Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A financial services company is designing a hybrid network connectivity solution for its multi-account environment on AWS. The environment consists of 1010 AWS accounts managed under AWS Organizations, with each account containing a single VPC in the `us-east-1` Region. The company also has an on-premises data center that must be securely connected to all VPCs. The solution must support transitive routing between the VPCs and the on-premises environment, minimize routing table management complexity, and support future expansion to new accounts. Which two actions should a solutions architect take to meet these requirements?

  1. Create an AWS Transit Gateway in a central network account, share it with the other AWS accounts using AWS Resource Access Manager (RAM), and attach each VPC to the Transit Gateway.Answer
  2. Configure an AWS Direct Connect connection with a transit virtual interface (transit VIF), attach it to a Direct Connect gateway, and associate the Direct Connect gateway with the AWS Transit Gateway.Answer
  3. C
    Establish VPC peering connections between all VPCs in a full-mesh configuration, and configure a private virtual interface (private VIF) on the Direct Connect connection to connect directly to each VPC.
  4. D
    Create a Direct Connect gateway, associate it directly with the virtual private gateways (VGWs) of all 1010 spoke VPCs, and use the Direct Connect gateway to route traffic transitively between the VPCs.
  5. E
    Deploy a single NAT Gateway in a shared network VPC, route all VPC-to-VPC traffic through it, and associate a Route 53 Private Hosted Zone with the shared VPC without associating it with the spoke VPCs.

Answer

Create an AWS Transit Gateway in a central network account, share it with the other AWS accounts using AWS Resource Access Manager (RAM), attach each VPC to the Transit Gateway, and configure an AWS Direct Connect connection with a transit virtual interface (transit VIF) attached to a Direct Connect gateway associated with the Transit Gateway.
The correct approach uses AWS Transit Gateway shared via AWS Resource Access Manager (RAM) to connect the spoke VPCs in a hub-and-spoke topology, minimizing routing complexity. To connect this setup to the on-premises network via AWS Direct Connect, a transit virtual interface (transit VIF) is configured and connected to a Direct Connect gateway, which is then associated with the Transit Gateway. This enables full transitive routing between the VPCs and the on-premises data center.

Step-by-Step Solution

1
Set up a centralized hub-and-spoke network topology.
Create an AWS Transit Gateway in a dedicated network account and share it via AWS RAM with the spoke VPC accounts.
This simplifies routing table management and supports scaling to new accounts without configuring manual peering connections.
2
Configure hybrid connectivity using AWS Direct Connect.
Establish a transit virtual interface (transit VIF) on the Direct Connect connection, terminate it at a Direct Connect gateway, and associate the Direct Connect gateway with the Transit Gateway.
A transit VIF is required to connect Direct Connect to an AWS Transit Gateway, enabling transitive routing to all attached spoke VPCs.

Key Concept

AWS Transit Gateway and Direct Connect Gateway integration with transit VIF for multi-account transitive routing.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic