AWSCertifiedAdvancedNetworking-Specialty-ANS-C00.pdf资源-CSDN文库

版权申诉

5星 · 超过95%的资源 85 浏览量 2021-11-30 09:30:18 上传评论收藏 967KB PDF 举报

【AWS Certified Advanced Networking - Specialty - ANS - C00】是亚马逊网络服务（AWS）提供的一项高级认证，旨在验证专业人士在网络架构、设计、部署和管理AWS云中的复杂网络解决方案的能力。该认证涵盖了一系列主题，包括但不限于全球网络设计、流量管理、网络安全性、自动化和网络故障排除。在提供的部分内容中，涉及了两个具体的问题：问题#1 关于如何配置Amazon Route 53以确保组织的公司网站在www.acme.com和acme.com上可用。正确答案是A：将acme.com配置为使用ALIAS记录指向ELB（Elastic Load Balancer），并将www.acme.com配置为使用ALIAS记录同样指向ELB。ALIAS记录允许Route 53直接映射到由AWS服务如ELB分配的DNS名称，从而保持DNS解析的稳定性。问题#2 涉及在AWS中构建一个需要Amazon Elastic MapReduce（Amazon EMR）的应用，该应用需要解析内部On-Premises Active Directory域中的主机名。通过更新VPC的DHCP选项集，将DNS服务器指向VPC内的Active Directory集成DNS服务器。成功启动Amazon EMR集群所需的行动是B：启用无缝域加入功能。这允许EMR集群与内部的Active Directory域进行无缝连接，以便在集群中运行需要访问域资源的应用。参考链接提供了有关如何使用AD Connector将内部Active Directory连接到AWS，以及如何设置DNS解析以实现On-Premises网络和AWS之间的通信的详细指南。在AWS环境中，正确配置DNS解析至关重要，因为它确保了服务的可用性和性能。例如，使用ALIAS记录可以消除DNS解析的延迟，而配置私有Route 53区域或使用AD Connector则有助于在AWS和内部网络之间建立信任关系，支持跨环境的资源访问。 AWS Certified Advanced Networking - Specialty认证测试了考生对AWS网络服务的深入理解和实践经验，包括Route 53、VPC、DHCP选项集、ELB以及与On-Premises环境集成的策略。这些问题和答案揭示了网络架构师应具备的关键技能，以确保在AWS云中创建高可用、安全且可扩展的网络基础设施。

资源推荐

资源详情

资源评论

- Expert Veri�ed, Online, Free.



Custom View Settings

Topic 1 - Single Topic

Topic 1

Question #1

Your organizationג€™s corporate website must be available on www.acme.com and acme.com.

How should you congure Amazon Route 53 to meet this requirement?

Congure acme.com with an ALIAS record targeting the ELB. www.acme.com with an ALIAS record targeting the ELB.

B. Congure acme.com with an A record targeting the ELB. www.acme.com with a CNAME record targeting the acme.com record.

C. Congure acme.com with a CNAME record targeting the ELB. www.acme.com with a CNAME record targeting the acme.com record.

D. Congure acme.com using a second ALIAS record with the ELB target. www.acme.com using a PTR record with the acme.com record

target.

Correct Answer:

Topic 1

Question #2

You are building an application in AWS that requires Amazon Elastic MapReduce (Amazon EMR). The application needs to resolve hostnames in

your internal, on-premises Active Directory domain. You update your DHCP Options Set in the VPC to point to a pair of Active Directory integrated

DNS servers running in your

VPC.

Which action is required to support a successful Amazon EMR cluster launch?

Add a conditional forwarder to the Amazon-provided DNS server.

B. Enable seamless domain join for the Amazon EMR cluster.

C. Launch an AD connector for the internal domain.

D. Congure an Amazon Route 53 private zone for the EMR cluster.

Correct Answer:

References:

https://aws.amazon.com/blogs/security/how-to-connect-your-on-premises-active-directory-to-aws-using-ad-connector/

ANS-C00 Exam – Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/amazon/ans-c00/custom-view/

1 of 138 24/08/2021, 10:08 a.m.

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html

https://aws.amazon.com/es/blogs/security/how-to-set-up-dns-resolution-between-on-premises-networks-and-

aws-using-aws-directory-service-and-microsoft-active-directory/

ANS - C00

AWS Certified Advanced Networking - Specialty

Work hard, play hard

Topic 1

Question #3

You have a three-tier web application with separate subnets for Web, Applications, and Database tiers. Your CISO suspects your application will be

the target of malicious activity. You are tasked with notifying the security team in the event your application is port scanned by external systems.

Which two AWS Services cloud you leverage to build an automated notication system? (Choose two.)

Internet gateway

VPC Flow Logs

AWS CloudTrail

D. Lambda

E. AWS Inspector

Correct Answer:

References:

https://aws.amazon.com/blogs/security/how-to-receive-alerts-when-specic-apis-are-called-by-using-aws-cloudtrail-amazon-sns-and-aws-

lambda/

Topic 1

Question #4

You are designing the network infrastructure for an application server in Amazon VPC. Users will access all the application instances from the

Internet and from an on-premises network. The on-premises network is connected to your VPC over an AWS Direct Connect link.

How should you design routing to meet these requirements?

Congure a single routing table with two default routes: one to the Internet via an IGW, the other to the on-premises network via the VGW.

Use this routing table across all subnets in your VPC.

B. Congure two routing tables: one that has a default route via the IGW, and another that has a default route via the VGW. Associate both

routing tables with each VPC subnet.

C. Congure a single routing table with a default route via the IGW. Propagate a default route via BGP on the AWS Direct Connect customer

router. Associate the routing table with all VPC subnet.

D. Congure a single routing table with a default route via the IGW. Propagate specic routes for the on-premises networks via BGP on the

AWS Direct Connect customer router. Associate the routing table with all VPC subnets.

Correct Answer:

Topic 1

Question #5

Your company decides to use Amazon S3 to augment its on-premises data store. Instead of using the company

ג€™s highly controlled, on-premises

Internet gateway, a Direct Connect connection is ordered to provide high bandwidth, low latency access to S3. Since the company does not own a

publically routable IPv4 address block, a request was made to AWS for an AWS-owned address for a Public Virtual Interface (VIF).

The security team is calling this new connection a

€backdoor

ג€, and you have been asked to clarify the risk to the company.

Which concern from the security team is valid and should be addressed?

AWS advertises its aggregate routes to the Internet allowing anyone on the Internet to reach the router.

B. Direct Connect customers with a Public VIF in the same region could directly reach the router.

ANS-C00 Exam – Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/amazon/ans-c00/custom-view/

2 of 138 24/08/2021, 10:08 a.m.

C. EC2 instances in the same region with access to the Internet could directly reach the router.

D. The S3 service could reach the router through a pre-congured VPC Endpoint.

Correct Answer:

Topic 1

Question #6

Your organization uses a VPN to connect to your VPC but must upgrade to a 1-G AWS Direct Connect connection for stability and performance.

Your telecommunications provider has provisioned the circuit from your data center to an AWS Direct Connect facility and needs information on

how to cross-connect

(e.g., which rack/port to connect).

What is the AWS-recommended procedure for providing this information?

Create a support ticket. Provide your AWS account number and telecommunications companyג€™s name and where you need the Direct

Connect connection to terminate.

B. Create a new connection through your AWS Management Console and wait for an email from AWS with information.

Ask your telecommunications provider to contact AWS through an AWS Partner Channel. Provide your AWS account number.

Contact an AWS Account Manager and provide your AWS account number, telecommunications company

ג€™s name, and where you need

the Direct Connect connection to terminate.

Correct Answer:

Topic 1

Question #7

You manage a web service that is used by client applications deployed in 300 oces worldwide. The web service architecture is an Elastic Load

Balancer (ELB) distributing trac across four application servers deployed in an Auto Scaling group across two Availability Zones.

The ELB is congured to use round robin, and sticky sessions are disabled. You have congured the NACLs and security groups to allow port 22

from your bastion host, and port 80 from 0.0.0.0/0. The client conguration is managed by each regional IT team.

Upon inspection you nd that a large amount of requests from incorrectly congured sites are causing a single application server to degrade. The

remainder of the requests are equally distributed across all servers with no negative effects.

What should you do to remedy the situation and prevent future occurrences?

Mark the affected instance as degraded in the ELB and raise it with the client application team.

B. Update the NACL to only allow port 80 to the application servers from the ELB servers.

C. Update the Security Groups to only allow port 80 to the application servers from the ELB.

D. Terminate the affected instance and allow Auto Scaling to create a new instance.

Correct Answer:

Topic 1

Question #8

A multinational organization has applications deployed in three different AWS regions. These applications must securely communicate with each

other by VPN.

ANS-C00 Exam – Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/amazon/ans-c00/custom-view/

3 of 138 24/08/2021, 10:08 a.m.

Create subnets 192.168.1.0/28 and 192.168.1.16/28. Move i-3 and i-4 to these subnets, respectively.

B. Create subnets 192.168.1.0/27 and 192.168.1.16/27. Move i-3 and i-4 to these subnets, respectively.

C. Change the IP address of i-2 to 10.0.0.100. Assign it an elastic IP address.

D. Create a new route table for VPC B, with unique route entries for destination VPC A and destination VPC C.

E. Create two route tables: one with a route for destination VPC A, and another for destination VPC C.

Correct Answer:

Topic 1

Question #10

A legacy, on-premises web application cannot be load balanced effectively. There are both planned and unplanned events that cause usage spikes

to millions of concurrent users. The existing infrastructure cannot handle the usage spikes. The CIO has mandated that the application be moved

to the cloud to avoid further disruptions, with the additional requirement that source IP addresses be unaltered to support network trac-

monitoring needs. Which of the following designs will meet these requirements?

Use an Auto Scaling group of Amazon EC2 instances behind a Classic Load Balancer.

B. Use an Auto Scaling group of EC2 instances in a target group behind an Application Load Balancer.

C. Use an Auto Scaling group of EC2 instances in a target group behind a Classic Load Balancer.

D. Use an Auto Scaling group of EC2 instances in a target group behind a Network Load Balancer.

Correct Answer:

Topic 1

Question #11

An organization processes consumer information submitted through its website. The organizationג€™s security policy requires that personally

identiable information

(PII) elements are specically encrypted at all times and as soon as feasible when received. The front-end Amazon EC2 instances should not have

access to decrypted PII. A single service within the production VPC must decrypt the PII by leveraging an IAM role.

Which combination of services will support these requirements? (Choose two.)

Amazon Aurora in a private subnet

Amazon CloudFront using AWS

Lambda@Edge

C. Customer-managed MySQL with Transparent Data Encryption

D. Application Load Balancer using HTTPS listeners and targets

E. AWS Key Management Services

Correct Answer:

References:

https://noise.getoto.net/tag/aws-kms/

ANS-C00 Exam – Free Actual Q&As, Page 1 | ExamTopics https://www.examtopics.com/exams/amazon/ans-c00/custom-view/

5 of 138 24/08/2021, 10:08 a.m.

https://aws.amazon.com/blogs/security/how-to-protect-sensitive-data-for-its-entire-lifecycle-in-aws/

剩余137页未读，继续阅读

评论收藏

内容反馈

版权申诉

szkktom

2022-02-24

用户下载后在一定时间内未进行评价，系统默认好评。
huhulaoma

2022-11-06

资源有一定的参考价值，与资源描述一致，很实用，能够借鉴的部分挺多的，值得下载。

优质网络系统领域创作者

粉丝: 3187
资源: 2508

AWS Certified Advanced Networking - Specialty - ANS - C00 .pdf

最新资源

AWS Certified Advanced Networking - Specialty - ANS - C00 .pdf

AWS Certified Advanced Networking Official Study

AWS Certified Advanced Networking Official Study Guide--2018年

AWS Advanced Networking Specialty (ANS-C01)- 认证考试资料-中文-系列一.pdf

AWS Advanced Networking Specialty (ANS-C01)- 认证考试资料-英文-系列一.pdf

AWS Certified SAP on AWS Specialty (PAS-C01)- 认证考试题库-中文-系列二.pdf

AWS Certified SAP on AWS Specialty (PAS-C01)- 认证考试题库-中文-系列一.pdf

AWS Certified SAP on AWS Specialty (PAS-C01)- 认证考试题库-英文-系列二.pdf

AWS Certified SAP on AWS Specialty (PAS-C01)- 认证考试题库-英文-系列一.pdf

AWS文档资料

AWS Certified Advanced Networking - Specialty ANS题库ExamShoot公开版

AWS Certified Database - Specialty

AWS Certified Machine Learning - Specialty 机器学习专家题库Examshoot公开版

aws-java-sdk-core-1.11.939-API文档-中文版.zip

AWS Certified Solutions Architect - Associate题库

aws-java-sdk-core-1.12.160-API文档-中英对照版.zip

aws-java-sdk-s3-1.11.939-API文档-中文版.zip

aws-java-sdk-s3-1.12.376.jar中文-英文对照文档.zip

AWS Certified Solutions Architect - Associate【英文视频】.rar

aws-java-sdk-kms-1.11.939-API文档-中文版.zip

aws-java-sdk-core-1.11.939-API文档-中英对照版.zip

AWS-Security-Specialty.pdf

aws-java-sdk-kms-1.11.939-API文档-中英对照版.zip

Aws-Certified-Solutions-Architect-Professional-Course-Sap-C02-Pr

PyPI 官网下载 | aws-cdk.aws-amplify-1.15.0.tar.gz

AWS-Certified-Solutions-Architect-Associate.zip

Python库 | aws-cdk.aws-wafv2-1.72.0.tar.gz

Python库 | aws-cdk.aws-ec2-1.22.0.tar.gz

aws-java-sdk-kms-1.12.160-API文档-中英对照版.zip

最新资源