WGU E029 TASK 1 CAPSTONE
PROJECT PROPOSAL | AWS
HYBRID CLOUD
LATEST MOCK PRACTICE SET
130 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E029 TASK 1 CAPSTONE PROJECT PROPOSAL | AWS HYBRID CLOUD INFRASTRUCTURE, GNS3,
VYOS, IPSEC VPN & NETWORK SECURITY | 2026 PASSED.. It contains 130 carefully selected questions that
reflect the most current exam content and testing strategies. Each question is accompanied by a correct answer
and a detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 130 Questions
Foundations - Application - WGU E029 TASK 1 Capstone Project Proposal AWS Hybrid Cloud
Infrastructure GNS3 VYOS Ipsec VPN & Network Security 2026 Passed Cloud Infrastructure Network
Security AND Virtualization Graduate / Advanced Undergraduate Senior Level
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
AWS Hybrid Cloud 1-22 Network, Capstone, On-premises, Ipsec, Configuration
Architecture AND Design
GNS3 Network Simulation 23-44 On-premises, Ipsec, Traffic, Network, Hybrid Cloud
AND Virtualization
VYOS Router Configuration 45-66 Ipsec, Network, On-premises, Hybrid Cloud, Configuration
AND Management
Ipsec VPN Implementation 67-88 Ipsec, Network, Hybrid Cloud, Configuration, Capstone S
AND Troubleshooting
Network Security BEST 89-110 Traffic, Ipsec, Network, Tunnel, On-premises
Practices AND Firewall
Configuration
Cloud Integration AND 111-130 Tunnel, Network, Ipsec, Traffic, VYOS Router
Interoperability
TOTAL 130 All questions include answers and detailed rationales
,Section A - AWS Hybrid Cloud Architecture AND Design
Q1.
In the AWS hybrid cloud design, which component is essential for establishing a
dedicated, private connection between the on-premises network and VPC, bypassing the
public internet?
A. AWS Site-to-Site VPN B. AWS Direct Connect
C. Internet Gateway D. VPC Peering
Correct: B - AWS Direct Connect
Rationale:AWS Direct Connect provides a dedicated private network connection from
on-premises to AWS, offering lower latency and more consistent bandwidth than
internet-based VPNs. Site-to-Site VPN uses the public internet, while Internet Gateway and
VPC Peering do not provide private on-premises connectivity.
Q2.
When simulating a multi-site network in GNS3, which approach best emulates WAN
latency and packet loss for realistic IPsec VPN performance testing?
A. Using the 'ethernet switch' node with B. Applying a 'packet capture' filter on each
default settings link
C. Configuring a 'WAN emulator' node or D. Connecting all devices to a single cloud
link parameters with delay and loss node
Correct: C - Configuring a 'WAN emulator' node or link parameters with delay and loss
Rationale:GNS3 supports link parameters and WAN emulation nodes to introduce delay,
jitter, and loss, which is critical for realistic VPN performance assessment. Ethernet switches
and cloud nodes do not provide such granular control, and packet capture only inspects
traffic.
Q3.
In VyOS, which configuration command correctly defines an IPsec site-to-site VPN peer
with pre-shared key authentication and proposes AES-256 encryption?
A. set vpn ipsec site-to-site peer B. set vpn ipsec site-to-site peer
203.0.113.1 authentication mode 203.0.113.1 authentication
pre-shared-secret pre-shared-secret 'secret'
C. set vpn ipsec site-to-site peer D. set vpn ipsec site-to-site peer
203.0.113.1 authentication mode 203.0.113.1 authentication
pre-shared-secret 'secret' pre-shared-secret
Page 3
, Section A - AWS Hybrid Cloud Architecture AND Design
Correct: B - set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret
'secret'
Rationale:The correct VyOS syntax is `set vpn ipsec site-to-site peer <ip> authentication
pre-shared-secret <secret>`. Options A and C include an erroneous 'mode' keyword, and D
lacks the secret value. Encryption proposals are set separately, not in this command.
Q4.
During IPsec troubleshooting, you notice that the tunnel is established but traffic is not
passing. Which of the following is the MOST likely cause if the security association (SA) is
active and the routing is correct?
A. The firewall is blocking UDP port 500 and B. The NAT-T is disabled on one side but
4500 enabled on the other
C. The crypto map is not applied to the D. The ACL defining interesting traffic is
correct interface misconfigured
Correct: D - The ACL defining interesting traffic is misconfigured
Rationale:If the SA is up, IKE and IPsec negotiation succeeded, so firewall and crypto map
issues are less likely. NAT-T mismatch would prevent SA establishment. A misconfigured ACL
for interesting traffic would allow the tunnel to form but not encrypt/decrypt the intended
traffic, causing it to be dropped or sent in clear.
Q5.
In the capstone's security hardening, which AWS service should be used to continuously
monitor and record API activity across the hybrid infrastructure for compliance and
auditing?
A. AWS CloudTrail B. AWS Config
C. AWS GuardDuty D. AWS Inspector
Correct: A - AWS CloudTrail
Rationale:AWS CloudTrail records API calls and events, providing an audit log of user activity
and changes. Config tracks configuration changes, GuardDuty is a threat detection service,
and Inspector scans for vulnerabilities. For auditing API activity, CloudTrail is the primary tool.
Q6.
When designing the IPsec VPN between GNS3 and AWS, which parameter must match
exactly on both ends to ensure successful Phase 1 negotiation?
A. The pre-shared key and the encryption B. The tunnel interface IP address and the
algorithm peer IP address
Page 4
PROJECT PROPOSAL | AWS
HYBRID CLOUD
LATEST MOCK PRACTICE SET
130 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E029 TASK 1 CAPSTONE PROJECT PROPOSAL | AWS HYBRID CLOUD INFRASTRUCTURE, GNS3,
VYOS, IPSEC VPN & NETWORK SECURITY | 2026 PASSED.. It contains 130 carefully selected questions that
reflect the most current exam content and testing strategies. Each question is accompanied by a correct answer
and a detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 130 Questions
Foundations - Application - WGU E029 TASK 1 Capstone Project Proposal AWS Hybrid Cloud
Infrastructure GNS3 VYOS Ipsec VPN & Network Security 2026 Passed Cloud Infrastructure Network
Security AND Virtualization Graduate / Advanced Undergraduate Senior Level
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
AWS Hybrid Cloud 1-22 Network, Capstone, On-premises, Ipsec, Configuration
Architecture AND Design
GNS3 Network Simulation 23-44 On-premises, Ipsec, Traffic, Network, Hybrid Cloud
AND Virtualization
VYOS Router Configuration 45-66 Ipsec, Network, On-premises, Hybrid Cloud, Configuration
AND Management
Ipsec VPN Implementation 67-88 Ipsec, Network, Hybrid Cloud, Configuration, Capstone S
AND Troubleshooting
Network Security BEST 89-110 Traffic, Ipsec, Network, Tunnel, On-premises
Practices AND Firewall
Configuration
Cloud Integration AND 111-130 Tunnel, Network, Ipsec, Traffic, VYOS Router
Interoperability
TOTAL 130 All questions include answers and detailed rationales
,Section A - AWS Hybrid Cloud Architecture AND Design
Q1.
In the AWS hybrid cloud design, which component is essential for establishing a
dedicated, private connection between the on-premises network and VPC, bypassing the
public internet?
A. AWS Site-to-Site VPN B. AWS Direct Connect
C. Internet Gateway D. VPC Peering
Correct: B - AWS Direct Connect
Rationale:AWS Direct Connect provides a dedicated private network connection from
on-premises to AWS, offering lower latency and more consistent bandwidth than
internet-based VPNs. Site-to-Site VPN uses the public internet, while Internet Gateway and
VPC Peering do not provide private on-premises connectivity.
Q2.
When simulating a multi-site network in GNS3, which approach best emulates WAN
latency and packet loss for realistic IPsec VPN performance testing?
A. Using the 'ethernet switch' node with B. Applying a 'packet capture' filter on each
default settings link
C. Configuring a 'WAN emulator' node or D. Connecting all devices to a single cloud
link parameters with delay and loss node
Correct: C - Configuring a 'WAN emulator' node or link parameters with delay and loss
Rationale:GNS3 supports link parameters and WAN emulation nodes to introduce delay,
jitter, and loss, which is critical for realistic VPN performance assessment. Ethernet switches
and cloud nodes do not provide such granular control, and packet capture only inspects
traffic.
Q3.
In VyOS, which configuration command correctly defines an IPsec site-to-site VPN peer
with pre-shared key authentication and proposes AES-256 encryption?
A. set vpn ipsec site-to-site peer B. set vpn ipsec site-to-site peer
203.0.113.1 authentication mode 203.0.113.1 authentication
pre-shared-secret pre-shared-secret 'secret'
C. set vpn ipsec site-to-site peer D. set vpn ipsec site-to-site peer
203.0.113.1 authentication mode 203.0.113.1 authentication
pre-shared-secret 'secret' pre-shared-secret
Page 3
, Section A - AWS Hybrid Cloud Architecture AND Design
Correct: B - set vpn ipsec site-to-site peer 203.0.113.1 authentication pre-shared-secret
'secret'
Rationale:The correct VyOS syntax is `set vpn ipsec site-to-site peer <ip> authentication
pre-shared-secret <secret>`. Options A and C include an erroneous 'mode' keyword, and D
lacks the secret value. Encryption proposals are set separately, not in this command.
Q4.
During IPsec troubleshooting, you notice that the tunnel is established but traffic is not
passing. Which of the following is the MOST likely cause if the security association (SA) is
active and the routing is correct?
A. The firewall is blocking UDP port 500 and B. The NAT-T is disabled on one side but
4500 enabled on the other
C. The crypto map is not applied to the D. The ACL defining interesting traffic is
correct interface misconfigured
Correct: D - The ACL defining interesting traffic is misconfigured
Rationale:If the SA is up, IKE and IPsec negotiation succeeded, so firewall and crypto map
issues are less likely. NAT-T mismatch would prevent SA establishment. A misconfigured ACL
for interesting traffic would allow the tunnel to form but not encrypt/decrypt the intended
traffic, causing it to be dropped or sent in clear.
Q5.
In the capstone's security hardening, which AWS service should be used to continuously
monitor and record API activity across the hybrid infrastructure for compliance and
auditing?
A. AWS CloudTrail B. AWS Config
C. AWS GuardDuty D. AWS Inspector
Correct: A - AWS CloudTrail
Rationale:AWS CloudTrail records API calls and events, providing an audit log of user activity
and changes. Config tracks configuration changes, GuardDuty is a threat detection service,
and Inspector scans for vulnerabilities. For auditing API activity, CloudTrail is the primary tool.
Q6.
When designing the IPsec VPN between GNS3 and AWS, which parameter must match
exactly on both ends to ensure successful Phase 1 negotiation?
A. The pre-shared key and the encryption B. The tunnel interface IP address and the
algorithm peer IP address
Page 4
