[Oct-2024] ANS-C01 PDF Dumps Are Helpful To produce Your Dreams Correct QA's
New ANS-C01 exam Free Sample Questions to Practice
Amazon ANS-C01 (AWS Certified Advanced Networking Specialty) certification exam is a popular and valuable credential for IT professionals who want to demonstrate their advanced knowledge and skills in designing and implementing AWS network solutions. AWS Certified Advanced Networking Specialty Exam certification is designed for individuals who have a strong background in networking and want to specialize in AWS networking technologies.
The ANS-C01 exam tests the candidate's ability to design and deploy secure and scalable AWS networking solutions, as well as their knowledge of advanced networking concepts such as VPC, VPN, DNS, and Route 53. ANS-C01 exam also covers topics such as network security, monitoring, and optimization, as well as AWS Direct Connect and Elastic Load Balancing.
The ANS-C01 exam is intended for individuals who have prior experience in networking and AWS services. Candidates are expected to have a thorough understanding of core networking concepts such as TCP/IP, DNS, and VPN, as well as an in-depth knowledge of AWS networking services like VPC, Direct Connect, and Route 53. ANS-C01 exam also tests the candidate's ability to apply these concepts to real-world scenarios and design complex networking solutions.
NEW QUESTION # 108
An ecommerce company is hosting a web application on Amazon EC2 instances to handle continuously changing customer demand. The EC2 instances are part of an Auto Scaling group. The company wants to implement a solution to distribute traffic from customers to the EC2 instances. The company must encrypt all traffic at all stages between the customers and the application servers. No decryption at intermediate points is allowed.
Which solution will meet these requirements?
- A. Create a Gateway Load Balancer (GLB). Configure the Auto Scaling group to register instances with the GLB's target group.
- B. Create a Network Load Balancer (NLB). Add a TCP listener to the NLB. Configure the Auto Scaling group to register instances with the NLB's target group.
- C. Create an Application Load Balancer (ALB). Add an HTTPS listener to the ALB. Configure the Auto Scaling group to register instances with the ALB's target group.
- D. Create an Amazon CloudFront distribution. Configure the distribution with a custom SSL/TLS certificate. Set the Auto Scaling group as the distribution's origin.
Answer: B
Explanation:
To distribute traffic from customers to EC2 instances in an Auto Scaling group and encrypt all traffic at all stages between the customers and the application servers without decryption at intermediate points, the company should create a Network Load Balancer (NLB) with a TCP listener and configure the Auto Scaling group to register instances with the NLB's target group (Option C). This solution allows for end-to-end encryption of traffic without decryption at intermediate points.
NEW QUESTION # 109
A financial services application runs on a fleet of Amazon EC2 instances that are configured with an Auto Scaling Group (ASG). The instances are fronted by an Elastic Load Balancer (ELB). The security team has flagged an exploitable vulnerability in the encryption protocol and cipher that the application uses. The listener of the ELB is configured on an HTTPS protocol.
Which step will you take to secure the application from the newly detected vulnerability?
Response:
- A. Add a certificate list to add multiple certificates on the ELB for additional security
- B. Update the security policy on the ELB to disable vulnerable protocols and ciphers
- C. Create a strong custom security policy to cover the newly detected vulnerability and attach it to your Application Load Balancer
- D. Create new SSL certificates for all web servers and replace the old ones with the new certificates created
Answer: B
NEW QUESTION # 110
You have a route table entry that points to this destination: pl-1a2b3c4d What type of destination is this?
Response:
- A. Provider List
- B. Prefix List
- C. Provider Logical-Interface
Answer: B
NEW QUESTION # 111
A company has deployed its AWS environment in a single AWS Region. The environment consists of a few hundred application VPCs, a shared services VPC, and a VPN connection to the company's on-premises environment. A network engineer needs to implement a transit gateway with the following requirements:
* Application VPCs must be isolated from each other.
* Bidirectional communication must be allowed between the application VPCs and the on-premises network.
* Bidirectional communication must be allowed between the application VPCs and the shared services VPC.
The network engineer creates the transit gateway with options disabled for default route table association and default route table propagation. The network engineer also creates the VPN attachment for the on-premises network and creates the VPC attachments for the application VPCs and the shared services VPC.
The network engineer must meet all the requirements for the transit gateway by designing a solution that needs the least number of transit gateway route tables.
Which combination of actions should the network engineer perform to accomplish this goal? (Choose two.)
- A. Configure a separate transit gateway route table for all application VPCs. Associate all application VPCs with this transit gateway route table. Propagate the shared services VPC attachment and the VPN attachment to this transit gateway route table.
- B. Configure a separate transit gateway route table for on premises. Associate the VPN attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.
- C. Configure a separate transit gateway route table for each application VPC. Associate each application VPC attachment with its respective transit gateway route table. Propagate the shared services VPC attachment and the VPN attachment to this transit gateway route table.
- D. Configure a separate transit gateway route table for on premises and the shared services VPC. Associate the VPN attachment and the shared services VPC attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.
- E. Configure a separate transit gateway route table for the shared services VPC. Associate the shared services VPC attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.
Answer: C,E
NEW QUESTION # 112
A company has deployed its AWS environment in a single AWS Region. The environment consists of a few hundred application VPCs, a shared services VPC, and a VPN connection to the company's on-premises environment. A network engineer needs to implement a transit gateway with the following requirements:
- Application VPCs must be isolated from each other.
- Bidirectional communication must be allowed between the application
VPCs and the on-premises network.
- Bidirectional communication must be allowed between the application
VPCs and the shared services VPC.
The network engineer creates the transit gateway with options disabled for default route table association and default route table propagation. The network engineer also creates the VPN attachment for the on-premises network and creates the VPC attachments for the application VPCs and the shared services VPC.
The network engineer must meet all the requirements for the transit gateway by designing a solution that needs the least number of transit gateway route tables.
Which combination of actions should the network engineer perform to accomplish this goal?
(Choose two.)
- A. Configure a separate transit gateway route table for the shared services VPC. Associate the shared services VPC attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.
- B. Configure a separate transit gateway route table for on premises. Associate the VPN attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.
- C. Configure a separate transit gateway route table for each application VPC. Associate each application VPC attachment with its respective transit gateway route table. Propagate the shared services VPC attachment and the VPN attachment to this transit gateway route table.
- D. Configure a separate transit gateway route table for all application VPCs. Associate all application VPCs with this transit gateway route table. Propagate the shared services VPC attachment and the VPN attachment to this transit gateway route table.
- E. Configure a separate transit gateway route table for on premises and the shared services VPC.Associate the VPN attachment and the shared services VPC attachment with this transit gateway route table. Propagate all application VPC attachments to this transit gateway route table.
Answer: D,E
NEW QUESTION # 113
Which type of firewall dynamically allows return traffic?
Response:
- A. Stateless Firewall
- B. Network ACL
- C. Security Group
Answer: C
NEW QUESTION # 114
Your company is expanding its cloud infrastructure and moving many of its flat files and static assets to S3. You currently use a VPN to access your compute infrastructure, but you require more reliability for your static files as you are offloading all of your important data to AWS.
What is your best course of action while keeping costs low?
Response:
- A. Create a Direct Connect connection using a Private VIF to access both compute and S3 resources.
- B. Create an S3 endpoint and create a route to the endpoint prefix list for your VPN to allow access to your S3 resources.
- C. Create two Direct Connect connections. Each connected to a Private VIF to ensure maximum resiliency.
- D. Create a Direct Connect connection using a Public VIF and route your VPN over the DX connection to your VPN endpoint.
Answer: D
NEW QUESTION # 115
You have configured a subnet with the following CIDR range: 10.0.1.0/24. Which of the following IP addresses are NOT reserved by AWS?
Response:
- A. 10.0.1.255
- B. 10.0.1.3
- C. 10.0.1.2
- D. 10.0.1.254
Answer: D
NEW QUESTION # 116
A company wants to analyze TCP traffic to the internet. The traffic originates from Amazon EC2 instances in the company's VPC. The EC2 instances initiate connections through a NAT gateway.
The required information includes source and destination IP addresses, ports, and the first 8 bytes of payload of TCP segments. The company needs to collect, store, and analyze all the required data points.
Which solution will meet these requirements?
- A. Set up the EC2 instances as VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights.
- B. Turn on VPC Flow Logs on the EC2 instances. Specify the default format and a log destination of Amazon CloudWatch Logs. Analyze the flow log data by using CloudWatch Logs Insights.
- C. Turn on VPC Flow Logs on the EC2 instances. Specify a custom format and a log destination of Amazon S3. Analyze the flow log data by using Amazon Athena.
- D. Set up the NAT gateway as a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon OpenSearch Service cluster. Analyze the data by using OpenSearch Dashboards.
Answer: A
Explanation:
VPC Flow Logs capture metadata about the network traffic, such as source and destination IP addresses, source and destination ports, protocol, packet and byte counts, start and end times of the flow, and more. This information is useful for monitoring and troubleshooting network traffic patterns, but it does not include the payload content of TCP segments.
If you need to capture and analyze the payload data of TCP segments, you would need to use other monitoring and logging solutions, such as tapping into the network traffic with tools like Traffic Mirroring or using other packet capture mechanisms. These solutions can capture the actual data content for analysis, but they might require more advanced setup and configuration compared to VPC Flow Logs.
NEW QUESTION # 117
An organization has three AWS accounts with each containing VPCs in Virginia, Canada and the Sydney regions. The organization wants to determine whether all available Elastic IP addresses (EIPs) in these accounts are attached to Amazon EC2 instances or in use elastic network interfaces (ENIs) in all of the specified regions for compliance and cost-optimization purposes.
Which of the following meets the requirements with the LEAST management overhead?
Response:
- A. Use AWS CloudFormation StackSets to deploy an AWS Config EIP-attached rule in all accounts and regions to find the unattached and unused EIPs.
- B. Add an AWS managed, EIP-attached AWS Config rule in each region in all three accounts to find unattached and unused EIPs.
- C. Use a CloudWatch event bus to schedule Lambda functions in each account in all three regions to find the unattached and unused EIPs.
- D. use an Amazon CloudWatch Events rule to schedule an AWS Lambda function in each account in all three regions to find the unattached and unused EIPs.
Answer: A
NEW QUESTION # 118
You are supporting a customer that executes tightly coupled High Performance Computing (HPC) workloads. What Virtual Private Cloud (VPC) option provides high-throughput, low-latency, and high packet-per-second performance?
Response:
- A. 25 Gbps Ethernet
- B. IPv6 addressing
- C. NIC Teaming
- D. Placement groups
Answer: D
NEW QUESTION # 119
A company uses a 1 Gbps AWS Direct Connect connection to connect its AWS environment to its on-premises data center. The connection provides employees with access to an application VPC that is hosted on AWS. Many remote employees use a company-provided VPN to connect to the data center. These employees are reporting slowness when they access the application during business hours. On-premises users have started to report similar slowness while they are in the office.
The company plans to build an additional application on AWS. On-site and remote employees will use the additional application. After the deployment of this additional application, the company will need 20% more bandwidth than the company currently uses. With the increased usage, the company wants to add resiliency to the AWS connectivity. A network engineer must review the current implementation and must make improvements within a limited budget.
What should the network engineer do to meet these requirements MOST cost-effectively?
- A. Deploy an AWS Site-to-Site VPN connection to the application VPC. Configure the on-premises routing for the remote employees to connect to the Site-to-Site VPN connection.
- B. Deploy Amazon Workspaces into the application VPInstruct the remote employees to connect to Workspaces.
- C. Replace the existing 1 Gbps Direct Connect connection with two new 2 Gbps Direct Connect hosted connections. Create an AWS Client VPN endpoint in the application VPC. Instruct the remote employees to connect to the Client VPN endpoint.
- D. Set up a new 1 Gbps Direct Connect dedicated connection to accommodate the additional traffic load from remote employees and the additional application. Create a link aggregation group (LAG).
Answer: D
Explanation:
Setting up a new 1 Gbps Direct Connect dedicated connection to accommodate the additional traffic load from remote employees and the additional application would provide more bandwidth and lower latency than a VPN connection over the public internet1. Creating a link aggregation group (LAG) with the existing and new Direct Connect connections would provide resiliency and redundancy for the AWS connectivity2.
NEW QUESTION # 120
A company has an application that hosts personally identifiable information (PII) of users. All connections to the application must be secured by HTTPS with TLS certificates that implement Elliptic Curve Cryptography (ECC).
The application uses stateful connections between the web tier and the end users. Multiple instances host the application. A network engineer must implement a solution that offloads TLS connections to a load balancer.
Which load-balancing solution will meet these requirements?
- A. Provision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Identity and Access Management (IAM). Configure a default action to redirect to the URL for the application. Turn on application-based session affinity (sticky sessions).
- B. Provision a Network Load Balancer. Configure a TLS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS identity and Access Management (IAM). Turn on health checks to monitor the web hosts that connect to the end users.
- C. Provision a Network Load Balancer. Configure a TLS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Certificate Manager (ACM). Turn on application-based session affinity (sticky sessions). Turn on health checks to monitor the web hosts that connect to the end users.
- D. Provision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Certificate Manager (ACM). Configure a default action to redirect to the URL for the application. Turn on health checks to monitor the web hosts that connect to the end users.
Answer: C
NEW QUESTION # 121
Which service parses large Flow Logs for consumption by other programs such as Kibana?
Response:
- A. S3
- B. Kinesis
- C. ElasticSearch
- D. Elastic Beanstalk
Answer: C
NEW QUESTION # 122
When setting up a client-to-site VPN using EC2 instance to access AWS resources, which of the following configuration would be preferable considering the security and management?
Response:
- A. Configure the client software to use an EC2 elastic IP as the VPN termination endpoint. Turn on EC2 auto-recovery on this instance.
- B. Configure client software to use a DNS name as a VPN termination endpoint. Map the DNS name to multiple IP addresses using Amazon Route 53 and set up health checks.
- C. Configure client software to use an EC2 elastic IP as the VPN termination endpoint. Build in automation to detect failure, and move Elastic IP from the primary to the secondary EC2 instance.
- D. Leverage the high availability built into Virtual Private Gateway (VGW).
Answer: A
NEW QUESTION # 123
What MTU is recommended for VPN and Direct Connect links?
Note: Answers to this question are not verified by our experts, please study yourself and select the appropriate answers.
Contribute: Please send the correct answers with reference text/link on [email protected] to get up to 50% cashback.
Response:
- A. 0
- B. Jumbo Frames
- C. 1
- D. 2
Answer: D
NEW QUESTION # 124
In the context of Amazon CloudFront, when you configure the media player, the path you specify to the media file must contain the characters _____________.
Note: Answers to this question are not verified by our experts, please study yourself and select the appropriate answers.
Contribute: Please send the correct answers with reference text/link on [email protected] to get up to 50% cashback.
Response:
- A. flv/std just before the domain name
- B. flv/std immediately after the domain name
- C. cfx/st immediately after the domain name
- D. cfx/st just before the domain name
Answer: C
NEW QUESTION # 125
A company has several production applications across different accounts in the AWS Cloud. The company operates from the us-east-1 Region only. Only certain partner companies can access the applications. The applications are running on Amazon EC2 instances that are in an Auto Scaling group behind an Application Load Balancer (ALB). The EC2 instances are in private subnets and allow traffic only from the ALB. The ALB is in a public subnet and allows inbound traffic only from partner network IP address ranges over port 80.
When the company adds a new partner, the company must allow the IP address range of the partner network in the security group that is associated with the ALB in each account. A network engineer must implement a solution to centrally manage the partner network IP address ranges.
Which solution will meet these requirements in the MOST operationally efficient manner?
- A. Create a new prefix list. Add all allowed IP address ranges to the prefix list. Use Amazon EventBridge (Amazon CloudWatch Events) rules to invoke an AWS Lambda function to update security groups whenever a new IP address range is added to the prefix list. Deploy this solution in all accounts.
- B. Create a new prefix list. Add all allowed IP address ranges to the prefix list. Share the prefix list across different accounts by using AWS Resource Access Manager (AWS RAM). Update security groups to use the prefix list instead of the partner IP address range. Update the prefix list with the new IP address range when the company adds a new partner.
- C. Create an Amazon DynamoDB table to maintain all IP address ranges and security groups that need to be updated. Update the DynamoDB table with the new IP address range when the company adds a new partner. Invoke an AWS Lambda function to read new IP address ranges and security groups from the DynamoDB table to update the security groups. Deploy this solution in all accounts.
- D. Create an Amazon S3 bucket to maintain all IP address ranges and security groups that need to be updated. Update the S3 bucket with the new IP address range when the company adds a new partner. Invoke an AWS Lambda function to read new IP address ranges and security groups from the S3 bucket to update the security groups. Deploy this solution in all accounts.
Answer: B
Explanation:
Creating a new prefix list and adding all allowed IP address ranges to the prefix list would enable grouping of CIDR blocks that can be referenced in security group rules3. Sharing the prefix list across different accounts by using AWS Resource Access Manager (AWS RAM) would enable central management of the partner network IP address ranges5. Updating security groups to use the prefix list instead of the partner IP address range would enable simplification of security group rules3. Updating the prefix list with the new IP address range when the company adds a new partner would enable automatic propagation of the changes to all security groups that use the prefix list3.
NEW QUESTION # 126
......
Cover ANS-C01 Exam Questions Make Sure You 100% Pass: https://prepaway.testinsides.top/ANS-C01-dumps-review.html