Examkin

Question

Difficulty: Very hardHybrid and Multi-Account Network Connectivity Design

A global retail corporation is migrating its legacy inventory management systems to AWS. The target architecture spans 6060 spoke VPCs distributed equally between `us-east-1` and `us-west-2` across separate member accounts under AWS Organizations. The corporation has established two AWS Direct Connect connections at separate colocation facilities to link their on-premises core datacenter to AWS. Workloads within the same Region require high-bandwidth, low-latency inter-VPC communication. However, security policy forbids direct inter-VPC traffic across different AWS Regions. The hybrid connectivity design must ensure that on-premises database synchronization occurs primarily over the Direct Connect path, with an IPsec VPN tunnel acting as an automated secondary failover route. Which TWO actions must a solutions architect take to configure this hybrid and multi-account network topology?

  1. Provision an AWS Transit Gateway in each Region, attach the regional spoke VPCs to it, and associate both Transit Gateways with a single Direct Connect Gateway that connects to the on-premises datacenter using Transit Virtual Interfaces.Answer
  2. Configure an AWS Site-to-Site VPN connection terminating on each Transit Gateway as a backup path, using Border Gateway Protocol (BGP) with AS Path prepending on the on-premises router for the VPN routes to ensure Direct Connect is preferred.Answer
  3. C
    Associate the Direct Connect Gateway directly with the Virtual Private Gateways (VGWs) of all 6060 spoke VPCs to bypass Transit Gateway data processing charges, and configure VPC peering for spoke-to-spoke routing.
  4. D
    Deploy a single centralized Route 53 Private Hosted Zone for on-premises resolution in the Organization management account, and rely on Transit Gateway route propagation to distribute DNS resolution to all spokes.
  5. E
    Provision a single NAT Gateway in a single Availability Zone inside a centralized egress VPC in each Region to route all outbound internet traffic from the local spoke VPCs, minimizing NAT Gateway provisioning costs.

Answer

To establish the required architecture, the solutions architect must deploy an AWS Transit Gateway in each Region to connect local spoke VPCs, associate both Transit Gateways with a single Direct Connect Gateway via Transit VIFs, and establish backup AWS Site-to-Site VPN connections terminating on the Transit Gateways using BGP routing with AS Path prepending to prefer the Direct Connect path.
To build a scalable and resilient multi-account hybrid topology, a Solutions Architect should leverage AWS Transit Gateway as a regional router to consolidate VPC attachments. A single Direct Connect Gateway can associate with up to three Transit Gateways using Transit Virtual Interfaces (Transit VIFs), solving the scaling limitation of Direct Connect Gateway to VGW associations (which is capped at 1010). To establish a backup path, Site-to-Site VPN connections can be terminated on the same Transit Gateways. By running dynamic BGP routing and prepending the AS path on the VPN advertisements, the Direct Connect path is preferred due to its shorter AS path length. This configuration ensures automatic failover to the VPN only if the Direct Connect connections become unavailable.

Step-by-Step Solution

1
Select the correct regional hubs to scale inter-VPC communication for the 6060 spoke VPCs.
Provision an AWS Transit Gateway in `us-east-1` and another in `us-west-2`, attaching the local 3030 spoke VPCs to their respective regional Transit Gateway.
This scales inter-VPC routing within each region under a hub-and-spoke model, avoiding the 1010-association limit of Direct Connect Gateway to VGWs and the overhead of a full VPC peering mesh.
2
Configure hybrid connectivity to the on-premises datacenter via Direct Connect.
Associate both regional Transit Gateways with a single Direct Connect Gateway utilizing Transit Virtual Interfaces (Transit VIFs).
A Transit VIF is required to carry traffic between a Direct Connect Gateway and a Transit Gateway, allowing multiple regional Transit Gateways to share the same hybrid connection.
3
Establish the backup hybrid path and configure active/passive routing preferences.
Deploy AWS Site-to-Site VPN connections terminating on each Transit Gateway. Configure BGP dynamic routing, and prepend the AS path on the VPN connection from the customer gateway.
Dynamic routing with BGP allows for automated failover. Prepending the AS path on the VPN path ensures AWS prefers the Direct Connect path because it presents a shorter BGP AS path.

Key Concept

Hybrid and Multi-Account Network Connectivity Design
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic