ANS-C01 Exam Dumps : Amazon AWS Certified Advanced Networking - Specialty

Source IP Addresses in Dropped Traffic: When traffic is dropped by the transit gateway, the source IP addresses are the origin of the traffic causing the issue. To block this traffic from entering the VPC, an inbound rule must be added to the network ACL for the transit gateway attachment subnets.

Inbound Rule on Network ACL: Network ACLs (NACLs) are stateless and require explicit rules to allow or deny traffic. Adding aninbound ruleto deny traffic from the source IP addresses effectively prevents the unwanted traffic from entering the VPC.

Notification Details: The existing Lambda function should include the source IP addresses in the SNS notification so that the new Lambda function can use this information to automatically update the NACL.

The most operationally efficient way to restrict inbound traffic to the ALB to come from CloudFront is to use the AWS managed prefix list for CloudFront. A prefix list is a collection of CIDR blocks that can be used to configure security groups and network ACLs. AWS provides a managed prefix list for CloudFront that is automatically updated when CloudFront IP ranges change. By adding an inbound rule to the ALB’s security group to allow the AWS managed prefix list for CloudFront, the network engineer can ensure that only CloudFront can access the ALB at the network layer. This solution does not require any additional configuration or maintenance. Option B is less efficient because network ACLs are stateless and require rules for both inbound and outbound traffic. Option C is not a network layer solution, but an application layer solution that requires the ALB to inspect the HTTP headers and reject requests that do not have the custom header. Option D is also not a network layer solution, but a web layer solution that requires AWS WAF to filter the traffic based on the CloudFront IP set. This solution also requires an AWS Lambda function to update the CloudFront IP set, which adds complexity and cost

- creating VPC peering is free of charge - traffic costs ~0.01€/GB for VPC peering (IN + OUT) and ~0.02€/GB for direct connect (OUT only). As the communication involved in monitoring will never have IN == OUT, then 0.01 * (IN + OUT) will always be lower the 0.02 * OUT, ergo VPC peering will be cheaper