AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ236

Network Security, Compliance, and Governance

A company has recently begun using AWS Client VPN to allow its remote users to access resources in multiple peered VPCs and in the company’s on-premises data center. The Client VPN endpoint route table contains one entry: 0.0.0.0/0. The Client VPN endpoint uses a new security group with no inbound rules and one outbound rule that permits all traffic to 0.0.0.0/0.

Multiple remote users report that web search results display inaccurate geographic location information for them.

Which combination of steps should a network engineer take to resolve this issue with the LEAST service interruption?

Choose three
  • A Switch users to AWS Site-to-Site VPNs.
  • B Enable the split-tunnel option on the Client VPN endpoint.
  • C Add routes for the peered VPCs and for the on-premises data center to the Client VPN route table.
  • D Remove the 0.0.0.0/0 outbound rule from the security group that the Client VPN endpoint uses.
  • E Delete and recreate the Client VPN endpoint in a different VPC.
  • F Remove the 0.0.0.0/0 entry from the Client VPN endpoint route table.
Explanation

By default, AWS Client VPN routes all client traffic through the VPN tunnel, which makes Internet services observe the AWS egress location rather than the user’s local location. Split tunneling sends only traffic whose destination matches Client VPN endpoint routes through the tunnel. Specific routes for each peered VPC and the on-premises network preserve access to those private resources. A 0.0.0.0/0 route must be removed because AWS does not recommend that route with split tunneling due to possible connectivity disruption.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!