ANS-C00 시험 - Amazon실제시험문제와 답 - 76문항

Question No : 1

Your company uses an NTP server to synchronize time across systems. The company runs multiple versions of Linux and Windows systems. You discover that the NTP server has failed, and you need to add an alternate NTP server to your instances.
Where should you apply the NTP server update to propagate information without rebooting your running instances?

A.DHCP Options Set
B.instance user-data
C.cfn-init scripts
D.instance meta-data

정답:

Question No : 2

You are designing an AWS Direct Connect solution into your VPC. You need to consider requirements for the customer router to terminate the Direct Connect link at the Direct Connect location.
Which three factors that must be supported should you consider when choosing the customer router? (Choose three.)

A.802.1q trunking
B.802.1ax or 802.3ad link aggregation
C.OSPF
D.BGP
E.single-mode optical fiber connectivity
F.1-Gbps copper connectivity

정답:

Question No : 3

Your application is hosted behind an Elastic Load Balancer (ELB) within an autoscaling group. The autoscaling group is configured with a minimum of 2, a maximum of 14, and a desired value of 2. The autoscaling cooldown and the termination policies are set to the default value.
CloudWatch reports that the site typically requires just two servers, but spikes at the start and end of the business day can require eight to ten servers. You receive intermittent reports of timeouts and partially loaded web pages.
Which configuration change should you make to address this issue?

A.Configure connection draining on the EL
B.Configure the autoscaling cooldown to 600 seconds.
C.Configure the termination policy to oldest instance.
D.Configure a Terminating: Wait lifecycle hook on a scale in event.

정답:
Explanation:
References: https://docs.aws.amazon.com/autoscaling/ec2/userguide/attach-load-balancer-asg.html

Question No : 4

You are moving a two-tier application into an Amazon VPC. An Elastic Load Balancing (ELB) load balancer is configured in front of the application tier. The application tier is driven through RESTful interfaces. The data tier uses relational database service (RDS) MySQL. Company policy requires end-to-end encryption of all data in transit.
What ELB configuration complies with the corporate encryption policy?

A.Configure the ELB load balancer protocol as HTT
B.Configure the application instances for SSL termination. Configure Amazon RDS for SSL, and use REQUIRE SSL grants.
C.Configure the ELB protocols in TCP mode. Configure the application instances for SSL termination. Configure Amazon RDS for SSL, and use REQUIRE SSL grants.
D.Configure the ELB load balancer protocol as HTTP
E.Offload application instance encryption to the load balancer. Install your SSL certificate on Amazon RDS, and configure SS
F.Configure the ELB protocols in SSL mode. Offload application instance encryption to the load balancer. Install your SSL/TLS certificate on Amazon RDS, and configure SS

정답:

Question No : 5

You ping an Amazon Elastic Compute Cloud (EC2) instance from an on-premises server.
VPC Flow Logs record the following:
2 123456789010 eni-1235b8ca 10.123.234.78 172.11.22.33 0 0 1 8 672 1432917027
1432917142 ACCEPT OK
2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917027
1432917082 ACCEPT OK
2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917094
1432917142 REJECT OK
Why are ICMP responses not received by the on-premises system?

A.The inbound network access control list is blocking the traffic
B.The outbound network access control list is blocking the traffic
C.The inbound security group is blocking the traffic.
D.The outbound security group is blocking the traffic.

정답:

Question No : 6

You have been asked to monitor traffic flows on your Amazon EC2 instance. You will be performing deep packet inspection, looking for atypical patterns.
Which tool will enable you to look at this data?

A.Wireshark
B.VPC Flow Logs
C.AWS CLI
D.CloudWatch Logs

정답:
Explanation:
References: https://www.slideshare.net/TeriRadichel/packet-capture-on-aws

Question No : 7

You need to set up a VPN between AWS VPC and your on-premises network. You create a VPN connection in the AWS Management Console, download the configuration file, and install it on your on-premises router. The tunnel is not coming up because of firewall restrictions on your router.
Which two network traffic options should you allow through the firewall? (Choose two.)

A.UDP port 500
B.IP protocol 50
C.IP protocol 5
D.TCP port 50
E.TCP port 500

정답:
Explanation:
References: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_VPN.html

Question No : 8

An organization delivers high-resolution, dynamic web content. Internet users access the content from a variety of platforms, including mobile, tablet and desktop. Each platform receives a customized experience to account for the differences in viewing modes. A dedicated, automatic-scaling fleet of Amazon EC2 instances is used for each platform to server content based on path-based headers.
Which combination of services will MINIMIZE cost and MAXIMIZE performance? (Choose two.)

A.Amazon CloudFront with Lambda@Edge
B.Network Load Balancer
C.Amazon S3 static websites
D.Amazon Route 53 with traffic flow policies
E.Application Load Balancer

정답:
Explanation:
References: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-theedge.html

Question No : 9

Under increased cybersecurity concerns, a company is deploying a near real-time intrusion detection system (IDS) solution. A system must be put in place as soon as possible. The architecture consists of many AWS accounts, and all results must be delivered to a central location.
Which solution will meet this requirement, while minimizing downtime and costs?

A.Deploy a third-party vendor solution to perform deep packet inspection in a transit VP
B.Enable VPC Flow Logs on each VP
C.Set up a stream of the flow logs to a central Amazon Elasticsearch cluster.
D.Enable Amazon Macie on each AWS account and configure central reporting.
E.Enable Amazon GuardDuty on each account as members of a central account.

정답:
Explanation:
References: https://aws.amazon.com/blogs/security/how-to-manage-amazon-guardduty-security-findingsacross-multiple-accounts/

Question No : 10

An organization runs a consumer-facing website on AWS. The Amazon EC2-based web fleet is load balanced using the AWS Application Load Balancer, Amazon Route 53 is used to provide the public DNS services.
The following URLs need to server content to end users:
test.example.com
web.example.com
example.com
Based on this information, what combination of services must be used to meet the requirement? (Choose two.)

A.Path condition in ALB listener to route example.com to appropriate target groups.
B.Host condition in ALB listener to route *.example.com to appropriate target groups.
C.Host condition in ALB listener to route example.com to appropriate target groups.
D.Path condition in ALB listener to route *.example.com to appropriate target groups.
E.Host condition in ALB listener to route $$$$.example.com to appropriate target groups.

정답:

Question No : 11

A customer is using ABC Telecom as a network provider. The customer has 10 different offices connected to ABC Telecom’s MPLS backbone. The customer is setting up an AWS Direct Connect connection to AWS and has provided the LOA-CFA to ABC Telecom. ABC Telecom has terminated the Direct Connect circuit into their MPLS backbone. To uniquely identify the customer’s traffic over the MPLS backbone, the customer must encapsulate all traffic with VLAN tag 100. The customer wants to send traffic to multiple VPCs.
Which two steps should be taken to meet the customer’s requirement? (Choose two.)

A.The customer performs Q-in-Q tunneling, with the AWS-required VLAN tag in the inside and VLAN 100 as the outside tag.
B.Create a support ticket with AWS to request the removal of the outer VLAN tag 100 as the traffic reaches AWS routers.
C.Send the traffic for all VPCs with the same VLAN tag 100 and use BGP to ensure that proper routing takes place to the appropriate VP
D.ABC Telecom removes the outer tag before sending the packet to AW
E.ABC Telecom creates a support ticket with AWS to exchange MPLS labels and include the AWS port as part of their MPLS network.

정답:

Question No : 12

Your company’s policy requires that all VPCs peer with a “common services: VPC. This VPC contains a fleet of layer 7 proxies and an Internet gateway. No other VPC is allowed to provision an Internet gateway. You configure a new VPC and peer with the common service VPC as required by policy. You launch an Amazon EC2. Windows instance configured to forward all traffic to the layer 7 proxies in the common services VPC. The application on this server should successfully interact with Amazon S3 using its properly configured AWS Identity and Access Management (IAM) role.
However, Amazon S3 is returning 403 errors to the application.
Which step should you take to enable access to Amazon S3?

A.Update the S3 bucket policy with the private IP address of the instance.
B.Exclude 169.254.169.0/24 from the instance’s proxy configuration.
C.Configure a VPC endpoint for Amazon S3 in the same subnet as the instance.
D.Update the CORS configuration for Amazon S3 to allow traffic from the proxy.

정답:

Question No : 13

168.10.5 within the VPC. The DNS Resolver has standard root server hints configured and conditional forwarding for “awscloud.internal” to the IP address 192.168.0.2.
From your PC on the corporate network, you query the DNS server at 192.168.10.5 for www.amazon.com. The query is successful and returns the appropriate response. When you query for “server.awscloud.internal”, the query times out. You receive no response.
How should you enable successful queries for “server.awscloud.internal”?

A.Attach an internet gateway to the VPC and create a default route.
B.Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True
C.Relocate the BIND DNS Resolver to the corporate network.
D.Update the security group for the EC2 instance at 192.168.10.5 to allow UDP Port 53 outbound.

정답:

Question No : 14

You have to set up an AWS Direct Connect connection to connect your on-premises to an AWS VPC. Due to budget requirements, you can only provision a single Direct Connect port. You have two border gateway routers at your on-premises data center that can peer with the Direct Connect routers for redundancy.
Which two design methodologies, in combination, will achieve this connectivity? (Choose two.)

A.Terminate the Direct Connect circuit on a L2 border switch, which in turn has trunk connections to the two routers.
B.Create two Direct Connect private VIFs for the same VPC, each with a different peer I
C.Terminate the Direct Connect circuit on any of the one routers, which in turn will have an IBGP session with the other router.
D.Create one Direct Connect private VIF for the VPC with two customer peer IPs.
E.Provision two VGWs for the VPC and create one Direct Connect private VIF per VG

정답:

Question No : 15

You currently use a single security group assigned to all nodes in a clustered NoSQL database. Only your cluster members in one region must be able to connect to each other. This security group uses a self-referencing rule using the cluster security group’s group-id to make it easier to add or remove nodes from the cluster. You need to make this database comply with out-of-region disaster recovery requirements and ensure that the network traffic between the nodes is encrypted when travelling between regions.
How should you enable secure cluster communication while deploying additional cluster members in another AWS region?

A.Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group rules that reference each other’s security group-id in each region.
B.Create an IPsec VPN between AWS regions, use private IP addresses to route traffic, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region.
C.Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group CIDR-based rules that correspond with the VPC CIDR in the other region.
D.Use public IP addresses and TLS to securely communicate between cluster nodes in each AWS region, and create cluster security group rules that reference each other’s security group-id in each region.

정답:

Amazon ANS-C00 시험