CLF-C02 Networking 5 — Questions and Answers
Question 1: Which Route 53 feature would a company use to route a percentage of traffic to a new application version for A/B testing?
- Failover routing
- Geolocation routing
- Weighted routing (Correct answer)
- Multivalue answer routing
Correct answer: Weighted routing
Weighted routing allows you to assign proportional weights to different resource record sets, enabling gradual traffic shifts like sending 10% to a new version during testing.
Question 2: A company wants to privately access Amazon S3 from their VPC without sending traffic over the internet. Which type of VPC Endpoint should they use?
- Interface Endpoint
- Gateway Endpoint (Correct answer)
- Direct Connect Endpoint
- Transit Endpoint
Correct answer: Gateway Endpoint
Gateway Endpoints are available for Amazon S3 and DynamoDB, allowing private access from a VPC by adding an entry to the route table that directs traffic to the endpoint.
Question 3: What is the primary benefit of deploying resources across multiple Availability Zones within a VPC?
- It reduces the cost of data transfer
- It improves fault tolerance by protecting against single AZ failures (Correct answer)
- It increases the size of the available IP address space
- It allows access to additional AWS services
Correct answer: It improves fault tolerance by protecting against single AZ failures
Deploying across multiple Availability Zones ensures that if one AZ experiences an outage, resources in other AZs continue to serve traffic, improving application availability.
Question 4: Which AWS service provides DDoS protection and is automatically included at no extra charge for all AWS customers?
- AWS WAF
- AWS Shield Advanced
- AWS Shield Standard (Correct answer)
- Amazon GuardDuty
Correct answer: AWS Shield Standard
AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides protection against common, most frequently occurring DDoS attacks.
Question 5: A company's EC2 instances in a private subnet need to access AWS services like S3 and DynamoDB. Which solution keeps this traffic within the AWS network?
- Route all traffic through an Internet Gateway
- Use NAT Gateway for all AWS service traffic
- Use VPC Endpoints for S3 and DynamoDB (Correct answer)
- Set up AWS Direct Connect
Correct answer: Use VPC Endpoints for S3 and DynamoDB
VPC Endpoints (Gateway Endpoints for S3 and DynamoDB, Interface Endpoints for other services) allow private connectivity to AWS services without traversing the public internet.
Question 6: What is the difference between an AWS Site-to-Site VPN and AWS Direct Connect?
- Site-to-Site VPN provides a physical dedicated line; Direct Connect uses the internet
- Site-to-Site VPN creates an encrypted tunnel over the internet; Direct Connect provides a dedicated private connection (Correct answer)
- Both use the same underlying technology with different pricing
- Site-to-Site VPN is only for connecting VPCs; Direct Connect is for on-premises connections
Correct answer: Site-to-Site VPN creates an encrypted tunnel over the internet; Direct Connect provides a dedicated private connection
Site-to-Site VPN creates an IPsec-encrypted tunnel over the public internet for quick setup, while Direct Connect provides a dedicated physical connection bypassing the internet for consistent performance.
Question 7: Which Amazon Route 53 health check feature automatically redirects traffic away from unhealthy endpoints?
- Latency-based routing
- Failover routing with health checks (Correct answer)
- Simple routing
- Geoproximity routing
Correct answer: Failover routing with health checks
Failover routing combined with Route 53 health checks automatically routes traffic to a standby resource when the primary resource becomes unhealthy.
CLF-C02 Networking 5
Which Route 53 feature would a company use to route a percentage of traffic to a new application version for A/B testing?