ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 305 - ANS-C00 discussion

Report
Export

Your company has installed an AWS Direct Connect connection in an ap-southeast-1 Direct Connect location. A public virtual interface is configured through a router to a dedicated firewall. You advertise your company's public /24 CIDR block to AWS with AS 65500. The company maintains a separate, corporate Internet firewall to map all outbound traffic to a single IP.

This firewall maintains a BGP relationship with an upstream Internet provider that has delegated the public IP block your company uses. When the BGP session for the public virtual interface is up, corporate network users cannot access Amazon S3 resources in the ap-southeast-1 region.

Which step should you take to provide concurrent AWS and Internet access?

A.
Configure AS-PATH prepending for the public virtual interface.
Answers
A.
Configure AS-PATH prepending for the public virtual interface.
B.
Advertise a host route for the corporate firewall on the public virtual interface.
Answers
B.
Advertise a host route for the corporate firewall on the public virtual interface.
C.
Advertise a host route for the corporate firewall to the upstream Internet provider.
Answers
C.
Advertise a host route for the corporate firewall to the upstream Internet provider.
D.
NAT the traffic destined for AWS from the dedicated firewall using the public virtual interface.
Answers
D.
NAT the traffic destined for AWS from the dedicated firewall using the public virtual interface.
Suggested answer: D

Explanation:

Explanation:

When outgoing traffic is routed via the corporate firewall, its return path is via the Direct Connect public virtual interface and therefore through the dedicated firewall. This dedicated firewall does not track the original NAT session and subsequently drops the traffic. Answer A is incorrect because AWS will always prefer Direct Connect over Internet routing. Answer B is incorrect because return traffic is still processed by the dedicated firewall. Answer C is incorrect because it does not change the traffic flow.

asked 16/09/2024
Joshua Paffen
32 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first