Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

A logistics enterprise operates a multi-account AWS environment with 4040 spoke VPCs in the `us-east-1` Region and 2020 spoke VPCs in the `us-west-2` Region. The enterprise is designing a hybrid network to connect these VPCs to their on-premises data center. The connectivity design must meet the following requirements:

* Any-to-any VPC-to-VPC communication must be enabled within each region.
* Cross-region VPC-to-VPC traffic must be blocked.
* All VPCs in both regions must have redundant, high-bandwidth access to the on-premises data center.
* The hybrid path must utilize a primary 10 Gbps10\text{ Gbps} AWS Direct Connect connection with an IPsec VPN over the internet as a backup.
* Failover from Direct Connect to the VPN must be automatic and dynamic.
* Administrative overhead for routing configuration must be minimized.

Which TWO actions should the Solutions Architect perform to meet these requirements?

  1. Deploy an AWS Transit Gateway in `us-east-1` and another in `us-west-2`. Attach the regional spoke VPCs to their respective regional Transit Gateway. Create a single Direct Connect Gateway, associate it with both Transit Gateways, and establish Transit Virtual Interfaces (Transit VIFs) from the on-premises data center to the Direct Connect Gateway.Answer
  2. Establish AWS Site-to-Site VPN connections from the on-premises data center, terminating them as VPN attachments directly on each regional Transit Gateway. Configure BGP dynamic routing over both the Direct Connect and VPN connections, and utilize BGP attributes to ensure the Direct Connect path is preferred.Answer
  3. C
    Create a single Direct Connect Gateway and associate all 6060 spoke VPCs directly with the Direct Connect Gateway to enable VPC-to-VPC routing and on-premises connectivity, bypassing the need for Transit Gateways.
  4. D
    Establish an AWS Transit Gateway peering attachment between the Transit Gateway in `us-east-1` and the Transit Gateway in `us-west-2`. Route all on-premises traffic from `us-west-2` through the peered Transit Gateway in `us-east-1` to consolidate all hybrid traffic onto a single set of VPN connections.
  5. E
    Deploy a single non-redundant NAT Gateway in a centralized services VPC in `us-east-1` to act as the next hop for all outbound hybrid traffic from both regions, and configure static route tracking on the on-premises router to handle failover.

Answer

To design a resilient hybrid network that minimizes routing complexity and enforces isolation, the architect should deploy regional Transit Gateways associated with a single Direct Connect Gateway, and configure BGP-based Site-to-Site VPN connections directly to those Transit Gateways as a dynamic failover path.
The correct approach involves using regional Transit Gateways to manage intra-region routing. Associating them with a single Direct Connect Gateway enables both regions to access the data center. Because Direct Connect Gateway does not allow routing between its associated Transit Gateways, cross-region VPC-to-VPC traffic is blocked by default. Using dynamic BGP-based Site-to-Site VPN connections attached to the Transit Gateways provides an automated backup path. In Transit Gateway route tables, the Direct Connect Gateway path is naturally preferred over the VPN path for identical routes.

Step-by-Step Solution

1
Address regional any-to-any VPC connectivity.
Deploying regional Transit Gateways in `us-east-1` and `us-west-2` enables any-to-any communication within each region via VPC attachments.
Transit Gateway acts as a regional cloud router, simplifying spoke VPC management and routing compared to full-mesh peering.
2
Connect regional networks to on-premises while enforcing cross-region isolation.
Associate both regional Transit Gateways with a single Direct Connect Gateway using Transit VIFs.
Direct Connect Gateway does not support transitive routing between associated Transit Gateways, ensuring that cross-region VPC-to-VPC traffic is blocked while still allowing both regions to reach on-premises.
3
Implement a dynamic backup path.
Deploy BGP-enabled AWS Site-to-Site VPN connections terminated directly as VPN attachments on each Transit Gateway.
Using BGP ensures automatic path failover. Terminating VPN on the Transit Gateways aligns the backup path with the regional hubs.

Key Concept

Transit Gateway and Direct Connect Gateway route propagation and routing limitations (specifically, the lack of transitive routing between associated Transit Gateways on a Direct Connect Gateway).
Estimated Time:3m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic