A financial services company is designing a hybrid network architecture for its AWS multi-… — AWS Certified Solutions Architect - Professional

A financial services company is designing a hybrid network architecture for its AWS multi-account environment. The environment consists of several Production spoke VPCs and Non-Production spoke VPCs, all connected to a central AWS Transit Gateway (TGW) in a network transit account. The company has the following requirements for connectivity to their on-premises network ( $192.168.0.0/16$ ):

- Production traffic must utilize a primary $10$ Gbps Direct Connect (DX) connection at DX-Location-A. If DX-Location-A fails, traffic must fail over to a $10$ Gbps DX connection at DX-Location-B. If both DX connections fail, production traffic must fail over to a backup Site-to-Site VPN connection.
- Non-Production traffic must only use the DX connection at DX-Location-B to preserve bandwidth on the primary connection. It must never use DX-Location-A or the Site-to-Site VPN under any circumstances.
- Asymmetric routing between the on-premises network and AWS must be prevented.

Which combination of architectural and routing configurations must the Solutions Architect implement to meet these requirements? (Select TWO.)

Establish two separate Direct Connect Gateways: DXGW-A connected to the Transit VIF of DX-Location-A, and DXGW-B connected to the Transit VIF of DX-Location-B. Associate both DXGWs and the Site-to-Site VPN with the TGW. Create separate TGW route tables for Production and Non-Production. Associate the Non-Production TGW route table only with the DXGW-B attachment, and the Production TGW route table with DXGW-A, DXGW-B, and the VPN attachments.Answer
Advertise the on-premises prefix $192.168.0.0/16$ via BGP over all paths. On DX-Location-B, prepend the AS-Path $3$ times, and on the VPN connection, prepend the AS-Path $6$ times. In the TGW association for DXGW-B, configure prefix-level AS-Path prepending for the Production VPC CIDR blocks advertised to the on-premises router.Answer
C
Deploy a single Direct Connect Gateway (DXGW) and terminate both Transit VIFs on it. Create separate TGW route tables for Production and Non-Production. In the Non-Production TGW route table, create a static route for $192.168.0.0/16$ pointing to the DXGW attachment, and configure a TGW route table policy to filter out traffic destined for the DX-Location-A VIF.
D
Establish a single Direct Connect Gateway (DXGW) and terminate both Transit VIFs on it. Use BGP communities advertised from the on-premises router (such as local preference community $7224:7300$ for DX-Location-A and $7224:7100$ for DX-Location-B) to force the TGW to route Non-Production traffic exclusively through DX-Location-B and Production traffic through DX-Location-A.
E
Set up a Transit Gateway peering connection between the Production and Non-Production TGW route tables. Configure the customer gateway to advertise more specific prefixes (such as $/24$ subnets of $192.168.0.0/16$ ) over the VPN connection to force failover routing, and associate a shared Route 53 Private Hosted Zone (PHZ) across all VPCs to resolve the gateway endpoints.

Answer

Establish separate Direct Connect Gateways (DXGW-A and DXGW-B) to create two distinct Transit Gateway attachments, which allows the Non-Production TGW route table to only associate with DXGW-B while the Production TGW route table associates with both DXGWs and the VPN. Use BGP AS-Path prepending on the on-premises router and on the TGW-to-DXGW-B association for the Production VPC prefixes to enforce symmetric active/passive path selection.

To satisfy the requirements, the Solutions Architect must separate the egress paths at the Transit Gateway (TGW) level. Because a single Direct Connect Gateway (DXGW) attachment represents all underlying virtual interfaces (VIFs), a single DXGW cannot selectively route different spoke VPCs to specific DX locations. By establishing two distinct DXGWs (DXGW-A and DXGW-B), the TGW has separate attachments for each path, allowing the Non-Production TGW route table to only associate with the DXGW-B attachment. For Production, using BGP AS-Path prepending on DX-Location-B (

3

times) and the VPN (

6

times) ensures AWS prefers DX-Location-A for outbound traffic, while prepending the AS-Path on the TGW-to-DXGW-B association for the Production VPC prefixes ensures the on-premises network prefers DX-Location-A for inbound traffic to Production, preventing asymmetric routing.

Step-by-Step Solution

Address the egress path isolation requirement for Non-Production traffic.

Determine that a single Direct Connect Gateway (DXGW) attachment to a Transit Gateway (TGW) cannot separate egress traffic by individual Direct Connect locations. To solve this, two separate DXGWs (DXGW-A and DXGW-B) must be used to create two distinct TGW attachments.

This configuration allows the Non-Production TGW route table to be associated only with the DXGW-B attachment, preventing Non-Production traffic from using DX-Location-A.

Configure the TGW route table associations and propagations for Production and Non-Production.

Associate Production spoke VPCs with the Production TGW route table and propagate DXGW-A, DXGW-B, and VPN attachments. Associate Non-Production spoke VPCs with the Non-Production TGW route table and propagate only the DXGW-B attachment.

This guarantees that Non-Production traffic has no route to the VPN or DX-Location-A, satisfying the cost-preservation and isolation constraints.

Influence outbound routing from AWS to on-premises.

Advertise the

192.168.0.0/16

prefix over all paths, prepending the AS-Path

3

times on DX-Location-B and

6

times on the VPN.

This ensures that AWS prefers DX-Location-A for Production outbound traffic, failing over to DX-Location-B second, and the VPN third.

Influence inbound routing from on-premises to AWS to prevent asymmetric routing.

Configure prefix-level AS-Path prepending on the TGW-to-DXGW-B association for the Production VPC CIDR blocks advertised to the on-premises router.

This forces the on-premises router to prefer sending Production-destined traffic through DX-Location-A, keeping the traffic paths symmetric.

Key Concept

TGW routing isolation using multiple Direct Connect Gateways combined with BGP path selection attributes (AS-Path prepending) to prevent asymmetric routing in hybrid multi-account topologies.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic