2024 Updated ANS-C01 Tests Engine pdf - All Free Dumps Guaranteed!
Latest AWS Certified Specialty ANS-C01 Actual Free Exam Questions
NEW QUESTION # 55
Your organization has a newly installed 1-Gbps AWS Direct Connect connection. You order the cross-connect from the Direct Connect location provider to the port on your router in the same facility. To enable the use of your first virtual interface, your router must be configured appropriately.
What are the minimum requirements for your router?
- A. BGP Session with MD5, 802.1Q VLAN, Route-Map, Prefix List, IPsec encrypted GRE Tunnel
- B. IPsec Parameters, Pre-Shared key, Peer IP Address, BGP Session with MD5
- C. 1-Gbps Multi Mode Fiber Interface, 802.1Q VLAN, Peer IP Address, BGP Session with MD5.
- D. 1-Gbps Single Mode Fiber Interface, 802.1Q VLAN, Peer IP Address, BGP Session with MD5.
Answer: D
NEW QUESTION # 56
A company's internal security team receives a request to allow Amazon S3 access from inside the corporate network. All external traffic must be explicitly allowed through the corporate firewalls.
How can the security team grant this access?
Response:
- A. Schedule a script to download the Amazon S3 IP prefixes from AWS developer forum announcements.
Update the firewall rules accordingly. - B. Schedule a script to perform a DNS lookup on Amazon S3 endpoints. Update the firewall rules accordingly.
- C. Schedule a script to download and parse the Amazon S3 IP prefixes from the ip-ranges.json file.
Update the firewall rules accordingly. - D. Connect the data center to a VPC using AWS Direct Connect. Create routes that forward traffic from the data center to an Amazon S3 VPC endpoint.
Answer: C
NEW QUESTION # 57
An organization wants to process sensitive information using the Amazon EMR service. The information is stored in on-premises databases. The output of processing will be encrypted using AWS KMS before it is uploaded to a customer-owned Amazon S3 bucket. The current configuration includes a VPS with public and private subnets, with VPN connectivity to the on- premises network. The security organization does not allow Amazon EC2 instances to run in the public subnet.
What is the MOST simple and secure architecture that will achieve the organization's goal?
- A. Create a new VPS without an IGW and configure the VPN and Amazon EMR in a private subnet with an Amazon S3 endpoint and a NAT gateway.
- B. Create a new VPS without an IGW and configure the VPN and Amazon EMR in a private subnet with an Amazon S3 endpoint.
- C. Use the existing VPC and configure Amazon EMR in a private subnet with an Amazon S3 endpoint.
- D. Use the existing VPS and a NAT gateway, and configure Amazon EMR in a private subnet with an Amazon S3 endpoint.
Answer: D
Explanation:
You can connect directly to AWS KMS through a private endpoint in your VPC instead of connecting over the internet. When you use a VPC endpoint, communication between your VPC and AWS KMS is conducted entirely within the AWS network.
https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.html
NEW QUESTION # 58
An Application Load Balancer (ALB) should be used to route inbound connections to a group of EC2 instances. Clients will be connecting with HTTPs.
You must offload the encryption and decryption overhead to the load balancer. Which tasks must be completed to accomplish this?
(Choose two.)
Response:
- A. An X.509 SSL Certificate must be installed on the load balancer
- B. Choose HTTPS as the protocol
- C. Install an SSL certificate on the EC2 instances
- D. Configure a proxy server behind the ALB
Answer: A,B
NEW QUESTION # 59
An insurance company is planning the migration of workloads from its on-premises data center to the AWS Cloud. The company requires end-to-end domain name resolution. Bi-directional DNS resolution between AWS and the existing on-premises environments must be established. The workloads will be migrated into multiple VPCs. The workloads also have dependencies on each other, and not all the workloads will be migrated at the same time.
Which solution meets these requirements?
- A. Configure a public hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VPC. Define Route 53 Resolver rules to forward requests for the on-premises domains to the on-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC. and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager. Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints.
- B. Configure a private hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VPC. Define Route 53 Resolver rules to forward requests for the on-premises domains to the on-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC, and share the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager. Configure the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints.
- C. Configure a private hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VPDefine Route 53 Resolver rules to forward requests for the on-premises domains to the on-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPand s
Answer: B
Explanation:
Creating a private hosted zone for each application VPC and creating the requisite records would enable end-to-end domain name resolution for the resources. Creating a set of Amazon Route 53 Resolver inbound and outbound endpoints in an egress VPC would enable bi-directional DNS resolution between AWS and the existing on-premises environments. Defining Route 53 Resolver rules to forward requests for the on-premises domains to the on-premises DNS resolver would enable DNS queries from AWS resources to on-premises resources. Associating the application VPC private hosted zones with the egress VPC and sharing the Route 53 Resolver rules with the application accounts by using AWS Resource Access Manager would enable DNS queries among different VPCs and accounts. Configuring the on-premises DNS servers to forward the cloud domains to the Route 53 inbound endpoints would enable DNS queries from on-premises resources to AWS resources1.
NEW QUESTION # 60
AWS CloudTrail can be configured to ____ log files across multiple accounts and regions so that log files are delivered to a single bucket.
Response:
- A. aggregate
- B. replicate
- C. disperse
- D. encrypt
Answer: A
NEW QUESTION # 61
A company has 10 web server Amazon EC2 instances that run in an Auto Scaling group in a production VPC. The company has 10 other web servers that run in an on-premises data center.
The company has a 10 Gbps AWS Direct Connect connection between the on-premises data center and the production VPC.
The company needs to implement a load balancing solution that receives HTTPS traffic from thousands of external users. The solution must distribute the traffic across the web servers on AWS and the web servers in the on-premises data center. Regardless of the location of the web servers, HTTPS requests must go to the same web server throughout the entire session.
Which solution will meet these requirements?
- A. Create a Network Load Balancer (NLB) in the production VPCreate a target group. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target group. Enable session affinity (sticky sessions) on the NLB.
- B. Create an Application Load Balancer (ALB) in the production VPC. Create a target group Specify ip as the target type. Register the EC2 instances and the on-premises servers with the target group. Enable application-based session affinity (sticky sessions) on the ALB.
- C. Create a Network Load Balancer (NLB) in the production VPC. Create a target group. Specify ip as the target type. Register the EC2 instances and the on-premises servers with the target group Enable connection draining on the NLB
- D. Create an Application Load Balancer (ALB) in the production VPC. Create a target group. Specify instance as the target type Register the EC2 instances and the on-premises servers with the target group Enable application-based session affinity (sticky sessions) on the ALB.
Answer: B
Explanation:
ALB support on prem's ip address as a target group, and you need session affinity for this.
https://aws.amazon.com/blogs/aws/new-application-load-balancing-via-ip-address-to-aws-on- premises-resources/
NEW QUESTION # 62
A company has established connectivity between its on-premises data center in Paris, France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway.
The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center.
In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet.
Which set of steps should a network engineer take to meet these requirements?
- A. 1. Create public subnets in the Tokyo VPC to migrate the workloads into.
2. Configure an internet gateway for the Tokyo office to reach the Tokyo VPC.
3. Configure security groups on the Tokyo workloads to only allow traffic from the Tokyo office and the Paris workloads.
4. Create peering connections between the Tokyo VPC and the Paris VPCs.
5. Configure a VPN connection between the Paris data center and the Tokyo office by using existing routers. - B. 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.
2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway.
3. Set up a new Direct Connect connection from the Tokyo office to the Tokyo transit gateway.
4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs. - C. 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.
2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway.
3. Configure an AWS Site-to-Site VPN connection from the Tokyo office. Set the Tokyo transit gateway as the target.
4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs. - D. 1. Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit gateway.
2. Create an association between the Paris transit gateway and the Tokyo VPC.
3. Configure routing on the Paris transit gateway to allow data to flow between sites and the VPCs.
Answer: C
Explanation:
Option C is the best solution because it allows the company to use transit gateways to connect the VPCs in different regions and the on-premises sites. Transit gateways support inter-region peering and VPN attachments, which enable secure and scalable connectivity. Option A is not valid because public subnets are not suitable for workloads that cannot be directly accessible from the internet. Option B is not valid because Direct Connect connections take longer than 5 days to provision.
NEW QUESTION # 63
A company is migrating many applications from two on-premises data centers to AWS. The company's network team is setting up connectivity to the AWS environment. The migration will involve spreading the applications across two AWS Regions: us-east-1 and us-west-2.
The company has set up AWS Direct Connect connections at two different locations. Direct Connect connection 1 is to the first data center and is at a location in us-east-1. Direct Connect connection 2 is to the second data center and is at a location in us-west-2.
The company has connected both Direct Connect connections to a single Direct Connect gateway by using transit VIFs. The Direct Connect gateway is associated with transit gateways that are deployed in each Region. All traffic to and from AWS must travel through the first data center. In the event of failure, the second data center must take over the traffic.
How should the network team configure BGP to meet these requirements?
Response:
- A. Configure the local preference BGP community tag 7224:7300 for the transit VIF connected to Direct Connect connection 2.
- B. Configure the local preference BGP community tag 7224:9300 for the transit VIF connected to Direct Connect connection 2.
- C. Use the AS_PATH attribute to prepend the additional hop for the transit VIF connected to Direct Connect connection 1.
- D. Use the AS_PATH attribute to prepend the additional hop for the transit VIF connected to Direct Connect connection 2.
Answer: A
NEW QUESTION # 64
You have created 3 VPC's. VPC A.
VPC B and VPC C.
There is a VPC peering connection between VPC A and VPC B and a separate peering connection between VPC B and VPC C.
Which of the following is true with regards to this VPC peering arrangement?
Response:
- A. Instances launched in VPC A can reach instances in VPC C if the right Security Groups rules are present for the instances
- B. Instances launched in VPC A can reach instances in VPC C if the right routing entries are present.
- C. Instances launched in VPC A can reach instances in VPC C
- D. Instances launched in VPC A can reach instances in VPC C via a proxy instance in VPC B
Answer: D
NEW QUESTION # 65
A company is hosting an application on Amazon EC2 instances behind a Network Load Balancer (NLB). A solutions architect added EC2 instances in a second Availability Zone to improve the availability of the application. The solutions architect added the instances to the NLB target group.
The company's operations team notices that traffic is being routed only to the instances in the first Availability Zone.
What is the MOST operationally efficient solution to resolve this issue?
- A. Enable the new Availability Zone on the NLB
- B. Create a new NLB for the instances in the second Availability Zone
- C. Create a new target group with the instances in both Availability Zones
- D. Enable proxy protocol on the NLB
Answer: A
Explanation:
When adding instances in a new Availability Zone to an existing Network Load Balancer (NLB), it is important to ensure that the new Availability Zone is enabled on the NLB. This will allow traffic to be routed to instances in both Availability Zones. This can be done by editing the settings of the NLB and selecting the new Availability Zone from the list of available zones.
NEW QUESTION # 66
Which CloudWatch attributes are used for the statistics generation?
Response:
- A. Dimension
- B. Data point unit
- C. All the options are used
- D. NameSpace
Answer: C
NEW QUESTION # 67
A real estate company is building an internal application so that real estate agents can upload photos and videos of various properties. The application will store these photos and videos in an Amazon S3 bucket as objects and will use Amazon DynamoDB to store corresponding metadata.
The S3 bucket will be configured to publish all PUT events for new object uploads to an Amazon Simple Queue Service (Amazon SQS) queue.
A compute cluster of Amazon EC2 instances will poll the SQS queue to find out about newly uploaded objects. The cluster will retrieve new objects, perform proprietary image and video recognition and classification update metadata in DynamoDB and replace the objects with new watermarked objects.
The company does not want public IP addresses on the EC2 instances.
Which networking design solution will meet these requirements MOST cost-effectively as application usage increases?
- A. Place the EC2 instances in a private subnet. Create a NAT gateway in a public subnet in the same Availability Zone. Create an internet gateway. Attach the internet gateway to the VPC. In the public subnet's route table, add a default route that points to the internet gateway
- B. Place the EC2 instances in a private subnet. Create an interface VPC endpoint for Amazon SQS.
Create gateway VPC endpoints for Amazon S3 and DynamoDB. - C. Place the EC2 instances in a public subnet. Disable the Auto-assign Public IP option while launching the EC2 instances. Create an internet gateway. Attach the internet gateway to the VPC. In the public subnet's route table, add a default route that points to the internet gateway.
- D. Place the EC2 instances in a private subnet. Create a gateway VPC endpoint for Amazon SQS.Create interface VPC endpoints for Amazon S3 and DynamoDB.
Answer: B
NEW QUESTION # 68
A Systems Administrator is designing a hybrid DNS solution with spilt-view. The apex-domain
"example.com" should be served through name servers across multiple top-level domains (TLDs).
The name server for subdomain "dev.example.com" should reside on-premises. The administrator has decided to use Amazon Route 53 to achieve this scenario.
What procedurals steps must be taken to implement the solution?
Response:
- A. Use a Route 53 public and private hosted zone for example.com and perform subdomain delegation for dev.example.com
- B. Use a Route 53 private hosted zone for example.com and perform subdomain delegation for dev.example.com
- C. Use a Route 53 public hosted zone for example.com and perform subdomain delegation for dev.example.com
- D. Use a Route 53 public hosted zone for example.com and a private hosted zone for dev.example.com
Answer: A
NEW QUESTION # 69
You have defined your original Virtual Private Cloud (VPC) Classless Inter-Domain Routing (CIDR) as
192.168.20.0/24. Your on-premises infrastructure is defined as 192.168.128.0/17.
You have configured a route to on-premises as 192.168.0.0/16 in your VPC route table. You have added a new CIDR range of 192.168.100.0/24 to your VPC.
Which of the following is true?
Response:
- A. This is a valid configuration, the more specific route takes the precedence and hence VPC traffic will be routed internally and on-premises traffic will be routed as per VPC route table configuration.
- B. The new CIDR range should be contiguous to the existing VPC CIDR range.
- C. New CIDR ranges cannot be more specific than existing routes
- D. The route should be defined for 192.168.128.0/17 to allow more granular routing to on-premises devices. All traffic for 192.168.20.0/24 will now flow to on-premises network.
Answer: A
NEW QUESTION # 70
Your company is currently planning on using Route53 for managing Blue Green deployments. They have already setup an So%-2o% for a new deployment. How can you disable traffic to the older setup once all testing is complete?
Response:
- A. Delete the weighted resource record
- B. Change the resource record to a simple routing policy
- C. Change the resource record weight to 0
- D. Change the resource record weight to 100
Answer: C
NEW QUESTION # 71
......
To become certified in the Amazon ANS-C01, individuals must possess a deep understanding of AWS networking services, including VPCs, Route 53, Direct Connect, VPN, and Elastic Load Balancing. ANS-C01 exam covers a wide range of topics, including network design, implementation, optimization, and troubleshooting. It also tests the candidate's knowledge of security, compliance, and governance requirements in AWS networking solutions.
ANS-C01 Dumps Updated Practice Test and 221 unique questions: https://www.test4sure.com/ANS-C01-pass4sure-vce.html
Latest 100% Exam Passing Ratio - ANS-C01 Dumps PDF: https://drive.google.com/open?id=15wEdNG4Z6MWUhF4MrJ-_miwUlH_gx_He