Question 20
A production VPC communicates with a central inspection VPC through Transit Gateway. A security change should intentionally deny any route from the inspection table to an experimental CIDR, while retaining other propagated routes. What explicit routing action accomplishes this?
- Associate all VPCs with one shared table and use a more-general 0.0.0.0/0 route to the experimental VPC.
- Disable route propagation for the experimental attachment but leave an existing explicit static route to the forbidden CIDR in the inspection table.
- Replace only the VPC subnet route to Transit Gateway with a broader aggregate while leaving the inspection Transit Gateway route table permitting the experimental prefix.
- Add a more-specific blackhole route for the prohibited CIDR in the relevant Transit Gateway route table and confirm route precedence.
Explanation
Correct Answer
D:A blackhole route can drop traffic to the forbidden destination while leaving other forwarding entries unchanged.
Incorrect Answers
A:A default route would broaden reachable destinations rather than selectively deny the sensitive prefix.
B:Disabling propagation does not remove an already configured static route; the denied CIDR can remain reachable.
C:Changing an aggregate subnet route does not install the specific transit gateway destination deny requested.
Question 21
A company has a cross-account transit gateway attachment request waiting for approval. Its network account has shared the Transit Gateway through AWS RAM, but the participant VPC cannot send traffic until the attachment is operational. Which administrative step should networking perform?
- Accept or configure automatic acceptance for the participant attachment as appropriate, then add required association and routing.
- Update the RAM resource share to include the participant principal but leave its still-pending TGW VPC attachment unaccepted.
- Associate a TGW route table with the pending attachment without taking the explicit acceptance action required by the owner.
- Configure the participant VPC routes to the transit gateway while leaving the attachment in PendingAcceptance.
Explanation
Correct Answer
A:Sharing alone does not guarantee that an attachment is accepted, associated with a route table, and fully routed.
Incorrect Answers
B:Resource-share permission establishes eligibility to request an attachment, not acceptance of a pending attachment requiring authorization.
C:Route-table association does not bypass a pending-acceptance state for a requested VPC attachment.
D:VPC routes are necessary later but do not make an unaccepted attachment available for packet forwarding.
Question 22
A disaster recovery team has an active VPC peering connection between VPCs in different AWS Regions. Its application requires private addressing across Regions and a route to only the remote database subnet. What routing design is required?
- Enable transitive routing through a third peered VPC rather than updating the two direct peers.
- Advertise the remote database subnet with Transit Gateway route propagation, despite using only a direct VPC peering connection.
- Add the remote CIDR routes to the appropriate VPC route tables on both ends, targeting the inter-Region peering connection.
- Add a route to an internet gateway at both ends because inter-Region VPC peering is always public.
Explanation
Correct Answer
C:Peering becomes useful only after each side explicitly routes intended CIDRs through its peering attachment.
Incorrect Answers
A:VPC peering is nontransitive; a third peer cannot automatically route packets between the other two.
B:Transit Gateway propagation manages TGW attachments, whereas the specified active VPC peering connection needs explicit subnet routes.
D:Inter-Region peering uses AWS network connectivity and does not require public IGW routing for remote VPC CIDRs.
Question 23
Two existing peered VPCs contain private EC2 hosts whose DNS hostnames resolve to public IP addresses when queried across the peering connection. The administrator wants peer-side lookups to return private IPs where supported without exposing the hosts publicly. Which peering setting matters?
- Disable the peering connection and expose all instances through internet-facing load balancers.
- Add a Route 53 Resolver outbound forwarding rule for the public EC2 hostname while leaving the VPC peering DNS-resolution option disabled.
- Enable only VPC DNS hostnames on the source VPC but keep DNS resolution disabled on the active peering connection.
- Enable the appropriate DNS resolution option on the VPC peering connection and verify VPC DNS hostname settings.
Explanation
Correct Answer
D:The peering DNS resolution options can allow public hostnames of instances to resolve to private addresses across the peer connection.
Incorrect Answers
A:Public load balancing removes private connectivity and does not use the existing peering DNS setting.
B:Resolver forwarding targets external name servers; it does not enable the peering setting for private-IP answers to public EC2 hostnames.
C:The VPC hostname attribute by itself does not activate the peer-side public-hostname-to-private-IP resolution option.
Question 24
A networking team wants a shared private DNS namespace available to VPCs owned by several AWS accounts. The private hosted zone was created in a central account and must resolve inside participant VPCs. Which association workflow is needed?
- Publish the private zone as a public hosted zone so that all internet resolvers can read the internal names.
- Associate only a Route 53 Resolver forwarding rule with every participant VPC, without associating the central private hosted zone or forwarding to its authoritative resolver.
- Share the private hosted zone ARN through an AWS RAM resource share and assume that alone establishes every VPC-to-zone association.
- Authorize cross-account VPC association with the private hosted zone and complete the association in each permitted account.
Explanation
Correct Answer
D:Private hosted zones answer only for associated VPCs; cross-account authorization and association establish the intended DNS scope.
Incorrect Answers
A:Publishing internal names publicly violates the private namespace requirement and changes DNS exposure.
B:A forwarding-rule association alone cannot expose records in a separately owned private zone without a reachable authoritative target.
C:Private hosted-zone cross-account association uses explicit VPC-association authorization and association, not automatic resolution from a RAM share.
Question 25
A centralized DNS hub has Route 53 Resolver outbound endpoints and rules that forward queries for corp.example to an on-premises DNS server. A new application VPC in another account resolves public names, but corp.example queries never follow the central resolver rule. What is missing?
- Create a public DNS CNAME for corp.example pointing directly to a private on-premises IP address.
- Share and associate the appropriate forwarding rule with the application VPC using the supported Resolver/RAM workflow.
- Create separate outbound Resolver endpoints in each participant account but do not associate the existing central conditional forwarding rule.
- Associate the shared rule with only the DNS hub VPC and assume connected VPCs automatically inherit Resolver rule associations over Transit Gateway.
Explanation
Correct Answer
B:Resolver forwarding rules apply to associated VPCs; creating a rule in a hub VPC does not automatically attach every other VPC.
Incorrect Answers
A:Public DNS publication is not a substitute for controlled conditional forwarding to private authoritative servers.
C:Additional endpoints alone do not select a private domain suffix or distribute its conditional forwarding rule to a VPC.
D:Route 53 Resolver forwarding rule associations are per VPC; IP network connectivity does not distribute DNS rules.
Question 26
Corporate DNS servers over a private WAN must resolve names only in an AWS private hosted zone. Security wants those corporate DNS servers restricted to approved sources and requires their conditional forwarder to send only the internal domain to AWS. Which hybrid Resolver arrangement meets this requirement?
- Configure only outbound Resolver endpoints, since they are designed to receive on-premises queries for AWS private records.
- Create inbound endpoints but forward all public DNS zones to them, relying on the private hosted-zone association to filter arbitrary internet-domain requests.
- Use inbound Route 53 Resolver endpoints with restricted source/security group access and forward only approved private-zone names.
- Create inbound endpoints with security groups allowing any corporate subnet and send all DNS suffixes to AWS rather than only the approved internal zone.
Explanation
Correct Answer
C:Inbound endpoints can bridge on-premises queries to private hosted zones when perimeter and resolver forwarding scope are controlled.
Incorrect Answers
A:Outbound endpoints send VPC-originated queries toward external resolvers, the reverse direction of this requirement.
B:Inbound Resolver can also resolve other queries; the corporate conditional-forwarding scope must select only the intended private suffix.
D:An unrestricted corporate source range and all-domain forwarding do not preserve the required source and name-suffix boundaries.
Question 27
An enterprise needs to isolate production and development traffic using AWS Cloud WAN segments, while permitting a specific shared-services segment to provide DNS and directory services to both. Which policy construct addresses the selective reachability?
- Attach every network to one unrestricted segment and rely on separate account names to prevent cross-environment routing.
- Rely on the core network policy default attachment mapping while enabling automatic segment sharing across all network segments.
- Create static route propagation between production and development segments rather than sharing only the required shared-services paths.
- Use distinct Cloud WAN segments and explicit sharing or segment actions for the approved shared-services paths.
Explanation
Correct Answer
D:Cloud WAN network policy segments define routing domains; selective segment sharing permits intentional common services without full meshing.
Incorrect Answers
A:Account naming does not separate forwarding domains once prefixes are all reachable in one Cloud WAN segment.
B:Automatic unrestricted sharing removes the isolation boundary required between production and development.
C:Direct full cross-segment reachability unnecessarily joins the two environments the policy must isolate.
Question 28
A centralized egress VPC already has symmetric Transit Gateway routing through AWS Network Firewall. Security now requires HTTPS requests to approved SaaS hostnames only, and the managed firewall must match the relevant TLS Server Name Indication without installing custom filters on every EC2 instance. Which firewall rule-group approach fits this request?
- Configure an appropriate Network Firewall stateful domain-list rule group for the allowed TLS SNI names, with default actions and protocol limitations assessed.
- Add only stateless CIDR allow routes on Transit Gateway because network routes inspect the TLS requested hostname inside every encrypted connection.
- Use only stateful IP-set rules for resolved SaaS address ranges and assume they enforce exactly the named TLS SNI host on shared CDN addresses.
- Configure only stateless five-tuple firewall rules for port 443 and require the rule to evaluate requested SaaS hostnames.
Explanation
Correct Answer
A:Network Firewall domain-list stateful rules can match supported TLS SNI or HTTP Host information for domain-targeted filtering after routing is correct.
Incorrect Answers
B:Transit routing tables operate on destination prefixes rather than evaluating application-layer SNI hostnames from the TLS handshake.
C:An IP-based address list cannot distinguish different requested SaaS hostnames sharing network addresses; TLS SNI matching is the requirement.
D:Five-tuple stateless fields do not contain the TLS SNI name; domain list inspection must occur in a suitable stateful group.
Question 29
An application in one VPC needs to call an HTTPS service in another VPC using AWS PrivateLink. Consumers require endpoint DNS names resolving privately, and service owners should not expose all CIDRs. Which producer-side components are required?
- Deploy the HTTPS API behind a supported Network Load Balancer and create a PrivateLink endpoint service with authorized service consumers.
- Use an internet-facing Application Load Balancer only, and assume VPC interface endpoints can consume it directly as an endpoint service.
- Create VPC peering to every consumer, then add default transit routes to all subnets instead of an endpoint service.
- Publish the API through VPC Lattice service-network associations without creating the PrivateLink endpoint service requested for the existing interface endpoint consumers.
Explanation
Correct Answer
A:PrivateLink custom API interface endpoint services are typically backed by a Network Load Balancer; a Gateway Load Balancer service instead targets transparent security appliances.
Incorrect Answers
B:An ALB alone is not the load-balancer endpoint-service backing supported by this PrivateLink pattern.
C:Broad VPC routing is not the selective service exposure requested and cannot solve overlapping CIDR cases.
D:VPC Lattice is an alternate service-network architecture, not the provider endpoint-service needed for this consumer interface-endpoint requirement.
Question 30
A consumer VPC already has an interface endpoint to a private API, but application queries resolve the vendor hostname to a public address and egress toward a blocked internet route. Private DNS was intentionally disabled. What DNS configuration would fix the private endpoint path?
- Create only an endpoint policy granting the application role access but leave the public DNS answer unchanged.
- Add a private Route 53 zone with a record that still aliases to the vendor public IP instead of an endpoint-specific DNS name.
- Add a public internet gateway route while keeping all DNS queries directed to the public service address.
- Enable supported private DNS for the interface endpoint or configure appropriate private hosted-zone records pointing to endpoint DNS names.
Explanation
Correct Answer
D:The endpoint network interface exists but clients must resolve the service name to its private endpoint addresses to use the intended path.
Incorrect Answers
A:Endpoint policy authorizes requests that reach the endpoint; it does not remap hostname resolution to the private ENI addresses.
B:A private hosted-zone record must point clients to the interface endpoint DNS target or private address, not the inaccessible public service address.
C:Public egress violates the requirement to use the existing private endpoint and does not fix name resolution.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests