Amazon ANS-C01 dumps - 100% Pass Guarantee!

A company's network engineer needs to design a new solution to help troubleshoot and detect network anomalies. The network engineer hasconfigured Traffic Mirroring. However, the mirrored traffic is overwhelming the Amazon EC2 instance that is the traffic mirror target. The EC2instance hosts tools that the company's security team uses to analyze the traffic. The network engineer needs to design a highly availablesolution that can scale to meet the demand of the mirrored traffic.Which solution will meet these requirements?

A. Deploy a Network Load Balancer (NLB) as the traffic mirror target. Behind the NLB. deploy a fleet of EC2 instances in an Auto Scalinggroup. Use Traffic Mirroring as necessary.

B. Deploy an Application Load Balancer (ALB) as the traffic mirror target. Behind the ALB, deploy a fleet of EC2 instances in an AutoScaling group. Use Traffic Mirroring only during non-business hours.

C. Deploy a Gateway Load Balancer (GLB) as the traffic mirror target. Behind the GLB. deploy a fleet of EC2 instances in an Auto Scalinggroup. Use Traffic Mirroring as necessary.

D. Deploy an Application Load Balancer (ALB) with an HTTPS listener as the traffic mirror target. Behind the ALB. deploy a fleet of EC2instances in an Auto Scaling group. Use Traffic Mirroring only during active events or business hours.

A network engineer needs to standardize a company's approach to centralizing and managing interface VPC endpoints for privatecommunication with AWS services. The company uses AWS Transit Gateway for inter-VPC connectivity between AWS accounts through a hub-and-spoke model. The company's network services team must manage all Amazon Route 53 zones and interface endpoints within a sharedservices AWS account. The company wants to use this centralized model to provide AWS resources with access to AWS Key ManagementService (AWS KMS) without sending traffic over the public internet.What should the network engineer do to meet these requirements?

A. In the shared services account, create an interface endpoint for AWS KMS. Modify the interface endpoint by disabling the private DNSname. Create a private hosted zone in the shared services account with an alias record that points to the interface endpoint. Associatethe private hosted zone with the spoke VPCs in each AWS account.

B. In the shared services account, create an interface endpoint for AWS KMS. Modify the interface endpoint by disabling the private DNSname. Create a private hosted zone in each spoke AWS account with an alias record that points to the interface endpoint. Associate eachprivate hosted zone with the shared services AWS account.

C. In each spoke AWS account, create an interface endpoint for AWS KMS. Modify each interface endpoint by disabling the private DNSname. Create a private hosted zone in each spoke AWS account with an alias record that points to each interface endpoint. Associateeach private hosted zone with the shared services AWS account.

D. In each spoke AWS account, create an interface endpoint for AWS KMS. Modify each interface endpoint by disabling the private DNSname. Create a private hosted zone in the shared services account with an alias record that points to each interface endpoint. Associatethe private hosted zone with the spoke VPCs in each AWS account.

A company uses AWS Direct Connect to connect its corporate network to multiple VPCs in the same AWS account and the same AWS Region.Each VPC uses its own private VIF and its own virtual LAN on the Direct Connect connection. The company has grown and will soon surpassthe limit of VPCs and private VIFs for each connection.What is the MOST scalable way to add VPCs with on-premises connectivity?

A. Provision a new Direct Connect connection to handle the additional VPCs. Use the new connection to connect additional VPCs.

B. Create virtual private gateways for each VPC that is over the service quota. Use AWS Site-to-Site VPN to connect the virtual privategateways to the corporate network.

C. Create a Direct Connect gateway, and add virtual private gateway associations to the VPCs. Configure a private VIF to connect to thecorporate network.

D. Create a transit gateway, and attach the VPCs. Create a Direct Connect gateway, and associate it with the transit gateway. Create atransit VIF to the Direct Connect gateway.

A company's AWS architecture consists of several VPCs. The VPCs include a shared services VPC and several application VPCs. The companyhas established network connectivity from all VPCs to the on-premises DNS servers.Applications that are deployed in the application VPCs must be able to resolve DNS for internally hosted domains on premises. Theapplications also must be able to resolve local VPC domain names and domains that are hosted in Amazon Route 53 private hosted zones.What should a network engineer do to meet these requirements?

A. Create a new Route 53 Resolver inbound endpoint in the shared services VPC. Create forwarding rules for the on-premises hosteddomains. Associate the rules with the new Resolver endpoint and each application VPC. Update each application VPC's DHCPconfiguration to point DNS resolution to the new Resolver endpoint.

B. Create a new Route 53 Resolver outbound endpoint in the shared services VPC. Create forwarding rules for the on-premises hosteddomains. Associate the rules with the new Resolver endpoint and each application VPC.

C. Create a new Route 53 Resolver outbound endpoint in the shared services VPCreate forwarding rules for the on-premises hosteddomains. Associate the rules with the new Resolver endpoint and each application VPUpdate each application VPC's DHCP configurationto point DNS resolution to the new Resolver endpoint.

D. Create a new Route 53 Resolver inbound endpoint in the shared services VPC. Create forwarding rules for the on-premises hosteddomains. Associate the rules with the new Resolver endpoint and each application VPC.

A company is migrating critical applications to AWS. The company has multiple accounts and VPCs that are connected by a transit gateway.A network engineer must design a solution that performs deep packet inspection for any traffic that leaves a VPC network boundary. Allinspected traffic and the actions that are taken on the traffic must be logged in a central log account.Which solution will meet these requirements with the LEAST administrative overhead?

A. Create a central network VPC that includes an attachment to the transit gateway. Update the VPC and transit gateway route tables tosupport the new attachment. Deploy an AWS Gateway Load Balancer that is backed by third-party, next-generation firewall appliances tothe central network VPC. Create a policy that contains the rules for deep packet inspection. Attach the policy to the firewall appliances.Create an Amazon S3 bucket in the central log account. Configure the firewall appliances to capture and save the network flow logs to theS3 bucket.

B. Create a central network VPC that includes an attachment to the transit gateway. Update the VPC and transit gateway route tables tosupport the new attachment. Deploy an AWS Application Load Balancer that is backed by third-party, next-generation firewall appliancesto the central network VPC. Create a policy that contains the rules for deep packet inspection. Attach the policy to the firewall appliances.Create a syslog server in the central log account. Configure the firewall appliances to capture and save the network flow logs to the syslogserver.

C. Deploy network ACLs and security groups to each VPAttach the security groups to active network interfaces. Associate the networkACLs with VPC subnets. Create rules for the network ACLs and security groups to allow only the required traffic flows between subnets andnetwork interfaces. Create an Amazon S3 bucket in the central log account. Configure a VPC flow log that captures and saves all trafficflows to the S3 bucket.

D. Create a central log VPC and an attachment to the transit gateway. Update the VPC and transit gateway route tables to support the newattachment. Deploy an AWS Network Load Balancer (NLB) that is backed by third-party, next-generation intrusion detection system (IDS)security appliances to the central VPC. Activate rules on the security appliances to monitor for intrusion signatures. For each networkinterface, create a VPC Traffic Mirroring session that sends

the traffic to the central VPC's NLB.