALB

C :

Configure the applications behind private Application Load Balancers (ALBs) in separate VPCs. Set up a public Network Load Balancer (NLB) in the centralized VPC and point the target groups to the private IP addresses of the ALBs. Set up host-based routing to route application traffic to the corresponding target group through the NLB

D :

Configure the applications behind private Network Load Balancers (NLBs) in separate VPCs. Set up VPC Peering between application VPCs and the centralized VPC. Set up a public Application Load Balancer (ALB) in the centralized VPC and point the target groups to the private DNS names of the NLBs. Set up host-based routing to route application traffic to the corresponding target group through the ALB

Answer: B