A media company is migrating a high-throughput, low-latency live video streaming platform … — AWS Certified Solutions Architect - Associate

A media company is migrating a high-throughput, low-latency live video streaming platform to AWS. The platform requires high-speed connection between their on-premises broadcasting studio and their AWS VPC. The peak data transfer rate is expected to reach $8\text{ Gbps}$ during live events. The architecture must support maximum throughput, dynamic routing with automated failover, and high security. The solutions architect is designing the hybrid network connectivity using AWS Transit Gateway and AWS Direct Connect. The network security team requires strict traffic control at both the subnet boundary and the instance level. Which TWO configurations should the solutions architect implement to meet these requirements with optimal performance and resiliency?

Deploy an AWS Direct Connect connection with a Transit Virtual Interface (VIF) attached to an AWS Transit Gateway to enable high-speed routing to multiple VPCs.Answer
Configure stateful security groups at the instance level to allow streaming traffic, and implement stateless Network Access Control Lists (NACLs) at the subnet boundary to permit both inbound streaming traffic and outbound return traffic on ephemeral ports.Answer
C
Deploy an AWS Site-to-Site VPN connection and attach it to the AWS Transit Gateway as the primary path, relying on the VPN tunnel to dynamically scale its throughput to handle the $8\text{ Gbps}$ peak bandwidth.
D
Implement Route 53 latency routing policies to route the ingress video upload traffic to the closest AWS Region, relying on Route 53's default routing metrics to automatically fail over and bypass unhealthy regions during an outage.
E
Configure stateless security groups at the instance level to block unauthorized traffic, while relying on stateful Network Access Control Lists (NACLs) at the subnet level to track connections and automatically allow return traffic.

Answer

The correct configurations are to deploy an AWS Direct Connect connection with a Transit Virtual Interface (VIF) attached to an AWS Transit Gateway, and configure stateful security groups at the instance level combined with stateless Network Access Control Lists (NACLs) at the subnet boundary to permit both inbound streaming traffic and outbound return traffic on ephemeral ports.

The configuration using AWS Direct Connect with a Transit VIF attached to an AWS Transit Gateway is correct because it supports the high throughput requirements of

8\text{ Gbps}

by connecting to multiple VPCs over dedicated high-bandwidth lines. The configuration using stateful security groups and stateless Network Access Control Lists (NACLs) is correct because it aligns with AWS security best practices: security groups automatically allow return traffic statefully at the instance level, while NACLs at the subnet boundary are stateless and require explicit rules in both directions (including ephemeral port ranges) to permit return traffic.

Step-by-Step Solution

Evaluate the bandwidth and connectivity requirements for the on-premises migration.

Determined that the platform requires at least

8\text{ Gbps}

of throughput with low latency and dynamic routing.

Identifying throughput constraints helps rule out solutions with hard limits below

8\text{ Gbps}

, such as a single Site-to-Site VPN.

Select the appropriate hybrid connectivity model.

Selected AWS Direct Connect with a Transit Virtual Interface (VIF) attached to an AWS Transit Gateway.

AWS Direct Connect provides dedicated network connections up to

10\text{ Gbps}

100\text{ Gbps}

which can support the

8\text{ Gbps}

peak demand, and Transit Gateway simplifies routing management across multiple VPCs.

Configure network security controls at both the subnet and instance levels.

Implemented stateful security groups at the instance level and stateless Network ACLs (NACLs) at the subnet level.

This satisfies the requirement for strict traffic control. Security groups track connection states (stateful), while NACLs require explicit rules in both inbound and outbound directions to allow traffic and return paths (stateless).

Key Concept

Designing high-performing, scalable, and secure hybrid network architectures using AWS Direct Connect, Transit Gateway, stateful Security Groups, and stateless NACLs.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic