Examkin

Question

Difficulty: Very hardHybrid and Multi-Account Network Connectivity Design

An enterprise is implementing a multi-account AWS architecture with a hub-and-spoke transit network design using AWS Transit Gateway in the us-east-1 Region. The network consists of 80 spoke VPCs (aggregating under the 10.128.0.0/9 CIDR block) and a centralized Inspection VPC (10.0.0.0/16) containing a cluster of next-generation firewalls behind an AWS Gateway Load Balancer (GWLB). The security policy requires that all traffic between the spoke VPCs (east-west traffic) and all traffic from the spoke VPCs to the internet (north-south traffic) must be inspected by the firewall cluster. Outbound internet egress must occur via NAT Gateways deployed inside the Inspection VPC. The spoke VPCs must not have direct paths to the internet or to each other. Which routing configuration on the AWS Transit Gateway and within the Inspection VPC correctly implements this architecture while preventing routing loops and ensuring all spoke-to-spoke and egress traffic is inspected?

  1. On the Transit Gateway, create two route tables: Spoke-RT and Inspection-RT. Associate all spoke VPC attachments with Spoke-RT, disable route propagation from the spoke VPCs, and add a static route for 0.0.0.0/0 pointing to the Inspection VPC attachment. Associate the Inspection VPC attachment with Inspection-RT and enable route propagation from all spoke VPC attachments. Within the Inspection VPC, configure the Transit Gateway subnet route table to route 0.0.0.0/0 to the Gateway Load Balancer endpoint (GWLBe) in the same Availability Zone. Configure the GWLBe subnet route table to route 10.128.0.0/9 to the Transit Gateway and 0.0.0.0/0 to the NAT Gateway.Answer
  2. B
    On the Transit Gateway, create a single route table: Main-RT. Associate and enable route propagation for all spoke VPC attachments and the Inspection VPC attachment. Add a static route for 0.0.0.0/0 pointing to the Inspection VPC attachment. Within the Inspection VPC, route all incoming traffic from the Transit Gateway subnet to the GWLBe. Configure the GWLBe subnet route table to route all traffic (0.0.0.0/0) back to the Transit Gateway.
  3. C
    On the Transit Gateway, create two route tables: Spoke-RT and Inspection-RT. Associate all spoke VPC attachments with Spoke-RT, enable route propagation from all spoke VPCs, and add a static route for 0.0.0.0/0 pointing to the Inspection VPC attachment. Associate the Inspection VPC attachment with Inspection-RT, disable route propagation, and add static routes for each spoke VPC CIDR pointing to the respective spoke attachments. Within the Inspection VPC, configure the Transit Gateway subnet route table to route 10.128.0.0/9 to the GWLBe and 0.0.0.0/0 to the Transit Gateway.
  4. D
    On the Transit Gateway, create two route tables: Spoke-RT and Inspection-RT. Associate all spoke VPC attachments with Spoke-RT, disable route propagation from the spoke VPCs, and add a static route for 0.0.0.0/0 pointing to the Inspection VPC attachment. Associate the Inspection VPC attachment with Inspection-RT and enable route propagation from all spoke VPC attachments. Within the Inspection VPC, configure a single route table shared by both the Transit Gateway subnet and the GWLBe subnet that routes 0.0.0.0/0 to the GWLBe and 10.128.0.0/9 to the NAT Gateway.

Answer

Associate spoke attachments with a non-propagating route table that has a static default route to the Inspection VPC. Associate the Inspection VPC attachment with a separate route table that has route propagation enabled from the spoke VPCs. Inside the Inspection VPC, configure the TGW subnet to route to the GWLBe, and the GWLBe subnet to route 10.128.0.0/9 to the TGW and 0.0.0.0/0 to the NAT Gateway.
The correct routing pattern separates the inbound (spoke) and outbound (inspection return) traffic paths on the Transit Gateway using two distinct route tables (Spoke-RT and Inspection-RT). By disabling propagation on Spoke-RT and adding a static default route to the Inspection VPC, all traffic is forced through the firewalls. Associating the Inspection VPC attachment with Inspection-RT (which has propagation enabled) allows the Transit Gateway to route inspected traffic to the final spoke destination. Within the Inspection VPC, separate subnet route tables for the TGW attachment and GWLBe subnets prevent loops by ensuring that incoming traffic is sent to the firewall, while inspected traffic is either returned to the Transit Gateway (for spoke-to-spoke destinations) or sent to the NAT Gateways (for internet egress).

Step-by-Step Solution

1
Configure the Transit Gateway Spoke Route Table (Spoke-RT).
All traffic originating from spoke VPCs matches the static 0.0.0.0/0 route pointing to the Inspection VPC attachment.
By disabling route propagation on Spoke-RT, we prevent the Transit Gateway from learning specific spoke CIDRs, ensuring that both spoke-to-spoke and egress traffic are forced to the Inspection VPC instead of routing directly.
2
Configure the Transit Gateway Inspection Route Table (Inspection-RT).
The Inspection-RT learns all specific spoke VPC CIDRs through propagation.
This allows traffic that has been returned to the Transit Gateway from the Inspection VPC to be correctly routed to the destination spoke VPC.
3
Configure the Inspection VPC routing for incoming traffic.
Traffic arriving from the Transit Gateway at the TGW attachment subnet is routed to the local GWLBe.
This forwards all incoming packets to the Gateway Load Balancer and the associated firewall cluster for inspection.
4
Configure the Inspection VPC routing for post-inspection traffic.
Traffic returning to the GWLBe subnet is routed based on destination: 10.128.0.0/9 goes to the Transit Gateway, and 0.0.0.0/0 goes to the NAT Gateway.
This ensures that clean spoke-to-spoke traffic is sent back to the Transit Gateway to reach its destination, while clean internet-bound traffic is forwarded to the NAT Gateway for egress.

Key Concept

Centralized network security inspection using AWS Transit Gateway and Gateway Load Balancer (GWLB) with separate route tables to prevent routing loops.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic