ANS-C01 sample exam questions

An NLB is a valid traffic mirror target, and it spreads mirrored traffic across an Auto Scaling group of analysis instances for scale and availability. ALBs are not supported targets, and a Gateway Load Balancer is used through its endpoint rather than directly as a target.

ALB access logs include the client IP, target IP and port, and user agent, and they are stored in S3, where Athena can query them with no servers. Spreadsheets do not scale, and ALBs do not stream logs directly to Kinesis.

Forward secrecy uses a unique random session key, which stops captured traffic being decrypted later even if the long-term key is exposed. On an ALB, this comes from selecting a security policy with FS ciphers. TLS 1.2 alone does not guarantee it, and KMS and WAF do not control TLS sessions.

The VPC CNI uses secondary addresses for pods, and pkt-srcaddr and pkt-dstaddr show the pod IPs rather than the node's address. Creating flow logs on the two application subnets limits logs to those clusters, with autoscaling nodes covered automatically. EKS nodes are not a flow log resource, and the default format omits these fields.

ALB access logs are delivered only to S3, so choose a bucket and query them with Athena to find the errors. ALB access logs cannot be sent directly to CloudWatch Logs, and CloudWatch Logs does not pull them from S3 automatically.

Customer-managed prefix lists keep versions of their entries, and AWS RAM can share them with the whole organization. Security groups cannot be shared this way with the organization, Firewall Manager does not share prefix lists, and a DynamoDB and Lambda design requires custom code.

Maximum resiliency uses two Direct Connect locations with two separate connections at each, terminating on different routers, so 4 Gbps is still available after circuit or router failures. Two connections leave no spare after one failure at a location, and 1 Gbps links would drop below 4 Gbps after a failure.

Route 53 Resolver query logging records the domains queried from VPCs, and it can deliver through Kinesis Data Firehose to push to the SIEM. Flow logs show IP addresses rather than domain names, Traffic Mirroring is costly, and the CloudWatch agent does not log DNS requests from WorkSpaces this way.

A Gateway Load Balancer in a central VPC attached to the transit gateway sends all traffic through next-generation firewalls that perform deep packet inspection inline, and they can log to a central S3 bucket. ALBs do not handle this traffic, security groups do not inspect packet contents, and Traffic Mirroring per interface only copies traffic and adds work.

An existing Direct Connect VIF can have IPv6 added as a new peer, using the address AWS provides. A Site-to-Site VPN connection carries one address family, so IPv6 needs another VPN connection, and keeping the IPv4 one means a backup always remains. Replacing connections takes longer and removes the backup during change.

AWS PrivateLink lets each VPC reach the partner service through its own interface endpoint, regardless of overlapping addresses. Peering and transit gateway routing do not work with overlaps. NAT and VPN designs are complex and unnecessary.

A Site-to-Site VPN to each VPC can be set up quickly and handles 800 Mbps, with BGP adjusting routes automatically. Direct Connect takes longer and costs more for testing, it cannot use OSPF, and static routes need manual updates.

Global Accelerator supports cross-account attachments, so Account-B shares the ALB and Account-A's accelerator can use it as an endpoint. The networking team keeps full control. AWS RAM does not share accelerators in this way, and an NLB in the middle adds infrastructure.

Direct Connect events reach EventBridge, and a rule can invoke Lambda immediately to call the ticketing API, at almost no cost for one event a day. Polling every minute is wasteful and adds delay, and a DynamoDB step adds complexity with no benefit.

Route 53 Resolver rules can be shared through AWS RAM, so the new account's VPCs can use the existing outbound endpoint with no new endpoint charges. Sharing the rule is enough, and another endpoint or VPN adds cost. The connectivity already exists through the transit gateway.