Amazon Web ServicesExpert levelANS-C01Page 6 of 6

ANS-C01 exam dumps: questions 501 to 512 of 512

Page 6 of the free ANS-C01 question bank for the AWS Certified Advanced Networking - Specialty exam. Questions 501 to 512 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated December 2024

Start timed practice exam Questions 501 to 512

Free ANS-C01 practice questions

Questions 501 to 505 of 512

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

ANS-C01 Question 501

Single answer

Your company has deployed a hybrid cloud architecture with an AWS VPC connected to an on-premises data center using a VPN connection. The company requires all data in transit over this VPN to be encrypted using industry-standard protocols. Which encryption method should you implement to meet this requirement?

A
IPsec with AES-256 encryption
B
SSL/TLS with a self-signed certificate
C
Plaintext transmission with application-layer encryption
D
L2TP without encryption

Show answer and explanation

Correct answer: A

Explanation

IPsec with AES-256 encryption is the correct choice for securing data in transit over a VPN connection between an AWS VPC and an on-premises data center. IPsec is a protocol suite that provides secure communication by encrypting and authenticating data. AES-256 offers strong encryption, ensuring data confidentiality during transit. The other options either lack encryption or are not suitable for the VPN use case described.

A. Correct.
IPsec with AES-256 encryption is a widely accepted, industry-standard protocol for securing data in transit over VPNs. It provides robust encryption and authentication mechanisms.
B. Incorrect.
SSL/TLS is commonly used for securing web traffic but is not typically used for encrypting data in transit over VPN connections. Additionally, a self-signed certificate may not meet security compliance requirements.
C. Incorrect.
Plaintext transmission does not secure data in transit, and relying solely on application-layer encryption does not fulfill the requirement for VPN-level encryption.
D. Incorrect.
L2TP without encryption does not provide any encryption for data in transit, making it unsuitable for securing VPN connections.

ANS-C01 Question 502

Select 2

Your company is setting up a secure site-to-site VPN connection between its on-premises data center and a VPC in AWS. The requirement is to ensure encryption for data in transit using an industry-standard protocol. Which of the following methods can be used to accomplish this?

A
IPsec (Internet Protocol Security)
B
TLS (Transport Layer Security) with Amazon API Gateway
C
Direct Connect with MACsec
D
AWS Site-to-Site VPN with IPsec

Show answer and explanation

Correct answers: A, D

Explanation

To securely encrypt data in transit for a site-to-site VPN connection, IPsec is the industry-standard protocol used. AWS Site-to-Site VPN is built on IPsec technology, making it a valid solution for this requirement. TLS is application-level encryption and not suitable for site-to-site VPNs, while Direct Connect with MACsec operates at the physical layer and does not meet the VPN requirement.

A. Correct.
IPsec is an industry-standard protocol designed for securing data in transit over IP networks. It encrypts and authenticates IP packets, making it a common choice for site-to-site VPN connections.
B. Incorrect.
TLS is a protocol for encrypting application-level data, commonly used with HTTPS or services like API Gateway. While it ensures encryption, it is not typically used for site-to-site VPN connections.
C. Incorrect.
Direct Connect is used for dedicated network connections between on-premises and AWS. While MACsec can be enabled for physical layer encryption, Direct Connect with MACsec does not natively provide a site-to-site VPN solution.
D. Correct.
AWS Site-to-Site VPN uses IPsec to secure traffic between on-premises and AWS, meeting the requirement for encrypting data in transit using an industry-standard protocol.

ANS-C01 Question 503

Single answer

You are designing a secure hybrid infrastructure between your on-premises data center and AWS using a Site-to-Site VPN connection. To ensure data confidentiality and integrity during transit, which encryption protocol should you configure on both ends of the VPN tunnel?

A
IPsec with AES-256 encryption
B
SSL/TLS with RSA certificates
C
Plaintext communication with TCP session monitoring
D
HTTP with Basic Authentication

Show answer and explanation

Correct answer: A

Explanation

IPsec (Internet Protocol Security) with AES-256 encryption is the recommended method for securing data in transit over a Site-to-Site VPN connection. It provides robust encryption and integrity checks, making it ideal for hybrid cloud environments where confidentiality and data protection are critical. Other options, such as SSL/TLS or HTTP, are either application-layer protocols or insecure for this use case.

A. Correct.
IPsec with AES-256 encryption is a highly secure and commonly used encryption protocol for Site-to-Site VPNs. It ensures data confidentiality, integrity, and authenticity during transit.
B. Incorrect.
SSL/TLS with RSA certificates is commonly used for securing application-level connections, such as HTTPS, but it is not suitable for encrypting data in transit for Site-to-Site VPNs.
C. Incorrect.
Plaintext communication with TCP session monitoring does not provide any encryption or security for data in transit, making it a non-viable option for securing a VPN connection.
D. Incorrect.
HTTP with Basic Authentication is an insecure method for data transmission as it does not encrypt data during transit and is not applicable for VPN encryption.

ANS-C01 Question 504

Select 3

An organization is setting up a site-to-site VPN between its on-premises data center and a VPC in AWS. As part of the configuration, they want to ensure that data in transit is encrypted. Which of the following encryption methods are supported by AWS Site-to-Site VPN?

A
AES-256 for IPsec encryption
B
ChaCha20-Poly1305 for IPsec encryption
C
IKEv2 for key exchange
D
RSA for encrypting data payloads
E
SHA-2 for integrity verification

Show answer and explanation

Correct answers: A, C, E

Explanation

AWS Site-to-Site VPN supports specific encryption and integrity protocols to ensure secure communication. AES-256 is a widely supported encryption standard for IPsec. IKEv2 is used for secure key exchange, and SHA-2 is employed for data integrity. Other methods like ChaCha20-Poly1305 and RSA for payload encryption are not supported by AWS Site-to-Site VPN.

A. Correct.
AES-256 is a widely supported and highly secure encryption standard used by AWS Site-to-Site VPN for IPsec encryption.
B. Incorrect.
ChaCha20-Poly1305 is not currently supported by AWS Site-to-Site VPN as an encryption method.
C. Correct.
IKEv2 is supported by AWS Site-to-Site VPN and is used for key exchange and setting up secure communication channels.
D. Incorrect.
RSA is not used for encrypting data payloads in AWS Site-to-Site VPN. It is typically used for public/private key encryption but not for IPsec payloads.
E. Correct.
SHA-2 is supported by AWS Site-to-Site VPN for integrity verification, ensuring that data has not been tampered with during transit.

ANS-C01 Question 505

Select 3

Your organization is using Amazon S3 to store sensitive customer data. To comply with regulatory requirements, the data must be encrypted both in transit and at rest. Under the AWS Shared Responsibility Model, which of the following actions are your responsibility as a customer to ensure proper encryption of the data?

A
Enabling server-side encryption (SSE) for objects stored in S3
B
Ensuring that HTTPS is used when uploading or downloading data to S3
C
Maintaining the physical security of the data stored in AWS data centers
D
Configuring and managing your own customer-managed keys (CMKs) in AWS Key Management Service (KMS) if required
E
Monitoring network traffic for unauthorized access to ensure data encryption in transit

Show answer and explanation

Correct answers: A, B, D

Explanation

Under the AWS Shared Responsibility Model, AWS is responsible for the security 'of' the cloud, including the physical infrastructure and managed services like AWS KMS. However, customers are responsible for the security 'in' the cloud, which includes configuring encryption options (e.g., enabling server-side encryption for S3), ensuring secure communication (e.g., using HTTPS), and managing encryption keys if customer-managed keys (CMKs) are used. Physical security of data centers is handled by AWS, and while monitoring traffic is important, the customer’s responsibility regarding encryption in transit is to ensure secure protocols like HTTPS are used.

A. Correct.
Correct. Enabling server-side encryption is a customer responsibility to ensure that data is encrypted at rest. AWS provides multiple options for server-side encryption, but it is the customer's responsibility to configure this.
B. Correct.
Correct. Ensuring the use of HTTPS (TLS) for secure communication when transferring data to and from S3 is part of the customer's responsibility to secure data in transit.
C. Incorrect.
Incorrect. Maintaining the physical security of AWS data centers is AWS's responsibility under the Shared Responsibility Model.
D. Correct.
Correct. If you choose to use customer-managed keys (CMKs) for encryption, it is your responsibility to create, configure, and manage them in AWS KMS.
E. Incorrect.
Incorrect. AWS provides tools like VPC Flow Logs and CloudTrail for traffic monitoring, but ensuring encryption in transit is achieved by using HTTPS, which is the customer's responsibility.

Timed practice exam

Take a ANS-C01 practice test under exam conditions

65 questions in 170 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

ANS-C01 practice questions 501 to 512 of 512

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 6 pages of up to 100 questions.

More AWS exam dumps

All AWS exams

AIF-C01230 questions

AWS Certified AI Practitioner exam dumps

AWS Certified AI Practitioner

CLF-C02341 questions

AWS Certified Cloud Practitioner exam dumps

AWS Certified Cloud Practitioner

DEA-C01549 questions

AWS Data Engineer Associate exam dumps

AWS Certified Data Engineer - Associate

DOP-C02410 questions

AWS DevOps Engineer Professional exam dumps

AWS Certified DevOps Engineer - Professional

DVA-C02398 questions

AWS Developer Associate exam dumps

AWS Certified Developer - Associate

MLS-C01388 questions

AWS Machine Learning Specialty exam dumps

AWS Certified Machine Learning - Specialty

MLA-C01457 questions

AWS Machine Learning Engineer Associate exam dumps

AWS Certified Machine Learning Engineer - Associate

SCS-C02503 questions

AWS Security Specialty exam dumps

AWS Certified Security - Specialty