Examkin

Question

Difficulty: Very hardHigh-Performing and Scalable Network Architectures

An enterprise is migrating its core high-performance computing (HPC) data ingestion platform to AWS. The platform requires a hybrid network connection between the on-premises storage systems and multiple VPCs across different AWS accounts in the `us-east-1` Region. The workload demands a minimum network throughput of 4 Gbps4\text{ Gbps} for transferring large datasets, and all data in transit must be encrypted. The solution must support automated routing failover and scale seamlessly as new VPCs are provisioned. Which TWO steps should a solutions architect take to build this network architecture? (Select TWO.)

  1. Deploy an AWS Transit Gateway (TGW) with Equal-Cost Multi-Path (ECMP) routing support enabled, and attach the target VPCs to the TGW.Answer
  2. Establish an AWS Direct Connect connection, configure a Transit Virtual Interface (Transit VIF), and set up multiple AWS Site-to-Site VPN connections over the Transit VIF using Border Gateway Protocol (BGP).Answer
  3. C
    Deploy a Virtual Private Gateway (VGW) in each VPC, establish a single AWS Site-to-Site VPN connection to each VGW, and enable dynamic routing to automatically scale the VPN tunnel throughput to 4 Gbps4\text{ Gbps}.
  4. D
    Establish an AWS Direct Connect connection with a Private Virtual Interface (Private VIF) to each VPC, and configure stateful Network Access Control Lists (NACLs) to encrypt all traffic passing over the Direct Connect link.
  5. E
    Configure a full mesh of VPC Peering connections between all VPCs, and implement Amazon Route 53 latency-based routing policies to distribute traffic over the peering connections from the on-premises DNS servers.

Answer

Deploying AWS Transit Gateway with ECMP routing enabled to connect the VPCs, combined with establishing multiple AWS Site-to-Site VPN connections over an AWS Direct Connect Transit VIF.
To achieve secure, encrypted transit at a throughput of 4 Gbps4\text{ Gbps}, the organization must establish multiple AWS Site-to-Site VPN connections over an AWS Direct Connect link. Since a single VPN tunnel is limited to 1.25 Gbps1.25\text{ Gbps} of throughput, multiple tunnels must be combined using AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) enabled. Terminating these VPN connections on the Transit Gateway over a Transit Virtual Interface (Transit VIF) ensures that traffic is encrypted while dynamically distributing the load across the tunnels.

Step-by-Step Solution

1
Analyze the network bandwidth and encryption requirements.
Identify that the minimum throughput of 4 Gbps4\text{ Gbps} exceeds the 1.25 Gbps1.25\text{ Gbps} limit of a single AWS VPN tunnel, meaning multiple tunnels must be aggregated, and that Direct Connect traffic must be encrypted using IPsec VPN.
Establishing these parameters narrows down the solutions to multi-tunnel VPN over Direct Connect configurations.
2
Evaluate the scalability and routing mechanism.
Determine that AWS Transit Gateway is needed to enable Equal-Cost Multi-Path (ECMP) routing to load-balance and aggregate the throughput across at least four active VPN tunnels.
Transit Gateway allows central management of connections to multiple VPCs and supports ECMP for scaling VPN throughput.
3
Select the appropriate hybrid connectivity type.
Implement a Transit Virtual Interface (Transit VIF) on the AWS Direct Connect connection to route private IPsec VPN traffic directly to the AWS Transit Gateway.
A Transit VIF is required to connect AWS Direct Connect to a Transit Gateway, enabling VPN over Direct Connect for encrypted, high-bandwidth transit.

Key Concept

Scaling secure hybrid network throughput using AWS Transit Gateway ECMP and VPN over Direct Connect.
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic