Question 1

A company uses an Application Load Balancer (ALB) to provide access to a multi-tenant web application for 25 customers. The company creates a unique hostname for each customer to use to access the application. Hostnames use the format customer-name.example.com. Each customer has a dedicated group of Amazon EC2 instances that run their own version of the web application. When a customer visits customer-name.example.com, the ALB should route the request to the correct group of EC2 instances. The company requires a highly available solution that is easy to maintain. Which solution meets these requirements at the LOWEST cost?

Accepted Answer

The lowest cost solution is to use a single ALB for all customers and configure listener rules based on the Host header. This eliminates the need for additional NGINX proxy servers or CloudFront distributions, which can incur additional costs.

Question 2

You manage a website that uses a load balancer. You are noticing one of the servers is receiving more traffic than the other. What is probably the cause of this?

Accepted Answer

Sticky sessions can cause uneven traffic distribution if certain users consistently connect to the same server, leading to one server receiving more traffic.

Question 3

You are configuring multiple Direct Connect links for your organization and need them to be in an HA Active/Passive configuration with extreme sensitivity to outages in order to encourage very quick failover times. You also need to be able to control which link is active. What two configuration changes should you implement? (Choose two.)

Accepted Answer

The answer of You are configuring multiple Direct Connect links...

Question 4

A company wants to use thin clients running virtual desktops to replace 500 desktop computers used by its call center employees. The company is evaluating Amazon WorkSpaces as a solution. A network engineer who is testing with a thin client is unable to connect to Amazon WorkSpaces. After entering credentials, the network engineer receives the following error: "An error occurred while launching your WorkSpace. Please try again." What should the network engineer do to resolve this issue?

Accepted Answer

The inbound rules on the security group assigned to Amazon WorkSpaces need to be updated to allow UDP on port 4172 and TCP on port 4172. This will allow the thin client to connect to Amazon WorkSpaces.

Question 5

In AWS, which service provides a reliable and inexpensive way to backup and archive CloudTrail log files?

Accepted Answer

Amazon Glacier is a low-cost cloud storage service for data archiving and long-term backup, making it suitable for storing CloudTrail log files.

Question 6

A company is delivering web content from an Amazon EC2 instance in a public subnet with address 2001:db8:1:100::1. Users report they are unable to access the web content. The VPC Flow Logs for the subnet contain the following entries: 2 012345678912 eni-0596e500123456789 2001:db8:2:200::2 2001:db8:1:100::1 0 0 58 234 24336 1551299195 1551299434 ACCEPT OK 2 012345678912 eni-0596e500123456789 2001:db8:1:100::1 2001:db8:2:200::2 0 0 58 234 24336 1551299195 1551299434 REJECT OK Which action will restore network reachability to the EC2 instance?

Accepted Answer

The answer of A company is delivering web content from...

Question 7

What is the maximum number of CloudTrails that you can create per AWS region?

Accepted Answer

The answer of What is the maximum number of CloudTrails...

Question 8

Which service parses large Flow Logs for consumption by other programs such as Kibana?

Accepted Answer

ElasticSearch is a service that can parse and analyze large datasets, such as Flow Logs, and is often used in conjunction with Kibana for visualization and analysis.

Question 9

You have just deployed a website that utilizes CloudFront, ELB, and S3 to serve content. When users access your site, they are seeing broken image links. What is most likely the problem?

Accepted Answer

CloudFront needs permission to access the S3 bucket, which can be provided by creating an Origin Access Identity and updating the bucket policy accordingly.

Question 10

You have deployed a website that utilizes CloudFront, Elastic Loadbalancer, and S3 to serve content. When users access your site, they receive a "mixed content" security warning. What is most likely the problem?

Accepted Answer

The "mixed content" warning typically occurs when some resources are loaded over HTTP while others are loaded over HTTPS. If the SSL certificate is applied to the Elastic Load Balancer but not to the CloudFront CDN, users may receive this warning because CloudFront is serving content over HTTP.

Question 11

You are the AWS cloud architect and have been tasked with designing an appropriate subnetting design for your production VPC. Your production VPC requires secure communications back to the corporate private network. Quality of Service (QoS) is very important 24 × 7 for this particular connection, as real-time data is passed continually backwards and forwards between your on-prem bioinformatics enterprise application, and the number crunching servers deployed in the cloud. Any potential latency incurred on this connection will have a direct impact on the company's ability to attract investors and expansion into new markets. Select the correct network configuration that best facilitates your company's continued growth plans.

Accepted Answer

Provisioning a Direct Connect connection with a Virtual Private Gateway and Private Virtual Interface ensures a dedicated, high-bandwidth, low-latency connection between your on-premises network and AWS, which is crucial for real-time data transfer and maintaining QoS.

Question 12

What MTU is recommended for VPN and Direct Connect links?

Accepted Answer

The recommended MTU for VPN and Direct Connect links is typically 1500 bytes, which is the standard Ethernet frame size.

Question 13

You have several VPCs that are peered. Each VPC has several routes to different subnets. Over the years, your company has acquired many companies. You find that traffic destined for one VPC ends up going to another. What is the best way to remedy this?

Accepted Answer

The answer of You have several VPCs that are peered....

Question 14

Which of the following is true when you don't configure Amazon CloudFront to forward cookies to your origin?

Accepted Answer

When you don't configure CloudFront to forward cookies, it removes the Cookie header from requests that it forwards to your origin, ensuring that the cache behavior is not affected by cookies.

Question 15

To allow all traffic to access an instance in "Subnet 1" that uses "Security Group 1", what two options need to be configured? (Choose two.)

Accepted Answer

To allow all traffic to access an instance, you need to configure a Network ACL (NACL) rule allowing all IPs (0.0.0.0/0) to access the subnet and a Security Group rule allowing inbound traffic from all IPs (0.0.0.0/0).

Question 16

You manage a webserver that serves a webpage on AWS infrastructure. You utilize an Application Load Balancer, CloudFront, S3, and some other AWS services for this site. You are only responsible for the server and you don't have access to the AWS console or API. You need to find out what IPs are accessing your website. What is the best way to achieve this?

Accepted Answer

The answer of You manage a webserver that serves a...

Question 17

You have 99 routes in your dynamic BGP propagated route table and you wish to add 2 more: 10.1.0.0 and 10.3.0.0. You cannot modify or remove routes that have already been announced. What should you do?

Accepted Answer

Summarizing the two routes into one will reduce the number of routes in the route table, allowing the addition of the two new routes.

Question 18

Which of the following statements does not describe Jumbo Frames in an AWS VPC environment?

Accepted Answer

T2.micro instances do support Jumbo Frames, as they are capable of using enhanced networking which allows for the use of Jumbo Frames.

Question 19

Select the answer/s that correctly state how Jumbo Frames work

Accepted Answer

Jumbo Frames can improve application performance by reducing the number of packets sent over the network, which decreases overhead and increases efficiency.

Question 20

Which of the following services is used to send an alert from CloudWatch?

Accepted Answer

AWS SNS (Simple Notification Service) is used to send alerts and notifications from CloudWatch.

Exam 1: AWS Certified Advanced Networking - Specialty (ANS-C00)