View Full Amazon AWS Certified Advanced Networking – Specialty ANS-C01 Exam Dumps and Practice Test Dumps

 

Question 261. Which BGP attribute can be used by an AWS network administrator to influence outbound traffic from an AWS network toward an on-premises network?

1. MED
2. Local preference
3. AS_PATH prepending
4. BGP origin

Correct Answer: 2. Local preference

Explanation:

BGP local preference is used within an autonomous system to influence which path is preferred for outbound traffic. A higher local preference value is generally preferred, allowing an organization to select a particular Direct Connect or VPN path when multiple paths are available. This attribute is primarily evaluated by routers within the same autonomous system and is therefore useful for controlling how traffic leaves the network toward external destinations. MED can also influence route selection, but it is generally used to suggest an inbound path toward an autonomous system. AS_PATH prepending is commonly used to influence inbound traffic by making a route appear less attractive.

Question 262. A company has two Direct Connect connections to AWS and wants to make one path less preferred for traffic entering the company’s network. Which technique can the company use?

1. Increase local preference on the preferred AWS route
2. Configure a shorter AS_PATH on the backup connection
3. Use AS_PATH prepending on the backup connection
4. Enable VPC peering between the connections

Correct Answer: 3. Use AS_PATH prepending on the backup connection

Explanation:

AS_PATH prepending can be used to influence inbound BGP traffic. The organization can intentionally add its autonomous system number multiple times to routes advertised through the less-preferred Direct Connect connection. When an external router compares otherwise suitable BGP paths, a longer AS_PATH can make that route less attractive. This allows the company to encourage incoming traffic to use another Direct Connect connection without physically disabling the backup path. The technique is particularly useful when maintaining redundancy while establishing a preferred and secondary path. It is important to understand that AS_PATH prepending influences routing decisions made by neighboring networks and is not a guarantee of the final traffic path.

Question 263. Which AWS Direct Connect feature allows multiple physical connections to be combined into a logical connection for increased bandwidth and redundancy?

1. Link Aggregation Group (LAG)
2. Direct Connect gateway
3. Transit virtual interface
4. Public virtual interface

Correct Answer: 1. Link Aggregation Group (LAG)

Explanation:

A Direct Connect Link Aggregation Group, or LAG, combines multiple Direct Connect connections using the Link Aggregation Control Protocol (LACP) into a logical aggregation. This can simplify management while providing increased aggregate bandwidth and improved resilience. The individual connections participating in a LAG must meet AWS requirements for compatibility, including appropriate port speeds. A Direct Connect gateway serves a different purpose: it provides a way to connect virtual interfaces to multiple VPCs or supported resources across Regions. Public and transit virtual interfaces define connectivity types, but they do not aggregate physical Direct Connect links. Therefore, LAG is the appropriate feature when the requirement specifically involves combining multiple physical connections.

Question 264. Which Direct Connect virtual interface type should be used when a customer needs private connectivity from on-premises networks to VPC resources through a Direct Connect gateway?

1. Public virtual interface
2. Transit virtual interface
3. Private virtual interface
4. Internet virtual interface

Correct Answer: 3. Private virtual interface

Explanation:

A private virtual interface provides private connectivity between an on-premises network and AWS private resources, such as VPC subnets. It can be associated with a Direct Connect gateway when the architecture requires connectivity to supported VPC resources across AWS infrastructure. A public virtual interface is intended for reaching AWS public services using public IP addressing, while a transit virtual interface is used to connect to a Transit Gateway through a Direct Connect gateway. The distinction is important when designing hybrid architectures because the virtual interface determines the type of AWS connectivity and the routing model available to the customer.

Question 265. A company wants to connect its on-premises network to multiple VPCs using a single Direct Connect gateway and Transit Gateway architecture. Which virtual interface should it configure?

1. Private virtual interface
2. Public virtual interface
3. Transit virtual interface
4. Loopback virtual interface

Correct Answer: 3. Transit virtual interface

Explanation:

A transit virtual interface is designed to provide connectivity from a Direct Connect connection to a Direct Connect gateway, which can then provide connectivity to a Transit Gateway. This architecture is useful when an organization needs scalable hybrid connectivity to multiple VPCs. Instead of establishing separate Direct Connect connectivity arrangements for every VPC, the Transit Gateway can provide centralized routing and segmentation. A private virtual interface is used for private connectivity to VPCs through supported Direct Connect gateway configurations, but it does not provide the same Transit Gateway connectivity model. The transit VIF therefore matches the stated requirement of using Direct Connect with a Direct Connect gateway and Transit Gateway.

Question 266. Which AWS Site-to-Site VPN capability allows a customer to use dynamic routing rather than manually configured static routes?

1. BGP
2. NAT Gateway
3. Internet Gateway
4. Route 53 Resolver

Correct Answer: 1. BGP

Explanation:

AWS Site-to-Site VPN supports dynamic routing using Border Gateway Protocol (BGP) when configured with a suitable customer gateway device. BGP allows the AWS side and customer-side router to exchange network prefixes dynamically. This is especially useful when networks change frequently or when multiple VPN paths are required for redundancy and automatic route selection. Static routing can still be used when the environment is simple or the customer device does not support BGP, but it requires administrators to maintain route information manually. BGP reduces this operational burden and enables more flexible routing decisions based on attributes and available paths.

Question 267. A network administrator needs to establish encrypted connectivity between an on-premises router and an AWS VPC. Which protocol provides the secure tunnel used by AWS Site-to-Site VPN?

1. GRE
2. IPsec
3. HTTP
4. FTP

Correct Answer: 2. IPsec

Explanation:

AWS Site-to-Site VPN uses IPsec to establish encrypted tunnels between the customer’s network and AWS. IPsec provides mechanisms for authentication, encryption, and integrity protection of IP traffic traveling through the VPN connection. AWS Site-to-Site VPN normally provides redundant tunnels so that connectivity can continue if one tunnel becomes unavailable. GRE can be used in other networking architectures, including certain overlay designs, but it is not the underlying encryption protocol for AWS Site-to-Site VPN. HTTP and FTP are application-layer protocols and do not provide the network-layer encrypted tunnel required for this type of hybrid connectivity. Therefore, IPsec is the correct protocol.

Question 268. Which configuration provides automatic route exchange between AWS Site-to-Site VPN and a customer gateway when dynamic routing is required?

1. Static routes only
2. BGP peering
3. DNS forwarding
4. NAT translation

Correct Answer: 2. BGP peering

Explanation:

BGP peering allows the AWS VPN endpoint and customer gateway to exchange routes dynamically. When BGP is configured, each side can advertise reachable prefixes and learn routes from the other side. This is valuable in environments where networks are added, removed, or changed over time because administrators do not need to update every route manually. BGP can also support path selection and failover when multiple routes or VPN tunnels are available. Static routing provides a simpler alternative but requires explicit route configuration. DNS forwarding and NAT address different networking requirements and do not provide dynamic exchange of routing information between the VPN peers.

Question 269. Which Transit Gateway feature allows a virtual appliance to inspect traffic while preserving symmetric routing through the appliance?

1. Appliance mode support
2. DNS Firewall
3. VPC peering
4. Public virtual interface

Correct Answer: 1. Appliance mode support

Explanation:

Transit Gateway appliance mode is designed for architectures that use stateful network appliances, such as firewalls, intrusion prevention systems, or other inspection devices. Stateful appliances generally require both directions of a network flow to traverse the same appliance or appliance endpoint so that connection state can be maintained. Appliance mode helps Transit Gateway select an appropriate Availability Zone and maintain flow symmetry for traffic passing through an inspection VPC. Without appropriate appliance-mode behavior, return traffic could potentially use a different path or Availability Zone, which can cause stateful appliances to drop traffic because the expected connection state is not present.

Question 270. A company deploys a centralized firewall VPC connected to a Transit Gateway. Which architecture is most appropriate for forcing traffic from multiple VPCs through the firewall before reaching other networks?

1. Direct VPC peering between every VPC
2. Transit Gateway route tables directing traffic to the firewall VPC
3. Internet Gateway attached to every subnet
4. S3 gateway endpoints

Correct Answer: 2. Transit Gateway route tables directing traffic to the firewall VPC

Explanation:

A centralized inspection architecture can use Transit Gateway route tables to direct traffic from multiple VPCs toward a dedicated inspection VPC containing network security appliances. The Transit Gateway provides a scalable hub for connecting VPCs, VPNs, Direct Connect, and other attachments, while routing policies determine which traffic should pass through the inspection environment. This approach avoids creating a large mesh of VPC peering connections and makes security controls easier to centralize. Appliance mode may also be relevant when stateful appliances require symmetric flows. Internet Gateways and S3 gateway endpoints solve different connectivity problems and do not provide centralized traffic inspection.

Question 271. An organization wants to connect two VPCs in different AWS Regions without using a Transit Gateway. Which option can provide private connectivity between them?

1. VPC peering
2. NAT Gateway
3. Internet Gateway only
4. Gateway Load Balancer endpoint

Correct Answer: 1. VPC peering

Explanation:

Inter-Region VPC peering allows private network connectivity between VPCs located in different AWS Regions. Traffic travels using AWS infrastructure rather than requiring the applications to communicate through the public internet. The VPCs can use their private IP addresses, provided their CIDR ranges do not overlap and the required route table and security controls are configured correctly. VPC peering is a direct connection and is not transitive, so it may become difficult to manage when many VPCs need connectivity. For larger environments, Transit Gateway can provide a more centralized architecture. Nevertheless, when the requirement specifically asks for direct private connectivity between two VPCs without Transit Gateway, inter-Region VPC peering is an appropriate solution.

Question 272. Two VPCs use non-overlapping CIDR blocks and are connected using VPC peering. Which configuration is required for instances to communicate across the peering connection?

1. A route to the peer VPC CIDR through the peering connection
2. A NAT Gateway in both VPCs
3. An Internet Gateway in both VPCs
4. A public virtual interface

Correct Answer: 1. A route to the peer VPC CIDR through the peering connection

Explanation:

VPC peering establishes the networking relationship between two VPCs, but route tables still need appropriate routes for traffic to reach the remote VPC. For example, a subnet route table in one VPC must contain a route for the destination CIDR of the peer VPC with the VPC peering connection as the target. Security groups and network ACLs must also permit the traffic. A NAT Gateway or Internet Gateway is not required for private traffic between peered VPCs. A public virtual interface is related to Direct Connect and is unrelated to VPC peering. Therefore, adding the appropriate peer CIDR route is essential.

Question 273. A company needs IPv6-only workloads in a private subnet to initiate outbound connections to the internet while preventing unsolicited inbound IPv6 connections. Which AWS component should it use?

1. NAT Gateway
2. Internet Gateway
3. Egress-only Internet Gateway
4. Gateway Load Balancer

Correct Answer: 3. Egress-only Internet Gateway

Explanation:

An egress-only Internet Gateway is designed for IPv6 traffic originating from resources in a VPC that need outbound internet connectivity while preventing the internet from initiating inbound connections through the gateway. Unlike IPv4 NAT Gateway behavior, IPv6 addresses are globally routable, so an egress-only Internet Gateway provides a mechanism for controlling outbound-only IPv6 communication. The subnet route table must contain an appropriate IPv6 default route toward the egress-only Internet Gateway. A standard Internet Gateway provides general internet connectivity, while a NAT Gateway is primarily associated with translating private IPv4 addresses for outbound IPv4 access.

Question 274. A network engineer wants to reduce the number of public IPv4 addresses required by private EC2 instances that need outbound internet access. Which solution should be considered?

1. NAT Gateway
2. Internet Gateway attached directly to every instance
3. Public VPC peering
4. Route 53 Resolver

Correct Answer: 1. NAT Gateway

Explanation:

A NAT Gateway allows resources in private subnets to initiate outbound IPv4 connections to destinations such as the internet without assigning public IPv4 addresses to each private resource. The private subnet route table typically sends internet-bound traffic to a NAT Gateway located in a public subnet. The NAT Gateway uses its associated public IPv4 address for outbound communication, reducing the need for individual public addresses on private instances. Security groups and network ACLs still need to be configured appropriately. An Internet Gateway alone does not provide the same private-to-public IPv4 address translation function, and Route 53 Resolver is a DNS service rather than a general internet egress mechanism.

Question 275. A network administrator wants DNS queries from VPC resources to be forwarded to an on-premises DNS server. Which AWS service component should be configured?

1. Resolver outbound endpoint
2. Resolver inbound endpoint
3. Internet Gateway
4. CloudFront distribution

Correct Answer: 1. Resolver outbound endpoint

Explanation:

An Amazon Route 53 Resolver outbound endpoint allows DNS queries originating in AWS VPCs to be forwarded to DNS resolvers outside AWS, such as corporate DNS servers in an on-premises network. The administrator can create a Resolver forwarding rule specifying which domain names should be forwarded and associate that rule with the appropriate VPCs. The outbound endpoint uses elastic network interfaces in selected subnets to send DNS queries toward the external DNS infrastructure. An inbound endpoint serves the opposite direction, allowing on-premises clients to query DNS names hosted in AWS. Therefore, the outbound endpoint is the correct component when AWS-originated DNS queries must reach corporate DNS servers.

Question 276. A company’s on-premises DNS servers need to resolve private DNS names hosted in Amazon Route 53 private hosted zones. Which component enables the DNS queries to enter AWS?

1. Resolver outbound endpoint
2. Resolver inbound endpoint
3. NAT Gateway
4. Network Load Balancer

Correct Answer: 2. Resolver inbound endpoint

Explanation:

A Route 53 Resolver inbound endpoint allows DNS queries originating outside AWS to enter the VPC DNS resolution environment. For example, on-premises DNS servers can forward queries for AWS private domains to the IP addresses associated with the inbound endpoint. The Resolver can then resolve names associated with private hosted zones that are associated with the relevant VPCs. This creates an important part of a hybrid DNS architecture. An outbound endpoint performs the reverse function by forwarding DNS queries from AWS toward external DNS servers. NAT Gateways and load balancers do not provide this DNS forwarding capability.

Question 277. Which Route 53 feature allows an organization to return different DNS responses based on the geographic location of the DNS requester?

1. Weighted routing
2. Failover routing
3. Geolocation routing
4. Simple routing

Correct Answer: 3. Geolocation routing

Explanation:

Route 53 geolocation routing allows DNS responses to be selected according to the geographic location associated with the DNS query. Organizations can create records that direct users from different countries or geographic regions to different resources. This can be useful when applications have regulatory, localization, or regional service requirements. Geolocation routing is different from latency-based routing, which selects a resource based primarily on measured network latency between users and AWS Regions. Weighted routing distributes traffic according to configured weights, while failover routing is designed around health-check-based primary and secondary resource selection. The routing policy should therefore match the specific business and geographic requirement.

Question 278. A CloudFront distribution should use different caching rules for /images/* and /api/*. Which CloudFront feature should be configured?

1. Origin groups
2. Cache behaviors
3. Route 53 health checks
4. Direct Connect virtual interfaces

Correct Answer: 2. Cache behaviors

Explanation:

CloudFront cache behaviors allow administrators to define different processing and caching rules for URL path patterns. For example, a distribution can use one cache behavior for /images/* with a long cache duration while using another behavior for /api/* with more restrictive caching or different request policies. Cache behaviors can also control which origin receives requests and how query strings, headers, and cookies are handled. Origin groups address origin failover rather than path-specific caching policy. Route 53 health checks and Direct Connect virtual interfaces are unrelated to CloudFront cache behavior configuration. Therefore, cache behaviors are the appropriate feature for applying different rules based on URL paths.

Question 279. Which AWS service can provide a fixed set of static anycast IP addresses that route client traffic through the AWS global network to healthy application endpoints?

1. AWS Global Accelerator
2. Amazon Route 53 Resolver
3. AWS NAT Gateway
4. VPC peering

Correct Answer: 1. AWS Global Accelerator

Explanation:

AWS Global Accelerator provides static anycast IP addresses that serve as stable entry points for applications. Client traffic enters the AWS global network through an appropriate edge location and is then routed toward healthy endpoints in supported AWS Regions. This can improve application availability and network performance by using the AWS global backbone rather than relying solely on internet routing to the destination. Global Accelerator also supports health checks and endpoint traffic management. CloudFront is more focused on content delivery and caching, while Route 53 provides DNS services. NAT Gateway and VPC peering address VPC connectivity rather than global application traffic acceleration.

Question 280. A company wants to inspect HTTP and HTTPS traffic entering an application before it reaches an Application Load Balancer. Which AWS service is designed specifically to provide Layer 7 web application filtering?

1. AWS WAF
2. AWS Transit Gateway
3. AWS Direct Connect
4. Amazon Route 53 Resolver

Correct Answer: 1. AWS WAF

Explanation:

AWS WAF is designed to inspect and filter web requests at the application layer. It can be associated with supported resources such as an Application Load Balancer, CloudFront distribution, or API Gateway. Administrators can create rules to control traffic based on characteristics such as IP addresses, request patterns, headers, query strings, and other HTTP elements. WAF can help mitigate common web threats and can also use managed rule groups and rate-based rules. Transit Gateway provides network-level routing, Direct Connect provides private connectivity, and Route 53 Resolver handles DNS resolution. Therefore, AWS WAF is the service specifically intended for Layer 7 web request filtering.