Examkin

Question

Difficulty: HardAWS Network Services

A company is extending its on-premises corporate office to AWS using a 10 Gbps10\text{ Gbps} AWS Direct Connect connection. The corporate network needs to access workloads deployed across 3030 different Virtual Private Clouds (VPCs) in the same AWS Region. Additionally, the security team requires that any incoming traffic from the on-premises network to the VPCs' database subnets be filtered at the subnet boundary to permit only a specific range of administrative IP addresses. Which AWS networking solution and security feature should the company implement to meet these requirements?

  1. A
    VPC Peering to interconnect all 3030 VPCs to a central hub VPC connected to Direct Connect, and Network ACLs on the database subnets to filter incoming traffic.
  2. AWS Transit Gateway to route traffic from the Direct Connect gateway to the 3030 VPCs, and Network ACLs on the database subnets to filter incoming traffic.Answer
  3. C
    AWS Transit Gateway to route traffic from the Direct Connect gateway to the 3030 VPCs, and Security Groups on the database instances to filter traffic at the subnet boundary.
  4. D
    VPC Peering to interconnect all 3030 VPCs to a central hub VPC connected to Direct Connect, and Security Groups on the database instances to filter traffic at the subnet boundary.

Answer

AWS Transit Gateway combined with Network ACLs on the database subnets.
The solution utilizing AWS Transit Gateway for routing and Network ACLs for filtering is correct. AWS Transit Gateway acts as a cloud router, enabling transitive routing between the on-premises network connected via Direct Connect and all 3030 VPCs. Network ACLs operate at the subnet boundary, fulfilling the security requirement to filter incoming database subnet traffic based on source IP ranges.

Step-by-Step Solution

1
Analyze the requirement to connect 3030 VPCs to an on-premises network via a single AWS Direct Connect connection.
Identify that VPC Peering is not viable due to the lack of transitive routing (spokes cannot access Direct Connect via a hub VPC) and high operational overhead. AWS Transit Gateway is the correct solution as it natively supports transitive routing and acts as a centralized hub.
AWS Transit Gateway simplifies multi-VPC architectures and allows external connections like Direct Connect to route traffic to all attached VPCs transitively.
2
Determine the resource to enforce traffic filtering at the subnet boundary.
Identify that Network Access Control Lists (NACLs) operate at the subnet boundary, whereas Security Groups operate at the instance level.
The scenario explicitly requests filtering at the subnet boundary, which is the operational boundary for Network ACLs.

Key Concept

VPC Transitive Routing and Subnet-Level Filtering
Rate this question

Topics

AWS Network Services

More questions from this topic