ANS-C01 practice question 35 of 35

A company has multiple AWS accounts. Each account contains one or more VPCs. A new security guideline requires the inspection of all traffic between…

A company has multiple AWS accounts. Each account contains one or more VPCs. A new security guideline requires the inspection of all traffic between VPCs. The company has deployed a transit gateway that provides connectivity between all VPCs. The company also has deployed a shared services VPC with Amazon EC2 instances that include IDS services for stateful inspection. The EC2 instances are deployed across three Availability Zones. The company has set up VPC associations and routing on the transit gateway. The company has migrated a few test VPCs to the new solution for traffic inspection. Soon after the configuration of routing, the company receives reports of intermittent connections for traffic that crosses Availability Zones. What should a network engineer do to resolve this issue?

Answer options

A: Modify the transit gateway VPC attachment on the shared services VPC by enabling cross- Availability Zone load balancing.

B: Modify the transit gateway VPC attachment on the shared services VPC by enabling appliance mode support. Correct answer

C: Modify the transit gateway by selecting VPN equal-cost multi-path (ECMP) routing support.

D: Modify the transit gateway by selecting multicast support.

Correct Answer:

B. Modify the transit gateway VPC attachment on the shared services VPC by enabling appliance mode support.

Explanation

With stateful inspection appliances in a VPC, traffic must remain symmetrical. Enabling appliance mode support on the transit-gateway attachment keeps both forward and return flows in the same Availability Zone attachment, eliminating the cross-AZ asymmetry that causes intermittent drops.

Why Incorrect

A – Cross-AZ load balancing applies to VPC attachments but does not guarantee symmetry for appliance flows. C – ECMP affects VPN attachments, not VPC traffic through appliances. D – Multicast support is unrelated to unicast inspection traffic.

References

1. AWS Transit Gateway Guide – “Connect third-party appliances” → “Enable appliance mode support” (rev. 2024-02-20).

2. re:Invent 2020 NET403, slide 29 “Appliance mode keeps flows symmetrical”.

3. AWS Transit Gateway FAQ – “What problems does appliance mode solve?”

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test