ANS-C00 Exam Dumps – Our Features

An organization's Security team has a requirement that all data leaving its on-premises data center be encrypted at the network layer and use dedicated connectivity. There is also a requirement to centrally log all traffic flow in Amazon VPC environments. An AWS Direct Connect connection has been ordered to build out this design.What steps should be taken to ensure that connectivity to AWS meets these security requirements? (Choose two.)

• Provision a public virtual interface on AWS Direct Connect and set up a VPN to each VPC.
• Provision a private virtual interface for each VPC connection.
• Enable VPC Flow Logs for each VPC.
• Use AWS KMS to encrypt traffic between on-premises and AWS.
• Provision a VPN connection to each VPC over the internet. References:

An architecture is being designed to support an Amazon WorkSpaces deployment of 1,000 desktops.Which architecture will support this deployment while allowing for future expansion?

• A VPC with a /16 CIDR and one /21 subnet
• A VPC with a /20 CIDR and two /21 subnets
• A VPC with a /16 CIDR and one /22 subnet
• A VPC with a /20 CIDR and two /23 subnets

A VPC is deployed with a 10 0.0/16 CIDR block. The engineering team is reviewing DHCP options and there is disagreement about the valid DNS addresses available for the VPC Which addresses are valid IP addresses provided by Amazon for this subnet' (Select TWO.)

• 8.8.8.8
• 10.00.2
• 10.1.0.2
• 169.254.169.253
• 169.254.169.254

Your company decides to use Amazon S3 to augment its on-premises data store. Instead of using the company's highly controlled, on-premises Internet gateway, a Direct Connect connection is ordered to provide high bandwidth, low latency access to S3. Since the company does not own a publically routable IPv4 address block, a request was made to AWS for an AWS-owned address for a Public Virtual Interface (VIF).The security team is calling this new connection a ''backdoor'', and you have been asked to clarify the risk to the company.Which concern from the security team is valid and should be addressed?

• AWS advertises its aggregate routes to the Internet allowing anyone on the Internet to reach the router.
• Direct Connect customers with a Public VIF in the same region could directly reach the router.
• EC2 instances in the same region with access to the Internet could directly reach the router.
• The S3 service could reach the router through a pre-configured VPC Endpoint. https://aws.amazon.com/premiumsupport/knowledge-center/control-routes-direct-connect/

A company has an application running in an Amazon VPC that must be able to communicate with on-premises resources in a data center. Network traffic between AWS and the data center will initially be minimal, but will increase to more than 10 Gbps over the nextfew months. The company's goal is to launch the application as quickly as possible.The Network Engineer has been asked to design a hybrid IT connectivity solution.What should be done to meet these requirements?

• Submit a 1 Gbps AWS Direct Connect connection request, then increase the number of Direct Connect connections, as needed.
• Allocate elastic IPs to Amazon EC2 instances for temporary access to on-premises resources, then provision AWS VPN connections between an Amazon VPC and the data center.
• Provision an AWS VPN connection between an Amazon VPC and the data center, then submit an AWS Direct Connect connection request. Later, cut over from the VPN connection to one or more Direct Connect connections, as needed.
• Provision a 100 Mbps AWS Direct Connect connection between an Amazon VPC and the data center, then submit a Direct Connect connection request. Later, cut over from the hosted connection to one or more Direct Connect connections, as needed.

You operate a production VPC with both a public and a private subnet. Your organization maintains a restricted Amazon S3 bucket to support this production workload. Only Amazon EC2 instances in the private subnet should access the bucket. You implement VPC endpoints(VPC-E) for Amazon S3 and remove the NAT that previously provided a network path to Amazon S3. The default VPC-E policy is applied. Neither EC2 instances in the public or private subnets are able to access the S3 bucket.What should you do to enable Amazon S3 access from EC2 instances in the private subnet?

• Add the CIDR address range of the private subnet to the S3 bucket policy.
• Add the VPC-E identified to the S3 bucket policy.
• Add the VPC identifier for the production VPC to the S3 bucket policy.
• Add the VPC-E identifier for the production VPC to endpoint policy. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html#vpc-endpoints-policies-s3

An AWS CloudFormation template is being used to create a VPC peering connection between two existing operational VPCs, each belonging to a different AWS account. All necessary components in the 'Remote' (receiving) account are already in place.The template below creates the VPC peering connection in the Originating account. It contains these components:AWSTemplateFormation Version: 2010-09-09Parameters:Originating VCId:Type: StringRemoteVPCId:Type: StringRemoteVPCAccountId:Type: StringResources:newVPCPeeringConnection:Type: 'AWS::EC2::VPCPeeringConnection'Properties:VpcdId: !Ref OriginatingVPCIdPeerVpcId: !Ref RemoteVPCIdPeerOwnerId: !Ref RemoteVPCAccountIdWhich additional AWS CloudFormation components are necessary in the Originating account to create an operational cross-account VPC peering connection with AWS CloudFormation? (Select two.)

• Resources:NewEC2SecurityGroup:Type: AWS::EC2::SecurityGroup
• Resources:NetworkInterfaceToRemoteVPC:Type: ''AWS::EC2NetworkInterface''
• Resources:newEC2Route:Type: AWS::EC2::Route
• Resources:VPCGatewayToRemoteVPC:Type: ''AWS::EC2::VPCGatewayAttachment''
• Resources:newVPCPeeringConnection:Type: 'AWS::EC2VPCPeeringConnection'PeerRoleArn: !Ref PeerRoleArn https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_EC2.html

You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist. In addition to the whitelisted URL, the instances should be able to access any Amazon S3 bucket in the same region via any URL.Which of the following solutions should you deploy? (Select two.)

• Include s3.amazonaws.com in the whitelist.
• Create a VPC endpoint for S3.
• Run Squid proxy on a NAT instance.
• Deploy a NAT gateway into your VPC.
• Utilize a security group to restrict access. https://aws.amazon.com/blogs/security/how-to-set-up-an-outbound-vpc-proxy-with-domain-whitelisting-and-content-filtering/

You currently use a single security group assigned to all nodes in a clustered NoSQL database. Only your cluster members in one region must be able to connect to each other. This security group uses a self-referencing rule using the cluster security group's group-id to make it easier to add or remove nodes from the cluster. You need to make this database comply with out-of-region disaster recovery requirements and ensure that the network traffic between the nodes is encrypted when travelling between regions. How should you enable secure cluster communication while deploying additional cluster members in another AWS region?

• Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group rules that reference each other's security group-id in each region.
• Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region.
• Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region.
• Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group rules that reference each other's security group-id in each region.

A Systems Administrator is designing a hybrid DNS solution with spilt-view. The apex-domain ''example.com'' should be served through name servers across multiple top-level domains (TLDs). The name server for subdomain ''dev.example.com'' should reside on-premises. The administrator has decided to use Amazon Route 53 to achieve this scenario.What procedurals steps must be taken to implement the solution?

• Use a Route 53 public hosted zone for example.com and a private hosted zone for dev.example.com
• Use a Route 53 public and private hosted zone for example.com and perform subdomain delegation for dev.example.com
• Use a Route 53 public hosted zone for example.com and perform subdomain delegation for dev.example.com
• Use a Route 53 private hosted zone for example.com and perform subdomain delegation for dev.example.com aws.amazon.com/premiumsupport/knowledge-center/internal-version-website/