Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

An online multiplayer gaming studio is launching a new game server hosting platform in the us-west-2 Region. The gaming client applications require low-latency UDP communication with the server fleet. Additionally, the studio must establish a hybrid network link to their on-premises development office to transfer large game builds (up to 3 Gbps3\text{ Gbps} during peak hours) to private subnets in the VPC, while blocking specific external IPs known for malicious attacks at the subnet boundary. Which TWO actions should the solutions architect take to meet these requirements?

  1. Configure AWS Global Accelerator to route client traffic to a Network Load Balancer (NLB) targeting the game servers.Answer
  2. Establish a 10 Gbps10\text{ Gbps} AWS Direct Connect connection to the VPC, and configure a Network Access Control List (NACL) with deny rules for the malicious IP addresses.Answer
  3. C
    Establish a single AWS Site-to-Site VPN connection with a virtual private gateway to handle the game build transfers.
  4. D
    Configure the Security Groups of the game servers to explicitly deny inbound traffic from the malicious IP addresses.
  5. E
    Configure Amazon Route 53 with latency-based routing to resolve the client application connections directly to the game server instance public IP addresses.

Answer

Configure AWS Global Accelerator to route client traffic to a Network Load Balancer (NLB) targeting the game servers, and establish a 10 Gbps10\text{ Gbps} AWS Direct Connect connection to the VPC while configuring a Network Access Control List (NACL) with deny rules for the malicious IP addresses.
AWS Global Accelerator optimizes UDP routing by utilizing the AWS global network to route traffic to a Network Load Balancer (NLB) close to the game servers. AWS Direct Connect provides high, dedicated throughput (such as 10 Gbps10\text{ Gbps}) that easily accommodates the 3 Gbps3\text{ Gbps} build transfer requirement. Network Access Control Lists (NACLs) allow stateless deny rules to block specific malicious IP addresses at the subnet boundary.

Step-by-Step Solution

1
Evaluate the incoming client traffic requirement (low-latency UDP).
AWS Global Accelerator supports UDP traffic and routes it through the AWS global backbone network to a Network Load Balancer (NLB), minimizing latency.
Traditional DNS-based routing or ALBs cannot optimize UDP path latency and connection stability as effectively as Global Accelerator.
2
Analyze the hybrid throughput requirement of 3 Gbps3\text{ Gbps} peak traffic.
AWS Direct Connect can support bandwidth rates up to 10 Gbps10\text{ Gbps} or 100 Gbps100\text{ Gbps} directly.
A single AWS Site-to-Site VPN tunnel is limited to 1.25 Gbps1.25\text{ Gbps} maximum bandwidth, making it insufficient for the 3 Gbps3\text{ Gbps} demand.
3
Determine how to block malicious IP addresses at the subnet boundary.
Configure Network Access Control Lists (NACLs) with deny rules.
Security Groups only support allow rules and cannot explicitly deny traffic, whereas NACLs are stateless and can define explicit deny rules at the subnet boundary.

Key Concept

Designing scalable, low-latency, and high-throughput hybrid network architectures using AWS Global Accelerator, Direct Connect, and VPC NACLs.
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic