Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Practice Test 17

Question 160

A security team wants to drop traffic to a known malicious corporate CIDR at the transit hub. What routing action is specific to TGW?

  1. Enable the destination attachment's propagation into that TGW table or define a valid static route
  2. Install an appropriately scoped blackhole route in the associated TGW route table
  3. Forward matching /24 traffic according to the more-specific static route
  4. Associate the VPN attachment with the route table that represents its inbound security domain

Explanation

Correct Answer

B:

A TGW blackhole route discards packets that match its destination rather than forwarding them to any attachment.

Incorrect Answers

A:

TGW ingress is evaluated against the associated TGW route table; a VPC route alone cannot resolve the second-hop destination; that addresses TGW route-table entry for an attached destination, rather than deliberate drop action within transit routing.

C:

Transit routing follows longest-prefix match before broad-prefix alternatives, allowing a narrow service segment to take an explicit next hop; this changes specific prefix overrides aggregate traffic steering, not the necessary deliberate drop action within transit routing.

D:

In the correct routing domain for inbound VPN traffic workflow, TGW association determines lookup behavior for packets arriving from the VPN; using the wrong table can expose or suppress destinations; the current case needs deliberate drop action within transit routing.

Question 161

A service provider publishes an endpoint service but subscribers cannot create an interface endpoint because their AWS account principals are not allowed. What should the provider change?

  1. Require endpoint connection acceptance on the endpoint service
  2. Verify PrivateLink cross-Region support and the provider's supported-Region configuration for the endpoint service
  3. Publish an endpoint service backed by the supported Network Load Balancer
  4. Add the relevant account principal to the endpoint service's allowed principals
  5. Add an Amazon S3 gateway endpoint to the route tables used by the workload subnets

Explanation

Correct Answer

D:

Provider-side authorization controls which principals may request PrivateLink connections before acceptance and networking permissions apply.

Incorrect Answers

A:

Acceptance settings let the service owner approve connection requests independently of the permitted principal list; that addresses provider approval gate for endpoint connections, rather than whitelisting consumers of a private endpoint service.

B:

Interface endpoint availability is governed by service type and enabled Region settings; a local endpoint service is not automatically consumable everywhere; this belongs to explicitly supported PrivateLink regional reach, while the problem is whitelisting consumers of a private endpoint service.

C:

Interface endpoint consumers connect to a provider endpoint service rather than directly referencing arbitrary cross-account NLB DNS names; this changes provider resource for service-specific PrivateLink connectivity, not the necessary whitelisting consumers of a private endpoint service.

E:

This produces S3 access through endpoint-associated subnet routes: A gateway endpoint supplies a route-table target for S3 prefix ranges; another service's endpoint cannot provide that path; the stem instead tests whitelisting consumers of a private endpoint service.

Question 162

A PrivateLink interface endpoint has been approved but clients use a hostname that resolves to the public vendor address. What feature should the consumer investigate?

  1. Enable supported private DNS for the interface endpoint and validate its service-name mapping
  2. Add the relevant account principal to the endpoint service's allowed principals
  3. Add an Amazon S3 gateway endpoint to the route tables used by the workload subnets
  4. Publish an endpoint service backed by the supported Network Load Balancer

Explanation

Correct Answer

A:

Private DNS changes name resolution inside associated VPCs so eligible service names resolve to locally addressable endpoint interfaces.

Incorrect Answers

B:

Provider-side authorization controls which principals may request PrivateLink connections before acceptance and networking permissions apply; this belongs to whitelisting consumers of a private endpoint service, while the problem is private resolution of a service consumed through PrivateLink.

C:

A gateway endpoint supplies a route-table target for S3 prefix ranges; another service's endpoint cannot provide that path; this changes S3 access through endpoint-associated subnet routes, not the necessary private resolution of a service consumed through PrivateLink.

D:

In the provider resource for service-specific PrivateLink connectivity workflow, interface endpoint consumers connect to a provider endpoint service rather than directly referencing arbitrary cross-account NLB DNS names; the current case needs private resolution of a service consumed through PrivateLink.

Question 163

An application server must call S3 without NAT, but the team created only an interface endpoint for an unrelated AWS service. What should be configured?

  1. Enable supported private DNS for the interface endpoint and validate its service-name mapping
  2. Add an Amazon S3 gateway endpoint to the route tables used by the workload subnets
  3. Provision interface endpoints in selected subnets and enable the proper endpoint security-group rules
  4. Add the relevant account principal to the endpoint service's allowed principals

Explanation

Correct Answer

B:

A gateway endpoint supplies a route-table target for S3 prefix ranges; another service's endpoint cannot provide that path.

Incorrect Answers

A:

Private DNS changes name resolution inside associated VPCs so eligible service names resolve to locally addressable endpoint interfaces; that addresses private resolution of a service consumed through PrivateLink, rather than S3 access through endpoint-associated subnet routes.

C:

Interface endpoints allocate managed ENIs in chosen subnets and accept connections according to their attached security groups; this changes zonal private ENIs used to reach an endpoint service, not the necessary S3 access through endpoint-associated subnet routes.

D:

In the whitelisting consumers of a private endpoint service workflow, provider-side authorization controls which principals may request PrivateLink connections before acceptance and networking permissions apply; the current case needs S3 access through endpoint-associated subnet routes.

Question 164

A VPC peering connection was accepted, but instances still cannot communicate. What is a required routing task?

  1. Create static destination routes in both transit gateways' appropriate route tables
  2. Use separate direct peer links or a Transit Gateway hub for the third network
  3. Verify return-path routes in both subnet and associated TGW route tables
  4. Insert reciprocal destination-CIDR routes in both VPC route tables pointing to the peering connection

Explanation

Correct Answer

D:

Creating a peer relationship does not install the application subnet routes needed for each direction of private IP transit.

Incorrect Answers

A:

TGW peering does not propagate CIDRs dynamically, and the ingress attachment's table needs a static route to the peer; that addresses explicit inter-Region TGW route creation, rather than bidirectional subnet routing for VPC peers.

B:

VPC peering is nontransitive; the intermediate peer cannot act as a managed forwarding router to another peer; this belongs to supportable three-VPC routing topology, while the problem is bidirectional subnet routing for VPC peers.

C:

AWS transit forwarding is bidirectional only when each direction has an effective path; security-group statefulness cannot fabricate missing reverse routes; this changes symmetrical forward and return connectivity through transit, not the necessary bidirectional subnet routing for VPC peers.

Question 165

A team asks why traffic from a peered VPC cannot transit a second peering connection to a third VPC. What topology change is appropriate?

  1. Install an appropriately scoped blackhole route in the associated TGW route table
  2. Insert reciprocal destination-CIDR routes in both VPC route tables pointing to the peering connection
  3. Use separate direct peer links or a Transit Gateway hub for the third network
  4. Create static destination routes in both transit gateways' appropriate route tables

Explanation

Correct Answer

C:

VPC peering is nontransitive; the intermediate peer cannot act as a managed forwarding router to another peer.

Incorrect Answers

A:

A TGW blackhole route discards packets that match its destination rather than forwarding them to any attachment; that addresses deliberate drop action within transit routing, rather than supportable three-VPC routing topology.

B:

Creating a peer relationship does not install the application subnet routes needed for each direction of private IP transit; this belongs to bidirectional subnet routing for VPC peers, while the problem is supportable three-VPC routing topology.

D:

In the explicit inter-Region TGW route creation workflow, TGW peering does not propagate CIDRs dynamically, and the ingress attachment's table needs a static route to the peer; the current case needs supportable three-VPC routing topology.

Question 166

A new member account joins an AWS Organizations organizational unit that receives an AWS RAM share of VPC subnets. The owner wants the member to receive access without a separate invitation. What is the prerequisite?

  1. Require every newly added OU member to accept a separate AWS RAM subnet invitation
  2. Create a new Transit Gateway attachment for each member account before it uses a shared subnet
  3. Enable AWS RAM sharing with AWS Organizations and grant the relevant OU access to the subnet resource share
  4. Grant only ec2:RunInstances in the member account, without any RAM resource share

Explanation

Correct Answer

C:

With AWS RAM organization sharing enabled, accounts added to a shared OU obtain the eligible resource share automatically without accepting invitations. IAM permissions within each member account still govern actual resource use.

Incorrect Answers

A:

With organization sharing enabled and the OU listed as a principal, member accounts automatically gain access to the share. Invitations are not sent for organization-scoped shares.

B:

A TGW attachment supplies routed connectivity but is not the entitlement that exposes VPC subnets to other accounts.

D:

IAM permission to launch an instance cannot make an unshared subnet available across account boundaries. The cross-account association is created by the resource-share authorization, not an EC2 launch permission.

Question 167

A consumer wants to accept an incoming PrivateLink connection only after a vendor security review. Which provider setting supports that checkpoint?

  1. Publish an endpoint service backed by the supported Network Load Balancer
  2. Require endpoint connection acceptance on the endpoint service
  3. Add the relevant account principal to the endpoint service's allowed principals
  4. Provision interface endpoints in selected subnets and enable the proper endpoint security-group rules
  5. Enable supported private DNS for the interface endpoint and validate its service-name mapping

Explanation

Correct Answer

B:

Acceptance settings let the service owner approve connection requests independently of the permitted principal list.

Incorrect Answers

A:

Interface endpoint consumers connect to a provider endpoint service rather than directly referencing arbitrary cross-account NLB DNS names; that addresses provider resource for service-specific PrivateLink connectivity, rather than provider approval gate for endpoint connections.

C:

Provider-side authorization controls which principals may request PrivateLink connections before acceptance and networking permissions apply; this changes whitelisting consumers of a private endpoint service, not the necessary provider approval gate for endpoint connections.

D:

In the zonal private ENIs used to reach an endpoint service workflow, interface endpoints allocate managed ENIs in chosen subnets and accept connections according to their attached security groups; the current case needs provider approval gate for endpoint connections.

E:

This produces private resolution of a service consumed through PrivateLink: Private DNS changes name resolution inside associated VPCs so eligible service names resolve to locally addressable endpoint interfaces; the stem instead tests provider approval gate for endpoint connections.

Question 168

A Transit Gateway owner needs separate route domains for staging and production while preserving one shared gateway. How should the attachments be grouped?

  1. Check the dev attachment's associated route table for eligible forwarding routes
  2. Verify return-path routes in both subnet and associated TGW route tables
  3. Disable automatic acceptance of shared attachments and approve requests deliberately
  4. Associate their attachments with distinct TGW route tables and control propagation separately

Explanation

Correct Answer

D:

Association selects the forwarding lookup table; controlled propagation prevents undesired destination visibility between segmentation domains.

Incorrect Answers

A:

The TGW examines only the ingress attachment's associated table when forwarding; propagation into an unrelated table changes no dev path; that addresses association-dependent TGW lookup, rather than independent forwarding domains on a common transit hub.

B:

AWS transit forwarding is bidirectional only when each direction has an effective path; security-group statefulness cannot fabricate missing reverse routes; this belongs to symmetrical forward and return connectivity through transit, while the problem is independent forwarding domains on a common transit hub.

C:

TGW attachment acceptance controls whether shared consumers become connected before the owner explicitly authorizes them; this changes manual authorization of cross-account attachments, not the necessary independent forwarding domains on a common transit hub.

Question 169

An NLB serves a private API; the organization needs a cross-account PrivateLink service that customers can subscribe to. What must first be created?

  1. Require endpoint connection acceptance on the endpoint service
  2. Add the relevant account principal to the endpoint service's allowed principals
  3. Publish an endpoint service backed by the supported Network Load Balancer
  4. Verify PrivateLink cross-Region support and the provider's supported-Region configuration for the endpoint service

Explanation

Correct Answer

C:

Interface endpoint consumers connect to a provider endpoint service rather than directly referencing arbitrary cross-account NLB DNS names.

Incorrect Answers

A:

Acceptance settings let the service owner approve connection requests independently of the permitted principal list; that addresses provider approval gate for endpoint connections, rather than PrivateLink service authorization and service DNS name.

B:

Provider-side authorization controls which principals may request PrivateLink connections before acceptance and networking permissions apply; this belongs to whitelisting consumers of a private endpoint service, while the problem is PrivateLink service authorization and service DNS name.

D:

In the explicitly supported PrivateLink regional reach workflow, interface endpoint availability is governed by service type and enabled Region settings; a local endpoint service is not automatically consumable everywhere; the current case needs PrivateLink service authorization and service DNS name.

Question 170

An inspection platform uses Gateway Load Balancer endpoints, but spoke route tables send packets straight to the TGW instead of the local endpoint. Which fix is required?

  1. Point the relevant spoke subnet routes at the Gateway Load Balancer endpoint for the inspection path
  2. Enable the destination attachment's propagation into that TGW table or define a valid static route
  3. Add an Amazon S3 gateway endpoint to the route tables used by the workload subnets
  4. Verify PrivateLink cross-Region support and the provider's supported-Region configuration for the endpoint service

Explanation

Correct Answer

A:

Route-table insertion makes the endpoint the data-path next hop before traffic continues toward its intended destination.

Incorrect Answers

B:

TGW ingress is evaluated against the associated TGW route table; a VPC route alone cannot resolve the second-hop destination; this belongs to TGW route-table entry for an attached destination, while the problem is inline inspection insertion through a GWLB endpoint.

C:

A gateway endpoint supplies a route-table target for S3 prefix ranges; another service's endpoint cannot provide that path; this changes S3 access through endpoint-associated subnet routes, not the necessary inline inspection insertion through a GWLB endpoint.

D:

In the explicitly supported PrivateLink regional reach workflow, interface endpoint availability is governed by service type and enabled Region settings; a local endpoint service is not automatically consumable everywhere; the current case needs inline inspection insertion through a GWLB endpoint.

AWS Certified Advanced Networking - Specialty ANS-C01 Practice Tests