ANS-C01 · Question #260
A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edge location in the us-west-1 Region. A shared services segment exists at both edge locations. Each shared…
The correct answer is B. Create a network policy to share the inspection service segment with the BU segment. C. Set the isolate-attachments field to True for the BU segment. To ensure Business Unit (BU) VPCs cannot communicate with each other while allowing their internet-bound traffic to be inspected by a central inspection VPC via Cloud WAN, the BU segment's attachments must be isolated, and the inspection service segment must be shared with the…
Question
A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edge location in the us-west-1 Region. A shared services segment exists at both edge locations. Each shared services segment has a VPC attachment to each inspection VPC in each Region. The inspection VPCs inspect traffic from a WAN by using AWS Network Firewall. The company creates a new segment for a new business unit (BU) in the us-east-1 edge location. The new BU has three VPCs that are attached to the new BU segment. To comply with regulations, the BU VPCs must not communicate with each other. All internet-bound traffic must be inspected in the inspection VPC. The company updates VPC route tables so any traffic that is bound for internet goes to the AWS Cloud WAN core network. The company plans to add more VPCs for the new BU in the future. All future VPCs must comply with regulations. Which solution will meet these requirements in the MOST operationally efficient way? (Choose two.)
Options
- AUpdate the network policy to share the shared services segment with the BU segment.
- BCreate a network policy to share the inspection service segment with the BU segment.
- CSet the isolate-attachments field to True for the BU segment.
- DSet the isolate-attachments field to False for the BU segment.
- EUpdate the network policy to add static routes for the BU segment. Configure the shared services
How the community answered
(25 responses)- A4% (1)
- B68% (17)
- D20% (5)
- E8% (2)
Why each option
To ensure Business Unit (BU) VPCs cannot communicate with each other while allowing their internet-bound traffic to be inspected by a central inspection VPC via Cloud WAN, the BU segment's attachments must be isolated, and the inspection service segment must be shared with the BU segment.
Sharing the `shared services segment` (which is distinct from the inspection service segment) with the BU segment does not specifically ensure that internet-bound traffic is routed to the *inspection* VPC.
Creating a network policy to share the inspection service segment with the BU segment allows the internet-bound traffic from the BU VPCs to be routed to the inspection VPC for necessary security inspection before egressing to the internet.
Setting the `isolate-attachments` field to `True` for the BU segment directly fulfills the compliance requirement that the BU VPCs attached to this segment must not communicate with each other, enforcing isolation at the segment level.
Setting the `isolate-attachments` field to `False` for the BU segment would allow BU VPCs to communicate with each other, directly violating the requirement that they must not communicate.
Adding static routes for the BU segment and configuring the shared services segment is less granular and more complex than using segment sharing for controlled communication to the inspection VPC, and does not directly address the internal isolation requirement.
Concept tested: AWS Cloud WAN Segmentation and Isolation
Source: https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-segments.html
Community Discussion
No community discussion yet for this question.