An organization processes consumer information submitted through its website. The organization’s security policy requires that personally identifiable information (PII) elements are specifically encrypted at all times and as soon as feasible when received. The front-end Amazon EC2 instances should not have access to decrypted PII. A single service within the production VPC must decrypt the PII by leveraging an iAM role.
Which combination of services will support these requirement? (Select two.)

1. A. Amazon Aurora in a private subnet
2. B. Amazon CloudFront using AWS Lambda@Edge
3. C. Customer-managed MySQL with Transparent Data Encryption
4. D. Application Load Balancer using HTTPS listeners and targets
5. E. AWS Key Management Services

Correct Answer: BE

Your organization uses a VPN to connect to your VPC but must upgrade to a 1-G AWS Direct Connect connection for stability and performance. Your telecommunications provider has provisioned the circuit from your data center to an AWS Direct Connect facility and needs information on how to cross-connect (e.g., which rack/port to connect).
What is the AWS-recommended procedure for providing this information?

1. A. Create a support ticke
2. B. Provide your AWS account number and telecommunications company’s name and where you need the Direct Connect connection to terminate.
3. C. Create a new connection through your AWS Management Console and wait for an email from AWS with information.
4. D. Ask your telecommunications provider to contact AWS through an AWS Partner Channe
5. E. Provide your AWS account number.
6. F. Contact an AWS Account Manager and provide your AWS account number, telecommunications company’s name, and where you need the Direct Connect connection to terminate.

Correct Answer: B
https://aws.amazon.com/premiumsupport/knowledge-center/provision-direct-connection/ https://docs.aws.amazon.com/directconnect/latest/UserGuide/getting_started.html

A company is running services in a VPC with a CIDR block of 10.5.0.0/22 End users report that they no longer can provision new resources because some ot the subnets in theVPC have run out of IP addresses
How should a network engineer resolve this issue?

1. A. Add 10 5.2.0/23 as a second CIDR block to the VPC Create a new subnet with a new CIDR block, and provision new resources in the new subnet
2. B. Add 10 5.4.0/21 as a second CIDR block to the VPC Assign a second network from this CIDR block to the existing subnets that have run out of IP addresses
3. C. Add 10.5.4.0/22 as a second CIDR block to the VP
4. D. Assign a second network from this CIDR block to the existing subnets that have run out of IP addresses
5. E. Add 10.5.4.0/22 as a second CIDR block to the VP
6. F. Create a new subnet with a new CIDR block, and provision new resources in the new subnet

Correct Answer: D

Your company has a 1-Gbps AWS Direct Connect connection to AWS. Your company needs to send traffic from on-premises to a VPC owned by a partner company. The connectivity must have minimal latency at the lowest price.
Which of the following connectivity options should you choose?

1. A. Create a new Direct Connect connection, and set up a new circuit to connect to the partner VPC using a private virtual interface.
2. B. Create a new Direct Connect connection, and leverage the existing circuit to connect to the partner VPC.
3. C. Create a new private virtual interface, and leverage the existing connection to connect to the partner VPC.
4. D. Enable VPC peering and use your VPC as a transitive point to reach the partner VPC.

Correct Answer: C
https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html#create-vpc-peering-connec