QUESTION: 25

You have been asked to monitor traffic flows on your Amazon EC2 instance. You will be performing deep packet inspection, looking for atypical patterns.Which tool will enable you to look at this data?

Wireshark
VPC Flow Logs
AWS CLI
CloudWatch Logs

Answer(s): A

Reference:

https://www.slideshare.net/TeriRadichel/packet-capture-on-aws

Reveal Solution Next Question

You ping an Amazon Elastic Compute Cloud (EC2) instance from an on-premises server. VPC Flow Logs record the following:

2 123456789010 eni-1235b8ca 10.123.234.78 172.11.22.33 0 0 1 8 672 1432917027
1432917142 ACCEPT OK
2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917027
1432917082 ACCEPT OK
2 123456789010 eni-1235b8ca 172.11.22.33 10.123.234.78 0 0 1 4 336 1432917094
1432917142 REJECT OK

Why are ICMP responses not received by the on-premises system?

The inbound network access control list is blocking the traffic
The outbound network access control list is blocking the traffic
The inbound security group is blocking the traffic.
The outbound security group is blocking the traffic.

Answer(s): B

Explanation:

An ACCEPT record for the originating ping that was allowed by both the network ACL and the security group, and therefore was allowed to reach your instance.
A REJECT record for the response ping that the network ACL denied.
If your network ACL permits outbound ICMP traffic, the flow log displays two ACCEPT records (one for the originating ping and one for the response ping). If your security group denies inbound ICMP traffic, the flow logdisplays a single REJECT record, because the traffic was not permitted to reach your instance.

Reference:

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

Reveal Solution Next Question

QUESTION: 27

You are moving a two-tier application into an Amazon VPC. An Elastic Load Balancing (ELB) load balancer is configured in front of the application tier. The application tier is driven through RESTful interfaces. The data tier uses relational database service (RDS) MySQL. Company policy requires end-to-end encryption of all data in transit.What ELB configuration complies with the corporate encryption policy?

Configure the ELB load balancer protocol as HTTP. Configure the application instances for SSL termination. Configure Amazon RDS for SSL, and use REQUIRE SSL grants.
Configure the ELB protocols in TCP mode. Configure the application instances for SSL termination. Configure Amazon RDS for SSL, and use REQUIRE SSL grants.
Configure the ELB load balancer protocol as HTTPS. Offload application instance encryption to the load balancer. Install your SSL certificate on Amazon RDS, and configure SSL.
Configure the ELB protocols in SSL mode. Offload application instance encryption to the load balancer. Install your SSL/TLS certificate on Amazon RDS, and configure SSL.

Answer(s): C

Reveal Solution Next Question

QUESTION: 28

Your application is hosted behind an Elastic Load Balancer (ELB) within an autoscaling group. The autoscaling group is configured with a minimum of 2, a maximum of 14, and a desired value of 2. The autoscaling cooldown and the termination policies are set to the default value.

CloudWatch reports that the site typically requires just two servers, but spikes at the start and end of the business day can require eight to ten servers. You receive intermittent reports of timeouts and partially loaded web pages.

Which configuration change should you make to address this issue?

Configure connection draining on the ELB.
Configure the autoscaling cooldown to 600 seconds.
Configure the termination policy to oldest instance.
Configure a Terminating: Wait lifecycle hook on a scale in event.

Answer(s): A

Reference:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/attach-load-balancer-asg.html

Reveal Solution Next Question

Free AWS-Certified-Advanced-Networking-Specialty Exam Braindumps (page: 7)

QUESTION: 25

Reference:

QUESTION: 26

Explanation:

Reference:

QUESTION: 27

QUESTION: 28

Reference: