A company is setting up a hybrid network connection between their on-premises database and… — AWS Certified Solutions Architect - Associate

A company is setting up a hybrid network connection between their on-premises database and a VPC in AWS. They require a secure connection with a minimum throughput of $2\text{ Gbps}$ to replicate database logs. They provision a single AWS Site-to-Site VPN connection, but find that the throughput per tunnel does not meet their requirement. Which of the following options correctly identifies the throughput limit of a single AWS Site-to-Site VPN tunnel and the solution to scale the bandwidth?

A
A single VPN tunnel can scale dynamically to support up to $5\text{ Gbps}$ of throughput by increasing the MTU size on the virtual private gateway, so no additional tunnels are necessary.
B
A single VPN tunnel is limited to $1.25\text{ Gbps}$ due to stateful packet tracking. The company should replace all stateful Security Groups with stateless Network ACLs to allow the tunnel to scale up to $10\text{ Gbps}$ .
A single VPN tunnel is limited to a maximum throughput of $1.25\text{ Gbps}$ . To scale the throughput, the company should establish multiple VPN tunnels to an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing.Answer
D
A single VPN tunnel is limited to $1.25\text{ Gbps}$ . The company should implement Amazon Route 53 latency-based routing at the customer gateway to automatically distribute the VPN traffic across different AWS Regions.

Answer

A single VPN tunnel is limited to a maximum throughput of

1.25\text{ Gbps}

. To scale the throughput, the company should establish multiple VPN tunnels to an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing.

The correct option correctly states that each Site-to-Site VPN tunnel is limited to

1.25\text{ Gbps}

. To scale capacity beyond this point, multiple VPN connections can be attached to an AWS Transit Gateway. By enabling Equal-Cost Multi-Path (ECMP) routing on the Transit Gateway and the Customer Gateway, AWS can load balance packets across multiple tunnels, aggregating the overall bandwidth to meet or exceed the

2\text{ Gbps}

requirement.

Step-by-Step Solution

Identify the hard limit of a single AWS Site-to-Site VPN tunnel.

Each VPN tunnel supports a maximum bandwidth of

1.25\text{ Gbps}

Understanding the inherent physical and configuration limits of AWS networking services is necessary to determine if a simple setup meets the requirements.

Evaluate the required capacity against the single-tunnel limit.

The required database replication bandwidth (

2\text{ Gbps}

) exceeds the single-tunnel capacity of

1.25\text{ Gbps}

Comparing the target metric against the single-resource capability dictates the architectural pattern needed (scaling out).

Choose a scalable architecture to aggregate multiple tunnels.

Establish multiple VPN connections terminating at an AWS Transit Gateway with ECMP enabled.

Transit Gateway supports ECMP, which allows traffic to be dynamically distributed across multiple paths, effectively multiplying the overall connection throughput.

Key Concept

AWS Site-to-Site VPN throughput limits and Transit Gateway ECMP scaling

Estimated Time:1m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic