QUESTION: 17

You have to set up an AWS Direct Connect connection to connect your on-premises to an AWS VPC. Due to budget requirements, you can only provision a single Direct Connect port. You have two border gateway routersat your on-premises data center that can peer with the Direct Connect routers for redundancy. Which two design methodologies, in combination, will achieve this connectivity? (Choose two.)

Terminate the Direct Connect circuit on a L2 border switch, which in turn has trunk connections to the two routers.
Create two Direct Connect private VIFs for the same VPC, each with a different peer IP.
Terminate the Direct Connect circuit on any of the one routers, which in turn will have an IBGP session with the other router.
Create one Direct Connect private VIF for the VPC with two customer peer IPs.
Provision two VGWs for the VPC and create one Direct Connect private VIF per VGW.

Answer(s): A,D

Reveal Solution Next Question

QUESTION: 18

Your organization needs to resolve DNS entries stored in an Amazon Route 53 private zone “awscloud:internal” from the corporate network. An AWS Direct Connect connection with a private virtual interface is configured to provide access to a VPC with the CIDR block 192.168.0.0/16. A DNS Resolver (BIND) is configured on an Amazon Elastic Compute Cloud (EC2) instance with the IP address 192.168.10.5 within the VPC. The DNS Resolver has standard root server hints configured and conditional forwarding for “awscloud.internal” to the IP address 192.168.0.2.

From your PC on the corporate network, you query the DNS server at 192.168.10.5 for www.amazon.com. The query is successful and returns the appropriate response. When you query for “server.awscloud.internal”, the query times out. You receive no response.

How should you enable successful queries for “server.awscloud.internal”?

Attach an internet gateway to the VPC and create a default route.
Configure the VPC settings for enableDnsHostnames and enableDnsSupport as True
Relocate the BIND DNS Resolver to the corporate network.
Update the security group for the EC2 instance at 192.168.10.5 to allow UDP Port 53 outbound.

Answer(s): B

Reveal Solution Next Question

QUESTION: 19

Your company’s policy requires that all VPCs peer with a “common services: VPC. This VPC contains a fleet of layer 7 proxies and an Internet gateway. No other VPC is allowed to provision an Internet gateway. You configure a new VPC and peer with the common service VPC as required by policy. You launch an Amazon EC2. Windows instance configured to forward all traffic to the layer 7 proxies in the common services VPC. The application on this server should successfully interact with Amazon S3 using its properly configured AWS Identity and Access Management (IAM) role. However, Amazon S3 is returning 403 errors to the application.

Which step should you take to enable access to Amazon S3?

Update the S3 bucket policy with the private IP address of the instance.
Exclude 169.254.169.0/24 from the instance’s proxy configuration.
Configure a VPC endpoint for Amazon S3 in the same subnet as the instance.
Update the CORS configuration for Amazon S3 to allow traffic from the proxy.

Answer(s): D

Reveal Solution Next Question

QUESTION: 20

A customer is using ABC Telecom as a network provider. The customer has 10 different offices connected to ABC Telecom’s MPLS backbone. The customer is setting up an AWS Direct Connect connection to AWS and has provided the LOA-CFA to ABC Telecom. ABC Telecom has terminated the Direct Connect circuit into their MPLS backbone. To uniquely identify the customer’s traffic over the MPLS backbone, the customer must encapsulate all traffic with VLAN tag 100. The customer wants to send traffic to multiple VPCs.

Which two steps should be taken to meet the customer’s requirement? (Choose two.)

The customer performs Q-in-Q tunneling, with the AWS-required VLAN tag in the inside and VLAN 100 as the outside tag.
Create a support ticket with AWS to request the removal of the outer VLAN tag 100 as the traffic reaches AWS routers.
Send the traffic for all VPCs with the same VLAN tag 100 and use BGP to ensure that proper routing takes place to the appropriate VP
ABC Telecom removes the outer tag before sending the packet to AWS.
ABC Telecom creates a support ticket with AWS to exchange MPLS labels and include the AWS port as part of their MPLS network.

Answer(s): C,E

Reveal Solution Next Question

Free AWS-Certified-Advanced-Networking-Specialty Exam Braindumps (page: 5)

QUESTION: 17

QUESTION: 18

QUESTION: 19

QUESTION: 20