Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

A retail company hosts its primary database in a VPC within the us−east−1us-east-1 Region. The company needs to replicate database logs continuously to a disaster recovery VPC in the us−west−2us-west-2 Region. The replication traffic is highly variable, regularly peaking at 2.5 Gbps2.5\text{ Gbps}. To comply with corporate policies, all data must be encrypted in transit, must not traverse the public internet, and must travel over a private network connection that can scale dynamically to support peak traffic. Which network configuration meets these requirements with the lowest operational complexity?

  1. Establish an Inter-Region VPC Peering connection between the two VPCs and route the replication traffic directly over the peering connection.Answer
  2. B
    Deploy a Site-to-Site VPN connection between the VPCs using AWS Transit Gateway in both regions to encrypt the replication traffic.
  3. C
    Configure software-based VPN appliances on Amazon EC2 instances in each VPC, and route traffic using public IP addresses with Network ACLs to restrict access.
  4. D
    Establish an AWS Direct Connect connection with an IPsec VPN between the two VPCs, and configure Amazon Route 53 latency-based routing to resolve the replica endpoints.

Answer

Establish an Inter-Region VPC Peering connection between the two VPCs and route the replication traffic directly over the peering connection.
Establishing an Inter-Region VPC Peering connection is the most efficient solution because it routes traffic over the private AWS global network backbone, avoiding the public internet. Inter-Region VPC Peering traffic is automatically encrypted at the physical layer. It does not have any bandwidth throughput bottlenecks, meaning it easily handles the 2.5 Gbps2.5\text{ Gbps} peak traffic without requiring additional infrastructure configuration.

Step-by-Step Solution

1
Analyze the bandwidth requirement.
The replication traffic peaks at 2.5 Gbps2.5\text{ Gbps}, which exceeds the 1.25 Gbps1.25\text{ Gbps} limit of a single AWS Site-to-Site VPN tunnel.
This rules out solutions relying on a standard single VPN tunnel configuration without complex multipath routing.
2
Evaluate the path and encryption requirements.
The network path must be private (not over the public internet) and encrypted in transit.
Inter-Region VPC Peering traverses the private AWS global network backbone and is encrypted at the physical layer by default, meeting both criteria.
3
Compare scaling and operational complexity.
Inter-Region VPC Peering requires no additional network appliances or gateways to scale, representing the lowest operational complexity.
Unlike VPNs or custom EC2-based solutions, VPC Peering handles bandwidth scaling transparently.

Key Concept

AWS Inter-Region VPC Peering features built-in physical layer encryption and scales without throughput limits across the AWS global network backbone.
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic