Quiz ACE: Aviatrix Certified Engineer (ACE) program

As here AWS is Primary Cloud Provider.
With Aviatrix You can Bring your own firewall to the cloud. Pre-integrated with Next-Generation
Firewalls
to enable inline inspection of VPC traffic to maximize security and performance.
Multicloud and Multi-Region is the new normal: With Aviatrix You can support your business needs
for onprem and multiple cloud providers. Instead of managing different cloud vendor gateways,
Aviatrix NextGeneration Transit Network lets you abstract away the networking differences between
AWS, Azure, Google
and Private Cloud.

To encrypt this connection, users have the option to create an IPSec Tunnel which limits the
throughput to only 1.25Gbps. Standard IPSec encryption in the cloud, or from your data center to the
cloud, is limited by a single core processing to 1.25 Gbps.
High Performance Encryption with InsaneMode - Aviatrix Insane mode is integrated into the Transit
Network solution to provide 10Gbps performance between on-prem and Transit VPC with
encryption. For VPC to VPC, Insane mode can achieve 25 - 30Gbps.

Aviatrix Controller provides a VPC Tracker tool. VPC Tracker is a tool that collects and helps you
manage
your network CIDR ranges at a central place, eliminating the need to keep an Excel sheet on all your
VPC network addresses allocations.By using VPC Tracker tool one can create a VPC.
VPC Tracker: https://docs.aviatrix.com/HowTos/vpc_tracker.html
Create a VPC: https://docs.aviatrix.com/HowTos/create_vpc.html

The correct answer is A.
An AWS Transit Gateway connects multiple VPCs, but it does not automatically allow all instances in those VPCs to talk to each other. Even when the Transit Gateway attachments are in place, traffic between EC2 instances can still be blocked by security groups, network ACLs, or operating system firewalls.
Why A is correct:
- AWS automatically handles the VPC attachment and routing toward the Transit Gateway, but that does not guarantee instance-to-instance communication.
- If the instances cannot communicate, one of the most common causes is restrictive security group rules.
- Security groups are stateful and must explicitly allow the required inbound and outbound traffic between the VPCs or instance subnets.
Why the other options are incorrect:
B. Configure BGP communities in VPC such that all VPCs that need to communicate with each other have same community defined
- BGP communities are not used this way for standard Transit Gateway VPC-to-VPC communication.
- This is not the mechanism for enabling EC2 connectivity across VPCs.
C. Create routing tables in each VPC, add CIDR for all the other VPCs in the routing table pointing to AWS Transit Gateway
- This is partially related to connectivity, but in this scenario the question says the VPCs were attached and AWS auto-configures VPC routing tables.
- The issue described points more specifically to security group blocking rather than missing routes.
- Also, manually adding routes in every VPC is not the primary fix implied by the question.
D. There must be security group rules blocking traffic as BGP in VPC auto configures VPC routing tables
- This is incorrect because BGP is not what auto-configures VPC routing tables in this context.
- The important point is still security group rules, but the explanation attached to this option is wrong.
Key takeaway:
With Transit Gateway, routing may be in place, but communication still requires:
- proper security group rules
- appropriate network ACL rules
- correct route tables
Since the question says the instances cannot communicate after setup, the most likely fix is to check and adjust security group rules.

NAT capability supported on the gateway - An Aviatrix OpenVPN® gateway performs a NAT function
for
the user’s VPN traffic, effectively masking out the VPN client’s virtual IP address assigned by gateway
from
the VPN CIDR Block. but here specifically AWS NAT Gateway is asked.
An Aviatrix OpenVPN is DUO multi-factor authentication supported.
LDAP/AD Integration Authenticates VPN user from Aviatrix gateways in addition to VPN certificate
authentication.

Answer: A. True
Yes, the operator can use the Aviatrix VPC Tracker feature to help validate whether a planned network address space, such as a CIDR block, prefix, or address space, would overlap with or duplicate existing networks across multiple clouds.
Why this is true:
- Aviatrix Controller provides centralized visibility across cloud environments.
- The VPC Tracker feature is designed to inventory and track network objects such as VPCs, VNets, and other cloud network segments.
- By using this feature, an operator can review existing address allocations before creating a new VPC, VCN, or VNet.
- This helps prevent overlapping IP ranges and address conflicts, especially in multicloud deployments where duplicate CIDRs can cause routing and connectivity issues.
In practical terms:
- Before provisioning a new network, the operator can check whether the intended CIDR is already in use in another cloud or region managed by Aviatrix.
- This validation reduces the risk of network overlap and deployment failures.
Therefore, the correct answer is True.

Aviatrix Gateways can scale up and down both.

The correct answers are A, B, and C.
Azure Virtual WAN is a Microsoft-managed networking service designed to simplify large-scale connectivity across VNets, branches, users, and on-premises environments such as a data center via ExpressRoute. While it provides a highly scalable hub-and-spoke connectivity model, there are some common limitations or design challenges to be aware of.
Why A is correct: No support for multi-cloud
Azure Virtual WAN is primarily an Azure-centric solution. It is designed to connect Azure resources, branches, users, and on-premises networks into Microsoft’s global backbone. While you can connect external networks into Azure, Virtual WAN does not natively provide a multi-cloud networking control plane in the same way a vendor-neutral SD-WAN or multi-cloud networking platform might. So, multi-cloud support is a known challenge.
Why B is correct: Lack of encryption within the cloud
Traffic that flows between Azure resources over the Microsoft backbone is not automatically encrypted end-to-end by the Virtual WAN service itself. While Azure provides secure connectivity options and you can layer encryption on top using IPsec VPNs or application-level encryption, the design pattern does not inherently guarantee encryption for all east-west traffic inside the cloud. This is often considered a challenge in security-sensitive environments.
Why C is correct: Inability to selectively advertise routes
Azure Virtual WAN abstracts much of the routing control to make management easier, but that also means you have less granular control over route advertisement compared to traditional network architectures. In particular, selectively advertising specific routes or applying fine-grained route filtering can be more difficult or limited. This is a common challenge when designing with Virtual WAN, especially in environments with complex segmentation or policy requirements.
Why the other options are not correct:
D. No support for BGP
This is incorrect. Azure Virtual WAN does support BGP for dynamic route exchange with supported connectivity types such as VPN and ExpressRoute.
E. No support for VPN Users
This is incorrect. Azure Virtual WAN supports point-to-site VPN connections for users, so remote user access is supported.
F. Inability to have default any to any connectivity
This is incorrect. Virtual WAN is actually designed to enable broad connectivity between connected resources, and hub routing can support any-to-any style communication depending on the configuration. The issue is not that it cannot do this, but rather that control and segmentation need to be carefully designed.
Final answer: A, B, C

Aviatrix Controller programs all VPC route tables and Transit Gateway route tables so that two
Security Domains with a connection policy can communicate with each other automatically with the
help of Aviatrix AWS TGW Orchestrator.