ANS-C01 Mock Exam 93 — 25 Questions

Question 1

A company has a Direct Connect connection with a private VIF to a VPC in us-east-1. The VPC has two subnets: a public subnet and a private subnet. The public subnet has an internet gateway attached. The private subnet has a NAT gateway. The company's on-premises network uses the 10.0.0.0/8 IP range. The VPC CIDR is 10.1.0.0/16. The on-premises router is advertising 10.1.0.0/16 over BGP to the Direct Connect router. The company needs EC2 instances in the private subnet to initiate outbound connections to the internet for updates. The NAT gateway is in the public subnet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT gateway. However, the on-premises network team reports that they can ping the private IP of the NAT gateway (10.1.0.10) but not the private IP of an EC2 instance in the private subnet (10.1.1.50). The EC2 instance's security group allows ICMP from the on-premises IP range. The VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. The VPC is attached to a virtual private gateway. What is the most likely cause?

Accepted Answer

The private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway.. The on-premises network can ping the NAT gateway because the NAT gateway is in the public subnet, and the route table for the public subnet likely has a route to the virtual private gateway for the on-premises CIDR. However, the EC2 instance is in the private subnet, and the private subnet's route table does not have a route for the on-premises CIDR (10.0.0.0/8) pointing to the virtual private gateway. The VPC's main route table has such a route, but the private subnet is not using the main route table; it likely has a custom route table that only has the default route to the NAT gateway. Therefore, traffic from on-premises to the EC2 instance's private IP is not routed to the virtual private gateway. Option D is correct. Option A is incorrect because the security group allows ICMP. Option B is incorrect because the NAT gateway is reachable. Option C is incorrect because the virtual private gateway is attached.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The NAT gateway is not reachable from the on-premises network.

Answer

The security group on the EC2 instance is blocking ICMP from the on-premises IP range.

Question 2

A global e-commerce company operates a production environment on AWS with a VPC (10.0.0.0/16) containing public and private subnets in three Availability Zones. The application runs on EC2 instances in private subnets behind an Application Load Balancer (ALB) in public subnets. The company uses AWS Transit Gateway to connect multiple VPCs and on-premises data centers via Site-to-Site VPN. Recently, the operations team noticed intermittent connectivity issues: users in the Asia-Pacific region experience slow page load times and occasional timeouts, while users in other regions have no issues. The network team suspects packet loss or high latency on the VPN connection to the on-premises data center in Singapore, which hosts a critical database. The AWS Direct Connect connection is not yet available. The team ran a traceroute from an EC2 instance in the production VPC to the database server (IP 203.0.113.50) and observed high latency and packet loss on the fifth hop (a transit gateway attachment). The VPN tunnel status shows 'UP' on both ends. CloudWatch metrics for the VPN tunnel show no errors but high 'TunnelData' bytes. What should the network engineer do FIRST to resolve the issue?

Accepted Answer

Enable jumbo frames on the transit gateway and the EC2 instances in the private subnets.. Option D is correct because enabling jumbo frames on the transit gateway and EC2 instances can improve throughput and reduce latency by allowing larger MTU, which reduces the number of packets and thus CPU overhead. High latency and packet loss on a transit gateway attachment, especially with high data volume, suggests MTU issues. Option A is incorrect because while BGP attributes can influence routing, the symptoms point to MTU fragmentation rather than suboptimal routing. Option B is incorrect because increasing VPN bandwidth does not address packet loss due to MTU. Option C is incorrect because the VPN tunnel is already up and CloudWatch shows high data volume, not errors.

Answer

Increase the VPN tunnel bandwidth by creating a second VPN tunnel and enabling ECMP.

Answer

Modify the BGP attributes on the transit gateway to prefer the Direct Connect path once it becomes available.

Answer

Rebuild the VPN connection using a different customer gateway device with stronger encryption.

Question 3

A company has a VPC with CIDR 10.0.0.0/16. They have two Availability Zones (us-east-1a and us-east-1b). In each AZ, there is a public subnet (10.0.1.0/24 and 10.0.2.0/24) and a private subnet (10.0.3.0/24 and 10.0.4.0/24). A NAT Gateway is deployed in the public subnet of us-east-1a. The private route tables for both private subnets have a default route pointing to the NAT Gateway. An application team has deployed EC2 instances in the private subnets. They report that instances in us-east-1b cannot access the internet, while instances in us-east-1a can. The NAT Gateway is healthy and has an Elastic IP attached. The route tables for the public subnets have a default route to the Internet Gateway. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet in us-east-1b does not have a default route to the Internet Gateway. Option B is correct because the NAT Gateway is only in us-east-1a, so traffic from us-east-1b private subnets must traverse an Availability Zone boundary. The route table for the private subnet in us-east-1b points to the NAT Gateway, but the NAT Gateway is in a different AZ. However, that is allowed. The issue is likely the public subnet route table for us-east-1b does not have a route to the Internet Gateway, so the NAT Gateway cannot send traffic out. Option A is wrong because cross-AZ traffic is allowed. Option C is wrong because there is no such limit. Option D is wrong because NAT Gateways are not assigned to private subnets.

Answer

The NAT Gateway is deployed in a private subnet

Answer

The NAT Gateway has reached the maximum number of concurrent connections

Answer

The NAT Gateway is in a different Availability Zone than the private subnet instances, causing cross-AZ data transfer charges

Question 4

A company has a Direct Connect connection with a single private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The VPC CIDR is 10.0.0.0/16. The on-premises CIDR is 172.16.0.0/12. The BGP session is established, and the on-premises router is advertising the 172.16.0.0/12 route to the VGW. The VGW is configured to propagate routes to the VPC route tables. However, instances in the VPC cannot reach on-premises resources. The VPC route table shows a propagated route for 172.16.0.0/12 with a target of the VGW. What is the most likely issue?

Accepted Answer

The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface. Option C is correct because the on-premises router must also have a route back to the VPC CIDR via the Direct Connect interface. Option A is wrong because the VPC route table has the route. Option B is wrong because the BGP session is established. Option D is wrong because security groups are stateful and outbound traffic is allowed by default.

Answer

The security groups for the VPC instances do not allow outbound traffic to the on-premises network

Answer

The VPC route table does not have a route for the on-premises CIDR

Answer

The BGP session is not advertising the VPC CIDR to the on-premises router

Question 5

A company is migrating its on-premises data center to AWS and wants to extend its Layer 2 network to AWS using AWS Outposts. The company has an existing VLAN with IP subnet 10.0.1.0/24 that hosts a legacy application requiring direct Layer 2 connectivity between on-premises servers and Outposts racks. The network engineer has installed an Outposts rack in the data center and connected it to the on-premises network via a local gateway (LGW) with a VLAN interface. The engineer has created a subnet in the Outposts VPC with CIDR 10.0.1.0/24 and launched EC2 instances. However, the on-premises servers cannot communicate with the Outposts instances. The LGW is configured correctly. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure the LGW VLAN interface with the correct VLAN ID that matches the on-premises VLAN.. Option C is correct because the LGW VLAN interface must be associated with the same VLAN ID as the on-premises network to allow Layer 2 communication. Option A is incorrect because a VPC peering connection is Layer 3, not Layer 2. Option B is incorrect because Direct Connect is not needed. Option D is incorrect because a Transit Gateway does not provide Layer 2 extension.

Answer

Create a VPC peering connection between the Outposts VPC and the on-premises network via the LGW.

Answer

Set up a Direct Connect private virtual interface from the on-premises router to the Outposts VPC.

Answer

Attach the Outposts VPC to a Transit Gateway and peer with on-premises network.

Question 6

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises data center to a VPC. The VPC has a virtual private gateway (VGW) attached. The company has recently added a second VPC and wants to use the same Direct Connect connection to access both VPCs. The network engineer proposes using a Direct Connect gateway (DXGW) with two private VIFs, one for each VPC. However, the engineer wants to minimize complexity and cost. Which configuration should the engineer use to allow both VPCs to use the same Direct Connect connection?

Accepted Answer

Create a Direct Connect gateway and associate it with the private VIF. Then associate both VPCs' virtual private gateways with the Direct Connect gateway.. Option B is correct because a Direct Connect gateway can be associated with multiple VGWs from different VPCs, allowing a single private VIF to connect to multiple VPCs. Option A is incorrect because private VIF is needed, not public. Option C is incorrect because each VPC needs its own VGW. Option D is incorrect because multiple private VIFs increase cost and complexity.

Answer

Create a private VIF for each VPC on the same Direct Connect connection.

Answer

Create a public virtual interface on the Direct Connect connection and attach both VPCs to it.

Answer

Create a single private VIF and attach both VPCs directly to it.

Question 7

A company has a production VPC with CIDR 10.0.0.0/16. They have an internet-facing Application Load Balancer (ALB) in public subnets across two Availability Zones. The ALB distributes traffic to a fleet of EC2 instances in private subnets. The EC2 instances need to access an Amazon S3 bucket to retrieve configuration files. The company wants to minimize data transfer costs and ensure that traffic to S3 does not traverse the internet. A network engineer created a Gateway VPC Endpoint for S3 in the VPC and added a route in the public subnet route tables pointing to the endpoint. However, the EC2 instances still cannot access the S3 bucket. The security groups for the EC2 instances allow outbound HTTPS to 0.0.0.0/0. The NACLs are default (allow all). The S3 bucket policy allows access from the VPC endpoint. What is the MOST likely reason the EC2 instances cannot access S3?

Accepted Answer

The route to the Gateway VPC Endpoint was added only to public subnets, not to private subnets. Option A is correct. The Gateway VPC Endpoint is only accessible from within the VPC, but the route to the endpoint must be added to the route tables of the subnets where the EC2 instances reside. The engineer added the route only to public subnet route tables, not to the private subnet route tables. Therefore, traffic from the EC2 instances destined to S3 uses the default route (0.0.0.0/0) which goes through the NAT Gateway or Internet Gateway, not through the endpoint. Option B is incorrect because the security group rule allows outbound HTTPS to all destinations. Option C is incorrect because the S3 bucket policy allows the VPC endpoint. Option D is incorrect because the endpoint is in the same region as the bucket.

Answer

The Gateway VPC Endpoint is in a different region than the S3 bucket

Answer

The security group for the EC2 instances does not allow outbound traffic to the S3 prefix list

Answer

The S3 bucket policy does not include a condition for the VPC endpoint

Question 8

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and an IPv6 CIDR of 2001:db8:1234::/56. The company hosts a web application on IPv4-only EC2 instances in a private subnet. The application must be accessible from the internet via IPv6. The company has an internet-facing Application Load Balancer (ALB) with dual-stack IP address type. The ALB is in a public subnet. The target group is configured with IP address type IPv4. Users report that they can access the application via IPv4 but not via IPv6. The ALB security group allows inbound HTTP/HTTPS from ::/0. What is the MOST likely cause?

Accepted Answer

The target group is configured with IP address type IPv4, but the ALB must use IPv6 to communicate with the targets.. Option C is correct because an IPv4-only target group cannot receive IPv6 traffic; the ALB would attempt to connect to targets via IPv4, but the ALB can still accept IPv6 and translate. However, the issue is that the route table for the private subnet does not have an IPv6 route to the NAT64 or egress-only internet gateway? Actually, the most likely cause is that the private subnet lacks a route for IPv6 traffic from the ALB to reach the IPv4 targets. Option A is incorrect because the ALB can terminate IPv6 and forward to IPv4. Option B is incorrect because the ALB does not need an IPv6 address. Option D is incorrect because the ALB does not need an EIP.

Answer

The public subnet does not have an associated IPv6 CIDR.

Answer

The ALB is configured as IPv4-only instead of dual-stack.

Answer

The private subnet's route table does not have an IPv6 route to the NAT gateway or egress-only internet gateway.

Question 9

A small company has a single VPC with one public subnet and one private subnet. They have a web server in the public subnet and a database server in the private subnet. The web server needs to access the database server on port 3306 (MySQL). The network engineer has configured the security group for the database server to allow inbound TCP port 3306 from the security group of the web server. However, the web server cannot connect to the database server. The network ACL for the private subnet is the default (allows all inbound and outbound). The web server can ping the database server's private IP. What is the MOST likely cause of the connection failure?

Accepted Answer

The MySQL service on the database server is not running or not listening on port 3306. Option C is correct. The security group for the database server allows inbound from the web server's security group, which is correct. However, security groups are stateful, so the return traffic is automatically allowed. The issue is likely that the database server is not listening on port 3306 or the MySQL service is not running. Since ping works, the network layer is fine. Option A is incorrect because NACLs are default allow. Option B is incorrect because the security group rule is correct. Option D is incorrect because the web server is in the same VPC, so it can reach the private IP.

Answer

The web server cannot reach the private IP of the database server because it is in a different subnet

Answer

The network ACL for the private subnet is blocking inbound traffic on port 3306

Answer

The security group for the database server is not allowing inbound traffic from the web server's security group

Question 10

A company is setting up an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a virtual private gateway (VGW) attached, and the VPN connection uses two tunnels for redundancy. The on-premises customer gateway (CGW) is configured with the public IP address of the on-premises VPN device. The VPN tunnels are up and BGP sessions are established. However, the company cannot ping an EC2 instance in the VPC from an on-premises server. The security group for the EC2 instance allows ICMP from the on-premises network CIDR. What is the MOST likely cause of the issue?

Accepted Answer

The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.. Option A is correct because the VPC subnet route tables must have a route pointing to the VGW for the on-premises CIDR. Option B is incorrect because BGP is established. Option C is incorrect because the CGW is configured correctly. Option D is incorrect because the VPN connection does not have a security group.

Answer

The customer gateway is configured with an incorrect private IP address.

Answer

The VPN connection's security group is blocking ICMP traffic.

Answer

The BGP session is not advertising the on-premises routes to the VGW.

Question 11

A company has a VPC with a CIDR of 172.16.0.0/16. The VPC has two subnets: subnet A (172.16.1.0/24) and subnet B (172.16.2.0/24). The company launches an EC2 instance in subnet A with a private IP of 172.16.1.10 and a public IP. The instance's security group allows inbound SSH from 0.0.0.0/0. The subnet A's route table has a route to an internet gateway (IGW) for 0.0.0.0/0. The network engineer can SSH into the instance from the internet. The company then attaches a second network interface (eth1) to the instance with an IP from subnet B (172.16.2.20). The engineer wants to use this interface for additional management traffic. After attaching, the engineer can no longer SSH into the instance via the original public IP. What is the MOST likely cause?

Accepted Answer

The operating system's routing table now uses eth1 as the default gateway, causing asymmetric routing.. Option D is correct because when you attach a second ENI, the OS may change the default route, causing traffic to egress via the new interface. Option A is incorrect because the security group is already allowed. Option B is incorrect because the route table is fine. Option C is incorrect because there is no IGW in subnet B by default.

Answer

The route table for subnet B does not have a route to the IGW.

Answer

The security group for eth1 blocks inbound SSH.

Answer

The internet gateway is not attached to subnet B.

Question 12

A company is implementing a network architecture for a critical application that requires ultra-low latency between two Amazon EC2 instances. The instances are launched in two different Availability Zones within the same AWS Region. The network engineer needs to ensure that traffic between the instances uses the lowest latency path possible. The instances are placed in a cluster placement group. The application uses TCP. The engineer has configured the security groups to allow all traffic between the instances. However, latency is higher than expected. What should the engineer do to reduce latency?

Accepted Answer

Enable Elastic Network Adapter (ENA) and enhanced networking on both instances.. Option A is correct because Elastic Network Adapter (ENA) with enhanced networking provides lower latency and higher throughput. Option B is incorrect because cluster placement group is already used. Option C is incorrect because using private IP ensures traffic stays within AWS network, but ENA is more impactful. Option D is incorrect because VPC peering does not help; instances are in same VPC.

Answer

Configure the instances to use their private IP addresses instead of public IPs for communication.

Answer

Move the instances to the same subnet within the same Availability Zone.

Answer

Set up a VPC peering connection between the subnets in the two Availability Zones.

Question 13

A company uses a VPC with multiple subnets in different Availability Zones. The VPC has a NAT Gateway in a public subnet of us-east-1a, and a second NAT Gateway in us-east-1b for high availability. Each private subnet in us-east-1a routes 0.0.0.0/0 to the NAT Gateway in us-east-1a, and private subnets in us-east-1b route to the NAT Gateway in us-east-1b. The company's EC2 instances in private subnets need to access an external service using IPv6. The VPC is not configured for IPv6. The network engineer needs to enable IPv6 connectivity for these instances. Which solution is the most cost-effective and scalable?

Accepted Answer

Add an IPv6 CIDR block to the VPC, assign IPv6 addresses to private subnets, and add a route for ::/0 to an egress-only internet gateway.. Option C is correct because using an egress-only internet gateway (EIGW) provides IPv6 outbound connectivity for instances in private subnets when the VPC is dual-stack. Option A is wrong because NAT64 translates IPv6 to IPv4, but the service is IPv6, so not needed. Option B is wrong because adding IPv6 CIDR and using NAT64 is not necessary. Option D is wrong because an internet gateway alone does not work for private subnets; it requires a route and instances need public IPv6 addresses.

Answer

Add an IPv6 CIDR block to the VPC and configure a NAT64 gateway to translate IPv6 to IPv4.

Answer

Attach an internet gateway to the VPC and add a route for ::/0 to the internet gateway in the private subnets.

Answer

Add an IPv6 CIDR block to the VPC and use the existing NAT Gateways with IPv6.

Question 14

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a web application that needs to access an external API over the internet. The private subnet uses a NAT Gateway in the public subnet for outbound internet access. The web application is failing to reach the external API. The engineer has verified the following: the NAT Gateway has an Elastic IP attached, the route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway, the security group for the web application allows outbound HTTPS (TCP 443) to 0.0.0.0/0, the network ACL for the private subnet allows inbound and outbound TCP ephemeral ports (1024-65535) from and to 0.0.0.0/0, and the IAM role attached to the EC2 instance allows outbound HTTPS. The engineer also confirmed that the NAT Gateway is in the public subnet which has a route to an Internet Gateway. Despite all these checks, the web application still cannot reach the external API. What should the engineer do next?

Accepted Answer

Verify that the route table is correctly associated with the private subnet.. Option D is correct because even though the route table has a default route to the NAT Gateway, the subnet association might be incorrect. The route table associated with the private subnet might not be the one being used. Checking the subnet association ensures that the correct route table is applied. Option A is incorrect because the NAT Gateway is already in the public subnet. Option B is incorrect because the default route is present. Option C is incorrect because the security group already allows outbound HTTPS.

Answer

Add an inbound rule to the security group for the external API's IP address.

Answer

Move the NAT Gateway to the private subnet.

Answer

Add a specific route for the external API's IP address to the route table.

Question 15

A company has a hub-and-spoke network architecture using AWS Transit Gateway. The hub VPC contains a central inspection appliance (NVA) for traffic inspection. Spoke VPCs are attached to the Transit Gateway and have routes pointing to the Transit Gateway for all traffic. The Transit Gateway has a default route table that routes traffic to the NVA for inspection. Recently, the network team noticed that traffic between two spoke VPCs is not being inspected. The team verified that the Transit Gateway route tables are correctly configured and that the NVA is healthy. What should the team do to ensure that inter-spoke traffic is inspected?

Accepted Answer

Configure route propagation in the Transit Gateway route tables to propagate routes from the spoke attachments. Option B is correct because enabling route propagation from the Transit Gateway attachments to the route tables ensures that routes are dynamically updated. Option A is wrong because static routes may cause issues if the NVA IP changes. Option C is wrong because VPC Flow Logs do not configure inspection. Option D is wrong because increasing bandwidth does not solve the inspection routing issue.

Answer

Enable VPC Flow Logs on the spoke VPCs to capture traffic

Answer

Add static routes in the spoke VPC route tables pointing to the NVA

Answer

Increase the bandwidth of the Transit Gateway attachments

Question 16

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones in a VPC. The application communicates with an on-premises database over an AWS Direct Connect private VIF. The network team has configured a VPN connection as a backup. Recently, the application experienced intermittent timeouts when accessing the database. The team suspects asymmetric routing because the primary Direct Connect and backup VPN are both active. The network team wants to ensure that all traffic to the on-premises network uses the Direct Connect when it is available, and only fails over to the VPN if Direct Connect goes down. The BGP sessions are configured on both connections. The Direct Connect advertises the on-premises CIDR of 10.0.0.0/16, and the VPN advertises the same CIDR. The team has access to the on-premises router configuration and AWS console. Which action should the team take to resolve the issue?

Accepted Answer

Configure the on-premises router to prepend one or more AS numbers to the routes advertised over the VPN BGP session.. Option C is correct because adjusting the BGP attributes to make the Direct Connect path more preferred ensures all traffic uses Direct Connect when available. Adding AS path prepend on the VPN side makes the VPN path less preferred, so Direct Connect is chosen. Option A is wrong because adding a static route might not be as dynamic and could cause issues if Direct Connect fails. Option B is wrong because removing the VPN BGP session removes redundancy. Option D is wrong because reducing the prefix size on the VPN side would make the VPN path more specific and thus preferred, causing the same issue.

Answer

Add a static route in the VPC route table pointing to the Direct Connect virtual interface for the on-premises CIDR.

Answer

Advertise a more specific prefix (e.g., 10.0.0.0/24) over the VPN BGP session to attract traffic.

Answer

Disable BGP on the VPN connection and use static routes instead.

Question 17

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The connection uses a private virtual interface (VIF) to access the VPC. The network team is monitoring the link and notices that the BGP session goes down intermittently. The team has checked the physical layer and found no issues. The BGP keepalive timer is set to 30 seconds on both sides. The network engineer suspects that the issue might be related to the BGP hold timer. What should the engineer do to stabilize the BGP session?

Accepted Answer

Increase the BGP hold timer to 90 seconds on both the on-premises router and the AWS side.. Option A is correct because increasing the BGP hold timer allows more time to receive keepalives, reducing flapping due to transient issues. Option B is wrong because decreasing the hold timer would make the session more sensitive. Option C is wrong because a static route would bypass BGP and not provide redundancy. Option D is wrong because moving to a public VIF is unrelated to BGP stability.

Answer

Configure a static route on the on-premises router for the VPC CIDR.

Answer

Decrease the BGP hold timer to 10 seconds on the on-premises router.

Answer

Change the virtual interface to a public VIF to improve BGP stability.

Question 18

A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones. The application is fronted by an Application Load Balancer (ALB). The network team recently migrated from a transit VPC to a transit gateway for inter-VPC connectivity. After the migration, users experience intermittent connectivity failures. The team checks the ALB target group and sees that health checks are passing. However, from an EC2 instance in the same VPC, they can reach the ALB but not the application. They notice that the application sends traffic to an internal DNS server that is in a different VPC, and the application depends on that DNS resolution. The transit gateway route tables are configured to propagate routes from attached VPCs. The DNS server is reachable from the application VPC over the transit gateway. What is the MOST likely cause of the intermittent failures?

Accepted Answer

The DNS server returns different IP addresses for the same DNS name, and some IPs are not reachable due to route table misconfiguration.. If the DNS server returns different IP addresses for the same DNS name due to DNS round-robin or time-to-live (TTL) caching, the application may get an IP address that is not reachable (e.g., from a different VPC or a terminated instance). The health check may pass because the target group health check uses the ALB's IP, not the application's DNS resolution. Option A is plausible but less likely because the DNS server is reachable. Option B could cause total failure, not intermittent. Option D would affect all traffic, not just intermittent.

Answer

The transit gateway route tables have a blackhole route for the DNS server's VPC.

Answer

The Auto Scaling group is scaling in and out frequently, causing application instances to be terminated during DNS resolution.

Answer

The ALB security group does not allow traffic from the application instances on the ephemeral ports.

Question 19

A media company streams live video to viewers worldwide. The application runs on EC2 instances behind an Application Load Balancer in two AWS regions, us-east-1 and eu-west-1. The company uses Amazon CloudFront as a CDN with origins pointing to both regional ALBs. The network team recently deployed AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. However, after enabling Global Accelerator, viewers in Europe report buffering issues, while viewers in the US have no issues. The team has verified that the Global Accelerator endpoints are healthy and the ALBs are functioning correctly. The application uses a custom domain name. The DNS is managed by Route 53. What is the most likely cause of the buffering issues for European viewers?

Accepted Answer

Global Accelerator is directing European traffic to the us-east-1 endpoint due to endpoint weight misconfiguration.. Option A is correct because Global Accelerator provides static IP addresses that are anycast from edge locations. If viewers' DNS queries resolve to the Global Accelerator DNS name, they get IPs that may route to the us-east-1 endpoint if the eu-west-1 endpoint is not properly configured or weighted, causing high latency. The most common issue is that the DNS resolution for the custom domain points to Global Accelerator, but the routing within Global Accelerator may not be directing European traffic to the eu-west-1 endpoint if the endpoint weights are misconfigured or if one endpoint is unhealthy. Option B is wrong because CloudFront origins are separate; Global Accelerator is used instead of CloudFront? Actually, they use both, but the issue is after enabling Global Accelerator. Option C is wrong because CloudFront would not cause issues when Global Accelerator is used. Option D is wrong because the application is not on-premises.

Answer

The Route 53 DNS record is not pointing to Global Accelerator but to CloudFront, bypassing Global Accelerator.

Answer

CloudFront is caching content from the us-east-1 origin only, causing high latency for European viewers.

Answer

The eu-west-1 ALB is not configured to accept traffic from Global Accelerator IPs.

Question 20

A company has a multi-VPC architecture using AWS Transit Gateway (TGW). They have a central inspection VPC with a Gateway Load Balancer (GWLB) and third-party firewall appliances. All other VPCs are attached to the TGW and have route tables that send traffic to the inspection VPC for inspection. Recently, the network team deployed a new VPC (VPC-D) and attached it to the TGW. They configured the VPC-D route table to send all inter-VPC traffic to the TGW. However, traffic from VPC-D to other VPCs is not being inspected. The team confirmed that the firewall appliances are healthy and the GWLB is correctly configured. Which action should the network team take to ensure traffic from VPC-D is inspected?

Accepted Answer

Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.. Each VPC attached to TGW has a TGW route table that controls how traffic is forwarded. To send traffic from VPC-D through the inspection VPC, the TGW route table associated with VPC-D's attachment must have routes that point to the inspection VPC's attachment. Simply attaching the VPC does not automatically associate it with the correct TGW route table. Option B is correct because it ensures that the TGW route table used by VPC-D directs traffic to the inspection VPC.

Answer

Enable route propagation on VPC-D's TGW attachment.

Answer

Add a route in VPC-D's subnet route tables pointing to the TGW for all traffic.

Answer

Create a new TGW route table and associate all VPC attachments to it.