ANS-C01 Exam Dumps : Amazon AWS Certified Advanced Networking - Specialty

Understanding the Issue: The IPv6-only EC2 instance cannot communicate with IPv4-only services because IPv6 and IPv4 are not directly compatible. To bridge this gap, DNS64 and NAT64 are used together. However, AWS NAT gateways do not natively support NAT64, but you can use DNS64 to translate IPv4 DNS records (A records) into IPv6-compatible addresses (AAAA records).

DNS64 for IPv6-Only Subnets: DNS64 is a service that synthesizes AAAA records for IPv4-only services. This allows IPv6-only clients to resolve IPv4 addresses as IPv6-compatible addresses, enabling communication through the NAT gateway.

NAT Gateway with Route Table Updates: The NAT gateway enables outbound communication from private subnets to the internet. Updating the route tables for IPv6-only subnets to send traffic through the NAT gateway ensures that the IPv6 EC2 instance can reach IPv4 services.

Source IP Addresses in Dropped Traffic: When traffic is dropped by the transit gateway, the source IP addresses are the origin of the traffic causing the issue. To block this traffic from entering the VPC, an inbound rule must be added to the network ACL for the transit gateway attachment subnets.

Inbound Rule on Network ACL: Network ACLs (NACLs) are stateless and require explicit rules to allow or deny traffic. Adding aninbound ruleto deny traffic from the source IP addresses effectively prevents the unwanted traffic from entering the VPC.

Notification Details: The existing Lambda function should include the source IP addresses in the SNS notification so that the new Lambda function can use this information to automatically update the NACL.

- creating VPC peering is free of charge - traffic costs ~0.01€/GB for VPC peering (IN + OUT) and ~0.02€/GB for direct connect (OUT only). As the communication involved in monitoring will never have IN == OUT, then 0.01 * (IN + OUT) will always be lower the 0.02 * OUT, ergo VPC peering will be cheaper