Cisco®
Oracle
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
SAP
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk®
All Vendors
  2. Home
  3. Exams
  4. Amazon
  5. AWS-Certified-Advanced-Networking-Specialty

Free Amazon AWS-Certified-Advanced-Networking-Specialty Exam Questions (page: 19)

Page 11 of 56
PDF with 274 Questions

A network engineer must provide additional safeguards to protect encrypted data at Application Load Balancers (ALBs) through the use of a unique random session key.
What should the network engineer do to meet this requirement?

  1. Change the ALB security policy to a policy that supports TLS 1.2 protocol only
  2. Use AWS Key Management Service (AWS KMS) to encrypt session keys
  3. Associate an AWS WAF web ACL with the ALBs. and create a security rule to enforce forward secrecy (FS)
  4. Change the ALB security policy to a policy that supports forward secrecy (FS)

Answer(s): D

Explanation:

Forward secrecy (FS) is a security feature that ensures that even if an attacker is able to compromise the session keys for a particular connection, they will not be able to use those keys to decrypt any past or future communications. This is because FS uses a new, unique session key for each connection.

To enable FS on an ALB, you can change the ALB security policy to a policy that supports FS. You can do this by following these steps:

Go to the ALB console.
Select the ALB that you want to change.
Click the Configuration tab.
Under Security, click Edit.
In the Security policy drop-down list, select a policy that supports FS.
Click Save.
Once you have enabled FS on an ALB, all connections to the ALB will use unique, random session keys. This will help to protect your data from being intercepted and decrypted by attackers.

Here are some additional things to keep in mind when using FS on ALBs:

FS is only available for connections that use the TLS 1.2 or TLS 1.3 protocols.
If you are using a custom security policy, you will need to make sure that it includes a rule that enables FS.
You can also use AWS Key Management Service (KMS) to encrypt session keys. This can be useful if you need to rotate session keys or if you want to store them in a secure location.



A company has deployed a software-defined WAN (SD-WAN) solution to interconnect all of its offices. The company is migrating workloads to AWS and needs to extend its SD-WAN solution to support connectivity to these workloads.

A network engineer plans to deploy AWS Transit Gateway Connect and two SD-WAN virtual appliances to provide this connectivity. According to company policies, only a single SD-WAN virtual appliance can handle traffic from AWS workloads at a given time.

How should the network engineer configure routing to meet these requirements?

  1. Add a static default route in the transit gateway route table to point to the secondary SD-WAN virtual appliance. Add routes that are more specific to point to the primary SD-WAN virtual appliance.
  2. Configure the BGP community tag 7224:7300 on the primary SD-WAN virtual appliance for BGP routes toward the transit gateway.
  3. Configure the AS_PATH prepend attribute on the secondary SD-WAN virtual appliance for BGP routes toward the transit gateway.
  4. Disable equal-cost multi-path (ECMP) routing on the transit gateway for Transit Gateway Connect.

Answer(s): C



A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway in the required AWS Region. A network engineer needs to deploy the SD-WAN hub virtual appliance into a VPC that is connected to the transit gateway. The solution must support at least 5 Gbps of throughput from the SD-WAN hub virtual appliance to other VPCs that are attached to the transit gateway.
Which solution will meet these requirements?

  1. Create a new VPC for the SD-WAN hub virtual appliance. Create two IPsec VPN connections between the SD-WAN hub virtual appliance and the transit gateway. Configure BGP over the IPsec VPN connections
  2. Assign a new CIDR block to the transit gateway. Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Add a transit gateway Connect attachment. Create a Connect peer and specify the GRE and BGP parameters. Create a route in the appropriate VPC for the SD-WAN hub virtual appliance to route to the transit gateway.
  3. Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Create two IPsec VPN connections between the SD-WAN hub virtual appliance and the transit gateway. Configure BGP over the IPsec VPN connections.
  4. Assign a new CIDR block to the transit gateway. Create a new VPC for the SD-WAN hub virtual appliance. Attach the new VPC to the transit gateway with a VPC attachment. Add a transit gateway Connect attachment. Create a Connect peer and specify the VXLAN and BGP parameters. Create a route in the appropriate VPC for the SD-WAN hub virtual appliance to route to the transit gateway.

Answer(s): B



A company is deploying a new application on AWS. The application uses dynamic multicasting. The company has five VPCs that are all attached to a transit gateway Amazon EC2 instances in each VPC need to be able to register dynamically to receive a multicast transmission.
How should a network engineer configure the AWS resources to meet these requirements?

  1. Create a static source multicast domain within the transit gateway. Associate the VPCs and applicable subnets with the multicast domain. Register the multicast senders' network interface with the multicast domain. Adjust the network ACLs to allow UDP traffic from the source to all receivers and to allow UDP traffic that is sent to the multicast group address.
  2. Create a static source multicast domain within the transit gateway. Associate the VPCs and applicable subnets with the multicast domain. Register the multicast senders' network interface with the multicast domain. Adjust the network ACLs to allow TCP traffic from the source to all receivers and to allow TCP traffic that is sent to the multicast group address.
  3. Create an Internet Group Management Protocol (IGMP) multicast domain within the transit gateway. Associate the VPCs and applicable subnets with the multicast domain. Register the multicast senders' network interface with the multicast domain. Adjust the network ACLs to allow UDP traffic from the source to all receivers and to allow UDP traffic that is sent to the multicast group address.
  4. Create an Internet Group Management Protocol (IGMP) multicast domain within the transit gateway. Associate the VPCs and applicable subnets with the multicast domain. Register the multicast senders' network interface with the multicast domain. Adjust the network ACLs to allow TCP traffic from the source to all receivers and to allow TCP traffic that is sent to the multicast group address.

Answer(s): C



Viewing page 19 of 56



Post your Comments and Discuss Amazon AWS-Certified-Advanced-Networking-Specialty exam prep with other Community members:

AWS-Certified-Advanced-Networking-Specialty Exam Discussions & Posts