Examkin

Question

Difficulty: Very hardHybrid and Multi-Account Network Connectivity Design

A multinational pharmaceutical company is designing a highly available, multi-region hybrid network. The company has 4545 spoke VPCs in the `eu-west-2` Region and 2525 spoke VPCs in the `ap-southeast-1` Region, all managed under a single AWS Organization. The company requires primary connectivity to on-premises data centers in London and Singapore via dedicated 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connections using Transit virtual interfaces (VIFs) connected to a shared Direct Connect Gateway (DXGW). An IPsec VPN over the public internet must serve as the backup connection for each region. A centralized Route 53 Private Hosted Zone (PHZ) for internal tooling (`corp.internal`) is hosted in a shared services account in `eu-west-2` and must be resolvable by all spoke VPCs in both regions.

The design must satisfy the following requirements:
* On-premises traffic must always prefer the Direct Connect path over the backup VPN when the Direct Connect connection is healthy.
* Spoke VPCs must route to their local regional data center but must be restricted from using the cross-region Transit Gateway peering connection to reach the remote regional data center.
* In the event of a regional Direct Connect outage, traffic must fail over to the local IPsec VPN instead of routing transitively through the peer region's Direct Connect.
* DNS resolution for `corp.internal` must be available in all spoke VPCs without exposing the zone to the public internet.

Which two configurations should a Solutions Architect implement to meet these requirements?

  1. In each region, associate a Spoke VPC Route Table with all spoke VPC attachments. In this route table, add a route for the local on-premises CIDR pointing to the local Transit Gateway (TGW) attachment to the DXGW, and propagate the local VPN attachment. In the TGW peering route table, only propagate or add routes for the remote VPC CIDR blocks, excluding the remote on-premises network prefixes.Answer
  2. On the on-premises customer gateway routers, configure BGP local preference to prefer routes received via the Direct Connect Transit VIFs over those received via the backup VPN tunnels. For outbound traffic from AWS, rely on the Transit Gateway's default path selection, which automatically prefers the Direct Connect Gateway attachment over the VPN attachment for the same propagated prefix.Answer
  3. C
    Use the Direct Connect Gateway to perform transitive routing between the two regional Transit Gateways. In the Direct Connect Gateway, configure prefix filters to allow VPC-to-VPC routing across regions while blocking cross-region traffic from reaching the remote on-premises networks.
  4. D
    Associate the central Route 53 Private Hosted Zone (PHZ) in the shared services account with the Transit Gateway in each region, allowing all spoke VPCs connected to the Transit Gateways to resolve the hosted zone's records without further association.
  5. E
    Deploy a single shared transit VPC in each region containing a single NAT Gateway. Route all hybrid outbound traffic and backup VPN traffic from the spoke VPCs through the Transit Gateway to this NAT Gateway to centralize egress routing and reduce NAT Gateway hourly charges.

Answer

Configure separate Transit Gateway route tables to restrict remote on-premises routing over the peering attachment, configure BGP local preference on-premises to prefer Direct Connect for inbound traffic, rely on Transit Gateway's native preference of Direct Connect over VPN for outbound traffic, and associate the Route 53 Private Hosted Zone with each spoke VPC.
The correct architecture uses AWS Transit Gateway to manage multi-VPC and hybrid connectivity, and configures the TGW route tables to isolate local on-premises routes from the cross-region peering connection. For path preference, Transit Gateway naturally prefers Direct Connect Gateway attachments over VPN attachments for the same prefix, and BGP local preference on the customer gateways ensures the same preference for the reverse path. The Private Hosted Zone must be associated with the individual VPCs to enable DNS resolution.

Step-by-Step Solution

1
Configure the Transit Gateway (TGW) route tables in each region to control traffic flow.
By creating a dedicated Spoke VPC Route Table that only contains routes for the local on-premises network (via DX/VPN) and the remote VPCs (via TGW Peering), you prevent spoke VPCs from routing traffic to the remote on-premises data center over the peering connection.
This satisfies the requirement to restrict cross-region transit traffic to remote on-premises data centers.
2
Configure BGP routing parameters on the customer gateway routers for inbound traffic to AWS.
On-premises routers will prefer the Direct Connect path over the backup VPN because of the higher BGP local preference configured on the Direct Connect interfaces.
This ensures that traffic from the on-premises networks to AWS prefers the high-speed Direct Connect connection under normal operations.
3
Rely on AWS Transit Gateway's default route selection for outbound traffic from AWS.
AWS Transit Gateway automatically selects the Direct Connect Gateway path over the VPN path when the same prefix is propagated by both attachments.
This achieves automatic failover and failback for outbound AWS-to-on-premises traffic with zero additional BGP path tuning on the AWS side.
4
Associate the Route 53 Private Hosted Zone (PHZ) with all consumer spoke VPCs.
Cross-account authorization and association allow all spoke VPCs to resolve resources in the shared services zone.
Route 53 PHZs cannot be associated with Transit Gateways; they must be associated directly with VPCs.

Key Concept

AWS Transit Gateway route table design and path selection priority for hybrid networks using Direct Connect and backup VPNs.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic