WGU E029 CAPSTONE PROJECT
TASK 2: AWS HYBRID NETWORK
ARCHITECTURE
LATEST MOCK PRACTICE SET
150 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E029 CAPSTONE PROJECT TASK 2: AWS HYBRID NETWORK ARCHITECTURE IMPLEMENTATION &
FUNCTIONALITY REPORT | 2026 PASSED.. It contains 150 carefully selected questions that reflect the most
current exam content and testing strategies. Each question is accompanied by a correct answer and a detailed
rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 150 Questions
Foundations - Application - WGU E029 Capstone Project TASK 2 AWS Hybrid Network Architecture
Implementation & Functionality Report 2026 Passed Cloud Networking & Architecture Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
AWS Hybrid Network 1-25 On-premises, Connect, Network, Direct, Hybrid
Architecture Design
AWS Direct Connect AND 26-50 Network, Traffic, Direct Connect, On-premises, Gateway
VPN Connectivity
Amazon VPC Configuration 51-75 Network, Connect, Direct, Hybrid, On-premises
AND Subnetting
Routing AND LOAD 76-100 Network, On-premises, Hybrid, Connect, Direct
Balancing IN Hybrid
Environments
Security AND Compliance IN 101-125 Network, Connect, Direct, On-premises, Hybrid
Hybrid Networks
HIGH Availability AND Fault 126-150 Network, On-premises, Connect, Hybrid, Gateway
Tolerance
TOTAL 150 All questions include answers and detailed rationales
,Section A - AWS Hybrid Network Architecture Design
Q1.
A hybrid network uses a Direct Connect hosted VIF with a private VIF to a VPC. The
on-premises router advertises a default route via BGP. The VPC has a VPN connection to
the same on-premises network as backup. Which condition causes the VPN to become the
preferred path for return traffic from the VPC to on-premises?
A. The Direct Connect BGP session uses a B. The VPN BGP session uses a longer AS
lower local preference than the VPN BGP path than the Direct Connect BGP session.
session.
C. The Direct Connect VIF is associated D. The VPN BGP session advertises more
with a different virtual private gateway than specific routes than the Direct Connect BGP
the VPN. session.
Correct: D - The VPN BGP session advertises more specific routes than the Direct
Connect BGP session.
Rationale:BGP prefers the most specific route (longest prefix). If the VPN advertises a /16
while Direct Connect advertises a /24, the VPN becomes preferred for the longer prefix. Local
preference is only considered before AS path but after longest prefix; both are BGP attributes
but not the primary factor here. Association with different gateways would cause isolation, not
preference.
Q2.
A Transit Gateway interconnects three VPCs and an on-premises network via Direct
Connect. VPC A and VPC B both have routes to the on-premises CIDR, but VPC C does
not. You need to ensure VPC C can reach on-premises. What is the minimal configuration
change?
A. Attach VPC C to the Transit Gateway and B. Create a new Transit Gateway
add a static route in VPC C's route table attachment for VPC C and enable route
pointing to the Transit Gateway. propagation from the Direct Connect
attachment.
C. Modify the Direct Connect attachment to D. Add a route in the Transit Gateway route
associate with VPC C's route table. table pointing to VPC C's attachment for the
on-premises CIDR.
Correct: B - Create a new Transit Gateway attachment for VPC C and enable route
propagation from the Direct Connect attachment.
Page 3
, Section A - AWS Hybrid Network Architecture Design
Rationale: For VPC C to reach on-premises via Transit Gateway, it must be attached and its
route table must include the on-premises CIDR propagated from the Direct Connect
attachment. Simply attaching and adding a static route to the Transit Gateway is insufficient
because the Transit Gateway route table must also know how to reach on-premises.
Modifying the Direct Connect attachment is not possible; attachments are per resource.
Adding a route in the Transit Gateway route table pointing to VPC C would only affect traffic
from on-premises to VPC C, not the reverse.
Q3.
An organization uses AWS Site-to-Site VPN with two tunnels for redundancy. Both tunnels
use the same customer gateway device. During failover testing, the primary tunnel drops,
but the secondary tunnel does not automatically take over. Which configuration is most
likely causing this?
A. The secondary tunnel uses a different B. The VPN connection is configured as a
customer gateway IP address. single tunnel with a virtual tunnel interface.
C. The secondary tunnel's BGP session is D. The secondary tunnel is in a different
not established because the on-premises AWS region than the primary tunnel.
router is not advertising routes.
Correct: C - The secondary tunnel's BGP session is not established because the
on-premises router is not advertising routes.
Rationale:For automatic failover, both tunnels must have established BGP sessions. If the
secondary tunnel's BGP session is down, routes will not be advertised and traffic will not use
it. The customer gateway IP can be the same or different; both are valid. A single tunnel with
a VTI is not the standard AWS configuration. Different regions would not be part of the same
VPN connection.
Q4.
A company uses AWS PrivateLink to access a SaaS application in another VPC. The SaaS
provider's VPC has an NLB that routes to multiple instances. The consumer VPC has a
VPC endpoint. Which component is responsible for ensuring that the consumer's traffic is
load-balanced across the SaaS instances?
A. The VPC endpoint's route table B. The network load balancer (NLB) in the
provider VPC
C. The security group attached to the VPC D. The DNS resolution for the VPC endpoint
endpoint
Correct: B - The network load balancer (NLB) in the provider VPC
Page 4
TASK 2: AWS HYBRID NETWORK
ARCHITECTURE
LATEST MOCK PRACTICE SET
150 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E029 CAPSTONE PROJECT TASK 2: AWS HYBRID NETWORK ARCHITECTURE IMPLEMENTATION &
FUNCTIONALITY REPORT | 2026 PASSED.. It contains 150 carefully selected questions that reflect the most
current exam content and testing strategies. Each question is accompanied by a correct answer and a detailed
rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 150 Questions
Foundations - Application - WGU E029 Capstone Project TASK 2 AWS Hybrid Network Architecture
Implementation & Functionality Report 2026 Passed Cloud Networking & Architecture Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
AWS Hybrid Network 1-25 On-premises, Connect, Network, Direct, Hybrid
Architecture Design
AWS Direct Connect AND 26-50 Network, Traffic, Direct Connect, On-premises, Gateway
VPN Connectivity
Amazon VPC Configuration 51-75 Network, Connect, Direct, Hybrid, On-premises
AND Subnetting
Routing AND LOAD 76-100 Network, On-premises, Hybrid, Connect, Direct
Balancing IN Hybrid
Environments
Security AND Compliance IN 101-125 Network, Connect, Direct, On-premises, Hybrid
Hybrid Networks
HIGH Availability AND Fault 126-150 Network, On-premises, Connect, Hybrid, Gateway
Tolerance
TOTAL 150 All questions include answers and detailed rationales
,Section A - AWS Hybrid Network Architecture Design
Q1.
A hybrid network uses a Direct Connect hosted VIF with a private VIF to a VPC. The
on-premises router advertises a default route via BGP. The VPC has a VPN connection to
the same on-premises network as backup. Which condition causes the VPN to become the
preferred path for return traffic from the VPC to on-premises?
A. The Direct Connect BGP session uses a B. The VPN BGP session uses a longer AS
lower local preference than the VPN BGP path than the Direct Connect BGP session.
session.
C. The Direct Connect VIF is associated D. The VPN BGP session advertises more
with a different virtual private gateway than specific routes than the Direct Connect BGP
the VPN. session.
Correct: D - The VPN BGP session advertises more specific routes than the Direct
Connect BGP session.
Rationale:BGP prefers the most specific route (longest prefix). If the VPN advertises a /16
while Direct Connect advertises a /24, the VPN becomes preferred for the longer prefix. Local
preference is only considered before AS path but after longest prefix; both are BGP attributes
but not the primary factor here. Association with different gateways would cause isolation, not
preference.
Q2.
A Transit Gateway interconnects three VPCs and an on-premises network via Direct
Connect. VPC A and VPC B both have routes to the on-premises CIDR, but VPC C does
not. You need to ensure VPC C can reach on-premises. What is the minimal configuration
change?
A. Attach VPC C to the Transit Gateway and B. Create a new Transit Gateway
add a static route in VPC C's route table attachment for VPC C and enable route
pointing to the Transit Gateway. propagation from the Direct Connect
attachment.
C. Modify the Direct Connect attachment to D. Add a route in the Transit Gateway route
associate with VPC C's route table. table pointing to VPC C's attachment for the
on-premises CIDR.
Correct: B - Create a new Transit Gateway attachment for VPC C and enable route
propagation from the Direct Connect attachment.
Page 3
, Section A - AWS Hybrid Network Architecture Design
Rationale: For VPC C to reach on-premises via Transit Gateway, it must be attached and its
route table must include the on-premises CIDR propagated from the Direct Connect
attachment. Simply attaching and adding a static route to the Transit Gateway is insufficient
because the Transit Gateway route table must also know how to reach on-premises.
Modifying the Direct Connect attachment is not possible; attachments are per resource.
Adding a route in the Transit Gateway route table pointing to VPC C would only affect traffic
from on-premises to VPC C, not the reverse.
Q3.
An organization uses AWS Site-to-Site VPN with two tunnels for redundancy. Both tunnels
use the same customer gateway device. During failover testing, the primary tunnel drops,
but the secondary tunnel does not automatically take over. Which configuration is most
likely causing this?
A. The secondary tunnel uses a different B. The VPN connection is configured as a
customer gateway IP address. single tunnel with a virtual tunnel interface.
C. The secondary tunnel's BGP session is D. The secondary tunnel is in a different
not established because the on-premises AWS region than the primary tunnel.
router is not advertising routes.
Correct: C - The secondary tunnel's BGP session is not established because the
on-premises router is not advertising routes.
Rationale:For automatic failover, both tunnels must have established BGP sessions. If the
secondary tunnel's BGP session is down, routes will not be advertised and traffic will not use
it. The customer gateway IP can be the same or different; both are valid. A single tunnel with
a VTI is not the standard AWS configuration. Different regions would not be part of the same
VPN connection.
Q4.
A company uses AWS PrivateLink to access a SaaS application in another VPC. The SaaS
provider's VPC has an NLB that routes to multiple instances. The consumer VPC has a
VPC endpoint. Which component is responsible for ensuring that the consumer's traffic is
load-balanced across the SaaS instances?
A. The VPC endpoint's route table B. The network load balancer (NLB) in the
provider VPC
C. The security group attached to the VPC D. The DNS resolution for the VPC endpoint
endpoint
Correct: B - The network load balancer (NLB) in the provider VPC
Page 4
