Amazon ANS-C01 Exam Dumps

Amazon AWS Certified Advanced Networking - Specialty

Recent ANS-C01 Exam Results

Our Amazon ANS-C01 dumps are key to get success. More than 80000+ success stories.

30

Clients Passed Amazon ANS-C01 Exam Today

92%

Passing score in Real Amazon ANS-C01 Exam

98%

Questions were from our given ANS-C01 dumps

Amazon ANS-C01 Sample Questions

Question # 1

A company is planning to create a service that requires encryption in transit. The traffic must not bedecrypted between the client and the backend of the service. The company will implement theservice by using the gRPC protocol over TCP port 443. The service will scale up to thousands ofsimultaneous connections. The backend of the service will be hosted on an Amazon ElasticKubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and theHorizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-wayauthentication between the client and the backend.Which solution will meet these requirements?

A.Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure aNetwork Load Balancer with a TCP listener on port 443 to forward traffic to the IP addresses ofthe backend service Pods.
B.Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure anApplication Load Balancer with an HTTPS listener on port 443 to forward traffic to the IP addressesof the backend service Pods.
C.Create a target group. Add the EKS managed node group's Auto Scaling group as a target Create anApplication Load Balancer with an HTTPS listener on port 443 to forward traffic to the target group.
D.Create a target group. Add the EKS managed node groups Auto Scaling group as a target. Create aNetwork Load Balancer with a TLS listener on port 443 to forward traffic to the target group.

Answer: B

Show Answer

Question # 2

A company is deploying a new application in the AWS Cloud. The company wants a highly availableweb server that will sit behind an Elastic Load Balancer. The load balancer will route requests tomultiple target groups based on the URL in the request. All traffic must use HTTPS. TLS processingmust be offloaded to the load balancer. The web server must know the users IP address so that thecompany can keep accurate logs for security purposes.Which solution will meet these requirements?

A.Deploy an Application Load Balancer with an HTTPS listener. Use path-based routing rules to forward the traffic to the correct target group. Include the X-Forwarded-For request header withtraffic to the targets.
B.Deploy an Application Load Balancer with an HTTPS listener for each domain. Use host-basedrouting rules to forward the traffic to the correct target group for each domain. Include the XForwardedFor request header with traffic to the targets.
C.Deploy a Network Load Balancer with a TLS listener. Use path-based routing rules to forwardthe traffic to the correct target group. Configure client IP address preservation for traffic to thetargets.
D.Deploy a Network Load Balancer with a TLS listener for each domain. Use host-based routingrules to forward the traffic to the correct target group for each domain. Configure client IP addresspreservation for traffic to the targets.

Answer: A

Show Answer

Question # 3

A company has developed an application on AWS that will track inventory levels of vending machinesand initiate the restocking process automatically. The company plans to integrate this applicationwith vending machines and deploy the vending machines in several markets around the world. Theapplication resides in a VPC in the us-east-1 Region. The application consists of an Amazon ElasticContainer Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). Thecommunication from the vending machines to the application happens over HTTPS.The company is planning to use an AWS Global Accelerator accelerator and configure static IPaddresses of the accelerator in the vending machines for application endpoint access. Theapplication must be accessible only through the accelerator and not through a direct connectionover the internet to the ALB endpoint.Which solution will meet these requirements?

A.Configure the ALB in a private subnet of the VPC. Attach an internet gateway without addingroutes in the subnet route tables to point to the internet gateway. Configure the accelerator withendpoint groups that include the ALB endpoint. Configure the ALBs security group to only allowinbound traffic from the internet on the ALB listener port.
B.Configure the ALB in a private subnet of the VPC. Configure the accelerator with endpoint groups that include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic fromthe internet on the ALB listener port.
C.Configure the ALB in a public subnet of the VPAttach an internet gateway. Add routes in the subnetroute tables to point to the internet gateway. Configure the accelerator with endpoint groups thatinclude the ALB endpoint. Configure the ALB's security group to only allow inbound traffic from theaccelerator's IP addresses on the ALB listener port.
D.Configure the ALB in a private subnet of the VPC. Attach an internet gateway. Add routes in thesubnet route tables to point to the internet gateway. Configure the accelerator with endpoint groupsthat include the ALB endpoint. Configure the ALB's security group to only allow inbound traffic fromthe accelerator's IP addresses on the ALB listener port.

Answer: A

Show Answer

Question # 4

A global delivery company is modernizing its fleet management system. The company has severalbusiness units. Each business unit designs and maintains applications that are hosted in its own AWSaccount in separate application VPCs in the same AWS Region. Each business unit's applications aredesigned to get data from a central shared services VPC.The company wants the network connectivity architecture to provide granular security controls. Thearchitecture also must be able to scale as more business units consume data from the central sharedservices VPC in the future.Which solution will meet these requirements in the MOST secure manner?

A.Create a central transit gateway. Create a VPC attachment to each application VPC. Providefull mesh connectivity between all the VPCs by using the transit gateway.
B.Create VPC peering connections between the central shared services VPC and each applicationVPC in each business unit's AWS account.
C.Create VPC endpoint services powered by AWS PrivateLink in the central shared services VPCreateVPC endpoints in each application VPC.
D.Create a central transit VPC with a VPN appliance from AWS Marketplace. Create a VPNattachment from each VPC to the transit VPC. Provide full mesh connectivity among all the VPCs.

Answer: C

Show Answer

Question # 5

A company uses a 4 Gbps AWS Direct Connect dedicated connection with a link aggregation group(LAG) bundle to connect to five VPCs that are deployed in the us-east-1 Region. Each VPC serves adifferent business unit and uses its own private VIF for connectivity to the on-premises environment.Users are reporting slowness when they access resources that are hosted on AWS.A network engineer finds that there are sudden increases in throughput and that the Direct Connectconnection becomes saturated at the same time for about an hour each business day. The companywants to know which business unit is causing the sudden increase in throughput. The networkengineer must find out this information and implement a solution to resolve the problem.Which solution will meet these requirements?

A.Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress andVirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during theperiod in which slowness is observed. Create a new 10 Gbps dedicated connection. Shift traffic fromthe existing dedicated connection to the new dedicated connection.
B.Review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress andVirtualInterfaceBpsIngress to determine which VIF is sending the highest throughput during theperiod in which slowness is observed. Upgrade the bandwidth of the existing dedicated connection to 10 Gbps
C.Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress todetermine which VIF is sending the highest throughput during the period in which slowness isobserved. Upgrade the existing dedicated connection to a 5 Gbps hosted connection
D.Review the Amazon CloudWatch metrics for ConnectionBpsIngress and ConnectionPpsEgress todetermine which VIF is sending the highest throughput during the period in which slowness isobserved. Create a new 10 Gbps dedicated connection. Shift traffic from the existing dedicated connection to the new dedicated connection. 

Answer: A

Show Answer

Question # 6

A software-as-a-service (SaaS) provider hosts its solution on Amazon EC2 instances within a VPC inthe AWS Cloud. All of the provider's customers also have their environments in the AWS Cloud.A recent design meeting revealed that the customers have IP address overlap with the provider'sAWS deployment. The customers have stated that they will not share their internal IP addresses andthat they do not want to connect to the provider's SaaS service over the internet.Which combination of steps is part of a solution that meets these requirements? (Choose two.)

A.Deploy the SaaS service endpoint behind a Network Load Balancer.
B.Configure an endpoint service, and grant the customers permission to create a connection to the endpoint service.
C.Deploy the SaaS service endpoint behind an Application Load Balancer.
D.Configure a VPC peering connection to the customer VPCs. Route traffic through NAT gateways.
E.Deploy an AWS Transit Gateway, and connect the SaaS VPC to it. Share the transit gateway with the customers. Configure routing on the transit gateway.

Answer: A,B

Show Answer

Question # 7

A network engineer is designing the architecture for a healthcare company's workload that is movingto the AWS Cloud. All data to and from the on-premises environment must be encrypted in transit.All traffic also must be inspected in the cloud before the traffic is allowed to leave the cloud and travel to the on-premises environment or to the internet.The company will expose components of the workload to the internet so that patients can reserveappointments. The architecture must secure these components and protect them against DDoSattacks. The architecture also must provide protection against financial liability for services thatscale out during a DDoS event.Which combination of steps should the network engineer take to meet all these requirements for theworkload? (Choose three.)

A.Use Traffic Mirroring to copy all traffic to a fleet of traffic capture appliances.
B.Set up AWS WAF on all network components.
C.Configure an AWS Lambda function to create Deny rules in security groups to block malicious IPaddresses.
D.Use AWS Direct Connect with MACsec support for connectivity to the cloud.
E.Use Gateway Load Balancers to insert third-party firewalls for inline traffic inspection.
F.Configure AWS Shield Advanced and ensure that it is configured on all public assets.

Answer: D,E,F

Show Answer

Question # 8

A retail company is running its service on AWS. The companys architecture includes Application LoadBalancers (ALBs) in public subnets. The ALB target groups are configured to send traffic to backendAmazon EC2 instances in private subnets. These backend EC2 instances can call externally hostedservices over the internet by using a NAT gateway.The company has noticed in its billing that NAT gateway usage has increased significantly. A networkengineer needs to find out the source of this increased usage.Which options can the network engineer use to investigate the traffic through the NAT gateway? (Choose two.)

A.Enable VPC flow logs on the NAT gateway's elastic network interface. Publish the logs to a loggroup in Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query and analyze the logs.
B.Enable NAT gateway access logs. Publish the logs to a log group in Amazon CloudWatch Logs. UseCloudWatch Logs Insights to query and analyze the logs.
C.Configure Traffic Mirroring on the NAT gateway's elastic network interface. Send the traffic to anadditional EC2 instance. Use tools such as tcpdump and Wireshark to query and analyze the mirroredtraffic
D.Enable VPC flow logs on the NAT gateway's elastic network interface. Publish the logs to anAmazon S3 bucket. Create a custom table for the S3 bucket in Amazon Athena to describe the logstructure. Use Athena to query and analyze the logs.
E.Enable NAT gateway access logs. Publish the logs to an Amazon S3 bucket. Create a custom tablefor the S3 bucket in Amazon Athena to describe the log structure. Use Athena to query and analyzethe logs.

Answer: A,D

Show Answer

Question # 9

A banking company is successfully operating its public mobile banking stack on AWS. The mobilebanking stack is deployed in a VPC that includes private subnets and public subnets. The company isusing IPv4 networking and has not deployed or supported IPv6 in the environment. The company hasdecided to adopt a third-party service provider's API and must integrate the API with the existingenvironment. The service providers API requires the use of IPv6.A network engineer must turn on IPv6 connectivity for the existing workload that is deployed in aprivate subnet. The company does not want to permit IPv6 traffic from the public internet andmandates that the company's servers must initiate all IPv6 connectivity. The network engineer turns on IPv6 in the VPC and in the private subnets.Which solution will meet these requirements?

A.Create an internet gateway and a NAT gateway in the VPC. Add a route to the existing subnet routetables to point IPv6 traffic to the NAT gateway.
B.Create an internet gateway and a NAT instance in the VPC. Add a route to the existing subnet routetables to point IPv6 traffic to the NAT instance.
C.Create an egress-only Internet gateway in the VPAdd a route to the existing subnet route tables topoint IPv6 traffic to the egress-only internet gateway.
D.Create an egress-only internet gateway in the VPC. Configure a security group that denies allinbound traffic. Associate the security group with the egress-only internet gateway.

Answer: C

Show Answer

Question # 10

A company has deployed an AWS Network Firewall firewall into a VPC. A network engineer needs toimplement a solution to deliver Network Firewall flow logs to the companys Amazon OpenSearchService (Amazon Elasticsearch Service) cluster in the shortest possible time.Which solution will meet these requirements?

A.Create an Amazon S3 bucket. Create an AWS Lambda function to load logs into the AmazonOpenSearch Service (Amazon Elasticsearch Service) cluster. Enable Amazon Simple NotificationService (Amazon SNS) notifications on the S3 bucket to invoke the Lambda function. Configure flowlogs for the firewall. Set the S3 bucket as the destination.
B.Create an Amazon Kinesis Data Firehose delivery stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination. Configure flow logs for the firewall Set the Kinesis Data Firehose delivery stream as the destination for the Network Firewall flow logs.
C.Configure flow logs for the firewall. Set the Amazon OpenSearch Service (Amazon ElasticsearchService) cluster as the destination for the Network Firewall flow logs.
D.Create an Amazon Kinesis data stream that includes the Amazon OpenSearch Service (AmazonElasticsearch Service) cluster as the destination. Configure flow logs for the firewall. Set the Kinesisdata stream as the destination for the Network Firewall flow logs.

Answer: B

Show Answer

Question # 11

A company is using custom DNS servers that run BIND for name resolution in its VPCs. The VPCs aredeployed across multiple AWS accounts that are part of the same organization in AWS Organizations.All the VPCs are connected to a transit gateway. The BIND servers are running in a central VPC andare configured to forward all queries for an on-premises DNS domain to DNS servers that are hostedin an on-premises data center. To ensure that all the VPCs use the custom DNS servers, a networkengineer has configured a VPC DHCP options set in all the VPCs that specifies the custom DNS serversto be used as domain name servers.Multiple development teams in the company want to use Amazon Elastic File System (Amazon EFS).A development team has created a new EFS file system but cannot mount the file system to one of itsAmazon EC2 instances. The network engineer discovers that the EC2 instance cannot resolve the IPaddress for the EFS mount point fs-33444567d.efs.us-east-1.amazonaws.com. The network engineerneeds to implement a solution so that development teams throughout the organization can mountEFS file systems.Which combination of steps will meet these requirements? (Choose two.)

A.Configure the BIND DNS servers in the central VPC to forward queries for efs.us-east1.amazonaws.com to the Amazon provided DNS server (169.254.169.253).
B.Create an Amazon Route 53 Resolver outbound endpoint in the central VPC. Update all the VPCDHCP options sets to use AmazonProvidedDNS for name resolution.
C.Create an Amazon Route 53 Resolver inbound endpoint in the central VPUpdate all the VPC DHCPoptions sets to use the Route 53 Resolver inbound endpoint in the central VPC for name resolution.
D.Create an Amazon Route 53 Resolver rule to forward queries for the on-premises domain to theon-premises DNS servers. Share the rule with the organization by using AWS Resource AccessManager (AWS RAM). Associate the rule with all the VPCs.
E.Create an Amazon Route 53 private hosted zone for the efs.us-east-1.amazonaws.com domain.Associate the private hosted zone with the VPC where the EC2 instance is deployed. Create an Arecord for fs-33444567d.efs.us-east-1.amazonaws.com in the private hosted zone. Configure the Arecord to return the mount target of the EFS mount point.

Answer: B,D

Show Answer

Question # 12

An ecommerce company is hosting a web application on Amazon EC2 instances to handlecontinuously changing customer demand. The EC2 instances are part of an Auto Scaling group. Thecompany wants to implement a solution to distribute traffic from customers to the EC2 instances.The company must encrypt all traffic at all stages between the customers and the application servers.No decryption at intermediate points is allowed.Which solution will meet these requirements?

A.Create an Application Load Balancer (ALB). Add an HTTPS listener to the ALB. Configure the AutoScaling group to register instances with the ALB's target group.
B.Create an Amazon CloudFront distribution. Configure the distribution with a custom SSL/TLScertificate. Set the Auto Scaling group as the distribution's origin.
C.Create a Network Load Balancer (NLB). Add a TCP listener to the NLB. Configure the Auto Scalinggroup to register instances with the NLB's target group.
D.Create a Gateway Load Balancer (GLB). Configure the Auto Scaling group to register instances withthe GLB's target group.

Answer: C

Show Answer

Question # 13

A company has two on-premises data center locations. There is a company-managed router at eachdata center. Each data center has a dedicated AWS Direct Connect connection to a Direct Connectgateway through a private virtual interface. The router for the first location is advertising 110 routesto the Direct Connect gateway by using BGP, and the router for the second location is advertising 60routes to the Direct Connect gateway by using BGP. The Direct Connect gateway is attached to acompany VPC through a virtual private gateway.A network engineer receives reports that resources in the VPC are not reachable from variouslocations in either data center. The network engineer checks the VPC route table and sees that theroutes from the first data center location are not being populated into the route table. The networkengineer must resolve this issue in the most operationally efficient manner.What should the network engineer do to meet these requirements?

A.Remove the Direct Connect gateway, and create a new private virtual interface from eachcompany router to the virtual private gateway of the VPC.
B.Change the router configurations to summarize the advertised routes.
C.Open a support ticket to increase the quota on advertised routes to the VPC route table.
D.Create an AWS Transit Gateway. Attach the transit gateway to the VPC, and connect the DirectConnect gateway to the transit gateway.

Answer: B

Show Answer

Question # 14

A company has expanded its network to the AWS Cloud by using a hybrid architecture with multipleAWS accounts. The company has set up a shared AWS account for the connection to its on-premisesdata centers and the company offices. The workloads consist of private web-based services forinternal use. These services run in different AWS accounts. Office-based employees consume theseservices by using a DNS name in an on-premises DNS zone that is named example.internal.The process to register a new service that runs on AWS requires a manual and complicated changerequest to the internal DNS. The process involves many teams.The company wants to update the DNS registration process by giving the service creators access thatwill allow them to register their DNS records. A network engineer must design a solution that willachieve this goal. The solution must maximize cost-effectiveness and must require the least possiblenumber of configuration changes.Which combination of steps should the network engineer take to meet these requirements? (Choosethree.)

A.Create a record for each service in its local private hosted zone(serviceA.account1.aws.example.internal). Provide this DNS record to the employees who needaccess.
B.Create an Amazon Route 53 Resolver inbound endpoint in the shared account VPC. Create a conditional forwarder for a domain named aws.example.internal on the on-premises DNS servers.Set the forwarding IP addresses to the inbound endpoint's IP addresses that were created.
C.Create an Amazon Route 53 Resolver rule to forward any queries made toonprem.example.internal to the on-premises DNS servers.
D.Create an Amazon Route 53 private hosted zone named aws.example.internal in the shared AWSaccount to resolve queries for this domain
E.Launch two Amazon EC2 instances in the shared AWS account. Install BIND on each instance.Create a DNS conditional forwarder on each BIND server to forward queries for each subdomainunder aws.example.internal to the appropriate private hosted zone in each AWS account. Create aconditional forwarder for a domain named aws.example.internal on the on-premises DNS servers.Set the forwarding IP addresses to the IP addresses of the BIND servers.
F.Create a private hosted zone in the shared AWS account for each account that runs the service.Configure the private hosted zone to contain aws.example.internal in the domain(account1.aws.example.internal). Associate the private hosted zone with the VPC that runs theservice and the shared account VPC.

Answer: A,B,D

Show Answer

Question # 15

A company has multiple AWS accounts. Each account contains one or more VPCs. A new securityguideline requires the inspection of all traffic between VPCs.The company has deployed a transit gateway that provides connectivity between all VPCs. Thecompany also has deployed a shared services VPC with Amazon EC2 instances that include IDSservices for stateful inspection. The EC2 instances are deployed across three Availability Zones. The company has set up VPC associations and routing on the transit gateway. The company has migrateda few test VPCs to the new solution for traffic inspection.Soon after the configuration of routing, the company receives reports of intermittent connections fortraffic that crosses Availability Zones.What should a network engineer do to resolve this issue?

A.Modify the transit gateway VPC attachment on the shared services VPC by enabling crossAvailability Zone load balancing.
B.Modify the transit gateway VPC attachment on the shared services VPC by enabling appliancemode support.
C.Modify the transit gateway by selecting VPN equal-cost multi-path (ECMP) routing support.
D.Modify the transit gateway by selecting multicast support.

Answer: B

Show Answer