Networking Specialty ANS-C01 Practice Questions & Answers • ExamPrepare

75 questions in this view

Page 1 of 13

Question 1

Did any of the following have a negative impact on your overall testing experience? (Select up to THREE.)

Question length is too long
Question length is too short
Length of answer choices is too long
Length of answer choices is too short
Answer choices are too similar
Something else not listed above
None of the above apply to my experience

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A company has VPCs in the us-east-1 Region that are connected to each other through a transit gateway. A network engineer needs to establish an AWS Direct Connect connection between the company's on-premises data center and the transit gateway for the migration of a workload.

The Direct Connect connection is UP according to the ConnectionState metric in Amazon CloudWatch. However, the VIF is DOWN. The network engineer has verified the transit VIF and BGP configurations on the on-premises router and has found no issues. However, the network engineer is unable to ping the Amazon peer IP address.

Which combination of steps should the network engineer take to troubleshoot this issue? (Select THREE.)

Verify that the correct IP address and subnet mask are in use for the subinterface on the router.
Ensure that VLAN trunking is disabled on the router.
Verify that the router has a MAC address entry from the AWS endpoint in the Address Resolution Protocol (ARP) table.
Verify that the optical signal that is received over the cross connect is optimal.
Ensure that the correct VLAN tag is applied on the subinterface configuration on the router.
Ensure that TCP port 179 is not being blocked at the on-premises router.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

A company's network engineer is configuring an AWS Site-to-Site VPN connection between a transit gateway and the company's on-premises network. The Site-to-Site VPN connection is configured to use BGP over two tunnels in active/active mode with equal-cost multi-path (ECMP) routing activated on the transit gateway.

When the network engineer attempts to send traffic from the on-premises network to an Amazon EC2 instance, traffic is sent over the first tunnel. However, return traffic is received over the second tunnel and is dropped at the customer gateway. The network engineer must resolve this issue without reducing the overall VPN bandwidth.

Which solution will meet these requirements?

Configure the customer gateway to use AS PATH prepending and local preference to prefer one tunnel over the other.
Configure the Site-to-Site VPN options to set the first tunnel as the primary tunnel to eliminate asymmetric routing.
Configure the virtual tunnel interfaces on the customer gateway to allow asymmetric routing.
Configure the Site-to-Site VPN to use static routing in active/active mode to ensure that traffic flows over a preferred path.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

A company has business operations in the United States and in Europe. The company's public applications are running on AWS and use three transit gateways. The transit gateways are located in the us-west-2, us-east-1, and eu-central-1 Regions. All the transit gateways are connected to each other in a full mesh configuration.

The company accidentally removes the route to the eu-central-1 VPCs from the us-west-2 transit gateway route table. The company also accidentally removes the route to the us-west-2 VPCs from the eu-central-1 transit gateway route table.

How can a network engineer identify the misconfiguration with the LEAST operational overhead?

Use the Route Analyzer feature for AWS Transit Gateway Network Manager.
Use the AWSSupport-SetupIPMonitoringFromVPC AWS Systems Manager Automation runbook. Push network telemetry data to Amazon CloudWatch Logs for analysis.
Use VPC flow logs in eu-central-1 and us-west-2 to analyze the missing routes.
Use Amazon VPC Traffic Mirroring in eu-central-1 or us-west-2 to take packet captures and troubleshoot the connectivity issues.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A company establishes an AWS Site-to-Site VPN connection between an on-premises data center and the company's VPC. Users report a loss of connectivity after the company moves a VPN device behind a new firewall. A network engineer investigates the connectivity issue and confirms that the AWS Region that the Site-to-Site VPN connection connects to is reachable through the internet.

What is the likely cause of this connectivity issue?

Dead Peer Detection (DPD) timeout expired after the company moved the VPN device.
The new firewall is blocking UDP port 4500.
The network engineer needs to include the new firewall IP address in the security group.
The network engineer needs to update a tunnel initiation option.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

A company is running a hybrid cloud environment. The company has multiple AWS accounts as part of an organization in AWS Organizations. The company needs a solution to manage a list of IPv4 on-premises hosts that will be allowed to access resources in AWS. The solution must provide version control for the list of IPv4 addresses and must make the list available to the AWS accounts in the organization.

Which solution will meet these requirements?

Create a customer-managed prefix list. Add entries for the initial list of on-premises IPv4 hosts. Create a resource share in AWS Resource Access Manager. Add the managed prefix list to the resource share. Share the resource with the organization.
Create a customer-managed prefix list. Add entries for the initial list of on-premises IPv4 hosts. Use AWS Firewall Manager to share the managed prefix list with the organization.
Create a security group. Add inbound rule entries for the initial list of on-premises IPv4 hosts. Create a resource share in AWS Resource Access Manager. Add the security group to the resource share. Share the resource with the organization.
Create an Amazon DynamoDB table. Add entries for the initial list of on-premises IPv4 hosts. Create an AWS Lambda function that assumes a role in each AWS account in the organization to authorize inbound rules on security groups based on entries from the DynamoDB table.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.