ANS-C01 · Question #279
A US-based company is expanding its business to Europe. A network engineer needs to extend the company's network infrastructure by setting up a new hub and spoke architecture in the eu- west-1…
The correct answer is D. Enable Appliance mode on both the transit gateway attachments for the inspection VPC. Inspection VPC with Network Firewall: When using a central inspection VPC with AWS Network Firewall, traffic must be routed through the inspection VPC for inspection. This requires the traffic to pass through transit gateway attachments that are configured to handle such…
Question
A US-based company is expanding its business to Europe. A network engineer needs to extend the company's network infrastructure by setting up a new hub and spoke architecture in the eu- west-1 Region. The network engineer uses a transit gateway peering connection to connect the new resources in eu-west-1 to an existing environment in the us-east-1 Region. The hub and spoke architecture in each AWS Region includes an inspection VPC that uses AWS Network Firewall to centralize traffic inspection for each Region. To reduce costs, the network engineer decides to inspect inter-Region traffic by using the inspection VPC in the Region that originates the traffic. The network engineer configures the transit gateway route tables accordingly for each Region. When the network engineer tests the new architecture, communication within each Region works as expected. However, the network engineer finds that inter-Region communication is not working. The network engineer must resolve the inter-Region communication issue. Which solution will meet this requirement?
Options
- AConfigure Open Shortest Path First (OSPF) routing on the transit gateway peering connection to
- BUse AWS Resource Access Manager (AWS RAM) to share access between the transit gateways.
- CPrevent asymmetric routing in the inspection VPCs by ensuring that both requests and responses
- DEnable Appliance mode on both the transit gateway attachments for the inspection VPC.
How the community answered
(20 responses)- A15% (3)
- B5% (1)
- C25% (5)
- D55% (11)
Explanation
Inspection VPC with Network Firewall: When using a central inspection VPC with AWS Network Firewall, traffic must be routed through the inspection VPC for inspection. This requires the traffic to pass through transit gateway attachments that are configured to handle such scenarios. Appliance Mode: Enabling Appliance mode on the transit gateway attachments for the inspection VPC allows asymmetric traffic flows, where packets in one direction and their corresponding return packets can take different paths. This is crucial for inspection because traffic may be routed back differently after being inspected. Inter-Region Communication: Without Appliance mode, transit gateways drop traffic if the return path is not symmetric. Enabling Appliance mode ensures that the inspection VPC can handle inter-Region traffic flows without breaking communication.
Community Discussion
No community discussion yet for this question.