AWS Certified Advanced Networking - Specialty (ANS-C01)

Incorrect. Security groups on the production account that hosts the source services do not explain random loss of mirrored packets in this scenario. A security group problem would usually cause deterministic blocking of specific traffic patterns, ports, or protocols rather than intermittent packet omissions. Also, Traffic Mirroring occurs from the source ENI in the VPC data plane, so the symptom described does not match a typical source-side security group issue. If security controls on the target path were wrong, the failure would more likely be consistent than random.

Incorrect. IAM policies govern who can create, modify, or delete traffic mirror sessions, targets, and filters through the control plane. Once mirroring is already enabled and operating, IAM is not involved in the runtime forwarding of mirrored packets. Therefore, a misconfigured IAM policy would typically prevent setup or changes, not cause sporadic packet loss in an active session. This option confuses provisioning permissions with data-plane behavior.

Incorrect. Network Load Balancers do not have a documented 'warm-up delay' characteristic that would explain random packet loss in a Traffic Mirroring design. NLBs are designed to scale automatically and are not associated with the classic pre-warming concern seen in some older AWS load balancing contexts. While any downstream target capacity issue could affect analysis systems, the specific statement about NLB warm-up delays is technically misleading. For this question, AWS-documented mirroring best-effort behavior and source/ENI capacity limits are the plausible explanations.

Not the most operationally efficient. A DynamoDB-driven Lambda updater requires building and maintaining custom automation, IAM roles, error handling, and deployment in every account. It introduces operational overhead and potential drift if the function fails or is misconfigured. While it can work, it is less scalable and less elegant than using a native VPC construct designed for centrally managed CIDR allow lists.

This option is less efficient because it adds EventBridge and Lambda to update security groups whenever the prefix list changes, which reintroduces custom orchestration and operational overhead. If a prefix list is the chosen abstraction, the goal should be to consume it directly where supported rather than trigger code to rewrite security group rules. It also omits the necessary cross-account sharing mechanism, so it does not fully solve the multi-account central-management requirement.

Similar to option A, this is a custom automation approach with higher operational burden. Storing CIDRs in S3 and running Lambda to update security groups across accounts requires per-account deployment, cross-account permissions, and robust handling for failures and concurrency. It is not as efficient or scalable as using a managed prefix list shared via AWS RAM, which is purpose-built for this use case.

Incorrect. Static-routing VPNs to Transit Gateway generally do not provide the same ECMP load-sharing capability as dynamic (BGP) VPNs and are operationally brittle (manual route management and less graceful failover). Even if multiple tunnels exist, without BGP-driven ECMP you typically won’t achieve reliable active/active distribution of traffic to increase aggregate bandwidth.

Incorrect. VPN acceleration (where available) can improve performance characteristics (e.g., latency/jitter) by leveraging AWS global networking, but it does not fundamentally scale aggregate throughput the way multiple parallel VPN connections with ECMP do. The requirement is explicitly to increase aggregate VPN bandwidth without sacrificing availability; acceleration alone doesn’t add parallel paths for load sharing.

Incorrect. A self-managed software VPN appliance on EC2 increases operational overhead and can introduce new bottlenecks and availability concerns (instance sizing, scaling, patching, failover design). It also deviates from the managed TGW VPN approach and may not meet the “highly available” requirement unless you build a complex HA pair and routing design. The question asks for scaling VPN throughput to multiple VPCs via TGW, which is best met with managed VPN + ECMP.

Incorrect. AWS Site-to-Site VPN is for connecting networks (e.g., on-premises to VPC), not for individual remote users like Client VPN. Migrating users to Site-to-Site VPN would require new customer gateway devices/configuration and does not directly address geolocation; it also causes significant service interruption and operational change compared to adjusting Client VPN routing.

Incorrect. Removing the 0.0.0.0/0 outbound rule from the Client VPN endpoint security group does not solve the routing problem that causes geolocation issues. It would likely break legitimate outbound connectivity from VPN clients to internal resources (and possibly required AWS services) and introduces avoidable disruption. Geolocation is driven by egress path/IP, not SG rules.

Incorrect. Deleting and recreating the Client VPN endpoint in a different VPC is highly disruptive (new endpoint, associations, authorization rules, client configuration updates). It may change the egress IP range and thus geolocation, but it does not address the root cause (full-tunnel routing of internet traffic through AWS). Split-tunnel and route changes are the minimal-interruption fix.

Incorrect. Route 53 Resolver does not use "*" as a catch-all forwarding domain; the correct catch-all is ".". In addition, a user-defined system rule that targets Route 53 Resolver for corp.global.internal is not how private hosted zone resolution is configured. Private hosted zones are resolved automatically for associated VPCs, and forwarding rules target external DNS servers through outbound endpoints, not Route 53 Resolver itself.

Incorrect. A forwarding rule cannot target "Route 53 Resolver" as if it were an external DNS destination; forwarding rules must specify target IP addresses reachable through an outbound endpoint. Also, a system rule for "." that targets an outbound endpoint is not a valid Route 53 Resolver construct. This option misunderstands both how private hosted zones are resolved and how outbound forwarding rules are defined.

Incorrect. A forwarding rule for "." alone would send all unmatched queries to the on-premises DNS resolver, but this option does not provide the required specific handling for corp.global.internal. It also incorrectly states that Resolver rules are associated with a transit gateway attachment, when in reality Resolver rules are associated with VPCs. Without the more specific corp.global.internal rule, the design does not explicitly satisfy the split-resolution requirement across all VPCs.

DXGW with private VIFs to each VPC’s VGW can provide on-premises-to-VPC connectivity, but it does not provide an efficient way to interconnect all VPCs with each other across accounts/Regions. You would need additional constructs (VPC peering, VPN, or TGW) for VPC-to-VPC reachability. Also, ECMP across four links is not the core issue; the architecture doesn’t meet the “all VPCs interconnected” requirement cleanly.

This option is incorrect because a Transit Gateway is a Regional service; you cannot have a “single TGW” spanning eu-west-3 and eu-central-1. Also, “inter-Region LAG” is not a supported Direct Connect concept (LAG is within a single DX location). While DXGW + transit VIF to TGW is correct in principle, the single-TGW multi-Region premise makes the design invalid.

This option is incorrect because it mixes private VIF-based DXGW connectivity (used for VGW) with TGW connectivity, which requires transit VIFs. Additionally, “inter-Region LAG” is not a valid AWS DX feature. Even if you added TGW, the described attachment model is wrong/incomplete and does not clearly achieve full VPC reachability with proper multi-Region resiliency and separation.

CloudFront distributions with NLB origins plus Route 53 weighted routing can provide some traffic shifting, but CloudFront is not intended as a general TCP/UDP front door for arbitrary application protocols behind NLB. Also, weighted DNS does not inherently minimize jitter/first-byte latency because traffic still traverses the public internet after DNS resolution. This option mixes services in a way that doesn’t best meet the TCP/UDP and jitter requirements.

S3 Transfer Acceleration only accelerates transfers to and from Amazon S3 using edge locations; it does not front an EC2/NLB-based multi-tier application and does not provide TCP/UDP listener routing to NLB endpoints. It also does not offer the required multi-Region traffic dials for phased rollouts of an application stack. This is a service mismatch.

CloudFront origin groups are mainly for origin failover (primary/secondary) and are oriented around HTTP/HTTPS content delivery rather than generic TCP/UDP application traffic. Route 53 latency routing can steer users to lower-latency Regions, but it cannot precisely control rollout percentages like Global Accelerator traffic dials, and it won’t reduce jitter/first-byte latency as effectively as routing over the AWS backbone.

Incorrect. AWS managed prefix lists are not the feature used to permit AWS-to-on-premises route advertisement over Direct Connect. In addition, this option still uses two separate CIDR entries rather than a single aggregate, so it does not address the one-entry limit even conceptually. The engineer must modify the DXGW allowed prefix list, not a managed prefix list, to affect advertised routes.

Incorrect. Adding 10.0.32.0/21 and 10.0.40.0/21 directly to the Direct Connect gateway allowed prefix list would require two separate entries. The question explicitly states that the allowed prefix list has room for only one more entry, so this option cannot meet the stated constraint. While the prefixes themselves are valid AWS routes, this approach fails the scale-limit requirement.

Incorrect. The CIDR 10.0.32.0/20 is the right aggregate, but AWS managed prefix lists do not control route advertisement from a Direct Connect gateway to on-premises. Managed prefix lists are reusable CIDR sets for VPC resources such as route tables and security groups, not for DXGW BGP filtering. Therefore, placing the summary there would not solve the actual problem being asked.

Incorrect. Amazon CloudFront is primarily a CDN for HTTP/HTTPS and does not provide a general-purpose UDP acceleration path to an NLB origin. While CloudFront can front certain TCP-based origins for web delivery, it is not designed to proxy proprietary UDP sensor protocols. For UDP acceleration and static anycast ingress, Global Accelerator is the appropriate AWS service.

Incorrect. Route 53 failover routing is active-passive and is intended for availability when the primary endpoint becomes unhealthy. It does not optimize for latency and will not address intermittent packet loss when the primary endpoint remains healthy. Also, “packets are dropped” is not something Route 53 can detect per-flow; DNS failover is coarse-grained and slow relative to UDP telemetry streams.

Incorrect. Enhanced networking with ENA improves EC2 network performance (higher bandwidth, lower latency, higher PPS) once packets reach the instance. The problem described is packet loss in transit over the public internet from South Asia to us-west-2, before traffic arrives at AWS. ENA will not materially improve reliability of the long-distance path or reduce internet routing-related loss.

This option is incorrect because the default ALB listener rule cannot be modified to include conditions such as path-pattern or source-ip. The default rule is always unconditional and is evaluated only after all higher-priority rules have been checked. It also describes forwarding to the management target group when the conditions are not matched, which is the opposite of the desired behavior. Group-level stickiness does not fix the invalid listener-rule design.

This option is wrong because ALB listener rules should use the native source-ip condition rather than inspecting the X-Forwarded-For header. X-Forwarded-For can contain multiple addresses and is not the intended access-control primitive for ALB listener rule matching. The requirement is specifically to restrict access by on-premises source CIDR ranges, which ALB supports directly. While group-level stickiness may be useful, the traffic-matching method here is technically inappropriate.

This option is incorrect because forwarding all requests to the web app target group would prevent the /management path from being routed to the management target group. It also says to disable stickiness, which conflicts with the stateful nature of the management application. A proper ALB configuration needs a specific higher-priority rule for /management and a separate default action for everything else. This option does not implement the required listener-rule combination.

Incorrect. VPC Flow Logs provide network flow metadata (source/destination IP, ports, protocol, bytes, action) but do not include packet payloads. Content inspection requires packet copies (L2/L3/L4 and payload visibility), which flow logs cannot provide. Additionally, flow logs are delivered asynchronously to S3/CloudWatch, not suitable for real-time inspection or validating that the inspection layer is receiving full traffic.

Incorrect. Amazon Kinesis Data Firehose is not a supported VPC Traffic Mirroring target and is designed for delivering streaming records to destinations like S3, Redshift, or OpenSearch—not raw packet mirroring for real-time inspection. Even conceptually, converting packets into Firehose records would not preserve full fidelity of network traffic required for content inspection.

Incorrect for the stated requirement. Gateway Load Balancer (GWLB) is used for inline traffic steering through security appliances using GENEVE encapsulation, meaning the original traffic is routed through the appliance before reaching its destination. The question requires a transparent solution that sends a copy of traffic to a single-node appliance without disrupting the original flow, which aligns with Traffic Mirroring, not GWLB.

TGW improves VPC-to-VPC scalability, but using a Site-to-Site VPN between TGW and the SD-WAN transit VPC still relies on VPN tunnel constructs and often more manual routing (static routes or limited dynamic behavior depending on design). It can work, but it is not the lowest operational overhead compared to TGW Connect’s purpose-built SD-WAN integration and BGP-based dynamic route exchange.

VPC peering does not scale well for this use case: it is non-transitive (a key limitation when trying to build a hub), requires managing many peering connections as VPC count grows, and increases route table entries per peer. It also doesn’t inherently reduce operational overhead versus the current model and can reintroduce route table scaling challenges.

This mixes two incompatible scaling approaches: VPC peering for VPC connectivity (which is non-transitive and operationally heavy at scale) and TGW Connect for SD-WAN integration. Even if SD-WAN integration is improved, the VPC-to-VPC and VPC-to-hub connectivity would still suffer from peering’s scaling/management limitations, so it does not meet the overall requirement with the least operational overhead.

Incorrect. Advertising a longer prefix (more specific route) from the 2 Gbps router would make the 2 Gbps path MORE preferred, not less, because longest-prefix match occurs before BGP attribute comparison. That would steer traffic to the 2 Gbps connection, the opposite of the requirement. More-specific routes are typically used to attract traffic, not to de-prefer a link.

Incorrect. Advertising a less specific route from the 5 Gbps router would generally make the 5 Gbps path LESS preferred if the 2 Gbps router continues to advertise a more specific route for the same destination. AWS would match the more specific prefix (likely from the 2 Gbps link) and send traffic there. This undermines the goal of preferring the 5 Gbps connection.

Incorrect. Prepending AS_PATH on the 5 Gbps router would make the 5 Gbps path less attractive to AWS, causing AWS to prefer the 2 Gbps connection. That is the reverse of the desired behavior. AS_PATH prepending should be applied to the backup/secondary path (2 Gbps) so the primary (5 Gbps) remains the most preferred route.

Incorrect. A CNAME to the ALB’s internal DNS name can work only for non-apex names (e.g., app.example.com). The requirement is https://example.com (apex). DNS does not allow a CNAME at the zone apex because it would conflict with SOA/NS records. Route 53 Alias exists specifically to enable apex mapping to AWS resources like ALBs.

Incorrect. A Resolver outbound endpoint is used when resources in the VPC need to resolve DNS names hosted on-premises (VPC-to-on-prem). The question requires the reverse: on-prem clients must resolve a private hosted zone in Route 53. Therefore, an inbound endpoint (not outbound) is required for on-prem forwarding into AWS.

Incorrect. 172.31.0.2 (AmazonProvidedDNS) is the VPC resolver address intended for use by instances inside the VPC. It is not designed to be a general-purpose DNS server for on-premises networks across VPN/Direct Connect, and forwarding to it from on-prem is not the supported approach. Route 53 Resolver endpoints are the supported mechanism for hybrid DNS.

Incorrect. Direct Connect virtual interfaces require VLAN tagging, so disabling VLAN trunking is not the goal. The important requirement is that the router subinterface carries the correct 802.1Q VLAN tag that matches the VIF configuration. Turning off trunking or VLAN tagging would typically break the VIF rather than fix it.

Incorrect. Checking for a MAC address entry from the AWS endpoint in the ARP table is not one of the primary or most reliable troubleshooting steps for a DOWN transit VIF. The more appropriate checks are the physical optical signal, the VLAN tag, and the point-to-point IP/subnet configuration on the subinterface. ARP observations can be incidental, but they are not the best answer choice compared with the documented foundational checks.

Incorrect. TCP port 179 is used by BGP, but the engineer cannot even ping the Amazon peer IP, which means the issue is likely below the BGP session layer. A blocked TCP 179 port would prevent BGP establishment, but it would not usually explain failure to reach the peer IP itself if VLAN and IP connectivity were otherwise correct. Therefore, this is not one of the first three troubleshooting steps for this scenario.