Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Practice Test 3

Question 20

Two healthy web regions should get traffic based on measured latency from DNS resolvers, not geographic country boundaries. Which Route 53 routing policy fits?

  1. Use geoproximity routing with traffic bias values
  2. Create latency-based records for each regional endpoint
  3. Configure geolocation routing records with country-specific rules and a default record
  4. Define Route 53 failover records with primary and secondary roles and appropriate health evaluation

Explanation

Correct Answer

B:

Latency routing uses AWS measurements to choose the record associated with the lower-latency AWS Region for a query.

Incorrect Answers

A:

Geoproximity policies alter the area from which an endpoint attracts DNS traffic, enabling deliberate regional traffic-shaping; that addresses geographical attraction controlled by traffic bias, rather than DNS region selection based on estimated network latency.

C:

Geolocation routing selects responses from location mappings, with a default for clients not matching a specified geography; this changes country-based DNS steering, not the necessary DNS region selection based on estimated network latency.

D:

In the active-passive authoritative DNS failover workflow, failover policies prefer the primary while healthy and can provide the secondary record when the primary fails its health condition; the current case needs DNS region selection based on estimated network latency.

Question 21

A canary deployment should initially receive approximately one-tenth of eligible DNS responses. Which approach allows the target split?

  1. Create a Route 53 private hosted zone and associate the intended VPCs
  2. Create latency-based records for each regional endpoint
  3. Configure weighted Route 53 records with relative weights of 10 and 90
  4. Publish an MX record identifying the mail exchanger and its preference

Explanation

Correct Answer

C:

Weighted routing distributes DNS answers approximately by configured proportions across eligible records, subject to resolver caching.

Incorrect Answers

A:

A private hosted zone is resolved through VPC DNS facilities for associated VPCs rather than published to the public DNS hierarchy; that addresses VPC-scoped authoritative private DNS records, rather than proportional DNS-based rollout.

B:

Latency routing uses AWS measurements to choose the record associated with the lower-latency AWS Region for a query; this belongs to DNS region selection based on estimated network latency, while the problem is proportional DNS-based rollout.

D:

In the specification of inbound mail exchangers workflow, MX records direct SMTP delivery toward named mail servers with priorities, unlike address records used to locate hosts; the current case needs proportional DNS-based rollout.

Question 22

A company must answer names for an internal app only from VPCs authorized to use a private namespace. What should host those records?

  1. Associate the additional VPC with the existing private hosted zone
  2. Investigate the private-zone namespace shadowing of unmatched names
  3. Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs
  4. Create a Route 53 private hosted zone and associate the intended VPCs

Explanation

Correct Answer

D:

A private hosted zone is resolved through VPC DNS facilities for associated VPCs rather than published to the public DNS hierarchy.

Incorrect Answers

A:

Private zone resolution is determined by authorized VPC associations, not by the AWS account boundary alone; that addresses sharing an authoritative private zone among VPCs, rather than VPC-scoped authoritative private DNS records.

B:

A matching private hosted zone takes precedence for that namespace; absent private records do not automatically fall back to the public zone; this belongs to avoiding mistaken public fallback when private DNS overrides a suffix, while the problem is VPC-scoped authoritative private DNS records.

C:

The inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context; this changes resolving AWS private-zone names from external DNS infrastructure, not the necessary VPC-scoped authoritative private DNS records.

Question 23

An operations team delegates `research.example.org` to a different DNS operator while retaining the parent hosted zone. Which DNS record is essential in the parent?

  1. Enable DNSSEC signing for the Route 53 public hosted zone and establish its chain of trust
  2. Add an NS delegation record set for the child zone's authoritative name servers
  3. Set the registrar's authoritative name-server delegation to the hosted zone's assigned NS values
  4. Investigate the private-zone namespace shadowing of unmatched names

Explanation

Correct Answer

B:

NS delegation informs resolvers which authoritative servers control the delegated subdomain's records. The parent publishes NS records for the child even though the child zone may be hosted by a different DNS provider.

Incorrect Answers

A:

DNSSEC signs DNS data and relies on delegation signer information so validating resolvers can verify authentic responses; that addresses signed public authoritative DNS data, rather than delegation of child DNS authority.

C:

The parent-zone delegation determines which public authoritative servers answer for the domain, independent of where records are edited; this changes alignment of registry delegation with authoritative DNS hosting, not the necessary delegation of child DNS authority.

D:

In the avoiding mistaken public fallback when private DNS overrides a suffix workflow, A matching private hosted zone takes precedence for that namespace; absent private records do not automatically fall back to the public zone; the current case needs delegation of child DNS authority.

Question 24

A service owner wants clients to discover a mail receiving service for a domain rather than an IPv4 address. Which DNS resource record type is necessary?

  1. Configure geolocation routing records with country-specific rules and a default record
  2. Publish an MX record identifying the mail exchanger and its preference
  3. Create a Route 53 alias A record targeting the Application Load Balancer
  4. Add a PTR record under the proper reverse-lookup domain
  5. Publish an AAAA record for the service hostname

Explanation

Correct Answer

B:

MX records direct SMTP delivery toward named mail servers with priorities, unlike address records used to locate hosts.

Incorrect Answers

A:

Geolocation routing selects responses from location mappings, with a default for clients not matching a specified geography; that addresses country-based DNS steering, rather than specification of inbound mail exchangers.

C:

Alias records can target supported AWS resources and resolve their current addresses without hardcoding balancer IPs; this changes stable DNS mapping to an AWS-managed load balancer, not the necessary specification of inbound mail exchangers.

D:

In the reverse address-to-name resolution workflow, PTR records map reversed IP address names to hostnames, enabling conventional reverse DNS queries; the current case needs specification of inbound mail exchangers.

E:

This produces DNS mapping of a host name to an IPv6 address: AAAA record data contains IPv6 addresses; A records contain IPv4 addresses and cannot substitute an IPv6 response; the stem instead tests specification of inbound mail exchangers.

Question 25

A public site should use a primary endpoint normally but return a backup DNS answer when the primary's health check fails. Which routing policy works?

  1. Use IP-based routing with a CIDR collection mapped to record sets
  2. Review the Route 53 health check's HealthCheckStatus metric in CloudWatch
  3. Define Route 53 failover records with primary and secondary roles and appropriate health evaluation
  4. Configure geolocation routing records with country-specific rules and a default record

Explanation

Correct Answer

C:

Failover policies prefer the primary while healthy and can provide the secondary record when the primary fails its health condition.

Incorrect Answers

A:

IP-based routing selects a DNS record based on the querying resolver's matched source CIDR collection; that addresses IP-CIDR-based DNS answer selection, rather than active-passive authoritative DNS failover.

B:

DNS record query volume is distinct from endpoint reachability; health-check status reports whether configured probes consider the target healthy; this belongs to monitoring DNS-routing endpoint health, while the problem is active-passive authoritative DNS failover.

D:

In the country-based DNS steering workflow, geolocation routing selects responses from location mappings, with a default for clients not matching a specified geography; the current case needs active-passive authoritative DNS failover.

Question 26

An organization wants DNS clients in one country to resolve a different published endpoint than clients in other countries, independent of measured latency. Which policy should be used?

  1. Create latency-based records for each regional endpoint
  2. Publish an MX record identifying the mail exchanger and its preference
  3. Use IP-based routing with a CIDR collection mapped to record sets
  4. Configure geolocation routing records with country-specific rules and a default record

Explanation

Correct Answer

D:

Geolocation routing selects responses from location mappings, with a default for clients not matching a specified geography.

Incorrect Answers

A:

Latency routing uses AWS measurements to choose the record associated with the lower-latency AWS Region for a query; that addresses DNS region selection based on estimated network latency, rather than country-based DNS steering.

B:

MX records direct SMTP delivery toward named mail servers with priorities, unlike address records used to locate hosts; this belongs to specification of inbound mail exchangers, while the problem is country-based DNS steering.

C:

IP-based routing selects a DNS record based on the querying resolver's matched source CIDR collection; this changes IP-CIDR-based DNS answer selection, not the necessary country-based DNS steering.

Question 27

A company manages multiple on-premises datacenter IPs and wants a policy that can move traffic toward a location by altering a geographic bias. Which Route 53 policy applies?

  1. Use geoproximity routing with traffic bias values
  2. Define Route 53 failover records with primary and secondary roles and appropriate health evaluation
  3. Create latency-based records for each regional endpoint
  4. Use IP-based routing with a CIDR collection mapped to record sets

Explanation

Correct Answer

A:

Geoproximity policies alter the area from which an endpoint attracts DNS traffic, enabling deliberate regional traffic-shaping.

Incorrect Answers

B:

Failover policies prefer the primary while healthy and can provide the secondary record when the primary fails its health condition; this belongs to active-passive authoritative DNS failover, while the problem is geographical attraction controlled by traffic bias.

C:

Latency routing uses AWS measurements to choose the record associated with the lower-latency AWS Region for a query; this changes DNS region selection based on estimated network latency, not the necessary geographical attraction controlled by traffic bias.

D:

In the IP-CIDR-based DNS answer selection workflow, IP-based routing selects a DNS record based on the querying resolver's matched source CIDR collection; the current case needs geographical attraction controlled by traffic bias.

Question 28

A company wants a different DNS answer for clients in a defined set of corporate source networks regardless of physical location. What Route 53 capability provides this?

  1. Define Route 53 failover records with primary and secondary roles and appropriate health evaluation
  2. Use geoproximity routing with traffic bias values
  3. Use IP-based routing with a CIDR collection mapped to record sets
  4. Configure geolocation routing records with country-specific rules and a default record

Explanation

Correct Answer

C:

IP-based routing selects a DNS record based on the querying resolver's matched source CIDR collection. The decision is based on the source address Route 53 sees for the recursive resolver, which may differ from the individual client’s address.

Incorrect Answers

A:

Failover policies prefer the primary while healthy and can provide the secondary record when the primary fails its health condition; that addresses active-passive authoritative DNS failover, rather than IP-CIDR-based DNS answer selection.

B:

Geoproximity policies alter the area from which an endpoint attracts DNS traffic, enabling deliberate regional traffic-shaping; this belongs to geographical attraction controlled by traffic bias, while the problem is IP-CIDR-based DNS answer selection.

D:

In the country-based DNS steering workflow, geolocation routing selects responses from location mappings, with a default for clients not matching a specified geography; the current case needs IP-CIDR-based DNS answer selection.

Question 29

After replacing an A record, some clients continue using the old response for several minutes. Which DNS behavior explains the lag?

  1. Use IP-based routing with a CIDR collection mapped to record sets
  2. Add a PTR record under the proper reverse-lookup domain
  3. Configure geolocation routing records with country-specific rules and a default record
  4. Enable DNSSEC signing for the Route 53 public hosted zone and establish its chain of trust
  5. Publish an MX record identifying the mail exchanger and its preference
  6. Account for recursive resolver and client caching until the old record TTL expires

Explanation

Correct Answer

F:

DNS TTL values control how long prior responses can be reused by caches, so an authoritative update is not immediately observed everywhere.

Incorrect Answers

A:

IP-based routing selects a DNS record based on the querying resolver's matched source CIDR collection; that addresses IP-CIDR-based DNS answer selection, rather than DNS cache persistence after record changes.

B:

PTR records map reversed IP address names to hostnames, enabling conventional reverse DNS queries; this belongs to reverse address-to-name resolution, while the problem is DNS cache persistence after record changes.

C:

Geolocation routing selects responses from location mappings, with a default for clients not matching a specified geography; this changes country-based DNS steering, not the necessary DNS cache persistence after record changes.

D:

In the signed public authoritative DNS data workflow, DNSSEC signs DNS data and relies on delegation signer information so validating resolvers can verify authentic responses; the current case needs DNS cache persistence after record changes.

E:

This produces specification of inbound mail exchangers: MX records direct SMTP delivery toward named mail servers with priorities, unlike address records used to locate hosts; the stem instead tests DNS cache persistence after record changes.

Question 30

A security team wants a public zone to provide cryptographic proof of DNS record authenticity to validating resolvers. Which control must be enabled?

  1. Add an NS delegation record set for the child zone's authoritative name servers
  2. Set the registrar's authoritative name-server delegation to the hosted zone's assigned NS values
  3. Review the Route 53 health check's HealthCheckStatus metric in CloudWatch
  4. Define Route 53 failover records with primary and secondary roles and appropriate health evaluation
  5. Enable DNSSEC signing for the Route 53 public hosted zone and establish its chain of trust

Explanation

Correct Answer

E:

DNSSEC signs DNS data and relies on delegation signer information so validating resolvers can verify authentic responses.

Incorrect Answers

A:

NS delegation informs resolvers which authoritative servers control the delegated subdomain's records; that addresses delegation of child DNS authority, rather than signed public authoritative DNS data.

B:

The parent-zone delegation determines which public authoritative servers answer for the domain, independent of where records are edited; this belongs to alignment of registry delegation with authoritative DNS hosting, while the problem is signed public authoritative DNS data.

C:

DNS record query volume is distinct from endpoint reachability; health-check status reports whether configured probes consider the target healthy; this changes monitoring DNS-routing endpoint health, not the necessary signed public authoritative DNS data.

D:

In the active-passive authoritative DNS failover workflow, failover policies prefer the primary while healthy and can provide the secondary record when the primary fails its health condition; the current case needs signed public authoritative DNS data.

AWS Certified Advanced Networking - Specialty ANS-C01 Practice Tests