nerdexam
Amazon

ANS-C01 · Question #215

A company securely connects resources that are in its VPC to a software as a service (SaaS) solution from a SaaS provider. The SaaS solution is hosted in the AWS Cloud and is powered by AWS…

The correct answer is C. The SaaS provider does not offer the solution in the new Availability Zone and has not configured. A network engineer cannot deploy a new interface VPC endpoint for a SaaS solution in a newly added Availability Zone.

Submitted by minji_kr· Mar 6, 2026VPC Connectivity

Question

A company securely connects resources that are in its VPC to a software as a service (SaaS) solution from a SaaS provider. The SaaS solution is hosted in the AWS Cloud and is powered by AWS PrivateLink. The company uses a PrivateLink endpoint to access the SaaS solution behind the SaaS provider's Network Load Balancer (NLB). The company recently added a new Availability Zone and new subnets to its VPC. A network engineer is unable to deploy a new interface VPC endpoint for the SaaS solution in the new Availability Zone. What is the cause of this problem?

Options

  • AThe CIDR block of the new subnets conflicts with the SaaS provider's CIDR block.
  • BThe enableDnsHostnames attribute and enableDnsSupport attribute were not configured on the
  • CThe SaaS provider does not offer the solution in the new Availability Zone and has not configured
  • DThe new subnets are missing a route to the VPC internet gateway.

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    19% (5)
  • C
    69% (18)
  • D
    8% (2)

Why each option

A network engineer cannot deploy a new interface VPC endpoint for a SaaS solution in a newly added Availability Zone.

AThe CIDR block of the new subnets conflicts with the SaaS provider's CIDR block.

CIDR block conflicts usually prevent VPC peering or direct routing, but not the creation of an *interface* VPC endpoint, which uses an ENI with an private IP from the consumer's VPC subnet.

BThe enableDnsHostnames attribute and enableDnsSupport attribute were not configured on the

`enableDnsHostnames` and `enableDnsSupport` attributes on the VPC are important for DNS resolution of VPC endpoints, but their misconfiguration would not *prevent* the deployment of the endpoint itself in an AZ; rather, it would affect its functionality after deployment.

CThe SaaS provider does not offer the solution in the new Availability Zone and has not configuredCorrect

For AWS PrivateLink, the service provider (SaaS provider in this case) must explicitly configure their Network Load Balancer (NLB) service to be available in specific Availability Zones. If the SaaS provider has not enabled their service endpoint (via their endpoint service configuration) in the new Availability Zone, consumers cannot create an interface VPC endpoint there.

DThe new subnets are missing a route to the VPC internet gateway.

Interface VPC endpoints operate within the VPC and do not require a route to an internet gateway for communication within the VPC or to the PrivateLink service.

Concept tested: PrivateLink endpoint service availability

Source: https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full ANS-C01 Practice