Examkin

Question

Difficulty: HardAWS Network Services

An organization is designing a network architecture to connect six corporate offices to ten Amazon VPCs. The technical requirements specify a centralized, hub-and-spoke connectivity model to simplify routing management. Additionally, the security team needs to enforce stateless traffic filtering at the boundary of each subnet within the VPCs. Which combination of AWS networking components best satisfies these requirements?

  1. A
    A full mesh of VPC Peering connections to link all VPCs, combined with Security Groups for subnet-level filtering.
  2. B
    AWS Transit Gateway to centralize VPC and office connectivity, combined with Security Groups for subnet-level filtering.
  3. AWS Transit Gateway to centralize VPC and office connectivity, combined with Network Access Control Lists (Network ACLs) for subnet-level filtering.Answer
  4. D
    A full mesh of VPC Peering connections to link all VPCs, combined with Network Access Control Lists (Network ACLs) for subnet-level filtering.

Answer

AWS Transit Gateway to centralize VPC and office connectivity, combined with Network Access Control Lists (Network ACLs) for subnet-level filtering.
AWS Transit Gateway acts as a cloud router, establishing a centralized hub-and-spoke network topology that simplifies routing management across multiple VPCs and on-premises networks. Network Access Control Lists (Network ACLs) are stateless firewall rules that operate at the subnet boundary, satisfying the requirement for stateless traffic filtering at the subnet level.

Step-by-Step Solution

1
Analyze the connectivity requirements.
The architecture requires connecting six offices and ten VPCs using a centralized hub-and-spoke model.
AWS Transit Gateway is designed to act as a central hub, simplifying connection management. VPC Peering requires point-to-point connections, which would result in a complex and difficult-to-manage mesh.
2
Analyze the security and filtering requirements.
The architecture requires stateless traffic filtering at the subnet boundary.
Network Access Control Lists (NACLs) are stateless and operate at the subnet boundary. Security Groups are stateful and operate at the instance/elastic network interface (ENI) level.
3
Combine the networking and security requirements.
AWS Transit Gateway provides the centralized hub-and-spoke connectivity, while Network ACLs provide the stateless subnet-level filtering.
This combination successfully meets all specified technical and security requirements of the scenario.

Key Concept

Centralized multi-VPC routing and subnet-level security filtering on AWS
Estimated Time:2m 0s
Rate this question

Topics

AWS Network Services

More questions from this topic