Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

A financial services company has a hybrid architecture where their on-premises trading application must securely stream data feeds to a fleet of Amazon EC2 instances in a VPC. The stream requires a sustained throughput of 2 Gbps2\text{ Gbps} with minimal latency. Due to tight timelines, they must leverage their existing high-bandwidth internet connection rather than waiting to provision a dedicated fiber line. Additionally, they must ensure the return traffic is allowed dynamically while maintaining strict stateful traffic filtering. Which network architecture should a solutions architect recommend to meet these requirements?

  1. A
    Deploy a single Site-to-Site VPN connection and configure Amazon Route 53 with latency-based routing to dynamically load balance the trading traffic across the VPN tunnels to optimize performance.
  2. Deploy an AWS Transit Gateway and establish multiple AWS Site-to-Site VPN connections using Equal-Cost Multi-Path (ECMP) routing. Configure EC2 security groups to allow the trading traffic, relying on their stateful nature to permit return traffic automatically.Answer
  3. C
    Establish a single AWS Site-to-Site VPN connection with active-active tunnels directly to a Virtual Private Gateway, and configure the on-premises router to load balance traffic across both tunnels to achieve the required 2 Gbps2\text{ Gbps} throughput.
  4. D
    Deploy an AWS Transit Gateway with multiple VPN connections, and configure stateless Network ACLs on the subnets to bypass security group evaluation to optimize network throughput for the return traffic.

Answer

Deploy an AWS Transit Gateway with multiple AWS Site-to-Site VPN connections using Equal-Cost Multi-Path (ECMP) routing, and configure stateful EC2 security groups.
The correct option is the one recommending AWS Transit Gateway with multiple VPN connections and ECMP routing. AWS Site-to-Site VPN tunnels have a hard throughput limit of 1.25 Gbps1.25\text{ Gbps}. To scale bandwidth over existing internet connections, multiple VPN connections can be attached to an AWS Transit Gateway with ECMP enabled, allowing traffic to be distributed across up to 50 paths. Utilizing security groups ensures stateful filtering, which automatically allows dynamic return traffic.

Step-by-Step Solution

1
Evaluate the throughput requirement against VPN tunnel limitations.
The target is 2 Gbps2\text{ Gbps}, which exceeds the 1.25 Gbps1.25\text{ Gbps} maximum limit of a single AWS VPN tunnel.
Identifying the single tunnel bottleneck determines that a multi-tunnel or alternative path is required.
2
Select the scaling mechanism to aggregate VPN throughput over the internet.
Combine multiple VPN connections using AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing.
ECMP on Transit Gateway allows active-active load balancing across multiple tunnels, enabling total throughput to scale past 1.25 Gbps1.25\text{ Gbps}.
3
Address the traffic filtering and dynamic return traffic requirement.
Utilize stateful EC2 security groups to filter the traffic.
Security groups are stateful and automatically track connections to allow dynamic return traffic, whereas Network ACLs are stateless and would block return traffic unless a broad range of ports is manually opened.

Key Concept

Scaling VPN throughput using AWS Transit Gateway ECMP routing while maintaining stateful traffic filtering.
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic