AWS Certified Advanced Networking – Specialty (ANS-C01) — Question 214
A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edge location in the us-west-1 Region. A shared services segment exists at both edge locations. Each shared services segment has a VPC attachment to each inspection VPC in each Region. The inspection VPCs inspect traffic from a WAN by using AWS Network Firewall.
The company creates a new segment for a new business unit (BU) in the us-east-1 edge location. The new BU has three VPCs that are attached to the new BU segment. To comply with regulations, the BU VPCs must not communicate with each other. All internet-bound traffic must be inspected in the inspection VPC.
The company updates VPC route tables so any traffic that is bound for internet goes to the AWS Cloud WAN core network.
The company plans to add more VPCs for the new BU in the future. All future VPCs must comply with regulations.
Which solution will meet these requirements in the MOST operationally efficient way? (Choose two.)
Answer options
- A. Update the network policy to share the shared services segment with the BU segment.
- B. Create a network policy to share the inspection service segment with the BU segment.
- C. Set the isolate-attachments field to True for the BU segment.
- D. Set the isolate-attachments field to False for the BU segment.
- E. Update the network policy to add static routes for the BU segment. Configure the shared services segment to route traffic related to VPC CIDR blocks to each respective VPC attachment.
Correct answer: B, C
Explanation
Option B is correct because allowing the BU segment to access the inspection service segment ensures that all internet-bound traffic is inspected, which is a regulatory requirement. Option C is also correct because setting the isolate-attachments field to True prevents communication between the BU's VPCs, fulfilling the compliance requirement. The other options do not adequately meet both the inspection and isolation requirements.