Amazon AWS SAA-C03 VPC Segmentation, Security Groups, NACLs, Routing, and Secure Endpoints Practice Test 2

 

Topic 03 Practice Test 2 covers VPC Segmentation, Security Groups, NACLs, Routing, and Secure Endpoints for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A private subnet should have no direct internet route, yet an audit finds 0.0.0.0/0 pointing to an internet gateway. Instances have public addresses disabled. Which route-table change restores the intended isolation?

  1. Public subnet route to an internet gateway
  2. Private subnet route to a NAT gateway
  3. Internet gateway
  4. AWS Transit Gateway

Correct Answer(s)

 

B

Rationale

  1. Public subnet route to an internet gateway controls internet routable subnet path through an for direct IGW route is unintended. The requested action is replace the direct internet-gateway path with controlled NAT egress where internet access is needed. It differs from replace the direct internet-gateway path with controlled NAT egress where internet access is needed, so Public subnet route to an internet gateway is unsuitable here.
  2. Private subnet route to a NAT gateway supports outbound IPv4 internet path without inbound for private subnet policy. The requested action is replace the direct internet-gateway path with controlled NAT egress where internet access is needed. This matches replace the direct internet-gateway path with controlled NAT egress where internet access is needed, so Private subnet route to a NAT gateway fits the evidence.
  3. Internet gateway delivers VPC edge target for public internet for private subnet policy. The requested action is replace the direct internet-gateway path with controlled NAT egress where internet access is needed. It differs from replace the direct internet-gateway path with controlled NAT egress where internet access is needed, so Internet gateway is unsuitable here.
  4. AWS Transit Gateway acts as regional hub for many routed network for direct IGW route is unintended. The requested action is replace the direct internet-gateway path with controlled NAT egress where internet access is needed. It differs from replace the direct internet-gateway path with controlled NAT egress where internet access is needed, so AWS Transit Gateway is unsuitable here.

 

Question 2

A public bastion has a public IPv4 address and an internet-gateway route, but inbound SSH still fails. The subnet NACL permits the flow. Which remaining VPC control should be checked first?

  1. Subnet route table
  2. VPC Flow Logs
  3. S3 gateway VPC endpoint
  4. Security group

Correct Answer(s)

 

D

Rationale

  1. Subnet route table supplies longest prefix forwarding policy associated with for NACL permits traffic. The requested action is verify the bastion security group permits the intended SSH source. It differs from verify the bastion security group permits the intended SSH source, so Subnet route table is unsuitable here.
  2. VPC Flow Logs functions as metadata records for accepted and rejected for public addressing and routing already work. The requested action is verify the bastion security group permits the intended SSH source. It differs from verify the bastion security group permits the intended SSH source, so VPC Flow Logs is unsuitable here.
  3. S3 gateway VPC endpoint enables route table private path to Amazon for NACL permits traffic. The requested action is verify the bastion security group permits the intended SSH source. It differs from verify the bastion security group permits the intended SSH source, so S3 gateway VPC endpoint is unsuitable here.
  4. Security group implements stateful ENI level allow list firewall for public addressing and routing already work. The requested action is verify the bastion security group permits the intended SSH source. This matches verify the bastion security group permits the intended SSH source, so Security group fits the evidence.

 

Question 3

An NACL permits outbound HTTPS to 0.0.0.0/0 but denies the return traffic for client-initiated sessions. Which property explains why a separate inbound allowance is needed?

  1. Network ACL
  2. Security group
  3. NAT gateway
  4. Internet gateway

Correct Answer(s)

 

A

Rationale

  1. Network ACL serves as stateless subnet boundary allow and deny for client-initiated sessions. The requested action is recognize that NACLs are stateless and evaluate each direction independently. This matches recognize that NACLs are stateless and evaluate each direction independently, so Network ACL fits the evidence.
  2. Security group establishes stateful ENI level allow list firewall for return direction denied. The requested action is recognize that NACLs are stateless and evaluate each direction independently. It differs from recognize that NACLs are stateless and evaluate each direction independently, so Security group is unsuitable here.
  3. NAT gateway supports managed IPv4 source translation for private for client-initiated sessions. The requested action is recognize that NACLs are stateless and evaluate each direction independently. It differs from recognize that NACLs are stateless and evaluate each direction independently, so NAT gateway is unsuitable here.
  4. Internet gateway controls VPC edge target for public internet for return direction denied. The requested action is recognize that NACLs are stateless and evaluate each direction independently. It differs from recognize that NACLs are stateless and evaluate each direction independently, so Internet gateway is unsuitable here.

 

Question 4

A security group allows an outbound TCP connection to a vendor endpoint. No explicit inbound rule exists for the response packets, yet the session succeeds. Which security-group behavior accounts for this?

  1. Network ACL
  2. Subnet route table
  3. Security group
  4. VPC Flow Logs

Correct Answer(s)

 

C

Rationale

  1. Network ACL handles stateless subnet boundary allow and deny for response traffic is related. The requested action is rely on stateful security-group connection tracking for return traffic. It differs from rely on stateful security-group connection tracking for return traffic, so Network ACL is unsuitable here.
  2. Subnet route table implements longest prefix forwarding policy associated with for outbound session is allowed. The requested action is rely on stateful security-group connection tracking for return traffic. It differs from rely on stateful security-group connection tracking for return traffic, so Subnet route table is unsuitable here.
  3. Security group applies stateful ENI level allow list firewall for outbound session is allowed. The requested action is rely on stateful security-group connection tracking for return traffic. This matches rely on stateful security-group connection tracking for return traffic, so Security group fits the evidence.
  4. VPC Flow Logs supplies metadata records for accepted and rejected for response traffic is related. The requested action is rely on stateful security-group connection tracking for return traffic. It differs from rely on stateful security-group connection tracking for return traffic, so VPC Flow Logs is unsuitable here.

 

Question 5

Private instances need DynamoDB access without NAT or internet gateways. The team wants a route-table endpoint with no endpoint ENIs. Which component is designed for this?

  1. Interface VPC endpoint
  2. AWS PrivateLink endpoint service
  3. DynamoDB gateway VPC endpoint
  4. NAT gateway

Correct Answer(s)

 

C

Rationale

  1. Interface VPC endpoint offers PrivateLink ENIs for private service access for route-table model. The requested action is use a DynamoDB gateway VPC endpoint. It differs from use a DynamoDB gateway VPC endpoint, so Interface VPC endpoint is unsuitable here.
  2. AWS PrivateLink endpoint service serves as one way private service exposure across for no ENIs. The requested action is use a DynamoDB gateway VPC endpoint. It differs from use a DynamoDB gateway VPC endpoint, so AWS PrivateLink endpoint service is unsuitable here.
  3. DynamoDB gateway VPC endpoint provides route table private path to DynamoDB for DynamoDB access. The requested action is use a DynamoDB gateway VPC endpoint. This matches use a DynamoDB gateway VPC endpoint, so DynamoDB gateway VPC endpoint fits the evidence.
  4. NAT gateway establishes managed IPv4 source translation for private for DynamoDB access. The requested action is use a DynamoDB gateway VPC endpoint. It differs from use a DynamoDB gateway VPC endpoint, so NAT gateway is unsuitable here.

 

Question 6

An interface endpoint is healthy, but applications still resolve the AWS service hostname to public addresses. The VPC DNS attributes are enabled. Which endpoint setting should be examined?

  1. Private DNS on an interface endpoint
  2. VPC endpoint policy
  3. Endpoint ENI security group
  4. Subnet route table

Correct Answer(s)

 

A

Rationale

  1. Private DNS on an interface endpoint acts as service hostname resolution to endpoint private for endpoint healthy. The requested action is enable or repair private DNS association for the interface endpoint. This matches enable or repair private DNS association for the interface endpoint, so Private DNS on an interface endpoint fits the evidence.
  2. VPC endpoint policy creates principal and action guardrail on endpoint for service name resolves publicly. The requested action is enable or repair private DNS association for the interface endpoint. It differs from enable or repair private DNS association for the interface endpoint, so VPC endpoint policy is unsuitable here.
  3. Endpoint ENI security group applies traffic filter attached to interface endpoint for endpoint healthy. The requested action is enable or repair private DNS association for the interface endpoint. It differs from enable or repair private DNS association for the interface endpoint, so Endpoint ENI security group is unsuitable here.
  4. Subnet route table handles longest prefix forwarding policy associated with for service name resolves publicly. The requested action is enable or repair private DNS association for the interface endpoint. It differs from enable or repair private DNS association for the interface endpoint, so Subnet route table is unsuitable here.

 

Question 7

A team wants to prevent use of an S3 gateway endpoint for buckets outside an approved set, even though IAM identities may have broader S3 permissions elsewhere. Which endpoint feature can narrow requests through this path?

  1. S3 gateway VPC endpoint
  2. Security group
  3. Network ACL
  4. VPC endpoint policy

Correct Answer(s)

 

D

Rationale

  1. S3 gateway VPC endpoint gives route table private path to Amazon for bucket-level scope. The requested action is apply a restrictive policy to the VPC endpoint. It differs from apply a restrictive policy to the VPC endpoint, so S3 gateway VPC endpoint is unsuitable here.
  2. Security group provides stateful ENI level allow list firewall for restrict this endpoint path. The requested action is apply a restrictive policy to the VPC endpoint. It differs from apply a restrictive policy to the VPC endpoint, so Security group is unsuitable here.
  3. Network ACL offers stateless subnet boundary allow and deny for bucket-level scope. The requested action is apply a restrictive policy to the VPC endpoint. It differs from apply a restrictive policy to the VPC endpoint, so Network ACL is unsuitable here.
  4. VPC endpoint policy enables principal and action guardrail on endpoint for restrict this endpoint path. The requested action is apply a restrictive policy to the VPC endpoint. This matches apply a restrictive policy to the VPC endpoint, so VPC endpoint policy fits the evidence.

 

Question 8

Three VPCs are peered in a chain: A-B and B-C. A cannot reach C through B. All CIDRs are unique. Which design fact is responsible?

  1. AWS Transit Gateway
  2. VPC peering
  3. Subnet route table
  4. AWS PrivateLink endpoint service

Correct Answer(s)

 

B

Rationale

  1. AWS Transit Gateway delivers regional hub for many routed network for A-to-C transit expected. The requested action is VPC peering does not provide transitive routing through the middle VPC. It differs from VPC peering does not provide transitive routing through the middle VPC, so AWS Transit Gateway is unsuitable here.
  2. VPC peering controls direct nontransitive private routing between two for A-B and B-C peering. The requested action is VPC peering does not provide transitive routing through the middle VPC. This matches VPC peering does not provide transitive routing through the middle VPC, so VPC peering fits the evidence.
  3. Subnet route table acts as longest prefix forwarding policy associated with for A-B and B-C peering. The requested action is VPC peering does not provide transitive routing through the middle VPC. It differs from VPC peering does not provide transitive routing through the middle VPC, so Subnet route table is unsuitable here.
  4. AWS PrivateLink endpoint service creates one way private service exposure across for A-to-C transit expected. The requested action is VPC peering does not provide transitive routing through the middle VPC. It differs from VPC peering does not provide transitive routing through the middle VPC, so AWS PrivateLink endpoint service is unsuitable here.

 

Question 9

A multi-account network uses Transit Gateway route tables. Development attachments must never receive routes to production attachments, while shared services remain reachable. What should enforce this separation?

  1. AWS Transit Gateway
  2. VPC peering
  3. Security-group reference
  4. Public subnet route to an internet gateway

Correct Answer(s)

 

A

Rationale

  1. AWS Transit Gateway supplies regional hub for many routed network for development isolated from production. The requested action is use separate Transit Gateway route-table associations and propagations. This matches use separate Transit Gateway route-table associations and propagations, so AWS Transit Gateway fits the evidence.
  2. VPC peering functions as direct nontransitive private routing between two for shared services still reachable. The requested action is use separate Transit Gateway route-table associations and propagations. It differs from use separate Transit Gateway route-table associations and propagations, so VPC peering is unsuitable here.
  3. Security-group reference enables identity based rule targeting another security for development isolated from production. The requested action is use separate Transit Gateway route-table associations and propagations. It differs from use separate Transit Gateway route-table associations and propagations, so Security-group reference is unsuitable here.
  4. Public subnet route to an internet gateway gives internet routable subnet path through an for shared services still reachable. The requested action is use separate Transit Gateway route-table associations and propagations. It differs from use separate Transit Gateway route-table associations and propagations, so Public subnet route to an internet gateway is unsuitable here.

 

Question 10

A provider wants customer VPCs to consume a TCP service privately. The provider should keep its subnet topology hidden and avoid exchanging routes with every customer. Which pattern should be used?

  1. VPC peering
  2. AWS Transit Gateway
  3. AWS PrivateLink endpoint service
  4. VPC sharing with AWS RAM

Correct Answer(s)

 

C

Rationale

  1. VPC peering supports direct nontransitive private routing between two for private consumer access. The requested action is use a PrivateLink endpoint service backed by supported service infrastructure. It differs from use a PrivateLink endpoint service backed by supported service infrastructure, so VPC peering is unsuitable here.
  2. AWS Transit Gateway controls regional hub for many routed network for hide provider network. The requested action is use a PrivateLink endpoint service backed by supported service infrastructure. It differs from use a PrivateLink endpoint service backed by supported service infrastructure, so AWS Transit Gateway is unsuitable here.
  3. AWS PrivateLink endpoint service establishes one way private service exposure across for hide provider network. The requested action is use a PrivateLink endpoint service backed by supported service infrastructure. This matches use a PrivateLink endpoint service backed by supported service infrastructure, so AWS PrivateLink endpoint service fits the evidence.
  4. VPC sharing with AWS RAM delivers shared subnets across accounts in one for private consumer access. The requested action is use a PrivateLink endpoint service backed by supported service infrastructure. It differs from use a PrivateLink endpoint service backed by supported service infrastructure, so VPC sharing with AWS RAM is unsuitable here.

 

Question 11

A VPC endpoint policy allows an API action, but the caller’s IAM policy explicitly denies that same action. Will the endpoint policy override the IAM deny?

  1. Security group
  2. VPC endpoint policy
  3. Network ACL
  4. VPC Flow Logs

Correct Answer(s)

 

B

Rationale

  1. Security group implements stateful ENI level allow list firewall for endpoint policy allows action. The requested action is treat the endpoint policy as an additional guardrail rather than an override of IAM authorization. It differs from treat the endpoint policy as an additional guardrail rather than an override of IAM authorization, so Security group is unsuitable here.
  2. VPC endpoint policy handles principal and action guardrail on endpoint for caller has explicit IAM deny. The requested action is treat the endpoint policy as an additional guardrail rather than an override of IAM authorization. This matches treat the endpoint policy as an additional guardrail rather than an override of IAM authorization, so VPC endpoint policy fits the evidence.
  3. Network ACL supplies stateless subnet boundary allow and deny for caller has explicit IAM deny. The requested action is treat the endpoint policy as an additional guardrail rather than an override of IAM authorization. It differs from treat the endpoint policy as an additional guardrail rather than an override of IAM authorization, so Network ACL is unsuitable here.
  4. VPC Flow Logs functions as metadata records for accepted and rejected for endpoint policy allows action. The requested action is treat the endpoint policy as an additional guardrail rather than an override of IAM authorization. It differs from treat the endpoint policy as an additional guardrail rather than an override of IAM authorization, so VPC Flow Logs is unsuitable here.

 

Question 12

An on-premises DNS server must resolve private Route 53 names in a VPC, and VPC workloads must resolve selected on-premises domains. Which design supplies both directions?

  1. AWS PrivateLink endpoint service
  2. AWS Transit Gateway
  3. Private DNS on an interface endpoint
  4. Route 53 Resolver endpoints

Correct Answer(s)

 

D

Rationale

  1. AWS PrivateLink endpoint service serves as one way private service exposure across for queries must flow in both directions. The requested action is deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules. It differs from deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules, so AWS PrivateLink endpoint service is unsuitable here.
  2. AWS Transit Gateway establishes regional hub for many routed network for hybrid DNS. The requested action is deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules. It differs from deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules, so AWS Transit Gateway is unsuitable here.
  3. Private DNS on an interface endpoint supports service hostname resolution to endpoint private for queries must flow in both directions. The requested action is deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules. It differs from deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules, so Private DNS on an interface endpoint is unsuitable here.
  4. Route 53 Resolver endpoints offers hybrid DNS forwarding between VPCs and for hybrid DNS. The requested action is deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules. This matches deploy Route 53 Resolver inbound and outbound endpoints with forwarding rules, so Route 53 Resolver endpoints fits the evidence.

 

Question 13

Security operations need to find which VPC flows were rejected during a short outage, but they do not need packet bodies. Which source provides the most direct evidence with lower data volume than packet mirroring?

  1. VPC Traffic Mirroring
  2. AWS Network Firewall
  3. Security group
  4. VPC Flow Logs

Correct Answer(s)

 

D

Rationale

  1. VPC Traffic Mirroring applies packet copies sent to analysis appliances for packet payload unnecessary. The requested action is query VPC Flow Logs for REJECT connection records. It differs from query VPC Flow Logs for REJECT connection records, so VPC Traffic Mirroring is unsuitable here.
  2. AWS Network Firewall handles managed stateful inspection for VPC traffic for rejected flows. The requested action is query VPC Flow Logs for REJECT connection records. It differs from query VPC Flow Logs for REJECT connection records, so AWS Network Firewall is unsuitable here.
  3. Security group implements stateful ENI level allow list firewall for packet payload unnecessary. The requested action is query VPC Flow Logs for REJECT connection records. It differs from query VPC Flow Logs for REJECT connection records, so Security group is unsuitable here.
  4. VPC Flow Logs creates metadata records for accepted and rejected for rejected flows. The requested action is query VPC Flow Logs for REJECT connection records. This matches query VPC Flow Logs for REJECT connection records, so VPC Flow Logs fits the evidence.

 

Question 14

An inline firewall policy is correct, but traffic bypasses the inspection appliance because a subnet route points directly to the destination. Which component must be changed to force the inspection path?

  1. VPC Flow Logs
  2. Subnet route table
  3. Security group
  4. VPC endpoint policy

Correct Answer(s)

 

B

Rationale

  1. VPC Flow Logs provides metadata records for accepted and rejected for current route bypasses it. The requested action is change the subnet routing so the selected traffic traverses the inspection target. It differs from change the subnet routing so the selected traffic traverses the inspection target, so VPC Flow Logs is unsuitable here.
  2. Subnet route table gives longest prefix forwarding policy associated with for firewall itself is healthy. The requested action is change the subnet routing so the selected traffic traverses the inspection target. This matches change the subnet routing so the selected traffic traverses the inspection target, so Subnet route table fits the evidence.
  3. Security group offers stateful ENI level allow list firewall for firewall itself is healthy. The requested action is change the subnet routing so the selected traffic traverses the inspection target. It differs from change the subnet routing so the selected traffic traverses the inspection target, so Security group is unsuitable here.
  4. VPC endpoint policy serves as principal and action guardrail on endpoint for current route bypasses it. The requested action is change the subnet routing so the selected traffic traverses the inspection target. It differs from change the subnet routing so the selected traffic traverses the inspection target, so VPC endpoint policy is unsuitable here.

 

Question 15

A dual-stack subnet needs normal outbound and inbound IPv6 internet connectivity for a public web tier. Which route is necessary in addition to appropriate security controls?

  1. Egress-only internet gateway
  2. NAT gateway
  3. IPv6 ::/0 route
  4. S3 gateway VPC endpoint

Correct Answer(s)

 

C

Rationale

  1. Egress-only internet gateway acts as outbound only IPv6 path for VPC for bidirectional internet. The requested action is send the IPv6 default route to the internet gateway for a public tier. It differs from send the IPv6 default route to the internet gateway for a public tier, so Egress-only internet gateway is unsuitable here.
  2. NAT gateway creates managed IPv4 source translation for private for public IPv6 web tier. The requested action is send the IPv6 default route to the internet gateway for a public tier. It differs from send the IPv6 default route to the internet gateway for a public tier, so NAT gateway is unsuitable here.
  3. IPv6 ::/0 route delivers default IPv6 forwarding entry in a for public IPv6 web tier. The requested action is send the IPv6 default route to the internet gateway for a public tier. This matches send the IPv6 default route to the internet gateway for a public tier, so IPv6 ::/0 route fits the evidence.
  4. S3 gateway VPC endpoint applies route table private path to Amazon for bidirectional internet. The requested action is send the IPv6 default route to the internet gateway for a public tier. It differs from send the IPv6 default route to the internet gateway for a public tier, so S3 gateway VPC endpoint is unsuitable here.

 

Question 16

A private IPv6 workload should reach the internet for updates, but a route to the regular internet gateway would expose a bidirectional path. Which target should the ::/0 route use instead?

  1. Egress-only internet gateway
  2. Internet gateway
  3. NAT gateway
  4. AWS Transit Gateway

Correct Answer(s)

 

A

Rationale

  1. Egress-only internet gateway functions as outbound only IPv6 path for VPC for private IPv6 workload. The requested action is point the IPv6 default route at an egress-only internet gateway. This matches point the IPv6 default route at an egress-only internet gateway, so Egress-only internet gateway fits the evidence.
  2. Internet gateway enables VPC edge target for public internet for outbound initiation only. The requested action is point the IPv6 default route at an egress-only internet gateway. It differs from point the IPv6 default route at an egress-only internet gateway, so Internet gateway is unsuitable here.
  3. NAT gateway gives managed IPv4 source translation for private for private IPv6 workload. The requested action is point the IPv6 default route at an egress-only internet gateway. It differs from point the IPv6 default route at an egress-only internet gateway, so NAT gateway is unsuitable here.
  4. AWS Transit Gateway provides regional hub for many routed network for outbound initiation only. The requested action is point the IPv6 default route at an egress-only internet gateway. It differs from point the IPv6 default route at an egress-only internet gateway, so AWS Transit Gateway is unsuitable here.

 

Question 17

Multiple application accounts need to launch resources into centrally governed subnets without creating peering links to a networking account. All accounts are in the same organization. Which model fits?

  1. VPC peering
  2. VPC sharing with AWS RAM
  3. AWS PrivateLink endpoint service
  4. AWS Transit Gateway

Correct Answer(s)

 

B

Rationale

  1. VPC peering controls direct nontransitive private routing between two for central subnet ownership. The requested action is share selected VPC subnets across accounts with AWS RAM. It differs from share selected VPC subnets across accounts with AWS RAM, so VPC peering is unsuitable here.
  2. VPC sharing with AWS RAM supports shared subnets across accounts in one for same organization. The requested action is share selected VPC subnets across accounts with AWS RAM. This matches share selected VPC subnets across accounts with AWS RAM, so VPC sharing with AWS RAM fits the evidence.
  3. AWS PrivateLink endpoint service delivers one way private service exposure across for participant resource deployment. The requested action is share selected VPC subnets across accounts with AWS RAM. It differs from share selected VPC subnets across accounts with AWS RAM, so AWS PrivateLink endpoint service is unsuitable here.
  4. AWS Transit Gateway acts as regional hub for many routed network for same organization. The requested action is share selected VPC subnets across accounts with AWS RAM. It differs from share selected VPC subnets across accounts with AWS RAM, so AWS Transit Gateway is unsuitable here.

 

Question 18

A new interface endpoint was placed in only one Availability Zone. Applications run in three zones and the endpoint is on a critical private API path. Which change improves endpoint resilience?

  1. S3 gateway VPC endpoint
  2. VPC peering
  3. Public subnet route to an internet gateway
  4. Interface VPC endpoint

Correct Answer(s)

 

D

Rationale

  1. S3 gateway VPC endpoint supplies route table private path to Amazon for applications span multiple AZs. The requested action is add endpoint subnets in additional Availability Zones. It differs from add endpoint subnets in additional Availability Zones, so S3 gateway VPC endpoint is unsuitable here.
  2. VPC peering functions as direct nontransitive private routing between two for critical endpoint path. The requested action is add endpoint subnets in additional Availability Zones. It differs from add endpoint subnets in additional Availability Zones, so VPC peering is unsuitable here.
  3. Public subnet route to an internet gateway enables internet routable subnet path through an for applications span multiple AZs. The requested action is add endpoint subnets in additional Availability Zones. It differs from add endpoint subnets in additional Availability Zones, so Public subnet route to an internet gateway is unsuitable here.
  4. Interface VPC endpoint implements PrivateLink ENIs for private service access for critical endpoint path. The requested action is add endpoint subnets in additional Availability Zones. This matches add endpoint subnets in additional Availability Zones, so Interface VPC endpoint fits the evidence.

 

Question 19

A team replaced fixed vendor CIDRs with a managed prefix list in a security group. What operational benefit does that design provide?

  1. AWS-managed prefix list
  2. VPC Flow Logs
  3. Secondary VPC CIDR block
  4. Security-group reference

Correct Answer(s)

 

A

Rationale

  1. AWS-managed prefix list serves as managed CIDR set for supported AWS for CIDRs change over time. The requested action is consume centrally maintained CIDR membership through one reusable object. This matches consume centrally maintained CIDR membership through one reusable object, so AWS-managed prefix list fits the evidence.
  2. VPC Flow Logs establishes metadata records for accepted and rejected for many rules consume same ranges. The requested action is consume centrally maintained CIDR membership through one reusable object. It differs from consume centrally maintained CIDR membership through one reusable object, so VPC Flow Logs is unsuitable here.
  3. Secondary VPC CIDR block supports additional address space attached to one for CIDRs change over time. The requested action is consume centrally maintained CIDR membership through one reusable object. It differs from consume centrally maintained CIDR membership through one reusable object, so Secondary VPC CIDR block is unsuitable here.
  4. Security-group reference controls identity based rule targeting another security for many rules consume same ranges. The requested action is consume centrally maintained CIDR membership through one reusable object. It differs from consume centrally maintained CIDR membership through one reusable object, so Security-group reference is unsuitable here.

 

Question 20

A subnet route table sends 10.20.0.0/16 to a Transit Gateway and 10.20.5.0/24 to a peering connection. A packet targets 10.20.5.10. Which route is selected?

  1. AWS Transit Gateway
  2. VPC peering
  3. Subnet route table
  4. VPC Flow Logs

Correct Answer(s)

 

C

Rationale

  1. AWS Transit Gateway handles regional hub for many routed network for destination is inside /24. The requested action is use the more-specific /24 route because VPC routing uses longest-prefix match. It differs from use the more-specific /24 route because VPC routing uses longest-prefix match, so AWS Transit Gateway is unsuitable here.
  2. VPC peering implements direct nontransitive private routing between two for overlapping route prefixes. The requested action is use the more-specific /24 route because VPC routing uses longest-prefix match. It differs from use the more-specific /24 route because VPC routing uses longest-prefix match, so VPC peering is unsuitable here.
  3. Subnet route table applies longest prefix forwarding policy associated with for overlapping route prefixes. The requested action is use the more-specific /24 route because VPC routing uses longest-prefix match. This matches use the more-specific /24 route because VPC routing uses longest-prefix match, so Subnet route table fits the evidence.
  4. VPC Flow Logs supplies metadata records for accepted and rejected for destination is inside /24. The requested action is use the more-specific /24 route because VPC routing uses longest-prefix match. It differs from use the more-specific /24 route because VPC routing uses longest-prefix match, so VPC Flow Logs is unsuitable here.

Related posts:

  1. Amazon AWS AIP-C01 FM Deployment and Endpoints Practice Test 2
  2. Amazon AWS SAA-C03 IAM, Federation, Identity Center, and Least-Privilege Access Practice Test 1
  3. Cisco CCNA 200-301 IPv4 Addressing, Subnetting, and Private Addressing Practice Test 2
  4. Cisco CCNA 200-301 Security Concepts, Programs, and Device Passwords Practice Test 1
  5. Cisco CCNP 350-401 ENCOR 802.1Q Trunking and EtherChannel Troubleshooting Practice Test 3
  6. CompTIA Security+ SY0-701 Cryptography and PKI Practice Test 3
  7. CompTIA Security+ SY0-701 Enterprise Mitigation Techniques Practice Test 1
  8. CompTIA Security+ SY0-701 Enterprise Security Capabilities Practice Test 1
  9. CompTIA Security+ SY0-701 Investigation Data Sources Practice Test 1
  10. Microsoft Azure Administrator AZ-104 Azure Storage Access Practice Test 1

Leave a Reply

Categories

Recent Posts

Recent Comments

    How It Works

    img
    Step 1. Choose Exam
    on ExamLabs
    Download IT Exams Questions & Answers
    img
    Step 2. Open Exam with
    Avanset Exam Simulator
    Press here to download VCE Exam Simulator that simulates real exam environment
    img
    Step 3. Study
    & Pass
    IT Exams Anywhere, Anytime!

    Close