EMT Practice Test

1. Question Content...

---

Question1: What are two routing methods used by Route 53?
(Choose two.)
Response:

Question2: You have configured a new Amazon S3 endpoint in your VPC. You have created a public Amazon S3 bucket so that you can test connectivity. You can download objects from your laptop but not from instances in the VPC. Which of the following could NOT be a problem?
Response:

Question3: What does the Amazon CloudFront invalidation feature do?
Response:

Question4: A user is collecting 1000 records per second. The user wants to send the data to CloudWatch using a custom namespace. Which of the below mentioned options is recommended for this activity?
Response:

Question5: You are responsible for several EC2 instances deployed from Amazon AMIs that are required to upload information to an S3 bucket. This information must not traverse the public internet. You must also be able to update the instances. Which option is your best solution?
Response:

Question6: You have configured an AWS PrivateLink connection between your Virtual Private Cloud (VPC) and the VPC of a business partner's hospital.
The hospital has specialized applications that staff developed in-house; some were developed more than 10 years ago. The hospital is trying to enable access to your private service but is having problems connecting to your service.
Which of the following is a possible solution?
Response:

Question7: When adding an alternate domain to your Amazon CloudFront distribution, the wildcard * can be used to do what?
Response:

Question8: A company has an application running on Amazon EC2 instances in a private subnet that connects to a third-part service provider's public HTTP endpoint through a NAT gateway.
As request rates increase, new connections are starting to fail. At the same time, the ErrorPortAllocation Amazon CloudWatch metric count for the NAT gateway is increasing.
Which of the following actions should improve the connectivity issues?
(Select TWO.)
Response:

Question9: A network engineer needs to design a solution for an application running on an Amazon EC2 instance to connect to a publicly accessible Amazon RDS Multi-AZ DB instance in a different VPC and Region.
Security requirements mandate that the traffic not traverse the internet.
Which configuration will ensure that the instances communicate privately without routing traffic over the internet?
Response:

Question10: What is the purpose of connection draining?
Response:

Question11: Your organization has a DX connection, and you've just created a new VPC and Private VIF to which you've linked your DX connection. You duplicated the configuration from the other VPC to guarantee consistency.
Once the new VIF was joined, connection issues with both VPCs started to occur. You verified that you were not using the same CIDR for each VPC, so what could possibly be the issue?
Response:

Question12: A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB).
The company recently experienced a network security breach. A network engineer must collect and analyze logs that include the client IP address, target IP address, target port, and user agent of each user that accesses the application.
What is the MOST operationally efficient solution that meets these requirements?
Response:

Question13: Over which of the following Ethernet standards does AWS Direct Connect link your internal network to an AWS Direct Connect location?
Response:

Question14: AWS Config flags a resource as ____ if a resource violates any conditions of an AWS Config rule that it evaluates on the resource in question.
Response:

Question15: Which one of the following options is not true about WorkSpaces?
Response:

Question16: How many prefixes can be announced from a customer to AWS over an AWS Direct Connect Private Virtual Interface (VIF)?
Response:

Question17: How many Virtual Private Gateways can exist per AWS region?
Response:

Question18: A bank built a new version of its banking application in AWS using containers that content to an on- premises database over VPN connection. This application version requires users to also update their client application. The bank plans to deprecate the earlier client version.
However, the company wants to keep supporting earlier clients through their on-premises version of the application to serve a small portion of the customers who haven't yet upgraded.
What design will allow the company to serve both newer and earlier clients in the MOST efficient way?
Response:

Question19: If you have one VPC peered with two VPCs with overlapping CIDRs, which route will be more preferred?
Response:

Question20: Which Amazon Route 53 routing policy would be the most appropriate for gradually migrating an application to AWS?
Response:

Question21: An AWS CloudFormation template is being used to create a VPC peering connection between two existing operational VPCs, each belonging to a different AWS account. All necessary components in the
'Remote' (receiving) account are already in place.
The template below creates the VPC peering connection in the Originating account. It contains these components:

Which additional AWS CloudFormation components are necessary in the Originating account to create an operational cross-account VPC peering connection with AWS CloudFormation?
(Select two.)
Response:

Question22: You can use the ____ command of the AWS Config service CLI to see the compliance state of each of your rules.
Response:

Question23: You have just configured an Elastic Load Balancer. Assuming all settings are configured properly, about how long will it take an instance to become healthy with a 6 second HealthCheck Interval, an unhealthy threshold of 5 and a healthy threshold of 10?
Response:

Question24: A company's network engineer needs to design a new solution to help troubleshoot and detect network anomalies. The network engineer has configured Traffic Mirroring. However, the mirrored traffic is overwhelming the Amazon EC2 instance that is the traffic mirror target. The EC2 instance hosts tools that the company's security team uses to analyze the traffic. The network engineer needs to design a highly available solution that can scale to meet the demand of the mirrored traffic.
Which solution will meet these requirements?

Question25: You have deployed a website that utilizes CloudFront, Elastic Loadbalancer, and S3 to serve content.
When users access your site, they receive a "mixed content" security warning. What is most likely the problem?
Note: Answers to this question are not verified by our experts, please study yourself and select the appropriate answers.
Contribute: Please send the correct answers with reference text/link on [email protected] to get up to 50% cashback.
Response:

Question26: You need to create a subnet in a VPC that supports 1000 hosts. You need to be as accurate as possible since you run a very large company. What CIDR should you use?
Note: Answers to this question are not verified by our experts, please study yourself and select the appropriate answers.
Contribute: Please send the correct answers with reference text/link on [email protected] to get up to 50% cashback.
Response:

Question27: A cybersecurity company has its flagship application running on EC2 instances in a VPC and the application must publish custom metrics with proprietary information to CloudWatch in the same AWS Region. All connectivity must be established using private IP addresses.
Which of the following options will address these requirements?
Response:

Question28: A on-premises user application references a specific URL that resolves to an EC2 instance in the US East
1 region. Users are spread over a large geographic area.
You want to deliver content to them with the lowest possible latency. The URL is written into the client application, and we do not want to re-write the application to change the URL.
The URL points to the domain apex of our domain. How can we deliver this content to the users with minimal latency without re-writing the application?
Response:

Question29: Your company is currently planning on using Route53 for managing Blue Green deployments. They have already setup an So%-2o% for a new deployment. How can you disable traffic to the older setup once all testing is complete?
Response:

Question30: You would like to ensure that all Amazon S3 buckets going forward, current and newly created ones, have logging enabled. What type of trigger(s) should you use?
Response:

Question31: You have setup a Cloudfront distribution in AWS. You want to use the AWS Certification Manager along with Cloudfront You are setting up Cloudfront. but you cannot see the ACM certificate that you created at an earlier stage to associate with the distribution.
What could be the underlying issue?
Response:

Question32: You are a network admin of a US company called Webby Widgets that is expanding to Europe. The company has a website that serves dynamic and static content. You have been instructed to ensure the European clients receive the least latency possible, no matter where in Europe they live, while still allowing the US clients to receive the same user experience and performance they have been accustomead to. You have also been instructed to ensure both countries use the same URL to access the site and keep costs low.
What two things should you do?
(Choose two.)
Response:

Question33: A team implements a highly available solution using Amazon AppStream 2.0. The AppStream 2.0 fleet needs to communicate with resources both in an existing VPC and on-premises. The VPC is connected to the on-premises environment using an AWS Direct Connect private virtual interface.
What implementation enables on-premises users to connect to AppSTream and existing VPC resources?
Response:

Question34: Which two strategies may be used to guarantee that only the appropriate persons get items?
(Select two.)
Response:

Question35: A company is designing infrastructure on AWS with three VPCs connected to a transit gateway. The three VPCs are an application VPC, a backend VPC, and an inspection VPC. The application VPC and the backend VPC have compute instances deployed in Availability Zone A and Availability Zone B. Stateful firewalls are deployed in the same Availability Zones in the inspection VPC, which is a shared services VPC.
All traffic is routed through the inspection VPC through the stateful layer 7 virtual firewall appliances to comply with a security policy that mandates traffic inspection. There are no overlapping IP addresses across the three VPCs. A network engineer must ensure that traffic between the application VPC and the backend VPC can route through the inspection VPC's stateful firewalls.
Which solution will meet these requirements?
Response:

Question36: Considering the rules of IPv4 subnetting, how many subnets and hosts per subnet are possible given the following network 192.168.130.130/28? (in this question ignore the fact that AWS reserves 5 IP addresses) Note: Answers to this question are not verified by our experts, please study yourself and select the appropriate answers.
Contribute: Please send the correct answers with reference text/link on [email protected] to get up to 50% cashback.
Response:

Question37: A legacy, on-premises web application cannot be load balances effectively. There are both planned and unplanned events that cause usage spikes to millions of concurrent users.
The existing infrastructure cannot handle the usage spikes. The CIO has mandated that the application be moved to the cloud to avoid further disruptions, with the additional requirement that source IP addresses be unaltered to support network traffic-monitoring needs.
Which of the following designs will meet these requirements?
Response:

Question38: To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use ____.
Response:

Question39: A multi-player gaming application that runs on UDP protocol needs to add functionality where you can assign multiple players to a single session on a game server based on factors such as geographic location, player skill, and few more configurable parameters. The application is accessed by players spread out across different regions of the world.
What is the right way to configure this requirement?
Response:

Question40: You have just provisioned a new VPC a with a CIDR block of 172.16.12.0/24. The entire CIDR block is fully utilized by subdividing it into 6 subnets, we will refer to these as Subnet1 through to Subnet6. The first 2 subnets (Subnet1 and Subnet2) are the same size. The last 4 subnets (Subnet3, Subnet4, Subnet5, Subnet6) are also the same size. Subnet5 is half the size of Subnet2. The address space as occupied by the first two subnets is contiguous, as is the address space occupied by the last 4 subnets.
Within Subnet3 AWS reserves the address 172.16.12.129 for the VPC router. Select the correct IP address reserved by AWS for DNS in the Subnet2.
Response:

Question41: A retail company has a data center with a 2 connection LAG. The networking team at the company wants to add 2 more connections. How many Letters of Authorization (LOAs) would you need to complete for the given use case?
Response:

Question42: Which service parses large Flow Logs for consumption by other programs such as Kibana?
Response:

Question43: Which of the following is a security benefit of Amazon VPC endpoints?
Response:

Question44: Your company was recently acquired and a Direct Connection connection was extended from your new parent corporation to your AWS VPC using a hosted VIF. What data charges are billed to your account for that connection?
Note: Answers to this question are not verified by our experts, please study yourself and select the appropriate answers.
Contribute: Please send the correct answers with reference text/link on [email protected] to get up to 50% cashback.
Response:

Question45: You are working with a government agency, and you need to choose an encryption standard for their VPN. Which standard should you choose?
Response:

Question46: A company has developed a new web application that processes confidential data that is hosted on Amazon EC2 instances. The application needs to scale and must use certificates to authenticate clients.
The application is configured to request a client's certificate and will validate the certificate as part of the initial handshake.
Which Elastic Load Balancing (ELB) solution will meet these requirements?
Response:

Question47: You have created a centralized, shared service Virtual Private Cloud (VPC) for your organization. It uses VPC peering, and you have been asked to evaluate AWS PrivateLink to optimize connectivity. Which of the following design considerations is true?
Response:

Question48: A company has an application that processes confidential dat
a. The data is currently stored in an onpremises data center. A network engineer is moving workloads to AWS, and needs to ensure confidentiality and integrity of the data in transit to AWS. The company has an existing AWS Direct Connect connection.
Which combination of steps should the network engineer perform to set up the most cost-effective connection between the on-premises data center and AWS?
(Select TWO.)
Response:

Question49: You have set up an S3 endpoint, and you want to restrict some instances from being able to access it.
These instances are all in the same subnet, so you cannot simply remove the prefix list from the route table. What two approaches can you take to solve this?
(Choose two.)
Response:

Question50: The networking team at a company wants to do a Simple AD deployment and use it for the company's Microsoft Exchange email server. The team is having issues finding the AD server. What is the most probable root cause behind this issue?
Response:

Question51: With AWS CloudTrail, creating multiple trails in one region allows ____ to focus on one aspect of AWS operation.
Response:

Question52: A social media company has installed an AWS Site-to-Site VPN and the networking team has noticed that the VPN tunnel is unstable or the tunnel status is frequently down on the customer gateway device.
Which steps should the networking team take to address this issue?
(Select two)
Response:

Question53: What value in a packet dictates the priority of the packet in a QoS enabled network?
Response:

Question54: A company is using Amazon Route 53 Resolver for its hybrid DNS infrastructure. The company is using Route 53 Resolver forwarding rules for authoritative domains that are hosted on on-premises DNS servers. The company achieves hybrid network connectivity by using an AWS Site-to-Site VPN connection.
A new governance policy requires logging for DNS traffic that originates in the AWS Cloud. The policy also requires the company to query DNS traffic to identify the source IP address of the resources that the query originated from, along with the DNS name that was requested.
Which solution will meet these requirements?
Response:

Question55: What are two ways to influence the direction of Dynamic VPN traffic over multiple links?
(Choose two.)
Response:

Question56: You discover that the default VPC has been deleted from region us-east-1 by a coworker in the morning.
You will be deploying a lot of new services during the afternoon. What should you do?
Response:

Question57: You have been requested to use CloudFormation to maintain version control and achieve automation for the applications in your organization. The environment will consist of several networking components and application services. What is the best way to design the template?
Response:

Question58: A company has applications running in a single AWS Region and its on-premises data center in a hybrid mode. The company has a 1 Gbps AWS Direct Connect connection from the data center to AWS that is
65% utilized.
The company has an AWS Enterprise Support plan. The company is planning to deploy a new critical application on AWS that will connect with existing applications running in the data center.
The application SLA requires a minimum of 99.9% network uptime between the data center and AWS.
What is the MOST cost-effective way to meet this SLA requirement?
Response:

Question59: Your company maintains an Amazon Route 53 private hosted zone. DNS resolution is restricted to a single, pre-existing VPC.
For a new application deployment, you create an additional VPC in the same AWS account. Both this new VPC and your on-premises DNS infrastructure must resolve records in the existing private hosted zone.
Which two activities are required to enable DNS resolution both within the new VPC and from the on- premises infrastructure?
(Select two.)
Response:

Question60: Which other AWS service is used to track `Related Events' within the Configuration Item?
Response:

Question61: You have 3 VPCs that need to be able to pass traffic. In what two ways can you achieve this?
(Choose two.)
Note: Answers to this question are not verified by our experts, please study yourself and select the appropriate answers.
Contribute: Please send the correct answers with reference text/link on [email protected] to get up to 50% cashback.
Response:

Question62: Your development team is testing the performance of a new application using enhanced networking.
They have updated the kernel to the latest version that supports the Elastic Network Adapter (ENA) driver. What is the other requirement for support?
Response:

Question63: Which AWS Cloud service uses edge locations to deliver content to end users?
Response:

Question64: You are architecting your e-business application for PCI compliance. To meet the compliance requirements, you need to monitor web application logs to identify any malicious activity. You also need to monitor for remote attempts to change the network interface of web instances.
Which two AWS services will be helpful to achieve this goal?
Response:

Question65: Which address should be used to access EC2 instance metadata from within the EC2 instance?
Response:

Question66: A company has two on-premises data center locations. There is a company-managed router at each data center. Each data center has a dedicated AWS Direct Connect connection to a Direct Connect gateway through a private virtual interface. The router for the first location is advertising 110 routes to the Direct Connect gateway by using BGP, and the router for the second location is advertising 60 routes to the Direct Connect gateway by using BGP. The Direct Connect gateway is attached to a company VPC through a virtual private gateway.
A network engineer receives reports that resources in the VPC are not reachable from various locations in either data center. The network engineer checks the VPC route table and sees that the routes from the first data center location are not being populated into the route table. The network engineer must resolve this issue in the most operationally efficient manner.
What should the network engineer do to meet these requirements?

Question67: A company has developed an application on AWS that will track inventory levels of vending machines and initiate the restocking process automatically. The company plans to integrate this application with vending machines and deploy the vending machines in several markets around the world. The application resides in a VPC in the us-east-1 Region. The application consists of an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). The communication from the vending machines to the application happens over HTTPS.
The company is planning to use an AWS Global Accelerator accelerator and configure static IP addresses of the accelerator in the vending machines for application endpoint access. The application must be accessible only through the accelerator and not through a direct connection over the internet to the ALB endpoint.
Which solution will meet these requirements?

