Examkin

Question

Difficulty: HardAWS Network Services

A company is designing a network architecture on AWS. They have multiple VPCs across different AWS accounts that need to communicate with each other in a hub-and-spoke model to simplify routing management. Additionally, they must block traffic from a specific range of malicious external IP addresses at the subnet boundary before it reaches any resources. Which AWS networking services or features should be configured to meet these requirements? (Select TWO.)

  1. AWS Transit Gateway to interconnect the VPCsAnswer
  2. Network Access Control Lists (Network ACLs) to block the IP addressesAnswer
  3. C
    VPC Peering connections between all VPCs
  4. D
    Security Groups with inbound deny rules to block the IP addresses
  5. E
    AWS Identity and Access Management (IAM) policies to block the malicious IP addresses

Answer

AWS Transit Gateway to interconnect the VPCs and Network Access Control Lists (Network ACLs) to block the IP addresses
AWS Transit Gateway simplifies the network architecture by connecting multiple VPCs in a hub-and-spoke topology, avoiding the complexity of a full-mesh VPC Peering network. Network Access Control Lists (Network ACLs) operate at the subnet boundary and support explicit deny rules, which allows them to block traffic from specific IP ranges before it reaches any resources inside the subnets.

Step-by-Step Solution

1
Analyze the requirement for connecting multiple VPCs in a hub-and-spoke model.
Identify AWS Transit Gateway as the central hub that simplifies multi-VPC routing, whereas VPC Peering would require complex mesh configurations.
VPC Peering does not scale easily for large numbers of VPCs due to lack of edge-to-edge routing, making Transit Gateway the correct choice.
2
Analyze the requirement to block malicious external IP addresses at the subnet boundary.
Identify Network Access Control Lists (Network ACLs) as stateless firewalls operating at the subnet level that support explicit deny rules.
Security Groups operate at the instance level and only support allow rules, so they cannot block specific IP ranges at the subnet boundary.

Key Concept

AWS network routing and subnet-level security controls
Estimated Time:2m 0s
Rate this question

Topics

AWS Network Services

More questions from this topic