Examkin

Question

Difficulty: MediumAWS Network Services

An organization needs to interconnect ten Amazon VPCs in a single AWS Region using a hub-and-spoke topology to simplify routing management. In addition, the security team requires that inbound traffic from a specific external IP address range be blocked at the subnet boundary before it reaches any resources. Which combination of AWS services and features should be used to meet these requirements?

  1. A
    VPC Peering to interconnect the VPCs, and Security Groups to block the IP range at the subnet boundary
  2. B
    AWS Transit Gateway to interconnect the VPCs, and Security Groups to block the IP range at the subnet boundary
  3. AWS Transit Gateway to interconnect the VPCs, and Network ACLs to block the IP range at the subnet boundaryAnswer
  4. D
    VPC Peering to interconnect the VPCs, and Network ACLs to block the IP range at the subnet boundary

Answer

AWS Transit Gateway to interconnect the VPCs, and Network ACLs to block the IP range at the subnet boundary
The correct option combines AWS Transit Gateway and Network ACLs. AWS Transit Gateway serves as a central hub to simplify routing across multiple VPCs in a hub-and-spoke design. Network ACLs operate at the subnet boundary and support stateless rules, allowing administrators to explicitly define block (deny) rules for specific external IP address ranges.

Step-by-Step Solution

1
Analyze the requirement for connecting ten VPCs using a simplified hub-and-spoke topology.
Identify that AWS Transit Gateway acts as a central cloud router to connect multiple VPCs without the complexity of a point-to-point mesh.
VPC Peering does not support transitive routing, requiring a complex mesh of connections as the number of VPCs grows.
2
Analyze the security requirement to block a specific external IP range at the subnet boundary.
Identify that Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules.
Security Groups operate at the instance level (network interface) and only support allow rules, making them incapable of blocking specific IP ranges at the subnet boundary.

Key Concept

AWS hybrid and multi-VPC networking topologies combined with subnet-level security controls.
Estimated Time:1m 30s
Rate this question

Topics

AWS Network Services

More questions from this topic