Question68: You need to find the subnet, the security group and the VPC that your instance is associated with. You only have access to the terminal of an instance with an admin role attached.
What is the first part of the command you would use?
Response:

Question69: You need to find the MTU used by another instance, but tracepath is not working. You know the instance you are trying to tracepath has open security group and NACL rules. Which protocol do you need to allow to access your instance to remedy this?
Response:

Question70: A company has a VPC in the us-west-1 Region and another VPC in the ap-southeast-2 Region. Network engineers set up an AWS Direct Connect connection from their data center to the us-east-1 Region.
They create a private virtual interface (VIF) that references a Direct Connect gateway, which is then connected to virtual private gateways in both VPCs.
When the setup is complete, the engineers cannot access resources in us-west-1 from ap-southeast-2.
What should the network engineers do to resolve this issue?
Response:

Question71: You have an EC2 instance inside a VPC that needs to communicate with an S3 bucket. How does that traffic flow by default?
Response:

Question72: A company hosts its ecommerce application on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances are in a private subnet with the default DHCP options set. Internet connectivity is through a NAT gateway that is configured in the public subnet.
A third-party audit of the security infrastructure identifies a DNS exfiltration vulnerability. The company must implement a highly available solution that protects against this vulnerability.
Which solution will meet these requirements MOST cost-effectively?
Response:

Question73: The networking team at a retail company is configuring a virtual interface for accessing your VPC on a newly provisioned 10-Gbps AWS Direct Connect connection. Which of the following configuration values do you need to provide?
(Select two)
Response:

Question74: You want to forward DNS queries from an on-premises datacenter into Route 53. Which configuration tasks must you complete?
(Choose two.)
Response:

Question75: You manage a website that uses a load balancer. You are noticing one of the servers is receiving more traffic than the other. What is probably the cause of this?
Response:

Question76: You are the AWS cloud architect and have been tasked with designing an appropriate subnetting design for your production VPC. Your production VPC requires secure communications back to the corporate private network. Quality of Service (QoS) is very important 24 × 7 for this particular connection, as real- time data is passed continually backwards and forwards between your on-prem bioinformatics enterprise application, and the number crunching servers deployed in the cloud.
Any potential latency incurred on this connection will have a direct impact on the company's ability to attract investors and expansion into new markets. Select the correct network configuration that best facilitates your company's continued growth plans.
Response:

Question77: A network engineer needs to limit access to the company's Amazon S3 bucket to specific source networks. What should the network engineer do to accomplish this?
Response:

Question78: Your current web application's network security architecture includes an Application Load Balancer, locked down Security Groups, and restrictive VPC route tables. You have been asked to implement additional controls for temporarily blocking hundreds of noncontiguous, malicious IP addresses.
Which AWS service or features should you add to this architecture?
Response:

Question79: Which design option is ideal for handling communication across a large number of VPCs?
Response:

Question80: You are deploying an EC2 instance in a private subnet that requires access to the Internet. One of the requirements for this solution is to restrict access to only particular URLs on a whitelist.
In addition to the whitelisted URL, the instances should be able to access any Amazon S3 bucket in the same region via any URL.
Which of the following solutions should you deploy?
(Select two.)
Response:

Question81: What is the DNS server address for a VPC (10.111.0.0/16) with a subnet of 10.111.4.0/24?
Response:

Question82: A company has deployed a software-defined WAN (SD-WAN) solution to interconnect all of its offices. The company is migrating workloads to AWS and needs to extend its SD-WAN solution to support connectivity to these workloads.
A network engineer plans to deploy AWS Transit Gateway Connect and two SD-WAN virtual appliances to provide this connectivity. According to company policies, only a single SD-WAN virtual appliance can handle traffic from AWS workloads at a given time.
How should the network engineer configure routing to meet these requirements?

Question83: A company is using an AWS Site-to-Site VPN connection from the company's on-premises data center to a virtual private gateway in the AWS Cloud Because of congestion, the company is experiencing availability and performance issues as traffic travels across the internet before the traffic reaches AWS. A network engineer must reduce these issues for the connection as quickly as possible with minimum administration effort.
Which solution will meet these requirements?