A financial services company is designing a hybrid network architecture for its multi-acco… — AWS Certified Solutions Architect - Professional

A financial services company is designing a hybrid network architecture for its multi-account environment on AWS. The environment contains $35$ spoke VPCs in a single AWS Region: $15$ Production VPCs and $20$ Development VPCs. The company's on-premises infrastructure consists of a corporate headquarters connected via AWS Direct Connect and a backup recovery center connected via an IPsec VPN.

The network design must satisfy the following requirements:
- All spoke VPCs must have bi-directional connectivity with the corporate headquarters and the recovery center.
- Production VPCs must be able to communicate with each other.
- Development VPCs must be completely isolated from each other and from the Production VPCs.
- Administrative overhead for routing configuration must be minimized.

Which network architecture and routing configuration should the solutions architect implement?

A
Create an AWS Transit Gateway with the default route table and default route propagation enabled. Attach all Production VPCs, Development VPCs, the Direct Connect gateway, and the VPN to the Transit Gateway. Implement Network Access Control Lists (NACLs) in all Development VPC subnets to explicitly deny traffic from the CIDR blocks of all other Development and Production VPCs.
B
Create an AWS Direct Connect gateway and associate it with virtual private gateways in all $35$ spoke VPCs to enable hybrid connectivity. To implement VPC-to-VPC communication, establish a full mesh of VPC peering connections among the $15$ Production VPCs. For the $20$ Development VPCs, do not establish any VPC peering connections to ensure their isolation from each other.
Create an AWS Transit Gateway. Create three Transit Gateway route tables: Production, Development, and Hybrid. Associate the Production VPC attachments with the Production route table, and enable route propagation from the Production VPCs, the Direct Connect gateway, and the VPN. Associate the Development VPC attachments with the Development route table, and enable route propagation only from the Direct Connect gateway and the VPN. Associate the Direct Connect gateway and VPN attachments with the Hybrid route table, and enable route propagation from all Production and Development VPCs.Answer
D
Create an AWS Transit Gateway. Create two Transit Gateway route tables: Spoke and Hybrid. Associate all Production and Development VPC attachments with the Spoke route table, and enable route propagation for all VPC and hybrid attachments. Associate the Direct Connect gateway and VPN attachments with the Hybrid route table, and enable route propagation from the Production VPCs only. Configure security groups in the Development VPCs to deny inbound traffic from other Development VPC CIDR ranges.

Answer

Create an AWS Transit Gateway with three separate route tables (Production, Development, and Hybrid) to separate routing domains, thereby ensuring proper network isolation and hybrid connectivity.

The correct configuration uses an AWS Transit Gateway with three separate route tables to isolate traffic domains. The Production route table enables local VPC-to-VPC communication and hybrid routing. The Development route table does not propagate the Development VPCs, which prevents them from routing traffic to each other. The Hybrid route table propagates all VPCs to allow return traffic from the on-premises networks back to all spoke VPCs.

Step-by-Step Solution

Identify the connectivity and isolation requirements for the spoke VPCs and on-premises endpoints.

There are

15

Production VPCs that need inter-communication and hybrid access,

20

Development VPCs that need hybrid access but absolute isolation from each other and from Production, and corporate/recovery networks that need access to all VPCs.

Understanding the required traffic paths is necessary to design the routing domains.

Evaluate scale limitations of Direct Connect Gateway and VPC peering.

Direct Connect Gateway only supports up to

10

Virtual Private Gateway associations, and full-mesh VPC peering for

15

Production VPCs requires

105

peering connections, making both options unsuitable.

This rules out direct Direct Connect Gateway association and manual VPC peering at this scale.

Design Transit Gateway route tables for spoke isolation and hybrid routing.

Create three route tables: Production (associated with Production VPCs, propagating Production and hybrid paths), Development (associated with Development VPCs, propagating only hybrid paths to prevent spoke-to-spoke routing), and Hybrid (associated with hybrid connections, propagating all spoke VPCs so the hybrid network can route replies back).

This utilizes Transit Gateway route domain separation to meet the isolation and connectivity requirements with minimal administrative overhead.

Key Concept

AWS Transit Gateway route domain separation using multiple route tables to enforce traffic isolation in a multi-account spoke VPC architecture.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic