AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ274

Network Design

A company operates hundreds of Amazon EC2 instances in two production VPCs across every Availability Zone in the us-east-1 Region. The production VPCs are named VPC A and VPC B.

A new security regulation requires inspection of all traffic between the production VPCs before it is routed to its ultimate destination. The company deploys a new shared VPC containing a stateful firewall appliance and a transit gateway with a VPC attachment across all VPCs, routing traffic between VPC A and VPC B through the firewall appliance for inspection. During testing, the company finds that the transit gateway drops traffic whenever it travels between two Availability Zones.

What should a network engineer do to resolve this issue with the LEAST management overhead?

  • A In the shared VPC, replace the VPC attachment with a VPN attachment. Create a VPN tunnel between the transit gateway and the firewall appliance. Configure BGP.
  • B Enable transit gateway appliance mode on the VPC attachment in VPC A and VPC B.
  • C Enable transit gateway appliance mode on the VPC attachment in the shared VPC.
  • D In the shared VPC, configure one VPC peering connection to VPC A and another VPC peering connection to VPC B.
Explanation

A stateful firewall must receive both directions of a flow through the same Availability Zone and appliance instance so it can maintain connection state. Enabling Transit Gateway appliance mode on the shared VPC attachment provides flow stickiness for the VPC that contains the firewall, preventing asymmetric cross-Availability-Zone routing that causes stateful inspection traffic to be dropped.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!