Question 1

A company has an AWS environment that includes multiple VPCs that are connected by a transitgateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establishconnectivity between an on-premises environment and the AWS environment. The company doesnot have a static public IP address for the on-premises environment.Which combination of steps should the company take to establish VPN connectivity between the transit gateway and the on-premises environment? (Choose two.)

A.Create a public certificate in AWS Certificate Manager (ACM).

B.Create a private certificate in AWS Certificate Manager (ACM).

C.Configure the Site-to-Site VPN tunnels to use the pre-shared key (PSK).

D.Create a customer gateway. Specify the current dynamic IP address of the customer gatewaydevice's external interface.

E.Create a customer gateway. Do not specify the IP address of the customer gateway device.

Answer: B,D

Question 2

A company has two teams: Team A and Team B. Team A has VPCs that run in AccountA.The teamuses a transit gateway (TGW-A) to route traffic between workloads that run in the different VPCs.Similarly, Team Ð’ has VPCs that run in Account B. Team Ð’ uses a different transit gateway (TGW-B) to route traffic between workloads that run in the different VPCs.The company's network team manages the routing for Team A and Team Ð’. The network team wantsto retire TGW-B and use a single transit gateway to manage routing for the VPCs of both teams.Which solution will meet this requirement with the LEAST operational overhead?

A.Create a resource share for TGW-A Share TGW-A with Account B. Create VPC attachments for theVPCs in Account Ð’. Configure routing for the VPCs in TGW-A route tables. Update the route tables ofthe VPCs in Account Ð’ to forward traffic to TGWA.Delete TGW-B attachments and TGW-B

A. Share TGW-A with Account Ð’. Replicate the TGW-Bconfiguration to TGW-A to automatically start routing changes for the VPCs in Account Ð’. DeleteTGW-B when routing changes are complete.

C.Create a new transit gateway (TGW-C) in AccountA. Create a resource share for TGW-C. ShareTGW-C with Account B. Create VPC attachments for the VPCs in Account A and Account Ð’. Configurerouting for all the VPCs in TGW-C route tables. Update the route tables for the VPCs in Account A andAccount Ð’ to forward traffic to TGW-C. Delete TGW-A attachments and TGW-B attachments. DeleteTGW-A and TGW-B.

D.Create a new transit gateway (TGW-C) in a new account (Account C). Create a resource share forTGW-C. Share TGW-C with Account A and Account B. Create VPC attachments for the VPCs inAccount A and Account Ð’. Configure routing for all the VPCs in TGW-C route tables. Update the routetables for the VPCs in Account A and Account Ð’ to forward traffic to TGW-C. Delete TGW-Aattachments and TGW-B attachments. Delete TGW-A and TGW-B.

Answer: A

Question 3

A company has several AWS Site-to-Site VPN connections between an on-premises customergateway and a transit gateway. The company's application uses IPv4 to communicate through theVPN connections.The company has updated the VPC to be dual stack and wants to transition to using IPv6-only for newworkloads. When the company tries to communicate through the existing VPN connections, IPv6traffic fails.Which solution will provide IPv6 support with the LEAST operational overhead?

A.Create a new Site-to-Site VPN connection that supports IPv6.

B.Create a new Site-to-Site VPN connection to a self-managed Amazon EC2 instance that runs opensource software.

C.Update the existing Site-to-Site VPN connections to support IPv6.

D.Update the on-premises customer gateway's public IP address from IPv4 to IPv6.

Answer: A

Question 4

A company uses transit gateways to route traffic between the company's VPCs. Each transit gatewayhas a single route table. Each route table contains attachments and routes for the VPCs that are inthe same AWS Region as the transit gateway. The route tables in each VPC also contain routes to allthe other VPC CIDR ranges that are available through the transit gateways. Some VPCs route to localNAT gateways.The company plans to add many new VPCs soon. A network engineer needs a solution to add newVPC CIDR ranges to the route tables in each VPC.Which solution will meet these requirements in the MOST operationally efficient way?

A.Create a new customer-managed prefix list. Add all VPC CIDR ranges to the new prefix list. Updatethe route tables in each VPC to use the new prefix list ID as the destination and the appropriatetransit gateway ID as the target.

B.Turn on default route table propagation for the transit gateway route tables. Turn onroute propagation for each route table in each VPC.

C.Update the route tables in each VPC to use 0.0.0.010 as the destination and the appropriate transitgateway ID as the target.

D.Turn on default route table association for the transit gateway route tables. Turn on routepropagation for each route table in each VPC.

Answer: A

Question 5

A company runs a workload in a single VPC on AWS. The companys architecture contains severalinterface VPC endpoints for AWS services, including Amazon CloudWatch Logs and AWS KeyManagement Service (AWS KMS). The endpoints are configured to use a shared security group. Thesecurity group is not used for any other workloads or resources.After a security review of the environment, the company determined that the shared security groupis more permissive than necessary. The company wants to make the rules associated with thesecurity group more restrictive. The changes to the security group rules must not prevent theresources in the VPC from using AWS services through interface VPC endpoints. The changesmust prevent unnecessary access.The security group currently uses the following rules:Inbound - Rule 1Protocol: TCPPort: 443Source: 0.0.0.0/0Inbound - Rule 2Protocol: TCPPort: 443Source: VPC CIDROutbound - Rule 1Protocol: AllPort: AllDestination: 0.0.0.0/0Which rule or rules should the company remove to meet with these requirements?

A.Outbound - Rule 2

B.Inbound - Rule 1 and Outbound - Rule 1

C.Inbound - Rule 2 and Outbound - Rule 1

D.Outbound - Rule 1

Answer: B