A company’s network engineer needs to design a new solution to help troubleshoot and detect network anomalies. The network engineer has configured Traffic Mirroring. However, the mirrored traffic is overwhelming the Amazon EC2 instance that is the traffic mirror target. The EC2 instance hosts tools that the company’s security team uses to analyze the traffic. The network engineer needs to design a highly available solution that can scale to meet the demand of the mirrored traffic.
Which solution will meet these requirements?

1. A. Deploy a Network Load Balancer (NLB) as the traffic mirror targe
2. B. Behind the NL
3. C. deploy a fleet of EC2 instances in an Auto Scaling grou
4. D. Use Traffic Mirroring as necessary.
5. E. Deploy an Application Load Balancer (ALB) as the traffic mirror targe
6. F. Behind the ALB, deploy a fleet of EC2 instances in an Auto Scaling grou
7. G. Use Traffic Mirroring only during non-business hours.
8. H. Deploy a Gateway Load Balancer (GLB) as the traffic mirror targe
9. I. Behind the GL
10. J. deploy a fleet of EC2 instances in an Auto Scaling grou
11. K. Use Traffic Mirroring as necessary.
12. L. Deploy an Application Load Balancer (ALB) with an HTTPS listener as the traffic mirror targe
13. M. Behind the AL
14. N. deploy a fleet of EC2 instances in an Auto Scaling grou
15. O. Use Traffic Mirroring only during active events or business hours.

Correct Answer: A

A company is using custom DNS servers that run BIND for name resolution in its VPCs. The VPCs are deployed across multiple AWS accounts that are part of the same organization in AWS Organizations. All the VPCs are connected to a transit gateway. The BIND servers are running in a central VPC and are configured to forward all queries for an on-premises DNS domain to DNS servers that are hosted in an on-premises data center. To ensure that all the VPCs use the custom DNS servers, a network engineer has configured a VPC DHCP options set in all the VPCs that specifies the custom DNS servers to be used as domain name servers.
Multiple development teams in the company want to use Amazon Elastic File System (Amazon EFS). A development team has created a new EFS file system but cannot mount the file system to one of its Amazon EC2 instances. The network engineer discovers that the EC2 instance cannot resolve the IP address for the EFS mount point fs-33444567d.efs.us-east-1.amazonaws.com. The network engineer needs to implement a solution so that development teams throughout the organization can mount EFS file systems.
Which combination of steps will meet these requirements? (Choose two.)

1. A. Configure the BIND DNS servers in the central VPC to forward queries forefs.us-east-1.amazonaws.com to the Amazon provided DNS server (169.254.169.253).
2. B. Create an Amazon Route 53 Resolver outbound endpoint in the central VP
3. C. Update all the VPC DHCP options sets to use AmazonProvidedDNS for name resolution.
4. D. Create an Amazon Route 53 Resolver inbound endpoint in the central VPUpdate all the VPC DHCP options sets to use the Route 53 Resolver inbound endpoint in the central VPC for name resolution.
5. E. Create an Amazon Route 53 Resolver rule to forward queries for the on-premises domain to the on-premises DNS server
6. F. Share the rule with the organization by using AWS Resource Access Manager (AWS RAM). Associate the rule with all the VPCs.
7. G. Create an Amazon Route 53 private hosted zone for the efs.us-east-1.amazonaws.com domain.Associate the private hosted zone with the VPC where the EC2 instance is deploye
8. H. Create an A record for fs-33444567d.efs.us-east-1.amazonaws.com in the private hosted zon
9. I. Configure the A record to return the mount target of the EFS mount point.

Correct Answer: BD
Option B suggests using Amazon Route 53 Resolver outbound endpoint, which would replace the existing BIND DNS servers with the AmazonProvidedDNS for name resolution. However, the scenario specifically mentions that the company is using custom DNS servers that run BIND for name resolution in its VPCs, so this solution would not work. Option D suggests creating a Route 53 Resolver rule to forward queries for the on-premises domain to the on-premises DNS servers, which would not address the issue of resolving the EFS mount point. The problem is not with resolving queries for the on-premises domain, but rather with resolving the IP address for the EFS mount point.

A company has hundreds of VPCs on AWS. All the VPCs access the public endpoints of Amazon S3 and AWS Systems Manager through NAT gateways. All the traffic from the VPCs to Amazon S3 and Systems Manager travels through the NAT gateways. The company's network engineer must centralize access to these services and must eliminate the need to use public endpoints.
Which solution will meet these requirements with the LEAST operational overhead?

1. A. Create a central egress VPC that has private NAT gateway
2. B. Connect all the VPCs to the central egress VPC by using AWS Transit Gatewa
3. C. Use the private NAT gateways to connect to Amazon S3 and Systems Manager by using private IP addresses.
4. D. Create a central shared services VP
5. E. In the central shared services VPC, create interface VPC endpoints for Amazon S3 and Systems Manager to acces
6. F. Ensure that private DNS is turned of
7. G. Connect all the VPCs to the central shared services VPC by using AWS Transit Gatewa
8. H. Create an Amazon Route 53 forwarding rule for each interface VPC endpoin
9. I. Associate the forwarding rules with all the VPC
10. J. Forward DNS queries to the interface VPC endpoints in the shared services VPC.
11. K. Create a central shared services VPIn the central shared services VPC, create interface VPC endpoints for Amazon S3 and Systems Manager to acces
12. L. Ensure that private DNS is turned of
13. M. Connect all the VPCs to the central shared services VPC by using AWS Transit Gatewa
14. N. Create an Amazon Route 53 private hosted zone with a full service endpoint name for Amazon S3 and Systems Manage
15. O. Associate the private hosted zones with all the VPC
16. P. Create an alias record in each private hosted zone with the full AWS service endpoint pointing to the interface VPC endpoint in the shared services VPC.
17. Q. Create a central shared services VP
18. R. In the central shared services VPC, create interface VPC endpoints for Amazon S3 and Systems Manager to acces
19. S. Connect all the VPCs to the central shared services VPC by using AWS Transit Gatewa
20. T. Ensure that private DNS is turned on for the interface VPC endpoints and that the transit gateway is created with DNS support turned on.

Correct Answer: B
Interface VPC endpoints enable private connectivity between VPCs and supported AWS serviceswithout requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection2. Interface VPC endpoints are powered by AWS PrivateLink, a technology that enables private access to AWS services2. Amazon S3 and AWS Systems Manager support interface VPC endpoin2ts. By turning off private DNS, the interface VPC endpoints can be accessed by using their private IP addresses2. By using Amazon Route 53 forwarding rules, DNS queries can be resolved to the interface VPC endpoints in the shared services VPC3.

A company’s network engineer builds and tests network designs for VPCs in a development account. The company needs to monitor the changes that are made to network resources and must ensure strict compliance with network security policies. The company also needs access to the historical configurations of network resources.
Which solution will meet these requirements?

1. A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with a custom pattern to monitor the account for change
2. B. Configure the rule to invoke an AWS Lambda function to identify noncompliant resource
3. C. Update an Amazon DynamoDB table with the changes that are identified.
4. D. Create custom metrics from Amazon CloudWatch log
5. E. Use the metrics to invoke an AWS Lambda function to identify noncompliant resource
6. F. Update an Amazon DynamoDB table with the changes that are identified.
7. G. Record the current state of network resources by using AWS Confi
8. H. Create rules that reflect the desired configuration setting
9. I. Set remediation for noncompliant resources.
10. J. Record the current state of network resources by using AWS Systems Manager Inventor
11. K. Use Systems Manager State Manager to enforce the desired configuration settings and to carry out remediation for noncompliant resources.

Correct Answer: C
Recording the current state of network resources by using AWS Config would enable auditing and assessment of resource configurations and compliance3. Creating rules that reflect the desired configuration settings would enable evaluation of whether the network resources comply with network security policies3. Setting remediation for noncompliant resources would enable automatic correction of undesired configurations3.

A network engineer has deployed an Amazon EC2 instance in a private subnet in a VPC. The VPC has no public subnet. The EC2 instance hosts application code that sends messages to an Amazon Simple Queue Service (Amazon SQS) queue. The subnet has the default network ACL with no modification applied. The EC2 instance has the default security group with no modification applied.
The SQS queue is not receiving messages.
Which of the following are possible causes of this problem? (Choose two.)

1. A. The EC2 instance is not attached to an IAM role that allows write operations to Amazon SQS.
2. B. The security group is blocking traffic to the IP address range used by Amazon SQS
3. C. There is no interface VPC endpoint configured for Amazon SQS
4. D. The network ACL is blocking return traffic from Amazon SQS
5. E. There is no route configured in the subnet route table for the IP address range used by Amazon SQS

Correct Answer: CE