Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

An enterprise has a multi-account AWS environment managed under AWS Organizations. The company has segregated its workloads into a Production Organizational Unit (OU) and a Development OU. A centralized Transit Gateway (TGW) in a Shared Services account is used to interconnect all spoke VPCs across both OUs using AWS Resource Access Manager (RAM).

The company has a 10 Gbps AWS Direct Connect (DX) connection to connect its on-premises data center to AWS. The on-premises network uses Virtual Routing and Forwarding (VRF) to isolate production traffic from development traffic.

The Solutions Architect must design a hybrid connectivity solution that satisfies the following requirements:
- Maintain strict end-to-end logical isolation between Production and Development traffic across the AWS environment and the on-premises network.
- Production VPCs must only communicate with other Production VPCs and the on-premises production VRF.
- Development VPCs must only communicate with other Development VPCs and the on-premises development VRF.
- Minimize the number of Transit Gateways and Direct Connect connections to optimize cost and reduce administrative complexity.

Which TWO actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Create two separate AWS Direct Connect Gateways (DXGWs) and provision two Transit Virtual Interfaces (VIFs) on the dedicated Direct Connect connection, terminating one Transit VIF on each DXGW.Answer
  2. Associate both DXGWs with the centralized Transit Gateway. Create separate Transit Gateway route tables for Production and Development. Associate the Production DXGW attachment and the Production VPC attachments with the Production Transit Gateway route table, and associate the Development DXGW attachment and the Development VPC attachments with the Development Transit Gateway route table.Answer
  3. C
    Create a single AWS Direct Connect Gateway (DXGW) and associate it with the Transit Gateway. Establish a single Transit Virtual Interface (VIF) on the Direct Connect connection. Use BGP communities advertised from the customer gateway to dynamically associate traffic with different Transit Gateway route tables.
  4. D
    Deploy two separate Transit Gateways (one for Production and one for Development) in the Shared Services account. Create a single Direct Connect Gateway (DXGW) and associate it with both Transit Gateways to share the Direct Connect connection.
  5. E
    Create a single Direct Connect Gateway (DXGW) and associate it with the Transit Gateway. Use a single Transit Gateway route table for all traffic. Associate a Route 53 Private Hosted Zone (PHZ) with the Production VPCs and a separate PHZ with the Development VPCs, and use security groups to block cross-environment DNS resolution.

Answer

To establish end-to-end logical isolation while minimizing Transit Gateways, the Solutions Architect should provision two Transit VIFs on the Direct Connect connection terminating on two separate Direct Connect Gateways, and associate each Direct Connect Gateway with the centralized Transit Gateway, routing traffic through separate Production and Development Transit Gateway route tables.
To maintain end-to-end logical isolation while minimizing Transit Gateways, the Solutions Architect must separate the traffic at the Direct Connect layer. By creating two Transit VIFs and terminating them on separate Direct Connect Gateways (DXGWs), the on-premises VRFs are mapped to isolated virtual gateways. These DXGWs can both be associated with the same centralized Transit Gateway, creating two distinct attachments. Inside the Transit Gateway, separate route tables are created for Production and Development. The Production DXGW attachment and Production VPC attachments are associated with the Production route table, while the Development DXGW attachment and Development VPC attachments are associated with the Development route table, guaranteeing complete logical isolation of traffic both in transit and within AWS.

Step-by-Step Solution

1
Provision two Transit VIFs on the dedicated Direct Connect connection and terminate them on two separate DXGWs.
This establishes logical isolation at the physical and gateway layers, mapping the on-premises Production and Development VRFs to isolated AWS entry points.
Traffic must be separated before entering the centralized Transit Gateway; otherwise, the VRF separation on-premises cannot be maintained over the shared Direct Connect link.
2
Associate both DXGWs with the centralized Transit Gateway, creating two distinct DXGW attachments on the Transit Gateway.
Two distinct attachments are generated on the centralized Transit Gateway, representing the Production and Development paths from the Direct Connect connection.
This allows the Transit Gateway to treat incoming traffic from each DXGW as a separate attachment, which can then be associated with different route tables.
3
Implement routing isolation inside the Transit Gateway by creating separate Transit Gateway route tables for Production and Development.
Separate routing tables exist within the Transit Gateway, ensuring that routes from Production do not mix with routes from Development.
Route tables are the logical partition within a Transit Gateway that prevent cross-VRF/cross-OU traffic communication.
4
Associate the Production DXGW attachment and the Production VPC attachments with the Production Transit Gateway route table, and associate the Development DXGW attachment and the Development VPC attachments with the Development Transit Gateway route table.
Production traffic only uses the Production route table (having access to only Production VPCs and Production on-premises), and Development traffic only uses the Development route table.
This completes the end-to-end logical path segregation without requiring multiple Transit Gateways.

Key Concept

End-to-end logical isolation in hybrid AWS networks using a single Transit Gateway, multiple Direct Connect Gateways, and separated Transit Gateway route tables.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic