Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network connectivity solution for its AWS Organization, which contains 10 spoke VPCs in a single AWS Region. The enterprise needs to establish communication between all spoke VPCs and their on-premises datacenter. They have a 10 Gbps AWS Direct Connect connection at their datacenter. The solution must support VPC-to-VPC communication, enable connectivity to the on-premises datacenter for all VPCs over the single Direct Connect connection, and minimize administrative overhead. Which of the following actions should the solutions architect perform to meet these requirements? (Select TWO.)

  1. Create an AWS Transit Gateway, attach all spoke VPCs to the Transit Gateway, and configure VPC route tables to route traffic destined for other VPCs and on-premises to the Transit Gateway.Answer
  2. Create an AWS Direct Connect Gateway, associate the Direct Connect Gateway with the Transit Gateway, and provision a Transit Virtual Interface (Transit VIF) on the Direct Connect connection.Answer
  3. C
    Attach a Virtual Private Gateway (VGW) to each spoke VPC, associate all VGWs with a single Direct Connect Gateway, and configure the Direct Connect Gateway to route traffic between the spoke VPCs.
  4. D
    Deploy a single NAT Gateway in a central VPC, create a Private Virtual Interface (Private VIF) on the Direct Connect connection, and route all spoke-to-spoke and hybrid traffic through the NAT Gateway.
  5. E
    Create a Route 53 Private Hosted Zone (PHZ) in a centralized network account, associate the PHZ with the Direct Connect Gateway, and configure all VPCs to use the Direct Connect Gateway as their primary DNS resolver.

Answer

Create an AWS Transit Gateway and attach all spoke VPCs to it; then create an AWS Direct Connect Gateway, associate it with the Transit Gateway, and provision a Transit Virtual Interface (Transit VIF) on the Direct Connect connection.
To build a scalable and low-maintenance hybrid network supporting VPC-to-VPC routing, AWS Transit Gateway is the correct hub-and-spoke solution. Attaching the VPCs to Transit Gateway allows transitive traffic flow between them. To connect this hub to an on-premises datacenter over Direct Connect, a Direct Connect Gateway must be associated with the Transit Gateway, and a Transit VIF must be configured. This combination allows all spoke VPCs to utilize the single Direct Connect connection dynamically.

Step-by-Step Solution

1
Deploy AWS Transit Gateway in the target Region.
A centralized hub is established that can scale to connect multiple VPCs and VPN/Direct Connect connections.
Transit Gateway simplifies the network topology and supports transitive routing between VPCs.
2
Attach all 10 spoke VPCs to the Transit Gateway and configure their subnet route tables.
Inter-VPC communication is enabled by pointing non-local CIDR blocks to the Transit Gateway attachment.
This allows any-to-any communication between the spoke VPCs and sets up the paths for hybrid traffic.
3
Create an AWS Direct Connect Gateway and associate it with the Transit Gateway.
The Direct Connect Gateway is linked to the Transit Gateway, preparing it to handle traffic from the on-premises datacenter.
Direct Connect Gateway serves as a global resource to bridge Direct Connect VIFs with regional resources like Transit Gateways.
4
Provision a Transit Virtual Interface (Transit VIF) on the Direct Connect connection and connect it to the Direct Connect Gateway.
A BGP session is established between the on-premises router and the Direct Connect Gateway, advertising the prefixes.
A Transit VIF is required to support Transit Gateway attachments over AWS Direct Connect.

Key Concept

Transit Gateway and Direct Connect Gateway Integration using Transit VIF for Scalable Hybrid Connectivity
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic