Question 30
A consumer VPC already has an interface endpoint to a private API, but application queries resolve the vendor hostname to a public address and egress toward a blocked internet route. Private DNS was intentionally disabled. What DNS configuration would fix the private endpoint path?
- Create only an endpoint policy granting the application role access but leave the public DNS answer unchanged.
- Add a private Route 53 zone with a record that still aliases to the vendor public IP instead of an endpoint-specific DNS name.
- Add a public internet gateway route while keeping all DNS queries directed to the public service address.
- Enable supported private DNS for the interface endpoint or configure appropriate private hosted-zone records pointing to endpoint DNS names.
Explanation
Correct Answer
D:The endpoint network interface exists but clients must resolve the service name to its private endpoint addresses to use the intended path.
Incorrect Answers
A:Endpoint policy authorizes requests that reach the endpoint; it does not remap hostname resolution to the private ENI addresses.
B:A private hosted-zone record must point clients to the interface endpoint DNS target or private address, not the inaccessible public service address.
C:Public egress violates the requirement to use the existing private endpoint and does not fix name resolution.
Question 31
A company has a working Direct Connect link to a networking VPC. Its on-premises backup client must upload directly to Amazon S3 over privately addressed endpoints without using public S3 IP addresses. EC2 workers in the networking VPC already use an inexpensive S3 gateway endpoint. Which additional endpoint design supports the on-premises client while preserving the existing EC2 path?
- Share the existing S3 gateway endpoint route-table entry through Transit Gateway so the data center can address the gateway as a private ENI.
- Create a Direct Connect public VIF and advertise public S3 prefixes, treating the public service addresses as private endpoint ENI addresses.
- Create an S3 interface VPC endpoint reachable over Direct Connect with the appropriate endpoint security groups and DNS; retain the S3 gateway endpoint for in-VPC clients.
- Use an S3 Access Point to authorize the transfer and retain only the existing gateway endpoint, assuming on-premises clients can reach that gateway endpoint directly.
Explanation
Correct Answer
C:S3 interface endpoints provide private ENI IP addresses reachable from on-premises through Direct Connect. Using both endpoint types lets local VPC clients keep the gateway path while hybrid clients use the interface path.
Incorrect Answers
A:S3 gateway endpoints are regional route-table targets for participating VPC subnets, not addressable endpoint ENIs that on-premises networks can traverse.
B:A public Direct Connect virtual interface can reach supported public AWS services but does not satisfy the requirement for privately addressed interface endpoints.
D:Access points control object authorization; gateway endpoints are not privately addressed ENIs reachable by a data-center client.
Question 32
A private IPv6-only application tier needs to communicate with a legacy IPv4-only API over the internet, without allocating public IPv4 addresses to the tier. The VPC has suitable IPv6 routing and an outbound translation layer. Which protocol translation feature enables the DNS name to work?
- Enable DNS64 on the source IPv6-only subnet but route the synthesized 64:ff9b::/96 destinations only to an egress-only internet gateway.
- Provision a NAT gateway for IPv6-to-IPv4 translation but leave DNS64 disabled for applications that connect by IPv4-only hostnames.
- Use DNS64 with NAT64-capable routing through a supported NAT gateway for the IPv4-only destination.
- Use an egress-only internet gateway alone for IPv4 translation, because it converts all IPv6 requests to IPv4.
Explanation
Correct Answer
C:DNS64 synthesizes suitable IPv6 DNS answers and NAT64 translates outbound packets between an IPv6-only client and IPv4 target.
Incorrect Answers
A:DNS64 alone produces synthesized IPv6 answers, but without a NAT64-capable NAT gateway route it cannot translate to the IPv4-only service.
B:NAT64 needs reachable synthesized IPv6 destinations; without DNS64 these IPv6-only clients cannot resolve the IPv4-only hostname into the needed path.
D:An egress-only IPv6 gateway filters inbound connections but does not itself perform NAT64 translation.
Question 33
A financial application VPC resolves public SaaS domains through the Amazon-provided VPC Resolver. Security detects malware attempting to resolve known command-and-control domains, and wants request-time DNS filtering without operating a fleet of custom DNS servers. How should the VPC resolver path be secured?
- Create Route 53 Resolver DNS Firewall rule groups blocking the approved malicious domain lists, associate them with the application VPC and test allowed and blocked resolutions.
- Enable Route 53 Resolver query logging without a DNS Firewall rule group associated to the VPC.
- Apply an AWS Network Firewall IP-set deny list to the VPC egress route but leave the DNS resolver unrestricted.
- Create DNS Firewall domain lists and rule groups but attach them only to a different VPC used by the security team.
Explanation
Correct Answer
A:Resolver DNS Firewall applies domain-based rules at the VPC Resolver path; association to the VPC is necessary before the blocked names are filtered.
Incorrect Answers
B:Query logs provide detective evidence but do not block a malicious domain during name resolution.
C:Network-layer IP denies are not the requested request-time Resolver hostname filter and may not cover changing C2 DNS targets.
D:DNS Firewall protection applies to associated VPCs; an unattached application VPC will not enforce the security rule group.
Question 34
A private-link design accesses three AWS APIs from EC2 with no internet access. The team deployed endpoints but one service remains unreachable because the interface endpoint security group allows HTTPS only from the wrong client subnet. What should be changed?
- Increase the IAM role permissions to administrator and assume that bypasses ENI security group filtering.
- Open port 443 on the interface endpoint policy to the application principal while leaving the endpoint ENI security group denying the source subnet.
- Permit TCP 443 from the correct application security group or subnet range on the endpoint ENI security group, retaining least privilege.
- Allow TCP 443 to the instance egress security group but leave the endpoint security group rejecting the connection.
Explanation
Correct Answer
C:Interface endpoints are ENIs; their security groups must allow client connection traffic, independent of the application identity policy.
Incorrect Answers
A:Identity authorization does not override VPC networking rules blocking the TCP session.
B:Endpoint policies govern API authorization rather than TCP 443 ingress; the endpoint security group must permit the client network.
D:Client egress permission alone cannot overcome the destination endpoint ENI ingress restriction.
Question 35
An analytics VPC connects to a shared services VPC using Transit Gateway. A connectivity incident affects only traffic to one remote CIDR. The network team needs a control-plane preview of the intended route path without creating a synthetic application session. Which diagnostic tool is best?
- Use VPC Reachability Analyzer alone and assume it reports the full Transit Gateway route-analysis path through all inter-Region TGW attachments.
- Inspect only the VPC subnet route toward Transit Gateway and ignore the source TGW attachment association and destination route entries.
- Search Transit Gateway flow logs for last week and treat historical packet telemetry as the requested control-plane path preview.
- Inspect Transit Gateway route tables, attachment associations and propagations, then use route analysis tools to confirm the exact forwarded destination.
Explanation
Correct Answer
D:Transit gateway routing is controlled by association and propagated/static prefix entries, which determine the intended next attachment.
Incorrect Answers
A:Reachability Analyzer can model supported VPC paths but is not the TGW Global Networks route-table-specific Route Analyzer requested.
B:A VPC route to TGW does not identify the selected next attachment for the remote CIDR.
C:Flow logs provide observed flow metadata, not a prospective control-plane route-table analysis before traffic is sent.
Question 36
Operations sees packet loss between an application VPC and a partner VPC. The partner route is correct, but the team needs network-level flow evidence showing whether packets reach an interface, are accepted, or are rejected. Which telemetry should be enabled?
- Enable only Transit Gateway route-table route inspection and expect it to show whether a security group rejected an individual connection attempt.
- Review CloudTrail management events alone and treat them as a packet capture of every TCP exchange.
- Create only VPC Reachability Analyzer path tests and treat their modeled possible path as measured packet accept/reject events.
- Capture VPC Flow Logs for the relevant network interfaces or subnet and correlate accepted/rejected flows with security-group and NACL rules.
Explanation
Correct Answer
D:Flow logs provide network-flow metadata that can distinguish observed packet paths and filtering outcomes from absent application logs.
Incorrect Answers
A:Route-table inspection finds forwarding configuration but cannot report the accepted/rejected interface-flow records.
B:CloudTrail API history does not record individual network flows or security group accept/reject decisions.
C:Reachability Analyzer models configuration reachability; VPC Flow Logs are needed for observed interface flow metadata and filter decisions.
Question 37
A hybrid enterprise has three Direct Connect circuits and regional VPN backups. The network team wants route-selection evidence after a planned DX circuit shutdown and must avoid assuming that BGP preference alone guarantees application availability. Which validation test is most appropriate?
- Verify only that the standby BGP peer has Established status before the simulated failure, without withdrawing the production Direct Connect path.
- Change the primary Direct Connect BGP local-preference community and declare the test complete without simulating a failed path.
- Perform controlled DX withdrawal, verify BGP route convergence and tested application flows over the remaining DX or VPN path.
- Inspect historical Direct Connect connection state metrics without testing bidirectional flows over the alternate circuit or VPN.
Explanation
Correct Answer
C:A realistic outage drill tests route advertisements, return paths, security rules and application recovery rather than just the BGP session state.
Incorrect Answers
A:A healthy standby BGP session does not prove route convergence and end-to-end client traffic after primary circuit withdrawal.
B:BGP policy configuration cannot substitute for exercising an actual withdrawal and verifying application forwarding.
D:Past physical link health is not evidence of usable application traffic or correct return routing during a planned outage.
Question 38
A company advertises the same on-premises /20 prefix through two private Direct Connect virtual interfaces at separate locations. BGP AS paths and prefix lengths are equal, but AWS-initiated return traffic should prefer circuit A while keeping circuit B as standby. Which supported Direct Connect routing signal can influence AWS path selection?
- Set the same BGP MED value on both Direct Connect advertisements but expect it to override documented AWS local-preference communities.
- Advertise the same prefix using BGP local-preference community 7224:7300 on circuit A and 7224:7100 on circuit B, and test failover.
- Set 7224:7300 on both circuits and expect AWS to make A active and B passive despite identical community preferences.
- Change only the transit gateway’s allowed-prefix association list, without applying any route-preference attributes to the equivalent advertised on-premises prefix.
Explanation
Correct Answer
B:For private/transit VIFs, Direct Connect supports high/low local-preference BGP communities on customer-advertised prefixes to select AWS-to-on-premises return paths.
Incorrect Answers
A:For equal-prefix Direct Connect return-path preference, the supported AWS local-preference communities are the explicit controlling signal.
C:Identical high-preference community tags do not distinguish A from B as primary and backup routes.
D:The DX gateway allowed-prefix list governs prefix announcement from AWS to customers; it does not express priority between equal customer-advertised return paths.
Question 39
A team has a Transit Gateway attachment to a shared egress VPC and observes internet-bound traffic from spoke VPCs taking a direct internet gateway in those spokes. The organization requires all egress to cross the centralized inspection stack. What routing change is needed?
- Increase the number of public IP addresses on spoke instances so traffic prefers the inspection stack.
- Add a default route toward the egress VPC in the Transit Gateway route table but retain more-specific internet-gateway default routing in each spoke subnet.
- Remove bypass egress routes from spoke route tables and point approved default traffic through the Transit Gateway with symmetric inspection/egress VPC routes.
- Add firewall rules only in the inspection VPC and rely on the managed firewall to redirect traffic that never enters its forwarding path.
Explanation
Correct Answer
C:Central inspection only functions when VPC and TGW route tables actually direct both directions along the firewall path.
Incorrect Answers
A:Public addresses tend to enable rather than eliminate direct egress through an internet gateway.
B:Correct transit routes cannot force flows to the inspection VPC while spoke subnets still send their traffic directly to the internet gateway.
D:Firewall policy applies only to flows routed through the inspection endpoints; route-table steering must prevent bypass.
Question 40
An engineer uses VPC Reachability Analyzer to model a private path from one ENI to another. The tool reports a missing route in the source subnet route table. Which corrective action addresses this specific configuration issue before packet testing?
- Change only the destination subnet return route and leave the Reachability Analyzer-reported source subnet route missing.
- Add the intended destination CIDR route with the correct next hop in the source subnet table and verify the reverse path separately.
- Increase MTU on the source instance without supplying a route for the destination CIDR.
- Disable the destination subnet network ACL and assume this supplies a next hop for the missing source subnet route.
Explanation
Correct Answer
B:Reachability analysis identifies configuration-level routing blockers; fixing the missing prefix entry restores a potential forwarding path.
Incorrect Answers
A:The reported blocker is a missing forward route in the source subnet; the reverse route cannot repair that source lookup.
C:A larger MTU cannot make a packet forward when no route to the destination network exists.
D:ACLs can filter packets after routing but do not create the absent CIDR route flagged by Reachability Analyzer.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests