A company has stateful security appliances that are deployed to multiple Availability Zones in a centralized shared services VPC. The AWS environment includes a transit gateway that is attached to application VPCs and the shared services VPC. The application VPCs have workloads that are deployed in private subnets across multiple Availability Zones. The stateful appliances in the shared services VPC inspect all east west (VPC-to-VPC) traffic. Users report that inter-VPC traffic to different Availability Zones is dropping. A network engineer verified this claim by issuing Internet Control Message Protocol (ICMP) pings between workloads in different Availability Zones across the application VPCs. The network engineer has ruled out security groups, stateful device configurations and network ACLs as the cause of the dropped traffic. What is causing the traffic to drop?
Select one answer.
Marked answer: B
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose B3
B - Should be enabled under VPC which the appliance is located.
Chose B2
B is the correct answer. Appliance mode needs to be enabled on the shared VPC where the stateful inspection appliance resides.
