Section-Based - Automate AWS Tasks (Advanced Networking)

1. Question

Category: ANS – Network Implementation

An enterprise application is hosted in Amazon EKS on Fargate with an Amazon VPC Container Network Interface (CNI) plugin configured. The application hosts corporate report files that are accessed by millions of people around the world.

The company decided to launch a new security feature to prevent users in specific geographic locations from accessing the website’s static content. The solution should also reduce the number of simultaneous requests that are sent to your origin and improve the cache hit ratio.

What should be done to enable this new feature?

Integrate AWS Global Accelerator to the Application Load Balancer and enable the Geo-Restriction feature. Launch a Route 53 Resolver Inbound endpoint to improve the cache hit ratio.
Configure a Geolocation routing policy in the associated Amazon Route 53 record of the application. Launch a Route 53 Resolver Outbound endpoint to reduce the number of simultaneous requests that are sent to the origin.
Launch a CloudFront distribution and set the enterprise application as the origin. Enable the Geo-Restriction and Origin Shield features in the Amazon CloudFront distribution.
Use Geoproximity routing in Amazon Route 53 to route traffic only to the whitelisted geographic locations. Integrate a CloudFront function to reduce the number of simultaneous requests that are sent to your origin and improve the cache hit ratio.

2. Question

Category: ANS – Network Implementation

A company has multiple Amazon VPCs for each of its department namely Shared Services VPC, Service Consumer VPC, and an Outbound VPC proxy for domain whitelisting and content filtering. These common services ensure data compliance and network security of the company’s entire cloud infrastructure. For every new workload in AWS, the Network Team always creates a new VPC and manually peers it to the Shared VPCs.

What should the team do to automate the VPC Peering process for new AWS workloads?

Launch a Transit VPC in an AWS Direct Connect location. Set up a network configuration that automatically connects the new VPC to the existing Shared Services, Service Consumer, and Outbound VPCs by default.
Prepare a custom AWS Lambda function that automatically creates peering connections in the new VPC to all of the Shared VPCs.
Launch an AWS Transit Gateway that will automatically connect the new VPC to the existing Shared Services, Service Consumer, and Outbound VPCs. The Transit Gateway will immediately create and approve the peering requests to the VPCs without any manual intervention.
Prepare an AWS CloudFormation template that automatically creates peering connections in the new VPC to all of the Shared VPCs.

3. Question

Category: ANS – Network Implementation

An application is hosted in an Auto Scaling group of EC2 instances behind an Application Load Balancer. The Security team detected 300 random IP addresses that submitted bad requests to the application. These malicious web requests generate thousands of HTTP 4xx error codes that significantly affect the application’s performance. Based on the security logs, the Security team predicts that there would be more attacks from new IP addresses that need to be blocked.

What is the MOST suitable solution that the Network Administrator should implement to mitigate this security threat?

Set up 300 inbound rules in the Security Group of the EC2 instances to block the malicious IP addresses.
Integrate Amazon Inspector to the Application Load Balancer. Set up IP match conditions in Amazon Inspector to block the malicious IP addresses.
Add 300 inbound rules in the Network ACL on the subnet, where the EC2 instances are launched, to the block the malicious IP addresses.
Integrate AWS WAF to the Application Load Balancer. Configure IP match conditions in AWS WAF to block the malicious IP addresses.

4. Question

Category: ANS – Network Implementation

An online trade finance system is hosted in two Dedicated EC2 Hosts that are behind an Application Load Balancer. A Network Engineer is tasked to implement a web filtering solution that automatically blocks web requests from a list of blacklisted countries issued by the Financial Action Task Force (FATF).

What should the Engineer implement to satisfy this requirement?

Use AWS WAF with a rule that blocks an IP Set which contains all IP addresses associated with the blacklisted countries.
Use AWS WAF with a geo match condition.
Set up a geo match condition in the Application Load Balancer that blocks requests from the blacklisted countries.
Use Amazon GuardDuty to block web requests from a list of blacklisted countries.

5. Question

Category: ANS – Network Implementation

A Network Administrator is setting up an automated monitoring system that checks whether all Elastic IP addresses are attached to EC2 instances. The monitoring solution should verify that the Elastic IP addresses are also used by the elastic network interfaces (ENIs).

What should the Administrator do to complete this task?

Enable Detailed Monitoring in CloudWatch.
Set up and use the EIP-ATTACHED managed rule in AWS Config.
Install an Amazon Inspector agent to all EC2 instances and configure the agent to send a notification if the instance doesn't have an Elastic IP address.
Use Amazon GuardDuty in the VPC and enable the EIP-ATTACHED managed rule.

6. Question

Category: ANS – Network Implementation

A financial application is hosted in several EC2 instances behind an Application Load Balancer that only accepts HTTP or HTTPS traffic. A recent misconfiguration incident occurred when a Network team member incorrectly replaced the existing security group with an unused one that allows all inbound traffic. One of the measures to prevent this from happening again is to track unassociated security groups automatically.

Which of the following is the MOST suitable solution that the team should implement?

Install a CloudWatch Agent in each EC2 instance. Configure the agent to send an email notification if a security group is not attached to the EC2 instance.
Use AWS Config and set up the EC2_SECURITY_GROUP_ATTACHED_TO_ENI managed rule to track the security group changes.
Set up Amazon Macie to track all security group changes in the VPC.
Configure Systems Manager State Manager to identify and track all changes in the security group association of the EC2 instances.

