How Can You Alert on a Default Route to an Internet Gateway?

A banking company has an application that must connect to specific public IP addresses from a VPC. A network engineer has configured routes in the route table that is associated with the application’s subnet to the required public IP addresses through an internet gateway. The network engineer needs to set up email notifications that will alert the network engineer when a user adds a default route to the application subnet's route table with the internet gateway as a target. Which solution will meet these requirements with the LEAST implementation effort?

Create an AWS Lambda function that reads the routes in the route table and sends an email notification. Configure the Lambda function to send an email notification if any route is configured with 0.0.0.0/0 or ::/0 CIDRs to the internet gateway. Configure the Lambda function to run every minute.
Create an AWS Lambda function that will be invoked by an Amazon EC2 CreateRoute API call. Configure the Lambda function to send an email notification. Configure the Lambda function to send an email notification if any route is configured with 0.0.0.0/0 or ::/0 CIDRs to the internet gateway.
Create AWS Config rules for the route table by using the internet-gateway-authorized-vpc-only managed rule. Create an Amazon EventBridge rule to match the AWS Config rule and to route to an Amazon Simple Notification Service (Amazon SNS) topic to send an email notification.
Create an AWS Config rule for the route table by using the no-unrestricted-route-to-igw managed rule. Create an Amazon EventBridge rule to match the AWS Config rule and to route to an Amazon Simple Notification Service (Amazon SNS) topic to send an email notification. Source Reference Answer

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your ability to match an AWS managed Config rule to a specific route-table condition, and the common trap is confusing internet-gateway-authorized-vpc-only (which checks IGW VPC attachment) with no-unrestricted-route-to-igw (which detects unrestricted public routes).

Learn the least-effort way to send email alerts when a user adds a default route (0.0.0.0/0 or ::/0) to a VPC route table with an internet gateway target. Community consensus favors the AWS Config managed rule no-unrestricted-route-to-igw combined with EventBridge and Amazon SNS.

The most common wrong option is C, because it uses AWS Config, EventBridge, and SNS, but the internet-gateway-authorized-vpc-only managed rule checks whether an IGW is attached only to authorized VPCs, not whether the route table contains a default route to the IGW.

Community Discussion (6 comments)

AzureDP900 👍 1 Selected: D

This solution has less implementation effort because: It uses a pre-configured AWS managed rule (no-unrestricted-route-to-igw) that is specifically designed for this use case, eliminating the need to write custom code. It leverages Amazon EventBridge (formerly CloudWatch Events) and Amazon SNS, which are well-established services with minimal configuration required.

AzureDP900 👍 1 Selected: D

D Create an AWS Config rule for the route table by using the no-unrestricted-route-to-igw managed rule would meet these requirements with the LEAST implementation effort. This solution leverages pre-built AWS Config rules, which monitor the resource configuration and trigger an Amazon EventBridge rule when a rule violation is detected. The email notification can then be sent to the network engineer through an Amazon SNS topic.

woorkim 👍 1 Selected: D

C. AWS Config rule using internet-gateway-authorized-vpc-only: This rule checks if an internet gateway is attached only to authorized VPCs. It does not specifically monitor for unrestricted routes (0.0.0.0/0 or ::/0) to the internet gateway, which is the requirement.

meseerie 👍 3 Selected: D

answer is cleary D https://docs.aws.amazon.com/config/latest/developerguide/no-unrestricted-route-to-igw.html ''Checks if there are public routes in the route table to an Internet gateway (IGW). The rule is NON_COMPLIANT if a route to an IGW has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.''

ArunRav 👍 2 Selected: D

A and B is out as lambda need effort. C only check if igw is attached to authorized vpc. For checking unrestricted route getting attached to igw D is the best option and needs very less operational effort as it is using aws native tool.

46f094c 👍 1 Selected: C

https://docs.aws.amazon.com/config/latest/developerguide/no-unrestricted-route-to-igw.html

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option D uses the AWS managed rule no-unrestricted-route-to-igw, which is purpose-built to detect route-table entries with a destination CIDR of 0.0.0.0/0 or ::/0 to an internet gateway. No custom Lambda code is required, so it has the least implementation effort. The rule’s non-compliance event can be matched by an EventBridge rule and delivered to an SNS topic for email, exactly as required.

Why the Other Options Are Wrong

Options A and B require building and maintaining a Lambda function, adding significant implementation effort and runtime complexity. Option B incorrectly references the EC2 CreateRoute API call and is not a native monitoring solution. Option C uses internet-gateway-authorized-vpc-only, which checks whether an IGW is attached to authorized VPCs, but it does not evaluate route-table entries for unrestricted routes to the IGW.

Community Comment Notes

Most commenters correctly choose D and note that the managed rule greatly reduces operational overhead. One commenter links the official docs for no-unrestricted-route-to-igw but marks answer C, which appears to be a typo or misread. The distinction between the two managed rules (C vs. D) is a key takeaway, and the official documentation clearly defines the rule’s compliance logic.

Official Reference

Exam Strategy

When a question asks for least implementation effort, look for a managed AWS service or managed Config rule that already covers the condition. Remember the exact purpose of the Config managed rules: no-unrestricted-route-to-igw is for default/public routes to an IGW, while internet-gateway-authorized-vpc-only is for IGW attachment to authorized VPCs.

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide