Amazon Web ServicesExpert levelANS-C01Page 4 of 6

ANS-C01 exam dumps: questions 301 to 400 of 512

Page 4 of the free ANS-C01 question bank for the AWS Certified Advanced Networking - Specialty exam. Questions 301 to 400 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated December 2024

Start timed practice exam Questions 301 to 400

Free ANS-C01 practice questions

Questions 301 to 305 of 512

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

ANS-C01 Question 301

Select 2

Your organization is hosting a web application on AWS and uses Amazon Route 53 for DNS. To enhance the security of your DNS records and prevent DNS spoofing, your team has decided to implement DNSSEC. What steps must you take to enable DNSSEC on an Amazon Route 53 hosted zone?

  1. A

    Enable DNSSEC signing on the hosted zone in Amazon Route 53

  2. B

    Export the DS (Delegation Signer) record from the hosted zone and add it to the parent domain registrar

  3. C

    Configure Route 53 Resolver to validate DNSSEC-signed records

  4. D

    Enable DNSSEC on Route 53 Resolver endpoints

  5. E

    Manually sign your DNS records using a third-party DNS tool and upload the signed records to the hosted zone

Show answer and explanation

Correct answers: A, B

Explanation

To secure your DNS records with DNSSEC in Amazon Route 53, you must enable DNSSEC signing on the hosted zone and export the DS record to the parent domain registrar to establish the chain of trust. This ensures that DNS resolvers can verify the authenticity of your DNS data. The other options are either unrelated to hosted zone DNSSEC or incorrect for this scenario.

  • A. Correct.

    Correct. Enabling DNSSEC signing on the hosted zone is the first step to activate DNSSEC for a Route 53 hosted zone. This step ensures that Route 53 generates and manages the necessary DNSSEC keys.

  • B. Correct.

    Correct. After enabling DNSSEC signing, you must export the DS record and provide it to the parent domain registrar. This is required for the chain of trust to be established between the parent domain and your hosted zone.

  • C. Incorrect.

    Incorrect. DNSSEC validation is not configured directly within Route 53 Resolver for this use case. Instead, this is typically handled by the resolver's clients or other DNS resolvers.

  • D. Incorrect.

    Incorrect. While Route 53 Resolver endpoints can perform DNSSEC validation for incoming queries, enabling DNSSEC on the hosted zone is unrelated to this configuration.

  • E. Incorrect.

    Incorrect. DNSSEC signing is automatically managed by Route 53 for hosted zones when DNSSEC signing is enabled. There is no need to manually sign the records.

ANS-C01 Question 302

Select 2

Your company is operating a public-facing application hosted on Amazon Route 53. To enhance security, you are tasked with implementing DNSSEC for your domain. After enabling DNSSEC in Route 53, what additional steps must you take to complete the DNSSEC setup?

  1. A

    Publish the DS (Delegation Signer) record in your domain's parent zone through your domain registrar.

  2. B

    Generate a public/private key pair and upload the public key to Route 53.

  3. C

    Validate the DNSSEC chain of trust by testing the DNS records using a DNSSEC validation tool.

  4. D

    Configure a key-signing key (KSK) in Route 53 and enable automatic key management.

  5. E

    Inform AWS Support to manually propagate DNSSEC settings across the global Route 53 infrastructure.

Show answer and explanation

Correct answers: A, C

Explanation

To successfully configure DNSSEC in Amazon Route 53, you need to establish the chain of trust by publishing the DS record in your domain's parent zone through your registrar. Additionally, validating the implementation ensures that the DNSSEC setup is functioning correctly. Route 53 automates key management, so manual key configuration or AWS Support involvement is not required.

  • A. Correct.

    Correct: After enabling DNSSEC in Route 53, you must publish the DS record in your domain's parent zone using your domain registrar. This step establishes the chain of trust between the parent zone and your domain.

  • B. Incorrect.

    Incorrect: Route 53 automatically handles key management, and you do not need to generate or upload your own key pair.

  • C. Correct.

    Correct: Testing the DNSSEC implementation using a validation tool ensures that the chain of trust is correctly configured and operational.

  • D. Incorrect.

    Incorrect: Route 53 automatically manages KSKs, so there is no need for manual configuration or enabling automatic key management explicitly by the user.

  • E. Incorrect.

    Incorrect: AWS Support is not involved in propagating DNSSEC settings; the implementation is automated within Route 53.

ANS-C01 Question 303

Select 2

Your organization has multiple AWS accounts managed under a single AWS Organization. You want to centralize DNS management by sharing a Route 53 private hosted zone from the 'Networking' account with specific VPCs in the 'Development' and 'Production' accounts. Which steps should you take to achieve this using AWS Resource Access Manager (RAM)?

  1. A

    Create a private hosted zone in the 'Networking' account and associate it with the VPCs in the 'Development' and 'Production' accounts using AWS RAM.

  2. B

    Share the private hosted zone from the 'Networking' account by creating a resource share in AWS RAM and including the required VPCs.

  3. C

    Enable AWS Organizations integration in AWS RAM for the 'Networking' account to allow cross-account resource sharing.

  4. D

    Manually configure Route 53 DNS resolver endpoints in each account to query the private hosted zone in the 'Networking' account.

  5. E

    Ensure that the VPCs in the 'Development' and 'Production' accounts have DNS resolution and DNS hostnames enabled.

Show answer and explanation

Correct answers: B, E

Explanation

To share a Route 53 private hosted zone across AWS accounts, you must use AWS Resource Access Manager (RAM) to create a resource share and include the desired VPCs from the target accounts. Additionally, DNS resolution and DNS hostnames must be enabled in the target VPCs to allow them to resolve names within the private hosted zone. AWS Organizations integration, while useful for simplifying resource sharing, is not explicitly required for this use case. Manual configuration of DNS resolver endpoints is unnecessary for private hosted zone sharing.

  • A. Incorrect.

    Incorrect: While a private hosted zone can be created in the 'Networking' account, it cannot directly associate with VPCs in other accounts without using a sharing mechanism like AWS RAM.

  • B. Correct.

    Correct: AWS RAM must be used to share the private hosted zone by creating a resource share and specifying the VPCs in the 'Development' and 'Production' accounts.

  • C. Incorrect.

    Incorrect: While AWS Organizations integration can simplify resource sharing, it is not a mandatory step for sharing private hosted zones via AWS RAM.

  • D. Incorrect.

    Incorrect: Manually configuring Route 53 DNS resolver endpoints is not required for sharing a private hosted zone. This method is used for forwarding DNS queries, not for sharing hosted zones.

  • E. Correct.

    Correct: DNS resolution and DNS hostnames must be enabled in the VPCs to ensure they can use the private hosted zone for DNS resolution.

ANS-C01 Question 304

Select 2

You are tasked with enabling shared access to a Route 53 Private Hosted Zone for multiple AWS accounts in your organization. The solution must ensure minimal operational overhead and utilize AWS-native services. Which steps are required to achieve this?

  1. A

    Use AWS Resource Access Manager (RAM) to share the Private Hosted Zone with the target accounts.

  2. B

    Ensure that the VPCs in the target accounts are associated with the Private Hosted Zone.

  3. C

    Set up a Route 53 Resolver rule in each target account to forward DNS queries to the Private Hosted Zone in the source account.

  4. D

    Manually replicate the DNS records from the Private Hosted Zone to a new Private Hosted Zone in each target account.

  5. E

    Enable cross-account permissions on the Private Hosted Zone directly using IAM policies.

Show answer and explanation

Correct answers: A, B

Explanation

To share a Route 53 Private Hosted Zone across AWS accounts, AWS RAM is used to share the zone with target accounts. Additionally, VPCs in the target accounts must be associated with the Private Hosted Zone to allow DNS resolution. This approach leverages AWS-native services and minimizes operational overhead, avoiding the need for manual replication or complex configurations like Resolver rules.

  • A. Correct.

    Correct: AWS Resource Access Manager (RAM) is the recommended service for sharing Route 53 Private Hosted Zones across accounts without duplicating resources.

  • B. Correct.

    Correct: Associating the VPCs in the target accounts with the Private Hosted Zone ensures DNS resolution for resources within those VPCs.

  • C. Incorrect.

    Incorrect: Route 53 Resolver rules are not required for sharing Private Hosted Zones. Resolver rules are used for forwarding DNS queries to external DNS systems, not for sharing hosted zones.

  • D. Incorrect.

    Incorrect: Manually replicating DNS records is not required when using AWS RAM for sharing Private Hosted Zones, as it introduces unnecessary complexity.

  • E. Incorrect.

    Incorrect: There is no mechanism to enable cross-account permissions directly on a Private Hosted Zone using IAM policies.

ANS-C01 Question 305

Select 2

Your organization has separate AWS accounts for different business units. The central IT team manages a Route 53 private hosted zone in their account, and the business units need to resolve domain names from this hosted zone in their respective Amazon VPCs. How can you enable this DNS sharing securely and efficiently across accounts?

  1. A

    Use AWS Resource Access Manager (RAM) to share the Route 53 private hosted zone with the other accounts and associate it with their VPCs.

  2. B

    Create a new Route 53 public hosted zone for each account and replicate the DNS records from the private hosted zone.

  3. C

    Share the Route 53 private hosted zone using AWS RAM and ensure the VPCs in the other accounts have appropriate association authorization.

  4. D

    Manually create identical private hosted zones in each of the accounts and add the same DNS records to each zone.

  5. E

    Establish a centralized DNS forwarding solution using Amazon Route 53 Resolver and share resolver rules with other accounts.

Show answer and explanation

Correct answers: A, C

Explanation

To share DNS services between accounts, AWS RAM is the recommended approach for securely sharing Route 53 private hosted zones. By sharing the private hosted zone and associating it with the VPCs in the other accounts, you enable seamless DNS resolution across accounts without duplicating DNS configurations. Additionally, VPC association authorization ensures security and proper access control.

  • A. Correct.

    Correct: AWS RAM allows you to share Route 53 private hosted zones securely across accounts. You can then associate the shared zone with the VPCs in the other accounts.

  • B. Incorrect.

    Incorrect: Public hosted zones are used for DNS resolution over the internet and cannot be used for private DNS resolution within VPCs.

  • C. Correct.

    Correct: Sharing the private hosted zone using AWS RAM requires ensuring that VPCs in other accounts are authorized for association. This step is critical for secure and functional cross-account DNS sharing.

  • D. Incorrect.

    Incorrect: Manually creating identical private hosted zones in each account is inefficient and prone to errors. Additionally, this does not provide an automated or scalable solution.

  • E. Incorrect.

    Incorrect: While Route 53 Resolver forwarding rules can centralize DNS forwarding, they are not required to share Route 53 private hosted zones and would be an overcomplication for this use case.

Timed practice exam

Take a ANS-C01 practice test under exam conditions

65 questions in 170 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

ANS-C01 practice questions 301 to 400 of 512

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 6 pages of up to 100 questions.

  1. 301.Your organization is hosting a web application on AWS and uses Amazon Route 53 for DNS. To enhance the...
  2. 302.Your company is operating a public-facing application hosted on Amazon Route 53. To enhance security, you are...
  3. 303.Your organization has multiple AWS accounts managed under a single AWS Organization. You want to centralize...
  4. 304.You are tasked with enabling shared access to a Route 53 Private Hosted Zone for multiple AWS accounts in...
  5. 305.Your organization has separate AWS accounts for different business units. The central IT team manages a Route...
  6. 306.You are a network administrator managing DNS services within a multi-account AWS environment. Your...
  7. 307.Your company is hosting a hybrid architecture where on-premises systems need to resolve domain names of...
  8. 308.Your organization has a VPC with private subnets and needs to resolve DNS queries for both on-premises...
  9. 309.You are designing a hybrid DNS solution for a company that has an on-premises data center and a VPC in AWS....
  10. 310.Your company has a hybrid environment with applications running on-premises and in AWS. To resolve DNS...
  11. 311.You are managing a multi-account AWS environment using AWS Organizations. Your organization requires a...
  12. 312.Your organization is deploying a hybrid cloud architecture and needs to automate the creation of VPN...
  13. 313.You are tasked with setting up a highly available VPC with two public subnets and two private subnets across...
  14. 314.Your company requires an automated solution for managing and deploying changes to its Amazon Virtual Private...
  15. 315.You are designing a hybrid network architecture for an organization that wants to securely connect its...
  16. 316.Your company is hosting a multi-tier web application on AWS. The application uses an Application Load...
  17. 317.Your organization is deploying a new web application across multiple AWS Regions to provide low-latency...
  18. 318.A company is setting up a hybrid architecture to extend its on-premises network to AWS. The on-premises...
  19. 319.Your team is tasked with deploying a highly available application across multiple AWS regions using...
  20. 320.Your team is tasked with deploying a multi-region VPC architecture using Infrastructure as Code (IaC). The...
  21. 321.You are designing a network infrastructure for a new application that requires multiple VPCs to communicate...
  22. 322.Your organization is looking to implement Infrastructure as Code (IaC) to manage and deploy network...
  23. 323.An organization uses Amazon VPC and wants to automate network changes based on specific events, such as a new...
  24. 324.Your organization is using a serverless architecture to manage network configurations dynamically in AWS. A...
  25. 325.Your organization is deploying a serverless architecture using AWS Lambda and Amazon EventBridge. You need to...
  26. 326.Your organization uses AWS to host a multi-tier application, and you are tasked with automating network...
  27. 327.An organization uses an Infrastructure as Code (IaC) template to provision networking resources in AWS. The...
  28. 328.You are tasked with provisioning a multi-region VPC architecture using an Infrastructure as Code (IaC)...
  29. 329.You are tasked with creating an AWS CloudFormation template to provision a VPC with subnets, routing tables,...
  30. 330.An organization uses an AWS CloudFormation template to provision VPCs and associated networking resources....
  31. 331.Your organization hosts a multi-account AWS environment with multiple VPCs connected via AWS Transit Gateway....
  32. 332.An organization has a critical application hosted in a VPC within AWS. The application requires low-latency...
  33. 333.Your company operates a multi-region application hosted in multiple VPCs in different AWS accounts. To...
  34. 334.Your organization uses Amazon VPC with multiple subnets and has deployed a fleet of EC2 instances within a...
  35. 335.Your company has a hybrid network setup with an on-premises data center connected to AWS via AWS Direct...
  36. 336.You are managing a hybrid network architecture for a company that has an on-premises data center connected to...
  37. 337.Your company has a hybrid network setup with an on-premises data center connected to AWS using an AWS...
  38. 338.You are managing a hybrid network where your on-premises environment connects to AWS using a Direct Connect...
  39. 339.Your organization has deployed a highly available application across multiple AWS Regions. The application...
  40. 340.Your company has recently implemented an AWS Transit Gateway to connect multiple VPCs in different AWS...
  41. 341.A company needs to set up a hybrid architecture to connect their on-premises data center to an Amazon VPC....
  42. 342.Your organization is deploying a multi-region web application in AWS. You need to design a solution to ensure...
  43. 343.You are designing a hybrid network between your on-premises data center and AWS using AWS Direct Connect....
  44. 344.Your company has established an AWS hybrid network using AWS Direct Connect to connect your on-premises data...
  45. 345.You are tasked with designing a hybrid network between an on-premises data center and AWS using AWS Direct...
  46. 346.You are setting up a hybrid network using AWS Direct Connect and need to establish dynamic routing between...
  47. 347.Your organization has a hybrid network setup with on-premises data centers connected to AWS through AWS...
  48. 348.Your company has an on-premises data center and uses multiple AWS accounts across different regions. They...
  49. 349.An organization has multiple on-premises data centers and wants to establish highly available, low-latency...
  50. 350.Your company has a multi-region AWS environment and wants to establish low-latency, high-bandwidth private...
  51. 351.Your organization is deploying a highly available application across two AWS Regions. The application...
  52. 352.An organization is designing a new multi-region architecture that involves multiple VPCs connected through...
  53. 353.Your organization uses a VPC with a private subnet containing 200 EC2 instances. The subnet routes outbound...
  54. 354.You are designing a hybrid network that connects an on-premises data center to multiple AWS VPCs using AWS...
  55. 355.Your organization has deployed a custom service in a VPC on AWS. The service needs to be accessed by clients...
  56. 356.Your company has deployed a custom API service in a VPC. The service needs to be securely accessed by other...
  57. 357.Your organization has deployed a custom web service in a private subnet of a VPC. The service needs to be...
  58. 358.Your company has deployed a custom service in a VPC on AWS, and now you need to provide secure access to the...
  59. 359.Your organization has deployed an application in multiple AWS Regions to serve a global user base. The...
  60. 360.You are designing a multi-region architecture for an application that needs to transfer data between two VPCs...
  61. 361.An organization has a multi-Region architecture with critical applications running in both the us-east-1 and...
  62. 362.A company has deployed a multi-region application using Amazon EC2 instances in two AWS Regions: us-east-1...
  63. 363.Your organization has deployed a multi-tier application in AWS across multiple Availability Zones. Users...
  64. 364.You are managing a hybrid cloud architecture where an on-premises data center is connected to AWS through a...
  65. 365.You are responsible for managing a VPC in your company's AWS environment, and users are reporting...
  66. 366.You are managing a multi-tier application hosted on AWS. Users are reporting intermittent connectivity issues...
  67. 367.You are designing a hybrid cloud architecture for an organization that requires secure and highly available...
  68. 368.Your company is deploying a highly available web application across multiple AWS Regions. The application...
  69. 369.You are designing a hybrid architecture where an on-premises data center needs to communicate with resources...
  70. 370.You are managing a multi-region application hosted on EC2 instances behind Application Load Balancers (ALBs)...
  71. 371.Your organization has a hybrid cloud setup where an on-premises data center communicates with workloads...
  72. 372.Your organization has deployed a multi-region application hosted in both the US-East-1 and EU-West-1 AWS...
  73. 373.You are designing a hybrid architecture where your on-premises data center communicates with an Amazon VPC...
  74. 374.You are troubleshooting a network performance issue involving intermittent packet loss between two Amazon EC2...
  75. 375.You are troubleshooting intermittent connectivity issues between an application running in your VPC and an...
  76. 376.Your organization is experiencing intermittent connectivity issues between EC2 instances deployed in two...
  77. 377.You are troubleshooting intermittent packet loss and latency issues in a multi-VPC architecture connected via...
  78. 378.A company has deployed a web application in a VPC. They are experiencing intermittent connectivity issues,...
  79. 379.A company is facing intermittent issues with one of its web applications running on Amazon EC2 instances in a...
  80. 380.Your organization is experiencing intermittent connectivity issues between two EC2 instances in the same VPC....
  81. 381.An organization is troubleshooting intermittent connectivity issues between their application servers hosted...
  82. 382.Your company leverages AWS Transit Gateway to manage connectivity between multiple VPCs and on-premises data...
  83. 383.You are managing a complex AWS network that uses Transit Gateway to connect multiple VPCs and on-premises...
  84. 384.You are managing a complex multi-region AWS network that uses AWS Transit Gateway to interconnect multiple...
  85. 385.You are managing a multi-account AWS environment connected through AWS Transit Gateway. A user in one of the...
  86. 386.Your company runs a global e-commerce platform hosted on AWS. Customers report intermittent latency issues...
  87. 387.Your company runs a global e-commerce platform hosted on AWS, with end-users distributed across North...
  88. 388.You are tasked with designing a network architecture for a global e-commerce application hosted in AWS. The...
  89. 389.Your company is hosting a global e-commerce application on AWS. The application is deployed in multiple AWS...
  90. 390.Your company hosts a multi-tier web application in an Amazon VPC. The application is experiencing...
  91. 391.Your organization has deployed a multi-region application that uses an Amazon VPC in each region, connected...
  92. 392.You are designing a hybrid cloud architecture for an organization that requires high availability and low...
  93. 393.Your organization has a hybrid cloud setup with resources hosted both on-premises and in an AWS VPC. You are...
  94. 394.Your company has multiple VPCs across two AWS Regions. Some VPCs require low-latency, high-bandwidth...
  95. 395.You are designing a network architecture for a company with multiple AWS accounts. The company requires...
  96. 396.Your company has multiple VPCs, each representing a different environment (e.g., production, development, and...
  97. 397.Your organization has three VPCs in the same AWS Region: VPC-A, VPC-B, and VPC-C. VPC-A needs to communicate...
  98. 398.Your organization is delivering a live video broadcast to millions of users around the world. You need to...
  99. 399.Your company is streaming live video content to thousands of users across multiple regions, and the current...
  100. 400.Your company is deploying a large-scale video streaming service to deliver live content to millions of users...

More AWS exam dumps

All AWS exams
AIF-C01230 questions

AWS Certified AI Practitioner exam dumps

AWS Certified AI Practitioner

CLF-C02341 questions

AWS Certified Cloud Practitioner exam dumps

AWS Certified Cloud Practitioner

DEA-C01549 questions

AWS Data Engineer Associate exam dumps

AWS Certified Data Engineer - Associate

DOP-C02410 questions

AWS DevOps Engineer Professional exam dumps

AWS Certified DevOps Engineer - Professional

DVA-C02398 questions

AWS Developer Associate exam dumps

AWS Certified Developer - Associate

MLS-C01388 questions

AWS Machine Learning Specialty exam dumps

AWS Certified Machine Learning - Specialty

MLA-C01457 questions

AWS Machine Learning Engineer Associate exam dumps

AWS Certified Machine Learning Engineer - Associate

SCS-C02503 questions

AWS Security Specialty exam dumps

AWS Certified Security - Specialty