AWS Networking and Security 4

Question 1

A Solutions Architect needs to connect two VPCs in different AWS accounts so they can communicate privately. The IP ranges do not overlap. Which solution is most appropriate?

Accepted Answer

VPC Peering

Answer

VPC Peering creates a direct private network connection between two VPCs (same or different accounts/regions) as long as CIDR ranges do not overlap.

Question 2

Which AWS service provides a managed, scalable solution for distributed denial-of-service (DDoS) protection at the network and transport layers?

Accepted Answer

AWS Shield Standard

Answer

AWS Shield Standard is automatically included at no cost for all AWS customers and provides protection against common Layer 3 and Layer 4 DDoS attacks.

Question 3

A company is setting up a hybrid network and needs consistent, low-latency connectivity between their on-premises data center and AWS. Which service best meets this requirement?

Accepted Answer

AWS Direct Connect

Answer

AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, offering consistent performance and lower latency than internet-based VPN.

Question 4

What happens to traffic that does not match any rule in an AWS Network ACL?

Accepted Answer

It is denied by the implicit deny-all rule

Answer

NACLs include an implicit deny-all rule (rule number *) at the end; any traffic not matching an explicit allow or deny rule is automatically denied.

Question 5

A developer is using AWS KMS to encrypt data. They want to ensure the encryption key is automatically rotated annually. Which feature should they enable?

Accepted Answer

Automatic Key Rotation

Answer

AWS KMS Automatic Key Rotation rotates the key material for a customer-managed key annually while keeping the same key ID and alias.

AWS Practice Test

AWS Practice Test

AWS Networking and Security 4