You have set up an S3 endpoint, and you want to restrict some instances from being able to access it.
These instances are all in the same subnet, so you cannot simply remove the prefix list from the route table. What two approaches can you take to solve this?
(Choose two.)
Response:

• A.Remove any access to the PL in the security group attached to the instances.
• B.Add A rule in the NACL to block the prefix list ID outbound.
• C.This is not possible.
• D.Modify the endpoint policy.

Comment: *

Name: *

Email: *

Verification: *

An organization processes consumer information submitted through its website. The organization's security policy requires that personally identifiable information (Pll) elements are specifically encrypted at all times and as soon as feasible when received.
The front-end Amazon EC2 instances should not have access to decrypted Pll. A single service within the production VPC must decrypt the Pll by leveraging an iAM role.
Which combination of services will support these requirements?
(Select two.)
Response:

• A.Amazon Aurora in a private subnet
• B.Amazon CloudFront using AWS Lambda@Edge
• C.AWS Key Management Services
• D.Application Load Balancer using HTTPS listeners and targets
• E.Customer-managed MySQL with Transparent Data Encryption

Comment: *

Name: *

Email: *

Verification: *

What statement about LAGs is incorrect?
Note: Answers to this question are not verified by our experts, please study yourself and select the appropriate answers.
Contribute: Please send the correct answers with reference text/link on [email protected] to get up to 50% cashback.
Response:

• A.You will receive 1 LOA-CFA with a page for each connection.
• B.If you create a new connection, you will have to fill out another LOA-CFA.
• C.All connections in the LAG must terminate at the same DX endpoint.
• D.You can pool connections with multiple speeds to create one faster speed.

Comment: *

Name: *

Email: *

Verification: *

An IoT company sells hardware sensor modules that periodically send out temperature, humidity, pressure, and location data through the MQTT messaging protocol. The hardware sensor modules send this data to the company's on-premises MQTT brokers that run on Linux servers behind a load balancer. The hardware sensor modules have been hardcoded with public IP addresses to reach the brokers.
The company is growing and is acquiring customers across the world. The existing solution can no longer scale and is introducing additional latency because of the company's global presence. As a result, the company decides to migrate its entire infrastructure from on premises to the AWS Cloud. The company needs to migrate without reconfiguring the hardware sensor modules that are already deployed across the world. The solution also must minimize latency.
The company migrates the MQTT brokers to run on Amazon EC2 instances.
What should the company do next to meet these requirements?

• A.Place the EC2 instances behind a Network Load Balancer (NLB). Configure TCP listeners. Create an AWS Global Accelerator accelerator in front of the NLUse Bring Your Own IP (BYOIP) from the on-premises network with Global Accelerator.
• B.Place the EC2 instances behind a Network Load Balancer (NLB). Configure TCP listeners. Use Bring Your Own IP (BYOIP) from the on-premises network with the NLB.
• C.Place the EC2 instances behind an Application Load Balancer (ALB). Configure TCP listeners. Create an AWS Global Accelerator accelerator in front of the ALB. Use Bring Your Own IP (BYOIP) from the on-premises network with Global Accelerator
• D.Place the EC2 instances behind an Amazon CloudFront distribution. Use Bring Your Own IP (BYOIP) from the on-premises network with CloudFront.

Comment: *

Name: *

Email: *

Verification: *

An organization will be extending its existing on-premises infrastructure into the cloud. The design consists of a transit VPC that contains stateful firewalls that will be deployed in a highly available configuration across two Availability Zones for automatic failover.
What MUST be configured for this design to work?
(Select two.)
Response:

• A.Autonomous system (AS) path prepending
• B.A different Autonomous System Number (ASN) for each firewall.
• C.Static routing
• D.Border Gateway Protocol (BGP) routing
• E.Equal-cost multi-path routing (ECMP)

Comment: *

Name: *

Email: *

Verification: *