Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A company is designing a network architecture to connect 1212 spoke VPCs spread across 33 AWS accounts in a single AWS Region. The architecture must support low-latency, any-to-any communication between the VPCs and provide a highly available, dedicated connection to their on-premises data center. The solutions architect must minimize administrative overhead and ensure that routing scales easily as new spoke VPCs are added. Which of the following architectures meets these requirements?

  1. A
    Deploy a centralized AWS Direct Connect Gateway and associate it directly with the virtual private gateways of all 1212 spoke VPCs using private virtual interfaces, relying on the Direct Connect Gateway to route traffic between the spoke VPCs and the on-premises data center.
  2. B
    Establish a full mesh of VPC peering connections between all 1212 spoke VPCs to handle inter-VPC communication. Connect the on-premises data center to a central hub VPC using a Direct Connect Gateway and a transit virtual interface, and configure a Route 5353 Private Hosted Zone in the hub VPC without associating it with the spoke VPCs.
  3. Provision an AWS Transit Gateway in a centralized network account, share it with the other accounts using AWS Resource Access Manager (RAM), and attach the spoke VPCs. Associate the Transit Gateway with an AWS Direct Connect Gateway connected to the on-premises data center via a transit virtual interface.Answer
  4. D
    Create a hub-and-spoke topology by sharing a Transit Gateway across accounts. Connect the Transit Gateway to the on-premises data center using a Site-to-Site VPN. Route all outbound internet and hybrid traffic through a single NAT Gateway located in a central egress VPC's single Availability Zone to minimize NAT charges.

Answer

Provision an AWS Transit Gateway in a centralized network account, share it with the other accounts using AWS Resource Access Manager (RAM), and attach the spoke VPCs. Associate the Transit Gateway with an AWS Direct Connect Gateway connected to the on-premises data center via a transit virtual interface.
The correct architecture leverages AWS Transit Gateway to act as a cloud router, providing any-to-any connectivity among the 1212 spoke VPCs. Sharing the Transit Gateway via AWS Resource Access Manager (RAM) allows the spoke VPCs in different accounts to attach to the same gateway seamlessly. To connect to the on-premises data center, a Direct Connect Gateway is associated with the Transit Gateway using a transit virtual interface (Transit VIF), which supports routing to multiple VPCs via the Transit Gateway over a dedicated, low-latency connection.

Step-by-Step Solution

1
Evaluate the requirement for any-to-any spoke VPC communication.
Identify that a hub-and-spoke routing mechanism is required. AWS Transit Gateway is the standard service for interconnecting multiple VPCs transitively, whereas Direct Connect Gateway or VPC Peering do not scale well or support transitive inter-VPC routing natively.
Transit Gateway simplifies the network topology and eliminates the need to manage a complex full mesh of VPC peering connections.
2
Determine the resource sharing mechanism for the multi-account setup.
Use AWS Resource Access Manager (RAM) to share the central Transit Gateway with the other 22 AWS accounts.
This allows spoke VPCs in different accounts to be attached to the same Transit Gateway, maintaining centralized network management while separating account boundaries.
3
Select the correct hybrid connectivity configuration for high-performance dedicated access.
Associate the Transit Gateway with an AWS Direct Connect Gateway connected via a transit virtual interface (Transit VIF).
Transit VIF is the only virtual interface type that supports Transit Gateway, enabling traffic from all attached spoke VPCs to flow to the on-premises data center via the Direct Connect Gateway.

Key Concept

Hub-and-Spoke hybrid network design using Transit Gateway, RAM, and Direct Connect Gateway with a Transit VIF to achieve scale, transitive routing, and high availability.
Estimated Time:2m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic