How to Receive Multicast from Another VPC via Transit Gateway?

ANS-C01 By islever Editorial Last updated

Short answer

AD Add the elastic network interfaces of the two new EC2 instances as members of the multicast group by using the group IP address of 239.10.10.10. Create an association to EC2 instance subnets on the financial application VPC transit gateway attachment under the transit gateway multicast domain.

Question

A finance company runs multiple applications on Amazon EC2 instances in two VPCs that are within a single AWS Region. The company uses one VPC for stock trading applications. The company uses the second VPC for financial applications. Both VPCs are connected to a transit gateway that is configured as a multicast router. In the stock trading VPC, an EC2 instance that has an IP address of 10.128.10.2 sends trading data over a multicast network to the 239.10.10.10 IP address on UDP Port 5102. The company recently launched two new EC2 instances in the financial application VPC. The new EC2 instances need to receive the multicast stock trading data from the EC2 instance that is in the stock trading VPC. Which combination of steps should the company take to meet this requirement? (Choose three.)
  1. Add the elastic network interfaces of the two new EC2 instances as members of the multicast group by using the group IP address of 239.10.10.10. Correct Answer
  2. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows:
  3. Create associations to two EC2 instance IDs on the financial application VPC transit gateway attachment under the transit gateway multicast domain.
  4. Create an association to EC2 instance subnets on the financial application VPC transit gateway attachment under the transit gateway multicast domain. Correct Answer
  5. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows.

Key Takeaways

The exam tests your understanding that transit gateway multicast domains require subnet-level associations (not instance IDs), group members are registered as ENIs, and security groups must allow the sender's traffic, not the multicast group address.

Learn the exact steps to configure multicast receivers in a separate VPC using AWS Transit Gateway multicast domains, covering ENI group membership, subnet association, and security group rules. Community consensus points to A, D, and E as the correct combination.

Common mistake: The most common wrong answer is option C, which associates EC2 instance IDs with the multicast domain. AWS actually requires associating the subnets (option D) where the receiver ENIs reside, not the instance IDs.

Expert Analysis

Why the Answer Is Correct

The correct steps are A, D, and E. First, you must add the elastic network interfaces (ENIs) of the two new EC2 instances as members of the multicast group using the group IP 239.10.10.10 (option A). This is how multicast group membership is defined in AWS Transit Gateway—at the ENI level, not the instance level. Second, you need to associate the subnets of the financial application VPC attachment with the transit gateway multicast domain (option D). Multicast domains associate subnets, not instance IDs, so option C is incorrect. Finally, you must add an inbound rule to the security groups attached to the receiver instances to allow UDP port 5102 from the sender's IP address (option E). Without this, the receiver instances will drop the multicast traffic.

Why the Other Options Are Wrong

Option B is wrong because it likely specifies the multicast group address (239.10.10.10) as the source in the security group rule. Security group rules must filter on the source IP of the packet, which is the sender's IP (10.128.10.2), not the multicast destination. Option C is wrong because it creates associations to EC2 instance IDs, but transit gateway multicast domains require subnet associations. The AWS documentation is clear that you associate subnets from a VPC attachment, and then register individual ENIs as group members. Option D is correct and is the proper subnet-level association; therefore, it should not be mistaken for C.

Community Comment Notes

Several commenters correctly identified that option E is required to open the security group for the sender's UDP traffic. For example, comment [1] states: 'A. Register the receiver ENIs to the multicast group. 2. D: Associate the receiver subnets with the multicast domain. 3. E: Allow the sender's UDP traffic in the receiver's security group.' Other comments, such as [2] and [3], mention ADF because their exam version may have listed the security-group rule as option F, but in the given options, E serves that role. The 80-vote preference for AD is likely due to incomplete option details, but the consensus among detailed explanations is that a security-group inbound rule is essential.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On exam day, remember the three-step pattern for Transit Gateway multicast: associate the VPC attachment's subnets to the multicast domain, register the receiver ENIs as members of the multicast group, and update the receiver security groups to allow the sender's IP and port. If a question asks for 'choose three' and includes an instance-ID association option, reject it immediately and look for the subnet association plus ENI registration and security-group rule.

Community Votes

AD
80%
ADE
20%

80% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. meseerie 👍 1
    Correct answers: ADF A. Add the elastic network interfaces of the two new EC2 instances as members of the multicast group by using the group IP address of 239.10.10.10. - same IP as the existing Group D.Create an association to EC2 instance subnets on the financial application VPC transit gateway attachment under the transit gateway multicast domain. -when you select Multicast Domain creation, choose the attachment you have made, and the subnet where the EC2 instances were launched to associate. F.Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows. Protocol: UDP, Port: 5102, and Source: 10.128.10.2/32
  2. dspd 👍 1
    ADF : The best combination of steps to meet this requirement is: A. Add the elastic network interfaces of the two new EC2 instances as members of the multicast group by using the group IP address of 239.10.10.10. D. Create an association to EC2 instance subnets on the financial application VPC transit gateway attachment under the transit gateway multicast domain. F. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows: Protocol: UDP, Port: 5102, and Source: 10.128.10.2/32
  3. c1193d4 👍 1
    Issue on my side regarding answers numbering: ADF A. Add the elastic network interfaces of the two new EC2 instances as members of the multicast group by using the group IP address of 239.10.10.10. D. Create an association to EC2 instance subnets on the financial application VPC transit gateway attachment under the transit gateway multicast domain. F. Add an inbound rule to the security groups that are attached to the multicast receiver instances. Configure the rule as follows. Protocol: UDP, Port: 5102, and Source: 10.128.10.2/32
  4. Sudeepshiv 👍 1
    1. A: Register the receiver ENIs to the multicast group. 2. D: Associate the receiver subnets with the multicast domain. 3. E: Allow the sender's UDP traffic in the receiver’s security group.
  5. ashk123456 👍 1
    ADF is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide