SIMULATION 1 A company has decided to scale its e-commerce application from its corporate datacenter to a commercial cloud provider to meet an anticipated increase in demand during an upcoming holiday. The majority of the application load takes place on the application server under normal conditions. For this reason, the company decides to deploy additional application servers into a commercial cloud provider using the on-premises orchestration engine that installs and configures common software and network configurations. The remote computing environment is connected to the on-premises datacenter via a site-to-site IPSec tunnel. The external DNS provider has been configured to use weighted round-robin routing to load balance connections from the Internet. During testing, the company discovers that only 20% of connections completed successfully. INSTRUCTIONS Review the network architecture and supporting documents and fulfill these requirements:

Part 1:

Analyze the configuration of the following components: DNS, Firewall 1, Firewall 2, Router

Router 2, VPN and Orchestrator Server.

Identify the problematic device(s).

Part 2:

Identify the correct options to provide adequate configuration for hybrid cloud architecture.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. Part 1:

Cloud Hybrid Network Diagram Part 2:

Only select a maximum of TWO options from the multiple choice question. (Choose two.)

Question

SIMULATION 1 A company has decided to scale its e-commerce application from its corporate datacenter to a commercial cloud provider to meet an anticipated increase in demand during an upcoming holiday. The majority of the application load takes place on the application server under normal conditions. For this reason, the company decides to deploy additional application servers into a commercial cloud provider using the on-premises orchestration engine that installs and configures common software and network configurations. The remote computing environment is connected to the on-premises datacenter via a site-to-site IPSec tunnel. The external DNS provider has been configured to use weighted round-robin routing to load balance connections from the Internet. During testing, the company discovers that only 20% of connections completed successfully. INSTRUCTIONS Review the network architecture and supporting documents and fulfill these requirements:

Part 1:

Analyze the configuration of the following components: DNS, Firewall 1, Firewall 2, Router

Router 2, VPN and Orchestrator Server.

Identify the problematic device(s).

Part 2:

Identify the correct options to provide adequate configuration for hybrid cloud architecture.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. Part 1:

Cloud Hybrid Network Diagram Part 2:

Only select a maximum of TWO options from the multiple choice question. (Choose two.)

Accepted Answer

A. Update the PSK (Pre-shared key) in Router 2. The PSK must be identical on both VPN peers for IKE authentication to succeed; a mismatched PSK on Router 2 would cause the IPSec tunnel negotiation to fail, blocking all traffic between on-premises and the cloud. D. Change the Address Space on Router 2. The address space configured on Router 2 must correctly identify the remote network subnets; an incorrect or overlapping address space causes routing failures over the tunnel, preventing traffic from reaching cloud-hosted application servers.

Answer

B. Update the A record on the DNS from 2.2.2.2 to 1.1.1.1. Updating the DNS A record changes where Internet clients are directed but does not resolve VPN connectivity issues between on-premises and the cloud.

Answer

C. Promote deny All to allow All in Firewall 1 and Firewall 2. Replacing a deny-all rule with allow-all on both firewalls would eliminate the security posture entirely and is not an appropriate fix for a VPN misconfiguration.

Answer

E. Change internal IP Address of Router 1. Changing the internal IP of Router 1 is not indicated as a misconfiguration and would disrupt existing on-premises routing without fixing the IPSec tunnel.

Answer

F. Reverse the Weight property in the two CNAME records on the DNS. Reversing CNAME record weights only redistributes DNS-based traffic ratios and does not address any VPN or routing misconfiguration.

Answer

G. Add the Application Server at on-premises to the Load Balancer. Adding the on-premises application server to the cloud load balancer does not resolve the underlying IPSec tunnel or routing misconfiguration.