WGU E030 TASK 2 BSCNE-AWS
CAPSTONE PROJECT |
COMPLETE HYBRID CLOUD
LATEST MOCK PRACTICE SET
130 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E030 TASK 2 BSCNE-AWS CAPSTONE PROJECT | COMPLETE HYBRID CLOUD FUNCTIONALITY
REPORT, GNS3, AWS CLOUDFORMATION, IPSEC VPN, TESTING & NETWORK DIAGRAM | 2026. It contains
130 carefully selected questions that reflect the most current exam content and testing strategies. Each question
is accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 130 Questions
Foundations - Application - WGU E030 TASK 2 Bscne-aws Capstone Project Complete Hybrid Cloud
Functionality Report GNS3 AWS Cloudformation Ipsec VPN Testing & Network Diagram 2026 Computer
Science / Cloud Networking Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Hybrid Cloud Architecture 1-22 On-premises, Hybrid Cloud, Network, Ipsec, Tunnel
Design
GNS3 Network Simulation 23-44 On-premises, Tunnel, Hybrid Cloud, Network, Testing
AND Configuration
AWS Cloudformation 45-66 On-premises, Hybrid, Cloud, Network, Ipsec
Infrastructure AS CODE
Ipsec VPN Configuration 67-88 On-premises, Cloud, Tunnel, Hybrid, Private
AND Security
Network Testing AND 89-110 Tunnel, On-premises, Ipsec, Network, Cloudformation
Validation
Network Diagram Creation 111-130 On-premises, Tunnel, Ipsec, Cloud, Resource
AND Documentation
TOTAL 130 All questions include answers and detailed rationales
,Section A - Hybrid Cloud Architecture Design
Q1.
In a hybrid cloud setup, you need to ensure that on-premises devices can reach AWS
resources via a VPN tunnel. Which GNS3 component is essential to simulate the
on-premises side of the VPN connection?
A. A cloud node connected to a physical B. A router with IPsec configuration
interface
C. A virtual PC with a public IP address D. An Ethernet switch with VLAN support
Correct: B - A router with IPsec configuration
Rationale:A router with IPsec configuration is essential to terminate the VPN tunnel on the
on-premises side. A cloud node connects to physical networks, a virtual PC lacks routing
capabilities, and an Ethernet switch does not support IPsec.
Q2.
When deploying a CloudFormation stack for a hybrid cloud, you need to reference the
on-premises network CIDR in a security group rule. Which parameter type is most
appropriate to allow flexible input?
A. AWS::EC2::SecurityGroup::Id B. List<Number>
C. String D. AWS::EC2::VPC::Id
Correct: C - String
Rationale:A String parameter type is appropriate for a CIDR block because it allows any valid
input. List<Number> is for numeric lists, and the AWS-specific types are for IDs, not CIDR
ranges.
Q3.
In an IPsec VPN, which setting must match on both ends to ensure successful Phase 1
negotiation?
A. Pre-shared key and encryption algorithm B. Remote tunnel IP address
C. Local network subnet D. Tunnel interface MTU
Correct: A - Pre-shared key and encryption algorithm
Rationale:Phase 1 requires matching IKE policies, including pre-shared key and encryption
algorithm. Remote tunnel IP and local subnet are for Phase 2, and MTU is not part of
negotiation.
Page 3
, Section A - Hybrid Cloud Architecture Design
Q4.
During testing, you notice that traffic from the on-premises network to the AWS VPC is
dropped. Which tool would you use in GNS3 to capture packets on the VPN tunnel
interface?
A. Wireshark B. Ping
C. Traceroute D. NetFlow
Correct: A - Wireshark
Rationale:Wireshark provides packet-level analysis on interfaces. Ping and traceroute only
test connectivity, and NetFlow is for flow statistics, not packet capture.
Q5.
In a network diagram, you see two routers with a dashed line labeled 'IPsec VPN'. What
does the dashed line typically represent?
A. A logical tunnel that does not map to a B. A physical Ethernet cable
physical link
C. A wireless connection D. A backup link that is inactive
Correct: A - A logical tunnel that does not map to a physical link
Rationale:Dashed lines in network diagrams often indicate logical connections like VPN
tunnels. Physical links are solid lines, wireless may have a different symbol, and backup links
are usually labeled.
Q6.
When writing a CloudFormation template, you need to define an EC2 instance that will act
as a VPN endpoint. Which resource property is required to associate a security group?
A. SecurityGroupIds B. SubnetId
C. KeyName D. UserData
Correct: A - SecurityGroupIds
Rationale:SecurityGroupIds is required to assign security groups to an EC2 instance.
SubnetId is for networking, KeyName for SSH access, and UserData for bootstrap scripts.
Q7.
In a hybrid cloud scenario, you need to ensure that traffic from on-premises to AWS is
encrypted. Which IPsec mode should you use?
Page 4
CAPSTONE PROJECT |
COMPLETE HYBRID CLOUD
LATEST MOCK PRACTICE SET
130 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E030 TASK 2 BSCNE-AWS CAPSTONE PROJECT | COMPLETE HYBRID CLOUD FUNCTIONALITY
REPORT, GNS3, AWS CLOUDFORMATION, IPSEC VPN, TESTING & NETWORK DIAGRAM | 2026. It contains
130 carefully selected questions that reflect the most current exam content and testing strategies. Each question
is accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 130 Questions
Foundations - Application - WGU E030 TASK 2 Bscne-aws Capstone Project Complete Hybrid Cloud
Functionality Report GNS3 AWS Cloudformation Ipsec VPN Testing & Network Diagram 2026 Computer
Science / Cloud Networking Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Hybrid Cloud Architecture 1-22 On-premises, Hybrid Cloud, Network, Ipsec, Tunnel
Design
GNS3 Network Simulation 23-44 On-premises, Tunnel, Hybrid Cloud, Network, Testing
AND Configuration
AWS Cloudformation 45-66 On-premises, Hybrid, Cloud, Network, Ipsec
Infrastructure AS CODE
Ipsec VPN Configuration 67-88 On-premises, Cloud, Tunnel, Hybrid, Private
AND Security
Network Testing AND 89-110 Tunnel, On-premises, Ipsec, Network, Cloudformation
Validation
Network Diagram Creation 111-130 On-premises, Tunnel, Ipsec, Cloud, Resource
AND Documentation
TOTAL 130 All questions include answers and detailed rationales
,Section A - Hybrid Cloud Architecture Design
Q1.
In a hybrid cloud setup, you need to ensure that on-premises devices can reach AWS
resources via a VPN tunnel. Which GNS3 component is essential to simulate the
on-premises side of the VPN connection?
A. A cloud node connected to a physical B. A router with IPsec configuration
interface
C. A virtual PC with a public IP address D. An Ethernet switch with VLAN support
Correct: B - A router with IPsec configuration
Rationale:A router with IPsec configuration is essential to terminate the VPN tunnel on the
on-premises side. A cloud node connects to physical networks, a virtual PC lacks routing
capabilities, and an Ethernet switch does not support IPsec.
Q2.
When deploying a CloudFormation stack for a hybrid cloud, you need to reference the
on-premises network CIDR in a security group rule. Which parameter type is most
appropriate to allow flexible input?
A. AWS::EC2::SecurityGroup::Id B. List<Number>
C. String D. AWS::EC2::VPC::Id
Correct: C - String
Rationale:A String parameter type is appropriate for a CIDR block because it allows any valid
input. List<Number> is for numeric lists, and the AWS-specific types are for IDs, not CIDR
ranges.
Q3.
In an IPsec VPN, which setting must match on both ends to ensure successful Phase 1
negotiation?
A. Pre-shared key and encryption algorithm B. Remote tunnel IP address
C. Local network subnet D. Tunnel interface MTU
Correct: A - Pre-shared key and encryption algorithm
Rationale:Phase 1 requires matching IKE policies, including pre-shared key and encryption
algorithm. Remote tunnel IP and local subnet are for Phase 2, and MTU is not part of
negotiation.
Page 3
, Section A - Hybrid Cloud Architecture Design
Q4.
During testing, you notice that traffic from the on-premises network to the AWS VPC is
dropped. Which tool would you use in GNS3 to capture packets on the VPN tunnel
interface?
A. Wireshark B. Ping
C. Traceroute D. NetFlow
Correct: A - Wireshark
Rationale:Wireshark provides packet-level analysis on interfaces. Ping and traceroute only
test connectivity, and NetFlow is for flow statistics, not packet capture.
Q5.
In a network diagram, you see two routers with a dashed line labeled 'IPsec VPN'. What
does the dashed line typically represent?
A. A logical tunnel that does not map to a B. A physical Ethernet cable
physical link
C. A wireless connection D. A backup link that is inactive
Correct: A - A logical tunnel that does not map to a physical link
Rationale:Dashed lines in network diagrams often indicate logical connections like VPN
tunnels. Physical links are solid lines, wireless may have a different symbol, and backup links
are usually labeled.
Q6.
When writing a CloudFormation template, you need to define an EC2 instance that will act
as a VPN endpoint. Which resource property is required to associate a security group?
A. SecurityGroupIds B. SubnetId
C. KeyName D. UserData
Correct: A - SecurityGroupIds
Rationale:SecurityGroupIds is required to assign security groups to an EC2 instance.
SubnetId is for networking, KeyName for SSH access, and UserData for bootstrap scripts.
Q7.
In a hybrid cloud scenario, you need to ensure that traffic from on-premises to AWS is
encrypted. Which IPsec mode should you use?
Page 4
