WGU E030 TASK 1 CAPSTONE
TOPIC APPROVAL FORM & AWS
HYBRID-CLOUD NETWORK
LATEST MOCK PRACTICE SET
140 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E030 TASK 1 CAPSTONE TOPIC APPROVAL FORM & AWS HYBRID-CLOUD NETWORK PROPOSAL |
GNS3, CLOUDFORMATION, SITE-TO-SITE VPN & NETWORK DIAGRAM | 2026 .. It contains 140 carefully
selected questions that reflect the most current exam content and testing strategies. Each question is
accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 140 Questions
Foundations - Application - WGU E030 TASK 1 Capstone Topic Approval FORM & AWS Hybrid-cloud
Network Proposal GNS3 Cloudformation Site-to-site VPN & Network Diagram 2026 Network Engineering
AND Cloud Architecture Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Capstone Topic Approval 1-24 On-premises, Site-to-site VPN, Cloudformation, Combination,
AND Proposal Development Tunnel
AWS Hybrid-cloud 25-48 Network, Hybrid-cloud, On-premises, Capstone, Tunnel
Architecture Design
Network Infrastructure AND 49-72 Network, Hybrid-cloud, Site-to-site VPN, On-premises, VPN
GNS3 Simulation Tunnel
Cloudformation 73-96 Network, Hybrid-cloud, Capstone, Site-to-site VPN, Proposal
Infrastructure AS CODE
Site-to-site VPN 97-120 On-premises, Network, YOU MUST, Site-to-site VPN,
Configuration AND Security Hybrid-cloud
Network Diagramming AND 121-140 Network, Capstone, Proposal, On-premises, Hybrid-cloud
Documentation
TOTAL 140 All questions include answers and detailed rationales
,Section A - Capstone Topic Approval AND Proposal
Development
Q1.
In a GNS3-based hybrid-cloud lab, you need to emulate an AWS Transit Gateway
connecting multiple VPCs and an on-premises site. Which GNS3 node type best
represents the Transit Gateway's routing behavior without introducing a layer-2
bottleneck?
A. A cloud node bridging to a physical B. A router running BGP with VPC
switch attachments
C. An Ethernet switch with VLAN trunking D. A NAT device performing static
translations
Correct: B - A router running BGP with VPC attachments
Rationale:A Transit Gateway operates at layer 3, performing IP routing between attached
networks. A router with BGP can emulate its routing table and dynamic route exchange. A
cloud node or switch would not provide the routing intelligence, and a NAT device would alter
packet addressing, unlike a transparent transit hub.
Q2.
When authoring an AWS CloudFormation template for a site-to-site VPN, which
combination of resources is essential to establish the VPN tunnel and propagate routes to
the VPC route tables?
A. AWS::EC2::VPNGateway, B. AWS::EC2::InternetGateway,
AWS::EC2::CustomerGateway, AWS::EC2::RouteTable, AWS::EC2::Subnet,
AWS::EC2::VPNConnection, AWS::EC2::SecurityGroup
AWS::EC2::Route
C. AWS::EC2::TransitGateway, D. AWS::EC2::VPNGateway,
AWS::EC2::VPCAttachment, AWS::EC2::VPNConnection,
AWS::EC2::RouteTablePropagation, AWS::EC2::VPNGatewayRoutePropagation,
AWS::EC2::Route AWS::EC2::Route
Correct: D - AWS::EC2::VPNGateway, AWS::EC2::VPNConnection,
AWS::EC2::VPNGatewayRoutePropagation, AWS::EC2::Route
Rationale:A classic site-to-site VPN requires a VPN gateway, customer gateway, and VPN
connection. To propagate routes from the VPN to the VPC, you need
VPNGatewayRoutePropagation attached to the route table, and then a static route (or BGP)
to send traffic. Option A misses the propagation resource. Option B is for internet connectivity.
Option C is for Transit Gateway, not direct VPN.
Page 3
, Section A - Capstone Topic Approval AND Proposal Development
Q3.
In a hybrid-cloud network diagram, you must represent the logical flow of encrypted traffic
from an on-premises host to an AWS VPC. Which notation set correctly depicts the
encapsulation and routing path?
A. Host -> Switch -> Firewall -> Router -> B. Host -> Router -> Switch -> NAT ->
IPSec Tunnel -> VGW -> VPC Internet -> IGW -> VPC
C. Host -> Firewall -> Switch -> MPLS -> D. Host -> VPN Gateway -> Internet ->
Direct Connect -> VPC Customer Gateway -> VPC
Correct: A - Host -> Switch -> Firewall -> Router -> IPSec Tunnel -> VGW -> VPC
Rationale:The correct path for an IPSec VPN involves the host sending plaintext to the
network, which is then encrypted by the VPN device (often a firewall or router) and sent
through the tunnel to the Virtual Private Gateway (VGW) in AWS. Option A accurately shows
the encryption boundary and the tunnel. Option B uses NAT and IGW, which is for internet
traffic, not VPN. Option C implies Direct Connect, not VPN. Option D reverses the gateway
roles.
Q4.
Your hybrid-cloud design must support active-active failover between two on-premises
data centers and AWS, using BGP over site-to-site VPN. Which BGP attribute manipulation
ensures that AWS prefers the primary site for inbound traffic while still allowing failover?
A. Set a lower local preference on the B. Prepend AS path on the backup site's
primary site's routes advertised routes
C. Set a higher MED on the primary site's D. Use a longer community string on the
routes backup site
Correct: B - Prepend AS path on the backup site's advertised routes
Rationale:AS path prepending makes the backup site's routes less preferred by AWS, as
longer AS paths are less favorable. This ensures inbound traffic uses the primary site while
still providing a valid path for failover. Local preference is used within an AS, not across to
AWS. MED is used for outbound traffic from AWS. Community strings do not directly
influence path selection unless mapped to local preference.
Q5.
When deploying a CloudFormation stack that includes a VPN connection with dynamic
routing (BGP), which parameter is required to be defined in the
AWS::EC2::VPNConnection resource to establish the tunnel?
A. VpnGatewayId and CustomerGatewayId B. Type (ipsec.1) and StaticRoutesOnly set
only to false
Page 4
TOPIC APPROVAL FORM & AWS
HYBRID-CLOUD NETWORK
LATEST MOCK PRACTICE SET
140 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E030 TASK 1 CAPSTONE TOPIC APPROVAL FORM & AWS HYBRID-CLOUD NETWORK PROPOSAL |
GNS3, CLOUDFORMATION, SITE-TO-SITE VPN & NETWORK DIAGRAM | 2026 .. It contains 140 carefully
selected questions that reflect the most current exam content and testing strategies. Each question is
accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 140 Questions
Foundations - Application - WGU E030 TASK 1 Capstone Topic Approval FORM & AWS Hybrid-cloud
Network Proposal GNS3 Cloudformation Site-to-site VPN & Network Diagram 2026 Network Engineering
AND Cloud Architecture Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Capstone Topic Approval 1-24 On-premises, Site-to-site VPN, Cloudformation, Combination,
AND Proposal Development Tunnel
AWS Hybrid-cloud 25-48 Network, Hybrid-cloud, On-premises, Capstone, Tunnel
Architecture Design
Network Infrastructure AND 49-72 Network, Hybrid-cloud, Site-to-site VPN, On-premises, VPN
GNS3 Simulation Tunnel
Cloudformation 73-96 Network, Hybrid-cloud, Capstone, Site-to-site VPN, Proposal
Infrastructure AS CODE
Site-to-site VPN 97-120 On-premises, Network, YOU MUST, Site-to-site VPN,
Configuration AND Security Hybrid-cloud
Network Diagramming AND 121-140 Network, Capstone, Proposal, On-premises, Hybrid-cloud
Documentation
TOTAL 140 All questions include answers and detailed rationales
,Section A - Capstone Topic Approval AND Proposal
Development
Q1.
In a GNS3-based hybrid-cloud lab, you need to emulate an AWS Transit Gateway
connecting multiple VPCs and an on-premises site. Which GNS3 node type best
represents the Transit Gateway's routing behavior without introducing a layer-2
bottleneck?
A. A cloud node bridging to a physical B. A router running BGP with VPC
switch attachments
C. An Ethernet switch with VLAN trunking D. A NAT device performing static
translations
Correct: B - A router running BGP with VPC attachments
Rationale:A Transit Gateway operates at layer 3, performing IP routing between attached
networks. A router with BGP can emulate its routing table and dynamic route exchange. A
cloud node or switch would not provide the routing intelligence, and a NAT device would alter
packet addressing, unlike a transparent transit hub.
Q2.
When authoring an AWS CloudFormation template for a site-to-site VPN, which
combination of resources is essential to establish the VPN tunnel and propagate routes to
the VPC route tables?
A. AWS::EC2::VPNGateway, B. AWS::EC2::InternetGateway,
AWS::EC2::CustomerGateway, AWS::EC2::RouteTable, AWS::EC2::Subnet,
AWS::EC2::VPNConnection, AWS::EC2::SecurityGroup
AWS::EC2::Route
C. AWS::EC2::TransitGateway, D. AWS::EC2::VPNGateway,
AWS::EC2::VPCAttachment, AWS::EC2::VPNConnection,
AWS::EC2::RouteTablePropagation, AWS::EC2::VPNGatewayRoutePropagation,
AWS::EC2::Route AWS::EC2::Route
Correct: D - AWS::EC2::VPNGateway, AWS::EC2::VPNConnection,
AWS::EC2::VPNGatewayRoutePropagation, AWS::EC2::Route
Rationale:A classic site-to-site VPN requires a VPN gateway, customer gateway, and VPN
connection. To propagate routes from the VPN to the VPC, you need
VPNGatewayRoutePropagation attached to the route table, and then a static route (or BGP)
to send traffic. Option A misses the propagation resource. Option B is for internet connectivity.
Option C is for Transit Gateway, not direct VPN.
Page 3
, Section A - Capstone Topic Approval AND Proposal Development
Q3.
In a hybrid-cloud network diagram, you must represent the logical flow of encrypted traffic
from an on-premises host to an AWS VPC. Which notation set correctly depicts the
encapsulation and routing path?
A. Host -> Switch -> Firewall -> Router -> B. Host -> Router -> Switch -> NAT ->
IPSec Tunnel -> VGW -> VPC Internet -> IGW -> VPC
C. Host -> Firewall -> Switch -> MPLS -> D. Host -> VPN Gateway -> Internet ->
Direct Connect -> VPC Customer Gateway -> VPC
Correct: A - Host -> Switch -> Firewall -> Router -> IPSec Tunnel -> VGW -> VPC
Rationale:The correct path for an IPSec VPN involves the host sending plaintext to the
network, which is then encrypted by the VPN device (often a firewall or router) and sent
through the tunnel to the Virtual Private Gateway (VGW) in AWS. Option A accurately shows
the encryption boundary and the tunnel. Option B uses NAT and IGW, which is for internet
traffic, not VPN. Option C implies Direct Connect, not VPN. Option D reverses the gateway
roles.
Q4.
Your hybrid-cloud design must support active-active failover between two on-premises
data centers and AWS, using BGP over site-to-site VPN. Which BGP attribute manipulation
ensures that AWS prefers the primary site for inbound traffic while still allowing failover?
A. Set a lower local preference on the B. Prepend AS path on the backup site's
primary site's routes advertised routes
C. Set a higher MED on the primary site's D. Use a longer community string on the
routes backup site
Correct: B - Prepend AS path on the backup site's advertised routes
Rationale:AS path prepending makes the backup site's routes less preferred by AWS, as
longer AS paths are less favorable. This ensures inbound traffic uses the primary site while
still providing a valid path for failover. Local preference is used within an AS, not across to
AWS. MED is used for outbound traffic from AWS. Community strings do not directly
influence path selection unless mapped to local preference.
Q5.
When deploying a CloudFormation stack that includes a VPN connection with dynamic
routing (BGP), which parameter is required to be defined in the
AWS::EC2::VPNConnection resource to establish the tunnel?
A. VpnGatewayId and CustomerGatewayId B. Type (ipsec.1) and StaticRoutesOnly set
only to false
Page 4
