vpc peering

A company has an AWS account that contains three VPCs (Dev, Test, and Prod) in the same region. Test is peered to both Prod and Dev. All VPCs have non-overlapping CIDR blocks. The company wants to push minor code releases from Dev to Prod to speed up time to market. Which of the following options helps the company accomplish this?🤪

• Create a new peering connection Between Prod and Dev along with appropriate routes.

• Create a new entry to Prod in the Dev route table using the peering connection as the target.

• Attach a second gateway to Dev. Add a new entry in the Prod route table identifying the gateway as the target.

• The VPCs have non-overlapping CIDR blocks in the same account. The route tables contain local routes for all VPCs.

Instance A and instance B are running in two different subnets A and B of a VPC. Instance A is not able to ping instance B. What are two possible reasons for this? (Pick 2 correct answers)🤪

• The routing table of subnet A has no target route to subnet B

• The security group attached to instance B does not allow inbound ICMP traffic

• The policy linked to the IAM role on instance A is not configured correctly

• The NACL on subnet B does not allow outbound ICMP traffic

An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and deny all outbound traffic. The instance’s security group is configured to allow SSH from any IP address and deny all outbound traffic. What changes need to be made to allow SSH access to the instance?🤪

• The outbound security group needs to be modified to allow outbound traffic

• The outbound network ACL needs to be modified to allow outbound traffic

• Nothing, it can be accessed from any IP address using SSH

• Both the outbound security group and outbound network ACL need to be modified to allow outbound traffic.

What is the difference between a security group in VPC and a network ACL in VPC (choose 3 correct answers)😜

• Security group restricts access to a Subnet while ACL restricts traffic to EC2

• Security group restricts access to EC2 while ACL restricts traffic to a subnet

• Security group can work outside the VPC also while ACL only works within a VPC

• Network ACL performs stateless filtering and Security group provides stateful filtering

• Security group can only set Allow rule, while ACL can set Deny rule also

You are currently hosting multiple applications in a VPC and have logged numerous port scans coming in from a specific IP address block. Your security team has requested that all access from the offending IP address block be denied for the next 24 hours. Which of the following is the best method to quickly and temporarily deny access from the specified IP address block?😨😱

• Create an AD policy to modify Windows Firewall settings on all hosts in the VPC to deny access from the IP address block

• Modify the Network ACLs associated with all public subnets in the VPC to deny access from the IP address block

• Add a rule to all of the VPCs Security Groups to deny access from the IP address block

• Modify the Windows Firewall settings on all Amazon Machine Images (AMIs) that your organization uses in that VPC to deny access from the IP address block