Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

A global financial enterprise is migrating its workload to a multi-account, multi-region AWS environment. They have 5050 spoke VPCs distributed across the `us-east-1` and `eu-west-1` Regions. The enterprise must establish a hybrid network architecture connecting these VPCs to their on-premises data centers in New York and London. The design must meet the following requirements:
- Primary high-bandwidth connectivity must use AWS Direct Connect.
- Private IP communication is required between all spoke VPCs across both Regions and the on-premises data centers.
- An IPsec VPN over the public internet must serve as an active-passive backup to the Direct Connect connections.
- The design must minimize administrative overhead and avoid manual routing table updates when VPCs are added or removed.

Which TWO actions should the solutions architect take to meet these connectivity requirements?

  1. Deploy AWS Transit Gateway in both the `us-east-1` and `eu-west-1` Regions, peer the two Transit Gateways, attach the local spoke VPCs to their regional Transit Gateway, and associate both Transit Gateways with a single AWS Direct Connect Gateway connected to the on-premises locations.Answer
  2. Establish AWS Site-to-Site VPN connections from the on-premises data centers to the Transit Gateway in each Region, configure BGP dynamic routing, and set a higher BGP local preference on the customer gateway routers for prefixes received via Direct Connect.Answer
  3. C
    Create a single AWS Direct Connect Gateway and associate it directly with all 5050 spoke VPCs across both Regions to enable transit routing between the VPCs and the on-premises networks without deploying Transit Gateways.
  4. D
    Create a centralized Route 53 Private Hosted Zone (PHZ) in a shared services VPC and associate the PHZ directly with the peered Transit Gateways to automatically enable cross-account hybrid DNS resolution for all connected spoke VPCs.
  5. E
    Deploy a single NAT Gateway in a centralized egress VPC in `us-east-1`, and route all internet-bound traffic from the spoke VPCs in both Regions through this NAT Gateway to minimize hourly NAT Gateway costs.

Answer

Deploy AWS Transit Gateway in both Regions, peer the Transit Gateways, attach local VPCs, and associate them with a single Direct Connect Gateway. Additionally, establish AWS Site-to-Site VPN connections to the Transit Gateways and configure the customer gateway to prefer Direct Connect paths using BGP local preference.
Deploying AWS Transit Gateway in each Region and peering them allows for scalable, transitive inter-VPC communication. Connecting them to a single Direct Connect Gateway allows both Regions to access the on-premises network over Direct Connect. Establishing Site-to-Site VPN connections directly to the Transit Gateways provides a backup path. Adjusting BGP local preference on the customer gateways ensures that inbound traffic to AWS prefers the high-bandwidth Direct Connect path over the VPN connection.

Step-by-Step Solution

1
Configure the core Transit Gateway architecture.
AWS Transit Gateways are deployed in both `us-east-1` and `eu-west-1`. Local VPCs in each region are attached to their respective regional Transit Gateway. The two Transit Gateways are peered to allow inter-region VPC-to-VPC routing.
This establishes a scalable hub-and-spoke topology across regions, minimizing routing table management overhead.
2
Configure hybrid connectivity via Direct Connect.
A single Direct Connect Gateway is created and associated with both Transit Gateways. On-premises routers establish BGP sessions over Direct Connect transit virtual interfaces.
Direct Connect Gateway serves as the centralized hybrid router, routing traffic between the on-premises data centers and both regional Transit Gateways.
3
Establish the backup VPN path and configure routing preference.
AWS Site-to-Site VPN connections are created to the Transit Gateways. The customer gateway routers are configured to prefer routes received via Direct Connect by setting a higher BGP local preference.
This ensures that traffic from on-premises to AWS defaults to Direct Connect and fails over to VPN only when Direct Connect is unavailable. Outbound traffic from AWS to on-premises automatically prefers Direct Connect over VPN in Transit Gateway path selection.

Key Concept

Transit Gateway hybrid routing with Direct Connect Gateway and BGP failover preferences.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic