AWS Advanced Networking Specialty Practice Test

Answer choices

1. A. Network Firewall requires every flow to be intentionally asymmetric for scale, under the documented operational and governance requirements.
2. B. Stateful inspection requires symmetric routing so both directions of a flow traverse the corresponding firewall path consistently, for the affected environment.
3. C. Route 53 must resolve both directions to the same firewall IP, for the described technical objective and its associated operational control requirements, in practice.
4. D. The firewall must be replaced with a stateless security group, as the recommended implementation across the complete governed service lifecycle.

Wrong-answer review

• A. Network Firewall requires every flow to be intentionally asymmetric for scale, under the documented operational and governance requirements.: Incorrect. Stateful firewall processing depends on seeing both directions of the connection; arbitrary asymmetry breaks state tracking.
• C. Route 53 must resolve both directions to the same firewall IP, for the described technical objective and its associated operational control requirements, in practice.: Incorrect. The problem is IP routing symmetry through stateful inspection, not DNS answer symmetry.
• D. The firewall must be replaced with a stateless security group, as the recommended implementation across the complete governed service lifecycle.: Incorrect. Security groups do not replace a centralized Network Firewall inspection architecture.

Answer choices

1. A. Increase the IKE lifetime on the single configured tunnel, for the described technical objective and its associated operational control requirements, as proposed.
2. B. Configure both VPN tunnels on the customer gateway and make both eligible to carry traffic, within the described operational context.
3. C. Create two static routes that both point to the same configured tunnel, as the primary implementation for the described business requirement.
4. D. Disable tunnel endpoint updates in AWS, within the documented operational, security, ownership, and validation requirements.

Answer choices

1. A. Set the endpoint-group traffic dial to 90 and 10 simultaneously, for evaluation.
2. B. Set Route 53 weighted records for the accelerator static IP addresses.
3. C. Configure endpoint weights, for the described technical objective and its associated operational control requirements.
4. D. Set different CloudFront cache TTLs for the two endpoints, for the stated requirement.

Answer choices

1. A. Yes. An attachment must be associated with every route table to which it propagates, for the described technical objective and its associated operational control requirements, for this task.
2. B. Yes, but only for inter-Region peering attachments, for the described technical objective and its associated operational control requirements, within the . network design (30%) context.
3. C. No. Association and propagation are separate; an attachment is associated with one route table while its routes can propagate to other route tables.
4. D. No, because Transit Gateway route tables cannot accept propagated routes, for the described technical objective and its associated operational control requirements, for the required . network design (30%) outcome.

Answer choices

1. A. Configure an HTTPS listener on an Application Load Balancer with an ACM-managed server certificate and an appropriate security policy, in the described situation.
2. B. Put the ACM certificate on a Route 53 hosted zone, for the described technical objective and its associated operational control requirements, within the proposed design.
3. C. Use a network ACL to perform TLS decryption before traffic reaches the ALB, within the defined security and accountability boundaries.
4. D. Use a Gateway Load Balancer to terminate browser TLS and inspect URL paths, as the primary implementation for the described business requirement.

Answer choices

1. A. Add routes in the relevant subnet route tables in both VPCs that point the peer CIDR to the peering connection, under end-to-end security-and-governance requirements.
2. B. Enable transitive routing through a third peered VPC, for the described technical objective and its associated operational control requirements, for the stated implementation and support requirements.
3. C. Add the peer CIDR only to the source VPC route table, as the primary implementation for the described business requirement.
4. D. Attach the peering connection to a Transit Gateway route table, for the described technical objective and its associated operational control requirements.

Answer choices

1. A. Yes. 5 Gbps tunnels automatically support jumbo frames end to end, within the proposed design.
2. B. Yes, but only when the VPN is attached to a virtual private gateway, within cross-functional operational-accountability boundaries.
3. C. No. The documented MTU limit remains 1500 bytes for Large Bandwidth Tunnels, for the affected environment.
4. D. No, because all Site-to-Site VPN tunnels are limited to 576 bytes, in practice.

Answer choices

1. A. The request is automatically sent to every target group registered with the ALB, for the specified implementation requirement.
2. B. The request is handed to Route 53 for a second routing decision, under end-to-end security-and-governance requirements.
3. C. The ALB converts the request to a Network Load Balancer flow, for the stated security, delivery, and accountability requirements.
4. D. The listener applies its default rule and forwards, redirects, or returns the configured default action, for the required business outcome.

Answer choices

1. A. Reduce the VPC route-table MTU, for the required . network security, compliance, and governance (24%) outcome, for this requirement.
2. B. Change the source ENI security group to deny the traffic after it has been mirrored, under this approach.
3. C. Narrow the traffic mirror filter so only relevant protocols, ports, or address ranges are mirrored.
4. D. Lower the DNS TTL of the mirror target, for the described technical objective and its associated operational control requirements, as described.

Answer choices

1. A. Use infrastructure as code as the source of truth, detect drift/events, and invoke controlled automation to reconcile approved configuration, for the stated requirement.
2. B. Allow event handlers to create arbitrary network resources with no template or policy boundary, under the stated technical, operational, and governance constraints.
3. C. Disable drift detection and rely on weekly manual comparisons, for the described technical objective and its associated operational control requirements.
4. D. Hardcode VPC, subnet, and account identifiers inside every remediation function, as the primary implementation for the described business requirement.