An international media broadcasting company is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of 50 spoke VPCs in a single AWS Region, which host various parts of a media processing pipeline. The company needs to establish a highly available, transitive connection between all VPCs and two on-premises sites: a primary production facility and a backup recovery center. The primary path must run over a 10 Gbps AWS Direct Connect connection. The backup path must use an IPsec VPN over the internet. The solution must minimize routing configuration complexity, automatically fail over to the backup path if the primary path is unavailable, and allow direct VPC-to-VPC communication. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)
- Deploy an AWS Transit Gateway and attach all 50 spoke VPCs to it. Create a Direct Connect gateway, associate it with a transit virtual interface (transit VIF) on the Direct Connect connection, and attach the Direct Connect gateway to the Transit Gateway.Answer
- Create an AWS Site-to-Site VPN connection and terminate it on the AWS Transit Gateway. Advertise the same on-premises network prefixes over both the Direct Connect gateway and the VPN connection, using AS PATH prepending on the backup VPN connection to ensure the Direct Connect path is preferred.Answer
- CEstablish VPC peering connections between all 50 spoke VPCs to enable inter-VPC traffic. Create a Direct Connect gateway and attach it to a virtual private gateway (VGW) in each spoke VPC to handle hybrid routing.
- DCreate a centralized egress VPC with a single NAT Gateway in one Availability Zone to route all outbound internet-bound traffic from the 50 spoke VPCs via the AWS Transit Gateway, modifying the spoke VPC route tables to point all 0.0.0.0/0 traffic to the Transit Gateway.