Examkin

Question

Difficulty: HardHigh-Performing and Scalable Network Architectures

A financial services company is designing a hybrid network architecture to connect its on-premises trading application in London to its AWS resources. The AWS environment consists of a primary production VPC in the `eu-west-1` Region and a disaster recovery VPC in the `us-east-1` Region. The on-premises application requires a primary, highly reliable connection with a minimum throughput of 5 Gbps5\text{ Gbps} to the `eu-west-1` Region. Additionally, the company requires a backup connection to `eu-west-1` that must support a minimum throughput of 2 Gbps2\text{ Gbps} during failover events. This backup path must also allow communication with the `us-east-1` VPC. Which two options should the solutions architect choose to meet these requirements?

  1. Provision an AWS Direct Connect connection with a 10 Gbps10\text{ Gbps} physical port to an AWS Direct Connect location in London, and configure a transit virtual interface (transit VIF) to an AWS Transit Gateway.Answer
  2. Set up an AWS Site-to-Site VPN connection terminating on an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, utilizing at least two active VPN tunnels.Answer
  3. C
    Configure a single AWS Site-to-Site VPN connection terminating on a Virtual Private Gateway (VGW) attached to the `eu-west-1` VPC to serve as the backup connection.
  4. D
    Use Amazon Route 53 latency routing policies without health checks to dynamically route database replication traffic between the primary Direct Connect path and the backup VPN path based on packet latency.
  5. E
    Configure a stateless Network Access Control List (NACL) at the subnet level to allow inbound traffic on the custom trading port, without adding a corresponding outbound rule, assuming the return traffic is automatically permitted.

Answer

Provision an AWS Direct Connect connection with a 10 Gbps10\text{ Gbps} physical port to an AWS Direct Connect location in London, configure a transit virtual interface to an AWS Transit Gateway, and set up an AWS Site-to-Site VPN connection terminating on an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, utilizing at least two active VPN tunnels.
To meet the 5 Gbps5\text{ Gbps} primary throughput requirement and route traffic to multiple VPCs across different Regions, the company must provision an AWS Direct Connect connection with a 10 Gbps10\text{ Gbps} port and link it via a transit virtual interface to an AWS Transit Gateway. To support the backup requirement of 2 Gbps2\text{ Gbps}, the company must use AWS Transit Gateway with ECMP routing enabled over multiple active VPN tunnels, since a single VPN tunnel has a performance limitation of 1.25 Gbps1.25\text{ Gbps}.

Step-by-Step Solution

1
Evaluate the primary bandwidth requirement.
The primary path requires at least 5 Gbps5\text{ Gbps} throughput, which exceeds standard VPN capabilities. This requires provisioning a dedicated 10 Gbps10\text{ Gbps} AWS Direct Connect connection.
Direct Connect provides high, consistent bandwidth and lower latency than internet-based connections.
2
Address the multi-Region routing requirement.
Attach the Direct Connect connection to an AWS Transit Gateway using a Transit Virtual Interface (transit VIF).
Transit Gateway allows central management of routing to multiple VPCs across different Regions (using Transit Gateway peering for the remote Region).
3
Evaluate the backup connection throughput requirement.
The backup connection must support 2 Gbps2\text{ Gbps} throughput. Since a single Site-to-Site VPN tunnel is limited to 1.25 Gbps1.25\text{ Gbps}, the solutions architect must terminate the VPN on Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing.
ECMP aggregates the throughput of multiple active VPN tunnels, allowing the total bandwidth to exceed the single-tunnel threshold of 1.25 Gbps1.25\text{ Gbps}.

Key Concept

Scaling hybrid network throughput using Direct Connect with Transit Gateway and scaling Site-to-Site VPN bandwidth beyond single-tunnel limits using ECMP on Transit Gateway.
Estimated Time:3m 0s
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic