QUESTION: 109

A company’s web application is deployed on Amazon EC2 instances behind a public Application Load Balancer. The application flags malicious requests and uses an AWS Lambda function to add the offending IP addresses to the network ACL to block any further request for 24 hours. Recently, the application has been receiving more malicious requests, which causes the network ACL to reach its limit of allowed entries.

Which action should be taken to block more IP addresses, without compromising the existing security requirements?

Update the AWS Lambda function to remove blocked entries from the network ACL after 2 hours.
Update the AWS Lambda function to block malicious IPs in security groups rather than the network ACL.
Update the AWS Lambda function to block malicious IPs in AWS WAF attached to the Application Load Balancer.
Update the AWS Lambda function to add an additional network ACL to the subnets once the limit for the previous ones has been reached.

Answer(s): D

Reveal Solution Next Question

QUESTION: 110

A company is using AWS to host all of its applications. Each application is isolated in its own Amazon VPC. Different environments such as Development, Test, and Production are also isolated in their own VPCs. The Network Engineer needs to automate VPC creation to enforce the company’s network and security standards. Additionally, the CIDR range used in each VPC needs to be unique.
Which solution meets all of these requirements?

Use AWS CloudFormation to deploy the VPC infrastructure and a custom resource to request a CIDR range from an external IP address management (IPAM) service.
Use AWS OpsWorks to deploy the VPC infrastructure and a custom resource to request a CIDR range from an external IP address management (IPAM) service.
Use the VPC wizard in the AWS Management Console. Type in the CIDR blocks for the VPC and subnets.
Create the VPCs using AWS CLI and use the dry-run flag to validate if the current CIDR range is in use.

Answer(s): A

Reveal Solution Next Question

QUESTION: 111

You can turn on the AWS Config service from the AWS CLI by running the subscribe command and passing as parameters a valid IAM role, SNS topic, and _____________.

EBS volume
EC2 instance
S3 bucket
Kinesis stream

Answer(s): C

Explanation:

You can use the AWS CLI to turn on AWS Config. All it takes is the subscribe command and a few additional parameters. The parameters are -s3-bucket, which specifies the S3 bucket to which AWS Config data will be saved, -sns-topic, which specifies to which SNS topic messages from AWS Config will be sent, and -iam-role, which is an IAM role containing appropriate permissions for AWS Config to access the resources it monitors.

Reference:

http://docs.aws.amazon.com/config/latest/developerguide/gs-cli-subscribe.html

Reveal Solution Next Question

QUESTION: 112

You would like to automate the monitoring of changes in the configurations of your AWS resources and respond programmatically to configurations of only a certain type. To do this, you could use Amazon __________as the endpoint for the Amazon SNS topics that generate messages from AWS Config.

Kinesis
Simple Email Service (SES)
Simple Storage Service (S3)
Simple Queue Service (SQS)

Answer(s): D

Explanation:

AWS Config uses Amazon Simple Notification Service (SNS) to send you notifications every time a supported AWS resource is created, updated, or otherwise modified as a result of user API activity. However, you might be interested in only certain resource configuration changes. For example, you might consider it critical to know when someone modifies the configuration of a security group, but not need to know every time there is a change to tags on your Amazon EC2 instances. Or, you might want to write a program that performs specific actions when specific resources are updated. For example, you might want to start a certain workflow when a security group configuration is changed. If you want to programmatically consume the data from AWS Config in these or other ways, use an Amazon Simple Queue Service queue as the notification endpoint for Amazon SNS.

Reference:

http://docs.aws.amazon.com/config/latest/developerguide/monitor-resource-changes.html

Reveal Solution Next Question

Free AWS-Certified-Advanced-Networking-Specialty Exam Braindumps (page: 28)

QUESTION: 109

QUESTION: 110

QUESTION: 111

Explanation:

Reference:

QUESTION: 112

Explanation:

Reference: