Examkin

Question

Difficulty: HardAWS Network Services

A multinational enterprise is consolidating its cloud infrastructure after acquiring several smaller subsidiaries. The IT team must interconnect 40 separate Virtual Private Clouds (VPCs) across different AWS accounts and also establish a connection to their central headquarters. Additionally, they must implement a mechanism to deny inbound traffic from a list of known malicious IP addresses at the boundary of their subnets. Which combination of AWS solutions will satisfy these requirements with the lowest operational complexity?

  1. AWS Transit Gateway to interconnect the networks, combined with Network Access Control Lists (Network ACLs) at the subnet levelAnswer
  2. B
    AWS Transit Gateway to interconnect the networks, combined with Security Groups at the instance level
  3. C
    A mesh of VPC Peering connections to interconnect the networks, combined with Security Groups at the instance level
  4. D
    A mesh of VPC Peering connections to interconnect the networks, combined with Network Access Control Lists (Network ACLs) at the subnet level

Answer

The combination of AWS Transit Gateway to interconnect the networks and Network Access Control Lists (Network ACLs) at the subnet level.
The correct answer combines AWS Transit Gateway and Network Access Control Lists. AWS Transit Gateway simplifies the network architecture by acting as a central hub that transitively routes traffic between the 40 VPCs and the corporate headquarters. Network ACLs operate at the subnet boundary and support stateless rule evaluation, allowing administrators to add explicit deny rules for specific malicious IP addresses.

Step-by-Step Solution

1
Analyze the interconnection requirements for 40 VPCs and an on-premises network.
Identify that VPC Peering would require a complex, unmanageable mesh of point-to-point connections, whereas AWS Transit Gateway acts as a central hub to simplify routing.
Choosing the service that minimizes operational overhead for multi-VPC and hybrid network connectivity.
2
Analyze the security requirement to block specific external IP addresses at the subnet boundary.
Determine that Network ACLs are stateless, apply at the subnet boundary, and support explicit deny rules. In contrast, Security Groups are stateful, apply at the instance level, and only support allow rules.
Selecting the appropriate security control that supports blocking specific source IPs before traffic reaches the instances.

Key Concept

AWS Transit Gateway provides simplified hub-and-spoke routing for multi-VPC environments, while Network ACLs allow stateless subnet-level traffic filtering, including explicit deny rules.
Rate this question

Topics

AWS Network Services

More questions from this topic