Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A retail company is designing a hybrid network to connect 2525 spoke VPCs in the `eu-west-1` Region to two on-premises data centers. The company has established a 10 Gbps10\text{ Gbps} AWS Direct Connect connection at each data center. To ensure high availability, they also want to deploy a backup AWS Site-to-Site VPN connection over the internet. The traffic between the on-premises data centers and the spoke VPCs must use the Direct Connect connections as the primary path and fail over to the VPN connection only during a total Direct Connect outage. Additionally, the spoke VPCs must be able to communicate with each other directly through the central hub. Which configuration should a solutions architect recommend to meet these requirements with the least administrative overhead?

  1. Deploy an AWS Transit Gateway and attach all 2525 spoke VPCs. Create a Direct Connect Gateway, associate it with the Transit Gateway, and establish Transit Virtual Interfaces. Configure an AWS Site-to-Site VPN connection as a VPN attachment on the Transit Gateway. Configure BGP on the on-premises routers to advertise the on-premises CIDR blocks over both paths, prepending the AS Path on the VPN connection to ensure the Direct Connect connection is preferred.Answer
  2. B
    Create a Direct Connect Gateway and associate it directly with the Virtual Private Gateways (VGWs) of all 2525 spoke VPCs. Establish individual Site-to-Site VPN connections from the data centers to the VGW of each spoke VPC. Configure the on-premises routers to advertise the local CIDR blocks to the Direct Connect Gateway and the VPNs, prioritizing the Direct Connect path using BGP local preference.
  3. C
    Deploy an AWS Transit Gateway and associate it with a Direct Connect Gateway. Connect the Direct Connect Gateway to a Virtual Private Gateway (VGW) attached to a central transit VPC. Establish VPC peering connections between the central transit VPC and the 2525 spoke VPCs, and configure the transit VPC route tables to route traffic transitively between the spoke VPCs and the on-premises data centers.
  4. D
    Deploy an AWS Transit Gateway and attach all 2525 spoke VPCs. Associate a Direct Connect Gateway with the Transit Gateway using Transit Virtual Interfaces, and attach a Site-to-Site VPN connection. For all outbound internet traffic from the spoke VPCs, route traffic through a centralized egress VPC using a single NAT Gateway deployed in a single Availability Zone to minimize deployment costs.

Answer

Deploy an AWS Transit Gateway and attach all spoke VPCs, associate a Direct Connect Gateway with Transit Virtual Interfaces, and establish a Site-to-Site VPN connection as an attachment on the Transit Gateway, using BGP AS Path prepending to prefer the Direct Connect path.
The correct option correctly uses AWS Transit Gateway to attach the 25 spoke VPCs, satisfying the inter-VPC communication requirement. It integrates both the primary Direct Connect connections (via a Direct Connect Gateway and Transit VIFs) and the backup VPN connection (via a Transit Gateway VPN attachment) into a single hub. By prepending the BGP AS Path on the VPN path, the Direct Connect connections are preferred for inbound traffic, and BGP routing ensures automatic failover during a Direct Connect outage.

Step-by-Step Solution

1
Centralize VPC connectivity using AWS Transit Gateway.
All 25 spoke VPCs are attached to the Transit Gateway, enabling inter-VPC communication and centralizing external connectivity.
Transit Gateway acts as a cloud router, supporting transitive routing between VPCs and external networks with low administrative overhead.
2
Configure the primary hybrid path using AWS Direct Connect and a Direct Connect Gateway.
A Direct Connect Gateway is associated with the Transit Gateway, and Transit VIFs are established from the on-premises data centers to the Direct Connect Gateway.
Transit VIFs are required to carry traffic between a Direct Connect Gateway and a Transit Gateway.
3
Configure the backup hybrid path using an AWS Site-to-Site VPN connection.
A VPN connection is created and attached directly to the Transit Gateway as a VPN attachment.
This provides a secondary path over the public internet that terminates on the same Transit Gateway hub.
4
Manage routing preferences using BGP path attributes.
Both paths advertise the same on-premises routes, but the VPN path has its BGP AS Path prepended multiple times.
AWS will prefer the Direct Connect path due to the shorter AS Path. If the Direct Connect path fails, BGP will automatically fail over to the VPN path.

Key Concept

AWS Transit Gateway acts as a centralized hub that supports transitive routing between VPCs, Direct Connect Gateways (via Transit VIFs), and Site-to-Site VPN attachments. By utilizing BGP attributes such as AS Path prepending, network traffic can be dynamically routed to prefer Direct Connect over a backup VPN connection.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic