ANS-C01 Mock Exam 94 — 25 Questions

Question 1

A company has a VPC with public and private subnets. The public subnets have a NAT gateway for outbound internet access. The private subnets route all 0.0.0.0/0 traffic to the NAT gateway. The network team wants to centrally log all outbound internet traffic from the private subnets. They enable VPC Flow Logs and publish them to Amazon S3. However, they notice that the flow logs are capturing only traffic between instances within the VPC, not the NAT gateway traffic. What should the team do to capture outbound internet traffic?

Accepted Answer

Enable VPC Flow Logs specifically for the NAT gateway's elastic network interface.. VPC Flow Logs capture traffic at the network interface level. To capture traffic that goes through the NAT gateway, you need to enable flow logs on the NAT gateway's network interface. Option B is the correct approach. Option A is not necessary because NAT gateway traffic is not VPC-to-VPC. Option C would capture traffic but not specifically the outbound traffic. Option D is incorrect because the issue is not with VPC Flow Logs configuration but with the resource being monitored.

Answer

Enable VPC Flow Logs for all subnets in the VPC.

Answer

Use AWS CloudTrail to log NAT gateway traffic.

Answer

Enable VPC Flow Logs for the VPC and publish to CloudWatch Logs instead of S3.

Question 2

A company has a production VPC with a public and private subnet across two Availability Zones. The public subnet hosts a Network Load Balancer (NLB) that distributes traffic to EC2 instances in the private subnet. The application experiences periodic failures where the NLB marks all targets as unhealthy for about 2 minutes, then they recover. The health checks are HTTP on port 80 with a 5-second interval, 2 consecutive successes to be healthy, and 2 consecutive failures to be unhealthy. The target group health check timeout is 5 seconds. The EC2 instances are behind an Auto Scaling group with a minimum of 2 instances per AZ. CPU utilization on the instances is stable at 40%. The NLB's CloudWatch metrics show HealthyHostCount drops to zero suddenly. The network engineer suspects a network issue. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the interval, causing timeouts under transient network delays.. If the health check timeout equals the interval, a single delayed response can cause consecutive failures. Under load, if the health check request is delayed, the NLB might timeout, count a failure, and after two such timeouts, mark the instance unhealthy. The instances are not overloaded (CPU 40%), but network contention or latency could cause timeouts. However, the most common cause is that the health check timeout is equal to the interval, meaning a missed response leads to immediate failure. The recommended practice is to set timeout less than interval to allow for retries. Option D addresses this by increasing the interval or decreasing the timeout.

Answer

The security group for the private subnet is blocking inbound traffic from the NLB.

Answer

The NLB's cross-zone load balancing is disabled, causing all traffic to go to one AZ.

Answer

The route tables for the private subnets are missing a route to the NLB's subnet.

Question 3

A company has a VPC with multiple subnets across three Availability Zones. The VPC contains an Auto Scaling group of EC2 instances that process messages from an SQS queue. The instances are deployed in private subnets and need to access the SQS queue over the internet. The company wants to minimize data transfer costs and improve security by keeping traffic within the AWS network. The VPC has a NAT gateway in each AZ for outbound internet access. The network team has configured the route tables for the private subnets to send 0.0.0.0/0 traffic to the NAT gateway in the same AZ. However, the team notices that the EC2 instances are still using the NAT gateways to reach SQS, resulting in higher costs. What should the team do to ensure traffic to SQS stays within the AWS network?

Accepted Answer

Create a gateway VPC endpoint for SQS in the VPC and update the route tables for the private subnets to include a route for the SQS prefix list pointing to the endpoint.. Option B is correct because VPC Gateway Endpoints for SQS allow traffic to SQS to stay within the AWS network, avoiding NAT gateways and reducing costs. Option A is wrong because VPC Interface Endpoints are used for services that require private IPs, but SQS supports Gateway Endpoints. Option C is wrong because NACLs and security groups do not change the path; they only filter traffic. Option D is wrong because Direct Connect is for on-premises, not for VPC-to-SQS traffic.

Answer

Create an interface VPC endpoint for SQS in each private subnet.

Answer

Set up an AWS Direct Connect connection to route SQS traffic directly.

Answer

Modify the network ACLs and security groups to allow traffic to SQS without going through the NAT gateway.

Question 4

A company has a VPC with a single public subnet. The subnet has a web server that needs to be accessible over the internet. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the subnet allows inbound HTTP from 0.0.0.0/0 and outbound traffic on ports 1024-65535 to 0.0.0.0/0. The internet gateway is attached to the VPC, and the route table has a route to the internet gateway for 0.0.0.0/0. The web server has a public IP address. However, users cannot access the web server. The engineer verifies that the web server is running and listening on port 80. What is the most likely cause?

Accepted Answer

The network ACL's outbound rule does not allow traffic from port 80 to the internet.. Although the security group allows inbound HTTP, the network ACL's inbound rule only allows HTTP. However, the network ACL is stateless, so for a user to access the web server, the inbound rule must allow the HTTP traffic, and the outbound rule must allow return traffic. The outbound rule allows ephemeral ports, which is correct. However, the network ACL's default deny all inbound could be blocking if the rule order is wrong. But the question says the NACL allows inbound HTTP. The likely issue is that the security group is stateful and allows return traffic, but the network ACL is not stateful, and if the inbound rule does not allow the initial HTTP, it would fail. But it does allow inbound HTTP. So the issue might be that the security group's outbound rule is blocking the return traffic? No, security group is stateful. The most common mistake is that the network ACL's inbound rule does not allow the HTTP traffic from the internet because the rule number is higher than a deny rule. However, the question states the NACL allows inbound HTTP. Another common issue is that the web server's OS firewall is blocking. But the engineer verified the server is listening. The likely cause is that the security group is attached to the wrong ENI or the web server is in a private subnet. But the question says public subnet. The answer: the network ACL's outbound rule might be missing the return traffic for the HTTP response. The response uses ephemeral ports, but the outbound rule allows all outbound on ephemeral ports, so that's fine. Wait: the outbound rule allows traffic to 0.0.0.0/0 on ports 1024-65535, but the HTTP response comes from the server's port 80 to the client's ephemeral port, so the outbound traffic is from port 80 to the client's ephemeral port. The NACL outbound rule should allow traffic from the server's port 80 to the client's port. The outbound rule only allows source port 1024-65535, not port 80. That is the issue! The outbound rule must allow traffic from the server's port (80) to the client's ephemeral port. So the missing outbound rule for port 80 causes the response to be dropped.

Answer

The route table for the subnet does not have a route to the internet gateway.

Answer

The internet gateway is not properly attached to the VPC.

Answer

The security group's outbound rule is blocking the HTTP response.

Question 5

A company uses AWS CloudWAN to build a global network connecting multiple VPCs and on-premises sites. The network team has configured a core network with a segment that includes VPCs in us-east-1 and eu-west-1. The team notices that traffic between VPCs in different regions is taking a suboptimal path, going through the internet instead of staying within the AWS global network. The team has verified that the core network attachments are correctly configured and that the route tables are propagated. What should the team do to ensure traffic stays within the AWS global network?

Accepted Answer

Ensure both VPCs are attached to the same CloudWAN segment.. Option C is correct because CloudWAN uses segments and attachments; if the VPCs are not in the same segment, traffic may be routed through the internet. Option A is wrong because Transit Gateway is not needed when using CloudWAN. Option B is wrong because DX is for on-premises, not inter-region VPC traffic. Option D is wrong because VPC peering is not part of CloudWAN architecture.

Answer

Establish a VPC peering connection between the two VPCs.

Answer

Set up an AWS Direct Connect gateway to route traffic between regions.

Answer

Create a transit gateway in each region and peer them together.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). An EC2 instance in the private subnet needs to download patches from the internet. The team creates a NAT gateway in the public subnet and updates the private subnet route table to route 0.0.0.0/0 to the NAT gateway. The EC2 instance still cannot reach the internet. The team confirms the NAT gateway has an elastic IP and the public subnet has an internet gateway. What is the MOST likely cause?

Accepted Answer

The network ACL for the private subnet denies outbound traffic to the internet.. The security group or network ACL of the private subnet may be blocking outbound traffic. However, a common mistake is not disabling source/destination check on the NAT gateway. But NAT gateway is a managed service, so source/destination check is automatically disabled. Option A is correct: the private subnet's network ACL must allow outbound traffic and inbound return traffic. Option B is not needed because NAT gateway is managed. Option C is not a requirement. Option D would be for the NAT gateway's subnet.

Answer

The private subnet route table does not have a route for the NAT gateway's IP.

Answer

The public subnet does not have a route to the internet gateway.

Answer

The NAT gateway does not have source/destination check disabled.

Question 7

A company has a VPC with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via AWS Direct Connect. The network team needs to ensure that only specific VPCs can communicate with each other. They create a transit gateway route table for each VPC and attach the VPC to the route table. They also propagate routes from the Direct Connect virtual interface. However, after configuration, traffic between two VPCs that should not communicate is still flowing. What is the MOST likely cause?

Accepted Answer

The VPC attachments are using the default transit gateway route table instead of custom route tables.. If the transit gateway has a default route table that is shared, all attachments may be associated with it by default. If the team did not explicitly associate each VPC with its own route table, they might be using the default route table, which allows all routes. Option B is correct. Option A is not possible because route tables are not associated with attachments; attachments are associated with route tables. Option C would affect on-premises connectivity, not inter-VPC. Option D is the opposite of what is needed.

Answer

The VPC route tables have a route for the other VPC CIDR pointing to the transit gateway.

Answer

The transit gateway route tables are not associated with the VPC attachments.

Answer

The Direct Connect virtual interface is propagating routes into all route tables.

Question 8

A company has a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The security team requires that all traffic between VPCs must be inspected by a centralized firewall appliance deployed in a security VPC. They have configured a Transit Gateway with a route table that has blackhole routes for all VPC CIDRs except the security VPC, and the security VPC appliance performs inspection and returns traffic to the Transit Gateway. Recently, they added a new VPC for a critical application. After configuration, some traffic from the new VPC to other VPCs is being dropped. The network engineer verifies that the Transit Gateway route table includes a blackhole route for the new VPC's CIDR and that the security VPC's firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Accepted Answer

The Transit Gateway route table does not have a static route pointing to the security VPC attachment for the new VPC's CIDR.

Answer

The security VPC's network ACLs are blocking return traffic from the firewall appliance back to the Transit Gateway.

Answer

The new VPC's route table does not have a default route pointing to the Transit Gateway attachment.

Answer

The Transit Gateway route table propagates the new VPC's CIDR, overriding the static blackhole route.

Question 9

A company has a hybrid network architecture with an AWS Direct Connect connection between its on-premises data center and an Amazon VPC. The VPC has a single private subnet with Amazon EC2 instances running a critical application. The on-premises network uses BGP to advertise a route for the VPC's CIDR (10.0.0.0/16) to the on-premises routers. Recently, the company added a new application in a second VPC (VPC-B) with CIDR 10.1.0.0/16 and peered it with the original VPC (VPC-A). After the peering, users on-premises can still reach resources in VPC-A, but cannot reach resources in VPC-B. The VPC-A route table has a route for VPC-B's CIDR pointing to the peering connection. The VPC-B route table has a route for VPC-A's CIDR pointing to the peering connection. The on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface. What is the most likely cause of the issue?

Accepted Answer

The on-premises network is not advertising VPC-B's CIDR to the VPC via BGP, so VPC-B does not have a route back to on-premises.. Option C is correct. The on-premises network does not know how to reach VPC-B because VPC-B's CIDR is not advertised via BGP over Direct Connect. The static route on on-premises routers is not propagated to the VPC side, so VPC-B does not have a return route to on-premises. Option A is incorrect because the peering connection is working between VPCs. Option B is incorrect because security groups are stateful and would allow return traffic. Option D is incorrect because route propagation for the virtual private gateway does not apply to VPC-B if it is not attached to the same VGW.

Answer

The VPC peering connection is not properly configured.

Answer

The security group on VPC-B instances is blocking inbound traffic from on-premises IP ranges.

Answer

The virtual private gateway does not have route propagation enabled for VPC-B.

Question 10

A company has an S3 bucket that stores sensitive documents. They need to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, they want to prevent any uploads that do not specify the required KMS key. Which combination of bucket policy and default encryption should they implement?

Accepted Answer

Enable default encryption on the bucket with SSE-KMS using the required KMS key, and add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN.

Answer

Enable default encryption with SSE-S3, and add a bucket policy that denies s3:PutObject unless the request uses the required KMS key.

Answer

Use a bucket policy that requires the kms:Encrypt permission for the required key, but do not enable default encryption.

Answer

Enable default encryption with SSE-KMS using the required key, and rely on IAM policies to enforce encryption, not bucket policies.

Question 11

A company runs a multi-tier application on AWS. The web tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application tier runs on EC2 instances in a separate Auto Scaling group, and the database tier uses an Amazon RDS MySQL instance. All resources are in the same VPC. The security team has identified that the application tier instances are receiving traffic from unknown IP addresses on port 22 (SSH). The team wants to ensure that only the web tier instances can communicate with the application tier on the application port (8080), and only from a specific security group. Additionally, the database tier should only accept traffic from the application tier on port 3306. Currently, the security groups are configured as follows: Web-SG allows inbound from 0.0.0.0/0 on ports 80 and 443; App-SG allows inbound from 0.0.0.0/0 on port 8080 and from 0.0.0.0/0 on port 22; DB-SG allows inbound from 0.0.0.0/0 on port 3306. The team has also noticed that the web tier instances can be accessed via SSH from the internet. Which course of action should the team take to remediate the security issues?

Accepted Answer

Update Web-SG to allow SSH from a specific management CIDR. Update App-SG to allow inbound on port 8080 from Web-SG only, and remove inbound SSH from App-SG (or restrict to management CIDR). Update DB-SG to allow inbound on port 3306 from App-SG only.. The correct action is to update the security groups to restrict inbound traffic: Web-SG should allow SSH only from a trusted management IP, not from 0.0.0.0/0. App-SG should allow inbound on port 8080 only from Web-SG, and not allow SSH from 0.0.0.0/0. DB-SG should allow inbound on port 3306 only from App-SG. Option A achieves this. Option B only addresses the web tier SSH issue. Option C removes SSH entirely, which might be needed for management. Option D uses network ACLs but NACLs are stateless and would require complex rules; security groups are more appropriate for this use case.

Answer

Update Web-SG to allow SSH from a specific management CIDR. Leave App-SG and DB-SG as is because they are not directly accessible from the internet.

Answer

Remove inbound SSH rules from all security groups and rely on AWS Systems Manager Session Manager for administrative access.

Answer

Use network ACLs on the subnets to restrict traffic between tiers instead of security groups.

Question 12

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS and that bucket policies restrict access to specific IAM roles. They have created an SCP that denies s3:PutBucketPolicy unless the bucket is encrypted with KMS (using a condition) and restricts the PutBucketPolicy action to a specific role. After applying the SCP, the development team reports that they cannot update bucket policies even when using the allowed role. The SCP is attached to the root OU. The allowed role is in the dev account and has full S3 permissions via an IAM policy. What is the most likely reason for the failure?

Accepted Answer

The SCP denies s3:PutBucketPolicy for all principals except the allowed role, but the SCP is applied at the root OU and affects all accounts, so the allowed role is still denied because SCPs are deny-by-default and the allow list in the SCP does not override the implicit deny.

Answer

The SCP must be applied to the dev account specifically, not the root OU, because SCPs attached to OUs do not affect member accounts unless explicitly inherited.

Answer

The SCP condition key for KMS encryption is incorrect because the s3:PutBucketPolicy action does not support condition keys for encryption.

Answer

The IAM policy attached to the allowed role does not include s3:PutBucketPolicy permission, even though it has full S3 access.

Question 13

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to implement a centralized inspection architecture where all traffic between VPCs must be inspected by a security appliance (e.g., firewall) deployed in a dedicated inspection VPC. Currently, traffic flows directly between VPCs using the Transit Gateway. Which architecture change would enforce that all inter-VPC traffic passes through the inspection VPC?

Accepted Answer

Configure the Transit Gateway to use separate route tables for each VPC attachment, with a default route pointing to the inspection VPC's attachment. Then, in the inspection VPC, route traffic back to the Transit Gateway for final delivery.. Option B is correct. By using Transit Gateway route tables, you can create separate route tables for each VPC attachment and propagate only a default route pointing to the inspection VPC. This forces all traffic to go through the inspection VPC. Option A is incorrect because VPC peering does not integrate with Transit Gateway. Option C is incorrect because Network Load Balancer does not provide routing control. Option D is incorrect because Direct Connect is for on-premises connectivity, not for inter-VPC routing.

Answer

Create VPC peering connections between each VPC and the inspection VPC, and remove the Transit Gateway attachments.

Answer

Use AWS Direct Connect Gateway to route traffic through the inspection VPC.

Answer

Deploy a Network Load Balancer in each VPC and configure it to forward traffic to the inspection VPC.

Question 14

A company uses AWS Network Firewall to inspect traffic between VPCs in a transit gateway setup. They have a rule group that allows HTTP and HTTPS traffic to a web server in a production VPC. Recently, the security team added a new Suricata IPS rule to block traffic from a specific IP address. After deploying the updated rule group, they notice that all traffic to the web server is being dropped, even from allowed IPs. The firewall logs show the new rule is triggering for all traffic, not just the specific IP. What is the most likely cause?

Accepted Answer

The new rule is placed before the allow rules in the rule group, and due to the order of evaluation, the drop rule matches first and drops all traffic because the rule's source IP is set to 'any' instead of the specific IP.

Answer

The web server's security group is blocking traffic from the firewall's IP range after the firewall adds its source IP.

Answer

The new Suricata rule uses the 'drop' action instead of 'reject', causing all packets to be dropped.

Answer

The rule group is attached to the firewall policy in the wrong direction (e.g., outbound instead of inbound).

Question 15

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains several EC2 instances that need to download software updates from the internet. The security team has configured the following: - A security group on the EC2 instances allows outbound traffic to 0.0.0.0/0 on ports 443 and 80. - The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT gateway. - The NAT gateway is in the public subnet with an Elastic IP and its security group allows inbound traffic from the private subnet CIDR on ports 443 and 80, and outbound to 0.0.0.0/0 on all ports. Despite this, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's security group inbound rule is too restrictive. Option B is correct because the NAT gateway's security group inbound rule should allow traffic from the private subnet on ephemeral ports (1024-65535), not just ports 443 and 80. The outbound connection from the EC2 instance uses a random source port, and the NAT gateway must receive that return traffic. Option A is wrong because the route is correct. Option C is wrong because the NAT gateway is in the public subnet with an EIP, so it can reach the internet. Option D is wrong because the security group on the EC2 instances allows outbound traffic.

Answer

The NAT gateway does not have an Elastic IP associated

Answer

The route table of the private subnet does not have a route to the NAT gateway

Answer

The EC2 instances' security group does not allow inbound traffic from the NAT gateway

Question 16

A company is using Amazon VPC with a public subnet and a private subnet. The public subnet has a NAT gateway. The private subnet has an Amazon RDS for MySQL database. The security team wants to ensure that the database is not accessible from the internet, but they need to allow a specific on-premises network (IP range 203.0.113.0/24) to connect to the database for maintenance. The company also wants to restrict outbound traffic from the database to only necessary AWS services (e.g., S3 for backups) and deny all other outbound traffic. Which configuration should the security team implement?

Accepted Answer

Modify the database security group to allow inbound TCP 3306 from 203.0.113.0/24. Create a VPC endpoint for S3. Update the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list.. Option A is correct because modifying the database security group to allow inbound from the on-premises CIDR directly is the simplest and most secure way. Using a VPC endpoint for S3 allows private connectivity. A custom network ACL on the private subnet can deny all outbound traffic except to the VPC endpoint. Option B is wrong because a security group cannot reference another region's CIDR; also, allowing all outbound traffic to the VPC endpoint defeats the purpose. Option C is wrong because the NAT gateway is not needed for on-premises access; also, a security group cannot reference a prefix list for on-premises IPs. Option D is wrong because an internet gateway is not needed for on-premises access via VPN; also, allowing all outbound traffic to 0.0.0.0/0 is insecure.

Answer

Create a security group for the database that allows inbound from the on-premises network using a prefix list for 203.0.113.0/24. Create a VPC endpoint for S3 and allow outbound traffic to the endpoint. Keep the private subnet's network ACL default (allow all outbound).

Answer

Set up a Site-to-Site VPN between the on-premises network and the VPC. Modify the route tables to route 203.0.113.0/24 through the VPN. Place the database in a private subnet and allow inbound from the VPN CIDR. Use an internet gateway for outbound traffic to S3.

Answer

Place the database in a public subnet and use a security group that allows inbound from 203.0.113.0/24. Use the NAT gateway for outbound traffic to S3. Configure the public subnet's network ACL to deny all outbound traffic except to S3.

Question 17

A company runs a critical application on EC2 instances in a VPC. The application needs to send data to an S3 bucket and an SQS queue, both in the same AWS account. The security team requires that all traffic to these AWS services must stay within the AWS network and not traverse the internet. The VPC has private subnets with no NAT gateway or Internet Gateway. The EC2 instances have an IAM role that grants necessary permissions. The S3 bucket and SQS queue are configured with bucket policies and queue policies that deny all access except from the VPC. However, the application is failing to send data to both S3 and SQS. What should the network engineer do to resolve this issue?

Accepted Answer

Create a gateway endpoint for S3 and an interface endpoint for SQS in the VPC, and update the route tables for S3 and the security groups for SQS. Option C is correct because VPC endpoints for S3 (Gateway endpoint) and SQS (Interface endpoint) provide private connectivity without internet. The policies must also be updated to allow traffic from the endpoints. Option A is wrong because NAT gateways would route traffic over the internet, violating the requirement. Option B is wrong because Direct Connect is overkill and does not solve the immediate issue of private connectivity to S3 and SQS. Option D is wrong because CloudFront is for content delivery and does not provide private access to SQS.

Answer

Deploy an Amazon CloudFront distribution in front of S3 and use its public endpoint

Answer

Create a NAT gateway in a public subnet and update the route tables to send traffic to it

Answer

Set up an AWS Direct Connect connection and route traffic through it

Question 18

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing EC2 instances. The EC2 instances need to download patches from the internet. The security team wants to ensure that the EC2 instances cannot initiate outbound connections to any other internet destinations. What should the network engineer do?

Accepted Answer

Assign a security group to the EC2 instances that allows outbound HTTPS traffic only to the patch server's IP address.. Option D is correct because an egress-only Internet Gateway is for IPv6, not IPv4. For IPv4, the solution is to use a NAT gateway with a security group that denies all outbound traffic except to the patch server. However, the best approach is to configure the security group to allow only HTTPS outbound to the patch server's IP and deny all else. Option A is wrong because it would allow all outbound traffic. Option B is wrong because egress-only IGW is for IPv6. Option C is wrong because NACLs are stateless and not ideal for this granular control.

Answer

Remove the NAT gateway and attach an Internet Gateway to the private subnet route table.

Answer

Attach an egress-only Internet Gateway to the VPC and route private subnet traffic to it.

Answer

Configure a network ACL on the private subnet to allow outbound traffic only to the patch server's IP address.

Question 19

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. They have a central inspection VPC that uses AWS Network Firewall to inspect traffic. The security team wants to ensure that all traffic between VPCs and between VPCs and on-premises is routed through the inspection VPC. They have created a transit gateway route table for each VPC and the Direct Connect/VPN attachments. They have configured the route tables to propagate routes from the inspection VPC's attachment. However, traffic is still bypassing the inspection VPC. What should the security team do to ensure traffic is inspected?

Accepted Answer

Create static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and remove any routes that point directly to other attachments.. Option C is correct because to force traffic through the inspection VPC, you must use transit gateway route tables with specific routes pointing to the inspection VPC's attachment, and ensure that no other routes allow direct communication. Option A is wrong because enabling route propagation alone does not force traffic through inspection; the inspection VPC must be the next hop. Option B is wrong because VPC peering bypasses the transit gateway. Option D is wrong because network ACLs in the inspection VPC do not affect routing in the transit gateway.

Answer

Enable route propagation for all attachments in the transit gateway route tables.

Answer

Configure network ACLs in the inspection VPC to block traffic that does not come from the transit gateway.

Answer

Create VPC peering connections between all VPCs and the inspection VPC.

Question 20

A company has a VPC with CIDR 10.0.0.0/16. They have public subnets (10.0.1.0/24, 10.0.2.0/24) and private subnets (10.0.3.0/24, 10.0.4.0/24) in two Availability Zones. An Internet Gateway is attached to the VPC, and a NAT Gateway is in public subnet 10.0.1.0/24. The private subnets route 0.0.0.0/0 to the NAT Gateway. The security team notices that instances in private subnet 10.0.3.0/24 can reach the internet, but instances in private subnet 10.0.4.0/24 cannot. Both private subnets have the same route table configuration. The network ACLs for both private subnets are set to allow all inbound and outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet 10.0.1.0/24 does not have a route to the Internet Gateway.. Option B is correct because if the NAT Gateway is in subnet 10.0.1.0/24, the route table for that subnet must have a route to the Internet Gateway for the NAT Gateway to work. Without that route, the NAT Gateway cannot send traffic to the internet. Option A is wrong because the route tables for private subnets are correct. Option C is wrong because the network ACLs allow all traffic. Option D is wrong because security groups on the instances would affect both subnets equally.

Answer

The security group on the instances in private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The network ACL for private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The route table for private subnet 10.0.4.0/24 does not have a route to the NAT Gateway.