A logistics company has migrated its inventory management systems to AWS, distributing the… — AWS Certified Solutions Architect - Associate

A logistics company has migrated its inventory management systems to AWS, distributing the workload across $20$ VPCs in the us-west-2 Region. The company needs to establish private connectivity between these VPCs and its on-premises data center, which has an existing $10\text{ Gbps}$ AWS Direct Connect connection. The database synchronization process requires a minimum, consistent throughput of $3\text{ Gbps}$ . The solution must easily scale to accommodate up to $50$ VPCs in the future with minimal routing complexity and administrative overhead. Additionally, the network security policy mandates stateful traffic filtering at the instance level and stateless filtering at the subnet boundary. Which of the following network architectures meets these requirements?

Attach the $20$ VPCs to an AWS Transit Gateway. Connect the Transit Gateway to a Direct Connect Gateway using a Transit Virtual Interface (Transit VIF) on the Direct Connect connection. Configure Security Groups to statefully inspect traffic at the instance level and Network ACLs to statelessly filter traffic at the subnet boundary.Answer
B
Establish an AWS Site-to-Site VPN connection over the Direct Connect connection to an AWS Transit Gateway, and attach the $20$ VPCs to the Transit Gateway. Configure Network ACLs to statefully filter traffic at the instance level and Security Groups to statelessly filter traffic at the subnet boundary.
C
Create a full mesh of VPC Peering connections between the $20$ VPCs. Create a Private Virtual Interface (Private VIF) on the Direct Connect connection to a central transit VPC to route traffic to the on-premises data center. Configure Route 53 latency routing policies to direct traffic between subnets.
D
Provision $20$ separate Private Virtual Interfaces (Private VIFs) on the Direct Connect connection, connecting each VIF directly to a Virtual Private Gateway (VGW) in each VPC. Configure Security Groups to statelessly filter traffic at the subnet boundary.

Answer

The correct network architecture is to attach all VPCs to an AWS Transit Gateway, connect it to a Direct Connect Gateway using a Transit Virtual Interface (Transit VIF), and use Security Groups for stateful instance-level security and Network ACLs for stateless subnet-level security.

The correct architecture uses AWS Transit Gateway to act as a centralized cloud router, which supports up to

50\text{ Gbps}

of throughput per VPC attachment and easily scales up to thousands of VPCs, meeting both the throughput and scalability requirements. Connecting the Transit Gateway to the

10\text{ Gbps}

Direct Connect connection requires a Direct Connect Gateway and a Transit Virtual Interface (Transit VIF). To satisfy the security requirements, Security Groups are configured at the instance level for stateful filtering, and Network ACLs are configured at the subnet level for stateless filtering.

Step-by-Step Solution

Analyze the scaling and routing complexity requirements for connecting

20

(scaling to

50

) VPCs to an on-premises data center.

A full mesh VPC Peering scales poorly and lacks transitive routing. A Direct Connect Gateway associated with Virtual Private Gateways is limited to

10

associations. AWS Transit Gateway provides a hub-and-spoke model that scales to thousands of VPCs.

To identify a network topology that supports the required scale and reduces routing complexity.

Evaluate the bandwidth and connection requirements (

3\text{ Gbps}

throughput over a

10\text{ Gbps}

Direct Connect line).

A single Site-to-Site VPN tunnel is limited to

1.25\text{ Gbps}

, which fails the requirement. Direct Connect with a Transit VIF to AWS Transit Gateway supports the full Direct Connect line speed, with Transit Gateway supporting up to

50\text{ Gbps}

per VPC attachment.

To ensure the network path meets the database replication performance constraints.

Apply security rules for stateful instance-level and stateless subnet-level filtering.

Security Groups are stateful and apply to elastic network interfaces (instance level). Network ACLs are stateless and apply at the subnet boundary.

To satisfy the security policy requirements correctly using AWS native security components.

Key Concept

Scalable hybrid network design using AWS Transit Gateway, Direct Connect Gateway with Transit VIF, and stateful vs stateless traffic filtering.

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic