QUESTION: 45

The Web Application Development team is worried about malicious activity from 200 random IP addresses.Which action will ensure security and scalability from this type of threat?

Use inbound security group rules to block the IP addresses.
Use inbound network ACL rules to block the IP addresses.
Use AWS WAF to block the IP addresses.
Write iptables rules on the instance to block the IP addresses.

Answer(s): B

Reveal Solution Next Question

You operate a production VPC with both a public and a private subnet. Your organization maintains a restricted Amazon S3 bucket to support this production workload. Only Amazon EC2 instances in the private subnet should access the bucket. You implement VPC endpoints(VPC-E) for Amazon S3 and remove the NAT that previously provided a network path to Amazon S3. The default VPC-E policy is applied. Neither EC2 instances in the public or private subnets are able to access the S3 bucket.
What should you do to enable Amazon S3 access from EC2 instances in the private subnet?

Add the CIDR address range of the private subnet to the S3 bucket policy.
Add the VPC-E identified to the S3 bucket policy.
Add the VPC identifier for the production VPC to the S3 bucket policy.
Add the VPC-E identifier for the production VPC to endpoint policy.

Answer(s): A

Reveal Solution Next Question

QUESTION: 47

Your hybrid networking environment consists of two application VPCs, a shared services VPC, and your corporate network. The corporate network is connected to the shared services VPC via an IPsec VPN with dynamic (BGP) routing enabled.

The applications require access to a common authentication service in the shared services VPC. You need to enable native network access from the corporate network to both application VPCs.

Which step should you take to meet the requirements?

Use VPC peering to peer the application VPCs with the shared services VPC, and enable associated routing in the shared services VPC via the corporate VPN.
Configure an IPsec VPN between the virtual private gateway in each application VPC to the virtual private gateway in the shared services VPC.
Configure additional IPsec VPNs for each application VPC back to the corporate network, and enable VPC peering to the shared services VP
Enable CloudHub functionality to route traffic between the three VPCs and the corporate network using dynamic BGP routing.

Answer(s): C

Reveal Solution Next Question

QUESTION: 48

You use a VPN to extend your corporate network into a VPC. Instances in the VPC are able to resolve resource records in an Amazon Route 53 private hosted zone. Your on-premises DNS server is configured with a forwarder to the VPC DNS server IP address. On-premises users are unable to resolve names in the private hosted zone, although instances in a peered VPC can.
What should you do to provide on-premises users with access to the private hosted zone?

Create a proxy resolver within the VPC. Point the on-premises forwarder to the proxy resolver.
Modify the network access control list on the VPC to allow DNS queries from on-premises systems.
Configure the on-premises server as a secondary DNS for the private zone. Update the NS records.
Update the on-premises forwarders with the four name servers assigned to the private hosted zone.

Answer(s): D

Reference:

https://aws.amazon.com/blogs/security/how-to-set-up-dns-resolution-between-on-premises-networks-and-aws-by-using-unbound/

Reveal Solution Next Question

Free AWS-Certified-Advanced-Networking-Specialty Exam Braindumps (page: 12)

QUESTION: 45

QUESTION: 46

QUESTION: 47

QUESTION: 48

Reference: