Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

A company is designing a hybrid network architecture to connect its on-premises corporate office to an AWS VPC. The connection must support a minimum throughput of 2 Gbps2\text{ Gbps} for secure, encrypted data transfers. Additionally, the network design must implement stateless traffic filtering at the subnet boundary to restrict specific external IP address ranges from accessing internal resources.

Which TWO actions should the Solutions Architect take to meet these requirements?

  1. Create an AWS Transit Gateway and set up a Site-to-Site VPN connection with multiple VPN tunnels, enabling Equal-Cost Multi-Path (ECMP) routing to distribute the traffic.Answer
  2. Configure stateless Network Access Control Lists (Network ACLs) associated with the subnets to deny traffic from the restricted external IP ranges.Answer
  3. C
    Deploy a single AWS Site-to-Site VPN connection with one active IPsec tunnel to route the traffic directly to a Virtual Private Gateway (VGW).
  4. D
    Apply stateful Security Groups to the EC2 instances in the subnets to block incoming traffic from the restricted external IP ranges at the subnet boundary.
  5. E
    Use Amazon Route 53 latency-based routing policies to route traffic through the VPN tunnels to resolve throughput bottlenecks and provide subnet-level filtering.

Answer

Create an AWS Transit Gateway with a Site-to-Site VPN utilizing ECMP routing across multiple tunnels to exceed individual tunnel throughput limits, and configure stateless Network Access Control Lists (Network ACLs) at the subnet boundary.
To achieve a secure connection of 2 Gbps2\text{ Gbps}, the architect must use AWS Transit Gateway with multiple Site-to-Site VPN tunnels and ECMP routing enabled, which effectively pools the 1.25 Gbps1.25\text{ Gbps} bandwidth capacity of individual tunnels. Additionally, Network ACLs are the correct component to meet the requirement for stateless filtering at the subnet boundary.

Step-by-Step Solution

1
Evaluate the encryption and throughput requirements for the hybrid connection.
A throughput of 2 Gbps2\text{ Gbps} is required. A single AWS Site-to-Site VPN tunnel is limited to 1.25 Gbps1.25\text{ Gbps}. To scale capacity beyond this limit while maintaining encryption, multiple VPN tunnels must be aggregated using AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled.
This overcomes the standard bandwidth limits of a single VPN connection.
2
Determine the appropriate firewalling mechanism for stateless filtering at the subnet boundary.
Network Access Control Lists (Network ACLs) are stateless and operate at the subnet boundary.
This matches the requirement to perform stateless traffic filtering at the subnet boundary, whereas security groups are stateful and operate at the instance level.

Key Concept

Scaling VPN throughput using AWS Transit Gateway ECMP routing and implementing stateless subnet security boundaries with Network ACLs.
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic