We have prepared AWS Certified Advanced Networking - Specialty (ANS-C01) certification sample questions to make you aware of actual exam properties. This sample question set provides you with information about the Advanced Networking Specialty exam pattern, question formate, a difficulty level of questions and time required to answer each question. To get familiar with AWS Certified Advanced Networking - Specialty exam, we suggest you try our Sample AWS ANS-C01 Certification Practice Exam in simulated AWS certification exam environment.
To test your knowledge and understanding of concepts with real-time scenario based AWS ANS-C01 questions, we strongly recommend you to prepare and practice with Premium AWS Advanced Networking Specialty Certification Practice Exam. The premium AWS Advanced Networking Specialty certification practice exam helps you identify topics in which you are well prepared and topics in which you may need further training to achieving great score in actual AWS Certified Advanced Networking - Specialty exam.
AWS ANS-C01 Sample Questions:
01. A company hosts a public hosted zone in Amazon Route 53. The company wants to configure DNS Security Extensions (DNSSEC) signing for the public hosted zone. All the company's business-critical applications are running in the us-west-2 Region.
The company has created a symmetric, customer managed, single-Region key in us-west-2 by using AWS Key Management Service (AWS KMS). A network engineer finds that the existing AWS KMS key cannot be used to create a key-signing key (KSK).
How can the network engineer resolve this issue?
a) Recreate a symmetric, customer managed, multi-Region key in the us-east-1 Region. Use this key to create a KSK.
b) Recreate a symmetric, customer managed, single-Region key in us-west-2. Use this key to create a KSK.
c) Recreate an asymmetric, customer managed key with an ECC_NIST_P256 key spec in the us-east-1 Region. Use this key to create a KSK.
d) Recreate an asymmetric, customer managed key with an ECC_NIST_P256 key spec in us-west-2. Use this key to create a KSK.
02. A company is using Amazon Route 53 Resolver for its hybrid DNS infrastructure. The company is using Route 53 Resolver forwarding rules for authoritative domains that are hosted on on-premises DNS servers.
The company achieves hybrid network connectivity by using an AWS Site-to-Site VPN connection. A new governance policy requires logging for DNS traffic that originates in the AWS Cloud.
The policy also requires the company to query DNS traffic to identify the source IP address of the resources that the query originated from, along with the DNS name that was requested.
Which solution will meet these requirements?
a) Create VPC flow logs for all VPCs. Send the logs to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the IP address and DNS name.
b) Modify the existing Route 53 Resolver rules to configure logging. Send the logs to an Amazon S3 bucket. Use Amazon Athena to query the IP address and DNS name.
c) Configure DNS logging for the Site-to-Site VPN connection. Send the logs to an Amazon S3 bucket. Use Amazon Athena to query the IP address and DNS name.
d) Configure Route 53 Resolver query logging for all VPCs. Send the logs to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the IP address and DNS name.
03. A company collects a high volume of shipping data and stores the data in an on-premises data center. A network engineer wants to use Amazon S3 to store the data during the first phase of a migration to AWS.
During this phase, an application that resides in the data center will need to access the data privately in an S3 bucket that the company created.
The company has set up an AWS Direct Connect connection with a private VIF to connect the on-premises data center to a VPC. The network engineer plans to use this Direct Connect connection for the hybrid cloud setup. The solution must be highly available.
What should the network engineer do next to implement this architecture?
a) Configure an S3 gateway endpoint in the VPC. Update VPC route tables to route traffic to the S3 gateway endpoint. Configure the S3 gateway endpoint DNS name in the on-premises application.
b) Configure an S3 interface endpoint in the VPC. Configure the S3 interface endpoint DNS name in the on-premises application.
c) Configure an S3 gateway endpoint in the VPC. Update VPC route tables to route traffic to the S3 gateway endpoint. Configure an HTTP proxy on an Amazon EC2 instance in the VPC to route traffic to the S3 gateway endpoint. Configure the HTTP proxy DNS name in the on-premises application.
d) Configure an S3 interface endpoint in the VPC. Update VPC route tables to route traffic to the S3 interface endpoint. Configure an HTTP proxy on an Amazon EC2 instance in the VPC to route traffic to the S3 interface endpoint. Configure the HTTP proxy DNS name in the on-premises application.
04. A gaming company is planning to launch a globally available game that is hosted in one AWS Region. The game backend is hosted on Amazon EC2 instances that are part of an Auto Scaling group.
The game uses the gRPC protocol for bidirectional streaming between game clients and the backend. The company needs to filter incoming traffic based on the source IP address to protect the game.
Which solution will meet these requirements?
a) Configure an AWS Global Accelerator accelerator with an Application Load Balancer (ALB) endpoint. Attach the ALB to the Auto Scaling group. Configure an AWS WAF web ACL for the ALB to filter traffic based on the source IP address.
b) Configure an AWS Global Accelerator accelerator with a Network Load Balancer (NLB) endpoint. Attach the NLB to the Auto Scaling group. Configure security groups for the EC2 instances to filter traffic based on the source IP address.
c) Configure an Amazon CloudFront distribution with an Application Load Balancer (ALB) endpoint. Attach the ALB to the Auto Scaling group. Configure an AWS WAF web ACL for the ALB to filter traffic based on the source IP address.
d) Configure an Amazon CloudFront distribution with a Network Load Balancer (NLB) endpoint. Attach the NLB to the Auto Scaling group. Configure security groups for the EC2 instances to filter traffic based on the source IP address.
05. A company has developed a new web application that processes confidential data that is hosted on Amazon EC2 instances.
The application needs to scale and must use certificates to authenticate clients. The application is configured to request a client's certificate and will validate the certificate as part of the initial handshake.
Which Elastic Load Balancing (ELB) solution will meet these requirements?
a) Configure an Application Load Balancer (ALB) that includes an HTTPS listener on port 443. Create an Auto Scaling group for the EC2 instances. Configure the Auto Scaling group as the target group of the ALB. Configure HTTPS as the protocol for the target group.
b) Configure a Network Load Balancer (NLB) that includes a TLS listener on port 443. Create an Auto Scaling group for the EC2 instances. Configure the Auto Scaling group as the target group of the NLB. Configure the NLB to terminate TLS. Configure TLS as the protocol for the target group.
c) Configure a Network Load Balancer (NLB) that includes a TCP listener on port 443. Create an Auto Scaling group for the EC2 instances. Configure the Auto Scaling group as the target group of the NLB. Configure TCP as the protocol for the target group.
d) Configure an Application Load Balancer (ALB) that includes a TLS listener on port 443. Create an Auto Scaling group for the EC2 instances. Configure the Auto Scaling group as the target group of the ALB. Configure TLS as the protocol for the target group.
06. A company hosts its ecommerce application on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances are in a private subnet with the default DHCP options set. Internet connectivity is through a NAT gateway that is configured in the public subnet.
A third-party audit of the security infrastructure identifies a DNS exfiltration vulnerability. The company must implement a highly available solution that protects against this vulnerability.
Which solution will meet these requirements MOST cost-effectively?
a) Configure a BIND server with DNS filtering. Modify the DNS servers in the DHCP options set.
b) Use Amazon Route 53 Resolver DNS Firewall. Configure a domain list with a rule group.
c) Use AWS Network Firewall with domain name filtering.
d) Configure an Amazon Route 53 Resolver outbound endpoint with rules to filter and block suspicious traffic.
07. A company is migrating many applications from two on-premises data centers to AWS. The company's network team is setting up connectivity to the AWS environment. The migration will involve spreading the applications across two AWS Regions: us-east-1 and us-west-2. The company has set up AWS Direct Connect connections at two different locations. Direct Connect connection 1 is to the first data center and is at a location in us-east-1. Direct Connect connection 2 is to the second data center and is at a location in us-west-2.
The company has connected both Direct Connect connections to a single Direct Connect gateway by using transit VIFs. The Direct Connect gateway is associated with transit gateways that are deployed in each Region.
All traffic to and from AWS must travel through the first data center. In the event of failure, the second data center must take over the traffic.
How should the network team configure BGP to meet these requirements?
The company has connected both Direct Connect connections to a single Direct Connect gateway by using transit VIFs. The Direct Connect gateway is associated with transit gateways that are deployed in each Region.
All traffic to and from AWS must travel through the first data center. In the event of failure, the second data center must take over the traffic.
How should the network team configure BGP to meet these requirements?
a) Configure the local preference BGP community tag 7224:7300 for the transit VIF connected to Direct Connect connection 2.
b) Configure the local preference BGP community tag 7224:9300 for the transit VIF connected to Direct Connect connection 2.
c) Use the AS_PATH attribute to prepend the additional hop for the transit VIF connected to Direct Connect connection 2.
d) Use the AS_PATH attribute to prepend the additional hop for the transit VIF connected to Direct Connect connection 1.
08. A company is designing infrastructure on AWS with three VPCs connected to a transit gateway. The three VPCs are an application VPC, a backend VPC, and an inspection VPC.
The application VPC and the backend VPC have compute instances deployed in Availability Zone A and Availability Zone B. Stateful firewalls are deployed in the same Availability Zones in the inspection VPC, which is a shared services VPC.
All traffic is routed through the inspection VPC through the stateful layer 7 virtual firewall appliances to comply with a security policy that mandates traffic inspection. There are no overlapping IP addresses across the three VPCs.
A network engineer must ensure that traffic between the application VPC and the backend VPC can route through the inspection VPC's stateful firewalls.
Which solution will meet these requirements?
a) Create IPsec VPN connections between the transit gateway and the virtual firewall appliances.
b) Configure Virtual Router Redundancy Protocol (VRRP) on the virtual firewall appliances.
c) Set up BGP between the transit gateway and the virtual firewall appliances.
d) Enable transit gateway appliance mode for the VPC attachment to the inspection VPC.
09. An ecommerce company has a business-critical application that runs on Amazon EC2 instances in a VPC. The company's development team has been testing a new version of the application on test EC2 instances.
The development team wants to test the new application version against production traffic to address any problems that might occur before the company releases the new version across all servers.
Which solution will meet this requirement with no impact on the end user's experience?
a) Configure Amazon Route 53 weighted routing policies by configuring records that have the same name and type as each of the instances. Assign relative weights to the production instances and the test instances.
b) Create an Application Load Balancer with weighted target groups. Add more than one target group to the forward action of a listener rule. Specify a weight for each target group.
c) Implement Traffic Mirroring to replay the production requests to the test instances. Configure the source as the production instances. Configure the target as the test instances.
d) Configure an NGINX proxy in front of the production servers. Use the NGINX mirroring capability.
10. A company has multiple VPCs in the us-east-1 Region. The company has deployed a website in one of the VPCs.
The company wants to implement split-view DNS so that the website is accessible internally from the VPCs and externally over the internet with the same domain name, example.com.
Which solution will meet these requirements?
a) Change the DHCP options for each VPC to use the IP address of an on-premises DNS server. Create a private hosted zone and a public hosted zone for example.com. Map the private hosted zone to the website's internal IP address. Map the public hosted zone to the website's external IP address.
b) Create Amazon Route 53 private hosted zones and public hosted zones that have the same name, example.com. Associate the VPCs with the private hosted zone. Create records in each hosted zone that determine how traffic is routed.
c) Create an Amazon Route 53 Resolver inbound endpoint for resolving example.com internally. Create a Route 53 public hosted zone for routing external DNS queries.
d) Create an Amazon Route 53 Resolver outbound endpoint for resolving example.com externally. Create a Route 53 private hosted zone for routing internal DNS queries.
Answers:
|
Question: 01 Answer: c |
Question: 02 Answer: d |
Question: 03 Answer: b |
Question: 04 Answer: a |
Question: 05 Answer: c |
|
Question: 06 Answer: b |
Question: 07 Answer: a |
Question: 08 Answer: d |
Question: 09 Answer: c |
Question: 10 Answer: b |
Note: Please update us by writing an email on feedback@vmexam.com for any error in AWS Certified Advanced Networking - Specialty certification exam sample questions