Examkin

Question

Difficulty: Very hardAWS Network Services

A company has deployed applications across 50 VPCs in multiple AWS accounts and needs to implement a network architecture that allows all VPCs to communicate with each other transitively while minimizing connection complexity. Additionally, the company must implement a stateless firewall mechanism at the boundary of each subnet to restrict traffic from specific IP ranges. Which combination of AWS services and features should the company use to meet these requirements?

  1. AWS Transit Gateway to interconnect the VPCs, and Network Access Control Lists (Network ACLs) for subnet-level stateless filtering.Answer
  2. B
    A full mesh of VPC Peering connections to interconnect the VPCs, and Network Access Control Lists (Network ACLs) for subnet-level stateless filtering.
  3. C
    AWS Transit Gateway to interconnect the VPCs, and Security Groups for subnet-level stateless filtering.
  4. D
    A full mesh of VPC Peering connections to interconnect the VPCs, and Security Groups for subnet-level stateless filtering.

Answer

AWS Transit Gateway to interconnect the VPCs, and Network Access Control Lists (Network ACLs) for subnet-level stateless filtering.
The correct option combines AWS Transit Gateway and Network ACLs. AWS Transit Gateway acts as a central hub to connect VPCs transitively, which is highly scalable for a 50-VPC setup. Network ACLs operate at the subnet boundary and are stateless, meeting the requirement to block traffic from specific IP ranges without tracking connection state.

Step-by-Step Solution

1
Evaluate the requirement for interconnecting 50 VPCs transitively with minimal complexity.
AWS Transit Gateway is identified as the ideal hub-and-spoke solution, as VPC Peering is non-transitive and requires a complex full-mesh configuration of 1,225 connections.
VPC Peering does not scale efficiently for a high number of VPCs requiring transitive communication.
2
Evaluate the requirement for a stateless firewall at the subnet boundary.
Network Access Control Lists (Network ACLs) are identified as the appropriate solution because they are stateless and applied at the subnet boundary, whereas Security Groups are stateful and applied at the instance level.
Security Groups cannot perform stateless filtering at the subnet boundary.
3
Combine the chosen routing and security services to find the matching option.
The correct combination is AWS Transit Gateway and Network ACLs.
This combination satisfies both the transitive hub-and-spoke networking requirement and the subnet-level stateless security requirement.

Key Concept

AWS Transit Gateway provides transitive routing for scaling multi-VPC architectures, while Network ACLs offer stateless security filtering at the subnet boundary.
Rate this question

Topics

AWS Network Services

More questions from this topic