Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Practice Test 19

Question 180

A TGW route table has an overlapping propagated /16 and more-specific static /24 route to an inspection attachment. Where will traffic for an IP in the /24 go?

  1. Enable the destination attachment's propagation into that TGW table or define a valid static route
  2. Install an appropriately scoped blackhole route in the associated TGW route table
  3. Forward matching /24 traffic according to the more-specific static route
  4. Associate the VPN attachment with the route table that represents its inbound security domain

Explanation

Correct Answer

C:

Transit routing follows longest-prefix match before broad-prefix alternatives, allowing a narrow service segment to take an explicit next hop.

Incorrect Answers

A:

TGW ingress is evaluated against the associated TGW route table; a VPC route alone cannot resolve the second-hop destination; that addresses TGW route-table entry for an attached destination, rather than specific prefix overrides aggregate traffic steering.

B:

A TGW blackhole route discards packets that match its destination rather than forwarding them to any attachment; this belongs to deliberate drop action within transit routing, while the problem is specific prefix overrides aggregate traffic steering.

D:

In the correct routing domain for inbound VPN traffic workflow, TGW association determines lookup behavior for packets arriving from the VPN; using the wrong table can expose or suppress destinations; the current case needs specific prefix overrides aggregate traffic steering.

Question 181

An on-premises AD DNS server forwards `aws.corp.example` to the default IP address of an AWS VPC instance rather than a Resolver endpoint. What should be provisioned?

  1. Add a Route 53 Resolver outbound endpoint and forwarding rule with target resolver IPs
  2. Associate the outbound forwarding rule with the workload VPC
  3. Create Route 53 Resolver inbound endpoint IP addresses and point conditional forwarding to them
  4. Permit required DNS traffic on both UDP and TCP port 53 to endpoint addresses

Explanation

Correct Answer

C:

Inbound endpoints provide supported external DNS ingress into a VPC's resolver context; a random instance IP is not equivalent.

Incorrect Answers

A:

Resolver outbound rules direct matching VPC queries across network connectivity to selected external name servers; that addresses outbound conditional forwarding to enterprise DNS, rather than DNS ingress from corporate resolvers into Route 53 Resolver.

B:

A rule controls resolution only for VPCs associated with it; merely creating a rule in an account has no global DNS effect; this belongs to activating conditional forwarding in a specific VPC, while the problem is DNS ingress from corporate resolvers into Route 53 Resolver.

D:

In the supported DNS transport to inbound Resolver endpoints workflow, recursive DNS primarily uses UDP but may require TCP for larger messages or protocol fallback; both must be routable and permitted; the current case needs DNS ingress from corporate resolvers into Route 53 Resolver.

Question 182

The outbound Route 53 Resolver endpoint and forwarding rule for `corp.example` are correctly associated with the VPC, and datacenter DNS servers are reachable across a VPN. Queries still time out because the endpoint security group currently denies all egress. What security-group change is required for standard DNS forwarding?

  1. Allow only inbound TCP 53 to the outbound Resolver endpoint security group
  2. Open only outbound UDP 443 to the datacenter DNS servers
  3. Allow outbound TCP 179 to the datacenter resolver addresses
  4. Allow outbound UDP and TCP 53 from the Resolver endpoint to the datacenter DNS server IP addresses

Explanation

Correct Answer

D:

Route 53 Resolver outbound endpoints must be able to send the configured DNS protocol to their target resolvers. Standard DNS uses both UDP and TCP port 53; allow this egress and check the return path.

Incorrect Answers

A:

The outbound endpoint initiates queries toward the datacenter name servers. Inbound-only TCP rules do not provide the endpoint with permission for its required outgoing DNS connections.

B:

Standard DNS forwarding uses port 53 over UDP and sometimes TCP, not UDP 443. Opening a different destination port cannot carry the required Do53 queries.

C:

TCP port 179 is used by BGP routing peers, not DNS resolver queries. The already-routed VPN path still needs correct DNS transport permitted from the outbound endpoint.

Question 183

An enterprise has both public `example.com` and private `example.com` zones. A VPC associated with the private zone returns NXDOMAIN for a missing internal record. Why is public data not returned?

  1. Publish the correct DS record through the domain's parent delegation
  2. Authorize the external VPC association and then associate that VPC with the hosted zone
  3. Associate the private hosted zone directly with the querying VPC or use an explicit Resolver forwarding design
  4. Recognize private hosted zone precedence for the matching suffix

Explanation

Correct Answer

D:

The associated private zone is authoritative for that VPC namespace; unanswered names do not normally spill to the public zone.

Incorrect Answers

A:

Validating resolvers rely on the parent DS linkage to establish trust in the child's signed DNSKEY material; that addresses DNSSEC authentication chain to the authoritative zone, rather than private DNS namespace precedence over public records.

B:

Cross-account private-zone use requires both hosted-zone authorization and an association action, not just shared account credentials; this belongs to cross-account private hosted zone association, while the problem is private DNS namespace precedence over public records.

C:

Private hosted zone associations do not implicitly follow peering connections; resolver scope is independent of routed reachability; this changes DNS visibility independent of peering topology, not the necessary private DNS namespace precedence over public records.

Question 184

A central private hosted zone belongs to an infrastructure account but must be queried from a spoke VPC owned by another account. What cross-account operation is required?

  1. Do not expect AWS Organizations membership alone to grant private-zone resolution
  2. Recognize private hosted zone precedence for the matching suffix
  3. Authorize the external VPC association and then associate that VPC with the hosted zone
  4. Associate the private hosted zone directly with the querying VPC or use an explicit Resolver forwarding design

Explanation

Correct Answer

C:

Cross-account private-zone use requires both hosted-zone authorization and an association action, not just shared account credentials.

Incorrect Answers

A:

Organizational membership can help authorize resource-sharing workflows, but VPC association controls resolver visibility for private hosted zones; that addresses explicit network-scoped private DNS authorization, rather than cross-account private hosted zone association.

B:

The associated private zone is authoritative for that VPC namespace; unanswered names do not normally spill to the public zone; this belongs to private DNS namespace precedence over public records, while the problem is cross-account private hosted zone association.

D:

In the DNS visibility independent of peering topology workflow, private hosted zone associations do not implicitly follow peering connections; resolver scope is independent of routed reachability; the current case needs cross-account private hosted zone association.

Question 185

A networking team in account A shares a Route 53 Resolver forwarding rule with account B, which is outside its AWS Organization. Account B can see that a resource share invitation is pending but cannot yet associate the shared rule with its VPC. What must account B do first?

  1. Create an inbound Resolver endpoint in account B before accepting the resource share invitation
  2. Create a second copy of the identical Resolver rule in account B instead of accepting the share
  3. Accept the AWS RAM resource-share invitation for the Resolver rule in account B
  4. Add the account B private hosted zone to account A before resolving any corporate names
  5. Add a VPC peering connection between account A and account B instead of accepting the pending invitation

Explanation

Correct Answer

C:

An account outside the sharing organization must accept the RAM invitation before the shared Resolver forwarding rule is available. It can then associate the rule with authorized VPCs.

Incorrect Answers

A:

Inbound Resolver endpoints handle queries sent into a VPC from external DNS systems. They do not confer permission to use a Resolver forwarding rule offered by another account.

B:

Creating an independent rule bypasses the intended centrally managed rule and does not activate the existing cross-account RAM share. The stated requirement is to reuse the shared rule.

D:

Private hosted zone association grants scoped authority for AWS-owned DNS zones; it does not accept a RAM invitation for a conditional Resolver forwarding rule.

E:

Routing connectivity across peered VPCs does not authorize consumption of a separately shared Route 53 Resolver forwarding rule. RAM invitation acceptance is the missing control-plane step.

Question 186

A DNS admin creates an outbound Resolver rule for `corp.example` but VPC queries still use the default resolver behavior. Which next step is necessary?

  1. Add a Route 53 Resolver outbound endpoint and forwarding rule with target resolver IPs
  2. Share the Resolver rule with participating accounts by using AWS RAM
  3. Create Route 53 Resolver inbound endpoint IP addresses and point conditional forwarding to them
  4. Associate the outbound forwarding rule with the workload VPC

Explanation

Correct Answer

D:

A rule controls resolution only for VPCs associated with it; merely creating a rule in an account has no global DNS effect.

Incorrect Answers

A:

Resolver outbound rules direct matching VPC queries across network connectivity to selected external name servers; that addresses outbound conditional forwarding to enterprise DNS, rather than activating conditional forwarding in a specific VPC.

B:

AWS RAM distributes rule access while consumers associate the rule with their VPCs; this belongs to reusable hybrid DNS rules across AWS accounts, while the problem is activating conditional forwarding in a specific VPC.

C:

Inbound endpoints provide supported external DNS ingress into a VPC's resolver context; a random instance IP is not equivalent; this changes DNS ingress from corporate resolvers into Route 53 Resolver, not the necessary activating conditional forwarding in a specific VPC.

Question 187

A shared Resolver outbound endpoint is deployed only in one Availability Zone. Which change improves hybrid DNS resilience?

  1. Add outbound endpoint IP addresses in subnets spanning multiple Availability Zones
  2. Add a Route 53 Resolver outbound endpoint and forwarding rule with target resolver IPs
  3. Ensure bidirectional network routing and endpoint security-group permission for DNS traffic
  4. Create Route 53 Resolver inbound endpoint IP addresses and point conditional forwarding to them

Explanation

Correct Answer

A:

Multi-AZ resolver endpoints reduce dependency on one zone's networking while sending DNS queries toward corporate servers.

Incorrect Answers

B:

Resolver outbound rules direct matching VPC queries across network connectivity to selected external name servers; this belongs to outbound conditional forwarding to enterprise DNS, while the problem is zonally resilient hybrid DNS forwarding.

C:

Resolver forwarding requires network reachability between endpoint addresses and target resolvers in both directions; this changes return-path reachability for hybrid DNS endpoints, not the necessary zonally resilient hybrid DNS forwarding.

D:

In the DNS ingress from corporate resolvers into Route 53 Resolver workflow, inbound endpoints provide supported external DNS ingress into a VPC's resolver context; a random instance IP is not equivalent; the current case needs zonally resilient hybrid DNS forwarding.

Question 188

A hybrid design uses a central inbound Resolver endpoint and an on-premises forwarder; firewall policy denies UDP and TCP port 53. What must be corrected?

  1. Review the matching DNS Firewall domain list rules and their evaluation priorities
  2. Create Route 53 Resolver inbound endpoint IP addresses and point conditional forwarding to them
  3. Publish an SRV record for the relevant service and protocol
  4. Permit required DNS traffic on both UDP and TCP port 53 to endpoint addresses

Explanation

Correct Answer

D:

Recursive DNS primarily uses UDP but may require TCP for larger messages or protocol fallback; both must be routable and permitted.

Incorrect Answers

A:

Resolver DNS Firewall evaluates rule-group associations and ordered rules to permit, block, or alert on domain queries; that addresses domain-specific resolver filtering behavior, rather than supported DNS transport to inbound Resolver endpoints.

B:

Inbound endpoints provide supported external DNS ingress into a VPC's resolver context; a random instance IP is not equivalent; this belongs to DNS ingress from corporate resolvers into Route 53 Resolver, while the problem is supported DNS transport to inbound Resolver endpoints.

C:

SRV records indicate service endpoints, ports, and priorities, whereas A records convey only IPv4 addresses; this changes service-and-port discovery through DNS, not the necessary supported DNS transport to inbound Resolver endpoints.

Question 189

A private hosted zone is associated with an endpoint VPC but workloads in a peered VPC cannot resolve its internal names. What should be considered?

  1. Do not expect AWS Organizations membership alone to grant private-zone resolution
  2. Recognize private hosted zone precedence for the matching suffix
  3. Associate the private hosted zone directly with the querying VPC or use an explicit Resolver forwarding design
  4. Authorize the external VPC association and then associate that VPC with the hosted zone

Explanation

Correct Answer

C:

Private hosted zone associations do not implicitly follow peering connections; resolver scope is independent of routed reachability.

Incorrect Answers

A:

Organizational membership can help authorize resource-sharing workflows, but VPC association controls resolver visibility for private hosted zones; that addresses explicit network-scoped private DNS authorization, rather than DNS visibility independent of peering topology.

B:

The associated private zone is authoritative for that VPC namespace; unanswered names do not normally spill to the public zone; this belongs to private DNS namespace precedence over public records, while the problem is DNS visibility independent of peering topology.

D:

In the cross-account private hosted zone association workflow, cross-account private-zone use requires both hosted-zone authorization and an association action, not just shared account credentials; the current case needs DNS visibility independent of peering topology.

Question 190

A dualstack Application Load Balancer serves an internal application and Route 53 hosts its private zone. Its AWS-managed IPv6 addresses can change. Which record type avoids hardcoding an address?

  1. Create an A alias to the ALB and rely on it for IPv6 AAAA responses as well
  2. Publish a literal AAAA record with the ALB’s current IPv6 addresses
  3. Create an SRV record containing the ALB hostname and its HTTPS port
  4. Create an AAAA alias record that targets the dualstack Application Load Balancer

Explanation

Correct Answer

D:

An AAAA alias to the dualstack ALB resolves IPv6 clients using the load balancer’s AWS-managed target rather than pinning an IP address. The alias remains correct when backend addresses change.

Incorrect Answers

A:

An A alias returns an IPv4-oriented answer, not an AAAA response for IPv6-only lookups. The DNS name needs the IPv6 alias record explicitly.

B:

A literal AAAA record pins addresses that the load balancer can change. An alias delegates resolution to the AWS-managed ALB target.

C:

SRV records advertise service location and port metadata for SRV-aware clients, not the AAAA response used for ordinary IPv6 hostname resolution.

AWS Certified Advanced Networking - Specialty ANS-C01 Practice Tests