Hard — ANS-C01 Practice Quiz

Question 1

A company runs a payment processing API behind a Network Load Balancer (NLB) with targets registered by instance ID across three Availability Zones. The security team requires that the backend EC2 instances see the original client source IP addresses in their application logs. Additionally, the operations team reports that traffic is being distributed unevenly — some AZs receive far more connections than others, causing hot spots. The NLB currently has cross-zone load balancing disabled. Which combination of actions will preserve original client IPs AND resolve the uneven traffic distribution?

Accepted Answer

Keep the targets registered by instance ID (which preserves client IP by default for NLB) and enable cross-zone load balancing on the NLB.

Answer

Re-register the targets by IP address and enable client IP preservation via a target group attribute, then leave cross-zone load balancing disabled.

Answer

Enable proxy protocol v2 on the target group and configure Route 53 weighted records pointing at each AZ's NLB node to balance traffic.

Answer

Place an Application Load Balancer in front of the NLB, enable the X-Forwarded-For header, and turn on cross-zone load balancing on the ALB.

Question 2

A network operations team runs a fleet of EC2 instances behind a custom TCP proxy on Nitro-based instance types. Applications intermittently report dropped connections during traffic spikes, but VPC Flow Logs show no REJECT entries and the instances' CPU and memory are healthy. The team suspects the instances are hitting Nitro network performance allowances (such as bandwidth or packet-per-second limits) that cause packets to be queued or dropped. Which approach provides the specific metrics needed to confirm this hypothesis?

Accepted Answer

Install the CloudWatch agent and collect the ethtool-based network performance metrics (bw_in_allowance_exceeded, bw_out_allowance_exceeded, pps_allowance_exceeded, conntrack_allowance_exceeded) exposed by the ENA driver

Answer

Enable VPC Flow Logs with the maximum aggregation interval and analyze the packets and bytes fields per flow in Athena

Answer

Enable Traffic Mirroring on the instances' ENIs and inspect the mirrored packets with a network analyzer appliance

Answer

Use Reachability Analyzer between the clients and the instances to verify there is no path-level packet drop

Question 3

A financial services company runs a critical hybrid workload that requires an SLA-backed connection between their on-premises data center and a single AWS Region. The design must survive the failure of any one AWS Direct Connect device, any one on-premises router, and an entire Direct Connect location, while maintaining active connectivity with no reliance on VPN failover. The company wants the AWS-recommended maximum resiliency posture. Which connectivity design meets these requirements?

Accepted Answer

Provision four dedicated connections across two separate Direct Connect locations, with two connections at each location terminating on separate on-premises routers and separate AWS devices.

Answer

Provision two dedicated connections at a single Direct Connect location, terminating on two different AWS devices, each connected to a separate on-premises router.

Answer

Provision one dedicated connection at a Direct Connect location and configure an AWS Site-to-Site VPN over the internet as the backup path using BGP.

Answer

Provision two dedicated connections at two separate Direct Connect locations, each terminating on a single shared on-premises router.

Question 4

A retail company has two Direct Connect locations, one in London and one in Frankfurt, each terminating a dedicated connection with a transit VIF attached to a separate Transit Gateway in eu-west-2 and eu-central-1. The company also has on-premises data centers connected at each Direct Connect location. The networking team wants traffic between the two on-premises data centers to flow directly across the AWS global backbone between the two Direct Connect locations, without traversing the customer's own WAN and without routing through a Transit Gateway. Which approach meets this requirement?

Accepted Answer

Enable SiteLink on the transit VIFs at both Direct Connect locations so the data centers can exchange routes over the AWS global network.

Answer

Create an inter-region Transit Gateway peering between the two Transit Gateways and advertise the on-premises prefixes across the peering.

Answer

Attach both transit VIFs to a single Direct Connect gateway and rely on the Direct Connect gateway to route between the two connections.

Answer

Provision a Site-to-Site VPN between the two customer gateways over public VIFs to bridge the two data centers.

Question 5

A company deploys a fleet of third-party firewall appliances behind a Gateway Load Balancer (GWLB) to inspect north-south traffic for a set of application VPCs. During testing, engineers observe that some TCP sessions inspected by the firewalls are being dropped intermittently, while others pass cleanly. Packet captures on the appliances show that return packets for the affected flows are arriving at a different appliance than the one that processed the initial forward packets. Which GWLB configuration change will resolve the dropped sessions?

Accepted Answer

Enable flow stickiness on the GWLB target group using an appropriate flow-hashing algorithm (5-tuple, 3-tuple, or 2-tuple) so both directions of a flow map to the same appliance.

Answer

Increase the health check interval on the GWLB target group so appliances are not marked unhealthy during inspection spikes.

Answer

Enable cross-zone load balancing on the GWLB so traffic is distributed evenly across appliances in all Availability Zones.

Answer

Switch the GWLB listener from the GENEVE protocol to TCP so the load balancer can track connection state per session.

Question 6

A financial services company must inspect all outbound TLS traffic from a centralized inspection VPC using third-party firewall appliances behind a Gateway Load Balancer. A compliance mandate requires that the private keys used for TLS decryption never be exportable in plaintext and that all cryptographic operations be performed on FIPS 140-2 Level 3 validated hardware under the company's sole control. The security team wants to minimize custom key-handling code on the appliances. Which approach BEST satisfies these requirements?

Accepted Answer

Configure the firewall appliances to use keys stored in an AWS CloudHSM cluster, integrating via the PKCS#11 library so private key operations occur inside the FIPS 140-2 Level 3 HSMs

Answer

Store the TLS private keys as encrypted secrets in AWS Secrets Manager and have each appliance decrypt them at boot using an AWS KMS customer managed key

Answer

Use AWS Certificate Manager to issue the decryption certificates and attach them directly to the Gateway Load Balancer for inline TLS termination

Answer

Enable AWS Network Firewall TLS inspection with a KMS customer managed key and route the inspection VPC traffic through it instead of the appliances

Question 7

A media company runs a fleet of EC2 instances in private subnets that push telemetry to a single third-party analytics endpoint (one destination IP and port) over HTTPS. Traffic flows through a NAT gateway. During peak events, application logs show connection failures and the CloudWatch metric ErrorPortAllocation for the NAT gateway spikes above zero, even though bandwidth utilization is well below the NAT gateway's throughput limit. What is the MOST effective way to resolve these connection failures?

Accepted Answer

Deploy multiple NAT gateways across different subnets and distribute the private instances so their traffic uses different NAT gateways, increasing the pool of available source ports to the same destination.

Answer

Increase the NAT gateway's bandwidth by requesting a service quota increase for maximum throughput per NAT gateway.

Answer

Replace the NAT gateway with a NAT instance running on a larger instance type to raise the connection limit.

Answer

Enable cross-zone load balancing on the NAT gateway so connections are balanced across Availability Zones.

Question 8

A financial services company runs a centralized inspection VPC using AWS Network Firewall to inspect all egress traffic from workload VPCs attached to a Transit Gateway. Auditors require that the security team be able to prove, on demand, exactly which domains each workload attempted to reach over the past 90 days, including connections that were ultimately blocked, without dropping any legitimate traffic during the initial rollout. The security team wants to introduce a new set of stateful rules but is concerned about accidentally blocking business-critical traffic before the rules are validated. Which approach best satisfies both the audit-evidence and safe-rollout requirements?

Accepted Answer

Configure the new stateful rule group with rule actions set to 'alert' and enable both alert and flow logging to an S3 bucket with a 90-day lifecycle, then switch selected rules to 'drop' after validation.

Answer

Deploy the rules directly with 'drop' actions but enable flow logs only, relying on the flow logs to capture blocked connection metadata for the auditors.

Answer

Use a stateless rule group with a 'forward to stateful' default action and rely on Transit Gateway Flow Logs sent to CloudWatch Logs to record domain-level attempts.

Answer

Enable TLS inspection with a drop action on all rules and send only alert logs to Kinesis Data Firehose so the auditors can query blocked domains in real time.

Question 9

A financial services company operates a multi-account AWS Organization with a centralized inspection VPC that hosts AWS Network Firewall. The security governance team must guarantee that every stateful rule group deployed across all firewall policies in every member account enforces a mandatory drop rule for known malicious domains, and they must be automatically alerted whenever a firewall policy is created or modified in a way that removes this baseline protection. The team wants a scalable, organization-wide approach that centralizes rule management while continuously auditing compliance. Which combination BEST meets these requirements?

Accepted Answer

Use AWS Firewall Manager with a Network Firewall policy to centrally deploy and enforce the baseline stateful rule group across all accounts, and rely on Firewall Manager's non-compliance reporting plus AWS Config rules to detect and alert on drift.

Answer

Deploy the stateful rule group manually in each member account's firewall policy and use Amazon GuardDuty to detect when the malicious-domain drop rule is removed.

Answer

Create a CloudFormation StackSet that provisions identical Network Firewall policies in every account and enable termination protection to prevent any modification of the rule groups.

Answer

Share a single centralized Network Firewall rule group via AWS RAM to all accounts and use VPC Flow Logs to confirm that malicious-domain traffic is being dropped.

Question 10

A company runs a public-facing web application in a VPC. Internet traffic enters through an Internet Gateway to an Application Load Balancer in public subnets, and the ALB forwards to application instances in private subnets. Security requires that ALL inbound traffic from the Internet be inspected by AWS Network Firewall before reaching the ALB. The team deploys a Network Firewall with firewall endpoints in dedicated firewall subnets. Which route table configuration correctly forces inbound Internet traffic through the firewall endpoint before reaching the public (ALB) subnets?

Accepted Answer

On the Internet Gateway ingress route table, add a route for the public subnet CIDRs pointing to the firewall VPC endpoint; on the public subnet route table, keep the default route (0.0.0.0/0) pointing to the Internet Gateway.

Answer

On the public subnet route table, add a 0.0.0.0/0 route pointing to the firewall VPC endpoint; leave the Internet Gateway with no edge association.

Answer

On the firewall subnet route table, add a route for the public subnet CIDRs pointing to the Internet Gateway; leave the public subnet route table default.

Answer

Attach a security group to the Internet Gateway that redirects all inbound traffic to the firewall endpoint before it reaches the ALB subnets.

Question 11

A financial services company hosts a public-facing web application behind an internet-facing Application Load Balancer in a public subnet. The security team requires that all inbound HTTPS traffic from the internet be deep-packet inspected by AWS Network Firewall for exploit signatures BEFORE it reaches the ALB, while preserving the original client source IP for the application's audit logs. The VPC uses an Internet Gateway. Which routing configuration correctly forces inbound internet traffic through the Network Firewall endpoint?

Accepted Answer

Add a route on the Internet Gateway route table (edge association) that sends traffic destined for the public subnet CIDR to the Network Firewall endpoint, and route return traffic from the firewall subnet back through the IGW.

Answer

Attach the Network Firewall endpoint as a target of the ALB and configure the listener to forward decrypted traffic to the firewall before the target group.

Answer

Modify the public subnet's NACL to redirect all inbound port 443 traffic to the Network Firewall endpoint ENI, then allow it onward to the ALB.

Answer

Place the Network Firewall endpoint in the same subnet as the ALB and add a security group rule referencing the firewall endpoint as the source for the ALB.

Question 12

A financial services company runs a centralized inspection VPC using AWS Network Firewall to enforce egress controls for all workload accounts. The compliance team requires that (1) all flow and alert logs from the firewall be retained immutably for 7 years, (2) logs be encrypted with a customer-managed key that the security team fully controls, and (3) the security team be able to prove during audits that logging was never disabled. Which combination of configurations BEST meets these requirements?

Accepted Answer

Configure Network Firewall logging to an S3 bucket with Object Lock in compliance mode, encrypt the bucket with an SSE-KMS customer-managed key, and use AWS Config with a managed rule to detect and alert when firewall logging configuration changes.

Answer

Configure Network Firewall logging to a CloudWatch Logs group with a 7-year retention setting, encrypt the log group with an AWS-managed key, and enable CloudTrail data events on the log group.

Answer

Configure Network Firewall logging to Kinesis Data Firehose delivering to S3 with versioning enabled, encrypt with SSE-S3, and rely on S3 lifecycle policies to prevent deletion for 7 years.

Answer

Configure Network Firewall logging to an S3 bucket with a bucket policy denying deletes, encrypt with an SSE-KMS customer-managed key, and enable GuardDuty to monitor for logging changes.

Question 13

A financial services company routes all outbound internet traffic from its VPCs through a centralized inspection VPC that uses AWS Network Firewall. Compliance requires that the firewall block access to any HTTPS destination outside an approved list of fully qualified domain names (FQDNs). Currently the firewall's stateful rules match on the TLS Server Name Indication (SNI), but security auditors report that some clients bypass the controls by sending a benign SNI while connecting to a disallowed domain. Which change most directly closes this gap while keeping the approved-domain allow-list model?

Accepted Answer

Enable TLS inspection configuration on the Network Firewall so it decrypts the session and enforces rules against the actual certificate and HTTP Host header rather than the SNI alone

Answer

Replace the stateful domain rules with stateless rules that filter on destination IP address ranges resolved from the approved FQDNs

Answer

Add a Route 53 Resolver DNS Firewall rule group that blocks all domains not on the approved list and attach it to the inspection VPC

Answer

Configure the firewall to drop any packet where the TLS SNI extension is absent and rely on strict SNI matching for the rest

Question 14

A financial services company runs a centralized inspection VPC with AWS Network Firewall for all outbound internet traffic from workloads across multiple accounts via a Transit Gateway. The security team must ensure that all data leaving the environment toward on-premises data centers over the Site-to-Site VPN is encrypted in transit, and that any workload attempting to establish an unencrypted (plaintext) connection to an external partner API endpoint is blocked. Traffic to the partner endpoint uses HTTPS on port 443, but the team suspects some legacy applications fall back to HTTP on port 80. Which approach BEST enforces encryption-in-transit requirements for the outbound partner traffic while minimizing operational overhead?

Accepted Answer

Configure a Network Firewall stateful rule group that drops any TCP traffic destined to the partner endpoint on port 80, and rely on the Site-to-Site VPN's IPsec encryption for the on-premises path.

Answer

Enable TLS inspection on the VPN tunnel and configure a stateless rule to reject all traffic on port 80 across the inspection VPC.

Answer

Attach a security group to the Transit Gateway attachment that denies outbound port 80 and require IPsec transport mode on all partner connections.

Answer

Deploy AWS WAF on the Network Firewall endpoint to block HTTP requests and enable MACsec on the Site-to-Site VPN for encryption in transit.

Question 15

A financial services company runs a centralized inspection VPC using AWS Network Firewall to filter east-west traffic between multiple spoke VPCs attached to a Transit Gateway. The security team must prove to auditors that no spoke-to-spoke traffic can bypass the firewall and reach another spoke directly. During a compliance review, an auditor asks how to programmatically and continuously verify that the Transit Gateway route tables associated with spoke attachments always route inter-spoke traffic through the inspection VPC attachment. Which approach best satisfies this continuous governance requirement?

Accepted Answer

Use an AWS Config custom rule (or conformance pack) that evaluates Transit Gateway route table associations and propagations, flagging any spoke route table whose inter-spoke routes do not point to the inspection VPC attachment.

Answer

Enable VPC Flow Logs on every spoke VPC and manually review the logs weekly to confirm no direct spoke-to-spoke flows appear.

Answer

Configure Reachability Analyzer to run once during the audit to confirm the current path between two spoke VPCs traverses the inspection VPC.

Answer

Attach a restrictive network ACL to the inspection VPC subnets to block any traffic not originating from the Transit Gateway.

Question 16

A financial services company exposes an internal payment API to hundreds of partner VPCs using AWS PrivateLink. The endpoint service is backed by a Network Load Balancer. Partners report intermittent connection failures that correlate with times when the company performs maintenance in one Availability Zone. The company's VPC spans three AZs (us-east-1a, 1b, 1c), but the NLB and endpoint service are configured with subnets only in us-east-1a and us-east-1b. Partner interface endpoints are created in all three AZs. What is the most likely cause of the failures and the correct remediation?

Accepted Answer

Consumer interface endpoints in us-east-1c have no corresponding provider AZ, so traffic to that endpoint ENI has no path; enable the endpoint service in us-east-1c by adding an NLB subnet there and enabling cross-zone load balancing is optional but recommended.

Answer

PrivateLink requires VPC peering between provider and consumer to route across AZs; add peering connections and update route tables to reach the NLB during maintenance.

Answer

The NLB must terminate TLS for PrivateLink to preserve availability; install an ACM certificate on the NLB and switch the listener to TLS so failover works across AZs.

Answer

Interface endpoints do not support multiple AZs, so partners must consolidate all endpoints into a single AZ that matches the provider; delete the us-east-1c endpoints.

Question 17

A network operations team manages several critical paths in a large VPC environment, including connectivity from an application EC2 instance to an RDS database across subnets. Recently, an unauthorized security group change silently broke this path for hours before anyone noticed. The team wants an automated, ongoing verification that continuously confirms the intended network path remains reachable and alerts them within minutes when a configuration change breaks it. Which approach best meets this requirement with the least custom development?

Accepted Answer

Use Reachability Analyzer with a defined path, and configure an EventBridge scheduled rule that invokes a Lambda function to start the analysis periodically, publishing results and alerting via SNS when the path status is 'not reachable'.

Answer

Enable VPC Flow Logs on the relevant ENIs and create a CloudWatch Logs metric filter that alarms when REJECT records appear between the instance and the database.

Answer

Create a Network Access Analyzer scope and run it manually each morning to detect any unintended network access paths.

Answer

Configure AWS Config with a managed rule that evaluates security group rules and sends an SNS notification whenever any security group is modified.

Question 18

A financial services company runs a Lambda function attached to a private subnet that intermittently fails to reach an on-premises database over a Site-to-Site VPN. During failures, the CloudWatch metrics show no errors on the VPN tunnels, and the tunnels report UP. The network team suspects that Lambda is exhausting available Hyperplane ENIs or private IP addresses in the subnet during scaling events. Which action MOST directly confirms whether subnet IP address exhaustion is the root cause?

Accepted Answer

Check the CloudWatch metric 'AvailableIPAddressCount' or examine the subnet's free IP count relative to concurrent Lambda executions and monitor Lambda invocation errors for 'ENILimitReached'

Answer

Run AWS Reachability Analyzer between the Lambda ENI and the on-premises database IP to validate the path configuration

Answer

Enable VPC Flow Logs on the subnet and filter for records with the status 'NODATA' or a rejected action indicating ENI creation failures

Answer

Increase the VPN tunnel's maximum bandwidth by enabling ECMP with a second Customer Gateway to eliminate throughput contention

Question 19

A financial services company runs an active-active application across two Regions (us-east-1 and eu-west-1), each fronted by an Application Load Balancer. They use Route 53 with latency-based routing and standard health checks to distribute traffic. During a recent partial outage, the application in us-east-1 was returning HTTP 200 on its health check endpoint but was silently corrupting data due to a dependency failure. Route 53 continued sending traffic there. The networking team needs a DNS-layer control that lets operators reliably and instantly shift 100% of traffic away from an unhealthy Region during an incident, independent of application-level health check status, while still supporting routine automated failover. Which approach best meets these requirements?

Accepted Answer

Implement Route 53 Application Recovery Controller (ARC) routing controls backed by readiness checks, and toggle the routing control state to fail traffic away from a Region on demand.

Answer

Shorten the Route 53 health check interval to fast (10 seconds) and lower the failure threshold to 1 so unhealthy endpoints are removed faster.

Answer

Add calculated health checks that combine the ALB health check with a CloudWatch alarm, and rely on Route 53 to withdraw the record automatically.

Answer

Replace latency-based routing with a weighted routing policy and manually set the us-east-1 record weight to 0 during incidents.

Question 20

A company is deploying a new microservices platform in IPv6-only subnets within a VPC to conserve IPv4 address space. The services must be able to reach an external partner API that is only reachable via an IPv4 public endpoint (no AAAA record exists for it). The networking team needs a solution that allows the IPv6-only workloads to initiate outbound connections to this IPv4-only destination without assigning IPv4 addresses to the workload instances. Which combination of features should the team enable to achieve this?

Accepted Answer

Enable DNS64 on the subnet's associated Route 53 Resolver and route IPv6 traffic destined for the well-known NAT64 prefix (64:ff9b::/96) to a NAT gateway

Answer

Attach an egress-only internet gateway to the VPC and add a default IPv6 route pointing to it

Answer

Enable a Route 53 Resolver outbound endpoint with a forwarding rule for the partner domain and route through a Direct Connect gateway

Answer

Assign IPv6 addresses from a BYOIP pool and configure PrivateLink to the partner's endpoint service

Question 21

A financial services company runs a large VPC hosting thousands of EC2 instances that generate a very high volume of DNS queries to the Amazon-provided VPC resolver (the .2 address). During peak trading hours, application teams report intermittent DNS resolution failures and timeouts, but CloudWatch shows CPU and network utilization on the instances is normal. The instances are spread across three Availability Zones. What is the MOST likely cause of the DNS failures, and how should the network team address it?

Accepted Answer

The VPC resolver enforces a limit of 1,024 packets per second per network interface toward the .2 address; distribute the query load across the ENIs in each AZ and consider caching or a local resolver fleet to reduce per-ENI query volume

Answer

The Route 53 private hosted zone has reached its record limit; split the zone into multiple hosted zones and associate each with the VPC

Answer

Route 53 Resolver outbound endpoints are throttling queries; increase the number of outbound endpoint IP addresses to raise the queries-per-second ceiling

Answer

The VPC DHCP option set is misconfigured to point at an on-premises DNS server; change it back to AmazonProvidedDNS to restore capacity

Question 22

A security team detects that a workload in a specific VPC has been compromised. The VPC is attached to a Transit Gateway that routes traffic between multiple VPCs and an on-premises network via a VPN attachment. The team wants to immediately isolate the compromised VPC from all other attachments and on-premises networks while preserving the ability to investigate the instances through a dedicated forensics VPC that remains reachable. What is the most effective way to achieve this using Transit Gateway features?

Accepted Answer

In the Transit Gateway route table associated with the compromised VPC's attachment, add blackhole routes for all destination CIDRs except the forensics VPC CIDR, which points to the forensics VPC attachment.

Answer

Detach the compromised VPC from the Transit Gateway and re-attach it after forensics is complete.

Answer

Modify the compromised VPC's security groups to deny all traffic, then update the Transit Gateway route table to point at the forensics VPC.

Answer

Remove the compromised VPC's route table propagations to the shared route table and rely on the default Transit Gateway route table to drop the traffic.

Question 23

A company operates workloads in a Transit Gateway in us-east-1 and another Transit Gateway in eu-west-1. They have a single Direct Connect location in the US with a 10 Gbps dedicated connection. The network team must allow on-premises networks to reach VPCs attached to both Transit Gateways over the Direct Connect connection, while minimizing the number of virtual interfaces required. Which implementation meets these requirements?

Accepted Answer

Create one transit VIF, associate it with a Direct Connect gateway, and associate both Transit Gateways to that Direct Connect gateway with allowed prefixes configured.

Answer

Create two private VIFs, one associated with a Direct Connect gateway for us-east-1 and one for eu-west-1, and attach each gateway to the respective Transit Gateway.

Answer

Create a transit VIF for each Transit Gateway and associate both to a single Direct Connect gateway that peers the two Transit Gateways together.

Answer

Create one public VIF, associate it with a Direct Connect gateway, and route to both Transit Gateways using BGP advertised prefixes.

Question 24

A company runs a hub-and-spoke topology using a Transit Gateway with multiple VPC attachments across three Availability Zones. Application teams report intermittent high latency for east-west traffic between two spoke VPCs, but only for flows that traverse different AZs. The network team must confirm whether traffic is being hairpinned across AZs at the Transit Gateway before opening a support case. Which action provides the most direct evidence of the cross-AZ traffic behavior?

Accepted Answer

Enable Transit Gateway Flow Logs and analyze the source/destination AZ fields (az-id) to determine whether ingress and egress occur in different Availability Zones for the affected flows

Answer

Enable VPC Flow Logs on both spoke VPC ENIs and inspect the packet byte counts to infer additional inter-AZ hops

Answer

Run Reachability Analyzer between the two spoke instances to measure the round-trip latency across the Transit Gateway

Answer

Use CloudWatch metrics for BytesIn and BytesOut on the Transit Gateway to identify which AZ is generating cross-zone charges

Question 25

A media company runs a large file-transfer workload between two VPCs attached to the same AWS Transit Gateway. On-premises testing showed high throughput using 9001-byte jumbo frames, but after migrating to AWS the application experiences sporadic large-payload failures and reduced throughput. A packet capture on the receiving instance shows that some large packets never arrive, while smaller packets pass normally. The instances themselves are configured with an MTU of 9001. What is the most likely cause and the correct remediation?

Accepted Answer

Transit Gateway supports a maximum MTU of 8500 bytes for traffic between VPC attachments, and packets larger than this are dropped without fragmentation; lower the instance/application MTU to 8500 or less.

Answer

Transit Gateway fragments all packets over 1500 bytes; disable jumbo frames entirely and set the instance MTU to 1500 to restore reliability.

Answer

The VPC route tables are missing a jumbo-frame propagation entry; add a static route with the jumbo flag enabled on both attachments.

Answer

Path MTU Discovery is failing because ICMP is blocked; open ICMP type 3 code 4 in the security groups so 9001-byte frames pass through Transit Gateway unchanged.