Online Access Free Amazon.ANS-C01.v2023-07-13.q34 Practice Test (Page 3)

ANS-C01 Exam Question 6

A company uses AWS Direct Connect to connect its corporate network to multiple VPCs in the same AWS account and the same AWS Region. Each VPC uses its own private VIF and its own virtual LAN on the Direct Connect connection. The company has grown and will soon surpass the limit of VPCs and private VIFs for each connection.
What is the MOST scalable way to add VPCs with on-premises connectivity?

A.Provision a new Direct Connect connection to handle the additional VPCs. Use the new connection to connect additional VPCs.

B.Create virtual private gateways for each VPC that is over the service quota. Use AWS Site-to-Site VPN to connect the virtual private gateways to the corporate network.

C.Create a Direct Connect gateway, and add virtual private gateway associations to the VPCs. Configure a private VIF to connect to the corporate network.

D.Create a transit gateway, and attach the VPCs. Create a Direct Connect gateway, and associate it with the transit gateway. Create a transit VIF to the Direct Connect gateway.

ANS-C01 Exam Question 7

A company is deploying an application. The application is implemented in a series of containers in an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use the Fargate launch type for its tasks. The containers will run workloads that require connectivity initiated over an SSL connection. Traffic must be able to flow to the application from other AWS accounts over private connectivity. The application must scale in a manageable way as more consumers use the application.
Which solution will meet these requirements?

A.Choose a Network Load Balancer (NLB) as the type of load balancer for the ECS service. Specify the NLB in the service definition. Create a VPC endpoint service for the NLB. Share the VPC endpoint service with other AWS accounts.

B.Choose a Gateway Load Balancer (GLB) as the type of load balancer for the ECS service. Create a lifecycle hook to add new tasks to the target group from Amazon ECS as required to handle scaling. Specify the GLB in the service definition. Create a VPC peer for external AWS accounts. Update the route tables so that the AWS accounts can reach the GLB.

C.Choose an Application Load Balancer (ALB) as the type of load balancer for the ECS service. Create path-based routing rules to allow the application to target the containers that are registered in the target group. Specify the ALB in the service definition. Create a VPC peer for the external AWS accounts. Update the route tables so that the AWS accounts can reach the ALB.

D.Choose an Application Load Balancer (ALB) as the type of load balancer for the ECS service. Create path-based routing rules to allow the application to target the containers that are registered in the target group. Specify the ALB in the service definition. Create a VPC endpoint service for the ALB Share the VPC endpoint service with other AWS accounts.

ANS-C01 Exam Question 8

A company's network engineer is designing a hybrid DNS solution for an AWS Cloud workload. Individual teams want to manage their own DNS hostnames for their applications in their development environment. The solution must integrate the application-specific hostnames with the centrally managed DNS hostnames from the on-premises network and must provide bidirectional name resolution. The solution also must minimize management overhead.
Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

A.Create DNS proxy servers.

B.Use an Amazon Route 53 Resolver outbound endpoint.

C.Create Amazon Route 53 private hosted zones.

D.Modify the DHCP options set by setting a custom DNS server value.

E.Use an Amazon Route 53 Resolver inbound endpoint.

F.Set up a zone transfer between Amazon Route 53 and the on-premises DNS.

ANS-C01 Exam Question 9

A media company is implementing a news website for a global audience. The website uses Amazon CloudFront as its content delivery network. The backend runs on Amazon EC2 Windows instances behind an Application Load Balancer (ALB). The instances are part of an Auto Scaling group. The company's customers access the website by using service example com as the CloudFront custom domain name. The CloudFront origin points to an ALB that uses service-alb.example.com as the domain name.
The company's security policy requires the traffic to be encrypted in transit at all times between the users and the backend.
Which combination of changes must the company make to meet this security requirement? (Choose three.)

A.Create a certificate for service.example.com by using AWS Certificate Manager (ACM). Configure CloudFront to use this custom SSL/TLS certificate. Change the default behavior to redirect HTTP to HTTPS.

B.Create a public certificate from a third-party certificate provider with any domain name for the EC2 instances. Configure the backend to use this certificate for its HTTPS listener. Specify the instance target type during the creation of a new target group that uses the HTTPS protocol for its targets. Attach the existing Auto Scaling group to this new target group.

C.Create a self-signed certificate for service-alb.example.com. Import the certificate into AWS Certificate Manager (ACM). On the ALB add a new HTTPS listener that uses the new target group and the imported service-alb.example.com ACM certificate. Modify the CloudFront origin to use the HTTPS protocol only. Delete the HTTP listener on the ALB.

D.Create a certificate for service-alb.example.com by using AWS Certificate Manager (ACM). On the ALB add a new HTTPS listener that uses the new target group and the service-alb.example.com ACM certificate. Modify the CloudFront origin to use the HTTPS protocol only. Delete the HTTP listener on the ALB.

E.Create a self-signed certificate for service.example.com. Import the certificate into AWS Certificate Manager (ACM). Configure CloudFront to use this imported SSL/TLS certificate. Change the default behavior to redirect HTTP to HTTPS.

F.Create a certificate with any domain name by using AWS Certificate Manager (ACM) for the EC2 instances. Configure the backend to use this certificate for its HTTPS listener. Specify the instance target type during the creation of a new target group that uses the HTTPS protocol for its targets. Attach the existing Auto Scaling group to this new target group.

ANS-C01 Exam Question 10

A network engineer must provide additional safeguards to protect encrypted data at Application Load Balancers (ALBs) through the use of a unique random session key.
What should the network engineer do to meet this requirement?

A.Change the ALB security policy to a policy that supports TLS 1.2 protocol only

B.Use AWS Key Management Service (AWS KMS) to encrypt session keys

C.Associate an AWS WAF web ACL with the ALBs. and create a security rule to enforce forward secrecy (FS)

D.Change the ALB security policy to a policy that supports forward secrecy (FS)

Other Version: 623Amazon.ANS-C01.v2023-07-29.q45; 2860Amazon.ANS-C01.v2023-03-20.q319

Latest Upload: 228Amazon.SAA-C03.v2026-07-25.q425; 130SAP.C_S4PM.v2026-07-25.q43; 224Google.Professional-Data-Engineer.v2026-07-25.q215; 220Microsoft.AZ-104.v2026-07-25.q227; 187Amazon.DOP-C02.v2026-07-25.q201; 154EMC.NCP-AII.v2026-07-25.q60; 152CheckPoint.156-561.v2026-07-25.q83; 230Amazon.AIF-C01.v2026-07-24.q158; 164WGU.Applied-Algebra.v2026-07-24.q46; 161Oracle.1Z0-948.v2026-07-24.q60

ANS-C01 Exam Question 6

ANS-C01 Exam Question 7

ANS-C01 Exam Question 8

ANS-C01 Exam Question 9

ANS-C01 Exam Question 10

Download PDF File