Examkin

Question

Difficulty: HardHigh-Performing and Scalable Network Architectures

A financial services company is establishing a hybrid network connection between its on-premises data center and a VPC in the AWS Cloud. The company needs to replicate a high-volume transactional database to AWS, requiring a continuous, secure, and encrypted bandwidth of at least 3 Gbps3\text{ Gbps} with minimal latency. The solutions architect decides to implement an AWS Site-to-Site VPN over an existing AWS Direct Connect connection.

Which configuration should the solutions architect implement to meet these performance and security requirements?

  1. Configure an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, associate it with a Direct Connect gateway using a transit virtual interface (VIF), and establish multiple Site-to-Site VPN connections terminating on the Transit Gateway.Answer
  2. B
    Attach a virtual private gateway (VGW) to the VPC, associate it with a Direct Connect gateway using a private virtual interface (VIF), and establish a single AWS Site-to-Site VPN connection to encrypt all replication traffic.
  3. C
    Deploy an AWS Site-to-Site VPN connection terminating on a virtual private gateway (VGW) and configure stateless Network Access Control Lists (NACLs) to automatically distribute and parallelize the database replication traffic across multiple private subnets.
  4. D
    Set up multiple active-active AWS Site-to-Site VPN connections and configure Amazon Route 53 with a latency-based routing policy to automatically route database replication traffic across the connections to optimize throughput.

Answer

Configure an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, associate it with a Direct Connect gateway using a transit virtual interface (VIF), and establish multiple Site-to-Site VPN connections terminating on the Transit Gateway.
The correct answer utilizes AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled. An AWS Site-to-Site VPN tunnel is restricted to a maximum throughput of 1.25 Gbps1.25\text{ Gbps}. To scale beyond this limit and achieve the required 3 Gbps3\text{ Gbps} bandwidth, multiple VPN tunnels must be established and aggregated. By terminating these VPN connections on an AWS Transit Gateway that has ECMP routing active and is connected via a transit virtual interface (VIF) to a Direct Connect gateway, the network can balance traffic across multiple tunnels, satisfying both the high-throughput performance requirement and the data encryption requirement over Direct Connect.

Step-by-Step Solution

1
Analyze the bandwidth constraint of the hybrid connection.
The replication workload requires at least 3 Gbps3\text{ Gbps} of encrypted bandwidth. A single AWS Site-to-Site VPN tunnel has a hard limit of 1.25 Gbps1.25\text{ Gbps} of throughput.
Identifying the 1.25 Gbps1.25\text{ Gbps} limit per IPsec tunnel ensures that a single VPN connection will not satisfy the 3 Gbps3\text{ Gbps} requirement.
2
Determine the scaling mechanism for VPN throughput.
AWS Transit Gateway supports Equal-Cost Multi-Path (ECMP) routing, which enables traffic to be dynamically balanced across multiple VPN tunnels.
By using ECMP on Transit Gateway, multiple VPN tunnels can be aggregated to achieve a cumulative throughput higher than 1.25 Gbps1.25\text{ Gbps}.
3
Integrate Transit Gateway with the AWS Direct Connect infrastructure.
Associate the Transit Gateway with a Direct Connect gateway utilizing a transit virtual interface (VIF).
A transit VIF is required to connect AWS Direct Connect to an AWS Transit Gateway, allowing the encrypted VPN tunnels to run over the private, low-latency Direct Connect circuit.

Key Concept

Scaling VPN throughput over AWS Direct Connect requires AWS Transit Gateway with ECMP enabled, routing over a transit virtual interface (VIF).
Estimated Time:2m 30s
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic