A logistics company is designing a hybrid network architecture to synchronize its on-premi… — AWS Certified Solutions Architect - Associate

A logistics company is designing a hybrid network architecture to synchronize its on-premises telemetry processing system in Chicago with a critical analytics application deployed across multiple VPCs in the `us-east-1` and `us-west-2` Regions. The telemetry system requires a high-throughput, private connection that can support peak data transfer rates of up to $10 \text{ Gbps}$ with the lowest possible latency. Meanwhile, several regional distribution centers must upload transactional logs to the same VPCs. The regional logs require IPsec encryption and need a connection that can handle up to $2 \text{ Gbps}$ of aggregate traffic. Which network architecture will meet these requirements while optimizing throughput, securing data in transit, and minimizing routing complexity?

A
Provision an AWS Direct Connect connection with a Private Virtual Interface (Private VIF) to a Direct Connect Gateway associated with both Regions. Connect the regional distribution centers using a single AWS Site-to-Site VPN connection to a Virtual Private Gateway (VGW) in each VPC, relying on the single VPN tunnel to dynamically scale and support the aggregate $2 \text{ Gbps}$ upload throughput.
B
Provision peered AWS Transit Gateways across both Regions. Connect the Chicago database using AWS Direct Connect and the regional distribution centers using AWS Site-to-Site VPN. Apply stateless Network ACLs to the Transit Gateway subnets to block all ephemeral ports on return traffic while permitting inbound traffic, assuming the connection states will be maintained automatically.
Provision peered AWS Transit Gateways across both Regions. Attach the Chicago telemetry system to the Transit Gateways using an AWS Direct Connect connection with a Transit Virtual Interface (Transit VIF) attached to a Direct Connect Gateway. Connect the regional distribution centers using multiple AWS Site-to-Site VPN connections to the Transit Gateways with Equal-Cost Multi-Path (ECMP) routing enabled to aggregate tunnel throughput.Answer
D
Provision an AWS Direct Connect connection with a Private Virtual Interface (Private VIF) for the Chicago database connection. For the regional distribution centers, set up Amazon Route 53 Latency-based routing to resolve API endpoints directly to the public IP addresses of the application servers over the public internet, relying on the latency routing policy to secure in-transit data and provide failover.

Answer

The architecture that provisions peered AWS Transit Gateways with a Direct Connect Transit VIF and ECMP-enabled VPN connections is the correct choice.

The correct architecture uses peered AWS Transit Gateways across the target Regions to simplify routing to multiple VPCs. It leverages AWS Direct Connect with a Transit VIF and a Direct Connect Gateway to provide the required

10 \text{ Gbps}

private, low-latency connection. To support the

2 \text{ Gbps}

IPsec VPN bandwidth requirement, it implements AWS Site-to-Site VPN connections to the Transit Gateways with Equal-Cost Multi-Path (ECMP) routing enabled, which aggregates the throughput of multiple VPN tunnels to bypass the

1.25 \text{ Gbps}

limit per tunnel.

Step-by-Step Solution

Analyze connectivity and performance requirements.

The telemetry system requires

10 \text{ Gbps}

of private, low-latency throughput. The regional distribution centers require encrypted paths supporting

2 \text{ Gbps}

of aggregate traffic across multiple VPCs in two Regions.

This establishes the throughput thresholds and encryption constraints for both connection types.

Evaluate the primary Direct Connect configuration.

A Transit VIF associated with a Direct Connect Gateway connected to peered Transit Gateways is required to access multiple VPCs across two Regions at

10 \text{ Gbps}

A Private VIF cannot connect to a Transit Gateway, which is necessary for scalable multi-VPC and multi-Region architectures.

Evaluate the Site-to-Site VPN throughput limitation.

A single VPN tunnel is limited to

1.25 \text{ Gbps}

of throughput. To achieve

2 \text{ Gbps}

, Equal-Cost Multi-Path (ECMP) routing must be enabled on the Transit Gateway to aggregate bandwidth over multiple VPN tunnels.

This overcomes the bandwidth limitation of a single VPN connection.

Assess security and routing options.

Stateless Network ACLs cannot track connection states, and Route 53 Latency routing does not provide secure IPsec tunnels.

Using peered Transit Gateways with ECMP-enabled VPN and Direct Connect with a Transit VIF is the only architecture that satisfies all constraints.

Key Concept

High-Performing and Scalable Hybrid Networks

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic