An enterprise is designing a highly resilient hybrid network architecture to connect their… — AWS Certified Solutions Architect - Professional

An enterprise is designing a highly resilient hybrid network architecture to connect their on-premises data center (network range $172.16.0.0/16$ ) to AWS resources across two regions: `us-east-1` and `us-west-2`. In each region, they have deployed an AWS Transit Gateway (TGW), and the two TGWs are connected via inter-region peering. A $10\text{ Gbps}$ AWS Direct Connect (DX) connection is established to a Direct Connect Gateway (DXGW) that is associated with both TGWs. For redundancy, Site-to-Site VPN connections are established from the on-premises customer gateway (CGW) to both TGWs.

The enterprise has the following routing requirements:
1. Outbound traffic from AWS VPCs to on-premises must always prefer the local region's DX connection.
2. If the local DX connection fails, traffic must fail over to the local region's VPN connection.
3. Traffic must only traverse the inter-region TGW peering link to use the remote region's DX or VPN connection as a last resort if both local paths fail.

Which of the following routing configurations meets these requirements while preventing routing loops?

A
Configure the CGW to advertise the summary range $172.16.0.0/16$ over both DX and VPN connections. Enable route propagation from the DXGW and VPN attachments in both TGW route tables. In each TGW route table, configure a static route for the summary range $172.16.0.0/16$ pointing to the inter-region TGW peering attachment.
Configure the CGW to advertise specific subnets (for example, $172.16.1.0/24$ and $172.16.2.0/24$ ) over both DX and VPN connections. Enable route propagation from the DXGW and VPN attachments in both TGW route tables. In each TGW route table, configure a static route for the summary range $172.16.0.0/16$ pointing to the inter-region TGW peering attachment.Answer
C
Configure the CGW to advertise the summary range $172.16.0.0/16$ over the DX connection and specific subnets (for example, $172.16.1.0/24$ and $172.16.2.0/24$ ) over the VPN connection. Enable route propagation from the DXGW and VPN attachments in both TGW route tables. In each TGW route table, configure a static route for the summary range $172.16.0.0/16$ pointing to the inter-region TGW peering attachment.
D
Configure the CGW to advertise the summary range $172.16.0.0/16$ over both DX and VPN connections. Associate a Route 53 Private Hosted Zone for the on-premises domain with all VPCs in both regions. Configure a TGW route table static route for $172.16.0.0/16$ pointing to a Route 53 Resolver outbound endpoint in the remote region to route all on-premises traffic when local DX fails.

Answer

Advertising specific subnets over both Direct Connect and VPN connections, propagating them to Transit Gateway route tables, and adding a static route for the summary range pointing to the inter-region peering attachment.

The correct answer configuration utilizes the longest prefix match behavior to ensure correct routing priority. By advertising specific

/24

subnets locally over both Direct Connect and VPN, the Transit Gateway will prefer these local paths for destination IPs within those ranges over the

/16

static route pointing to the peering connection. Between the local Direct Connect and local VPN, AWS Transit Gateway naturally prefers the propagated Direct Connect routes over the propagated VPN routes for the same prefix length. If the local Direct Connect fails, the propagated

/24

route is withdrawn, and traffic fails over to the local VPN. Only if both local paths fail are the

/24

routes withdrawn, forcing traffic to fall back to the static

/16

route pointing to the inter-region TGW peering link.

Step-by-Step Solution

Analyze Transit Gateway route selection order.

Transit Gateway route selection order prioritizes the longest prefix match first, then static routes, then propagated routes. If two propagated routes are identical, Direct Connect is preferred over VPN.

This is critical to understanding why a static route for the same prefix as a propagated route will override it, causing sub-optimal routing or routing loops.

Implement longest prefix match bypass for static routes.

By advertising more specific subnets (e.g.,

/24

) over the local paths and configuring a summary static route (e.g.,

/16

) over the peering path, local traffic uses local paths due to longest prefix match.

This prevents the static route on the peering attachment from overriding the local paths under normal operations.

Determine path selection between local Direct Connect and VPN.

Since both DX and VPN propagate identical

/24

routes, the Transit Gateway automatically prefers the DXGW attachment over the VPN attachment.

This satisfies the requirement to always prefer the local region's DX connection under normal conditions.

Verify failover behavior.

If local DX fails, the local TGW routes via the local VPN

/24

propagated route. If both fail, both

/24

routes are withdrawn, and the local TGW routes via the static summary

/16

route to the peering attachment.

This ensures the inter-region peering link is only used as a last resort.

Key Concept

AWS Transit Gateway route evaluation priorities (Longest Prefix Match > Static > Propagated) and path selection between Direct Connect Gateway and VPN.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic