Amazon Exam ANS-C01 Topic 4 Question 35 Discussion

Actual exam question for Amazon's ANS-C01 exam

Question #: 35
Topic #: 4

A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east-west (VPC-to-VPC) traffic.

Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations, and network ACLs as the cause of the dropped traffic.

What is causing the traffic to drop?

AThe stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC.

BAppliance mode is not enabled on the transit gateway attachment to the shared services VPC

CThe stateful appliances and the transit gateway attachments are deployed in the same subnet in the shared services VPC.

DAppliance mode is not enabled on the transit gateway attachment to the application VPCs.

Show Suggested Answer

Suggested Answer: B

The correct approach is to use AWS Systems Manager Session Manager, which allows you to manage your EC2 instances through a secure and browser-based interface. By deploying and configuring SSM Agent on each instance, you can enable Session Manager to communicate with the instances. By deploying VPC endpoints for Session Manager, you can enable the instances to connect to the AWS service without requiring an internet gateway, NAT device, or VPN connection. You can also use IAM policies and SSM documents to implement role-based access control for managing the instances. This approach has the least maintenance overhead, as it does not require any additional infrastructure or configuration.

by Verdell at Sep 06, 2024, 01:52 PM

Limited Time Offer

25%

Off

Get Premium ANS-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

1 months ago

Hold on, I'm not convinced. Maybe the problem is that the stateful appliances and the transit gateway attachments are deployed in a separate subnet in the shared services VPC. I'll go with option A just to be different.

upvoted 0 times

Germaine

3 days ago

User3: I'm not sure, but I'll go with option A and say the stateful appliances and transit gateway attachments are in separate subnets in the shared services VPC.

upvoted 0 times

...

Benedict

8 days ago

User2: I believe the problem could be that appliance mode is not enabled on the transit gateway attachment to the shared services VPC.

upvoted 0 times

...

Toi

14 days ago

User1: I think the issue might be that the stateful appliances and transit gateway attachments are in separate subnets in the shared services VPC.

upvoted 0 times

...

2 months ago

Well, this is a tricky one. I'm going to go with option B - appliance mode is not enabled on the transit gateway attachment to the shared services VPC. Seems like the most logical explanation for the dropped traffic.

upvoted 0 times