7. Question

Category: ANS – Network Implementation

An organization is preparing a CloudFormation template that uses the Fn::Cidr intrinsic function within a subnet resource to fetch available CIDR ranges. The CIDR block of the organization’s Amazon VPC is 192.168.0.0/24 and the intrinsic function must produce 6 CIDRs with a /27subnet mask.

Which of the following options provides the correct combination of parameter values that will yield the expected result?

{ "Fn::Cidr" : [ "192.168.0.0/24", "6", "5" ]}
{ "Fn::Cidr" : [ "192.168.0.0/24", "6", "27" ]}
{ "Fn::Cidr" : [ "192.168.0.0/24", "5", "6" ]}
{ "Fn::Cidr" : [ "192.168.0.0/24", "27", "5" ]}

8. Question

Category: ANS – Network Management and Operation

A company has a security information and event management (SIEM) solution that analyzes CloudTrail logs stored in an S3 bucket. The CloudTrail trail is configured to send a notification to an SNS topic whenever a log is outputted to the bucket. The SIEM polls new events from an SQS queue that is subscribed to the SNS topic. Then based on the SQS message, the SIEM fetches logs from the S3 bucket. A misconfiguration that resulted in permission issues has caused the SIEM to stop getting new events.

What could possibly cause this issue?

The access policy for the queue does not permit sqs:ReceiveMessage actions originating from Amazon SNS.
The access policy for the queue does not permit sqs:SendMessage actions originating from Amazon SNS
The IAM role does not have the sqs:SendMessage permissions.
The S3 bucket policy does not allow Amazon S3 to make sns:GetTopicAttributes actions to the SNS topic.

9. Question

Category: ANS – Network Implementation

An AWS Consultant is creating a CloudFormation template that automatically establishes a VPC peering connection between two VPCs. The requester VPC located at us-east-1 is owned by the company and the accepter VPC in us-west-1 belongs to another AWS account.

What should the Consultant do in order to implement this task?

Add an AWS::VPC::VPCGatewayAttachment resource in the CloudFormation template and set up a cross-account access role for the peering connection. Verify that the PeerRoleArn and PeerRegion properties are properly configured.
Create an AWS::EC2::VPCPeeringConnection resource in the template and set up a cross-account access role for the peering connection. Ensure that the PeerRoleArn and PeerRegion properties are properly supplied.
In the CloudFormation template, verify that the AWS::EC2::Route resource contains the necessary AWS::EC2::SecurityGroup and AWS::EC2NetworkInterface properties.
Set up an AWS::EC2::VPCPeeringConnection resource in the template and a Service Control Policy (SCP) for the peering connection.

10. Question

Category: ANS – Network Implementation

A Network Engineer has created an AWS CloudFormation template that can automatically peer with a virtual private cloud (VPC) in another AWS account by using the AWS::EC2::VPCPeeringConnection entity configuration. The VPC peering connection will help facilitate data access and data transfer between two VPCs. While doing the deployment, the Engineer received a VpcPeeringConnection failed to stabilize error in CloudFormation.

Which of the following are the possible causes for this issue? (Select TWO.)

The PeerRoleArn property isn’t passed correctly when creating a VPC peering connection between VPCs in different accounts.
The two VPCs do not have a matching or overlapping IPv4 CIDR blocks.
The AWS::EC2::VPCPeeringConnection resource was created in the originating account.
The AWS::EC2::Route resource was not properly configured.
The PeerRegion property isn’t passed correctly when creating a VPC peering connection between VPCs in different AWS Regions.

11. Question

Category: ANS – Network Implementation

A Systems Administrator has been tasked to set up a notification system that tracks every change in the AWS IP address ranges. How can the Administrator implement the solution with the LEAST effort?

Create a Lambda function that reads the https://ip-ranges.amazonaws.com/ip-ranges.json endpoint and send a notification using Amazon SNS. Set up a CloudWatch Events rule to run the function every hour.
In Amazon SNS, create a new subscription to the arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged Topic ARN.
Launch an EC2 Spot Instance that downloads the ip-ranges.json file from the https://ip-ranges.amazonaws.com endpoint every hour, using a cron job. Install and use a CloudWatch agent to send out the notification.
Use the AWS managed AmazonIpSpaceChanged queue in Amazon SQS. Subscribe the queue to an Amazon SNS Topic which will be used for the notification.

12. Question

Category: ANS – Network Implementation

A Network Engineer has been tasked to set up an automated solution to check whether all Elastic IP addresses are properly attached to the Amazon EC2 instances. The solution must verify that the Elastic IP addresses are also in-use by the elastic network interfaces (ENIs).

How can the Engineer satisfy the above requirements?

Set up AWS Firewall Manager to automatically check all the changes and allocations of the Elastic IP addresses.
Set up AWS Systems Manager to check all the changes and allocations of the Elastic IP addresses.
Set up AWS Config to track all configuration changes of specific AWS resources. Use the EIP-attached AWS Config Managed Rule to check all the changes and allocations of the Elastic IP addresses.
Set up AWS Shield Advanced to check all the changes and allocations of the Elastic IP addresses in the VPC.

Section-Based – Automate AWS Tasks (Advanced Networking)

Tutorials-Dojo

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question