Examkin

Question

Difficulty: MediumAWS Network Services

An enterprise is migrating its centralized service-oriented architecture to AWS. The architecture consists of 12 distinct Virtual Private Clouds (VPCs) that require full network connectivity with each other through a centralized hub. The enterprise also needs to enforce stateless packet filtering at the boundary of each subnet to prevent traffic from unauthorized external networks. Which combination of AWS networking components should the enterprise implement to satisfy these requirements?

  1. AWS Transit Gateway to interconnect the VPCs, and Network Access Control Lists (Network ACLs) for subnet-level stateless packet filteringAnswer
  2. B
    AWS Transit Gateway to interconnect the VPCs, and Security Groups for subnet-level stateless packet filtering
  3. C
    VPC Peering connections to interconnect the VPCs, and Security Groups for subnet-level stateless packet filtering
  4. D
    VPC Peering connections to interconnect the VPCs, and Network Access Control Lists (Network ACLs) for subnet-level stateless packet filtering

Answer

AWS Transit Gateway to interconnect the VPCs, and Network Access Control Lists (Network ACLs) for subnet-level stateless packet filtering
The correct option combines AWS Transit Gateway to act as a centralized router for the 12 VPCs, avoiding the complexity of a peer-to-peer mesh, and Network Access Control Lists (Network ACLs) to perform stateless packet filtering at the subnet boundaries.

Step-by-Step Solution

1
Determine the optimal network topology for connecting multiple VPCs.
AWS Transit Gateway acts as a central hub, routing traffic between the 12 VPCs and avoiding a complex mesh network of 66 peering connections.
Transit Gateway simplifies route management and scales easily for hub-and-spoke multi-VPC designs.
2
Identify the resource that provides stateless filtering at the subnet level.
Network Access Control Lists (Network ACLs) operate at the subnet boundary and perform stateless packet filtering.
Network ACLs evaluate traffic entering and leaving subnets against explicit rules, whereas Security Groups operate at the instance/ENI level and are stateful.

Key Concept

AWS network topologies and security boundaries
Rate this question

Topics

AWS Network Services

More questions from this topic