Exam ANS-C00 topic 1 question 355 discussion

Exam question from Amazon's ANS-C00

Question #: 355
Topic #: 1

A company installed an AWS Site-to-Site VPN and configured it to use two tunnels. The company has learned that the VPN connectivity is unstable. During a ping test from the on-premises data center to AWS, a network engineer notices that the first few ICMP replies time out but that subsequent requests are successful.
The AWS Management Console shows that the status for both tunnels last changed at the same time the ping responses were successfully received.
Which steps should the network engineer take to resolve the instability? (Choose two.)

A. Enable dead peer detection (DPD) on the customer gateway device.
B. Change the tunnel configuration to active/standby on the virtual private gateway.
C. Use AS PATH prepending on one path to cause all traffic to prefer that tunnel.
D. Send ICMP requests to an instance in the VPC every 5 seconds from the on-premises network.
E. Use a higher multi-exit discriminator (MED) value on the preferred path to prefer that tunnel.

Show Suggested Answer

Suggested Answer: AD 🗳️

by walkwolf3 at Sept. 1, 2021, 7:49 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

walkwolf3

Highly Voted 3 years, 8 months ago

AD A. Dead Peer Detection (DPD) is a method of detecting a dead Internet Key Exchange (IKE) peer. The method uses IPsec traffic patterns to minimize the number of messages required to confirm the availability of a peer. But keep in mind, you need to ensure both ends agree the parameters of BPD, otherwise, BPD could cause issue. https://en.wikipedia.org/wiki/Dead_Peer_Detection B. Wrong. AWS suggests to keep both tunnels' up as active/active, active/standby won't help. C. Wrong. AS Path prepending will make that path to be less preferrable. D. If you're experiencing idle timeouts due to low traffic on a VPN tunnel: Be sure that there's constant bidirectional traffic between your local network and your VPC. If necessary, create a host that sends ICMP requests to an instance in your VPC every 5 seconds. https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-instability-inactivity/ E. Wrong. The path with the lowest MED value is preferred. https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNRoutingTypes.html

upvoted 16 times