Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network architecture for its multi-account AWS environment consisting of 12 spoke VPCs distributed across us-east-1 and us-west-2. The organization needs to connect its on-premises data center to all VPCs. The solution must use a primary 10 Gbps AWS Direct Connect connection and a backup Site-to-Site VPN connection. The architecture must dynamically route traffic, prefer the Direct Connect path during normal operations, fail over automatically to the VPN path, and minimize administrative overhead.

Which TWO configuration steps should a solutions architect perform to meet these requirements? (Select TWO.)

  1. Deploy an AWS Transit Gateway in each Region, associate them with a single Direct Connect Gateway, and establish a transit virtual interface (VIF) on the Direct Connect connection to terminate at the Direct Connect Gateway.Answer
  2. Establish Site-to-Site VPN connections terminated directly on the Transit Gateways in both Regions, and advertise the same on-premises IP prefixes via BGP over both the Direct Connect and VPN connections.Answer
  3. C
    Establish a Private Virtual Interface (VIF) on the Direct Connect connection, associate it directly with a Direct Connect Gateway, and attach the Direct Connect Gateway to all 12 spoke VPCs to bypass Transit Gateway routing limits.
  4. D
    Configure a Route 53 Private Hosted Zone (PHZ) for the on-premises domain, associate the PHZ directly with the Direct Connect Gateway, and configure the on-premises DNS servers to forward queries to the inbound Route 53 Resolver endpoint.
  5. E
    Deploy a single NAT Gateway in each spoke VPC's public subnet and update the Route Tables of all private subnets to point to the NAT Gateway for cross-Region Transit Gateway routing.

Answer

To establish the desired hybrid network, the solutions architect must deploy an AWS Transit Gateway in each Region, associate them with a single Direct Connect Gateway, and establish a transit virtual interface on the Direct Connect connection. Additionally, they must establish Site-to-Site VPN connections terminated directly on the Transit Gateways and advertise the same prefixes over both paths.
Deploying an AWS Transit Gateway in each Region and associating them with a single Direct Connect Gateway using a transit virtual interface enables multi-account, multi-Region hybrid routing. Establishing BGP-based Site-to-Site VPN connections terminated on the Transit Gateways allows automatic failover because AWS automatically prioritizes Direct Connect paths over VPN paths when the same prefix is advertised over both.

Step-by-Step Solution

1
Deploy regional Transit Gateways and associate them with a centralized Direct Connect Gateway using a Transit VIF.
Establishes the primary high-bandwidth network path to both Regions for all 12 spoke VPCs.
Allows sharing the 10 Gbps Direct Connect connection across multiple accounts and Regions while avoiding individual VPC limits.
2
Configure Site-to-Site VPN connections from the on-premises router directly to the Transit Gateways in both Regions.
Provides backup connectivity paths in case of Direct Connect failure.
By terminating the VPNs on the Transit Gateways, they can act as failover paths for the same VPCs.
3
Advertise the same prefixes over both the Direct Connect BGP session and the VPN BGP sessions.
AWS routing automatically prefers the Direct Connect path over the VPN path for outbound traffic.
AWS network routing standards prioritize Direct Connect over VPN when identical routes are received.

Key Concept

AWS Transit Gateway integration with Direct Connect Gateway and Site-to-Site VPN for resilient, multi-Region hybrid routing.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic