How to Receive Multicast from Another VPC via Transit Gateway?
A finance company runs multiple applications on Amazon EC2 instances in two VPCs that are within a single AWS Region. The company uses one VPC for stock trading applications. The company uses the second VPC for financial applications. Both VPCs are connected to a transit gateway that is configured as a multicast router. In the stock trading VPC, an EC2 instance that has an IP address of 10.128.10.2 sends trading data over a multicast network to the 239.10.10.10 IP address on UDP Port 5102. The company recently launched two new EC2 instances in the financial application VPC. The new EC2 instances need to receive the multicast stock trading data from the EC2 instance that is in the stock trading VPC. Which combination of steps should the company take to meet this requirement? (Choose three.)
Community Votes
80% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your understanding that transit gateway multicast domains require subnet-level associations (not instance IDs), group members are registered as ENIs, and security groups must allow the sender's traffic, not the multicast group address.
Learn the exact steps to configure multicast receivers in a separate VPC using AWS Transit Gateway multicast domains, covering ENI group membership, subnet association, and security group rules. Community consensus points to A, D, and E as the correct combination.
The most common wrong answer is option C, which associates EC2 instance IDs with the multicast domain. AWS actually requires associating the subnets (option D) where the receiver ENIs reside, not the instance IDs.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct steps are A, D, and E. First, you must add the elastic network interfaces (ENIs) of the two new EC2 instances as members of the multicast group using the group IP 239.10.10.10 (option A). This is how multicast group membership is defined in AWS Transit Gateway—at the ENI level, not the instance level. Second, you need to associate the subnets of the financial application VPC attachment with the transit gateway multicast domain (option D). Multicast domains associate subnets, not instance IDs, so option C is incorrect. Finally, you must add an inbound rule to the security groups attached to the receiver instances to allow UDP port 5102 from the sender's IP address (option E). Without this, the receiver instances will drop the multicast traffic.
Why the Other Options Are Wrong
Option B is wrong because it likely specifies the multicast group address (239.10.10.10) as the source in the security group rule. Security group rules must filter on the source IP of the packet, which is the sender's IP (10.128.10.2), not the multicast destination. Option C is wrong because it creates associations to EC2 instance IDs, but transit gateway multicast domains require subnet associations. The AWS documentation is clear that you associate subnets from a VPC attachment, and then register individual ENIs as group members. Option D is correct and is the proper subnet-level association; therefore, it should not be mistaken for C.
Community Comment Notes
Several commenters correctly identified that option E is required to open the security group for the sender's UDP traffic. For example, comment [1] states: 'A. Register the receiver ENIs to the multicast group. 2. D: Associate the receiver subnets with the multicast domain. 3. E: Allow the sender's UDP traffic in the receiver's security group.' Other comments, such as [2] and [3], mention ADF because their exam version may have listed the security-group rule as option F, but in the given options, E serves that role. The 80-vote preference for AD is likely due to incomplete option details, but the consensus among detailed explanations is that a security-group inbound rule is essential.
Official Reference
Exam Strategy
On exam day, remember the three-step pattern for Transit Gateway multicast: associate the VPC attachment's subnets to the multicast domain, register the receiver ENIs as members of the multicast group, and update the receiver security groups to allow the sender's IP and port. If a question asks for 'choose three' and includes an instance-ID association option, reject it immediately and look for the subnet association plus ENI registration and security-group rule.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →