302 questions across 1 topics, with suggested answers, explanations where available, and imported community discussion. The first 30 questions are free to preview.
An insurance company plans to migrate workloads from its on-premises data center to the AWS Cloud. The company needs end-to-end domain name resolution, including bi-directional DNS resolution between AWS and the existing on-premises environments. The workloads will be migrated into multiple VPCs, have dependencies on one another, and will not all migrate at the same time.
Which solution fulfills these requirements?
Answer: A
Route 53 Resolver inbound endpoints allow on-premises DNS resolvers to forward AWS private-domain queries into AWS, while outbound endpoints and Resolver forwarding rules allow VPC workloads to resolve on-premises domains. A private hosted zone must be associated with the VPC that hosts the inbound endpoint for that endpoint to resolve records in the zone. Sharing Resolver rules through AWS Resource Access Manager lets the application VPCs use the centralized outbound DNS-forwarding configuration.
**Learn more:** [Resolving DNS queries between VPCs and your network](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html) · [Considerations when creating inbound and outbound endpoints](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-choose-vpc.html)
Question 2 · Network Management and Operation Open
A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company recently had a network security breach. A network engineer needs to collect and analyze logs containing the client IP address, target IP address, target port, and user agent for every user who accesses the application.
What is the **MOST** operationally efficient solution that fulfills these requirements?
Answer: D
Application Load Balancer access logs are delivered to an Amazon S3 bucket and include the `client:port`, `target:port`, and `user_agent` fields. Amazon Athena can query those logs directly in Amazon S3 using SQL, avoiding manual file downloads and avoiding the operational overhead of an unsupported direct ALB-to-Kinesis ingestion design.
**Learn more:** [Access logs for your Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html) · [Query Application Load Balancer logs](https://docs.aws.amazon.com/athena/latest/ug/application-load-balancer-logs.html)
Question 3 · Network Security, Compliance, and Governance Open
A company uses AWS Network Firewall to protect outbound traffic for multiple VPCs in the same AWS account. Each VPC contains Amazon EC2 instances that host the company’s applications. Every EC2 instance is tagged with the name of the application that it hosts. The EC2 instances are in Auto Scaling groups.
A Network Firewall stateful rule group must stay current even when an Auto Scaling group launches or terminates EC2 instances.
Which solution meets this requirement with the **LEAST** implementation and administrative effort?
Answer: D
AWS Network Firewall tag-based resource groups can group EC2 instances by their application-name tag and be referenced by a stateful rule group. Network Firewall automatically updates the rule group with the IP addresses of matching resources as instances are added, changed, or removed, so Auto Scaling lifecycle changes require no custom update automation.
**Learn more:** [Using tag-based resource groups in Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/resource-groups.html) · [Settings for the resource groups that you use in AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/resource-group-settings.html)