Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

A financial services organization is establishing a secure hybrid network connection between its on-premises trading platform and a VPC in the AWS Cloud. The application requires a minimum encrypted throughput of 2.0 Gbps2.0 \text{ Gbps} to replicate time-sensitive market feeds. Additionally, the network engineering team must implement stateless traffic filtering at the subnet level to restrict inbound access. Which design will meet these requirements with the lowest administrative complexity?

  1. Establish multiple AWS Site-to-Site VPN connections to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing to aggregate the tunnel throughput. Set up Network Access Control Lists (NACLs) on the subnets to enforce stateless traffic filtering.Answer
  2. B
    Deploy a single AWS Site-to-Site VPN connection with two active tunnels configured in an active-active routing setup to the VPC Virtual Private Gateway (VGW). Set up Network Access Control Lists (NACLs) on the subnets to enforce stateless traffic filtering.
  3. C
    Establish multiple AWS Site-to-Site VPN connections to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing to aggregate the tunnel throughput. Define security groups on the EC2 instances to enforce stateless inbound filtering at the subnet level.
  4. D
    Establish a single AWS Site-to-Site VPN connection to a virtual private gateway. Configure Amazon Route 53 with latency-based routing and health checks to dynamically distribute the market data traffic across the tunnels.

Answer

Establish multiple AWS Site-to-Site VPN connections to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing to aggregate the tunnel throughput, and set up Network Access Control Lists (NACLs) on the subnets to enforce stateless traffic filtering.
The correct answer combines AWS Transit Gateway and Equal-Cost Multi-Path (ECMP) routing, which allows the dynamic distribution of traffic across multiple active Site-to-Site VPN connections. This bypasses the 1.25 Gbps1.25 \text{ Gbps} limit of a single VPN tunnel to meet the 2.0 Gbps2.0 \text{ Gbps} requirement. Using Network Access Control Lists (NACLs) correctly provides the required stateless filtering at the subnet boundaries.

Step-by-Step Solution

1
Analyze the throughput requirement of 2.0 Gbps2.0 \text{ Gbps} and the encryption requirement.
A single AWS Site-to-Site VPN tunnel has a maximum throughput of 1.25 Gbps1.25 \text{ Gbps}. To meet the 2.0 Gbps2.0 \text{ Gbps} requirement, multiple VPN tunnels must be aggregated.
Identifying the hardware and service constraints of AWS VPN connections.
2
Determine the routing mechanism to aggregate multiple VPN tunnels.
AWS Transit Gateway supports Equal-Cost Multi-Path (ECMP) routing, allowing traffic to be balanced across multiple VPN tunnels to achieve aggregate throughput exceeding 1.25 Gbps1.25 \text{ Gbps}.
Enabling high performance and scalability for hybrid network architectures.
3
Identify the requirement for stateless traffic filtering at the subnet level.
Network Access Control Lists (NACLs) operate at the subnet level and are stateless, whereas security groups are stateful and operate at the instance level.
Selecting the correct security control that meets the stateless and subnet-level requirements.

Key Concept

To scale VPN throughput beyond 1.25 Gbps1.25 \text{ Gbps}, you must use AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing to distribute traffic across multiple Site-to-Site VPN tunnels. Stateless network filtering at the subnet level is achieved using Network Access Control Lists (NACLs).
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic