Task 1.1: Architect Network Connectivity Strategies. SAP-C02 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to ensure that the instance cannot be accessed from the internet and that all outbound traffic is logged. Which solution should they implement?

   • AAttach an internet gateway to the VPC and add a route in the private subnet's route table to the internet gateway.
   • BCreate a NAT instance in the private subnet and configure it to forward traffic to the internet gateway.
   • CUse a VPC endpoint for Amazon S3 to download the patches and do not provide internet access.
   • DCreate a NAT gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT gateway for internet traffic. Enable VPC Flow Logs for the private subnet.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A solutions architect is designing a VPC for a three-tier application. The architect needs to create subnets for web servers, application servers, and database servers. What is the primary purpose of using separate subnets in this design?

   • ATo reduce the cost of running the application
   • BTo increase the total number of IP addresses available
   • CTo enable communication between instances in different tiers
   • DTo isolate traffic and apply different security controls
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company runs a multi-Region application with VPCs in us-east-1 and eu-west-1. They need to enable communication between the VPCs for a database replication workload. The workload is sensitive to latency and the company wants to minimize data transfer costs. Which solution should they use?

   • ACreate a public endpoint in one VPC and access it from the other VPC over the internet.
   • BSet up a VPC peering connection between the two VPCs and update the route tables in both VPCs.
   • CSet up an AWS Site-to-Site VPN connection between the two VPCs over the internet.
   • DCreate an AWS Transit Gateway in each Region and peer them together.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A network administrator needs to capture information about IP traffic going to and from network interfaces in a VPC. Which AWS service provides this capability?

   • AVPC Flow Logs
   • BAmazon CloudWatch
   • CAWS Config
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has 15 AWS accounts in a single Region, each with one VPC. The accounts are managed through AWS Organizations. The network team needs to establish private connectivity between all VPCs so that any VPC can communicate with any other VPC. The company expects to add 10 more accounts in the next year. The solution must minimize the number of network connections to manage and must allow the security team to centrally inspect traffic between VPCs. Which solution should the network team implement?

   • AUse AWS PrivateLink to create an endpoint service in each VPC and connect every other VPC to it.
   • BCreate a transit gateway in the management account and attach all VPCs from all accounts to it. Use route tables and a central AWS Network Firewall for inspection.
   • CSet up a single VPC with a large CIDR block and use VPC peering to connect each account's VPC to this central VPC.
   • DCreate a full-mesh of VPC peering connections between all VPCs and attach an AWS Network Firewall to each VPC.
   Reveal Solution Discussion Select an answer first