ANS-C01 Mock Exam 90 — 25 Questions

Question 1

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no EC2 instance in any account can be launched with a public IP address unless it is in a specific VPC. Which solution will meet this requirement?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes an association with a public IP address, unless the VPC is the allowed one.. Option B is correct because an SCP can be applied at the root OU to deny the ec2:RunInstances action if the request includes a parameter to assign a public IP address, using a condition key like ec2:AssociatePublicIpAddress. Option A is wrong because IAM policies need to be applied in each account individually. Option C is wrong because Config can detect but not prevent. Option D is wrong because CloudTrail logs but does not prevent.

Answer

Create an IAM policy that denies ec2:RunInstances if the subnet is not in the allowed VPC, and attach it to all IAM users.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to stop any instance with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 2

A company has a VPC with a public subnet and a private subnet. They have a web server in the public subnet and a database in the private subnet. The web server needs to communicate with the database on port 3306. Security groups are configured as follows: Web server SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to database SG on port 3306. Database SG allows inbound from web server SG on port 3306. However, the web server cannot connect. Network ACLs are default. What is the issue?

Accepted Answer

The database security group inbound rule is not correctly referencing the web server security group ID.. Option C is correct because the web server's security group outbound rule explicitly allows traffic to the database SG, which is correct. The issue is likely that the database SG inbound rule is not referencing the correct web server SG, or the web server SG is not attached to the web server. Option A is wrong because NACLs are default allow. Option B is wrong because the web server SG outbound is correctly configured. Option D is wrong because stateful nature means inbound allows outbound responses, but the issue is the inbound rule on the database SG.

Answer

The network ACL on the private subnet denies inbound traffic on port 3306.

Answer

Security groups are stateful, so no outbound rule is needed; the issue is something else.

Answer

The web server security group does not allow outbound traffic to the database.

Question 3

A company has a Direct Connect connection to AWS with a private VIF to a VPC. They also have a VPN connection as a backup. The BGP sessions are established. They want to ensure that traffic from on-premises to the VPC prefers the Direct Connect path over the VPN. The on-premises router is advertising the same prefix to both connections. What should the network engineer configure on the AWS side?

Accepted Answer

Configure the on-premises router to prepend AS path for routes advertised over the VPN connection.. Option A is correct because BGP AS_PATH prepending can be used to make the VPN path less preferred. However, AWS does not allow manipulation of BGP attributes on the customer side. The correct action is to configure the on-premises router to prepend AS path for the VPN route. Option B is wrong because Local Preference is a Cisco-specific feature not applicable. Option C is wrong because MED can be used but is not as reliable as AS_PATH prepend. Option D is wrong because VPC route tables do not influence BGP path selection.

Answer

Set a higher local preference value on the on-premises router for the Direct Connect route.

Answer

Update the VPC route table to give higher priority to the Direct Connect route.

Answer

Set a lower MED value on the Direct Connect virtual interface.

Question 4

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They need to add IPv6 support for their internet-facing Application Load Balancer. The VPC is already associated with an IPv6 CIDR block. What additional configuration is required? (Choose two.)

Accepted Answer

Add a route in the subnet's route table for ::/0 to the Internet Gateway.. Options A and C are correct. For an internet-facing ALB to serve IPv6 clients, the subnet must have an IPv6 CIDR and the route table must have a route for ::/0 to the internet gateway. Option B is wrong because the ALB itself does not require an IPv6 address; it uses the subnet's IPv6 CIDR. Option D is wrong because Egress-Only Internet Gateway is for outbound-only IPv6 traffic from private subnets. Option E is wrong because a NAT64/DNS64 is not needed; ALB can handle IPv6 natively.

Answer

Configure NAT64 and DNS64 on the VPC.

Answer

Assign an IPv6 address to the ALB's network interface.

Answer

Create an Egress-Only Internet Gateway for the VPC.

Question 5

A security engineer notices that an EC2 instance in a public subnet is receiving inbound SSH traffic from a range of IP addresses that should be blocked. Which two actions should the engineer take to troubleshoot? (Choose two.)

Accepted Answer

Review the Security Group rules attached to the instance. Options A and D are correct. Checking VPC Flow Logs helps identify the source IP of the traffic. Reviewing Security Group rules ensures that the security group is not allowing the unwanted SSH traffic. Option B is wrong because Network ACLs are stateless and might be blocking, but they are not the first place to check for inbound traffic to an instance. Option C is wrong because the route table does not affect inbound traffic to the instance. Option E is wrong because the instance metadata does not contain network access rules.

Answer

Check the instance metadata for IP restrictions

Answer

Check the route table associated with the subnet

Answer

Check the Network ACL associated with the subnet

Question 6

A company wants to audit all changes to security groups in their AWS account. They need to be notified whenever a security group rule is added, modified, or removed. They also want to see who made the change. Which solution should they implement?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on EC2 SecurityGroup events, sending notifications via SNS.. AWS CloudTrail captures all API calls, including EC2 SecurityGroup-related actions (AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, etc.), recording the identity of the caller. A CloudWatch Events rule can filter for these specific events and trigger an SNS notification, providing both the change details and the IAM user or role that made the change. This meets the audit and notification requirements precisely.

Answer

Use AWS Trusted Advisor to check for security group changes and send email alerts.

Answer

Use AWS Config to monitor security group changes and trigger a Lambda function to send notifications.

Answer

Enable VPC Flow Logs and analyze logs for changes to security group rules.

Question 7

A company wants to securely store and manage secrets such as database passwords and API keys. They need to automatically rotate secrets every 30 days and ensure that only specific IAM roles can access them. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating secrets such as database passwords and API keys. It supports native rotation with AWS Lambda, enforces fine-grained access control via IAM roles, and can rotate secrets on a schedule (e.g., every 30 days) without custom scripting.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Question 8

A company has a VPC (10.0.0.0/16) with two subnets: public (10.0.1.0/24) and private (10.0.2.0/24). They have an Application Load Balancer (ALB) in the public subnet that distributes traffic to EC2 instances in the private subnet. The ALB is internet-facing and has a security group that allows inbound HTTP/S from 0.0.0.0/0. The EC2 instances have a security group that allows inbound HTTP from the ALB's security group. Users report that they can access the application, but the application is slow and sometimes times out. The network engineer checks CloudWatch metrics and sees that the ALB's target response time is high. The engineer suspects that the EC2 instances are overwhelmed. Which action should the engineer take to improve performance?

Accepted Answer

Add EC2 instances in another Availability Zone and register them with the ALB.. Option C is correct because using multiple Availability Zones increases capacity and fault tolerance. Option A is incorrect because increasing instance size may help but is not the best practice for high availability. Option B is incorrect because a NAT gateway is for outbound internet access. Option D is incorrect because an NLB does not offload processing from the instances.

Answer

Add a NAT gateway in the public subnet to reduce latency.

Answer

Replace the ALB with a Network Load Balancer to reduce overhead.

Answer

Increase the size of the EC2 instances in the private subnet.

Question 9

A global e-commerce company uses AWS CloudFront to distribute content. They have an origin behind an Application Load Balancer (ALB) in a VPC. The ALB is internet-facing and has a security group that allows inbound HTTPS traffic from CloudFront's IP ranges. Users in some regions report slow loading times. The company wants to reduce latency and improve performance. They are considering using Lambda@Edge and origin failover. However, they also notice that the ALB is receiving traffic directly from some IPs that are not CloudFront IPs, causing unnecessary load. What should a network engineer do to restrict access to the ALB to only CloudFront?

Accepted Answer

Update the ALB security group to allow inbound HTTPS only from the CloudFront managed prefix list. The best practice is to restrict ALB security group to CloudFront managed prefix list (com.amazonaws.global.cloudfront.origin-facing). This dynamically allows CloudFront IPs. Option A (custom header) is good but not sufficient alone because attackers can mimic headers. Option B (AWS WAF) can help but is not the primary method. Option D (restrict to specific regions) is not precise.

Answer

Use AWS WAF to block requests that do not come from CloudFront IPs

Answer

Configure the ALB to require a custom header (e.g., X-Origin-Verify) and validate it in the origin

Answer

Set up a VPC endpoint for CloudFront to route traffic privately

Question 10

A financial services company has a VPC with a public subnet and a private subnet. EC2 instances in the private subnet need to download patches from the internet. The company has a NAT gateway in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, instances cannot reach the internet. The NAT gateway is in an 'available' state and has an Elastic IP attached. The security group for the NAT gateway allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet does not have a default route (0.0.0.0/0) pointing to an internet gateway. The most common cause is that the route table for the public subnet (where the NAT gateway resides) does not have a default route to an internet gateway. The NAT gateway needs a route to the internet gateway to forward traffic. Option B is wrong because NAT gateway does not require an IAM role. Option C is wrong because security group is correct. Option D is wrong because the NAT gateway is in 'available' state and has an EIP, so it is not provisioned incorrectly.

Answer

The security group for the NAT gateway is blocking inbound traffic from private instances

Answer

The NAT gateway is not provisioned with sufficient bandwidth

Answer

The NAT gateway does not have an IAM role to access the internet

Question 11

A company is deploying a new application in a VPC that uses a single Availability Zone. The application consists of an Application Load Balancer (ALB) in a public subnet and EC2 instances in a private subnet. The EC2 instances need to send logs to an Amazon S3 bucket. The company has created a VPC gateway endpoint for S3 and associated it with the route table for the private subnet. The EC2 instances have an instance profile that grants access to the S3 bucket. However, the log delivery fails. The network team has verified that the route table for the private subnet includes a route to the S3 prefix list via the gateway endpoint. What is the MOST likely cause of the failure?

Accepted Answer

The VPC endpoint policy does not allow the PutObject action on the S3 bucket.. The most likely cause is that the VPC endpoint policy does not allow the PutObject action on the S3 bucket. Even though the route table has a route to the S3 prefix list via the gateway endpoint and the EC2 instance profile grants access, the endpoint policy acts as an additional layer of authorization. If the endpoint policy does not explicitly allow the s3:PutObject action for the target bucket, requests will be denied, causing the log delivery to fail.

Answer

The route table does not have a route to the S3 prefix list.

Answer

The VPC endpoint is not configured with private DNS.

Answer

The security group on the EC2 instances does not allow outbound traffic to the S3 prefix list.

Question 12

A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An Application Load Balancer (ALB) is deployed in the public subnet, and EC2 instances are in the private subnet. The ALB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the ALB's security group on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24) and allows outbound ephemeral ports. However, the ALB health checks are failing with 503 errors. The network engineer checks the ALB logs and sees that TCP connections are established but HTTP requests are timing out. What is the most likely cause?

Accepted Answer

The ALB health check is configured to use HTTPS but the target only listens on HTTP.. Option D is correct. The network ACL for the private subnet only allows inbound traffic from the public subnet CIDR (10.0.1.0/24). However, the ALB sends health checks from its private IP addresses, which are in the public subnet CIDR, so that should be fine. But the real issue is that the ALB also sends traffic to the targets using its own IP addresses, which are in the public subnet CIDR, so inbound is allowed. However, the outbound rule for the private subnet's network ACL must allow outbound traffic from the targets back to the ALB. The network ACL allows outbound ephemeral ports (1024-65535), but the ALB health check response uses the source port of the ALB (which is ephemeral) and the destination port on the target is 80. The response from the target goes back to the ALB's IP and port. The outbound rule in the network ACL should allow traffic to the ALB's subnet (10.0.1.0/24) on ephemeral ports. But the question says the network ACL allows outbound ephemeral ports without specifying destination. Actually, the outbound rule allows all ephemeral ports to anywhere? It says 'allows outbound ephemeral ports' - typically that means outbound to 0.0.0.0/0 on ephemeral ports. That should be fine. Wait, the issue might be that the network ACL is stateless and the outbound rule must allow the return traffic. The health check request comes from the ALB to the target on port 80. The target responds to the ALB's IP and source port. The outbound rule must allow traffic from the target to the ALB's IP on the ALB's source port (which is ephemeral). If the outbound rule allows all outbound ephemeral ports to 0.0.0.0/0, it should work. So why is it failing? Perhaps the ALB is using a different source IP? Actually, ALB health checks can originate from the ALB's private IP addresses. The network ACL for the private subnet has an inbound rule allowing port 80 from 10.0.1.0/24. That's correct. The outbound rule allows ephemeral ports to 0.0.0.0/0. That should allow the response. But maybe the outbound rule is too restrictive? Alternatively, the security group for the EC2 instances might not allow the response? But security groups are stateful, so if inbound is allowed, outbound is automatically allowed. So security group is fine. The most likely cause is that the network ACL inbound rule only allows from the public subnet CIDR, but the ALB might be using a different IP? No. Another possibility: the health check is sent from the ALB's nodes which are in the public subnet, but the public subnet CIDR is 10.0.1.0/24, so that's fine. Option D says 'The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.' That is incorrect because network ACLs cannot reference security groups. So the correct answer is actually that the network ACL inbound rule should allow from the ALB's security group? No. Let's re-evaluate. The most common issue is that the network ACL is stateless and the outbound rule must allow the response. But the question says the outbound rule allows ephemeral ports. That should be fine. Perhaps the health check is using HTTPS but only port 80 is allowed? The question says port 80. Option B says 'The ALB health check is configured to use HTTPS but the target only listens on HTTP.' That could cause a timeout. But the question says the TCP connection is established, so the port is open. However, if the health check expects a 200 OK and the target returns something else, it could cause a 503. Option A says 'The security group for the ALB does not allow outbound traffic to the targets.' But security groups are stateful, so if inbound is allowed, outbound is allowed. Option C says 'The route table for the private subnet does not have a route to the ALB's subnet.' That would cause no connectivity at all. Actually, the most likely cause is that the health check is using a different port or protocol. But given the options, Option D is the trick: network ACLs cannot reference security groups, so that statement is false, making it a distractor. The correct answer is not listed? Wait, the question is a PBQ with 4 options. Let's list them: A: The security group for the ALB does not allow outbound traffic to the targets. B: The ALB health check is configured to use HTTPS but the target only listens on HTTP. C: The route table for the private subnet does not have a route to the ALB's subnet. D: The network ACL for the private subnet does not allow inbound traffic from the ALB's security group. Option D is impossible because network ACLs don't support security groups. So D is wrong. Option A is unlikely because security groups are stateful. Option C would cause complete failure, not just health check. Option B is plausible: if health check expects HTTPS but target only has HTTP, the health check will get a timeout or non-200 response, causing 503. So the correct answer is B.

Answer

The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.

Answer

The security group for the ALB does not allow outbound traffic to the targets.

Answer

The route table for the private subnet does not have a route to the ALB's subnet.

Question 13

A company runs a multi-tier web application in a VPC with public and private subnets across two Availability Zones. The web tier uses an Application Load Balancer (ALB) in the public subnets, and the application tier uses EC2 instances in private subnets. The database tier uses an RDS MySQL Multi-AZ instance in private subnets. The company has implemented a network ACL (NACL) on the private subnets to allow only traffic from the ALB security group. Recently, the application tier instances are unable to connect to the RDS database. The security group for RDS allows inbound traffic on port 3306 from the application tier security group. The network team has verified that the application tier instances can reach the internet through a NAT Gateway. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The NACL on the private subnets is blocking outbound traffic from the application tier to the RDS database.. The NACL on the private subnets is stateful only for inbound rules; outbound traffic is evaluated separately. Since the NACL allows only inbound traffic from the ALB security group but does not have an outbound rule permitting traffic from the application tier to the RDS database (port 3306), the outbound SYN packets from the application instances are dropped, preventing the TCP handshake from completing.

Answer

The application tier instances are in a different Availability Zone than the RDS primary instance.

Answer

The NAT Gateway is blocking traffic to the RDS endpoint.

Answer

The RDS security group is not allowing inbound traffic from the application tier security group.

Question 14

A company is setting up a new AWS environment for a project. The network architect decides to use a hub-and-spoke model with a central inspection VPC for east-west traffic inspection. The inspection VPC (VPC-Hub) contains a firewall appliance that inspects traffic between spoke VPCs. All VPCs are attached to an AWS Transit Gateway. The architect creates a route table in the Transit Gateway for the inspection VPC and another route table for the spoke VPCs. The inspection VPC route table has a default route (0.0.0.0/0) pointing to the firewall appliance. The spoke VPCs have route tables that point to the inspection VPC for traffic to other spoke VPCs. The firewall appliance is configured to forward traffic after inspection. However, traffic between spoke VPCs is not being routed through the inspection VPC. Which configuration change should the architect make to ensure traffic between spoke VPCs is inspected?

Accepted Answer

Enable route propagation on the inspection VPC attachment for the inspection route table. Option D is correct because the inspection VPC route table needs to learn the spoke VPC CIDRs dynamically via route propagation from the Transit Gateway attachment. Without propagation, the inspection VPC route table only has a default route pointing to the firewall appliance, but no specific routes for the spoke VPCs. When the firewall appliance forwards traffic after inspection, it needs to know how to reach the destination spoke VPC; enabling route propagation on the inspection VPC attachment for the inspection route table allows the Transit Gateway to inject the spoke VPC routes into that route table, enabling proper return traffic flow.

Answer

Use VPC Peering between the spoke VPCs instead of Transit Gateway

Answer

Create a static route in the inspection VPC route table for each spoke VPC CIDR

Answer

Remove the default route from the spoke VPC route tables

Question 15

A large e-commerce company is designing a network for a new microservices architecture. They have hundreds of microservices running on Amazon ECS with Fargate launch type. The services need to communicate with each other and with external APIs. The company wants to minimize network latency and maximize security. They also need to ensure that traffic between services does not leave the VPC. The network engineer is considering using AWS PrivateLink to allow services to communicate via VPC endpoints. However, they are concerned about the cost of creating an endpoint for each service. Which design should the network engineer recommend?

Accepted Answer

Use AWS App Mesh to enable service-to-service communication within the VPC. AWS App Mesh provides a service mesh that enables secure, low-latency communication between microservices within the same VPC using Envoy sidecar proxies. It handles service discovery, traffic routing, and encryption (mTLS) without requiring VPC endpoints or public IPs, keeping all traffic within the VPC and minimizing cost. This directly addresses the requirement for hundreds of services to communicate privately and efficiently.

Answer

Use a Transit Gateway to connect all services

Answer

Assign public IP addresses to the Fargate tasks and use security groups

Answer

Create a VPC endpoint for each microservice and use PrivateLink

Question 16

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). They launch an Amazon RDS for MySQL DB instance in the private subnet. The DB instance needs to be accessed by an EC2 instance in the public subnet. The security group for the DB instance allows inbound traffic on port 3306 from the security group of the EC2 instance. However, the EC2 instance cannot connect to the DB instance. What is the most likely cause?

Accepted Answer

The private subnet does not have a route to the public subnet. The most likely cause is that the private subnet does not have a route to the public subnet. For an EC2 instance in the public subnet to reach an RDS DB instance in the private subnet, the private subnet's route table must include a route that directs return traffic back to the public subnet (e.g., via a VPC peering connection, a NAT gateway, or a transit gateway). Without this return path, the DB instance's response packets are dropped, even though the security group allows inbound traffic from the EC2 instance's security group.

Answer

The network ACL for the private subnet is blocking inbound traffic

Answer

The security group for the EC2 instance does not allow outbound traffic

Answer

The DB instance does not have a public IP address

Question 17

A company has deployed a multi-account AWS environment using AWS Organizations. Each account has one or more VPCs that need to communicate with each other and with an on-premises data center via a central transit VPC. The company uses AWS Transit Gateway with a centralized network account that hosts the Transit Gateway. VPCs from other accounts are attached to the Transit Gateway via Resource Access Manager (RAM) shares. The network team notices that after attaching a new VPC from a member account, resources in that VPC cannot communicate with resources in other attached VPCs. The Transit Gateway route tables have appropriate routes, and the VPC route tables point to the Transit Gateway. What is the MOST likely cause of the issue?

Accepted Answer

The Transit Gateway attachment in the member account is in the 'pending acceptance' state and not yet accepted by the Transit Gateway owner.. Option D is correct because when sharing a Transit Gateway attachment via RAM, the owner of the Transit Gateway must accept the attachment. Option A is incorrect because the Transit Gateway is not in the member account. Option B is incorrect because route propagation is not required. Option C is incorrect because VPC CIDR is not the issue.

Answer

The Transit Gateway route table does not have the routes from the new VPC propagated.

Answer

The new VPC's CIDR overlaps with an existing attachment's CIDR.

Answer

The member account's VPC does not have a route to the Transit Gateway in its route tables.

Question 18

A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) across multiple Availability Zones. The application uses a MySQL database on an RDS instance in a private subnet. Security compliance requires that all traffic between the ALB and EC2 instances must be encrypted. The security team finds that the ALB currently sends traffic to the EC2 instances using HTTP on port 80. The EC2 security group allows inbound HTTP traffic from the ALB security group. The team needs to implement encryption with minimal changes and without disrupting the application. Which solution meets these requirements?

Accepted Answer

Modify the ALB listener to use HTTPS on port 443. Create a new target group with protocol HTTPS on port 443. Install a valid SSL/TLS certificate on each EC2 instance. Update the EC2 security group to allow inbound HTTPS from the ALB security group.. Option C is correct because it directly modifies the existing ALB to use an HTTPS listener on port 443, creates a new target group with HTTPS on port 443, and requires installing a valid SSL/TLS certificate on each EC2 instance. This ensures all traffic between the ALB and EC2 instances is encrypted with TLS, meeting the security requirement with minimal changes and no disruption to the application. The EC2 security group update to allow inbound HTTPS from the ALB security group completes the configuration.

Answer

Set up an AWS Client VPN endpoint and have the ALB send traffic through the VPN to the EC2 instances.

Answer

Deploy an internal ALB in front of the EC2 instances and configure it with an HTTPS listener. Route traffic from the public ALB to the internal ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB) and use TLS listeners to the EC2 instances.

Question 19

A large e-commerce company operates a multi-tier application across multiple AWS accounts. The web tier is in a VPC (10.0.0.0/16) in Account A, and the application tier is in a separate VPC (10.1.0.0/16) in Account B. Both VPCs are connected via a VPC peering connection. The application tier uses an NLB to distribute traffic to EC2 instances in private subnets. The web tier sends traffic to the NLB's private IP address. Recently, the company migrated the application tier to use AWS PrivateLink instead of the VPC peering connection, creating a VPC endpoint service in Account B and an interface VPC endpoint in Account A. After the migration, the web tier cannot connect to the application tier. The security groups and NACLs allow the traffic. Which of the following is the MOST likely cause of the connectivity issue?

Accepted Answer

The web tier instances are using the private IP address of the Network Load Balancer instead of the VPC endpoint DNS name or private IP addresses.. After migrating from VPC peering to AWS PrivateLink, the web tier instances must use the VPC endpoint's DNS name or its private IP addresses to connect to the application tier. The VPC endpoint provides a different set of IP addresses (from the subnet in Account A) than the NLB's private IP, which remains in Account B. Since the web tier continues to send traffic to the NLB's private IP, the packets are not routed through the VPC endpoint, causing connectivity failure because the VPC peering connection is no longer available.

Answer

The route tables in Account A's VPC do not have a route to the VPC endpoint service in Account B.

Answer

The VPC endpoint in Account A requires an Internet Gateway (IGW) to route traffic to the VPC endpoint service in Account B.

Answer

The Network Load Balancer in Account B is not configured to support TCP traffic.

Question 20

A company has a hub-and-spoke network topology using AWS Transit Gateway in us-east-1. The hub VPC hosts centralized inspection appliances from a third-party vendor. The spokes include VPCs with application workloads and a Direct Connect VIF attached to a Direct Connect gateway which is associated with the Transit Gateway. The company notices that traffic from the on-premises network to the spoke VPCs is not being inspected by the centralized appliances. They have verified that the Transit Gateway route tables are correctly configured with static routes pointing to the inspection VPC for all spoke CIDRs, and the inspection appliances are properly configured to forward traffic. What is the most likely cause of this issue?

Accepted Answer

The Transit Gateway route table associated with the Direct Connect gateway attachment does not have a route that sends traffic to the inspection VPC.. Option B is correct because in a hub-and-spoke topology with AWS Transit Gateway, traffic from on-premises (via Direct Connect) to spoke VPCs must be routed through the inspection VPC. This requires the Transit Gateway route table associated with the Direct Connect gateway attachment to contain a static route pointing to the inspection VPC attachment for the spoke CIDRs. Without this route, traffic bypasses inspection entirely.

Answer

The Direct Connect gateway is not propagating routes to the Transit Gateway, causing the on-premises traffic to be dropped.

Answer

The inspection VPC is sending traffic back to the on-premises network via a different path, causing asymmetric routing that drops packets.

Answer

The Transit Gateway route table for the spoke VPC attachments does not have a route to the on-premises network via the Direct Connect gateway.