Amazon AWS SAA-C03 VPC Segmentation, Security Groups, NACLs, Routing, and Secure Endpoints Practice Test 1

 

Topic 03 Practice Test 1 covers VPC Segmentation, Security Groups, NACLs, Routing, and Secure Endpoints for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

An internet-facing Application Load Balancer sends HTTPS to private EC2 targets. The targets must accept application traffic only when it came through that load balancer, even if its node addresses change. Which rule design is best?

  1. AWS-managed prefix list
  2. Network ACL
  3. Load-balancer security group reference
  4. Public subnet route to an internet gateway

Correct Answer(s)

 

C

Rationale

  1. AWS-managed prefix list applies managed CIDR set for supported AWS for ALB addresses can change. The requested action is allow target ingress by referencing the load balancer security group rather than fixed addresses. It differs from allow target ingress by referencing the load balancer security group rather than fixed addresses, so AWS-managed prefix list is unsuitable here.
  2. Network ACL handles stateless subnet boundary allow and deny for private EC2 targets. The requested action is allow target ingress by referencing the load balancer security group rather than fixed addresses. It differs from allow target ingress by referencing the load balancer security group rather than fixed addresses, so Network ACL is unsuitable here.
  3. Load-balancer security group reference creates source identity rule from ALB to for private EC2 targets. The requested action is allow target ingress by referencing the load balancer security group rather than fixed addresses. This matches allow target ingress by referencing the load balancer security group rather than fixed addresses, so Load-balancer security group reference fits the evidence.
  4. Public subnet route to an internet gateway implements internet routable subnet path through an for ALB addresses can change. The requested action is allow target ingress by referencing the load balancer security group rather than fixed addresses. It differs from allow target ingress by referencing the load balancer security group rather than fixed addresses, so Public subnet route to an internet gateway is unsuitable here.

 

Question 2

A database tier uses a security group that currently allows TCP 5432 from the entire VPC CIDR. Only instances in the application tier should initiate database sessions. Which change most directly reduces the trust scope?

  1. Security-group reference
  2. Network ACL
  3. Subnet route table
  4. VPC Flow Logs

Correct Answer(s)

 

A

Rationale

  1. Security-group reference gives identity based rule targeting another security for database should trust app tier identity. The requested action is replace broad CIDR access with a rule referencing the application security group. This matches replace broad CIDR access with a rule referencing the application security group, so Security-group reference fits the evidence.
  2. Network ACL provides stateless subnet boundary allow and deny for avoid broad VPC CIDR. The requested action is replace broad CIDR access with a rule referencing the application security group. It differs from replace broad CIDR access with a rule referencing the application security group, so Network ACL is unsuitable here.
  3. Subnet route table offers longest prefix forwarding policy associated with for database should trust app tier identity. The requested action is replace broad CIDR access with a rule referencing the application security group. It differs from replace broad CIDR access with a rule referencing the application security group, so Subnet route table is unsuitable here.
  4. VPC Flow Logs serves as metadata records for accepted and rejected for avoid broad VPC CIDR. The requested action is replace broad CIDR access with a rule referencing the application security group. It differs from replace broad CIDR access with a rule referencing the application security group, so VPC Flow Logs is unsuitable here.

 

Question 3

A subnet NACL allows inbound HTTPS from the internet but clients time out because response packets are dropped. Instance security groups already allow the sessions. What NACL change is required?

  1. Security group
  2. VPC Flow Logs
  3. Subnet route table
  4. Network ACL

Correct Answer(s)

 

D

Rationale

  1. Security group acts as stateful ENI level allow list firewall for responses are being dropped. The requested action is allow the required return-path ephemeral ports in the stateless network ACL. It differs from allow the required return-path ephemeral ports in the stateless network ACL, so Security group is unsuitable here.
  2. VPC Flow Logs creates metadata records for accepted and rejected for NACL is stateless. The requested action is allow the required return-path ephemeral ports in the stateless network ACL. It differs from allow the required return-path ephemeral ports in the stateless network ACL, so VPC Flow Logs is unsuitable here.
  3. Subnet route table applies longest prefix forwarding policy associated with for responses are being dropped. The requested action is allow the required return-path ephemeral ports in the stateless network ACL. It differs from allow the required return-path ephemeral ports in the stateless network ACL, so Subnet route table is unsuitable here.
  4. Network ACL delivers stateless subnet boundary allow and deny for NACL is stateless. The requested action is allow the required return-path ephemeral ports in the stateless network ACL. This matches allow the required return-path ephemeral ports in the stateless network ACL, so Network ACL fits the evidence.

 

Question 4

A security team must block one known hostile IPv4 range at the subnet boundary while preserving existing security-group rules. Which control can explicitly deny that source CIDR?

  1. Security group
  2. Network ACL
  3. VPC Flow Logs
  4. AWS-managed prefix list

Correct Answer(s)

 

B

Rationale

  1. Security group enables stateful ENI level allow list firewall for subnet boundary. The requested action is use a network ACL deny rule at the subnet boundary. It differs from use a network ACL deny rule at the subnet boundary, so Security group is unsuitable here.
  2. Network ACL functions as stateless subnet boundary allow and deny for explicit deny required. The requested action is use a network ACL deny rule at the subnet boundary. This matches use a network ACL deny rule at the subnet boundary, so Network ACL fits the evidence.
  3. VPC Flow Logs gives metadata records for accepted and rejected for explicit deny required. The requested action is use a network ACL deny rule at the subnet boundary. It differs from use a network ACL deny rule at the subnet boundary, so VPC Flow Logs is unsuitable here.
  4. AWS-managed prefix list provides managed CIDR set for supported AWS for subnet boundary. The requested action is use a network ACL deny rule at the subnet boundary. It differs from use a network ACL deny rule at the subnet boundary, so AWS-managed prefix list is unsuitable here.

 

Question 5

Private application instances need to download operating-system updates from public repositories. They must not receive unsolicited inbound IPv4 connections from the internet. Which routing pattern fits?

  1. Private subnet route to a NAT gateway
  2. Public subnet route to an internet gateway
  3. Internet gateway
  4. Egress-only internet gateway

Correct Answer(s)

 

A

Rationale

  1. Private subnet route to a NAT gateway supports outbound IPv4 internet path without inbound for outbound internet required. The requested action is send private-subnet IPv4 egress through a NAT gateway. This matches send private-subnet IPv4 egress through a NAT gateway, so Private subnet route to a NAT gateway fits the evidence.
  2. Public subnet route to an internet gateway controls internet routable subnet path through an for no direct inbound IPv4. The requested action is send private-subnet IPv4 egress through a NAT gateway. It differs from send private-subnet IPv4 egress through a NAT gateway, so Public subnet route to an internet gateway is unsuitable here.
  3. Internet gateway delivers VPC edge target for public internet for outbound internet required. The requested action is send private-subnet IPv4 egress through a NAT gateway. It differs from send private-subnet IPv4 egress through a NAT gateway, so Internet gateway is unsuitable here.
  4. Egress-only internet gateway acts as outbound only IPv6 path for VPC for no direct inbound IPv4. The requested action is send private-subnet IPv4 egress through a NAT gateway. It differs from send private-subnet IPv4 egress through a NAT gateway, so Egress-only internet gateway is unsuitable here.

 

Question 6

A web server has a public IPv4 address, but its subnet route table has no default route to an internet gateway. Which change is necessary for direct internet reachability?

  1. Private subnet route to a NAT gateway
  2. S3 gateway VPC endpoint
  3. Public subnet route to an internet gateway
  4. AWS Transit Gateway

Correct Answer(s)

 

C

Rationale

  1. Private subnet route to a NAT gateway supplies outbound IPv4 internet path without inbound for direct internet reachability. The requested action is add an internet-gateway default route to the public subnet. It differs from add an internet-gateway default route to the public subnet, so Private subnet route to a NAT gateway is unsuitable here.
  2. S3 gateway VPC endpoint functions as route table private path to Amazon for instance already has public IPv4. The requested action is add an internet-gateway default route to the public subnet. It differs from add an internet-gateway default route to the public subnet, so S3 gateway VPC endpoint is unsuitable here.
  3. Public subnet route to an internet gateway implements internet routable subnet path through an for instance already has public IPv4. The requested action is add an internet-gateway default route to the public subnet. This matches add an internet-gateway default route to the public subnet, so Public subnet route to an internet gateway fits the evidence.
  4. AWS Transit Gateway enables regional hub for many routed network for direct internet reachability. The requested action is add an internet-gateway default route to the public subnet. It differs from add an internet-gateway default route to the public subnet, so AWS Transit Gateway is unsuitable here.

 

Question 7

IPv6-enabled private instances must initiate outbound internet connections but must not be reachable through unsolicited internet-initiated IPv6 sessions. Which VPC component should be used?

  1. NAT gateway
  2. Egress-only internet gateway
  3. Internet gateway
  4. Interface VPC endpoint

Correct Answer(s)

 

B

Rationale

  1. NAT gateway establishes managed IPv4 source translation for private for outbound-only internet. The requested action is block unsolicited IPv6 initiation while preserving client-initiated internet access through an egress-only internet gateway. It differs from block unsolicited IPv6 initiation while preserving client-initiated internet access through an egress-only internet gateway, so NAT gateway is unsuitable here.
  2. Egress-only internet gateway serves as outbound only IPv6 path for VPC for IPv6 workload. The requested action is block unsolicited IPv6 initiation while preserving client-initiated internet access through an egress-only internet gateway. This matches block unsolicited IPv6 initiation while preserving client-initiated internet access through an egress-only internet gateway, so Egress-only internet gateway fits the evidence.
  3. Internet gateway supports VPC edge target for public internet for IPv6 workload. The requested action is block unsolicited IPv6 initiation while preserving client-initiated internet access through an egress-only internet gateway. It differs from block unsolicited IPv6 initiation while preserving client-initiated internet access through an egress-only internet gateway, so Internet gateway is unsuitable here.
  4. Interface VPC endpoint controls PrivateLink ENIs for private service access for outbound-only internet. The requested action is block unsolicited IPv6 initiation while preserving client-initiated internet access through an egress-only internet gateway. It differs from block unsolicited IPv6 initiation while preserving client-initiated internet access through an egress-only internet gateway, so Interface VPC endpoint is unsuitable here.

 

Question 8

Instances in isolated subnets access Amazon S3 heavily. The architecture must remove NAT dependency for that traffic and avoid hourly interface-endpoint charges. Which endpoint type should be chosen?

  1. Interface VPC endpoint
  2. NAT gateway
  3. AWS PrivateLink endpoint service
  4. S3 gateway VPC endpoint

Correct Answer(s)

 

D

Rationale

  1. Interface VPC endpoint handles PrivateLink ENIs for private service access for no NAT. The requested action is use the S3 gateway endpoint and route-table integration. It differs from use the S3 gateway endpoint and route-table integration, so Interface VPC endpoint is unsuitable here.
  2. NAT gateway implements managed IPv4 source translation for private for avoid interface-endpoint hourly charges. The requested action is use the S3 gateway endpoint and route-table integration. It differs from use the S3 gateway endpoint and route-table integration, so NAT gateway is unsuitable here.
  3. AWS PrivateLink endpoint service supplies one way private service exposure across for S3 traffic. The requested action is use the S3 gateway endpoint and route-table integration. It differs from use the S3 gateway endpoint and route-table integration, so AWS PrivateLink endpoint service is unsuitable here.
  4. S3 gateway VPC endpoint applies route table private path to Amazon for S3 traffic. The requested action is use the S3 gateway endpoint and route-table integration. This matches use the S3 gateway endpoint and route-table integration, so S3 gateway VPC endpoint fits the evidence.

 

Question 9

An isolated VPC must call AWS Secrets Manager using private IP connectivity and the normal regional service hostname. Which design is appropriate? Choose TWO. (Choose 2.)

  1. S3 gateway VPC endpoint
  2. Private DNS on an interface endpoint
  3. Internet gateway
  4. Interface VPC endpoint

Correct Answer(s)

 

B, D

Rationale

  1. S3 gateway VPC endpoint serves as route table private path to Amazon for standard service DNS. The requested action is create an interface endpoint and enable private DNS for the service. It differs from create an interface endpoint and enable private DNS for the service, so S3 gateway VPC endpoint is unsuitable here.
  2. Private DNS on an interface endpoint offers service hostname resolution to endpoint private for private IP path. The requested action is create an interface endpoint and enable private DNS for the service. This matches create an interface endpoint and enable private DNS for the service, so Private DNS on an interface endpoint fits the evidence.
  3. Internet gateway establishes VPC edge target for public internet for Secrets Manager API. The requested action is create an interface endpoint and enable private DNS for the service. It differs from create an interface endpoint and enable private DNS for the service, so Internet gateway is unsuitable here.
  4. Interface VPC endpoint provides PrivateLink ENIs for private service access for Secrets Manager API. The requested action is create an interface endpoint and enable private DNS for the service. This matches create an interface endpoint and enable private DNS for the service, so Interface VPC endpoint fits the evidence.

 

Question 10

Developers can reach an interface endpoint, but the endpoint should allow only a designated IAM role to call a limited set of supported service actions. Which additional control addresses that requirement?

  1. Endpoint ENI security group
  2. VPC endpoint policy
  3. Network ACL
  4. VPC Flow Logs

Correct Answer(s)

 

B

Rationale

  1. Endpoint ENI security group creates traffic filter attached to interface endpoint for action-level endpoint guardrail. The requested action is restrict principals and actions with the VPC endpoint policy. It differs from restrict principals and actions with the VPC endpoint policy, so Endpoint ENI security group is unsuitable here.
  2. VPC endpoint policy acts as principal and action guardrail on endpoint for IAM principal restriction. The requested action is restrict principals and actions with the VPC endpoint policy. This matches restrict principals and actions with the VPC endpoint policy, so VPC endpoint policy fits the evidence.
  3. Network ACL applies stateless subnet boundary allow and deny for IAM principal restriction. The requested action is restrict principals and actions with the VPC endpoint policy. It differs from restrict principals and actions with the VPC endpoint policy, so Network ACL is unsuitable here.
  4. VPC Flow Logs handles metadata records for accepted and rejected for action-level endpoint guardrail. The requested action is restrict principals and actions with the VPC endpoint policy. It differs from restrict principals and actions with the VPC endpoint policy, so VPC Flow Logs is unsuitable here.

 

Question 11

A SaaS provider must expose one service privately to customer VPCs whose CIDR ranges sometimes overlap the provider VPC. Customers should not receive general routed access to the provider network. Which architecture fits?

  1. AWS PrivateLink endpoint service
  2. VPC peering
  3. AWS Transit Gateway
  4. Secondary VPC CIDR block

Correct Answer(s)

 

A

Rationale

  1. AWS PrivateLink endpoint service enables one way private service exposure across for overlapping CIDRs possible. The requested action is publish the service through AWS PrivateLink rather than full network routing. This matches publish the service through AWS PrivateLink rather than full network routing, so AWS PrivateLink endpoint service fits the evidence.
  2. VPC peering gives direct nontransitive private routing between two for service-only connectivity. The requested action is publish the service through AWS PrivateLink rather than full network routing. It differs from publish the service through AWS PrivateLink rather than full network routing, so VPC peering is unsuitable here.
  3. AWS Transit Gateway provides regional hub for many routed network for overlapping CIDRs possible. The requested action is publish the service through AWS PrivateLink rather than full network routing. It differs from publish the service through AWS PrivateLink rather than full network routing, so AWS Transit Gateway is unsuitable here.
  4. Secondary VPC CIDR block offers additional address space attached to one for service-only connectivity. The requested action is publish the service through AWS PrivateLink rather than full network routing. It differs from publish the service through AWS PrivateLink rather than full network routing, so Secondary VPC CIDR block is unsuitable here.

 

Question 12

Two VPCs need simple private bidirectional connectivity, their CIDR blocks do not overlap, and no third VPC must transit through the connection. Which option is the smallest fit?

  1. AWS Transit Gateway
  2. AWS PrivateLink endpoint service
  3. VPC peering
  4. Internet gateway

Correct Answer(s)

 

C

Rationale

  1. AWS Transit Gateway delivers regional hub for many routed network for no transitive routing. The requested action is use direct VPC peering for two nonoverlapping VPCs. It differs from use direct VPC peering for two nonoverlapping VPCs, so AWS Transit Gateway is unsuitable here.
  2. AWS PrivateLink endpoint service acts as one way private service exposure across for two VPCs only. The requested action is use direct VPC peering for two nonoverlapping VPCs. It differs from use direct VPC peering for two nonoverlapping VPCs, so AWS PrivateLink endpoint service is unsuitable here.
  3. VPC peering controls direct nontransitive private routing between two for two VPCs only. The requested action is use direct VPC peering for two nonoverlapping VPCs. This matches use direct VPC peering for two nonoverlapping VPCs, so VPC peering fits the evidence.
  4. Internet gateway creates VPC edge target for public internet for no transitive routing. The requested action is use direct VPC peering for two nonoverlapping VPCs. It differs from use direct VPC peering for two nonoverlapping VPCs, so Internet gateway is unsuitable here.

 

Question 13

Dozens of VPCs and two on-premises networks need centrally managed, transitive routing with segmented route tables. Which AWS networking service is the appropriate hub?

  1. VPC peering
  2. AWS Transit Gateway
  3. AWS PrivateLink endpoint service
  4. Subnet route table

Correct Answer(s)

 

B

Rationale

  1. VPC peering functions as direct nontransitive private routing between two for hybrid attachments. The requested action is use Transit Gateway as the transitive routing hub. It differs from use Transit Gateway as the transitive routing hub, so VPC peering is unsuitable here.
  2. AWS Transit Gateway supplies regional hub for many routed network for many VPCs. The requested action is use Transit Gateway as the transitive routing hub. This matches use Transit Gateway as the transitive routing hub, so AWS Transit Gateway fits the evidence.
  3. AWS PrivateLink endpoint service enables one way private service exposure across for central segmentation. The requested action is use Transit Gateway as the transitive routing hub. It differs from use Transit Gateway as the transitive routing hub, so AWS PrivateLink endpoint service is unsuitable here.
  4. Subnet route table gives longest prefix forwarding policy associated with for many VPCs. The requested action is use Transit Gateway as the transitive routing hub. It differs from use Transit Gateway as the transitive routing hub, so Subnet route table is unsuitable here.

 

Question 14

An incident team needs records showing source and destination addresses, ports, protocol, and whether VPC traffic was accepted or rejected. Packet payloads are not required. What should be enabled?

  1. VPC Traffic Mirroring
  2. AWS Network Firewall
  3. Security group
  4. VPC Flow Logs

Correct Answer(s)

 

D

Rationale

  1. VPC Traffic Mirroring supports packet copies sent to analysis appliances for payload not required. The requested action is enable VPC Flow Logs for connection metadata. It differs from enable VPC Flow Logs for connection metadata, so VPC Traffic Mirroring is unsuitable here.
  2. AWS Network Firewall controls managed stateful inspection for VPC traffic for flow metadata required. The requested action is enable VPC Flow Logs for connection metadata. It differs from enable VPC Flow Logs for connection metadata, so AWS Network Firewall is unsuitable here.
  3. Security group delivers stateful ENI level allow list firewall for payload not required. The requested action is enable VPC Flow Logs for connection metadata. It differs from enable VPC Flow Logs for connection metadata, so Security group is unsuitable here.
  4. VPC Flow Logs establishes metadata records for accepted and rejected for flow metadata required. The requested action is enable VPC Flow Logs for connection metadata. This matches enable VPC Flow Logs for connection metadata, so VPC Flow Logs fits the evidence.

 

Question 15

A security appliance must inspect copies of selected packets from production ENIs without becoming the inline forwarding path. Which VPC feature provides that feed?

  1. VPC Flow Logs
  2. AWS Network Firewall
  3. VPC Traffic Mirroring
  4. Network ACL

Correct Answer(s)

 

C

Rationale

  1. VPC Flow Logs implements metadata records for accepted and rejected for out-of-band analysis. The requested action is use Traffic Mirroring to send packet copies to an analyzer. It differs from use Traffic Mirroring to send packet copies to an analyzer, so VPC Flow Logs is unsuitable here.
  2. AWS Network Firewall supplies managed stateful inspection for VPC traffic for full packet copies. The requested action is use Traffic Mirroring to send packet copies to an analyzer. It differs from use Traffic Mirroring to send packet copies to an analyzer, so AWS Network Firewall is unsuitable here.
  3. VPC Traffic Mirroring handles packet copies sent to analysis appliances for full packet copies. The requested action is use Traffic Mirroring to send packet copies to an analyzer. This matches use Traffic Mirroring to send packet copies to an analyzer, so VPC Traffic Mirroring fits the evidence.
  4. Network ACL functions as stateless subnet boundary allow and deny for out-of-band analysis. The requested action is use Traffic Mirroring to send packet copies to an analyzer. It differs from use Traffic Mirroring to send packet copies to an analyzer, so Network ACL is unsuitable here.

