Exam Bundle

IAM group: Collects IAM user identities, not network-facility availability. This does not address the need for A VPC design needs a subnet-level stateless packet filter with allow and deny rules. The appropriate Network ACL applies because Network ACLs operate at subnet boundaries and are stateless, so return traffic must also be allowed.

AWS WAF: Filters HTTP(S) web requests by configured rules. This does not address the need for A VPC design needs a subnet-level stateless packet filter with allow and deny rules. The appropriate Network ACL applies because Network ACLs operate at subnet boundaries and are stateless, so return traffic must also be allowed.

Security group: Filters supported resource network traffic using stateful rules. This does not address the need for A VPC design needs a subnet-level stateless packet filter with allow and deny rules. The appropriate Network ACL applies because Network ACLs operate at subnet boundaries and are stateless, so return traffic must also be allowed.

IAM group: Collects IAM user identities, not network-facility availability. That does not meet the requirement: A network team needs controls applied at subnet boundaries rather than individual interface attachments.

AWS WAF: Filters HTTP(S) web requests by configured rules. That does not meet the requirement: A network team needs controls applied at subnet boundaries rather than individual interface attachments.

Security group: Filters supported resource network traffic using stateful rules. That does not meet the requirement: A network team needs controls applied at subnet boundaries rather than individual interface attachments.

AWS WAF: Filters HTTP(S) web requests by configured rules. This does not address the need for A network team needs controls applied at subnet boundaries rather than individual interface attachments. The appropriate Network ACL applies because Network ACLs operate at subnet boundaries and are stateless, so return traffic must also be allowed.

IAM group: Collects IAM user identities, not network-facility availability. This does not address the need for A network team needs controls applied at subnet boundaries rather than individual interface attachments. The appropriate Network ACL applies because Network ACLs operate at subnet boundaries and are stateless, so return traffic must also be allowed.

Security group: Filters supported resource network traffic using stateful rules. This does not address the need for A network team needs controls applied at subnet boundaries rather than individual interface attachments. The appropriate Network ACL applies because Network ACLs operate at subnet boundaries and are stateless, so return traffic must also be allowed.

Amazon CloudFront: Delivers and caches content at edge locations through a CDN. That does not meet the requirement: Consider this AWS requirement: A business wants its domain name resolved to a published application endpoint.

AWS Direct Connect provides dedicated customer-to-AWS connectivity. That does not meet the requirement: Consider this AWS requirement: A business wants its domain name resolved to a published application endpoint.

Amazon VPC creates logically isolated IP networks. That does not meet the requirement: Consider this AWS requirement: A business wants its domain name resolved to a published application endpoint.

Amazon CloudFront: Delivers and caches content at edge locations through a CDN. This does not address the need for A business wants its domain name resolved to a published application endpoint. The appropriate Amazon Route 53 applies because Route 53 offers managed domain name system functions including DNS resolution and routing policies.

AWS Direct Connect provides dedicated customer-to-AWS connectivity. This does not address the need for A business wants its domain name resolved to a published application endpoint. The appropriate Amazon Route 53 applies because Route 53 offers managed domain name system functions including DNS resolution and routing policies.

Amazon VPC creates logically isolated IP networks. This does not address the need for A business wants its domain name resolved to a published application endpoint. The appropriate Amazon Route 53 applies because Route 53 offers managed domain name system functions including DNS resolution and routing policies.

Amazon VPC creates logically isolated IP networks. That does not meet the requirement: A web app needs authoritative DNS records that direct users to services.

AWS Direct Connect provides dedicated customer-to-AWS connectivity. That does not meet the requirement: A web app needs authoritative DNS records that direct users to services.

Amazon CloudFront: Delivers and caches content at edge locations through a CDN. That does not meet the requirement: A web app needs authoritative DNS records that direct users to services.

Amazon VPC creates logically isolated IP networks. This does not address the need for A web app needs authoritative DNS records that direct users to services. The appropriate Amazon Route 53 applies because Route 53 offers managed domain name system functions including DNS resolution and routing policies.

AWS Direct Connect provides dedicated customer-to-AWS connectivity. This does not address the need for A web app needs authoritative DNS records that direct users to services. The appropriate Amazon Route 53 applies because Route 53 offers managed domain name system functions including DNS resolution and routing policies.

Amazon CloudFront: Delivers and caches content at edge locations through a CDN. This does not address the need for A web app needs authoritative DNS records that direct users to services. The appropriate Amazon Route 53 applies because Route 53 offers managed domain name system functions including DNS resolution and routing policies.

Amazon CloudFront: Delivers and caches content at edge locations through a CDN. That does not meet the requirement: A technical reviewer evaluates this need: A company wants an encrypted connection over the internet between its office and AWS network.

Amazon Route 53 provides managed DNS services. That does not meet the requirement: A technical reviewer evaluates this need: A company wants an encrypted connection over the internet between its office and AWS network.

AWS Direct Connect provides dedicated customer-to-AWS connectivity. That does not meet the requirement: A technical reviewer evaluates this need: A company wants an encrypted connection over the internet between its office and AWS network.

Amazon CloudFront: Delivers and caches content at edge locations through a CDN. This does not address the need for A company wants an encrypted connection over the internet between its office and AWS network. The appropriate AWS Site-to-Site VPN applies because Site-to-Site VPN provides encrypted tunnels across internet connectivity for supported on-premises-to-AWS links.

AWS Direct Connect provides dedicated customer-to-AWS connectivity. This does not address the need for A company wants an encrypted connection over the internet between its office and AWS network. The appropriate AWS Site-to-Site VPN applies because Site-to-Site VPN provides encrypted tunnels across internet connectivity for supported on-premises-to-AWS links.

Amazon Route 53 provides managed DNS services. This does not address the need for A company wants an encrypted connection over the internet between its office and AWS network. The appropriate AWS Site-to-Site VPN applies because Site-to-Site VPN provides encrypted tunnels across internet connectivity for supported on-premises-to-AWS links.

AWS Direct Connect provides dedicated customer-to-AWS connectivity. That does not meet the requirement: An organization must connect on-premises networking to a VPC over an IPsec-based tunnel.

Amazon Route 53 provides managed DNS services. That does not meet the requirement: An organization must connect on-premises networking to a VPC over an IPsec-based tunnel.

Amazon CloudFront: Delivers and caches content at edge locations through a CDN. That does not meet the requirement: An organization must connect on-premises networking to a VPC over an IPsec-based tunnel.

AWS Direct Connect provides dedicated customer-to-AWS connectivity. This does not address the need for An organization must connect on-premises networking to a VPC over an IPsec-based tunnel. The appropriate AWS Site-to-Site VPN applies because Site-to-Site VPN provides encrypted tunnels across internet connectivity for supported on-premises-to-AWS links.

Amazon Route 53 provides managed DNS services. This does not address the need for An organization must connect on-premises networking to a VPC over an IPsec-based tunnel. The appropriate AWS Site-to-Site VPN applies because Site-to-Site VPN provides encrypted tunnels across internet connectivity for supported on-premises-to-AWS links.

Amazon CloudFront: Delivers and caches content at edge locations through a CDN. This does not address the need for An organization must connect on-premises networking to a VPC over an IPsec-based tunnel. The appropriate AWS Site-to-Site VPN applies because Site-to-Site VPN provides encrypted tunnels across internet connectivity for supported on-premises-to-AWS links.