Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A financial services organization has a multi-account AWS environment with twenty VPCs in the us-east-1 region and ten VPCs in the us-west-2 region. The backend development teams require private, low-latency connectivity from their on-premises data center to all thirty VPCs. Additionally, applications in us-east-1 must communicate directly with databases in us-west-2. The network design must minimize BGP sessions, scale efficiently for future VPCs, and avoid routing inter-VPC traffic through the on-premises data center. Which network design meets these requirements?

  1. Deploy an AWS Transit Gateway in us-east-1 and another in us-west-2, and attach the local VPCs to their respective Transit Gateway. Create a Direct Connect Gateway, associate it with both Transit Gateways, and connect it to the on-premises network using a Transit Virtual Interface. Establish an inter-region Transit Gateway peering attachment between the two Transit Gateways.Answer
  2. B
    Create a Direct Connect Gateway and connect it to the on-premises network using a Private Virtual Interface. Create Virtual Private Gateways in each of the thirty VPCs and associate all of them with the Direct Connect Gateway. Establish a full mesh of VPC peering connections between all VPCs across both regions to handle inter-region traffic.
  3. C
    Deploy an AWS Transit Gateway in us-east-1 and another in us-west-2, and attach the local VPCs to their respective Transit Gateway. Create a Direct Connect Gateway, associate it with both Transit Gateways, and connect it to the on-premises network using two Private Virtual Interfaces on the Direct Connect connection.
  4. D
    Deploy an AWS Transit Gateway in us-east-1 and another in us-west-2, and attach the local VPCs to their respective Transit Gateway. Create a Direct Connect Gateway, associate it with both Transit Gateways, and connect it to the on-premises network using a Transit Virtual Interface. Configure the on-premises router to route and transit traffic between the two Transit Gateways to enable inter-VPC communication across regions.

Answer

Deploy regional AWS Transit Gateways connected to a Direct Connect Gateway via a Transit Virtual Interface, and peer the Transit Gateways for inter-region communication.
The correct architecture uses AWS Transit Gateways in each region to aggregate VPC attachments. By connecting both Transit Gateways to a single Direct Connect Gateway using a Transit Virtual Interface, you minimize BGP sessions and establish efficient hybrid routing. Establishing a Transit Gateway peering attachment ensures that cross-region inter-VPC traffic is routed directly over the AWS backbone, satisfying the requirement to avoid hair-pinning traffic through the on-premises router.

Step-by-Step Solution

1
Determine the scale and routing requirements for the hybrid topology.
Thirty VPCs across two regions require private connectivity to on-premises and direct, low-latency inter-VPC communication.
This rules out Virtual Private Gateways associated with a Direct Connect Gateway due to the 10-association limit.
2
Choose the correct Direct Connect virtual interface type for Transit Gateway association.
A Transit Virtual Interface (Transit VIF) must be used to connect the Direct Connect Gateway to the regional Transit Gateways.
Private Virtual Interfaces are incompatible with Transit Gateways and cannot be used for transit routing configurations.
3
Establish direct inter-region VPC routing path.
Configure a Transit Gateway peering attachment between the Transit Gateways in us-east-1 and us-west-2.
This routes cross-region VPC traffic over the AWS global network backbone, avoiding routing through the on-premises data center.

Key Concept

Design of scalable hybrid connectivity using Transit Gateways, Transit VIFs, and Transit Gateway Peering across multiple regions.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic