3.5
Question 1
A company is deploying a web server in an Amazon VPC. The server must be reachable from the internet. Which configuration is required for the subnet containing the web server?
A. A route in the subnet's route table that directs internet-bound traffic to an internet gateway
B. A network ACL that automatically assigns a public IP address to the web server
C. An AWS Site-to-Site VPN connection attached directly to the subnet
D. An Amazon Route 53 hosted zone associated with the subnet
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** A public subnet requires a route table entry that directs internet-bound traffic to an internet gateway attached to the VPC. The resource also needs a public IPv4 address or another applicable public connectivity configuration. * **Why B is incorrect:** Network ACLs control traffic at the subnet level. They do not assign public IP addresses. * **Why C is incorrect:** AWS Site-to-Site VPN provides encrypted connectivity between networks, such as an on-premises network and a VPC. It does not make a subnet publicly accessible. * **Why D is incorrect:** Amazon Route 53 provides DNS services. A hosted zone does not provide network connectivity to a subnet.Question 2
A security team is reviewing the controls used to protect resources in a VPC. Which TWO statements accurately describe security groups and network ACLs? (Select TWO)
A. Security groups are stateful and are associated with network interfaces or resources such as Amazon EC2 instances.
B. Network ACLs are stateless and operate at the subnet level.
C. Security groups are stateless and must allow return traffic in a separate rule.
D. Network ACLs are stateful and are associated directly with individual network interfaces.
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** Security groups act as virtual firewalls for associated resources, such as EC2 network interfaces. They are stateful, so response traffic is automatically allowed when the originating request is permitted. * **Why B is correct:** Network ACLs operate at the subnet level and are stateless. Both inbound and outbound traffic must be explicitly permitted as needed. * **Why C is incorrect:** Security groups are stateful, not stateless. * **Why D is incorrect:** Network ACLs are stateless and apply to subnets, not directly to individual network interfaces.Question 3
A company has registered the domain name example.com and wants to direct users to its application hosted on AWS. The company also wants DNS health checks and routing based on the location of users. Which AWS service should the company use?
A. Amazon Route 53
B. Amazon CloudFront
C. AWS Global Accelerator
D. Amazon VPC
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon Route 53 is a scalable DNS service that supports domain registration, DNS routing policies, and health checks. It can route users based on factors such as geographic location or endpoint health. * **Why B is incorrect:** Amazon CloudFront is a content delivery network that caches and delivers content from edge locations. It is not primarily a domain registration and DNS routing service. * **Why C is incorrect:** AWS Global Accelerator improves availability and performance for applications by using static anycast IP addresses and the AWS global network. It does not provide the primary DNS hosting functions described. * **Why D is incorrect:** Amazon VPC provides logically isolated networking in AWS. It is not a DNS registration and routing service.Question 4
A financial institution must connect its data center to AWS. The connection must use a dedicated private network connection with more consistent network performance than an internet-based connection. Which service should the institution use?
A. AWS Direct Connect
B. AWS Site-to-Site VPN
C. AWS Client VPN
D. Amazon CloudFront
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Direct Connect provides a dedicated network connection from an on-premises location to AWS. It can provide more consistent bandwidth and latency than connections that traverse the public internet. * **Why B is incorrect:** AWS Site-to-Site VPN creates an encrypted connection over the internet. It does not provide a dedicated physical network connection. * **Why C is incorrect:** AWS Client VPN is designed to provide remote users with secure access to AWS resources and networks. * **Why D is incorrect:** Amazon CloudFront is a content delivery network for distributing content to users from edge locations.Question 5
A company wants to securely connect its on-premises corporate network to resources in an Amazon VPC. The company prefers a solution that uses an encrypted connection over the public internet instead of a dedicated private circuit. Which service should the company use?
A. AWS Site-to-Site VPN
B. AWS Direct Connect
C. AWS Client VPN
D. AWS Transit Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Site-to-Site VPN creates an encrypted connection between an on-premises network and an Amazon VPC over the internet. * **Why B is incorrect:** AWS Direct Connect provides a dedicated private connection and does not primarily use an encrypted VPN tunnel over the public internet. * **Why C is incorrect:** AWS Client VPN is intended for individual remote users or client devices rather than connecting an entire corporate network to a VPC. * **Why D is incorrect:** AWS Transit Gateway acts as a central hub for connecting VPCs and on-premises networks. It does not itself provide the encrypted internet-based VPN connection.Question 6
A company has employees working remotely. The employees need secure access from their laptops to applications running in the company's AWS VPC. Which AWS service is designed for this requirement?
A. AWS Client VPN
B. AWS Site-to-Site VPN
C. AWS Direct Connect
D. Amazon Route 53
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Client VPN provides managed, client-based VPN access for individual users connecting from laptops or other client devices to AWS resources and on-premises networks. * **Why B is incorrect:** AWS Site-to-Site VPN connects networks, such as a corporate data center and a VPC. It is not primarily designed for individual remote-user connections. * **Why C is incorrect:** AWS Direct Connect provides a dedicated connection between a network and AWS. It is not a client-based remote access service. * **Why D is incorrect:** Amazon Route 53 provides DNS functionality and does not provide VPN access.Question 7
An online retailer wants product images, videos, and static web files to load quickly for customers around the world. The retailer wants AWS to cache this content close to users. Which service should the retailer use?
A. Amazon CloudFront
B. Amazon Route 53
C. AWS Global Accelerator
D. Amazon API Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon CloudFront is a content delivery network that caches and delivers content through a worldwide network of edge locations, reducing latency for users. * **Why B is incorrect:** Amazon Route 53 provides DNS services and can route users to endpoints, but it does not cache and deliver application content as a CDN. * **Why C is incorrect:** AWS Global Accelerator improves the availability and performance of applications by routing traffic through the AWS global network. It is not primarily a content caching service. * **Why D is incorrect:** Amazon API Gateway is used to create, publish, secure, and monitor APIs. It is not a general-purpose content delivery network.Question 8
A software provider offers a service running in a VPC. Customers in other VPCs must access the service privately without using public IP addresses, internet gateways, or NAT devices. Which AWS service should the provider use?
A. AWS PrivateLink
B. AWS Transit Gateway
C. Amazon CloudFront
D. AWS Global Accelerator
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS PrivateLink enables private connectivity between VPCs and supported services through interface VPC endpoints. Traffic does not need to traverse the public internet. * **Why B is incorrect:** AWS Transit Gateway provides a central routing hub for connecting multiple VPCs and networks. It is not specifically designed to privately publish a service to consumer VPCs. * **Why C is incorrect:** Amazon CloudFront distributes content through edge locations and is not the general solution for private VPC-to-service connectivity. * **Why D is incorrect:** AWS Global Accelerator provides global traffic acceleration using static anycast IP addresses. It does not provide private service access through VPC endpoints.Question 9
A company is building a serverless application and needs to expose RESTful and HTTP endpoints to clients. The company also needs features such as authentication, throttling, and API monitoring. Which AWS service should it use?
A. Amazon API Gateway
B. Amazon Route 53
C. AWS PrivateLink
D. Amazon CloudFront
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon API Gateway enables developers to create, publish, secure, monitor, and manage REST, HTTP, and WebSocket APIs. It supports capabilities such as authorization, throttling, and monitoring. * **Why B is incorrect:** Amazon Route 53 provides DNS and domain routing services but does not manage API endpoints or API authorization. * **Why C is incorrect:** AWS PrivateLink provides private connectivity to supported services through VPC endpoints. It is not an API management service. * **Why D is incorrect:** Amazon CloudFront accelerates the delivery of content and applications but does not provide the API management capabilities described.Question 10
A global application has users in multiple continents. The company needs a single set of static IP addresses and wants user traffic to be routed through the AWS global network to healthy application endpoints. The company also needs to expose managed HTTP APIs. Which TWO AWS services should the company use? (Select TWO)
A. AWS Global Accelerator
B. Amazon API Gateway
C. AWS Transit Gateway
D. Amazon Route 53
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** AWS Global Accelerator provides static anycast IP addresses and routes traffic through the AWS global network to healthy regional endpoints, improving availability and performance for global applications. * **Why B is correct:** Amazon API Gateway provides managed HTTP, REST, and WebSocket APIs, including features for securing, monitoring, and controlling API access. * **Why C is incorrect:** AWS Transit Gateway connects VPCs and on-premises networks through a central routing hub. It does not provide static global application IP addresses or API management. * **Why D is incorrect:** Amazon Route 53 provides DNS routing and health checks, but it does not provide static anycast IP addresses or API management.Question 11
A company is deploying a web application in a VPC. The application servers must be isolated from direct internet access, while users must still be able to access the application through a public load balancer. Which VPC design meets these requirements?
A. Place the load balancer in a public subnet and the application servers in private subnets
B. Place both the load balancer and application servers in a private subnet
C. Place both the load balancer and application servers in a public subnet
D. Place the load balancer in a private subnet and the application servers in a public subnet
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** A public subnet can host internet-facing resources, while private subnets can host application servers without direct internet access. * **Why B is incorrect:** A load balancer in a private subnet would not be directly accessible from the internet. * **Why C is incorrect:** Placing application servers in a public subnet exposes them to direct internet access. * **Why D is incorrect:** The application servers should not be placed in a public subnet, and a private load balancer cannot directly receive internet traffic.Question 12
A company wants to control inbound and outbound traffic at the subnet level in its VPC. Which AWS feature should the company use?
A. Network ACL
B. Security group
C. Amazon Route 53
D. AWS PrivateLink
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Network ACLs operate at the subnet level and can control inbound and outbound traffic. * **Why B is incorrect:** Security groups operate at the resource, such as an Amazon EC2 instance, level. * **Why C is incorrect:** Amazon Route 53 provides DNS and domain routing services. * **Why D is incorrect:** AWS PrivateLink provides private connectivity to supported services and endpoint services.Question 13
A development team needs a VPC security control that allows return traffic automatically when an outbound connection is permitted. Which feature provides this behavior?
A. Network ACL
B. Security group
C. AWS Transit Gateway
D. Amazon CloudFront
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** Security groups are stateful. Return traffic for an allowed inbound or outbound connection is automatically allowed. * **Why A is incorrect:** Network ACLs are stateless, so inbound and outbound rules must be configured separately. * **Why C is incorrect:** AWS Transit Gateway connects VPCs and networks through a central hub; it does not provide stateful instance-level filtering. * **Why D is incorrect:** Amazon CloudFront is a content delivery network, not a VPC traffic filtering control.Question 14
A company is hosting an application in a private subnet. The application must download software updates from the internet, but the application instances must not accept unsolicited inbound internet connections. Which solution should the company use?
A. An internet gateway with a public IP address assigned to each instance
B. A NAT gateway in a public subnet
C. AWS Direct Connect
D. AWS PrivateLink
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** A NAT gateway allows resources in private subnets to initiate outbound internet connections without allowing unsolicited inbound connections. * **Why A is incorrect:** Assigning public IP addresses and using an internet gateway exposes the instances to direct internet connectivity. * **Why C is incorrect:** AWS Direct Connect provides dedicated connectivity between an on-premises network and AWS, not general private-subnet internet access. * **Why D is incorrect:** AWS PrivateLink provides private access to supported services and endpoint services, not general internet access.Question 15
A company wants to use its registered domain name for an application hosted on AWS and route users to the application’s endpoint. Which AWS service should it use?
A. Amazon Route 53
B. Amazon CloudFront
C. AWS Global Accelerator
D. AWS API Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon Route 53 is a scalable DNS and domain name service that can route users to AWS resources and other endpoints. * **Why B is incorrect:** Amazon CloudFront caches and delivers content globally but is not primarily a domain registration and DNS service. * **Why C is incorrect:** AWS Global Accelerator improves application availability and performance by using static anycast IP addresses. * **Why D is incorrect:** AWS API Gateway creates and manages APIs rather than providing general-purpose DNS hosting.Question 16
A global media company wants static website content to be delivered from locations close to its customers. Which AWS service is designed for this requirement?
A. Amazon CloudFront
B. Amazon Route 53
C. AWS Site-to-Site VPN
D. AWS Transit Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon CloudFront is a content delivery network that caches and delivers content through globally distributed edge locations. * **Why B is incorrect:** Amazon Route 53 provides DNS and domain routing, not content caching and delivery. * **Why C is incorrect:** AWS Site-to-Site VPN creates encrypted connectivity between an on-premises network and a VPC. * **Why D is incorrect:** AWS Transit Gateway provides centralized connectivity between VPCs and other networks.Question 17
A company needs an encrypted connection between its on-premises data center and a VPC over the internet. The connection should be established quickly without waiting for a dedicated physical connection. Which service should the company use?
A. AWS Site-to-Site VPN
B. AWS Direct Connect
C. AWS Client VPN
D. AWS Global Accelerator
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Site-to-Site VPN creates an encrypted connection between an on-premises network and a VPC over the public internet. * **Why B is incorrect:** AWS Direct Connect provides a dedicated network connection and generally requires physical connectivity planning. * **Why C is incorrect:** AWS Client VPN is intended for individual users to connect remotely to AWS and on-premises resources. * **Why D is incorrect:** AWS Global Accelerator improves application availability and performance; it does not create an encrypted site-to-site connection.Question 18
A company has remote employees who need secure access to applications in a VPC from their laptops. Which AWS service should the company use?
A. AWS Client VPN
B. AWS Site-to-Site VPN
C. AWS Direct Connect
D. Amazon CloudFront
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Client VPN provides managed, client-based VPN access for individual users to connect securely to AWS resources and on-premises networks. * **Why B is incorrect:** AWS Site-to-Site VPN is designed to connect entire networks, not primarily individual remote users. * **Why C is incorrect:** AWS Direct Connect is a dedicated connection between networks and is not a client-based remote-access VPN. * **Why D is incorrect:** Amazon CloudFront distributes content and does not provide private remote-user access to VPC resources.Question 19
A large organization has many VPCs across multiple AWS accounts. The organization wants a central networking hub to simplify connectivity between the VPCs and its on-premises networks. Which service should it use?
A. AWS Transit Gateway
B. AWS PrivateLink
C. Amazon Route 53
D. AWS Site-to-Site VPN
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Transit Gateway acts as a central hub for connecting multiple VPCs and on-premises networks. * **Why B is incorrect:** AWS PrivateLink provides private access to specific services rather than acting as a general-purpose network hub. * **Why C is incorrect:** Amazon Route 53 provides DNS services and does not connect VPC networks. * **Why D is incorrect:** AWS Site-to-Site VPN creates encrypted connections but does not provide the same centralized hub architecture for many networks.Question 20
A software company wants customers in different AWS accounts to privately access a service running in the company’s VPC without exposing the service to the public internet. Which AWS service should the company use?
A. AWS PrivateLink
B. Amazon CloudFront
C. AWS Global Accelerator
D. Amazon Route 53
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS PrivateLink enables private connectivity between VPCs and supported services through interface VPC endpoints without requiring public internet access. * **Why B is incorrect:** Amazon CloudFront is designed for global content delivery, not private cross-account service access. * **Why C is incorrect:** AWS Global Accelerator routes internet traffic to applications using static anycast IP addresses. * **Why D is incorrect:** Amazon Route 53 provides DNS resolution and routing, not private service connectivity between VPCs.Question 21
A company is building a serverless backend and needs to publish REST and HTTP APIs for mobile and web applications. Which AWS service should it use?
A. AWS API Gateway
B. Amazon Route 53
C. AWS Transit Gateway
D. AWS Direct Connect
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS API Gateway is a managed service for creating, publishing, securing, monitoring, and managing APIs. * **Why B is incorrect:** Amazon Route 53 provides DNS services and does not manage application APIs. * **Why C is incorrect:** AWS Transit Gateway connects networks and VPCs. * **Why D is incorrect:** AWS Direct Connect provides dedicated network connectivity to AWS.Question 22
A company wants to improve the availability of a public application by routing users to healthy application endpoints in different AWS Regions. The company also wants static IP addresses for the application. Which service meets these requirements?
A. AWS Global Accelerator
B. Amazon CloudFront
C. Amazon Route 53
D. AWS PrivateLink
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Global Accelerator provides static anycast IP addresses and routes traffic over the AWS global network to healthy regional endpoints. * **Why B is incorrect:** Amazon CloudFront accelerates content delivery through caching and edge locations but does not provide the same static anycast application IP capability. * **Why C is incorrect:** Amazon Route 53 provides DNS-based routing but does not provide static anycast IP addresses for application endpoints. * **Why D is incorrect:** AWS PrivateLink provides private service access and is not intended for global public application acceleration.Question 23
A company requires a private, consistent network connection from its data center to AWS for large amounts of traffic. The connection should not use the public internet. Which service should the company choose?
A. AWS Direct Connect
B. AWS Site-to-Site VPN
C. AWS Client VPN
D. Amazon CloudFront
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Direct Connect provides a dedicated network connection from an on-premises location to AWS without traversing the public internet. * **Why B is incorrect:** AWS Site-to-Site VPN uses encrypted tunnels over the internet. * **Why C is incorrect:** AWS Client VPN is intended for remote user access rather than high-volume dedicated data center connectivity. * **Why D is incorrect:** Amazon CloudFront accelerates content delivery and does not provide a private data center-to-AWS connection.Question 24
A security team needs to allow HTTPS traffic to a web server while blocking all other inbound traffic. The control should be associated directly with the web server’s network interface. Which feature should the team use?
A. Security group
B. Network ACL
C. Amazon Route 53
D. AWS Transit Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Security groups are associated with network interfaces and can allow specific traffic, such as HTTPS on TCP port 443. * **Why B is incorrect:** Network ACLs are associated with subnets rather than individual network interfaces. * **Why C is incorrect:** Amazon Route 53 resolves domain names and does not filter network traffic. * **Why D is incorrect:** AWS Transit Gateway routes traffic among connected networks and does not provide resource-level traffic filtering.Question 25
A company wants a subnet-level traffic control that supports explicit allow and deny rules for inbound and outbound traffic. Which feature should it use?
A. Network ACL
B. Security group
C. AWS PrivateLink
D. Amazon API Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Network ACLs are subnet-level controls that support both allow and deny rules for inbound and outbound traffic. * **Why B is incorrect:** Security groups support allow rules and are associated with resources rather than subnets. * **Why C is incorrect:** AWS PrivateLink provides private service connectivity, not subnet-level filtering. * **Why D is incorrect:** Amazon API Gateway manages APIs and does not provide VPC subnet traffic control.Question 26
A company wants to expose a service hosted in a VPC to other VPCs privately. The consumers should not need internet gateways, public IP addresses, or complex network peering. Which solution is appropriate?
A. AWS PrivateLink
B. AWS Global Accelerator
C. Amazon CloudFront
D. AWS Direct Connect
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS PrivateLink provides private access to services through VPC endpoints without requiring public IP addresses or internet gateways. * **Why B is incorrect:** AWS Global Accelerator is intended for accelerating public application traffic. * **Why C is incorrect:** Amazon CloudFront distributes content through edge locations and is not a private VPC service access mechanism. * **Why D is incorrect:** AWS Direct Connect connects an on-premises network to AWS and is not primarily used for exposing a VPC service to other VPCs.Question 27
A company wants DNS-based routing that directs users to the AWS Region with the lowest network latency. Which service should provide this capability?
A. Amazon Route 53
B. AWS Global Accelerator
C. Amazon CloudFront
D. AWS Site-to-Site VPN
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon Route 53 supports latency-based routing, which can direct users to the Region that provides the lowest latency. * **Why B is incorrect:** AWS Global Accelerator uses the AWS global network to route traffic to optimal endpoints but is not a DNS-based routing service. * **Why C is incorrect:** Amazon CloudFront caches and serves content from edge locations. * **Why D is incorrect:** AWS Site-to-Site VPN provides encrypted network connectivity and does not perform application endpoint routing.Question 28
A company serves frequently accessed images and videos to customers around the world. The company wants to reduce latency and reduce the number of requests sent to its origin servers. Which service should it use?
A. Amazon CloudFront
B. Amazon Route 53
C. AWS PrivateLink
D. AWS Transit Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon CloudFront caches content at edge locations, reducing latency for users and reducing requests sent to the origin. * **Why B is incorrect:** Amazon Route 53 resolves DNS queries but does not cache and deliver application content. * **Why C is incorrect:** AWS PrivateLink provides private service connectivity. * **Why D is incorrect:** AWS Transit Gateway connects networks and does not distribute content globally.Question 29
A company has a VPC with no route to the public internet. It needs private access from resources in the VPC to a supported AWS service without using a NAT gateway. Which service or feature should it use?
A. AWS PrivateLink
B. Internet gateway
C. AWS Global Accelerator
D. Amazon CloudFront
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS PrivateLink, through VPC endpoints, enables private connectivity to supported services without requiring internet access or a NAT gateway. * **Why B is incorrect:** An internet gateway provides internet connectivity and would not provide private access by itself. * **Why C is incorrect:** AWS Global Accelerator is for improving public application availability and performance. * **Why D is incorrect:** Amazon CloudFront is a content delivery service and is not a general private endpoint for AWS services.Question 30
A company is connecting several VPCs and an on-premises network through AWS Transit Gateway. The company wants to control which connected networks can communicate with one another. Which Transit Gateway capability supports this design?
A. Transit Gateway route tables
B. Amazon Route 53 hosted zones
C. CloudFront distributions
D. Security groups attached to individual users
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Transit Gateway route tables control how traffic is routed between attached VPCs, VPN connections, Direct Connect connections, and other networks. * **Why B is incorrect:** Amazon Route 53 hosted zones provide DNS resolution and do not control Transit Gateway network paths. * **Why C is incorrect:** CloudFront distributions deliver content globally and do not control Transit Gateway routing. * **Why D is incorrect:** Security groups apply to resources such as network interfaces, not to individual users or Transit Gateway attachments.Question 31
A company wants to inspect its AWS resources for unintended network exposure and potential security vulnerabilities. Which AWS service can help identify vulnerabilities in supported workloads?
A. Amazon Inspector
B. Amazon Route 53
C. AWS Direct Connect
D. Amazon API Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon Inspector automatically assesses supported AWS workloads for software vulnerabilities and unintended network exposure. * **Why B is incorrect:** Amazon Route 53 provides DNS and domain routing services. * **Why C is incorrect:** AWS Direct Connect provides dedicated network connectivity. * **Why D is incorrect:** Amazon API Gateway manages APIs and does not perform general workload vulnerability assessments.Question 32
A company needs to connect its corporate network to AWS. It requires encrypted connectivity over the internet and wants the connection to terminate at a VPC. Which two solutions can provide network connectivity to AWS? (Select TWO)
A. AWS Site-to-Site VPN
B. AWS Direct Connect
C. Amazon CloudFront
D. Amazon Route 53
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** AWS Site-to-Site VPN provides encrypted connectivity between an on-premises network and a VPC over the internet. * **Why B is correct:** AWS Direct Connect provides dedicated connectivity between an on-premises network and AWS, which can be used to access VPC resources. * **Why C is incorrect:** Amazon CloudFront is a content delivery network, not an on-premises network connectivity service. * **Why D is incorrect:** Amazon Route 53 provides DNS services and does not establish network connectivity.Question 33
A company is designing a three-tier application in a VPC. Which two components are commonly used to control network placement and traffic within the VPC? (Select TWO)
A. Subnets
B. Security groups
C. Amazon CloudFront distributions
D. Amazon Route 53 hosted zones
Click to view Answer & Explanation
**Correct Answers:** A and B **Explanation:** * **Why A is correct:** Subnets divide a VPC’s IP address range and provide network placement for resources, such as public and private application tiers. * **Why B is correct:** Security groups control traffic to resources associated with them. * **Why C is incorrect:** CloudFront distributions deliver content through edge locations and are not VPC network placement components. * **Why D is incorrect:** Route 53 hosted zones provide DNS resolution and are not used to place resources within VPC subnets.Question 34
A company is launching a public website and wants users to reach the website by entering a human-readable domain name. The company also wants DNS health checks to help route users away from unhealthy endpoints. Which service should it use?
A. Amazon Route 53
B. AWS Client VPN
C. AWS PrivateLink
D. AWS Transit Gateway
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon Route 53 provides DNS, domain name management, health checks, and routing policies for application endpoints. * **Why B is incorrect:** AWS Client VPN provides secure remote access for users. * **Why C is incorrect:** AWS PrivateLink provides private access to services through VPC endpoints. * **Why D is incorrect:** AWS Transit Gateway connects VPCs and networks through a central routing hub.Question 35
A company has an application with users across the world. The application is hosted in multiple AWS Regions, and the company wants traffic to be directed to healthy endpoints using the AWS global network. Which service should it use?
A. AWS Global Accelerator
B. Amazon Route 53
C. AWS Site-to-Site VPN
D. AWS PrivateLink
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS Global Accelerator routes traffic through the AWS global network to healthy application endpoints in supported AWS Regions. * **Why B is incorrect:** Amazon Route 53 provides DNS-based routing, but it does not provide the same global network acceleration capability. * **Why C is incorrect:** AWS Site-to-Site VPN connects networks securely over the internet. * **Why D is incorrect:** AWS PrivateLink is intended for private service connectivity, not global public application acceleration.Question 36
A company wants to provide employees with secure remote access to VPC resources. Employees will connect individually from different locations using VPN client software. Which service should the company use?
A. AWS Client VPN
B. AWS Direct Connect
C. AWS Transit Gateway
D. Amazon CloudFront