ANS-C01 Drag & Drop — 10 Questions

Question 1

Arrange the steps to configure an AWS Transit Gateway with attachments to multiple VPCs:

Accepted Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments to VPCs. Step 3: Associate attachments with a transit gateway route table. Step 4: Update VPC route tables to point to the transit gateway. Step 5: Test connectivity.. First create the transit gateway, then create attachments, associate them with a route table, update VPC routes, and test connectivity.

Answer

Step 1: Create transit gateway attachments to VPCs. Step 2: Create the transit gateway. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Update VPC route tables. Step 3: Create transit gateway attachments. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Answer

Step 1: Create the transit gateway. Step 2: Create transit gateway attachments. Step 3: Update VPC route tables. Step 4: Associate attachments with a route table. Step 5: Test connectivity.

Question 2

Order the steps to set up a redundant Direct Connect connection with two virtual interfaces in different AWS regions:

Accepted Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then configure BGP, then tune routing, then test failover.. First provision the connections, then create VIFs, configure BGP, tune routing, then test failover.

Answer

Create virtual interfaces (VIFs), then provision Direct Connect connections, then configure BGP, then tune routing, then test failover.

Answer

Provision Direct Connect connections, then configure BGP, then create virtual interfaces (VIFs), then tune routing, then test failover.

Answer

Provision Direct Connect connections, then create virtual interfaces (VIFs), then test failover, then configure BGP, then tune routing.

Question 3

Order the steps to migrate a VPC from using an Internet Gateway to a NAT gateway for outbound-only internet access:

Accepted Answer

1. Create NAT gateway in a public subnet. 2. Update route tables to point default route to NAT gateway. 3. Remove the Internet Gateway route from route tables. 4. Adjust security group rules for outbound traffic. 5. Test outbound connectivity.. First create the NAT gateway, then update routes to use it, remove the IGW route, adjust security, and test.

Answer

1. Update route tables to point default route to NAT gateway. 2. Remove the Internet Gateway route. 3. Create NAT gateway in a public subnet. 4. Adjust security group rules. 5. Test outbound connectivity.

Answer

1. Remove the Internet Gateway route. 2. Create NAT gateway in a public subnet. 3. Update route tables to point default route to NAT gateway. 4. Adjust security group rules. 5. Test outbound connectivity.

Answer

1. Adjust security group rules. 2. Create NAT gateway. 3. Update routes. 4. Remove IGW route. 5. Test outbound connectivity.

Question 4

Arrange the steps to configure VPC Flow Logs for a VPC and publish logs to CloudWatch Logs:

Accepted Answer

1. Create a CloudWatch Logs log group. 2. Create an IAM role with permissions to write to CloudWatch Logs. 3. Create the VPC Flow Log, specifying the log group and IAM role. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.. First create the log group, then the IAM role, then the flow log, then verify, then analyze.

Answer

1. Create an IAM role with permissions to write to CloudWatch Logs. 2. Create a CloudWatch Logs log group. 3. Create the VPC Flow Log, specifying the log group and IAM role. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Answer

1. Create the VPC Flow Log, specifying a log group and IAM role. 2. Create a CloudWatch Logs log group. 3. Create an IAM role with permissions to write to CloudWatch Logs. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Answer

1. Create a CloudWatch Logs log group. 2. Create the VPC Flow Log, specifying the log group but without an IAM role. 3. Create an IAM role with permissions to write to CloudWatch Logs. 4. Verify that flow log records are delivered to the log group. 5. Analyze the logs using CloudWatch Logs Insights.

Question 5

Order the steps to set up a Network Load Balancer with a TCP listener in front of an Auto Scaling group:

Accepted Answer

Create target group → Create load balancer → Register targets → Associate target group with listener → Configure health checks. First create the target group, then the load balancer, register targets, associate the target group with the listener, and configure health checks.

Answer

Create load balancer → Create target group → Register targets → Associate target group with listener → Configure health checks

Answer

Create target group → Create load balancer → Configure health checks → Register targets → Associate target group with listener

Answer

Create target group → Register targets → Create load balancer → Associate target group with listener → Configure health checks

Question 6

Arrange the steps to configure an AWS Client VPN endpoint for remote access:

Accepted Answer

First create server and client certificates, then create the Client VPN endpoint, then associate the endpoint with a target network, then authorize ingress rules, then download and distribute the client configuration.. First create certificates, then the endpoint, associate with network, authorize access, then distribute client config.

Answer

First create the Client VPN endpoint, then create server and client certificates, then associate with a target network, then authorize ingress rules, then distribute client configuration.

Answer

First create server and client certificates, then create the Client VPN endpoint, then authorize ingress rules, then associate with a target network, then distribute client configuration.

Answer

First create the Client VPN endpoint, then associate with a target network, then create server and client certificates, then authorize ingress rules, then distribute client configuration.

Question 7

Arrange the steps to configure BGP on a Cisco router for a Direct Connect private virtual interface:

Accepted Answer

Enter configuration mode, then enable BGP, then define the neighbor, then advertise prefixes, then verify.. First enter config mode, enable BGP, define the neighbor, advertise prefixes, then verify.

Answer

Enable BGP, then enter configuration mode, then define the neighbor, then advertise prefixes, then verify.

Answer

Enter configuration mode, then enable BGP, then advertise prefixes, then define the neighbor, then verify.

Answer

Enter configuration mode, then enable BGP, then define the neighbor, then verify, then advertise prefixes.

Question 8

Order the steps to troubleshoot an inter-Region VPC peering connection that is not working:

Accepted Answer

Verify peering status, then check route tables, then check security groups and NACLs, then test connectivity, then use VPC Flow Logs. First verify peering status, then check routes, then security groups/ACLs, then test, then use flow logs.

Answer

Test connectivity, then check security groups and NACLs, then check route tables, then use VPC Flow Logs, then verify peering status

Answer

Check security groups and NACLs, then check route tables, then verify peering status, then test connectivity, then use VPC Flow Logs

Answer

Use VPC Flow Logs, then verify peering status, then check route tables, then check security groups and NACLs, then test connectivity

Question 9

Arrange the steps to configure a site-to-site VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA in the correct order.

Accepted Answer

Define customer gateway, then create VPN connection, then apply VPN configuration to Cisco ASA, then verify tunnel status, then configure routing.. First, define the customer gateway, then create the VPN connection, apply the configuration, verify the tunnel, and finally configure routing.

Answer

Create VPN connection, then define customer gateway, then apply configuration, then verify tunnel, then configure routing.

Answer

Define customer gateway, then create VPN connection, then verify tunnel, then apply configuration, then configure routing.

Answer

Define customer gateway, then apply configuration, then create VPN connection, then verify tunnel, then configure routing.

Question 10

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Accepted Answer

Check connection status, then verify virtual interface configuration, then check on-premises BGP, then test connectivity, then escalate if unresolved.. Start with the connection status, then verify virtual interface configuration, check on-premises BGP, test connectivity, and escalate if unresolved.

Answer

Check connection status, then check on-premises BGP, then verify virtual interface configuration, then test connectivity, then escalate if unresolved.

Answer

Check connection status, then test connectivity, then verify virtual interface configuration, then check on-premises BGP, then escalate if unresolved.

Answer

Verify virtual interface configuration, then check connection status, then check on-premises BGP, then test connectivity, then escalate if unresolved.