Examkin

Question

Difficulty: MediumAWS Network Services

A logistics company is designing its network architecture in AWS. The company has created 1212 Virtual Private Clouds (VPCs) to isolate different services, such as inventory management, billing, and shipment tracking. They need a solution that establishes a simplified hub-and-spoke routing model to allow all 1212 VPCs to communicate with one another without managing a complex mesh of point-to-point connections. Additionally, the security team requires a stateless firewall mechanism at the subnet boundary to explicitly deny traffic from a list of known malicious IP addresses.

Which two AWS services or features should the company implement to meet these requirements? (Select TWO.)

  1. AWS Transit GatewayAnswer
  2. Network Access Control Lists (Network ACLs)Answer
  3. C
    VPC Peering
  4. D
    Security Groups
  5. E
    Amazon Route 53 routing policies

Answer

AWS Transit Gateway and Network Access Control Lists (Network ACLs)
AWS Transit Gateway is correct because it acts as a central cloud router, simplifying multi-VPC connectivity into a hub-and-spoke model. Network Access Control Lists (Network ACLs) is correct because it operates at the subnet boundary, is stateless, and supports explicit deny rules to block malicious traffic before it reaches the instances.

Step-by-Step Solution

1
Analyze the VPC routing requirement for 12 VPCs.
Using point-to-point connections like VPC Peering would require n(n−1)/2=12(11)/2=66n(n-1)/2 = 12(11)/2 = 66 peering connections, which is complex to manage. A centralized hub-and-spoke model is required, pointing to AWS Transit Gateway.
AWS Transit Gateway simplifies multi-VPC routing by acting as a central network transit hub.
2
Analyze the firewall requirement.
The firewall must be stateless, operate at the subnet boundary, and support explicit deny rules to block a specific range of malicious IP addresses.
Network Access Control Lists (Network ACLs) meet these criteria because they are stateless, operate at the subnet level, and support both allow and deny rules. Security Groups are stateful, operate at the instance level, and only support allow rules.

Key Concept

AWS multi-VPC routing and subnet-level security access control.
Rate this question

Topics

AWS Network Services

More questions from this topic