Question 10
A new IPv6-only outbound worker tier must call external IPv6 HTTPS services but must never accept unsolicited inbound connections from the internet. The VPC has IPv6 addressing, and the route table currently points at a normal internet gateway. Which routing component best enforces outbound-only initiation?
- Use an ordinary internet gateway alone and assume IPv6 addresses cannot accept connections initiated externally.
- Route ::/0 through a NAT gateway and rely on IPv4-only NAT translation for arbitrary native IPv6 egress.
- Retain the standard internet gateway and change only instance security-group ingress rules, leaving the IPv6 default route bidirectional through that gateway.
- Route the outbound IPv6 default path through an egress-only internet gateway and keep inbound security controls restrictive.
Explanation
Correct Answer
D:An egress-only internet gateway allows instances to initiate IPv6 connections while blocking unsolicited incoming IPv6 connections.
Incorrect Answers
A:An internet gateway supports bidirectional IPv6 routing and does not intrinsically enforce outbound-only connection initiation.
B:NAT gateways are not a generic substitute for the egress-only IPv6 internet gateway in the stated native-IPv6 design.
C:Security groups can limit traffic, but the required outbound-only IPv6 routing component is an egress-only internet gateway rather than an ordinary IGW.
Question 11
A private-subnet fleet must call AWS Security Token Service without internet egress and without NAT gateways. The security team requires a private VPC path and regional STS usage. Which connectivity design directly meets these constraints?
- Create a DynamoDB gateway VPC endpoint and use its prefix-list routing for all regional AWS STS API operations.
- Route the private fleet through a public-subnet NAT gateway to reach regional STS, keeping internet egress enabled.
- Use only a private hosted-zone alias of the regional STS hostname to its current public address without a service interface endpoint.
- Create a regional interface VPC endpoint for STS, enable suitable private DNS and security-group access, and use regional STS endpoints.
Explanation
Correct Answer
D:PrivateLink interface endpoints permit private VPC connectivity to supported regional AWS APIs while endpoint and IAM policies scope traffic.
Incorrect Answers
A:Gateway endpoints are service-specific: a DynamoDB endpoint cannot carry STS interface API calls.
B:NAT-mediated public STS calls violate the explicit no-NAT, no-internet-egress constraint.
C:A DNS override to a public IP does not create the private network path required for STS in this isolated VPC.
Question 12
Two development VPCs use separate Transit Gateway route tables. Their owners intentionally require isolation even though both VPC attachments use the same gateway. A propagation change accidentally advertises each CIDR into the other segment. Which control should be corrected?
- Disable the default TGW route-table propagation but leave explicit static routes to the opposite environment in both forwarding tables.
- Enable VPC peering between the two VPCs to reinforce their intended network isolation.
- Restore the intended attachment associations and selective propagations, using route-table isolation or explicit blackhole routes where needed.
- Keep both attachments associated to the same route table and enforce only application security-group rules while their CIDRs remain mutually routed.
Explanation
Correct Answer
C:Transit Gateway route-table associations and propagated or static routes determine cross-attachment reachability and enable segment boundaries.
Incorrect Answers
A:Static routes remain reachable when propagation is disabled; the intended isolation requires checking both propagated and static reachability.
B:VPC peering can create an additional path between the environments and is contrary to the requirement to isolate them.
D:Security-group filtering can restrict some application traffic but does not restore the required transit-gateway route-domain segmentation.
Question 13
An international enterprise has more than twenty regional network hubs and wants a single policy-based global backbone that defines segments and regional attachments. It is considering replacing numerous manually managed Transit Gateway peering routes. Which AWS networking service matches the governance requirement?
- Use a single regional Transit Gateway and manual inter-Region peering routes as the global backbone, managed by separate regional scripts.
- Evaluate AWS Cloud WAN core network policies with segmented attachments and defined inter-segment sharing.
- Use AWS Global Accelerator endpoints to steer public application traffic and treat them as a segmented private IP routing backbone.
- Use AWS Network Manager global network inventory dashboards for existing Transit Gateways without a Cloud WAN core network policy.
Explanation
Correct Answer
B:Cloud WAN offers policy-driven global network segments and a managed core for inter-Region enterprise connectivity and governance.
Incorrect Answers
A:This design retains the manual regional peering control plane the requirement seeks to replace; it lacks a unified Cloud WAN core policy.
C:Global Accelerator routes supported endpoint traffic but is not a policy-defined enterprise network core joining branch and VPC attachments.
D:Monitoring and inventory do not enforce a global core network policy or cross-Region segment topology.
Question 14
A network team deploys AWS Network Firewall endpoints in a centralized inspection VPC attached to Transit Gateway. A spoke application can reach the firewall, but return packets sometimes bypass the inspection endpoint, breaking a stateful policy. Which network property is essential?
- Configure source VPC routes through inspection but let the destination bypass inspection on its return route.
- Delete transit route-table segmentation and propagate all routes to all spokes without considering inspection.
- Route both directions of each flow through the intended Network Firewall endpoints, and apply the appropriate Transit Gateway appliance-mode and VPC routing controls to maintain stateful inspection affinity.
- Allow return traffic through any unrelated Network Firewall endpoint and rely on identical stateless network rules to reconstruct missing state.
Explanation
Correct Answer
C:Network Firewall requires symmetric traffic traversal. The inspection VPC attachment and both directions of the VPC and TGW routes must preserve the same stateful firewall path.
Incorrect Answers
A:Asymmetric return paths miss state tracked by the chosen firewall and reproduce the observed intermittent connection failure.
B:Unrestricted propagation may bypass mandatory inspection and does not guarantee per-flow bidirectional appliance affinity.
D:Stateful rules maintain flow-specific context; arbitrary asymmetric return paths cannot be repaired by merely allowing stateless packets.
Question 15
An isolated production VPC runs high-volume outbound HTTPS through one NAT gateway in Availability Zone A. Application instances in AZ B rely on that gateway; losing AZ A interrupts outbound traffic and inter-AZ transfer charges are material. Which design improvement addresses both issues?
- Replace all NAT traffic with an S3 gateway endpoint although the applications contact unrelated external HTTPS APIs.
- Deploy a NAT gateway in each active AZ and make each private subnet route to its local AZ NAT gateway.
- Provision extra NAT gateway capacity in AZ A but keep AZ B private subnet default routes directed to that one gateway.
- Route both AZ subnets through the same NAT gateway and add an extra route table without creating another physical gateway.
Explanation
Correct Answer
B:AZ-local NAT paths reduce cross-AZ traffic and avoid depending on a gateway in a different AZ for every subnet outbound connection.
Incorrect Answers
A:An S3 gateway endpoint is not an outbound path for arbitrary third-party HTTPS services or the stated general egress flow.
C:Extra capacity does not remove a single-AZ failure dependency or AZ B-to-A cross-AZ transfer path.
D:A separate route table that points to the same NAT gateway does not remove its availability-zone dependency.
Question 16
A VPC application resolves a private on-premises DNS zone, and on-premises clients resolve a private Route 53 hosted zone. The organization wants bidirectional DNS forwarding, yet it currently has only Resolver inbound endpoints in AWS. Which additional component addresses the missing direction?
- Create more Resolver inbound endpoints and assume they forward all VPC-originated requests to on-premises DNS servers.
- Create an AWS private hosted zone for the on-premises DNS suffix in the application VPC without forwarding to the authoritative on-premises DNS servers.
- Associate more inbound Resolver endpoints with the VPC and change the on-premises forwarding rules, but do not create an outbound forwarding path from AWS.
- Create Route 53 Resolver outbound endpoints and forwarding rules for the on-premises DNS domain, and associate them with the querying VPCs.
Explanation
Correct Answer
D:Outbound Resolver endpoints forward VPC-originated queries to external DNS servers; inbound endpoints serve the opposite direction.
Incorrect Answers
A:Inbound endpoints receive queries from hybrid clients into AWS and are not the outbound-forwarding component described.
B:A separate AWS-hosted private zone is not automatically synchronized with existing on-premises records and does not implement outbound forwarding.
C:Inbound endpoints support on-premises clients resolving AWS zones; they do not originate VPC queries to external DNS servers.
Question 17
A company has VPCs in two Availability Zones attached to a Transit Gateway. Subnet routes, security groups, and TGW route-table entries are correct, but only instances in AZ A can reach remote VPCs. The VPC attachment contains a subnet in AZ A and none in AZ B. What direct attachment correction restores AZ B reachability?
- Enable AZ B on the existing VPC Transit Gateway attachment by selecting an eligible subnet in AZ B, then verify that subnet routes allow TGW forwarding.
- Add only a second subnet route-table entry pointing to the same transit gateway while leaving AZ B absent from the VPC attachment.
- Add a more specific static CIDR route for the remote VPC in the Transit Gateway route table but retain the AZ A-only attachment.
- Enable appliance mode on the AZ A attachment and leave the second Availability Zone without an attachment subnet.
Explanation
Correct Answer
A:Transit Gateway requires an attachment subnet in each Availability Zone whose resources need to reach it; routing entries alone cannot provide the missing AZ attachment.
Incorrect Answers
B:A subnet route does not enable an Availability Zone that lacks a Transit Gateway attachment subnet.
C:Destination routing is already correct; traffic originating in an unattached Availability Zone still cannot reach Transit Gateway.
D:Appliance mode provides flow affinity for stateful inspection; it does not add AZ B as an eligible forwarding zone.
Question 18
A global enterprise needs its data-center applications to reach VPCs connected to a Transit Gateway through Direct Connect. An engineer has configured a private virtual interface to a virtual private gateway, but the desired topology requires the Direct Connect gateway and Transit Gateway association. What interface should be used?
- Configure a transit virtual interface toward the Direct Connect gateway associated with Transit Gateway, with suitable BGP and permitted prefixes.
- Use a public VIF because private VPC CIDRs are always advertised through public AWS service routes.
- Keep the private VIF attached to a VGW and assume it is a Transit Gateway attachment automatically.
- Create an additional Direct Connect gateway association but keep only the private VIF terminating at the virtual private gateway.
Explanation
Correct Answer
A:Transit VIFs connect Direct Connect to Transit Gateway through a Direct Connect gateway for transitive hybrid routing.
Incorrect Answers
B:A public VIF is for public AWS IP destinations, not the intended TGW private hybrid route domain.
C:Private VIF to VGW is a separate supported topology, not the transit VIF needed for DX-to-TGW access.
D:A Direct Connect gateway association alone cannot convert a VGW private VIF into a transit VIF used for a Transit Gateway attachment.
Question 19
A manufacturer already has a working private Direct Connect circuit to AWS. It wants its on-premises network to reach Amazon S3 public service IP addresses over a dedicated circuit while preserving private VPC traffic on its current VIF. Which addition is appropriate?
- Add an S3 gateway VPC endpoint to a connected VPC and expect the on-premises router to learn a dedicated public-S3 BGP path from it.
- Add an S3 interface VPC endpoint and make clients use its private ENI addresses, treating these as the requested public S3 service IPs.
- Configure a public Direct Connect virtual interface for eligible public AWS services with the required BGP announcements and security review.
- Configure only another private VIF and expect it to advertise S3 public address ranges as VPC CIDRs.
Explanation
Correct Answer
C:A public VIF provides routes to public AWS service addresses across Direct Connect; the private VIF remains for VPC destinations.
Incorrect Answers
A:A gateway endpoint affects participating VPC route tables and is not the Direct Connect public VIF used for public AWS service prefixes.
B:An S3 interface endpoint is a valid private-address alternative, but the question explicitly requires reaching S3 public service IPs over the circuit.
D:Private VIFs target private VPC connectivity and are not the public AWS service routing product.
Question 20
A production VPC communicates with a central inspection VPC through Transit Gateway. A security change should intentionally deny any route from the inspection table to an experimental CIDR, while retaining other propagated routes. What explicit routing action accomplishes this?
- Associate all VPCs with one shared table and use a more-general 0.0.0.0/0 route to the experimental VPC.
- Disable route propagation for the experimental attachment but leave an existing explicit static route to the forbidden CIDR in the inspection table.
- Replace only the VPC subnet route to Transit Gateway with a broader aggregate while leaving the inspection Transit Gateway route table permitting the experimental prefix.
- Add a more-specific blackhole route for the prohibited CIDR in the relevant Transit Gateway route table and confirm route precedence.
Explanation
Correct Answer
D:A blackhole route can drop traffic to the forbidden destination while leaving other forwarding entries unchanged.
Incorrect Answers
A:A default route would broaden reachable destinations rather than selectively deny the sensitive prefix.
B:Disabling propagation does not remove an already configured static route; the denied CIDR can remain reachable.
C:Changing an aggregate subnet route does not install the specific transit gateway destination deny requested.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests