Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of 3030 spoke VPCs in a single AWS Region, divided into Production and Development workloads. The on-premises network must connect to the AWS environment using a 10 Gbps10\text{ Gbps} AWS Direct Connect connection as the primary path and an IPsec VPN over the internet as a backup path. The network design must support transitive VPC-to-VPC routing, restrict the Development VPCs from accessing the on-premises network while allowing the Production VPCs full access, and support dynamic routing failover using BGP.

Which two options should the Solutions Architect select to meet these requirements?

  1. Deploy an AWS Transit Gateway, attach the spoke VPCs, and configure separate Transit Gateway route tables for the Production and Development VPC attachments to control route propagation and isolate development traffic from the on-premises connection.Answer
  2. Associate a Direct Connect Gateway with the AWS Transit Gateway, configure a Transit Virtual Interface (Transit VIF) for the primary connection, and establish an IPsec VPN connection on the Transit Gateway as a backup path, using BGP for dynamic failover.Answer
  3. C
    Associate a Direct Connect Gateway directly with the Virtual Private Gateways of each spoke VPC, and rely on the Direct Connect Gateway to enable transitive routing between the spoke VPCs and the on-premises datacenter.
  4. D
    Create a single Transit Gateway route table for all spoke VPCs, associate a Route 53 Private Hosted Zone with all VPCs, and use DNS routing policies to prevent the Development VPCs from resolving the IP addresses of on-premises resources.
  5. E
    Route all outbound traffic from all spoke VPCs to a single NAT Gateway deployed in a centralized Transit Gateway services VPC to minimize NAT Gateway costs and administrative overhead.

Answer

Deploy an AWS Transit Gateway with separate route tables for the Production and Development VPC attachments, and associate a Direct Connect Gateway with the Transit Gateway using a Transit VIF while setting up a Transit Gateway VPN connection utilizing BGP for dynamic failover.
To achieve transitive routing and network segmentation for 3030 spoke VPCs, an AWS Transit Gateway is deployed. Spoke VPCs are attached to the Transit Gateway, and separate route tables are configured for Production and Development VPCs to block Development traffic from routing to the on-premises network. For the hybrid connection, a Direct Connect Gateway is associated with the Transit Gateway using a Transit VIF to establish the primary 10 Gbps10\text{ Gbps} link. A Site-to-Site VPN is configured as a Transit Gateway attachment to serve as the backup link, with BGP managing dynamic failover.

Step-by-Step Solution

1
Evaluate the requirement for transitive routing and scale.
Identify AWS Transit Gateway as the central hub to support VPC-to-VPC and hybrid transitive routing for 3030 VPCs.
Direct Connect Gateway alone does not support transitive routing between attached VPCs.
2
Design route isolation between Production and Development workloads.
Configure separate Transit Gateway route tables. Associate Development VPCs with a route table that does not propagate the on-premises route, and associate Production VPCs with a route table that does propagate it.
This implements network-level isolation, preventing Development workloads from reaching on-premises resources.
3
Establish the primary and backup hybrid connectivity paths with dynamic failover.
Associate the Direct Connect Gateway with the Transit Gateway via a Transit VIF (primary), and configure an IPsec VPN attachment on the Transit Gateway (backup) with BGP routing enabled on both.
BGP ensures dynamic path selection and automatically switches traffic to the VPN backup path if the Direct Connect link fails.

Key Concept

AWS Transit Gateway acts as a cloud router supporting transitive routing, route isolation via multiple route tables, and dynamic failover by combining Direct Connect Gateways (via Transit VIFs) and IPsec VPNs using BGP routing.
Estimated Time:3m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic