AWS Cloud WAN Segment Isolation and Policy

ANS-C01 By islever Editorial Last updated

Short answer

AC Update the network policy to share the shared services segment with the BU segment. Set the isolate-attachments field to True for the BU segment.

Question

A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edge location in the us-west-1 Region. A shared services segment exists at both edge locations. Each shared services segment has a VPC attachment to each inspection VPC in each Region. The inspection VPCs inspect traffic from a WAN by using AWS Network Firewall. The company creates a new segment for a new business unit (BU) in the us-east-1 edge location. The new BU has three VPCs that are attached to the new BU segment. To comply with regulations, the BU VPCs must not communicate with each other. All internet-bound traffic must be inspected in the inspection VPC. The company updates VPC route tables so any traffic that is bound for internet goes to the AWS Cloud WAN core network. The company plans to add more VPCs for the new BU in the future. All future VPCs must comply with regulations. Which solution will meet these requirements in the MOST operationally efficient way? (Choose two.)
  1. Update the network policy to share the shared services segment with the BU segment. Correct Answer
  2. Create a network policy to share the inspection service segment with the BU segment.
  3. Set the isolate-attachments field to True for the BU segment. Correct Answer
  4. Set the isolate-attachments field to False for the BU segment.
  5. Update the network policy to add static routes for the BU segment. Configure the shared services segment to route traffic related to VPC CIDR blocks to each respective VPC attachment.

Key Takeaways

The exam tests the ability to isolate VPCs within a single segment (isolate-attachments=True) while ensuring traffic can still reach inspection services through explicit sharing or routing policies.

This question tests AWS Cloud WAN network policies, specifically using the isolate-attachments field to enforce VPC isolation within a segment. Community consensus favors combining segment isolation with shared service access via network policy for operational efficiency.

Common mistake: Candidates often choose B (Create a network policy to share the inspection service segment) instead of A because they assume 'inspection' implies needing the 'inspection segment'. However, the question specifies traffic goes to 'shared services segment' VPCs, making A the correct sharing target. Others miss that C is required for isolation.

Expert Analysis

Why the Answer Is Correct

Option C (Set isolate-attachments to True) is critical because it prevents VPCs within the same BU segment from communicating with each other, satisfying the regulatory requirement for isolation without manual route table updates. Option A (Update network policy to share shared services segment) allows the BU segment to send traffic to the shared services segment, where the inspection VPCs reside. This combination ensures all internet-bound traffic is inspected while keeping BU VPCs isolated from each other.

Why the Other Options Are Wrong

Option B is incorrect because the question states inspection happens in the 'shared services segment', not an 'inspection service segment'. Sharing a non-existent or misnamed segment would fail. Option D disables isolation, violating the compliance rule. Option E requires manual static route updates for every new VPC, which fails the 'MOST operationally efficient' criterion for future scalability.

Community Comment Notes

Comments [2] highlight that AC provides a scalable solution requiring no manual route updates for new VPCs. Comment [1] clarifies that since the question mentions 'shared services segment' for inspection, Option A is the correct sharing target, not an inspection-specific segment. Comment [3] argues against A, but this overlooks that the shared services segment contains the inspection VPCs as per the setup description.

Community Votes

AC
50%
BC
50%

50% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. 304faa7 👍 3
    A & C. There is no mention of inspection segment in the question. The only segment mentioned in the question is shared services segment which is why A is correct
  2. woorkim 👍 2
    Options A + C provide the most scalable solution No need to update routes for each new VPC Automatic handling of traffic flows Maintains compliance automatically for future VPCs
  3. ashk123456 👍 1
    (A) incorrect because, The requirement does not mention that the BU VPCs need access to shared services. The key requirement is inspection and isolation, not shared services access.
  4. AWSLoverLoverLoverLoverLover 👍 1
    Answer B and C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Global Accelerator with private ALB: restrict access to accelerator IPs

S-grade

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide