Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A financial services company is designing a hybrid network connectivity solution for its multi-account AWS environment. The environment consists of 3030 spoke VPCs spread across two AWS Regions: `us-east-1` and `us-west-2`. The company needs to connect these VPCs to their on-premises data center using an existing 10 Gbps10\text{ Gbps} AWS Direct Connect connection at a co-location facility. The solution must support dynamic routing, secure any-to-any VPC communication within and across Regions, provide automatic failover via an AWS Site-to-Site VPN, and minimize administrative overhead.

Which of the following configuration steps must the company implement to meet these requirements? (Select TWO.)

  1. Deploy an AWS Transit Gateway in each Region, peer the two Transit Gateways, and connect them to the on-premises data center via a Direct Connect Gateway using transit virtual interfaces (VIFs).Answer
  2. Establish an AWS Site-to-Site VPN connection terminating on the Transit Gateways as a backup path, and use Border Gateway Protocol (BGP) routing with AS Path prepending to prefer the Direct Connect path.Answer
  3. C
    Associate the Direct Connect Gateway directly with all 3030 spoke VPCs to enable transitive VPC-to-VPC routing across both Regions without deploying Transit Gateways.
  4. D
    Create a single centralized Route 53 Private Hosted Zone (PHZ) in the network hub account, and rely on AWS Resource Access Manager (RAM) to automatically share dynamic resolution across all spoke VPCs without manual PHZ-VPC associations.
  5. E
    Configure a centralized egress architecture using a single NAT Gateway in the primary Region's transit VPC, and route all AZ subnets in both Regions through it to minimize NAT Gateway provisioning costs.

Answer

Deploying an AWS Transit Gateway in each Region, peering them, and connecting them to a Direct Connect Gateway using transit virtual interfaces (VIFs), combined with establishing an AWS Site-to-Site VPN terminating on the Transit Gateways as a backup path configured with AS Path prepending.
Establishing AWS Transit Gateways in both Regions, peering them, and connecting them to a Direct Connect Gateway utilizing transit VIFs provides a fully transitive, scalable architecture that connects multiple accounts and Regions. Supplementing this with an AWS Site-to-Site VPN that terminates on the Transit Gateways with BGP and AS Path prepending ensures high-availability failover while preventing asymmetric routing and ensuring the Direct Connect path is preferred.

Step-by-Step Solution

1
Deploy Transit Gateways in the target Regions and peer them.
Establishes a regional transit hub that supports cross-Region transitive routing between spoke VPCs.
Direct VPC peering does not scale for 3030 VPCs, and Transit Gateway is required to enable cross-Region any-to-any communication.
2
Connect the Transit Gateways to the Direct Connect Gateway.
Links the hybrid on-premises connectivity to the transit network using transit VIFs.
Allows all spoke VPCs attached to the Transit Gateways to route traffic to the on-premises data center via the high-speed Direct Connect connection.
3
Configure AWS Site-to-Site VPN on the Transit Gateways with BGP routing and AS Path prepending.
Creates a backup route that is only active if the Direct Connect link fails.
Prevents asymmetric routing and ensures that high-speed Direct Connect is prioritized over the backup VPN link under normal operation.

Key Concept

Designing hybrid and multi-account transit networking using AWS Transit Gateway and Direct Connect Gateway with VPN failover.
Estimated Time:2m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic