ANS-C01 Exam Questions & Answers

A network engineer has deployed an Amazon EC2 instance in a private subnet in a VPC. The VPC has no public subnet. The EC2 instancehosts application code that sends messages to an Amazon Simple Queue Service (Amazon SQS) queue. The subnet has the default networkACL with no modification applied. The EC2 instance has the default security group with no modification applied.The SQS queue is not receiving messages.Which of the following are possible causes of this problem? (Choose two.)

A. The EC2 instance is not attached to an IAM role that allows write operations to Amazon SQS.

B. The security group is blocking traffic to the IP address range used by Amazon SQS

C. There is no interface VPC endpoint configured for Amazon SQS

D. The network ACL is blocking return traffic from Amazon SQS

E. There is no route configured in the subnet route table for the IP address range used by Amazon SQS

A company has deployed a new web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are inan Amazon EC2 Auto Scaling group. Enterprise customers from around the world will use the application. Employees of these enterprisecustomers will connect to the application over HTTPS from office locations.The company must configure firewalls to allow outbound traffic to only approved IP addresses. The employees of the enterprise customersmust be able to access the application with the least amount of latency.Which change should a network engineer make in the infrastructure to meet these requirements?

A. Create a new Network Load Balancer (NLB). Add the ALB as a target of the NLB.

B. Create a new Amazon CloudFront distribution. Set the ALB as the distribution's origin.

C. Create a new accelerator in AWS Global Accelerator. Add the ALB as an accelerator endpoint.

D. Create a new Amazon Route 53 hosted zone. Create a new record to route traffic to the ALB.

An insurance company is planning the migration of workloads from its on-premises data center to the AWS Cloud. The company requires end-to-end domain name resolution. Bi-directional DNS resolution between AWS and the existing on-premises environments must be established.The workloads will be migrated into multiple VPCs. The workloads also have dependencies on each other, and not all the workloads will bemigrated at the same time.Which solution meets these requirements?

A. Configure a private hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolverinbound and outbound endpoints in an egress VPC. Define Route 53 Resolver rules to forward requests for the on-premises domains to theon-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC, and share the Route 53 Resolver ruleswith the application accounts by using AWS Resource Access Manager. Configure the on-premises DNS servers to forward the clouddomains to the Route 53 inbound endpoints.

B. Configure a public hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolverinbound and outbound endpoints in an egress VPC. Define Route 53 Resolver rules to forward requests for the on-premises domains to theon-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPC. and share the Route 53 Resolver ruleswith the application accounts by using AWS Resource Access Manager. Configure the on-premises DNS servers to forward the clouddomains to the Route 53 inbound endpoints.

C. Configure a private hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolverinbound and outbound endpoints in an egress VPDefine Route 53 Resolver rules to forward requests for the on-premises domains to theon-premises DNS resolver. Associate the application VPC private hosted zones with the egress VPand share the Route 53 Resolver ruleswith the application accounts by using AWS Resource Access Manager. Configure the on-premises DNS servers to forward the clouddomains to the Route 53 outbound endpoints.

D. Configure a private hosted zone for each application VPC, and create the requisite records. Create a set of Amazon Route 53 Resolverinbound and outbound endpoints in an egress VPC. Define Route 53 Resolver rules to forward requests for the on-premises domains to theon-premises DNS resolver. Associate the Route 53 outbound rules with the application VPCs, and share the private hosted zones with theapplication accounts by using AWS Resource Access Manager. Configure the on-premises DNS servers to forward the cloud domains to theRoute 53 inbound endpoints.