 

Question 16

A compliance design requires managed stateful inspection and centrally defined filtering of traffic crossing selected VPC network paths. Which service is intended for this inline control?

  1. AWS Network Firewall
  2. VPC Flow Logs
  3. VPC Traffic Mirroring
  4. Security group

Correct Answer(s)

 

A

Rationale

  1. AWS Network Firewall offers managed stateful inspection for VPC traffic for stateful managed inspection. The requested action is route the traffic through AWS Network Firewall. This matches route the traffic through AWS Network Firewall, so AWS Network Firewall fits the evidence.
  2. VPC Flow Logs serves as metadata records for accepted and rejected for inline enforcement. The requested action is route the traffic through AWS Network Firewall. It differs from route the traffic through AWS Network Firewall, so VPC Flow Logs is unsuitable here.
  3. VPC Traffic Mirroring establishes packet copies sent to analysis appliances for stateful managed inspection. The requested action is route the traffic through AWS Network Firewall. It differs from route the traffic through AWS Network Firewall, so VPC Traffic Mirroring is unsuitable here.
  4. Security group supports stateful ENI level allow list firewall for inline enforcement. The requested action is route the traffic through AWS Network Firewall. It differs from route the traffic through AWS Network Firewall, so Security group is unsuitable here.

 

Question 17

A route table contains a more-specific route to a deleted network interface and traffic to that prefix is blackholed, even though a broader valid route exists. What is the direct remediation?

  1. Secondary VPC CIDR block
  2. AWS-managed prefix list
  3. Blackhole route removal
  4. VPC Flow Logs

Correct Answer(s)

 

C

Rationale

  1. Secondary VPC CIDR block applies additional address space attached to one for longest-prefix match selects stale route. The requested action is remove or replace the stale more-specific blackhole route. It differs from remove or replace the stale more-specific blackhole route, so Secondary VPC CIDR block is unsuitable here.
  2. AWS-managed prefix list handles managed CIDR set for supported AWS for deleted route target. The requested action is remove or replace the stale more-specific blackhole route. It differs from remove or replace the stale more-specific blackhole route, so AWS-managed prefix list is unsuitable here.
  3. Blackhole route removal creates restore forwarding by deleting invalid route for deleted route target. The requested action is remove or replace the stale more-specific blackhole route. This matches remove or replace the stale more-specific blackhole route, so Blackhole route removal fits the evidence.
  4. VPC Flow Logs implements metadata records for accepted and rejected for longest-prefix match selects stale route. The requested action is remove or replace the stale more-specific blackhole route. It differs from remove or replace the stale more-specific blackhole route, so VPC Flow Logs is unsuitable here.

 

Question 18

A VPC is running out of private addresses, and workloads must stay in the same VPC. The organization can allocate another nonoverlapping RFC1918 range. Which VPC change expands address space?

  1. Secondary VPC CIDR block
  2. VPC peering
  3. AWS Transit Gateway
  4. Separate private application subnet

Correct Answer(s)

 

A

Rationale

  1. Secondary VPC CIDR block gives additional address space attached to one for same VPC must remain. The requested action is associate a secondary IPv4 CIDR block with the VPC. This matches associate a secondary IPv4 CIDR block with the VPC, so Secondary VPC CIDR block fits the evidence.
  2. VPC peering provides direct nontransitive private routing between two for additional nonoverlapping range available. The requested action is associate a secondary IPv4 CIDR block with the VPC. It differs from associate a secondary IPv4 CIDR block with the VPC, so VPC peering is unsuitable here.
  3. AWS Transit Gateway offers regional hub for many routed network for same VPC must remain. The requested action is associate a secondary IPv4 CIDR block with the VPC. It differs from associate a secondary IPv4 CIDR block with the VPC, so AWS Transit Gateway is unsuitable here.
  4. Separate private application subnet serves as network boundary without direct IGW routing for additional nonoverlapping range available. The requested action is associate a secondary IPv4 CIDR block with the VPC. It differs from associate a secondary IPv4 CIDR block with the VPC, so Separate private application subnet is unsuitable here.

 

Question 19

Security rules repeatedly need the published address ranges for an AWS service. The team wants AWS to maintain the service CIDRs rather than copying numeric ranges into every rule. What should it reference where supported?

  1. VPC Flow Logs
  2. AWS-managed prefix list
  3. Secondary VPC CIDR block
  4. Security-group reference

Correct Answer(s)

 

B

Rationale

  1. VPC Flow Logs acts as metadata records for accepted and rejected for avoid manual updates. The requested action is use an AWS-managed prefix list for the service ranges. It differs from use an AWS-managed prefix list for the service ranges, so VPC Flow Logs is unsuitable here.
  2. AWS-managed prefix list delivers managed CIDR set for supported AWS for AWS service CIDRs. The requested action is use an AWS-managed prefix list for the service ranges. This matches use an AWS-managed prefix list for the service ranges, so AWS-managed prefix list fits the evidence.
  3. Secondary VPC CIDR block creates additional address space attached to one for AWS service CIDRs. The requested action is use an AWS-managed prefix list for the service ranges. It differs from use an AWS-managed prefix list for the service ranges, so Secondary VPC CIDR block is unsuitable here.
  4. Security-group reference applies identity based rule targeting another security for avoid manual updates. The requested action is use an AWS-managed prefix list for the service ranges. It differs from use an AWS-managed prefix list for the service ranges, so Security-group reference is unsuitable here.

 

Question 20

An interface VPC endpoint exists, but clients receive connection resets because the endpoint network interfaces do not permit HTTPS from the application subnets. Which control must be corrected?

  1. VPC endpoint policy
  2. Network ACL
  3. Private DNS on an interface endpoint
  4. Endpoint ENI security group

Correct Answer(s)

 

D

Rationale

  1. VPC endpoint policy enables principal and action guardrail on endpoint for application subnets are source. The requested action is allow the application traffic in the endpoint ENI security group. It differs from allow the application traffic in the endpoint ENI security group, so VPC endpoint policy is unsuitable here.
  2. Network ACL gives stateless subnet boundary allow and deny for endpoint ENIs reject HTTPS. The requested action is allow the application traffic in the endpoint ENI security group. It differs from allow the application traffic in the endpoint ENI security group, so Network ACL is unsuitable here.
  3. Private DNS on an interface endpoint provides service hostname resolution to endpoint private for application subnets are source. The requested action is allow the application traffic in the endpoint ENI security group. It differs from allow the application traffic in the endpoint ENI security group, so Private DNS on an interface endpoint is unsuitable here.
  4. Endpoint ENI security group functions as traffic filter attached to interface endpoint for endpoint ENIs reject HTTPS. The requested action is allow the application traffic in the endpoint ENI security group. This matches allow the application traffic in the endpoint ENI security group, so Endpoint ENI security group fits the evidence.

Related posts:

  1. Amazon AWS AIP-C01 FM Deployment and Endpoints Practice Test 2
  2. Amazon AWS SAA-C03 IAM, Federation, Identity Center, and Least-Privilege Access Practice Test 1
  3. Cisco CCNA 200-301 Automation, Controllers, and SDN Architecture Practice Test 3
  4. Cisco CCNA 200-301 Discovery, EtherChannel, and Rapid PVST+ Practice Test 1
  5. Cisco CCNA 200-301 IPv4 Addressing, Subnetting, and Private Addressing Practice Test 2
  6. Cisco CCNA 200-301 Security Concepts, Programs, and Device Passwords Practice Test 1
  7. Cisco CCNP 350-401 ENCOR 802.1Q Trunking and EtherChannel Troubleshooting Practice Test 3
  8. CompTIA Security+ SY0-701 Cryptography and PKI Practice Test 3
  9. CompTIA Security+ SY0-701 Enterprise Security Capabilities Practice Test 1
  10. Microsoft Azure Administrator AZ-104 Azure Storage Access Practice Test 1

Leave a Reply

Categories

Recent Posts

Recent Comments

    How It Works

    img
    Step 1. Choose Exam
    on ExamLabs
    Download IT Exams Questions & Answers
    img
    Step 2. Open Exam with
    Avanset Exam Simulator
    Press here to download VCE Exam Simulator that simulates real exam environment
    img
    Step 3. Study
    & Pass
    IT Exams Anywhere, Anytime!

    Close