Design (15%)

300-440 · 45 questions

• A hotel chain needs the WAN provider to queue voice ahead of bulk data and to commit to a loss target between the hotels and a cloud contact-center VPC. Which connectivity choice fits?
• A bank's control owner says a dataset must not cross the public internet and must run only in a FedRAMP-authorized cloud offering. Which connectivity recommendation fits?
• A retailer must keep an internet IPsec path into an Azure virtual network up through a gateway-instance failure, without waiting for a standby instance to claim one public address. Which design meets that requirement?
• A retailer wants the 99.99 percent availability target Google documents for HA VPN between the campus and a VPC. What must the campus build to qualify on the Google Cloud side?
• A hospital control says a records workload must stay off the public internet to meet the ISO control they adopted, and the workload already runs in the approved cloud environment. Which connectivity recommendation fits?
• A stadium has two internet providers and must keep AWS transit-gateway VPN paths independent, so one provider failure withdraws only that provider's routes. Which design fits?
• A hospital has one AWS Site-to-Site VPN connection from the campus. One of the two tunnels is down and the other is up, and traffic to the VPC continues. Why is that flow expected to survive?
• Two application subnets inside one AWS VPC must stop communicating with each other. The site-to-site VPN from the campus must stay up, and inbound internet publishing is unchanged. Which policy belongs on this change?
• A bank wants every internet-bound flow that starts inside an AWS VPC to be inspected by the campus firewall. Traffic between two private subnets in the VPC must stay inside AWS. Which policy matches the internet requirement?
• A broker must keep a private AWS path up if an entire Direct Connect location fails. One dedicated connection exists at a single location today. What adds that location resiliency?
• A studio needs its own AWS Direct Connect port speed, not a slice of a partner's shared port. Which attachment matches?
• A factory needs a committed bandwidth into an AWS VPC, sized to a port they order, rather than a best-effort internet rate. Which connectivity choice matches?
• A defense contractor's adopted NIST-based control says the regulated dataset must not traverse the public internet. The workload already sits in the approved cloud environment. Which connectivity recommendation fits?
• Two application VPCs are peered. The security team must stop one VPC from reaching the database subnet in the other. The campus site-to-site VPN must stay unchanged. Which policy is this?
• A ticket company wants customers on the public internet to reach a web application in a cloud VPC. Campus VPN users must keep today's site-to-site path. Which policy is the new requirement?
• A hospital has two campus routers and wants an AWS VPN path to survive the failure of either router. One VPN connection on one router exists today. What should they add?
• A records firm's adopted control says a dataset must stay in-region and off the public internet. A faster internet VPN would hairpin through another country's POP. The approved environment is already in-region. Which connectivity fits?
• A bank uses one AWS Direct Connect path for production and wants traffic to fall back to an internet VPN only when that private path fails. Which design matches?
• Internet customers reach a web application through a cloud load balancer. Return traffic is being forced back through the campus firewall, and the customers' sessions fail. Campus VPN users are a separate path. What should the return path do?
• A retailer's store prefixes change several times a month. Each change must reach an Azure virtual network without a ticket to edit static routes on the VPN. Which routing choice fits?
• A shipper has one SDCI port in a single metro into AWS and wants the private path to survive that metro failing. They can buy a second SDCI port in another metro. What routing should use both?
• A bank's adopted control requires the records path to be encrypted. The path today is an AWS Direct Connect private virtual interface with no encryption. Staying off the public internet is also required. What should they add?
• A gallery must let internet visitors reach a new web application in a cloud VPC. Two private subnets must keep talking to each other. The campus VPN stays as it is. Which change meets the visitor requirement?
• Two subnets in an Azure virtual network must stop talking to each other. Internet-bound traffic from those subnets must keep using Azure's internet path, not the campus. Which control fits?
• A retailer firewall drops any flow that returns on a different tunnel from the one it used outbound. They still want an Azure VPN that fails over if the active instance is lost. Which gateway mode fits?
• A hotel's MPLS provider contract schedules voice only when the voice class is marked at the handoff into a cloud contact-center path. The internet is not on this path. What must the hotel edge do?
• A contractor can save money with an internet VPN into a commercial cloud region. The workload must run in the dedicated government cloud offering that holds the FedRAMP authorization the contract names, and must stay off the public internet. Which recommendation fits?
• A clinic wants the 99.99 percent HA VPN topology Google documents to a VPC in one region. They have one HA VPN gateway and a tunnel on only one of its two interfaces. What completes that topology?
• A records firm may send guest traffic over an internet VPN. A stated control says the regulated dataset stays off the public internet. Which path can carry that dataset?
• Two workloads in a cloud VPC must be inspected when they talk to each other. The inspection must stay in the cloud. Campus delay is not acceptable. Which policy fits?
• A publisher keeps a replica of a VPC in a second AWS region. The campus must still reach the replica if the first region is lost. What provides that survival?
• A plant has two equal internet providers and an AWS VPN on each. Both paths should be used, and a provider failure should withdraw only that path. Static defaults are the only routing today. What should replace them?
• A clinic advertises one campus prefix into an AWS VPN, and that prefix has not changed in years. There is no plan to add prefixes. Which routing is sufficient?
• A hospital has one ExpressRoute circuit in one peering location. The private path must survive the loss of that location. What adds that survival?
• A bank must encrypt the Direct Connect link itself with MACsec. A hosted connection is what they have today. Which change fits that requirement?
• A clinic has one Google Cloud HA VPN gateway. BGP is up on only one of the two interfaces. That tunnel fails and the VPC prefix disappears. What should also be up?
• Every internet flow from an Azure virtual network must leave through the campus firewall. East-west traffic inside the virtual network can stay local. What meets the internet requirement?
• Internet traffic from a virtual network must be inspected in the cloud. Backhaul to campus is forbidden. East-west traffic inside the virtual network is out of scope. What meets the internet requirement?
• A control says a dataset must use a private path into one named cloud region. An internet VPN into that same region is up. Which path meets the control?
• Both tunnels of one AWS VPN connection leave through the same internet provider. A second provider is already installed and unused. One provider failure should leave a tunnel up. What should change?
• A campus must keep independent native VPNs to AWS and to Azure. Prefixes on each side change often. What fits?
• A partner must reach one published application in a VPC and must not reach the rest of the VPC. A full site-to-site VPN from the partner is proposed. What fits?
• A control says a dataset must stay in a named authorized cloud offering. A private interconnect into a cheaper commercial region is up. The commercial region is not that offering. Which path meets the control?
• A control requires encryption in transit for a dataset and does not require a private path. An unencrypted private port is available. An IPsec VPN over the internet is available. Which path meets the control?
• A startup needs best-effort private connectivity into a VPC and does not need a bandwidth commitment or the whole port. A partner can sell a hosted connection. What is sufficient?