Question 1

A retail company operates its IT infrastructure in a hybrid cloud configuration with the on-premises data center connected to the AWS Cloud via an AWS Site-to-Site VPN connection. The networking team has set up an AWS VPC with a CIDR range of 10.0.0.0/16 and the on-premises network has a CIDR range of 172.31.0.0/24. The VPC's route table also has a static route to an internet gateway and a propagated route to a virtual private gateway. Both routes have a destination of 172.31.0.0/24. Which of the following represents a correct statement regarding the routing for traffic destined to the on-premises network?

Options :

A : All traffic destined for 172.31.0.0/24 is routed via the internet gateway

B : All traffic destined for 172.31.0.0/24 is routed via the virtual private gateway

C :

All traffic destined for 172.31.0.0/24 could be routed via the internet gateway or the virtual private gateway as decided by the router randomly

D :

The on-premises network would be unreachable as the local route would be preferred for all traffic destined for 172.31.0.0/24

Answer: A

Question 2

A Network Engineer is designing a system on AWS that will leverage Amazon CloudFront for content caching and for protecting the underlying origin. The security team has flagged a concern of a probable attack on the origin server IP addresses, despite it being served by CloudFront. Suggest a solution that provides the strongest level of protection to the origin server?

Options :

A : Configure private access to content by using special CloudFront signed URLs or signed cookies

B :

Configure CloudFront to use a custom header and configure an AWS WAF rule on the origin’s Application Load Balancer to accept only traffic that contains that header

C :

Configure an AWS Lambda@Edge function to validate that the traffic to the Application Load Balancer originates from CloudFront

D :

Configure Origin Access Identity(OAI) on the origin server, which will only allow requests originating from CloudFront

Answer: B

Question 3

A company has a hybrid cloud environment. The company’s data center is connected to the AWS Cloud by an AWS Direct Connect connection. The AWS environment includes VPCs that are connected together in a huband-spoke model by a transit gateway. The AWS environment has a transit VIF with a Direct Connect gateway for on-premises connectivity. The company has a hybrid DNS model. The company has configured Amazon Route 53 Resolver endpoints in the hub VPC to allow bidirectional DNS traffic flow. The company is running a backend application in one of the VPCs. The company uses a message-oriented architecture and employs Amazon Simple Queue Service (Amazon SQS) to receive messages from other applications over a private network. A network engineer wants to use an interface VPC endpoint for Amazon SQS for this architecture. Client services must be able to access the endpoint service from on premises and from multiple VPCs within the company's AWS infrastructure. Which combination of steps should the network engineer take to ensure that the client applications can resolve DNS for the interface endpoint? (Choose three.)

Options :

A : Create the interface endpoint for Amazon SQS with the option for private DNS names turned on.

B : Create the interface endpoint for Amazon SQS with the option for private DNS names turned off.

C :

Manually create a private hosted zone for sqs.us-east-1.amazonaws.com. Add necessary records that point to the interface endpoint. Associate the private hosted zones with other VPCs.

D :

Use the automatically created private hosted zone for sqs.us-east-1.amazonaws.com with previously created necessary records that point to the interface endpoint. Associate the private hosted zones with other VPCs.

E :

Access the SQS endpoint by using the public DNS name sqs.us-east-1 amazonaws.com in VPCs and on premises.

F :

Access the SQS endpoint by using the private DNS name of the interface endpoint .sqs.us-east-1.vpce. amazonaws.com in VPCs and on premises.

Answer: A,D,F

Question 4

A company is migrating an existing application to a new AWS account. The company will deploy the application in a single AWS Region by using one VPC and multiple Availability Zones. The application will run on Amazon EC2 instances. Each Availability Zone will have several EC2 instances. The EC2 instances will be deployed in private subnets. The company's clients will connect to the application by using a web browser with the HTTPS protocol. Inbound connections must be distributed across the Availability Zones and EC2 instances. All connections from the same client session must be connected to the same EC2 instance. The company must provide end-toend encryption for all connections between the clients and the application by using the application SSL certificate. Which solution will meet these requirements?

Options :

A :

Create a Network Load Balancer. Create a target group. Set the protocol to TCP and the port to 443 for the target group. Turn on session affinity (sticky sessions). Register the EC2 instances as targets. Create a listener. Set the protocol to TCP and the port to 443 for the listener. Deploy SSL certificates to the EC2 instances.

B :

Create an Application Load Balancer. Create a target group. Set the protocol to HTTP and the port to 80 for the target group. Turn on session affinity (sticky sessions) with an application-based cookie policy. Register the EC2 instances as targets. Create an HTTPS listener. Set the default action to forward to the target group. Use AWS Certificate Manager (ACM) to create a certificate for the listener.

C :

Create a Network Load Balancer. Create a target group. Set the protocol to TLS and the port to 443 for the target group. Turn on session affinity (sticky sessions). Register the EC2 instances as targets. Create a listener. Set the protocol to TLS and the port to 443 for the listener. Use AWS Certificate Manager (ACM) to create a certificate for the application.

D :

Create an Application Load Balancer. Create a target group. Set the protocol to HTTPS and the port to 443 for the target group. Turn on session affinity (sticky sessions) with an application-based cookie policy. Register the EC2 instances as targets. Create an HTTP listener. Set the port to 443 for the listener. Set the default action to forward to the target group.

Answer: A

Question 5

An application's EC2 instances are located in a private subnet and these instances access sensitive data in S3 via a NAT gateway deployed in a public subnet. The S3 bucket is located in the same AWS Region as the EC2 instances. The development team at the company wants to ensure that this bucket can be accessed only from the VPC where the application resides. As an AWS Certified Networking Specialist, which of the following solutions would you suggest to meet these requirements?

Options :

A :

Create an S3 bucket policy and use an IP address condition to restrict access to the bucket. Allow access only from the VPC CIDR range and deny all other IP address ranges

B :

Create a new IAM role for the EC2 instances that provides access to the S3 bucket and assign the role to the application instances. Set up an S3 bucket policy to allow access only from the role

C :

Set up an S3 VPC endpoint in the VPC where the application resides. Configure an S3 bucket policy with a condition to allow access only from the VPC endpoint

D : Set up an Origin Access Identity (OAI) for the S3 bucket and allow access only from within the VPC

Answer: C