nerdexam
Amazon

ANS-C01 · Question #254

A banking company has an application that must connect to specific public IP addresses from a VPC. A network engineer has configured routes in the route table that is associated with the…

The correct answer is D. Create an AWS Config rule for the route table by using the no-unrestricted-route-to-igw managed. To detect and alert when a default route to an Internet Gateway is added to an application subnet's route table with the least effort, an AWS Config managed rule should be used.

Submitted by takeshi77· Mar 6, 2026Network Security, Compliance, and Governance

Question

A banking company has an application that must connect to specific public IP addresses from a VPC. A network engineer has configured routes in the route table that is associated with the application's subnet to the required public IP addresses through an internet gateway. The network engineer needs to set up email notifications that will alert the network engineer when a user adds a default route to the application subnet's route table with the internet gateway as a target. Which solution will meet these requirements with the LEAST implementation effort?

Options

  • ACreate an AWS Lambda function that reads the routes in the route table and sends an email
  • BCreate an AWS Lambda function that will be invoked by an Amazon EC2 CreateRoute API call.
  • CCreate AWS Config rules for the route table by using the internet-gateway-authorized-vpc-only
  • DCreate an AWS Config rule for the route table by using the no-unrestricted-route-to-igw managed

How the community answered

(46 responses)
  • A
    2% (1)
  • B
    7% (3)
  • C
    4% (2)
  • D
    87% (40)

Why each option

To detect and alert when a default route to an Internet Gateway is added to an application subnet's route table with the least effort, an AWS Config managed rule should be used.

ACreate an AWS Lambda function that reads the routes in the route table and sends an email

Creating a custom AWS Lambda function to periodically read route tables requires significant development and maintenance effort compared to a managed AWS Config rule.

BCreate an AWS Lambda function that will be invoked by an Amazon EC2 CreateRoute API call.

An AWS Lambda function invoked by an `EC2 CreateRoute` API call would only detect new route creation, but configuring it to specifically filter for default routes to an IGW and manage alerts requires custom logic and more effort than a managed rule.

CCreate AWS Config rules for the route table by using the internet-gateway-authorized-vpc-only

The `internet-gateway-authorized-vpc-only` AWS Config managed rule checks if internet gateways are only attached to authorized VPCs, which is not the specific requirement of monitoring for default routes to an IGW in a route table.

DCreate an AWS Config rule for the route table by using the no-unrestricted-route-to-igw managedCorrect

The AWS Config managed rule `no-unrestricted-route-to-igw` specifically monitors route tables for routes to an Internet Gateway with a destination of 0.0.0.0/0, making it the perfect and least-effort solution to detect this specific configuration change and trigger notifications.

Concept tested: AWS Config Managed Rules for Network Monitoring

Source: https://docs.aws.amazon.com/config/latest/developerguide/no-unrestricted-route-to-igw.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full ANS-C01 Practice