A financial services company is designing a hybrid network architecture to connect 15 spok… — AWS Certified Solutions Architect - Professional

A financial services company is designing a hybrid network architecture to connect $15$ spoke VPCs in a single AWS Region to its on-premises data center. The company has a dedicated $10\text{ Gbps}$ AWS Direct Connect connection and wants to establish an AWS Site-to-Site VPN connection over the public internet as a backup. The architecture must ensure that all spoke VPCs can communicate with the data center, that the VPN is only utilized if the Direct Connect connection becomes unavailable, and that administrative overhead is minimized. Which approach should the solutions architect recommend?

A
Create a Virtual Private Gateway (VGW) in each of the $15$ spoke VPCs. Associate all $15$ VGWs with a single Direct Connect Gateway (DXGW) connected via a Private Virtual Interface (Private VIF). Establish a separate Site-to-Site VPN connection from the on-premises data center to each of the $15$ VGWs, using BGP routing with AS PATH prepending on the VPN connections.
Deploy an AWS Transit Gateway (TGW) and attach the $15$ spoke VPCs to it. Associate the TGW with a Direct Connect Gateway (DXGW) connected via a Transit Virtual Interface (Transit VIF). Establish a single AWS Site-to-Site VPN connection from the on-premises data center to the TGW. Advertise identical prefixes over BGP for both paths, and prepend the AS PATH on the VPN connection to make it the less preferred path.Answer
C
Deploy an AWS Transit Gateway (TGW) and attach the $15$ spoke VPCs to it. Associate the TGW with a Direct Connect Gateway (DXGW) connected via a Private Virtual Interface (Private VIF). Establish a single AWS Site-to-Site VPN connection from the on-premises data center to the TGW. Configure static routes on the TGW pointing to the DXGW with a lower metric than the VPN routes.
D
Establish a hub-and-spoke VPC Peering topology by peering all $15$ spoke VPCs with a central transit VPC. Associate the central VPC's Virtual Private Gateway (VGW) with a Direct Connect Gateway (DXGW) connected via a Private Virtual Interface (Private VIF). Create a single Site-to-Site VPN connection to the central VPC's VGW. Configure the route tables of the spoke VPCs to route on-premises traffic through the central VPC.

Answer

Deploy an AWS Transit Gateway (TGW) and attach the

15

spoke VPCs to it. Associate the TGW with a Direct Connect Gateway (DXGW) connected via a Transit Virtual Interface (Transit VIF). Establish a single AWS Site-to-Site VPN connection from the on-premises data center to the TGW. Advertise identical prefixes over BGP for both paths, and prepend the AS PATH on the VPN connection to make it the less preferred path.

The correct solution uses AWS Transit Gateway to aggregate connectivity for the

15

spoke VPCs, bypassing the

10

VGW attachment limit of a Direct Connect Gateway. It utilizes a Transit Virtual Interface (Transit VIF) to connect the Transit Gateway to the Direct Connect Gateway, which is the only supported VIF type for Transit Gateway. Active/passive routing is achieved dynamically using BGP by advertising identical prefixes on both paths and prepending the AS PATH on the VPN connection, ensuring AWS prefers the shorter AS PATH on the Direct Connect connection under normal operations.

Step-by-Step Solution

Evaluate the scaling requirement for the

15

spoke VPCs.

Identify that a standard Direct Connect Gateway directly associated with Virtual Private Gateways (VGWs) is limited to a maximum of

10

VPCs, necessitating the use of AWS Transit Gateway (TGW) to aggregate the attachments.

Ensures the solution scales to meet the requirements of

15

VPCs without hitting service limits.

Determine the correct interface type for connecting the Transit Gateway to the Direct Connect Gateway.

Confirm that a Transit Virtual Interface (Transit VIF) is required on the Direct Connect connection to terminate on the Direct Connect Gateway and associate with the TGW.

Private VIFs only support VGW associations and cannot be used to connect to a Transit Gateway.

Configure backup routing and path preference.

Set up a Site-to-Site VPN connection to the Transit Gateway, advertise the same routes via BGP, and prepend the AS PATH on the VPN connection.

Allows BGP to automatically route traffic over the Direct Connect path as the primary route, while dynamically failing over to the VPN path only if the Direct Connect path goes offline.

Key Concept

Scale hybrid connectivity and configure active/passive routing over AWS Direct Connect and VPN using AWS Transit Gateway and Direct Connect Gateway.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic