AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ159

Network Security, Compliance, and Governance

A company has begun using AWS Cloud WAN with one edge location in the us-east-1 Region. The company has a production segment and a security segment in AWS Cloud WAN, along with a default core network policy.

The company created a production VPC for the production workload and an outbound inspection VPC to inspect internet-bound traffic from the production VPC. It attached the production VPC to the production segment and the outbound inspection VPC to the security segment. The company also created an AWS Network Firewall firewall in the outbound inspection VPC to inspect internet-based traffic.

The company updated a route table for the production VPC to send all internet-bound traffic to the AWS Cloud WAN core network. It also updated a route table for the outbound inspection VPC so that Network Firewall inspects all outgoing and incoming traffic.

During testing, an Amazon EC2 instance in the production VPC cannot access the internet. The company checks the Network Firewall rules and confirms that the rules are not blocking the traffic.

Which combination of steps will meet these requirements?

Choose two
  • A Update the core network policy to configure segment sharing. Share the production segment with the security segment.
  • B Update the core network policy to create a static route for the security segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
  • C Update the core network policy to create a static route for the production segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
  • D Update the core network policy to create a static route for the production segment. Specify 10.2.0.0/16 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
  • E Create an attachment to attach the outbound inspection VPC to the production segment. Update the core network policy to turn on isolated attachment for the production segment.
Explanation

AWS Cloud WAN segments are isolated routing domains by default. Sharing the production segment with the security segment makes the outbound inspection VPC attachment reachable from the production segment. A static 0.0.0.0/0 route in the production segment targeted to that attachment then directs the production VPC’s internet-bound traffic through the inspection VPC, where Network Firewall can inspect it. AWS documents that segment sharing advertises attachment and return routes between shared segments, while a segment route creates a static CIDR route to selected attachments.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!