Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A financial services company is designing a hybrid network connectivity architecture to connect its on-premises data center to its AWS environment. The AWS environment consists of a Production VPC in us-east-1 and a Development VPC in us-west-2, both attached to a central AWS Transit Gateway. The primary path must use an AWS Direct Connect connection with 1 Gbps1\text{ Gbps} bandwidth, and an IPsec VPN over the public internet must serve as a backup path. Both paths connect to the same AWS Transit Gateway. The company wants to ensure that the IPsec VPN is used only if the Direct Connect connection fails, without requiring manual administrative intervention during failover. Which configuration will achieve this routing behavior automatically?

  1. Configure BGP on both the Direct Connect virtual interface and the VPN connection to advertise the same on-premises prefixes. The Transit Gateway will automatically prefer the Direct Connect Gateway path over the VPN path due to the default AWS route source evaluation order.Answer
  2. B
    Configure dynamic BGP routing over the Direct Connect connection, and define static routes with a lower administrative distance pointing to the VPN connection in the Transit Gateway route table.
  3. C
    Associate the Route 53 Private Hosted Zone with both VPCs and use Route 53 failover routing policies to resolve the hybrid endpoints, switching traffic to the VPN endpoint if the Direct Connect resolver endpoint becomes unhealthy.
  4. D
    Deploy a single NAT Gateway in the public subnet of the Production VPC, and establish the backup IPsec VPN connection through this NAT Gateway to handle outbound hybrid traffic if the Direct Connect connection fails.

Answer

Configure BGP on both the Direct Connect virtual interface and the VPN connection to advertise the same on-premises prefixes. The Transit Gateway will automatically prefer the Direct Connect Gateway path over the VPN path due to the default AWS route source evaluation order.
When a Transit Gateway receives identical prefixes from both a Direct Connect Gateway and an IPsec VPN connection, AWS evaluates the route source. In the route evaluation order, Transit Gateway automatically prioritizes Direct Connect Gateway attachments over VPN attachments for identical CIDR blocks. By advertising the same prefixes over both BGP sessions, failover occurs dynamically and automatically without manual intervention or static routing conflicts.

Step-by-Step Solution

1
Establish BGP sessions over both the Direct Connect connection and the IPsec VPN connection to the Transit Gateway.
On-premises routes are dynamically propagated to the Transit Gateway.
Dynamic routing using BGP allows the Transit Gateway to automatically detect path availability and perform failover.
2
Advertise identical prefixes from the on-premises router over both paths.
The Transit Gateway receives the same routing destinations from both attachments.
Advertising identical prefixes allows the Transit Gateway to evaluate and compare the two paths using its default route preference logic.
3
Rely on the AWS Transit Gateway route selection algorithm to determine the primary path.
Traffic defaults to the Direct Connect Gateway attachment and falls back to the VPN attachment upon failure.
For identical prefix lengths, Transit Gateway prioritizes Direct Connect Gateway routes over VPN routes by default.

Key Concept

AWS Transit Gateway route evaluation order and source preference for hybrid connectivity.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic