At ValidExamDumps, we consistently monitor updates to the Amazon ANS-C01 exam questions by Amazon. Whenever our team identifies changes in the exam questions, objectives, focus areas or requirements, We immediately update our exam questions for both PDF and online practice exams. This commitment ensures our customers always have access to the most current and accurate questions. By preparing with these up to date and 100% exam domain coverage questions, our customers can successfully pass the Amazon AWS Certified Advanced Networking - Specialty exam on their first attempt without needing additional materials or study guides.
Other certification materials providers often include outdated or removed questions by Amazon in their ANS-C01 exam. These outdated questions lead to customers failing their Amazon AWS Certified Advanced Networking - Specialty exam. In contrast, we ensure our questions bank includes only precise and up-to-date questions. Our main priority is your success in the Amazon ANS-C01 exam, not profiting from selling obsolete exam questions in PDF or Online Practice Test.
A finance company runs multiple applications on Amazon EC2 instances in two VPCs that are within a single AWS Region. The company uses one VPC for stock trading applications. The company uses the second VPC for financial applications. Both VPCs are connected to a transit gateway that is configured as a multicast router.
In the stock trading VPC, an EC2 instance that has an IP address of 10.128.10.2 sends trading data over a multicast network to the 239.10.10.10 IP address on UDP Port 5102. The company recently launched two new EC2 instances in the financial application VPC. The new EC2 instances need to receive the multicast stock trading data from the EC2 instance that is in the stock trading VPC.
Which combination of steps should the company take to meet this requirement? (Choose three.)
Add ENIs to the multicast group: To receive multicast traffic, the ENIs of the receiver EC2 instances must be explicitly added as members of the multicast group using the multicast group IP address (239.10.10.10).
Create associations to the EC2 instance IDs: Multicast domains in a transit gateway allow multicast traffic to flow between VPCs. To enable specific instances to receive the multicast traffic, the instance IDs in the financial application VPC must be associated with the transit gateway multicast domain.
Add a security group rule for UDP traffic: The receiver instances need a security group rule to allow inbound UDP traffic on port 5102 from the sender EC2 instance (source IP: 10.128.10.2). This ensures that multicast traffic is allowed to reach the receiving instances.
A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east-west (VPC-to-VPC) traffic.
Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations, and network ACLs as the cause of the dropped traffic.
What is causing the traffic to drop?
A network engineer is designing a hybrid networking environment that will connect a company's corporate network to the company's AWS environment. The AWS environment consists of 30 VPCs in 3 AWS Regions.
The network engineer needs to implement a solution to centrally filter traffic by using a firewall that the company's security team has approved. The solution must give all the VPCs the ability to connect to each other. Connectivity between AWS and the corporate network must meet a minimum bandwidth requirement of 2 Gbps.
Which solution will meet these requirements?
A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establish connectivity between an on-premises environment and the AWS environment. The company does not have a static public IP address for the on-premises environment.
Which combination of steps should the company take to establish VPN connectivity between the transit gateway and the on-premises environment? (Choose two.)
Create a private certificate in AWS Certificate Manager (ACM): This involves setting up a private Certificate Authority (CA) within AWS ACM, which will be used to issue certificates for authenticating your customer gateway device.
Create a customer gateway. Specify the current dynamic IP address of the customer gateway device's external interface: Even though on-premises environment doesn't have a static IP, you can still configure the customer gateway in AWS by specifying its current dynamic IP address. This setup allows AWS to recognize and authenticate your customer gateway device during the VPN connection establishment.
A customer has set up multiple VPCs for Dev, Test, Prod, and Management. You need to set up AWS Direct Connect to enable data flow from on-premises to each VPC. The customer has monitoring software running in the Management VPC that collects metrics from the instances in all the other VPCs. Due to budget requirements, data transfer charges should be kept at minimum.
Which design should be recommended?
- creating VPC peering is free of charge - traffic costs ~0.01/GB for VPC peering (IN + OUT) and ~0.02/GB for direct connect (OUT only). As the communication involved in monitoring will never have IN == OUT, then 0.01 * (IN + OUT) will always be lower the 0.02 * OUT, ergo VPC peering will be cheaper
