Examkin

Question

Difficulty: MediumAWS Network Services

A retail corporation is expanding its AWS infrastructure and now manages twenty Virtual Private Clouds (VPCs) across multiple departments. To optimize operations, the network engineering team wants to implement a centralized network hub to route traffic between all VPCs and their on-premises data center without establishing complex point-to-point connections. At the same time, the security team requires the ability to block traffic from specific external IP addresses at the boundary of each subnet.

Which two AWS features or services should the corporation implement to satisfy both the routing and security requirements? (Select TWO.)

  1. AWS Transit GatewayAnswer
  2. Network Access Control Lists (NACLs)Answer
  3. C
    VPC Peering
  4. D
    Security Groups
  5. E
    NAT Gateways

Answer

AWS Transit Gateway and Network Access Control Lists (NACLs)
AWS Transit Gateway acts as a central hub to connect multiple VPCs and on-premises networks, simplifying routing compared to point-to-point peering. Network Access Control Lists (NACLs) operate at the subnet level and allow explicit deny rules to block specific IP addresses.

Step-by-Step Solution

1
Analyze the routing requirement.
The company needs a centralized hub to route traffic across twenty VPCs and on-premises without complex point-to-point connections.
AWS Transit Gateway is designed precisely for this hub-and-spoke architecture, replacing complex VPC peering meshes.
2
Analyze the security requirement.
The company needs to block traffic from specific IP addresses at the subnet level.
Network Access Control Lists (NACLs) operate at the subnet boundary and support explicit 'deny' rules, which is necessary to block specific IP addresses. Security groups only support 'allow' rules and operate at the instance level.

Key Concept

AWS Network Services (Transit Gateway and NACLs)
Rate this question

Topics

AWS Network Services

More questions from this topic