Amazon Web ServicesExpert levelANS-C01Page 3 of 6

ANS-C01 exam dumps: questions 201 to 300 of 512

Page 3 of the free ANS-C01 question bank for the AWS Certified Advanced Networking - Specialty exam. Questions 201 to 300 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated December 2024

Start timed practice exam Questions 201 to 300

Free ANS-C01 practice questions

Questions 201 to 205 of 512

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

ANS-C01 Question 201

Select 3

Your company has deployed a hybrid network architecture where an on-premises data center connects to an Amazon VPC using an AWS Direct Connect connection. The on-premises network uses VLANs for segmentation, and the VPC has multiple subnets. You are tasked with ensuring that traffic from specific VLANs is routed to specific subnets in the VPC. Which of the following steps should you take to achieve this goal?

  1. A

    Configure 802.1Q VLAN tagging on the Direct Connect connection.

  2. B

    Use a Virtual Private Gateway (VGW) to terminate the Direct Connect connection.

  3. C

    Set up a custom route table in the VPC to route traffic to the appropriate subnets.

  4. D

    Use AWS Transit Gateway to handle routing between VLANs and VPC subnets.

  5. E

    Ensure the on-premises router maps VLAN traffic to distinct BGP prefixes advertised to AWS.

Show answer and explanation

Correct answers: A, C, E

Explanation

To route traffic from specific VLANs on-premises to specific subnets in the VPC, you need to configure 802.1Q VLAN tagging on the Direct Connect connection to segment traffic. Additionally, the on-premises router should map VLAN traffic to distinct BGP prefixes that are advertised to AWS, enabling AWS to differentiate the traffic. Within the VPC, you must configure custom route tables to direct the incoming traffic to the appropriate subnets. A Virtual Private Gateway or AWS Transit Gateway is not required in this specific scenario since the routing can be managed with the provided tools.

  • A. Correct.

    Correct: 802.1Q VLAN tagging is required to differentiate traffic from different VLANs on the same physical connection.

  • B. Incorrect.

    Incorrect: While a VGW can terminate a Direct Connect connection, it does not support routing based on VLANs.

  • C. Correct.

    Correct: A custom route table in the VPC is needed to map incoming traffic to the appropriate subnets.

  • D. Incorrect.

    Incorrect: AWS Transit Gateway is not required for this setup. The routing can be handled using Direct Connect and VPC route tables.

  • E. Correct.

    Correct: The on-premises router must map VLANs to distinct BGP prefixes to differentiate traffic and ensure proper routing to the VPC.

ANS-C01 Question 202

Select 3

Your company has deployed an application in a VPC consisting of two subnets: a private subnet and a public subnet. The private subnet hosts application servers, while the public subnet hosts a NAT Gateway. The application in the private subnet needs to communicate with an external service over the internet. You notice that the application cannot establish a connection to the external service. Which of the following could be the reason for the connectivity issue?

  1. A

    The private subnet does not have a route in its route table pointing to the NAT Gateway.

  2. B

    The NAT Gateway is not associated with an Elastic IP address.

  3. C

    The public subnet does not have a route in its route table pointing to an internet gateway.

  4. D

    The security group of the application servers in the private subnet does not allow outbound traffic to the destination IP or port.

  5. E

    The NAT Gateway is deployed in the private subnet instead of the public subnet.

Show answer and explanation

Correct answers: A, B, D

Explanation

For instances in a private subnet to access the internet through a NAT Gateway, the private subnet's route table must have a route to the NAT Gateway. Additionally, the NAT Gateway must be associated with an Elastic IP address and deployed in a public subnet. Security groups must also allow the necessary outbound traffic. Any misconfiguration in these areas can prevent the application from connecting to external services.

  • A. Correct.

    Correct. For instances in the private subnet to communicate with external services, the private subnet's route table must have a route to the NAT Gateway.

  • B. Correct.

    Correct. A NAT Gateway must be associated with an Elastic IP address to enable outbound internet access for resources in a private subnet.

  • C. Incorrect.

    Incorrect. While the internet gateway is required for internet access, this issue would prevent the NAT Gateway from working entirely, not just the private subnet's connectivity.

  • D. Correct.

    Correct. The security group of the application servers must allow outbound traffic to the destination IP and port for the connection to succeed.

  • E. Incorrect.

    Incorrect. A NAT Gateway must be deployed in a public subnet to provide outbound internet access to private subnets.

ANS-C01 Question 203

Select 4

Your company has implemented an SD-WAN solution to connect branch offices with the central data center. You want to integrate this SD-WAN solution with AWS to enable seamless connectivity between your branch offices, on-premises data center, and AWS workloads. To achieve this, you plan to use AWS Transit Gateway Connect. Which of the following steps are required to establish this integration?

  1. A

    Create a Transit Gateway Connect attachment for the SD-WAN appliance.

  2. B

    Configure a GRE tunnel between the SD-WAN appliance and the Transit Gateway Connect attachment.

  3. C

    Enable BGP on the Transit Gateway Connect attachment to exchange routing information.

  4. D

    Create a Transit Gateway VPC attachment between the Transit Gateway and your AWS workload's VPC.

  5. E

    Set up a Direct Connect gateway to connect the Transit Gateway to your SD-WAN appliance.

Show answer and explanation

Correct answers: A, B, C, D

Explanation

AWS Transit Gateway Connect is specifically designed to integrate SD-WAN appliances with AWS. To establish this integration, you must create a Transit Gateway Connect attachment, configure GRE tunnels for connectivity, and enable BGP for dynamic routing. Additionally, a VPC attachment is required to connect AWS workloads to the Transit Gateway. Direct Connect is not needed for this use case, as Transit Gateway Connect operates over GRE tunnels and supports dynamic routing.

  • A. Correct.

    This is correct. Transit Gateway Connect attachments are designed to enable SD-WAN and other third-party appliances to integrate with AWS Transit Gateway.

  • B. Correct.

    This is correct. GRE tunnels are required for establishing the connection between the SD-WAN appliance and the Transit Gateway Connect attachment.

  • C. Correct.

    This is correct. BGP must be enabled to dynamically exchange routing information between the SD-WAN appliance and AWS Transit Gateway.

  • D. Correct.

    This is correct. A VPC attachment is necessary to route traffic between AWS workloads in a VPC and the Transit Gateway.

  • E. Incorrect.

    This is incorrect. Direct Connect is not required for Transit Gateway Connect; the integration is designed to work over IP-based connections, such as VPN or GRE.

ANS-C01 Question 204

Select 2

Your company is deploying a global SD-WAN solution and has decided to use AWS Transit Gateway Connect to integrate with its on-premises SD-WAN appliances. The SD-WAN appliances at different branch locations will connect to the Transit Gateway through AWS VPN connections. Which of the following statements are correct about configuring AWS Transit Gateway Connect for this use case? (Choose TWO)

  1. A

    You must create a Transit Gateway Connect attachment to establish connectivity between the SD-WAN appliances and the Transit Gateway.

  2. B

    Transit Gateway Connect requires you to use GRE tunnels to establish connectivity between the Transit Gateway and the SD-WAN appliances.

  3. C

    Transit Gateway Connect automatically encrypts traffic between the Transit Gateway and the SD-WAN appliances without the need for additional configuration.

  4. D

    You can use BGP to dynamically exchange routing information between the Transit Gateway and the SD-WAN appliances over the Connect attachment.

Show answer and explanation

Correct answers: A, D

Explanation

AWS Transit Gateway Connect is designed to integrate third-party SD-WAN appliances with AWS Transit Gateway. In this use case, the setup requires creating a Connect attachment to establish connectivity and using BGP for dynamic routing. GRE tunnels are optional but not mandatory, and encryption must be handled separately, such as by using AWS VPN. This ensures secure and efficient traffic management across the hybrid SD-WAN deployment.

  • A. Correct.

    Correct: Transit Gateway Connect requires a Connect attachment to integrate third-party SD-WAN appliances with the Transit Gateway.

  • B. Incorrect.

    Incorrect: While GRE tunnels are supported, they are not mandatory for establishing connectivity with Transit Gateway Connect. Instead, Connect attachments are required.

  • C. Incorrect.

    Incorrect: Transit Gateway Connect itself does not provide encryption. You would need to use AWS VPN or other encryption mechanisms for secure communication.

  • D. Correct.

    Correct: Transit Gateway Connect allows dynamic routing using BGP, enabling seamless exchange of routing information between the Transit Gateway and SD-WAN appliances.

ANS-C01 Question 205

Select 3

Your organization has deployed an SD-WAN solution and wants to integrate it with AWS for optimized traffic management and hybrid connectivity. You decide to use AWS Transit Gateway Connect. Which of the following steps are required to enable this setup?

  1. A

    Establish a Connect peer using a GRE tunnel between the Transit Gateway and your SD-WAN appliance.

  2. B

    Attach the SD-WAN appliance directly to the Transit Gateway using a VPC attachment.

  3. C

    Configure the Transit Gateway Connect attachment by associating it with an existing Transit Gateway attachment.

  4. D

    Set up dynamic routing using Border Gateway Protocol (BGP) between the Connect peer and the Transit Gateway.

  5. E

    Manually configure static routes on the Transit Gateway to handle traffic from the SD-WAN appliance.

Show answer and explanation

Correct answers: A, C, D

Explanation

AWS Transit Gateway Connect is specifically designed to integrate SD-WAN appliances with AWS. The integration requires creating a Connect attachment, establishing a GRE-based Connect peer, and configuring BGP for dynamic routing. Direct attachment of SD-WAN appliances or reliance solely on static routes doesn't align with the capabilities or best practices of Transit Gateway Connect.

  • A. Correct.

    Correct. Establishing a Connect peer using a GRE tunnel is a key step in configuring Transit Gateway Connect to integrate with SD-WAN appliances.

  • B. Incorrect.

    Incorrect. SD-WAN appliances cannot be directly attached to a Transit Gateway. Instead, a Connect attachment is used for such integrations.

  • C. Correct.

    Correct. A Transit Gateway Connect attachment must be associated with an existing Transit Gateway attachment, such as a VPC or VPN attachment, to enable traffic flow.

  • D. Correct.

    Correct. BGP is used for dynamic routing between the Transit Gateway and the SD-WAN appliance, allowing efficient route advertisement and traffic management.

  • E. Incorrect.

    Incorrect. While static routes can be used in some cases, dynamic routing using BGP is the recommended and scalable approach for Transit Gateway Connect setups.

Timed practice exam

Take a ANS-C01 practice test under exam conditions

65 questions in 170 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

ANS-C01 practice questions 201 to 300 of 512

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 6 pages of up to 100 questions.

  1. 201.Your company has deployed a hybrid network architecture where an on-premises data center connects to an...
  2. 202.Your company has deployed an application in a VPC consisting of two subnets: a private subnet and a public...
  3. 203.Your company has implemented an SD-WAN solution to connect branch offices with the central data center. You...
  4. 204.Your company is deploying a global SD-WAN solution and has decided to use AWS Transit Gateway Connect to...
  5. 205.Your organization has deployed an SD-WAN solution and wants to integrate it with AWS for optimized traffic...
  6. 206.Your organization has deployed an SD-WAN solution to connect branch offices to AWS. You want to optimize...
  7. 207.Your company has a hybrid cloud setup where corporate users from on-premises need to resolve private...
  8. 208.An organization has deployed a hybrid infrastructure where applications are spread across their on-premises...
  9. 209.Your organization has deployed a hybrid cloud architecture. The on-premises network uses a private Active...
  10. 210.Your company has a hybrid cloud architecture where workloads are running in both an on-premises environment...
  11. 211.You are designing a highly available and secure network architecture for an application hosted in Amazon VPC....
  12. 212.An organization is deploying a third-party firewall appliance in their AWS environment to inspect traffic...
  13. 213.A company is deploying a third-party firewall appliance on AWS for inspecting and filtering outbound traffic...
  14. 214.You are designing a highly secure network architecture for a multi-account AWS setup. Your security team...
  15. 215.You are designing an application hosted in AWS that serves HTTP and HTTPS traffic to users worldwide. The...
  16. 216.Your company is deploying a web application that serves dynamic content and needs advanced application-layer...
  17. 217.You are designing a highly available web application hosted on AWS. The application has both static content...
  18. 218.Your company has deployed a web application hosted on Amazon EC2 instances. You are tasked with designing a...
  19. 219.Your organization is building a highly available and scalable web application in AWS across multiple regions....
  20. 220.Your organization is building a multi-region architecture to host a web application. To ensure consistent...
  21. 221.Your organization is deploying a multi-region architecture using AWS CloudFormation to automate the...
  22. 222.Your company is deploying a new application across multiple AWS accounts and regions. To ensure consistent...
  23. 223.An organization is using AWS Organizations with multiple AWS accounts. The organization needs to set up a...
  24. 224.An organization has set up a multi-account architecture using AWS Organizations. The central IT account is...
  25. 225.Your organization has multiple AWS accounts managed through AWS Organizations. You have created a shared...
  26. 226.An organization has a multi-account setup managed through AWS Organizations. They want to share a centrally...
  27. 227.You have deployed a multi-tier application in AWS with an ALB (Application Load Balancer) in front of the web...
  28. 228.You have deployed a VPC with multiple subnets in different Availability Zones (AZs) and set up a peering...
  29. 229.You have a VPC with multiple subnets and route tables. Your application hosted in a private subnet is unable...
  30. 230.Your company has a VPC with several private subnets hosting critical services. Recently, some instances in a...
  31. 231.You are designing a highly available web application in AWS that spans two Availability Zones within the same...
  32. 232.You are designing a multi-tier application that runs in an Amazon VPC. The application has three layers: a...
  33. 233.You are designing a VPC network for a company that requires highly available, fault-tolerant applications...
  34. 234.Your company is running a multi-tier application in AWS, hosted in a VPC. The application consists of web...
  35. 235.An organization has multiple AWS accounts and wants to establish secure connectivity between VPCs across...
  36. 236.You are managing a multi-account AWS setup for a global company. The company has multiple VPCs in different...
  37. 237.You are a network architect working for a company with multiple AWS accounts managed using AWS Organizations....
  38. 238.Your organization has three AWS accounts (Account A, Account B, Account C), each hosting a VPC in the same...
  39. 239.Your company uses an AWS Direct Connect connection to establish a private network connection between your...
  40. 240.Your company is designing a hybrid cloud architecture where the on-premises data center communicates securely...
  41. 241.Your company has deployed a multi-region application on AWS to ensure high availability and low latency for...
  42. 242.Your company is planning to deploy a high-availability web application across multiple AWS Regions. The...
  43. 243.Your organization has multiple AWS accounts managed under AWS Organizations. Each account hosts its own VPCs,...
  44. 244.A company operates multiple AWS accounts as part of their AWS Organizations setup. They want to establish...
  45. 245.Your organization has multiple AWS accounts, each with its own set of VPCs. You need to establish secure and...
  46. 246.Your organization has multiple AWS accounts, each with its own Amazon VPCs in different regions. You need to...
  47. 247.You are designing a secure architecture for an internal application hosted in your VPC that needs to...
  48. 248.Your company has a VPC in AWS that hosts a business-critical application running on an Amazon ECS service....
  49. 249.A company has deployed a private web application in an Amazon VPC. The application needs to be accessed...
  50. 250.Your organization is hosting an internal billing application in a VPC within your AWS account. The...
  51. 251.An enterprise uses AWS Organizations to manage multiple accounts and wants to share a central VPC across...
  52. 252.Your organization operates multiple AWS accounts managed using AWS Organizations. To centralize and share...
  53. 253.Your organization has multiple AWS accounts managed under AWS Organizations. You want to share a VPC from one...
  54. 254.A company operates in a multi-account setup using AWS Organizations and needs to share a VPC across multiple...
  55. 255.An e-commerce company is deploying a multi-region architecture to ensure high availability and low latency...
  56. 256.An e-commerce application hosted on AWS is experiencing intermittent connectivity issues. The application...
  57. 257.Your company is hosting a multi-region application on AWS. The application requires low-latency DNS...
  58. 258.An e-commerce company has deployed its application on Amazon ECS with Fargate. The application uses a custom...
  59. 259.Your company is managing a large-scale, multi-account AWS environment. To ensure consistent network...
  60. 260.You are tasked with creating and managing a secure, repeatable, and automated network infrastructure...
  61. 261.You are managing a large-scale AWS environment that spans multiple accounts and regions. The infrastructure...
  62. 262.You are designing a highly available architecture for a multi-account AWS environment. Your organization...
  63. 263.An organization wants to enable Single Sign-On (SSO) for its applications hosted in AWS using its on-premises...
  64. 264.Your company has deployed an application in AWS that requires users to authenticate via single sign-on (SSO)...
  65. 265.Your company has an on-premises Active Directory (AD) and uses AWS for hosting critical applications. You...
  66. 266.Your company is using an on-premises Active Directory (AD) for user authentication and plans to migrate its...
  67. 267.Your organization has deployed a three-tier web application in a VPC. The architecture includes a...
  68. 268.An organization is hosting a web application on Amazon EC2 instances behind an Application Load Balancer...
  69. 269.Your company has deployed a three-tier web application on AWS. The application stack consists of an...
  70. 270.Your organization is hosting a highly sensitive web application on Amazon EC2 instances in a private subnet....
  71. 271.Your organization has a VPC with a public and private subnet. Resources in the private subnet are unable to...
  72. 272.You are troubleshooting a connectivity issue in your AWS environment. A web server in a private subnet in...
  73. 273.You have deployed a multi-tier application in AWS with an Application Load Balancer (ALB) in front of a fleet...
  74. 274.A company is troubleshooting connectivity issues between an Amazon EC2 instance in a private subnet and an...
  75. 275.Your organization has a multi-account AWS setup and requires a DNS architecture that allows seamless...
  76. 276.You are designing a hybrid DNS architecture for a company that has on-premises infrastructure and multiple...
  77. 277.Your company has a multi-account AWS architecture where each account hosts specific services. The...
  78. 278.Your company operates a hybrid architecture with workloads distributed across an on-premises data center and...
  79. 279.Your organization is deploying an application across multiple AWS Regions to ensure high availability and low...
  80. 280.Your company is running a multi-region application hosted on Amazon ECS with a private application load...
  81. 281.You are designing a hybrid network architecture for a company that requires a highly available, low-latency...
  82. 282.You are designing a multi-region disaster recovery (DR) strategy for a critical application running in AWS....
  83. 283.Your company has a hybrid architecture setup with an on-premises data center and an AWS VPC. You need to...
  84. 284.Your organization is hosting a multi-tier application on AWS. The frontend of your application is publicly...
  85. 285.A company has a hybrid cloud architecture with workloads deployed both on AWS and on-premises. The company...
  86. 286.You are designing the DNS architecture for a company that operates both an internal application accessible...
  87. 287.An organization wants to serve users globally from multiple AWS Regions using Amazon Route 53. They need to...
  88. 288.Your organization deploys a global application using multiple AWS Regions, and you want to manage traffic...
  89. 289.You are managing a global application hosted on AWS that needs to direct users to the nearest application...
  90. 290.You manage a global application hosted in multiple AWS Regions. To provide an optimal user experience, you...
  91. 291.Your organization uses an Amazon Route 53 private hosted zone for internal DNS resolution within a VPC and...
  92. 292.Your company has a hybrid cloud setup with resources in both an on-premises data center and AWS. The...
  93. 293.Your organization has deployed a hybrid cloud environment with an on-premises data center and an AWS VPC. The...
  94. 294.Your organization has an on-premises network and a VPC in AWS. You want to configure DNS resolution such that...
  95. 295.Your organization is using Route 53 as a DNS service for a web application hosted on AWS. The application...
  96. 296.An organization has hosted a website using an Amazon S3 bucket configured as a static website. The...
  97. 297.An e-commerce company is hosting their website on an Amazon S3 bucket configured as a static website. They...
  98. 298.Your company is hosting an application in AWS that requires a domain name to point to an Application Load...
  99. 299.Your company is hosting a public-facing web application on AWS. You are tasked with ensuring that the DNS...
  100. 300.Your organization is hosting a public-facing web application on Amazon Route 53 and has implemented DNSSEC to...

More AWS exam dumps

All AWS exams
AIF-C01230 questions

AWS Certified AI Practitioner exam dumps

AWS Certified AI Practitioner

CLF-C02341 questions

AWS Certified Cloud Practitioner exam dumps

AWS Certified Cloud Practitioner

DEA-C01549 questions

AWS Data Engineer Associate exam dumps

AWS Certified Data Engineer - Associate

DOP-C02410 questions

AWS DevOps Engineer Professional exam dumps

AWS Certified DevOps Engineer - Professional

DVA-C02398 questions

AWS Developer Associate exam dumps

AWS Certified Developer - Associate

MLS-C01388 questions

AWS Machine Learning Specialty exam dumps

AWS Certified Machine Learning - Specialty

MLA-C01457 questions

AWS Machine Learning Engineer Associate exam dumps

AWS Certified Machine Learning Engineer - Associate

SCS-C02503 questions

AWS Security Specialty exam dumps

AWS Certified Security - Specialty