Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A company is designing a hybrid network architecture for its multi-account AWS environment consisting of 20 VPCs spread across two AWS Regions. The architecture must enable any-to-any VPC-to-VPC communication and connect all VPCs to the company's on-premises data center. The connectivity design requires AWS Direct Connect as the primary connection, with a backup connection over the internet that automatically handles failover. The company wants to minimize administrative overhead. Which hybrid connectivity design meets these requirements?

  1. A
    Associate all VPCs directly with a centralized Direct Connect Gateway using Private Virtual Interfaces to route both hybrid and inter-VPC traffic. Establish backup Site-to-Site VPN connections to a Virtual Private Gateway in each VPC, utilizing BGP to route traffic.
  2. Deploy an AWS Transit Gateway in each AWS Region, peer the two Transit Gateways, and connect them to a centralized Direct Connect Gateway using Transit Virtual Interfaces. Establish backup Site-to-Site VPN connections to the Transit Gateways, configuring dynamic routing with BGP and AS-Path prepending to prefer the Direct Connect path.Answer
  3. C
    Deploy peered AWS Transit Gateways in both Regions connected to a Direct Connect Gateway and a backup VPN. Create a Route 53 Private Hosted Zone for custom domain resolution and associate the hosted zone directly with the Transit Gateways to automatically enable DNS resolution for all connected VPCs.
  4. D
    Deploy peered AWS Transit Gateways in both Regions connected to a Direct Connect Gateway. Route all hybrid, VPC-to-VPC, and outbound internet traffic through a single NAT Gateway deployed in a public subnet of a centralized transit VPC in one Availability Zone to minimize NAT Gateway costs.

Answer

Deploy peered AWS Transit Gateways connected to a Direct Connect Gateway via Transit VIFs, and set up backup Site-to-Site VPNs to the Transit Gateways using BGP with AS-Path prepending to prefer the Direct Connect path.
The correct design uses AWS Transit Gateways peered across Regions to enable scalable any-to-any VPC-to-VPC routing. By connecting the Transit Gateways to a centralized Direct Connect Gateway using Transit Virtual Interfaces, hybrid connectivity is established. Deploying Site-to-Site VPNs to the Transit Gateways with BGP dynamic routing and AS-Path prepending ensures the Direct Connect path is preferred during normal operation, while enabling automatic failover to the VPN backup when necessary.

Step-by-Step Solution

1
Analyze routing requirements for multi-region VPC-to-VPC and hybrid connectivity.
Identify that AWS Transit Gateway is required because it natively supports transitive routing (any-to-any VPC communication), whereas a Direct Connect Gateway alone does not route traffic between attached VPCs.
To satisfy the requirement of any-to-any VPC communication across both AWS Regions.
2
Determine the configuration for primary and backup hybrid connections.
Connect the regional Transit Gateways to a centralized Direct Connect Gateway using Transit Virtual Interfaces (Transit VIFs) for the primary connection, and deploy AWS Site-to-Site VPN connections directly to the Transit Gateways for the backup connection.
Transit VIFs allow Transit Gateways to attach to a Direct Connect Gateway. Site-to-Site VPN attachments on the Transit Gateways allow backup hybrid traffic to scale across all associated VPCs.
3
Configure failover routing policy.
Use Border Gateway Protocol (BGP) dynamic routing on both the Direct Connect and VPN connections, and configure AS-Path prepending on the VPN connection on-premises.
AS-Path prepending makes the VPN path look longer, ensuring AWS prefers the Direct Connect path under normal operating conditions while facilitating automatic dynamic failover if the Direct Connect link fails.

Key Concept

Hybrid and Multi-Account Network Connectivity Design using AWS Transit Gateway, Direct Connect Gateway, and dynamic VPN failover.
Estimated Time:2m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic