Examkin

Question

Difficulty: Very hardAWS Network Services

A company is designing a network architecture on AWS to connect 20 Virtual Private Clouds (VPCs) across different AWS Regions to their on-premises data center using AWS Direct Connect. They also need to implement a security control that blocks traffic from specific external IP addresses at the subnet boundary before it reaches any resources. Which two AWS configurations or services should the company implement to meet these requirements? (Select two.)

  1. AWS Transit Gateway to act as a centralized hub for routing traffic between the multiple VPCs and the on-premises networkAnswer
  2. Stateless Network Access Control Lists (NACLs) associated with the subnets to block the specific malicious IP addressesAnswer
  3. C
    A full mesh of VPC Peering connections between all 20 VPCs to allow direct traffic routing between them
  4. D
    Stateful Security Groups applied at the subnet level to filter and block traffic from the specified IP addresses
  5. E
    Stateless Network Access Control Lists (NACLs) attached directly to the elastic network interfaces of individual EC2 instances

Answer

AWS Transit Gateway and stateless Network Access Control Lists (NACLs) associated with subnets
The correct answer combines AWS Transit Gateway and stateless Network Access Control Lists (NACLs) associated with subnets. AWS Transit Gateway is designed to act as a centralized router to connect multiple VPCs and on-premises networks, eliminating the complexity of a full mesh VPC peering topology. Network Access Control Lists (NACLs) are stateless and function at the subnet boundary, making them the appropriate tool to block specific external IP addresses before traffic reaches any EC2 instances within the subnet.

Step-by-Step Solution

1
Identify the service that simplifies interconnecting multiple VPCs (20 VPCs) across different regions and on-premises networks.
AWS Transit Gateway acts as a cloud router, serving as a centralized hub to connect multiple VPCs and on-premises networks, replacing the need for complex mesh configurations.
VPC Peering does not scale well for 20 VPCs and does not natively support transitive routing.
2
Determine the network security component capable of blocking traffic from specific IP addresses at the subnet boundary.
Network Access Control Lists (NACLs) operate at the subnet level and are stateless, allowing explicit deny rules to block specific IP addresses before traffic reaches any EC2 instance.
Security Groups operate at the instance level and do not apply at the subnet boundary.

Key Concept

AWS Transit Gateway acts as a central hub to simplify multi-VPC routing, while Network Access Control Lists (NACLs) provide stateless filtering at the subnet boundary.
Estimated Time:3m 0s
Rate this question

Topics

AWS Network Services

More questions from this topic