A company needs to replicate large database backups from its on-premises data center to a … — AWS Certified Solutions Architect - Associate

A company needs to replicate large database backups from its on-premises data center to a VPC on AWS. The replication software requires a consistent network throughput of at least $2\text{ Gbps}$ . The company wants to establish a secure, encrypted hybrid connection over the public internet, avoiding the lead time of dedicated physical circuits. Which network architecture should a solutions architect recommend to meet these requirements?

A
Create an AWS Site-to-Site VPN connection to a Virtual Private Gateway and configure dynamic routing with BGP to load-balance traffic concurrently across both tunnels of the connection.
B
Create an AWS Site-to-Site VPN connection to a Virtual Private Gateway and configure stateful Network ACL rules to allow outbound and inbound traffic to bypass the $1.25\text{ Gbps}$ tunnel throughput limitation.
Create an AWS Site-to-Site VPN connection to an AWS Transit Gateway, enable Equal-Cost Multi-Path (ECMP) routing, and establish multiple VPN tunnels to aggregate bandwidth.Answer
D
Create an AWS Site-to-Site VPN connection to a Virtual Private Gateway and configure Amazon Route 53 latency-based routing to distribute the replication workload across both VPN tunnels.

Answer

Create an AWS Site-to-Site VPN connection to an AWS Transit Gateway, enable Equal-Cost Multi-Path (ECMP) routing, and establish multiple VPN tunnels to aggregate bandwidth.

The correct answer is to use an AWS Site-to-Site VPN connection attached to an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled. An AWS Site-to-Site VPN tunnel has a maximum throughput capacity of

1.25\text{ Gbps}

. To exceed this limit and achieve the required

2\text{ Gbps}

throughput, Transit Gateway can load-balance traffic across multiple active tunnels using ECMP, aggregating the bandwidth of the tunnels.

Step-by-Step Solution

Identify the bandwidth constraint and connection requirements.

The replication requires at least

2\text{ Gbps}

of bandwidth, must be secure/encrypted, must run over the public internet, and needs to be set up without long lead times.

This rules out dedicated lines like AWS Direct Connect due to lead times, leaving Site-to-Site VPN as the primary hybrid connectivity option.

Analyze the throughput limitations of standard AWS VPN configurations.

A single AWS Site-to-Site VPN tunnel is logically capped at

1.25\text{ Gbps}

. Terminating the VPN on a Virtual Private Gateway only allows active-passive routing, meaning the max throughput remains

1.25\text{ Gbps}

To achieve

2\text{ Gbps}

, the architecture must support active-active tunnel load balancing to aggregate bandwidth.

Select a routing component that supports bandwidth aggregation.

Attaching the Site-to-Site VPN to an AWS Transit Gateway allows enabling Equal-Cost Multi-Path (ECMP) routing. This allows the system to distribute traffic across multiple active tunnels simultaneously.

By using at least two active VPN tunnels with ECMP, the combined throughput can scale beyond

1.25\text{ Gbps}

to meet the

2\text{ Gbps}

requirement.

Key Concept

AWS Transit Gateway ECMP routing allows scaling Site-to-Site VPN throughput beyond the

1.25\text{ Gbps}

limit of a single tunnel by load balancing traffic across multiple active tunnels.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic