A media production company needs to transfer large raw video files (averaging 50\text{ GB}… — AWS Certified Solutions Architect - Associate

A media production company needs to transfer large raw video files (averaging $50\text{ GB}$ each) from its on-premises editing studio to Amazon S3. The file transfer process requires a secure, encrypted connection over the internet with a minimum throughput of $2\text{ Gbps}$ to meet production deadlines. The solutions architect must also ensure that only the studio's public IP range ( $198.51.100.0/24$ ) can initiate inbound network connections to the destination resources in the VPC. Which configuration should the solutions architect recommend to meet these requirements with the highest network performance?

Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, using multiple VPN tunnels to distribute traffic. Configure stateful Security Groups on the destination resources to allow inbound traffic from the studio's IP range of $198.51.100.0/24$ .Answer
B
Establish a single AWS Site-to-Site VPN connection directly to a Virtual Private Gateway in the VPC to support the $2\text{ Gbps}$ transfer. Configure stateful Security Groups on the destination resources to allow inbound traffic from the studio's IP range of $198.51.100.0/24$ .
C
Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled. Configure a stateless Network Access Control List (NACL) on the destination subnet to allow inbound traffic from the studio's IP range of $198.51.100.0/24$ , relying on the stateless nature of the NACL to automatically permit all return traffic.
D
Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled. Use Amazon Route 53 latency routing to distribute file upload requests across the VPN tunnels to optimize performance and ensure failover, without configuring Route 53 health checks.

Answer

Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, using multiple VPN tunnels to distribute traffic. Configure stateful Security Groups on the destination resources to allow inbound traffic from the studio's IP range.

The correct answer correctly addresses both the throughput and filtering constraints. To exceed the

1.25\text{ Gbps}

limit of a single AWS Site-to-Site VPN tunnel, you must deploy the VPN over an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing. This configuration scales bandwidth by allowing active-active routing over multiple tunnels. Additionally, utilizing stateful Security Groups ensures that inbound traffic is restricted to the studio's IP range while automatically allowing outbound responses without manually opening ephemeral port ranges.

Step-by-Step Solution

Evaluate the throughput requirement against AWS Site-to-Site VPN limitations.

Identify that a single AWS VPN tunnel has a hard limit of

1.25\text{ Gbps}

. Since the requirement is

2\text{ Gbps}

, a single standard VPN connection is insufficient.

Ensures that the design does not violate physical performance boundaries of AWS VPN endpoints.

Determine the routing mechanism to aggregate VPN throughput.

Select AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, which dynamically balances traffic across multiple VPN tunnels, allowing throughput to scale beyond

1.25\text{ Gbps}

ECMP is required to bundle multiple tunnels and achieve active-active path distribution for high throughput.

Determine the network filtering security mechanism to restrict access while ensuring return traffic flow.

Choose stateful Security Groups to allow inbound traffic from

198.51.100.0/24

. Security Groups automatically track connection state and allow return traffic dynamically.

Avoids the configuration overhead and potential connection drop issues associated with stateless Network ACLs.

Key Concept

Scalable Hybrid Connectivity and Network Filtering Statefulness

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic