Managing Cloud Networks at Scale GCAD Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a key characteristic of VPC peering?

   • AIt supports transitive routing between multiple VPCs
   • BIt requires a transit gateway to function
   • CIt allows direct connectivity between two VPCs using private IP addresses
   • DIt automatically routes traffic through the internet
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A financial services company requires high availability for its trading application. The application runs in a cloud VPC and must remain available even if an entire availability zone fails. They also need to maintain connectivity to their on-premises data center. Which architecture should they implement?

   • ADeploy the application across multiple availability zones behind a load balancer, and use a transit gateway with redundant VPN/Direct Connect connections to on-premises.
   • BDeploy the application in a single availability zone and use a VPN to the on-premises data center for failover.
   • CPlace all resources in a single VPC with no redundancy and rely on snapshots for recovery.
   • DUse a single large instance in one availability zone and replicate data to another region.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has offices in 10 countries and uses AWS in multiple regions. They need to connect all offices to the cloud and to each other with reliable, low-latency connectivity. They are considering using AWS Transit Gateway with VPN attachments, AWS Direct Connect, or a third-party SD-WAN solution. The company has a limited budget and wants to minimize recurring costs while ensuring high availability. Which option should they choose?

   • ASet up AWS Direct Connect at each office location to ensure dedicated, low-latency connections.
   • BUse AWS Transit Gateway with VPN attachments from each office, and enable AWS VPN CloudHub for redundancy.
   • CUse a third-party SD-WAN solution that connects all offices to each other and to AWS via a single provider.
   • DUse AWS Client VPN to connect each office's users to the cloud.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a security challenge that becomes more pronounced as cloud networks scale?

   • AThe need to use only public IP addresses for all resources
   • BThe requirement to disable all logging to improve performance
   • CThe inability to create subnets in a VPC
   • DThe increased attack surface due to more network endpoints and paths
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team manages network infrastructure for 40 AWS accounts using CloudFormation. They need to enforce a consistent security group rule set across all accounts and regions, and they want to prevent manual changes that could introduce drift. Which approach best meets this requirement?

   • ADeploy a CloudFormation StackSet that creates the security groups and rules in every account and region, and use AWS Config rules to detect and remediate drift.
   • BWrite a script that runs once to create the security groups in each account using the AWS CLI, and document the expected rules in a wiki.
   • CUse AWS Organizations to apply a service control policy that denies all security group modifications.
   • DCreate a shared security group in a central account and reference it from all other accounts using security group peering.
   Reveal Solution Discussion Select an answer first