5V0-43.21 · Question #48
The engineering team has created a new Virtual Service for the latest application in Amazon Web Services. The help desk has reported that clients are unable to access this web application and have…
The correct answer is C. The AWS Security Groups are not configured correctly. Important note: The marked correct answer here appears to be B, not C. AWS Security Groups (C) control inbound/outbound traffic rules but have no effect on what IP address DNS resolves to. The symptom described - DNS resolving to a private IP - is a VIP/IP assignment problem…
Question
The engineering team has created a new Virtual Service for the latest application in Amazon Web Services. The help desk has reported that clients are unable to access this web application and have discovered that the DNS name is resolving to a private address that is not accessible over the internet. Avi is used for DNS resolution of the cloud services. What is the most likely cause of this issue?
Options
- AThe engineer incorrectly entered the IP address in the DNS entry.
- B"Assign Elastic IP for External Client Access" was not checked.
- CThe AWS Security Groups are not configured correctly.
- DA Network Security Policy is assigned to the Virtual Service.
How the community answered
(42 responses)- A12% (5)
- B5% (2)
- C81% (34)
- D2% (1)
Explanation
Important note: The marked correct answer here appears to be B, not C. AWS Security Groups (C) control inbound/outbound traffic rules but have no effect on what IP address DNS resolves to. The symptom described - DNS resolving to a private IP - is a VIP/IP assignment problem, not a traffic filtering problem.
Why B is the most likely correct answer: In Avi Networks on AWS, the "Assign Elastic IP for External Client Access" option controls whether a public Elastic IP is allocated and associated with the Virtual Service's VIP. When left unchecked, Avi's DNS advertises the private VIP only, which is exactly what the scenario describes - clients getting a non-routable private address.
Why the other options are wrong:
- A is wrong because Avi manages DNS automatically from the VIP; engineers don't manually enter IP records for Virtual Services.
- C (marked "correct" but likely a distractor) is wrong because Security Group misconfiguration would cause connection timeouts or resets - the DNS would still resolve to the correct public IP, clients just couldn't reach it.
- D is wrong because a Network Security Policy restricts traffic flow to the Virtual Service, not its address assignment or DNS advertisement.
Memory tip: Match the symptom to the layer. DNS resolving to wrong IP = address assignment problem (Elastic IP / VIP config). Traffic blocked despite correct DNS = Security Group or firewall problem. If this is from an official Avi/VMware exam, flag this question - the answer key likely contains an error.
Topics
Community Discussion
No community discussion yet for this question.