Networking and Content Delivery

138. Instances in a private subnet cannot download operating system updates, and the subnet route table has no route for 0.0.0.0/0. Which solution meets these requirements?

1. A Add a default route to the internet gateway in the private subnet route table.
2. B Create a NAT gateway in a public subnet and add a default route to it in the private subnet route table.
3. C Assign public IPv4 addresses to the instances in the private subnet.
4. D Create a VPC peering connection to a VPC that has internet access.

139. An interface VPC endpoint must restrict which API actions can be called through it. Which solution meets these requirements?

1. A Attach a security group to the endpoint's network interfaces that permits only the required ports.
2. B Add a route to the endpoint in the subnet route table for the required service prefix list.
3. C Attach an endpoint policy to the interface endpoint that permits only the required actions and resources.
4. D Apply a network ACL to the subnet containing the endpoint's network interfaces.

140. Traffic between two VPCs attached to the same AWS Transit Gateway is failing, although both attachments show as available. Which cause should the operations team investigate first?

1. A Check that both VPCs use the same CIDR range so the route is unambiguous.
2. B Check the transit gateway route tables to confirm each attachment's association and route propagation for the other VPC's CIDR.
3. C Check that both VPCs have an internet gateway attached and a default route.
4. D Check that the transit gateway is attached to a Direct Connect gateway in the same Region.

141. Outbound traffic from instances in three Availability Zones routes through one NAT gateway, and cross-zone data processing charges are significant. Which solution meets these requirements?

1. A Replace the NAT gateway with a NAT instance on a smaller instance type.
2. B Deploy a NAT gateway in each Availability Zone and route each subnet to the gateway in its own zone.
3. C Move all instances into the Availability Zone that contains the NAT gateway.
4. D Deploy a second NAT gateway in the same Availability Zone and balance traffic across both.

142. Instances in a private subnet must reach AWS Systems Manager for Session Manager with no internet path. Which solution meets these requirements?

1. A Create a gateway VPC endpoint for AWS Systems Manager in the subnet.
2. B Attach an internet gateway to the VPC and add a default route from the private subnet.
3. C Create a NAT gateway in a public subnet and route the subnet's traffic through it.
4. D Create interface VPC endpoints for the ssm, ssmmessages, and ec2messages services in the subnet.

143. A company must audit whether AWS WAF, AWS Shield, and Route 53 Resolver DNS Firewall protections are correctly configured in an account. Which solution meets these requirements?

1. A Enable VPC Flow Logs and analyse the traffic reaching the protected resources.
2. B Enable AWS Config and review the configuration history of the protected resources.
3. C Enable Amazon GuardDuty and review its findings for the protected resources.
4. D Review each protection's configuration and coverage, and record gaps against the account's protected resources.

144. An application must resolve private DNS names for resources inside a VPC, and those names must not be visible on the public internet. Which solution meets these requirements?

1. A Create an Amazon Route 53 public hosted zone containing only internal records.
2. B Create an Amazon CloudFront distribution with an alternate domain name for the internal service.
3. C Add host file entries on each instance for the internal names.
4. D Create an Amazon Route 53 private hosted zone and associate it with the VPC.

145. A zone apex such as example.com must resolve to an Application Load Balancer. Which solution meets these requirements?

1. A Create an Amazon Route 53 A record containing the load balancer's current IP addresses.
2. B Create an Amazon Route 53 TXT record containing the load balancer's DNS name.
3. C Create an Amazon Route 53 CNAME record that targets the load balancer's DNS name.
4. D Create an Amazon Route 53 alias A record that targets the load balancer.

146. Instances in a VPC intermittently fail to resolve an on-premises domain although a Route 53 Resolver forwarding rule exists. Which cause should the team investigate first?

1. A Check whether the forwarding rule has been associated with a second VPC.
2. B Check whether the outbound endpoint's IP addresses and security group permit DNS traffic to the on-premises resolvers in every Availability Zone.
3. C Check whether the on-premises domain has a matching public hosted zone.
4. D Check whether the VPC has DNS hostnames enabled in its attributes.

147. Users worldwide report slow downloads of large static assets served from an Amazon S3 bucket in one Region. Which solution meets these requirements?

1. A Enable S3 Versioning on the bucket so previous versions are retained.
2. B Change the bucket's storage class to S3 Standard-Infrequent Access.
3. C Create a bucket in each Region and replicate the assets to all of them.
4. D Create an Amazon CloudFront distribution with the bucket as the origin and serve the assets through it.

148. A dynamic API served from two Regions must fail over within seconds without waiting for DNS caches to expire. Which solution meets these requirements?

1. A Create an AWS Global Accelerator accelerator with endpoint groups in both Regions.
2. B Create Amazon Route 53 latency records for both Regional endpoints.
3. C Create an Amazon CloudFront distribution with both Regional endpoints as origins.
4. D Create Amazon Route 53 failover records with a short time to live.

149. A team must record which clients query a hosted zone and which records they request, for troubleshooting. Which solution meets these requirements?

1. A Enable AWS CloudTrail data events for the hosted zone.
2. B Enable VPC Flow Logs on the subnets containing the querying instances.
3. C Enable Amazon Route 53 health checks on the records in the hosted zone.
4. D Enable Amazon Route 53 query logging for the hosted zone and send the logs to CloudWatch Logs.

150. Traffic must be distributed across three Regional endpoints in proportion to their capacity, with the proportions adjustable. Which solution meets these requirements?

1. A Create Amazon Route 53 failover records with one primary and two secondaries.
2. B Create Amazon Route 53 multivalue answer records for the three endpoints.
3. C Create Amazon Route 53 weighted records for the three endpoints and set the weights to match capacity.
4. D Create Amazon Route 53 latency records for the three endpoints.

151. An Amazon CloudFront distribution must serve private content so that only the application's authenticated users can retrieve objects under a path. Which solution meets these requirements?

1. A Restrict the distribution with a geographic restriction covering the users' countries.
2. B Configure the distribution to forward the Authorization header to the origin.
3. C Issue CloudFront signed cookies scoped to the path with a short expiry.
4. D Restrict the origin bucket policy to the CloudFront distribution with Origin Access Control.

152. An engineer must determine why traffic from an EC2 instance cannot reach an Amazon RDS endpoint, evaluating security groups, network ACLs, and route tables together. Which solution meets these requirements?

1. A Enable VPC Flow Logs on the subnet and analyse the accepted and rejected records.
2. B Run VPC Reachability Analyzer between the instance and the database endpoint and review the blocking component.
3. C Run AWS Trusted Advisor and review the fault tolerance checks for the VPC.
4. D Enable Amazon GuardDuty and review findings for the affected instance.

153. VPC Flow Logs show REJECT entries for return traffic on ephemeral ports from a subnet that reaches the internet through a NAT gateway. Which cause is most likely?

1. A Add inbound ephemeral port ranges to the subnet's network ACL, because network ACLs are stateless.
2. B Move the NAT gateway into the same Availability Zone as the instances.
3. C Add outbound rules to the instances' security group, because the return traffic is not permitted.
4. D Enable DNS resolution on the VPC so the return traffic can be routed.

154. An Amazon CloudFront distribution continues serving an outdated object after the origin has been updated. Which solution meets these requirements?

1. A Enable Origin Shield on the distribution so the origin is consulted more often.
2. B Create an invalidation for the object path, and shorten the cache policy time to live for future updates.
3. C Add the object's path to the distribution's origin request policy.
4. D Disable caching on the distribution so every request reaches the origin.

155. A team must confirm which requests an Application Load Balancer received and how it responded during an incident. Which solution meets these requirements?

1. A Enable Amazon CloudWatch detailed monitoring on the load balancer.
2. B Enable Elastic Load Balancing access logs and deliver them to an Amazon S3 bucket for analysis.
3. C Enable VPC Flow Logs on the load balancer's subnets and analyse the records.
4. D Enable AWS CloudTrail management events for Elastic Load Balancing.

156. An on-premises network reaches AWS over both AWS Direct Connect and a Site-to-Site VPN, and traffic is unexpectedly using the VPN. Which cause should be investigated first?

1. A Review the Direct Connect connection's port speed, because it is insufficient for the traffic volume.
2. B Review the VPC's DNS resolution settings, because they determine the path selected.
3. C Review the VPN tunnel's encryption settings, because they override routing preference.
4. D Review the route propagation and BGP path attributes, because the Direct Connect route is not being preferred.

157. VPC Flow Logs show ACCEPT records for traffic the application never received. Which cause should be investigated first?

1. A Investigate the subnet's network ACL rules.
2. B Investigate the security group's inbound rules.
3. C Investigate the instance's host firewall or the application's listening configuration, since the traffic passed the VPC controls.
4. D Investigate the route table's default route.

158. An operator must determine whether a network path between two resources is permitted without sending traffic. Which tool is appropriate?

1. A VPC Reachability Analyzer, which evaluates the configured path and identifies the blocking component.
2. B AWS CloudTrail, which records API calls.
3. C Amazon CloudWatch, which collects metrics.
4. D VPC Flow Logs, which record traffic that was attempted.

159. A Site-to-Site VPN tunnel is down, and the customer gateway shows no established session. Which cause should be investigated first?

1. A Investigate whether the instances have public IP addresses.
2. B Investigate whether the customer gateway's configuration matches the AWS side, including the pre-shared key and the IKE parameters.
3. C Investigate whether the subnet route tables are correct.
4. D Investigate whether the VPC has an internet gateway.

160. An IAM user reports being denied an action their attached policy permits. Which cause should be investigated first?

1. A Investigate whether the user's password has expired.
2. B Investigate whether the policy was attached recently.
3. C Investigate whether an explicit deny applies from a service control policy, a permissions boundary, or a resource policy.
4. D Investigate whether the user has multi-factor authentication enabled.

161. An organization must confirm that all S3 buckets in an account have public access blocked. Which approach is appropriate?

1. A Review each bucket's configuration in the console.
2. B Enable the setting on new buckets only.
3. C Evaluate the buckets with an AWS Config rule for the block public access setting and remediate the findings.
4. D Rely on the organization's service control policies.

162. A KMS key's deletion has been scheduled in error. Which action is appropriate?

1. A Cancel the key deletion before the waiting period expires, which restores the key to a disabled state.
2. B Create a new key with the same identifier.
3. C Restore the key from a backup.
4. D Wait for deletion and recreate the key.

163. An S3 bucket policy must require that all requests use TLS. Which condition is appropriate?

1. A Deny requests where s3:x-amz-server-side-encryption is absent.
2. B Deny requests where aws:SecureTransport is false.
3. C Deny requests where aws:SourceIp is outside a range.
4. D Deny requests where aws:PrincipalOrgID does not match.

164. Secrets Manager rotation for an RDS credential fails with a connectivity error. Which cause should be investigated first?

1. A Investigate whether the rotation schedule is too frequent.
2. B Investigate whether the rotation function is attached to the VPC and can reach both the database and a Secrets Manager endpoint.
3. C Investigate whether the secret's value is correctly formatted.
4. D Investigate whether the secret is encrypted with a customer managed key.

165. An operator must confirm which principal deleted an S3 object. Which source provides this?

1. A The bucket's server access logs, which record requests on a best-effort basis.
2. B The bucket's current object listing.
3. C CloudTrail management events for the account.
4. D CloudTrail data events for the bucket, if they were enabled before the deletion.

166. An operator must connect a VPC to an AWS service privately without a NAT gateway or internet gateway. Which approach is appropriate?

1. A Create a VPC endpoint for the service, using a gateway endpoint for Amazon S3 and DynamoDB or an interface endpoint otherwise.
2. B Route the traffic through a proxy in a public subnet.
3. C Assign public IP addresses to the instances.
4. D Peer the VPC with a VPC that has internet access.

167. A transit gateway attachment must not receive routes from another attachment. Which configuration is appropriate?

1. A Associate the attachments with separate route tables and control which attachments propagate routes into each.
2. B Detach one of the VPCs from the transit gateway.
3. C Apply a network ACL to the transit gateway.
4. D Apply a security group to the transit gateway attachment.

168. An operator must increase the available IP addresses in a VPC that is running out. Which approach is appropriate?

1. A Delete and recreate the VPC with a larger range.
2. B Release unused Elastic IP addresses.
3. C Modify the VPC's primary CIDR block to a larger range.
4. D Add a secondary CIDR block to the VPC and create new subnets from it.

169. An instance cannot reach an AWS service through an interface VPC endpoint. Which cause should be investigated first?

1. A Investigate whether the endpoint's security group permits inbound traffic from the instance on the required port.
2. B Investigate whether the subnet's route table has a route to the endpoint.
3. C Investigate whether the endpoint has a public IP address.
4. D Investigate whether the instance has an internet gateway route.

170. Traffic between two subnets in the same VPC is being dropped in one direction only. Which cause should be investigated first?

1. A Investigate the VPC's route table.
2. B Investigate the network ACLs, since they are stateless and require rules permitting both the request and the response.
3. C Investigate the security groups, which are stateful.
4. D Investigate the instances' operating system routes.

171. An operator must determine which security group rule permitted a connection that should have been blocked. Which approach is appropriate?

1. A Review the security groups attached to the resource and their rules, since VPC Flow Logs record the outcome rather than the rule.
2. B Review the instance's system log.
3. C Review the VPC Flow Logs for the rule identifier.
4. D Review CloudTrail for the connection event.

172. An instance in a public subnet has an internet gateway route but cannot reach the internet. Which cause should be investigated first?

1. A Investigate whether the subnet has a NAT gateway.
2. B Investigate whether the instance's security group permits inbound traffic.
3. C Investigate whether the VPC has DNS resolution enabled.
4. D Investigate whether the instance has a public IP address or Elastic IP address assigned.

173. An on-premises host cannot reach a VPC resource over a Site-to-Site VPN although the tunnel is up. Which cause should be investigated first?

1. A Investigate whether the tunnel's pre-shared key is correct.
2. B Investigate whether the customer gateway's public address has changed.
3. C Investigate whether the VPC has an internet gateway.
4. D Investigate whether the VPC route table has a route to the on-premises CIDR through the virtual private gateway and whether route propagation is enabled.

174. DNS resolution fails for an AWS service endpoint from instances in a VPC with a custom DHCP option set. Which cause should be investigated first?

1. A Investigate whether the subnet's route table is correct.
2. B Investigate whether the DHCP option set specifies custom DNS servers that cannot resolve AWS service endpoints.
3. C Investigate whether the VPC has an internet gateway.
4. D Investigate whether the instances have public IP addresses.

175. An operator must capture the actual packet contents of traffic to an instance for analysis. Which capability is appropriate?

1. A VPC Traffic Mirroring, which copies packets to a monitoring appliance for inspection.
2. B CloudWatch Logs, which store application log output.
3. C AWS CloudTrail, which records API calls.
4. D VPC Flow Logs, which record connection metadata.