Question 1

A company runs an application on Amazon EC2 instances. A network engineer implements a NAT gateway in the application's VPC to replace self-managed NAT instances. After the network engineer shifts traffic from the self-managed NAT instances to the NAT gateway, users begin to report issues. During troubleshooting, the network engineer discovers that the connection to the application is closing after approximately 6 minutes of inactivity. What should the network engineer do to resolve this issue?

Options :

A :

Check for increases in the Amazon CloudWatch IdleTimeoutCount metric for the NAT gateway. Configure TCP keepalive on the application EC2 instances.

B :

Check for increases in the Amazon CloudWatch ErrorPortAIlocation metric for the NAT gateway. Configure an HTTP timeout value on the application EC2 instances.

C :

Check for increases in the Amazon CloudWatch PacketsDropCount metric for the NAT gateway. Configure an HTTPS timeout value on the application EC2 instances.

D :

Check for decreases in the Amazon CloudWatch ActiveConnectionCount metric for the NAT gateway. Configure UDP keepalive on the application EC2 instances.

Answer: A

Question 2

An application's EC2 instances are located in a private subnet and these instances access sensitive data in S3 via a NAT gateway deployed in a public subnet. The S3 bucket is located in the same AWS Region as the EC2 instances. The development team at the company wants to ensure that this bucket can be accessed only from the VPC where the application resides. As an AWS Certified Networking Specialist, which of the following solutions would you suggest to meet these requirements?

Options :

A :

Create an S3 bucket policy and use an IP address condition to restrict access to the bucket. Allow access only from the VPC CIDR range and deny all other IP address ranges

B :

Create a new IAM role for the EC2 instances that provides access to the S3 bucket and assign the role to the application instances. Set up an S3 bucket policy to allow access only from the role

C :

Set up an S3 VPC endpoint in the VPC where the application resides. Configure an S3 bucket policy with a condition to allow access only from the VPC endpoint

D : Set up an Origin Access Identity (OAI) for the S3 bucket and allow access only from within the VPC

Answer: C

Question 3

A company has deployed an AWS Network Firewall firewall into a VPC. A network engineer needs to implement a solution to deliver Network Firewall flow logs to the company’s Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster in the shortest possible time. Which solution will meet these requirements?

Options :

A : Create an Amazon S3 bucket. Create an AWS Lambda function to load logs into the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster. Enable Amazon Simple Notification Service (Amazon SNS) notifications on the S3 bucket to invoke the Lambda function. Configure flow logs for the firewall. Set the S3 bucket as the destination.

B : Create an Amazon Kinesis Data Firehose delivery stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination. Configure flow logs for the firewall Set the Kinesis Data Firehose delivery stream as the destination for the Network Firewall flow logs.

C : Configure flow logs for the firewall. Set the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination for the Network Firewall flow logs.

D : Create an Amazon Kinesis data stream that includes the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster as the destination. Configure flow logs for the firewall. Set the Kinesis data stream as the destination for the Network Firewall flow logs

Answer: B

Question 4

The networking team at a company has noticed issues with Quality of Service (QoS) in the traffic to the EC2 instances hosting a VOIP program. The team needs to inspect the network packets to determine if it is a programming error or a networking error. As an AWS Certified Networking Specialist, which of the following solutions would you recommend for the given use case?

Options :

A :

Provision another EC2 instance with an ENI added to act as a monitoring interface. Configure the port to promiscuous mode and sniff the traffic to analyze the packets. Direct the output of this single stream to an S3 bucket for further analysis

B :

Configure traffic mirroring on the source EC2 instances hosting the VOIP program, set up a network monitoring program on a target EC2 instance and stream the logs to an S3 bucket for further analysis

C : Use VPC Flow Logs to inspect the network packets

D : Use CloudWatch to inspect the network packets

Answer: B

Question 5

An organization is replacing a tape backup system with a storage gateway. there is currently no connectivity to AWS. Initial testing is needed. What connection option should the organization use to get up and running at minimal cost?

Options :

A : Use an internet connection.

B : Set up an AWS VPN connection.

C : Provision an AWS Direct Connection private virtual interface.

D : Provision a Direct Connect public virtual interface.

Answer: A

Free ANS-C01 Mock Exam – Practice Online Confidently

Buying Options: