Free Amazon ANS-C01 Exam Dumps Questions & Answers

A company runs workloads in multiple VPCs. The company needs to securely access a workload in one of the VPCs, named VPC-A, from an on-premises data center. A network engineer sets up an AWS Site-to-SiteVPN connection to a transit gateway. The network engineer configures dynamic routing for the connection, and communication works properly.
Recently, the owner of VPC-A added another CIDR range to the VPC. The VPC-A owner created workloads that use the additional CIDR range.
The company's on-premises network is unable to reach the new workloads. The network engineer needs to resolve the network connectivity issue and ensure that connectivity will not be affected if additional VPC CIDR ranges are added to the VPC in the future.
Which solution will meet these requirements with the MOST operational efficiency?

• A.  Configure route propagation for VPC-A to the VPN attachment route table.
• B.  Manually update the VPN attachment route table to include the new CIDR range.
• C.  Configure an Amazon EventBridge rule to invoke an AWS Lambda function when the rule to matches an update to the VPC-A CIDR range. Configure the Lambda function to update the VPN attachment route table.
• D.  Configure an Amazon CloudWatch alarm to invoke an AWS Lambda function when there is an update to the VPC-A CIDR range. Configure the Lambda function to update the VPN attachment route table.Restart the VPN tunnels.

A company is using Amazon Route 53 Resolver DNS Firewall in a VPC to block all domains except domains that are on an approved list. The company is concerned that if DNS Firewall is unresponsive, resources in the VPC might be affected if the network cannot resolve any DNS queries. To maintain application service level agreements, the company needs DNS queries to continue to resolve even if Route 53 Resolver does not receive a response from DNS Firewall.
Which change should a network engineer implement to meet these requirements?

• A.  Update the DNS Firewall VPC configuration to disable fail open for the VPC.
• B.  Create a new DHCP options set with parameter dns_firewall_fail_open=true. Associate the new DHCP options set with the VPC.
• C.  Create a new DHCP options set with parameter dns_firewall_fail_open=false. Associate the new DHCP options set with the VPC.
• D.  Update the DNS Firewall VPC configuration to enable fail open for the VPC.

A company has a new AWS Direct Connect connection between its on-premises data center and the AWS Cloud. The company has created a new private VIF on this connection. However, the VIF status is DOWN.
A network engineer verifies that the physical connection status is UP and RUNNING based on information from the AWS Management Console. The network engineer checks the customer Direct Connect router and can see the ARP entry for the VLAN interface created for the private VIF at AWS.
What could be causing the private VIF to have a DOWN status?

• A.  The IEEE 802.1Q VLAN identifier is misconfigured on the customer Direct Connect router.
• B.  TCP port 179 is blocked on the customer Direct Connect router.
• C.  ICMP is blocked on the customer Direct Connect router.
• D.  The company has configured IEEE 802.1ad instead of 802.1Q on the customer Direct Connect router.

An organization launched an IPv6-only web portal to support IPv6-native mobile clients. Front-end instances launch in an Amazon VPC associated with an appropriate IPv6 CIDR. The VPC IPv4 CIDR is fully utilized.
A single subnet exists in each of two Availability Zones with appropriately configured IPv6 CIDR associations. Auto Scaling is properly configured, and no Elastic Load Balancing is used.
Customers say the service is unavailable during peak load times. The network engineer attempts to launch an instance manually and receives the following message: "There are not enough free addresses in subnet
'subnet-12345677' to satisfy the requested number of instances."
What action will resolve the availability problem?

• A.  Create a new subnet using a VPC secondary IPv6 CIDR, and associate an IPv6 CIDR. Include the new subnet in the Auto Scaling group.
• B.  Resize the IPv6 CIDR on each of the existing subnets. Modify the Auto Scaling group maximum number of instances.
• C.  Create a new subnet using a VPC secondary IPv4 CIDR, and associate an IPv6 CIDR. Include the new subnet in the Auto Scaling group.
• D.  Add a secondary IPv4 CIDR to the Amazon VPC. Assign secondary IPv4 address space to each of the existing subnets.

A company has five VPCs in the us-east-1 Region. The company hosts an internal web application in us-east-
1. One of the company's VPCs. named VPC-A, needs to connect to an external partner's AWS environment.
The partner's environment is in the same AWS Region where the partner hosts a new version of the company's web application. The partner hosts its version of the application in a VPC named VPC-B.
The company has Amazon EC2 instances in VPC-A that need to connect to the web application in VPC-B A network engineer notices that the partner's VPC-B and the company's VPC-A use the same IP space. The network engineer needs a solution to allow the EC2 instances to connect to the web application. The solution must not negatively affect the exiting environment of the company or the partner.
Which combination of steps should the network engineer take meet these requirements? (Choose two.)

• A.  Deploy a VPC endpoint in VPC-A that uses a VPC endpoint service that is shared by the partner.
• B.  Ensure the partner creates a VPC endpoint service that uses a Network Load Balancer in VPC-B.
• C.  Establish an AWS Site-to-Site VPN connection between VPC-A and VPC-B.
• D.  Establish a VPC peering connection between VPC-A to VPC-B.
• E.  Deploy a new routable VPC CIDR block as a secondary CIDR block to both VPC-A and VPC-B.
  Deploy a public NAT gateway in VPC-A.