A financial services firm is designing a hybrid network architecture to connect 30 spoke V… — AWS Certified Solutions Architect - Professional

A financial services firm is designing a hybrid network architecture to connect $30$ spoke VPCs in the `eu-west-1` Region to its on-premises data centers in London ( $172.16.10.0/24$ ) and Dublin ( $172.16.20.0/24$ ). Each spoke VPC is attached to a centralized AWS Transit Gateway (TGW) in the `eu-west-1` Region.

The architecture must meet the following requirements:
- The London data center must connect to AWS using a $10\text{ Gbps}$ AWS Direct Connect (DX) connection as the primary path, and a redundant IPsec VPN connection over the internet as a backup.
- The Dublin data center must connect to AWS using a separate $10\text{ Gbps}$ DX connection as the primary path, and a redundant IPsec VPN connection over the internet as a backup.
- If the local DX connection fails, traffic to and from that data center must fail over to its local VPN connection.
- A data center must only route traffic through the other data center's connections if both its local DX and VPN connections are unavailable.
- Asymmetric routing must be avoided, and BGP routing must be configured dynamically.

Which two configuration options should the solutions architect implement to meet these requirements? (Select TWO.)

Configure the customer gateway routers in both London and Dublin to advertise their respective local subnets to AWS with no AS-Path prepending over their local Direct Connect connection, prepended with two AS hops over their local VPN connection, and prepended with four AS hops over the remote location's connections.Answer
Configure the customer gateway routers in both London and Dublin to assign the highest BGP local preference to the AWS routes received via their local Direct Connect connection, a lower local preference to routes received via their local VPN connection, and the lowest local preference to routes received via the cross-facility connection.Answer
C
Create a full mesh of VPC Peering connections between all 30 spoke VPCs to allow inter-VPC traffic, and connect each VPC to the Direct Connect Gateway using private virtual interfaces to route traffic directly to the on-premises locations.
D
Create a centralized Amazon Route 53 Private Hosted Zone in a shared services account for local DNS resolution, and deploy Route 53 Resolver inbound endpoints to handle hybrid queries without associating the zone with the spoke VPCs in the individual AWS accounts.
E
Route all outbound internet-bound traffic from the spoke VPCs to a single NAT Gateway located in a single Availability Zone in a centralized egress VPC to reduce NAT gateway hourly charges.

Answer

The solutions architect should configure the customer gateway routers to advertise local subnets with no prepending over Direct Connect, prepended with two AS hops over VPN, and prepended with four AS hops over the remote connections. In addition, the routers should assign the highest BGP local preference to AWS routes received over the local Direct Connect, followed by the local VPN, and then the cross-facility connection.

To satisfy both failover and symmetry requirements, routing controls must be applied on both sides of the hybrid network. Configuring the customer gateways to advertise local subnets with no prepending over the local Direct Connect, prepended with two AS hops over the local VPN, and prepended with four AS hops over the remote connections ensures the AWS Transit Gateway selects paths in the correct order. On the on-premises side, assigning local preference values to favor the local Direct Connect over the local VPN and the cross-facility path ensures symmetric routing and prevents traffic from unnecessarily crossing the inter-data-center link.

Step-by-Step Solution

Determine the path selection requirements for inbound traffic (AWS to on-premises). AWS Transit Gateway path selection evaluates AS-Path length when prefix lengths are equal. To establish the preference order of Local DX > Local VPN > Remote Connections, apply graduated AS-Path prepending at the customer gateways.

London customer gateway advertises 172.16.10.0/24 with 0, 2, and 4 AS prepends over London DX, London VPN, and Dublin connections respectively. Dublin does the same for 172.16.20.0/24.

This guarantees that AWS Transit Gateway selects the local DX as primary, local VPN as secondary, and remote paths only as a tertiary backup.

Determine the path selection requirements for outbound traffic (on-premises to AWS). The on-premises routers select paths based on local preference for BGP routes received from AWS.

On-premises routers assign Local Preference values: Local DX (e.g., 200) > Local VPN (e.g., 150) > Cross-facility (e.g., 100).

This prevents asymmetric routing by ensuring outbound traffic uses the same hierarchy of paths as inbound traffic.

Evaluate and eliminate distractors based on routing and architectural anti-patterns.

Eliminated options suggesting full-mesh peering (non-transitive over DXGW), unassociated Route 53 Private Hosted Zones, and non-redundant NAT Gateways.

These alternatives violate scaling, high availability, and functional routing requirements.

Key Concept

BGP routing policy control using AS-Path prepending and Local Preference within a multi-account, hybrid architecture utilizing AWS Transit Gateway and Direct Connect Gateway.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic